mixdog 1.3.4 → 1.4.0

package/src/session-runtime/services/agent-tool/worker-index.mjs

@@ -6,71 +6,33 @@
 //   row-store      — the file, its parse cache, the locked writer
 //   mutation-batch — spawn-path writes coalesced onto one immediate
 //   row-liveness   — stale-active detection and idle settlement
+//   row-reads          — scoped row and tag-tombstone reads
+//   row-writes         — upserts, removal, the owner's release mark
+//   awaiting-user-sync — approval waits kept in step with the runtime
+//   restart-settlement — rows a process exit or restart ended
+//   disposal           — drain, then release the registrations
 import { resolve } from 'node:path';
 
 import { WORKER_INDEX_FILE } from './tool-def.mjs';
-import { clean, positiveInt, registerExitFlush, rowMatchesContext } from './helpers.mjs';
-import { applyWorkerRowUpsert, recoverTagTombstoneOwner, workerRowKey } from './worker-rows.mjs';
-import {
-  applyAwaitingUser,
-  awaitingUserWouldChange,
-  clearAwaitingUser,
-  registerApprovalWaitWriter,
-} from './worker-index/approval-wait.mjs';
+import { registerExitFlush, rowMatchesContext } from './helpers.mjs';
+import { registerApprovalWaitWriter } from './worker-index/approval-wait.mjs';
+import { createAwaitingUserSync } from './worker-index/awaiting-user-sync.mjs';
+import { createIndexDisposal } from './worker-index/disposal.mjs';
 import { createMutationBatch } from './worker-index/mutation-batch.mjs';
-import {
-  createRowLiveness,
-  isActiveWorkerRow,
-  isStaleApprovalWait,
-  isUnnotifiedRestartFailure,
-  PROCESS_RESTART_FAILURE,
-  runtimeDied,
-} from './worker-index/row-liveness.mjs';
-import { normalizeWorkerRows, workerRowFromSession } from './worker-index/row-shape.mjs';
+import { createRestartSettlement } from './worker-index/restart-settlement.mjs';
+import { createWorkerRowReads } from './worker-index/row-reads.mjs';
 import { acquireWorkerRowStore } from './worker-index/row-store.mjs';
-import { findTagTombstone, tagTombstoneKey, tombstoneBlocksWork } from '../../../runtime/shared/agent-reap-state.mjs';
+import { createWorkerRowWrites } from './worker-index/row-writes.mjs';
+import { onSessionTurnStart } from '../../../runtime/shared/session-activity-signal.mjs';
 
 export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCwds }) {
   const file = dataDir ? resolve(dataDir, WORKER_INDEX_FILE) : null;
   // Shared with every other worker index of this process over the same file.
   const { store, release: releaseStore } = acquireWorkerRowStore(file);
-  // Sessions whose deferred rows still wait in the batch; reconciled once the
-  // batch lands in the store.
-  const unreconciled = new Set();
-  const batch = createMutationBatch(store.write, () => {
-    const ids = [...unreconciled];
-    unreconciled.clear();
-    for (const id of ids) reconcileAwaitingUser(id);
-  });
-  const liveness = createRowLiveness({
-    cfgMod,
-    isSessionRunning: (sessionId) => mgr.isSessionTurnInFlight?.(sessionId) === true,
-  });
-  // Rows this process marked active; settled as failed on exit (their turn
-  // dies with the process) so a crash of the host never leaves them
-  // "running" forever.
-  const activeWorkerKeys = new Set();
-
-  function readWorkerRows(context = {}) {
-    const { rows, tombstones: savedTombstones } = store.readSnapshot();
-    if (rows.length === 0) return rows;
-    const tombstones = new Map(recoverTombstoneOwners(savedTombstones).map((row) => [tagTombstoneKey(row), row]));
-    return rows.filter(
-      (row) => rowMatchesContext(row, context) && !tombstoneBlocksWork(row, findTagTombstone(row, tombstones))
-    );
-  }
-
-  function readAllTagTombstones() {
-    return recoverTombstoneOwners(store.readTombstones());
-  }
-
-  function recoverTombstoneOwners(rows) {
-    if (!rows.some((row) => !clean(row.parentSessionId || row.ownerSessionId))) return rows;
-    const sessions = typeof mgr.listSessions === 'function' ? mgr.listSessions({ includeClosed: true }) : [];
-    // Resolve legacy ownership against all sessions, never just the caller's
-    // scope: filtering first would conceal an ambiguous sibling owner.
-    return rows.map((row) => recoverTagTombstoneOwner(row, sessions));
-  }
+  const awaitingUser = createAwaitingUserSync(store, mgr);
+  const batch = createMutationBatch(store.write, awaitingUser.reconcileDeferred);
+  const settlement = createRestartSettlement({ store, cfgMod, mgr });
+  const { readWorkerRows, readAllTagTombstones } = createWorkerRowReads(store, mgr);
 
