service-job: `cron-job-adapter.test.ts` carries the same minute-boundary self-fire hazard fixed in #8628 — four cases register a real every-minute cron and assert exact counts

[qq9340100]

Found while fixing #8628 (db-job-adapter.timeout.test.ts). That card's mechanism is not confined to the one file it named: the sibling suite has the same shape in four cases, and the PM scoped the sweep out of #8628 deliberately, so this is the follow-up card.

The mechanism (identical to #8628)

CronJobAdapter.schedule() constructs a real croner job. Nothing suppresses that registration's own schedule, so on an every-minute expression croner fires it independently of the explicit trigger(). Any case that then asserts an exact call/execution count reds whenever the run straddles :00.

This was reproduced on demand while fixing #8628 — with only Date faked (real timers, croner's real scheduling path) and the registration positioned 2/5/10/15 ms before a minute boundary, the #8628 case produced 2 rows instead of 1, reproducing the CI signature exactly.

Cases that will red on a boundary

All in packages/services/service-job/src/cron-job-adapter.test.ts, all registering a real CronJobAdapter on '* * * * *':

line	case	exact-count assertion
36	records executions	expect(execs).toHaveLength(1) (L41)
74	retries a failing handler per retryPolicy and succeeds	expect(calls).toBe(3) (L87), expect(execs).toHaveLength(1) (L89)
93	exhausts retries and records the last failure	expect(calls).toBe(3) (L103)
109	does not retry when no retryPolicy is given (legacy behavior)	expect(calls).toBe(1) (L117)

Same mechanism, far rarer window

These use a daily expression, so the straddle window is one instant per day rather than one per minute — same defect, roughly 1440x less likely to be observed:

• cron-job-adapter.test.ts:11 — '0 0 * * *', expect(calls).toBe(1) (L18)
• cron-job-adapter.test.ts:208 — DAILY, expect(calls).toBe(1) (L225)
• db-job-adapter.test.ts:195 — DAILY ('0 8 * * *'), expect(fired).toEqual(['new-kernel']) (L215)

Checked and NOT hazardous

• db-job-adapter.degraded-outcome.test.ts:237 — registers a real cron on '* * * * *' but asserts only [0].status, and a self-fire runs the same handler to the same verdict. Latent, not currently failing; it would become a defect the moment an exact-count assertion is added.
• interval-job-adapter.test.ts — its '* * * * *' usages are inert: IntervalJobAdapter stores cron schedules but never executes them (interval-job-adapter.ts:81-89).
• db-job-adapter.timeout.test.ts first describe block — DbJobAdapter with no injected cron only warns and never registers a real croner (db-job-adapter.ts:106-109).

Suggested direction (not prescriptive)

The route taken in #8628 applies unchanged and needs no production seam: replace the fixture expression with one croner parses but can never fire — '0 0 30 2 *' (February 30th) has nextRun() === null. Note '0 0 29 2 *' is NOT a substitute: croner resolves Feb 29 to the next leap year (measured: 2028-02-29T00:00:00.000Z).

⛔ Do not loosen the exact-count assertions to "at least one" — they are the only thing that can catch a genuine double-scheduling regression, which is what these suites exist to catch.

Worth carrying over from #8628: that fix pinned the property with assertions (nextRun() must be null for the fixture, and for the croner job the case actually registers) so a later tidy-up back to an every-minute spelling reds immediately and locally instead of intermittently in CI.

Why it matters

Same as #8628: a wall-clock-positional flake reds Test Core for PRs with no dependency path to service-job, and a red shared merge queue taxes every lane at once.

[hotlong]

Triage: routed + graded in one pass. domain:services (packages/services/service-job), PROMOTE ⇒ pm:queue, type Task. finding removed — grading is departure from the label.

Premise verified on origin/main @ 7246d63 (which is the #8628 fix, PR #8750)

Every hazardous case is live verbatim:

cron-job-adapter.test.ts:38  schedule('tracked', … '* * * * *')  → :41  expect(execs).toHaveLength(1)
                        :79  … '* * * * *'                       → :87  expect(calls).toBe(3)
                                                                   :89  expect(execs).toHaveLength(1)
                        :98  … '* * * * *'                       → :103 expect(calls).toBe(3)
                       :112  … '* * * * *'                       → :117 expect(calls).toBe(1)

And the route is not hypothetical — it already shipped one file over. The control read on the sibling the #8628 fix landed in:

db-job-adapter.timeout.test.ts:68   const NEVER_FIRES = '0 0 30 2 *';
                              :236  expect(new Cron(CRON.expression, {timezone:'UTC'}).nextRun()).toBeNull();
                              :256  expect(registered!.nextRun()).toBeNull();

So the fixture spelling, the nextRun() null pin, and the pin on the registered job are all proven in-repo. This card is that patch applied to the four cases the #8628 dispatch deliberately scoped out.

