chainlesschain 0.163.6 → 0.163.8

package/src/lib/agent-schedule-store.js

@@ -22,7 +22,7 @@
 import fs from "fs";
 import os from "os";
 import path from "path";
-import { randomUUID } from "crypto";
+import { createHash, randomUUID } from "crypto";
 import { isEntryExpired, effectiveFireAt } from "./schedule-planner.js";
 import { SUBAGENT_PERMISSION_MODES } from "./subagent-contract.js";
 import { parseGoalCondition } from "./goal-condition-engine.js";
@@ -30,6 +30,7 @@ import { normalizeActionClass } from "./unattended-action-policy.js";
 import { withFileLock } from "./with-file-lock.js";
 
 export const SCHEDULE_KINDS = Object.freeze(["wakeup", "cron", "monitor"]);
+export const AGENDA_SCHEDULER_MIGRATION_SCHEMA_VERSION = 1;
 
 /** A valid absolute-epoch-ms expiry, or null (never expires). */
 function normalizeExpiresAt(v) {
@@ -168,6 +169,87 @@ function hasLiveExecutionLease(entry, now) {
   return Number(entry.executionLease?.expiresAt) > Number(now);
 }
 
+function stableJsonValue(value) {
+  if (Array.isArray(value)) return value.map(stableJsonValue);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.keys(value)
+        .sort()
+        .map((key) => [key, stableJsonValue(value[key])]),
+    );
+  }
+  return value;
+}
+
+function agendaMigrationSource(entry) {
+  const source = { ...entry };
+  delete source.executionLease;
+  delete source.schedulerExecution;
+  delete source.schedulerMigration;
+  delete source.firedAt;
+  delete source.lastRunAt;
+  delete source.runs;
+  delete source.nextAt;
+  delete source.lastCheckAt;
+  delete source.checks;
+  delete source.lastMtimeMs;
+  delete source.lastEventId;
+  delete source.lastAuthority;
+  delete source.status;
+  return source;
+}
+
+export function agendaMigrationSourceDigest(entry) {
+  return createHash("sha256")
+    .update("chainlesschain.agenda.scheduler-migration-source.v1\0", "utf8")
+    .update(
+      JSON.stringify(stableJsonValue(agendaMigrationSource(entry))),
+      "utf8",
+    )
+    .digest("hex");
+}
+
+export function agendaMigrationSourceSnapshot(entry) {
+  return stableJsonValue(agendaMigrationSource(entry));
+}
+
+function schedulerMigrationFence(entry, now) {
+  const migration = entry.schedulerMigration;
+  if (
+    migration?.schemaVersion !== AGENDA_SCHEDULER_MIGRATION_SCHEMA_VERSION ||
+    typeof migration.retirementToken !== "string" ||
+    migration.retirementToken.length === 0
+  ) {
+    return false;
+  }
+  return (
+    hasLiveExecutionLease(entry, now) &&
+    entry.executionLease?.owner ===
+      `scheduler-migration:${migration.retirementToken}`
+  );
+}
+
+function applySchedulerMigrationFence(entry, now) {
+  const token = entry.schedulerMigration?.retirementToken;
+  if (typeof token !== "string" || token.length === 0) return false;
+  entry.executionLease = {
+    owner: `scheduler-migration:${token}`,
+    claimedAt: now,
+    expiresAt: Number.MAX_SAFE_INTEGER,
+  };
+  return true;
+}
+
+function normalizeMigrationField(value, field) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw agendaStoreError(
+      "AGENDA_SCHEDULER_MIGRATION_INVALID",
+      `Agenda scheduler migration ${field} is required`,
+    );
+  }
+  return value.trim();
+}
+
 function agendaStoreError(code, message, { retryable = false, retryAt } = {}) {
   const error = new Error(message);
   error.code = code;
@@ -176,6 +258,21 @@ function agendaStoreError(code, message, { retryable = false, retryAt } = {}) {
   return error;
 }
 