   // Every upsert also projects the row into the in-memory tag maps so tag
   // lookups never wait on a disk round-trip.
@@ -80,68 +42,20 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
     if (row.cwd) tagCwds.set(row.tag, row.cwd);
   }
 
-  function upsertWorkerRow(row, { defer = false } = {}) {
-    const normalized = normalizeWorkerRows({ workers: [row] })[0];
-    if (!normalized) return false;
-    const key = workerRowKey(normalized);
-    if (isActiveWorkerRow(normalized)) activeWorkerKeys.add(key);
-    else activeWorkerKeys.delete(key);
-    bindTag(normalized);
-    if (defer) {
-      if (!file) return false;
-      unreconciled.add(normalized.sessionId);
-      return batch.queue((byKey) => applyWorkerRowUpsert(byKey, normalized));
-    }
-    store.write((byKey) => {
-      applyWorkerRowUpsert(byKey, normalized);
-    });
-    reconcileAwaitingUser(normalized.sessionId);
-    return true;
-  }
-
-  const rowFromSession = (session, fallbackTag = '', extra = {}) =>
-    workerRowFromSession(session, fallbackTag, extra, (sessionId) => mgr.getSessionRuntime?.(sessionId));
-
-  // A row whose owner is still owed its restart failure stays: closing the
-  // worker (a process exit closes every one) must not lose that result.
-  function removeWorkerRow({ tag = '', sessionId = '' } = {}) {
-    const targetTag = clean(tag);
-    const targetSessionId = clean(sessionId);
-    batch.flush();
-    store.write((byKey) => {
-      for (const [key, row] of [...byKey.entries()]) {
-        if (isUnnotifiedRestartFailure(row)) continue;
-        if ((targetSessionId && row.sessionId === targetSessionId) || (targetTag && row.tag === targetTag)) {
-          byKey.delete(key);
-        }
-      }
-    });
-  }
-
-  /** Persist (or clear) a worker's approval wait as a field update fenced to
-   *  the session and its turn (`turnAt`, ms): a row whose turn started later is
-   *  left alone. Writes only when a row of that session exists and would
-   *  change, so a Lead's own approvals cost nothing; a row that is not in the
-   *  store yet takes the wait when it lands (reconcileAwaitingUser). */
-  function setAwaitingUser(sessionId, awaitingUser, { turnAt = 0 } = {}) {
-    const fence = {
-      sessionId: clean(sessionId),
-      awaitingUser: awaitingUser === 'approval' ? 'approval' : null,
-      turnAt: Number(turnAt) || 0,
-    };
-    if (!fence.sessionId || !awaitingUserWouldChange(store.readAll(), fence)) return false;
-    store.update((byKey) => applyAwaitingUser(byKey, fence));
-    return true;
-  }
+  const { upsertWorkerRow, rowFromSession, markReleased, removeWorkerRow } = createWorkerRowWrites({
+    file,
+    store,
+    batch,
+    mgr,
+    bindTag,
+    settlement,
+    awaitingUser,
+  });
 