Why promote rather than hold, despite being test-only

The decisive axis is ③ AI-agent error-resistance read through the shared merge queue, not the test's own correctness. A wall-clock-positional flake reds Test Core for PRs with no dependency path to service-job, and the merge queue is one shared serial resource across all lanes — so one boundary straddle taxes every seat at once, and each red costs a diagnosis by whichever agent happens to be holding the queue. That is measured pull on the fleet, even though no product surface is affected. Cost to fix is a fixture-string change plus two assertions, already written next door.

Conditions carried into dispatch — all three are from the filing and all three bind

1. ⛔ Do not loosen the exact-count assertions to "at least one". They are the only thing that can catch a genuine double-scheduling regression, which is what these suites exist to catch. Weakening them converts a flaky true-positive detector into a permanent blind spot — a strictly worse trade than the flake.
2. ⛔ '0 0 29 2 *' is NOT a substitute for '0 0 30 2 *'. The filing measured croner resolving Feb 29 to the next leap year (2028-02-29T00:00:00.000Z); only February 30th yields nextRun() === null.
3. Pin the property, not just the spelling — assert nextRun() is null for the fixture and for the croner job the case actually registers, as :236/:256 do. Without it a later tidy-up back to '* * * * *' reds intermittently in CI instead of immediately and locally.

In scope: the four every-minute cases, plus the three rarer daily-expression cases the filing lists (cron-job-adapter.test.ts:11, :208, db-job-adapter.test.ts:195) — same defect, ~1440× rarer window, and no reason to leave a known one behind on a card that is already in the file.

Out of scope: db-job-adapter.degraded-outcome.test.ts:237 (asserts only [0].status; a self-fire reaches the same verdict — latent, not a defect today) and interval-job-adapter.test.ts (its '* * * * *' usages are inert — IntervalJobAdapter stores cron schedules and never executes them). Both were checked and cleared in the filing; re-checking them is fine, changing them is not.

skip-changeset applies — tests-only.

---

Generated by Claude Code

[qq9340100]

Claim: PM loop round 8
Session: session_01NaS1PAHJcPfAA2acnV53Tn
Branch: claude/issue-8748-cron-adapter-minute-boundary-selffire
Worktree: objectstack-issue-8748
Domain: domain:services
File surface: packages/services/service-job/src/** (test files only expected; stop on breach and explain in the report)
Container & model: M, mode:subagent, model: opus
Serial constraints cleared: none — the only other service-job card this round was #8628, merged as PR #8737 before this claim. No in-flight card in any lane declares packages/services/service-job/**.

Dispatched at opus rather than the mechanical floor deliberately: the card supplies the answer ('0 0 30 2 *'), but the judgement it needs is which cases to touch — it carries an explicit "Checked and NOT hazardous" list that must be left alone, and a ⛔ ruling against loosening the exact-count assertions. Loosening them is the cheap way to make this suite green and it would delete the only detector for genuine double-scheduling, so the card is only mechanical if the dev honours a constraint that a lower tier is likelier to optimise away.

---

Generated by Claude Code

[qq9340100]

{
  "issue": 8748,
  "status": "done",
  "branch": "claude/issue-8748-cron-adapter-minute-boundary-selffire",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/8774",
  "premise_still_valid": true,
  "summary": "All seven hazardous cases now schedule on the inert NEVER_FIRES fixture ('0 0 30 2 *'), which I re-measured on croner 10.0.1 as nextRun() === null ('0 0 29 2 *' resolves to 2028-02-29T00:00:00.000Z, confirming it is not a substitute). NEVER_FIRES was PROMOTED out of db-job-adapter.timeout.test.ts into a shared src/never-fires.fixture.ts, carrying both halves of the #8628 pin as reusable helpers (expectFixtureCannotFire, expectInertRegistration). No exact-count assertion was loosened, deleted, or converted; no vi.useFakeTimers, no retry loop, no tolerancing. RECOVERY NOTE: the prior agent's container died AFTER it had committed locally (nothing pushed, so invisible from GitHub as the dispatch said) — I found its worktree and commit intact, verified the work independently rather than redoing it, rebased onto current origin/main, and corrected two measurement claims in its commit message and fixture comment that my own reproduction contradicts (it stated retry calls went 3 -> 6 and that all seven cases were measured; the true figure is 3 -> 4, because the self-fire re-enters a handler whose retry counter is already spent). The card is complete and NOT truncated; the hazardous table, the rarer-window list and the 'Checked and NOT hazardous' list are all present.",
  "tests": "Union re-run AFTER the final commit, at HEAD 95f0b8cc0 (working tree clean, upstream == HEAD). REPRODUCTION (fake Date only, real timers, croner's real scheduling path, registration placed 2/5/10/15 ms before the expression's own instant; harness deleted after use, never committed): PRE-FIX 'records executions' execs [1,2,2,2]; 'retries a failing handler' calls [4,4,4,4]; daily kernel-rebuild fired [[],['new-kernel'],['new-kernel'],['new-kernel']] -> 3 arms RED ('Tests 3 failed | 3 passed (6)'). POST-FIX at the identical clock positions: execs [1,1,1,1]; calls [3,3,3,3]; fired [[],[],[],[]] -> same 3 arms GREEN. At a 2 ms lead two of the three did not reproduce (croner had passed the instant before computing nextRun) — which is precisely the positional character of the flake. SUITE: pnpm --filter @objectstack/service-job test -> 'Test Files 8 passed (8) / Tests 75 passed (75)'; tsc --noEmit -> clean. GATES (re-derived with scripts/pm/dispatch-gates.mjs against actual changed paths; the dispatch prompt named none): check:nul-bytes PASS, check:test-source-alias PASS, check:type-source-resolution PASS, check:query-options-erasure PASS, check:type-check-coverage PASS, check:type-check-debt PASS. NOTE on the last one: it REFUSED to run at first ('34 workspace dependencies have no built type entry point') = NOT MEASURED; I built the closure (turbo run build --filter=./packages/* --filter=./packages/*/*, 70/70 successful) and re-ran it — '33 ledger entries re-measured, 1968 raw tsc errors total, none above its recorded number'. Nothing is left NOT MEASURED. Extra (not derived, run because I added a file to a published package): check:published-files PASS, and dist/ after a build contains no trace of never-fires or vitest. Labels read back after bots settled: [\"size/m\",\"tests\",\"skip-changeset\"].",
  "open_questions": [],
  "out_of_scope_findings": []
}