+function agendaPersistenceError(
+  code,
+  message,
+  cause,
+  { filePath, commitState } = {},
+) {
+  const error = new Error(message, { cause });
+  error.name = "AgendaScheduleStoreError";
+  error.code = code;
+  error.filePath = filePath;
+  if (typeof cause?.code === "string") error.fsCode = cause.code;
+  if (commitState) error.commitState = commitState;
+  return error;
+}
+
 function applyScheduledAgentSuccess(entry, atMs) {
   if (entry.kind === "wakeup") {
     entry.status = "fired";
@@ -584,9 +681,16 @@ export function previousCronTime(expr, fromMs, options = {}) {
 // ─── store ───────────────────────────────────────────────────────────────
 
 export class AgentScheduleStore {
-  constructor({ dir = null, now = () => Date.now() } = {}) {
+  constructor({
+    dir = null,
+    now = () => Date.now(),
+    fileSystem = fs,
+    platform = process.platform,
+  } = {}) {
     this.dir = dir || agentScheduleDir();
     this._now = typeof now === "function" ? now : () => now;
+    this._fs = fileSystem;
+    this._platform = platform;
   }
 
   _file(kind) {
@@ -594,37 +698,124 @@ export class AgentScheduleStore {
   }
 
   _ensureDir() {
-    fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+    this._fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
   }
 
-  _readAll(kind) {
+  _readAll(kind, { failOnMalformed = false } = {}) {
+    const filePath = this._file(kind);
     let raw;
     try {
-      raw = fs.readFileSync(this._file(kind), "utf-8");
-    } catch {
-      return [];
+      raw = this._fs.readFileSync(filePath, "utf-8");
+    } catch (cause) {
+      if (cause?.code === "ENOENT") return [];
+      throw agendaPersistenceError(
+        "AGENDA_SCHEDULE_STORE_READ_FAILED",
+        `Agenda schedule store read failed (${filePath})`,
+        cause,
+        { filePath },
+      );
     }
     const entries = [];
+    let lineNumber = 0;
     for (const line of raw.split("\n")) {
+      lineNumber += 1;
       const trimmed = line.trim();
       if (!trimmed) continue;
       try {
-        entries.push(JSON.parse(trimmed));
-      } catch {
+        const entry = JSON.parse(trimmed);
+        if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+          throw new TypeError("schedule entry must be an object");
+        }
+        entries.push(entry);
+      } catch (cause) {
+        if (failOnMalformed) {
+          throw agendaPersistenceError(
+            "AGENDA_SCHEDULE_STORE_MALFORMED",
+            `Agenda schedule store contains malformed JSONL (${filePath}:${lineNumber})`,
+            cause,
+            { filePath },
+          );
+        }
         // Skip a corrupt line rather than throwing — one bad append must not
-        // poison the whole store (per-row resilience, like the JSON.parse sweep).
+        // poison advisory reads. Authoritative mutations opt into strict mode
+        // so they never replace a store after silently dropping durable rows.
       }
     }
     return entries;
   }
 