-  /** The runtime of a session this process runs is the authority on its
-   *  approval wait (the runtime-liveness counter behind `awaitingUser`): every
-   *  row it creates or refreshes takes that state, so a missed or stale
-   *  transition heals on the next write. No runtime here: not ours to judge. */
-  function reconcileAwaitingUser(sessionId) {
-    const runtime = mgr.getSessionRuntime?.(sessionId);
-    if (runtime) setAwaitingUser(sessionId, runtime.awaitingUser, { turnAt: runtime.askStartedAt });
-  }
+  // The one boundary every turn start passes through (user input, an answer,
+  // auto-resume, a send, a room/bot turn): the session is in use again, for
+  // good, whatever started the turn.
+  const stopTurnStartListener = onSessionTurnStart((sessionId) => store.clearReleased(sessionId));
 
   function refreshTagsFromIndex(context = {}) {
     const rows = readWorkerRows(context);
@@ -149,142 +63,27 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
     return rows;
   }
 
-  function flushActiveWorkerRows() {
-    if (!activeWorkerKeys.size) return;
-    const keys = [...activeWorkerKeys];
-    activeWorkerKeys.clear();
-    const now = Date.now();
-    store.write((byKey) => {
-      for (const key of keys) {
-        const current = byKey.get(key);
-        if (!current || positiveInt(current.runtimePid) !== process.pid) continue;
-        if (isActiveWorkerRow(current)) {
-          byKey.set(key, liveness.failedRow(current, now, PROCESS_RESTART_FAILURE, true));
-        }
-      }
-    });
-  }
-
-  // Startup recovery: stale active rows settle — as failed when another
-  // process ran their turn (it is gone, or is the predecessor still shutting
-  // down: either way the turn never finished), otherwise to idle — and an
-  // approval wait left behind by a runtime that is gone (daemon restart) is
-  // cleared. `deadOnly` (later sweeps) settles only rows whose runtime is
-  // provably dead, never a live process's quiet turn.
-  function recoverStaleWorkerRows({ deadOnly = false } = {}) {
-    const now = Date.now();
-    const rows = store.readAll();
-    const isStale = deadOnly
-      ? (row) => isActiveWorkerRow(row) && runtimeDied(row)
-      : (row) => liveness.isStaleActive(row, now);
-    const staleActive = rows.filter(isStale);
-    const staleWaits = rows.some(isStaleApprovalWait);
-    if (!staleActive.length && !staleWaits) return false;
-    if (staleActive.length) {
-      store.write((byKey) => {
-        for (const row of staleActive) {
-          const key = workerRowKey(row);
-          const current = byKey.get(key);
-          if (!current || !isStale(current)) continue;
-          const ranElsewhere = positiveInt(current.runtimePid) && positiveInt(current.runtimePid) !== process.pid;
-          byKey.set(
-            key,
-            ranElsewhere ? liveness.failedRow(current, now, PROCESS_RESTART_FAILURE) : liveness.idleRow(current, now)
-          );
-        }
-      });
-    }
-    if (staleWaits) store.update((byKey) => clearAwaitingUser(byKey, isStaleApprovalWait));
-    return true;
-  }
-
-  /** Rows whose turn a process restart ended and whose owner has not been told
-   *  yet — whoever settled the row (this process at startup, or the
-   *  predecessor's exit flush). Read-only: the caller enqueues the owner's
-   *  notification durably, THEN calls `markRestartNotified`, so a crash in
-   *  between retries (the notification's stable id makes the retry exactly-once). */
-  function pendingRestartFailures() {
-    return store.readAll().filter(isUnnotifiedRestartFailure);
-  }
-
-  /** Stamp these rows as told, once their notification is durably queued. */
-  function markRestartNotified(rows) {
-    const stamp = new Date().toISOString();
-    store.write((byKey) => {
-      for (const row of rows) {
-        const key = workerRowKey(row);
-        const current = byKey.get(key);
-        if (!current || !isUnnotifiedRestartFailure(current)) continue;
-        byKey.set(key, { ...current, restartNotified: stamp });
-      }
-    });
-  }
-
   function flushWorkerIndexOnExit() {
     batch.flush();
-    flushActiveWorkerRows();
+    settlement.flushActiveWorkerRows();
     // Writes are persisted by an async queue; the loop is gone at exit. This
     // is the best-effort last resort: a persist still running is left alone
     // (the graceful shutdown path drains before exit).
     store.flushSync();
   }
 