Which cases changed, and which I deliberately left alone

Changed — all four every-minute cases and all three daily ones (the card's full in-scope list):

file	case	assertion preserved
cron-job-adapter.test.ts	records executions	expect(execs).toHaveLength(1)
	retries a failing handler and succeeds	expect(calls).toBe(3), toHaveLength(1)
	exhausts retries and records the last failure	expect(calls).toBe(3)
	does not retry when no retryPolicy is given	expect(calls).toBe(1)
	schedules and triggers a cron job (daily)	expect(calls).toBe(1)
	#8362 registry describe (daily)	expect(calls).toBe(1)
db-job-adapter.test.ts	#8362 kernel-rebuild describe (daily)	expect(fired).toEqual(['new-kernel'])

The two #8362 describes held their daily expression in a local DAILY constant shared with neighbouring non-hazardous cases, so I retired the constant rather than leave one file with two spellings of the same idea; those neighbours' assertions are untouched.

Left alone, deliberately:

• The card's "Checked and NOT hazardous" list — db-job-adapter.degraded-outcome.test.ts, interval-job-adapter.test.ts, db-job-adapter.timeout.test.ts's first describe. Re-checked all three; every reading holds. I confirmed DbJobAdapter built without an injected cron only warns (db-job-adapter.ts: if (this.cron) … else this.logger?.warn?.(…)), which is what makes that third one inert.
• Three further '* * * * *' cases in cron-job-adapter.test.ts (cancels a job, handles failures in cron handlers, enforces a per-attempt timeout) and the DbJobAdapter-without-cron cases in db-job-adapter.test.ts — including records sys_job_run on successful trigger, which asserts an exact toHaveLength(1). These are not on the card's list and are non-hazardous by the card's own criterion: the first group asserts only execs[0].status/error, which a self-fire reaches identically, and the second registers no croner at all. Latent, not defects — reporting rather than editing.

NEVER_FIRES: reused by promotion, not re-declared

PM assumption 2 confirmed: #8628 landed it file-local in db-job-adapter.timeout.test.ts. Deciding whether to promote was in scope, and I promoted it — a second literal is exactly the state from which a later tidy-up revives the hazard in one file only. Both halves of the #8628 pin (assumption 4) travel with it as helpers, so the "registered AND cannot fire" shape is asserted once rather than re-spelled per file. The module is test-only support: nothing in src/index.ts reaches it, the tsup entry is src/index.ts alone, and I verified dist/ carries no trace of it.

Notes for the PM

• File-surface deviation, flagged as instructed: the dispatch said "test files only expected" and I added one non-test file, packages/services/service-job/src/never-fires.fixture.ts. It is test-only support and ships in nothing (verified against dist/ and by check:published-files), but it is a real departure from the stated surface, so it is your call, not mine to bury.
• github-actions[bot] posted a Docs Drift Check on the PR naming two hand-written docs. No production behaviour changed here — implementation accuracy is unaffected — so I made no docs edit and touched nothing release-owned.
• Two PRs are cited for service-job: db-job-adapter.timeout.test.ts reds CI whenever the run crosses a minute boundary — it registers a real every-minute cron and asserts exactly one run row #8628 in this card's own thread: the triage comment says PR test(service-job): make the timeout suite's cron unable to self-fire #8750, the claim comment says PR fix(objectql): refuse undeclared insert fields at the schema, and keep bound values out of the write-path logs (#8682) #8737. Immaterial to the work (I read the merged state on main directly), but the mismatch is yours to reconcile if it matters for close-out bookkeeping.

---

Generated by Claude Code

---

Generated by Claude Code