   _writeAll(kind, entries) {
-    this._ensureDir();
+    const filePath = this._file(kind);
     const body = entries.map((entry) => JSON.stringify(entry)).join("\n");
-    fs.writeFileSync(this._file(kind), body ? body + "\n" : "", {
-      encoding: "utf-8",
-      mode: 0o600,
-    });
+    const contents = Buffer.from(body ? `${body}\n` : "", "utf8");
+    const temporaryPath = path.join(
+      this.dir,
+      `.${path.basename(filePath)}.${process.pid}.${randomUUID()}.tmp`,
+    );
+    let descriptor = null;
+    let renamed = false;
+
+    try {
+      this._ensureDir();
+      descriptor = this._fs.openSync(temporaryPath, "wx", 0o600);
+      let offset = 0;
+      while (offset < contents.length) {
+        const written = this._fs.writeSync(
+          descriptor,
+          contents,
+          offset,
+          contents.length - offset,
+          null,
+        );
+        if (!Number.isSafeInteger(written) || written <= 0) {
+          const cause = new Error("write returned no progress");
+          cause.code = "EIO";
+          throw cause;
+        }
+        offset += written;
+      }
+      this._fs.fsyncSync(descriptor);
+      this._fs.closeSync(descriptor);
+      descriptor = null;
+      this._fs.renameSync(temporaryPath, filePath);
+      renamed = true;
+
+      if (this._platform !== "win32") {
+        const directoryDescriptor = this._fs.openSync(this.dir, "r");
+        try {
+          this._fs.fsyncSync(directoryDescriptor);
+        } finally {
+          this._fs.closeSync(directoryDescriptor);
+        }
+      }
+    } catch (cause) {
+      if (descriptor !== null) {
+        try {
+          this._fs.closeSync(descriptor);
+        } catch {
+          // Preserve the original persistence failure.
+        }
+      }
+      if (!renamed) {
+        try {
+          this._fs.unlinkSync(temporaryPath);
+        } catch {
+          // Best-effort orphan cleanup; the authoritative file is untouched.
+        }
+      }
+      throw agendaPersistenceError(
+        "AGENDA_SCHEDULE_STORE_WRITE_FAILED",
+        `Agenda schedule store write failed (${filePath})`,
+        cause,
+        {
+          filePath,
+          // A failure before rename leaves the old generation authoritative.
+          // A directory-fsync failure after rename makes crash durability
+          // unknowable even though an immediate read sees the new generation.
+          commitState: renamed ? "unknown" : "not-committed",
+        },
+      );
+    }
   }
 
   // ── create ──────────────────────────────────────────────────────────────
@@ -659,7 +850,7 @@ export class AgentScheduleStore {
       createdAt: now,
       status: "pending",
     };
-    const entries = this._readAll("wakeup");
+    const entries = this._readAll("wakeup", { failOnMalformed: true });
     entries.push(entry);
     this._writeAll("wakeup", entries);
     return entry;
@@ -704,7 +895,7 @@ export class AgentScheduleStore {
       runs: 0,
       status: "active",
     };
-    const entries = this._readAll("cron");
+    const entries = this._readAll("cron", { failOnMalformed: true });
     entries.push(entry);
     this._writeAll("cron", entries);
     return entry;
@@ -800,7 +991,7 @@ export class AgentScheduleStore {
       checks: 0,
       status: "active",
     };
-    const entries = this._readAll("monitor");
+    const entries = this._readAll("monitor", { failOnMalformed: true });
     entries.push(entry);
     this._writeAll("monitor", entries);
     return entry;
@@ -820,15 +1011,246 @@ export class AgentScheduleStore {
     return this.list().find((entry) => entry.id === id) || null;
   }
 