-  recoverStaleWorkerRows();
+  settlement.recoverStaleWorkerRows();
   const unregisterExitFlush = registerExitFlush(flushWorkerIndexOnExit);
-  const unregisterApprovalWaits = registerApprovalWaitWriter(file, setAwaitingUser);
-  let disposed = false;
-  let disposePromise = null;
+  const unregisterApprovalWaits = registerApprovalWaitWriter(file, awaitingUser.setAwaitingUser);
 
   function teardown() {
+    stopTurnStartListener();
     unregisterExitFlush();
     unregisterApprovalWaits();
     releaseStore();
   }
 
-  async function drainThenTeardown() {
-    batch.flush();
-    await store.flush();
-    teardown();
-  }
-
-  /** Persist queued rows, then release the exit registration. Active rows are
-   *  NOT settled: they are keyed by process pid, which every inline runtime in
-   *  the daemon shares, so settling here would idle other runtimes' workers.
-   *  When the sync flush cannot run (this process's async writer holds the
-   *  lock) the exit hook and store ref stay until the async drain settles. */
-  function dispose() {
-    if (disposed) return;
-    disposed = true;
-    let flushed = false;
-    try {
-      batch.flush();
-      flushed = store.flushSync();
-    } catch {}
-    if (flushed) {
-      teardown();
-      return;
-    }
-    disposePromise = drainThenTeardown().catch(reopenAfterFailedDrain);
-  }
-
-  /** A failed drain tears nothing down; allow a later dispose to retry it. */
-  function reopenAfterFailedDrain() {
-    disposed = false;
-    disposePromise = null;
-  }
-
-  /** Awaitable dispose: drain everything, then tear down. A failed drain
-   *  rejects and leaves the registrations in place. */
-  function disposeAsync() {
-    if (!disposePromise) {
-      disposed = true;
-      disposePromise = drainThenTeardown().catch((error) => {
-        reopenAfterFailedDrain();
-        throw error;
-      });
-    }
-    return disposePromise;
-  }
+  const { dispose, disposeAsync } = createIndexDisposal({ batch, store, teardown });
 
   return {
     dispose,
@@ -310,12 +109,13 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
     upsertWorkerSessionDeferred: (session, fallbackTag = '', extra = {}) =>
       upsertWorkerRow(rowFromSession(session, fallbackTag, extra), { defer: true }),
     removeWorkerRow,
-    setAwaitingUser,
+    markReleased,
+    setAwaitingUser: awaitingUser.setAwaitingUser,
     refreshTagsFromIndex,
-    flushActiveWorkerRows,
+    flushActiveWorkerRows: settlement.flushActiveWorkerRows,
     flushWorkerIndexOnExit,
-    recoverStaleWorkerRows,
-    pendingRestartFailures,
-    markRestartNotified,
+    recoverStaleWorkerRows: settlement.recoverStaleWorkerRows,
+    pendingRestartFailures: settlement.pendingRestartFailures,
+    markRestartNotified: settlement.markRestartNotified,
   };
 }

package/src/session-runtime/services/agent-tool/worker-rows.mjs

@@ -129,6 +129,9 @@ export function applyWorkerRowUpsert(byKey, normalized) {
       merged[field] = prev[field];
     }
   }
+  // A whole-row write carries the session's release state: a row written
+  // without it (the agent was reused) is no longer released.
+  if (normalized.released !== true) delete merged.released;
   // `awaitingUser` is not decided here: the worker row store keeps the current
   // row's flag across every whole-row write and drops it once the row settles.
   byKey.set(key, {

