Keep /schedule resume paused-only so completed one-shots stay terminal

[cursor]

Problem

/schedule resume <id> flipped any non-running row to active. After a successful one-shot fire, next_fire_at is still the original due time (in the past). Resume then set next=now+1, so list_due re-queued finished work on the next tick. /schedule pause on a completed/failed row plus resume was the same bypass.

This is distinct from recovery (#278): that path releases a crashed running lease back to active. HTTP PATCH to active remains the documented operator retry for failed one-shots.

Fix

schedule_pause_block_reason / schedule_resume_block_reason encode the writ policy:

• resume only from paused
• pause only from active / running / paused
• completed, failed, and canceled stay terminal

The scheduler invoker returns ERR: before mutating. Recurring resume still recomputes next_fire_at when the previous fire is in the past.

Tests

unit_schedule_parser — allowed pause/resume statuses vs terminal and unknown statuses.

Independently mergeable against main. Code hunks (schedule_parser, invoker ~5711) auto-merge with #321–#333. CHANGELOG [Unreleased] will need a rebase after whichever sibling merges first.

  

---

Note

Medium Risk
Changes writ behavior for schedule lifecycle (agents/operators using pause/resume on terminal tasks will see ERR instead of silent re-queue); logic is localized with tests but affects background job firing.

Overview
/schedule pause and /schedule resume are now status-gated so finished one-shots cannot be accidentally re-queued.

Previously, /schedule resume could set almost any non-running row back to active. For a completed one-shot, next_fire_at stays in the past after a successful fire; resume then bumped next to now+1, so the scheduler picked it up again on the next tick. Pause-then-resume on terminal rows was the same bypass.

The fix adds schedule_pause_block_reason / schedule_resume_block_reason and has the scheduler invoker return ERR: before PATCH when the transition is invalid: resume only from paused; pause only from active, running, or paused; completed / failed / canceled stay terminal. Recurring resume still recomputes next_fire_at when the prior fire is overdue. Docs and CHANGELOG describe recreating finished one-shots; HTTP PATCH to active remains the operator retry path for failed one-shots.

Unit tests cover allowed vs blocked statuses for both writs.

^{Reviewed by Cursor Bugbot for commit a2892b9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_121a8835-ba96-4e52-a8e7-5764a956a88e)