+  prepareSchedulerMigration(
+    id,
+    { migrationId, sourceDigest, targetJobId } = {},
+  ) {
+    const migration = normalizeMigrationField(migrationId, "migrationId");
+    const expectedDigest = normalizeMigrationField(
+      sourceDigest,
+      "sourceDigest",
+    );
+    const target = normalizeMigrationField(targetJobId, "targetJobId");
+    this._ensureDir();
+    return withFileLock(
+      path.join(this.dir, ".agenda-claims"),
+      () => {
+        for (const kind of SCHEDULE_KINDS) {
+          const entries = this._readAll(kind, { failOnMalformed: true });
+          const entry = entries.find((candidate) => candidate.id === id);
+          if (!entry) continue;
+          if (!isSchedulableStatus(entry)) {
+            throw agendaStoreError(
+              "AGENDA_SCHEDULER_ENTRY_TERMINAL",
+              `Agenda entry is not schedulable: ${id}`,
+            );
+          }
+          const actualDigest = agendaMigrationSourceDigest(entry);
+          if (actualDigest !== expectedDigest) {
+            throw agendaStoreError(
+              "AGENDA_SCHEDULER_MIGRATION_SOURCE_CHANGED",
+              `Agenda entry changed before migration: ${id}`,
+            );
+          }
+          const prior = entry.schedulerMigration;
+          if (prior) {
+            if (
+              prior.schemaVersion !==
+                AGENDA_SCHEDULER_MIGRATION_SCHEMA_VERSION ||
+              prior.sourceDigest !== expectedDigest ||
+              prior.targetJobId !== target ||
+              prior.migrationId !== migration ||
+              prior.state !== "prepared"
+            ) {
+              throw agendaStoreError(
+                "AGENDA_SCHEDULER_MIGRATION_CONFLICT",
+                `Agenda entry already belongs to another scheduler migration: ${id}`,
+              );
+            }
+            return entry;
+          }
+          entry.schedulerMigration = {
+            schemaVersion: AGENDA_SCHEDULER_MIGRATION_SCHEMA_VERSION,
+            state: "prepared",
+            migrationId: migration,
+            sourceDigest: expectedDigest,
+            targetJobId: target,
+            preparedAt: this._now(),
+          };
+          this._writeAll(kind, entries);
+          return entry;
+        }
+        throw agendaStoreError(
+          "AGENDA_SCHEDULER_ENTRY_NOT_FOUND",
+          `Agenda entry does not exist: ${id}`,
+        );
+      },
+      { failIfUnavailable: true },
+    );
+  }
+
+  retireForSchedulerMigration(
+    id,
+    {
+      migrationId,
+      sourceDigest,
+      targetJobId,
+      retirementToken,
+      atMs = null,
+    } = {},
+  ) {
+    const migration = normalizeMigrationField(migrationId, "migrationId");
+    const expectedDigest = normalizeMigrationField(
+      sourceDigest,
+      "sourceDigest",
+    );
+    const target = normalizeMigrationField(targetJobId, "targetJobId");
+    const token = normalizeMigrationField(retirementToken, "retirementToken");
+    const now = atMs != null ? Number(atMs) : this._now();
+    this._ensureDir();
+    return withFileLock(
+      path.join(this.dir, ".agenda-claims"),
+      () => {
+        for (const kind of SCHEDULE_KINDS) {
+          const entries = this._readAll(kind, { failOnMalformed: true });
+          const entry = entries.find((candidate) => candidate.id === id);
+          if (!entry) continue;
+          const prior = entry.schedulerMigration;
+          if (
+            prior?.schemaVersion !==
+              AGENDA_SCHEDULER_MIGRATION_SCHEMA_VERSION ||
+            prior.sourceDigest !== expectedDigest ||
+            prior.targetJobId !== target ||
+            prior.migrationId !== migration ||
+            !["prepared", "retired"].includes(prior.state)
+          ) {
+            throw agendaStoreError(
+              "AGENDA_SCHEDULER_MIGRATION_CONFLICT",
+              `Agenda migration preparation changed before retirement: ${id}`,
+            );
+          }
+          if (prior.state === "retired") {
+            if (
+              prior.retirementToken !== token ||
+              !schedulerMigrationFence(entry, now)