package/src/session-runtime/services/channel-admin.mjs

@@ -11,6 +11,7 @@ import {
   listSchedules as dbListSchedules,
   getSchedule as dbGetSchedule,
   upsertSchedule,
+  renameSchedule as dbRenameSchedule,
   deleteSchedule as dbDeleteSchedule,
   setEnabled as dbSetEnabled,
 } from '../../runtime/channels/lib/schedules-db.mjs';
@@ -26,6 +27,7 @@ import { normalizeAutomationAttachments } from '../../runtime/shared/automation-
 import { assertRoutineOwner, routineOwnerProblem } from '../routine-owner.mjs';
 import { hasEnabledAutomation } from '../../runtime/shared/automation-presence.mjs';
 import { resolveScheduleTimezone, validateScheduleCron } from '../../runtime/shared/schedule-time.mjs';
+import { scheduleNameTakenError, scheduleRenameRunningError } from '../../runtime/channels/lib/schedule-errors.mjs';
 import { pgClusterExists } from '../../runtime/memory/lib/pg/adapter.mjs';
 import { resolvePluginData } from '../../runtime/shared/plugin-paths.mjs';
 import { readHookPublicBase } from '../../runtime/channels/lib/webhook/relay-tunnel.mjs';
@@ -60,7 +62,6 @@ function normalizeChannelsConfig(raw = {}) {
   return {
     ...CHANNELS_DEFAULTS,
     ...stored,
-    access: { ...CHANNELS_DEFAULTS.access, ...(stored.access || {}) },
     webhook: { ...CHANNELS_DEFAULTS.webhook, ...(stored.webhook || {}) },
   };
 }
@@ -187,7 +188,7 @@ function parseAtDatetime(at) {
 
 // Map the store's def shape onto the flat display shape every schedule reader
 // (channelSetup, renderChannelStatus, TUI pickers) consumes: `.time` renders
-// the cron or the one-shot datetime, `.route` the channel/session target.
+// the cron or the one-shot datetime.
 function scheduleToDisplay(s, ownerProblem = '') {
   return {
     name: s.name,
@@ -200,7 +201,6 @@ function scheduleToDisplay(s, ownerProblem = '') {
     attachments: s.attachments || undefined,
     enabled: s.enabled !== false,
     instructions: s.prompt,
-    route: 'session',
     // The bot it belongs to: each run is a turn in that bot's chat.
     owner: s.ownerAgentId || MIXY_AGENT_ID,
     // Why it is paused for its owner (routine-owner.mjs); absent when it runs.
@@ -250,7 +250,8 @@ function scheduleOwner(owner, existing) {
   return existing?.ownerAgentId || MIXY_AGENT_ID;
 }
 
-/** Each owner's problem (routine-owner.mjs), probed once per owner. */
+/** Each owner's problem (routine-owner.mjs) for its stored rows, probed once
+ *  per owner. */
 function ownerProblems() {
   const seen = new Map();
   return (ownerAgentId) => {
@@ -258,7 +259,7 @@ function ownerProblems() {
     if (!seen.has(owner))
       seen.set(
         owner,
-        routineOwnerProblem(owner).catch(() => '')
+        routineOwnerProblem(owner, null, { stored: true }).catch(() => '')
       );
     return seen.get(owner);
   };
@@ -270,26 +271,62 @@ export async function listSchedules() {
   return Promise.all(rows.map(async (row) => scheduleToDisplay(row, await problemOf(row.ownerAgentId))));
 }
 