+            ) {
+              throw agendaStoreError(
+                "AGENDA_SCHEDULER_MIGRATION_CONFLICT",
+                `Agenda migration retirement fence changed: ${id}`,
+              );
+            }
+            return entry;
+          }
+          if (agendaMigrationSourceDigest(entry) !== expectedDigest) {
+            throw agendaStoreError(
+              "AGENDA_SCHEDULER_MIGRATION_SOURCE_CHANGED",
+              `Agenda entry changed before retirement: ${id}`,
+            );
+          }
+          if (hasLiveExecutionLease(entry, now)) {
+            throw agendaStoreError(
+              "AGENDA_SCHEDULER_LEGACY_CLAIM_ACTIVE",
+              `Agenda entry is already claimed by a legacy runner: ${id}`,
+              {
+                retryable: true,
+                retryAt: Number(entry.executionLease.expiresAt),
+              },
+            );
+          }
+          entry.schedulerMigration = {
+            ...prior,
+            state: "retired",
+            retirementToken: token,
+            retiredAt: now,
+          };
+          applySchedulerMigrationFence(entry, now);
+          this._writeAll(kind, entries);
+          return entry;
+        }
+        throw agendaStoreError(
+          "AGENDA_SCHEDULER_ENTRY_NOT_FOUND",
+          `Agenda entry does not exist: ${id}`,
+        );
+      },
+      { failIfUnavailable: true },
+    );
+  }
+
+  restoreFromSchedulerMigration(
+    id,
+    { migrationId, sourceDigest, targetJobId, retirementToken } = {},
+  ) {
+    const migrationIdValue = normalizeMigrationField(
+      migrationId,
+      "migrationId",
+    );
+    const expectedDigest = normalizeMigrationField(
+      sourceDigest,
+      "sourceDigest",
+    );
+    const target = normalizeMigrationField(targetJobId, "targetJobId");
+    const token =
+      retirementToken === null || retirementToken === undefined
+        ? null
+        : normalizeMigrationField(retirementToken, "retirementToken");
+    this._ensureDir();
+    return withFileLock(
+      path.join(this.dir, ".agenda-claims"),
+      () => {
+        for (const kind of SCHEDULE_KINDS) {
+          const entries = this._readAll(kind, { failOnMalformed: true });
+          const entry = entries.find((candidate) => candidate.id === id);
+          if (!entry) continue;
+          const migration = entry.schedulerMigration;
+          if (!migration) {
+            if (
+              agendaMigrationSourceDigest(entry) !== expectedDigest ||
+              String(entry.executionLease?.owner || "").startsWith(
+                "scheduler-migration:",
+              )
+            ) {
+              throw agendaStoreError(
+                "AGENDA_SCHEDULER_MIGRATION_CONFLICT",
+                `Agenda source changed after rollback restoration: ${id}`,
+              );
+            }
+            return entry;
+          }
+          if (
+            migration?.schemaVersion !==
+              AGENDA_SCHEDULER_MIGRATION_SCHEMA_VERSION ||
+            migration.sourceDigest !== expectedDigest ||
+            agendaMigrationSourceDigest(entry) !== expectedDigest ||
+            migration.targetJobId !== target ||
+            migration.migrationId !== migrationIdValue ||
+            !["prepared", "retired"].includes(migration.state) ||
+            (migration.state === "retired" &&
+              (migration.retirementToken !== token ||
+                entry.executionLease?.owner !== `scheduler-migration:${token}`))
+          ) {
+            throw agendaStoreError(
+              "AGENDA_SCHEDULER_MIGRATION_CONFLICT",
+              `Agenda migration fence changed before rollback: ${id}`,
+            );
+          }
+          delete entry.schedulerMigration;
+          if (migration.state === "retired") delete entry.executionLease;
+          this._writeAll(kind, entries);
+          return entry;
+        }
+        throw agendaStoreError(
+          "AGENDA_SCHEDULER_ENTRY_NOT_FOUND",
+          `Agenda entry does not exist: ${id}`,
+        );
+      },
+      { failIfUnavailable: true },
+    );
+  }
+
   /** Entries whose time has come (pending wakeup / active cron|monitor). */
-  due(kind = null, atMs = null) {
+  due(kind = null, atMs = null, { schedulerMigration = false } = {}) {
     const now = atMs != null ? atMs : this._now();
     return this.list(kind).filter((entry) => {
       // An entry past its expiry never fires — even if it is not yet retired
       // (defense-in-depth: retireExpired need not have run first).
       if (isEntryExpired(entry, now)) return false;
       if (!isSchedulableStatus(entry)) return false;
-      if (hasLiveExecutionLease(entry, now)) return false;
+      if (
+        hasLiveExecutionLease(entry, now) &&
+        !(schedulerMigration && schedulerMigrationFence(entry, now))
+      ) {
+        return false;
+      }
       // The effective fire time applies the entry's OWN deterministic jitter
       // (`entry.jitterMs`, default 0 → base fire time, byte-identical to the
       // prior `dueAt`/`nextAt` comparison). A jittered entry fires slightly
@@ -858,7 +1280,9 @@ export class AgentScheduleStore {
       () => {
         const claimed = [];
         for (const scheduleKind of kinds) {
-          const entries = this._readAll(scheduleKind);
+          const entries = this._readAll(scheduleKind, {
+            failOnMalformed: true,
+          });
           let changed = false;
           for (const entry of entries) {
             if (!isSchedulableStatus(entry) || isEntryExpired(entry, now))
@@ -929,7 +1353,7 @@ export class AgentScheduleStore {
       path.join(this.dir, ".agenda-claims"),
       () => {
         for (const kind of SCHEDULE_KINDS) {
-          const entries = this._readAll(kind);
+          const entries = this._readAll(kind, { failOnMalformed: true });
           const entry = entries.find((candidate) => candidate.id === id);
           if (!entry) continue;
           const prior = entry.schedulerExecution;
@@ -946,7 +1370,8 @@ export class AgentScheduleStore {
           ) {
             return entry;
           }
-          if (hasLiveExecutionLease(entry, now)) {
+          const migrationFence = schedulerMigrationFence(entry, now);
+          if (hasLiveExecutionLease(entry, now) && !migrationFence) {
             throw agendaStoreError(
               "AGENDA_SCHEDULER_LEGACY_CLAIM_ACTIVE",
               `Agenda entry is already claimed by a legacy runner: ${id}`,
@@ -1016,7 +1441,7 @@ export class AgentScheduleStore {
       path.join(this.dir, ".agenda-claims"),
       () => {
         for (const kind of SCHEDULE_KINDS) {
-          const entries = this._readAll(kind);
+          const entries = this._readAll(kind, { failOnMalformed: true });
           const entry = entries.find((candidate) => candidate.id === id);
           if (!entry) continue;
           const evidence = entry.schedulerExecution;
@@ -1051,6 +1476,102 @@ export class AgentScheduleStore {
             ...(outcome === "succeeded" ? { result: storedResult } : { error }),
           };
           delete entry.executionLease;
+          if (isSchedulableStatus(entry))
+            applySchedulerMigrationFence(entry, now);
+          this._writeAll(kind, entries);
+          return entry;
+        }
+        throw agendaStoreError(
+          "AGENDA_SCHEDULER_ENTRY_NOT_FOUND",
+          `Agenda entry does not exist: ${id}`,
+        );
+      },
+      { failIfUnavailable: true },
+    );
+  }
+
+  /**
+   * Resolve start-only scheduler evidence after an operator has verified the
+   * external outcome. This is intentionally separate from normal completion:
+   * it preserves the adjudication identity and can release the non-expiring
+   * legacy fence without pretending that a machine observed a terminal result.
+   */
+  adjudicateSchedulerExecution(
+    id,
+    {
+      occurrenceId,
+      snapshotDigest,
+      attempt,
+      decision,
+      requestId,
+      atMs = null,
+    } = {},
+  ) {
+    if (!["confirmed_applied", "confirmed_not_applied"].includes(decision)) {
+      throw agendaStoreError(
+        "AGENDA_SCHEDULER_ADJUDICATION_INVALID",
+        "Agenda scheduler adjudication decision is invalid",