+/**
+ * Run `step` (the move of schedule `name`'s row) with `name` reserved against
+ * runs in this process (the app's "Run now"). Refused when one is in flight.
+ */
+export async function withScheduleRenameReserved(name, step) {
+  const { beginAutomationRename } = await import('../owned-automation-run.mjs');
+  const release = beginAutomationRename('schedule', name);
+  if (!release) throw scheduleRenameRunningError(name);
+  try {
+    return await step();
+  } finally {
+    release();
+  }
+}
+
+// Whether `next` fires when `existing` does: the same cron in the same zone (a
+// stored row without a zone runs in the default one, as the scheduler arms
+// it), or the same instant, whatever its spelling.
+function sameTiming(existing, next) {
+  const instant = (value) => (value ? new Date(value).getTime() : null);
+  if ((existing.whenCron || null) !== next.whenCron) return false;
+  if (next.whenCron && resolveScheduleTimezone(existing.timezone) !== next.timezone) return false;
+  return instant(existing.whenAt) === instant(next.whenAt);
+}
+
+// The rename when no channels worker owns the scheduler: this process's runs
+// are the only ones there are.
+export const renameScheduleHere = (oldName, def, opts) =>
+  withScheduleRenameReserved(oldName, () => dbRenameSchedule(oldName, def, opts));
+
 // Register or update a schedule in the PG store. Recurring input maps `time`
 // (+ optional `days`) to a cron; one-shot input maps an `at` datetime; the two
 // are mutually exclusive (also enforced by the store's when_at/when_cron XOR).
 // Every schedule runs as a turn in its owner bot's chat; a bot that does not
 // exist (no representative bot yet, an archived bot) cannot own one.
-export async function saveSchedule({
-  name,
-  description = '',
-  time,
-  at,
-  timezone,
-  days,
-  cwd,
-  attachments,
-  enabled,
-  instructions,
-  owner,
-  overwrite = false,
-} = {}) {
+export async function saveSchedule(
+  {
+    name,
+    description = '',
+    time,
+    at,
+    timezone,
+    days,
+    cwd,
+    attachments,
+    enabled,
+    instructions,
+    owner,
+    overwrite = false,
+    newName,
+  } = {},
+  { rename = renameScheduleHere } = {}
+) {
   const id = assertScheduleName(name);
+  const renameTo = newName != null && String(newName).trim() !== '' ? assertScheduleName(newName) : id;
+  const renaming = renameTo !== id;
   const body = String(instructions || '').trim();
   if (!body) throw new Error('schedule instructions are required');
   const hasTime = time != null && String(time).trim() !== '';
@@ -297,22 +334,21 @@ export async function saveSchedule({
   if (hasTime && hasAt) throw new Error('provide either `time` (recurring) or `at` (one-shot), not both');
   if (!hasTime && !hasAt) throw new Error('either `time` (recurring cron) or `at` (one-shot datetime) is required');
   const existing = await dbGetSchedule(id);
+  if (renaming && !existing) throw new Error(`schedule "${id}" does not exist`);
   if (overwrite !== true && existing) {
-    throw new Error(`schedule "${id}" already exists`);
+    throw scheduleNameTakenError(id);
   }
   const ownerAgentId = scheduleOwner(owner, existing);
   await assertRoutineOwner(ownerAgentId);
   const whenCron = hasTime ? validateScheduleCron(foldDaysIntoCron(normalizeCron(time), days)) : null;
   const whenAt = hasAt ? parseAtDatetime(at) : null;
   const scheduleTimezone = hasTime ? resolveScheduleTimezone(timezone) : null;
-  const saved = await upsertSchedule({
-    name: id,
+  const def = {
+    name: renameTo,
     description: String(description || '').trim(),
     whenCron,
     whenAt,
     timezone: scheduleTimezone,
-    target: 'session',
-    channelId: null,
     cwd: cwd ? String(cwd).trim() : null,
     attachments: normalizeAutomationAttachments(attachments),
     delivery: 'app',
@@ -320,7 +356,16 @@ export async function saveSchedule({
     enabled: enabled !== false,
     nextFireAt: whenAt,
     ownerAgentId,
-  });
+  };
+  let saved;
+  if (renaming) {
+    if (await dbGetSchedule(renameTo)) throw scheduleNameTakenError(renameTo);
+    const timingChanged = !sameTiming(existing, { whenCron, whenAt, timezone: scheduleTimezone });
+    saved = await rename(id, def, { timingChanged });
+    if (!saved) throw new Error(`schedule "${id}" does not exist`);
+  } else {
+    saved = await upsertSchedule(def);
+  }
   automationProbe.invalidate();
   return scheduleToDisplay(saved);
 }
@@ -360,7 +405,6 @@ async function listWebhooks() {
     secretSet: ep.secretSet === true,
     secret: undefined,
     instructions: ep.instructions,
-    route: 'session',
     // The bot it belongs to: each run is a turn in that bot's chat.
     owner: ep.ownerAgentId || MIXY_AGENT_ID,
     ...(problems[index] ? { ownerProblem: problems[index] } : {}),
@@ -413,7 +457,6 @@ export async function saveWebhook({
     name: id,
     description: String(description || '').trim(),
     parser: nextParser,
-    channelId: null,
     cwd: cwd ? String(cwd).trim() : null,
     attachments: normalizeAutomationAttachments(attachments),
     delivery: 'app',
@@ -530,9 +573,8 @@ export async function testWebhook(name) {
 }
 
 // Automation presence: any enabled schedule or webhook endpoint. Drives the
-// worker boot decision independently of the messaging channels — schedules
-// and webhooks run sessions, so they must not require Discord/Telegram
-// tokens or an explicit remote toggle.
+// worker boot decision — schedules and webhooks run sessions, so they must
+// not require an explicit remote toggle.
 async function checkActiveAutomation() {
   const { schedules, webhooks } = await readAutomationRows();
   return hasEnabledAutomation({ schedules, webhooks });
@@ -555,7 +597,7 @@ async function readAutomationRows() {
 // at once; writes from other processes are picked up after ttlMs. A failed
 // check (e.g. PG still booting) answers false to its callers but is never
 // reused, so the next runtime checks again.
-export const AUTOMATION_PROBE_TTL_MS = 60_000;
+const AUTOMATION_PROBE_TTL_MS = 60_000;
 
 export function createAutomationProbe(check, { ttlMs = AUTOMATION_PROBE_TTL_MS, now = Date.now } = {}) {
   let pending = null;

package/src/session-runtime/services/channel-session-router.mjs

@@ -1,4 +1,5 @@
 import { channelNotificationModelContent } from '../../runtime/shared/channel-notification-routing.mjs';
+import { PROMPT_ORIGIN_CHANNEL } from '../../runtime/agent/orchestrator/session/manager/pending-message-entry.mjs';
 
 /** The one inbound channel notification method. Exported so every consumer
  *  (daemon router, session runtime) matches the same wire name. */
@@ -21,8 +22,9 @@ export function createChannelSessionRouter({ getSessionService, getSessionId, lo
         prompt: content,
         // A channel notification (webhook event rules carry fenced external
         // values) is queued as a task notification, never as typed input, so
-        // nothing inside it selects a skill.
-        options: { source: 'channel', mode: 'task-notification' },
+        // nothing inside it selects a skill. Its provenance (`origin`) says
+        // it is real external activity, which the mode alone does not.
+        options: { source: 'channel', mode: 'task-notification', origin: PROMPT_ORIGIN_CHANNEL },
       })
     ).catch((error) => {
       log(`channel session delivery failed session=${sessionId}: ${error?.message || error}`);

package/src/session-runtime/services/channel-worker.mjs

@@ -18,7 +18,7 @@ import { daemonEnv, spawnDaemonCandidate } from './channel-worker/daemon-spawn.m
 
 export { pruneStaleChannelClientHeartbeats };
 
-const CHANNEL_TOOLS = new Set(['activate_channel_bridge', 'reload_config']);
+const CHANNEL_TOOLS = new Set(['activate_channel_bridge', 'reload_config', 'rename_schedule']);
 const CALL_RETRIES = 3;
 
 function logLine(path, line) {