+      );
+    }
+    const now = atMs != null ? Number(atMs) : this._now();
+    this._ensureDir();
+    return withFileLock(
+      path.join(this.dir, ".agenda-claims"),
+      () => {
+        for (const kind of SCHEDULE_KINDS) {
+          const entries = this._readAll(kind, { failOnMalformed: true });
+          const entry = entries.find((candidate) => candidate.id === id);
+          if (!entry) continue;
+          const evidence = entry.schedulerExecution;
+          if (
+            evidence?.occurrenceId === occurrenceId &&
+            evidence.snapshotDigest === snapshotDigest &&
+            evidence.adjudication?.requestId === requestId &&
+            evidence.adjudication.decision === decision &&
+            evidence.status ===
+              (decision === "confirmed_applied"
+                ? "adjudicated_applied"
+                : "adjudicated_not_applied")
+          ) {
+            return entry;
+          }
+          if (
+            !evidence ||
+            evidence.occurrenceId !== occurrenceId ||
+            evidence.snapshotDigest !== snapshotDigest ||
+            !Number.isSafeInteger(evidence.attempt) ||
+            evidence.attempt < 1 ||
+            evidence.attempt > attempt ||
+            evidence.status !== "running"
+          ) {
+            throw agendaStoreError(
+              "AGENDA_SCHEDULER_ADJUDICATION_EVIDENCE_MISMATCH",
+              `Agenda scheduler adjudication evidence does not match: ${id}`,
+            );
+          }
+          if (decision === "confirmed_applied") {
+            if (entry.kind === "monitor") {
+              // A generic operator decision proves the prior check ran, but
+              // not whether its observation matched. Pause the monitor rather
+              // than inventing a domain result or rearming a duplicate check.
+              entry.status = "adjudicated";
+              entry.lastCheckAt = now;
+            } else {
+              applyScheduledAgentSuccess(entry, now);
+            }
+          }
+          entry.schedulerExecution = {
+            ...evidence,
+            status:
+              decision === "confirmed_applied"
+                ? "adjudicated_applied"
+                : "adjudicated_not_applied",
+            endedAt: now,
+            adjudication: { requestId, decision },
+          };
+          delete entry.executionLease;
+          if (isSchedulableStatus(entry))
+            applySchedulerMigrationFence(entry, now);
           this._writeAll(kind, entries);
           return entry;
         }
@@ -1074,7 +1595,7 @@ export class AgentScheduleStore {
     const now = atMs != null ? atMs : this._now();
     const retired = [];
     for (const kind of SCHEDULE_KINDS) {
-      const entries = this._readAll(kind);
+      const entries = this._readAll(kind, { failOnMalformed: true });
       let changed = false;
       for (const entry of entries) {
         if (isSchedulableStatus(entry) && isEntryExpired(entry, now)) {
@@ -1091,7 +1612,7 @@ export class AgentScheduleStore {
 
   cancel(id) {
     for (const kind of SCHEDULE_KINDS) {
-      const entries = this._readAll(kind);
+      const entries = this._readAll(kind, { failOnMalformed: true });
       const idx = entries.findIndex((entry) => entry.id === id);
       if (idx >= 0) {
         const [removed] = entries.splice(idx, 1);
@@ -1112,7 +1633,7 @@ export class AgentScheduleStore {
   pruneTerminal({ before = Infinity } = {}) {
     const removed = [];
     for (const kind of SCHEDULE_KINDS) {
-      const entries = this._readAll(kind);
+      const entries = this._readAll(kind, { failOnMalformed: true });
       const keep = entries.filter((entry) => {
         const prunable =
           TERMINAL_SET.has(entry.status) && terminalAt(entry) <= before;
@@ -1176,7 +1697,7 @@ export class AgentScheduleStore {
   }
 
   _mutate(kind, id, fn) {
-    const entries = this._readAll(kind);
+    const entries = this._readAll(kind, { failOnMalformed: true });
     const entry = entries.find((e) => e.id === id);
     if (!entry) return null;
     fn(entry);