schedule register --refresh leaves a deleted entry's artifact installed and firing — prune orphans owned by this vault

[kengio]

Summary

Deleting an entry from onebrain.yml schedule: and running onebrain schedule register --refresh leaves that entry's OS artifact installed and loaded. The job keeps firing on its old cron. Neither --refresh nor --remove can reach it: every cleanup path derives labels from the current config, so an entry that is no longer in the config has no code path that touches its artifact.

This is the "entry deleted" arm of the bug #352 already records as still open ("editing a schedule entry's args leaves the old artifact installed and firing, unreachable by --remove"). Filing it separately as a concrete, reproducible sub-case with a narrow ask, so it can ship independently of the full ownership redesign if that's the faster route.

Reproduction (onebrain 3.4.25, macOS, launchd)

1. onebrain.yml has six entries, including:

   - cron: 30 8 * * *
     skill: /digest

   schedule register --status shows all six ✓; launchctl list | grep onebrain shows six loaded, including com.onebrain.digest.
2. Remove the /digest entry from onebrain.yml (five remain).
3. onebrain schedule register --refresh

Observed

(--refresh: re-emitting plists with current vault path)
✓ Wrote ~/Library/LaunchAgents/com.onebrain.daily.plist
✓ Wrote ~/Library/LaunchAgents/com.onebrain.weekly.plist
✓ Wrote ~/Library/LaunchAgents/com.onebrain.recap.plist
✓ Wrote ~/Library/LaunchAgents/com.onebrain.onebrain-search-reindex.plist
✓ Wrote ~/Library/LaunchAgents/com.onebrain.sh--c-cd--Users-keng-onebrain-ob-1--1ddd50b9.plist

Registered and activated 5 schedule entries with launchd.

• schedule register --status → Registered schedules: 5 (looks clean)
• ls ~/Library/LaunchAgents | grep onebrain → six plists, com.onebrain.digest.plist still present
• launchctl list | grep onebrain → six jobs, com.onebrain.digest still loaded, exit 0

So --status reports the config, not the machine, and the removed job would have fired the next morning at 08:30 with nothing in the CLI's output hinting that it still existed.

4. onebrain schedule register --remove at this point would remove the five current entries and still not touch com.onebrain.digest (remove_entries iterates config.schedule).

Workaround used

launchctl bootout gui/$(id -u)/com.onebrain.digest
rm ~/Library/LaunchAgents/com.onebrain.digest.plist

Where it happens

crates/onebrain-cli/src/commands/register_schedule.rs @ v3.4.25:

• run_with → the install loop calls cleanup_stale_labels(entry, &current_labels, …) per entry still in the config; it only removes that entry's legacy labels (pre-Scheduler: cron parser rejects steps/lists; command-mode plist path collides per binary; unimplemented #116 basename, pre-v3.4.21 truncation). An entry that disappeared from the config never enters the loop, so its artifact is never considered.
• remove_all → remove_entries derives labels from config.schedule — same blind spot, from the other direction.
• if entries.is_empty() { … return Ok(0) } — deleting the whole schedule: block returns before any cleanup at all (already noted in Scheduler: redesign the installed-labels ledger around artifact OWNERSHIP, not bookkeeping #352).
• print_status reports from the raw config, so it cannot show the orphan either.

Expected

schedule register (at minimum --refresh, ideally every real register) should reconcile installed artifacts vs. config: enumerate the com.onebrain.* artifacts on disk, keep the ones whose label is in current_labels, and backend::remove the rest — but only after confirming the artifact belongs to this vault, per the ownership direction in #352 (its ProgramArguments / working directory already carry --vault <path>, so the check is available without any ledger). An artifact that points at a different vault must be left alone and, ideally, mentioned in the output.

Concretely:

• --refresh removes an installed artifact whose label is absent from the config and whose args point at this vault; prints ✓ Removed schedule '…' (no longer in onebrain.yml).
• Same sweep runs on a plain register (or document why refresh-only).
• Deleting the whole schedule: block (empty entries) still runs the sweep instead of early-returning.
• --status reports the on-disk/loaded state, or at least flags ⚠ installed but not in onebrain.yml: com.onebrain.digest so the drift is visible.
• Cross-vault guard: an artifact for the same label owned by another vault is never removed (regression test — the vacuous one from the reverted ledger should not come back).
• --remove --dry-run does not delete (from Scheduler: redesign the installed-labels ledger around artifact OWNERSHIP, not bookkeeping #352's list; worth fixing in the same pass since the sweep makes --dry-run more important).

Related

• Scheduler: redesign the installed-labels ledger around artifact OWNERSHIP, not bookkeeping #352 — ownership-based cleanup redesign (parent). This issue is the "entry deleted" repro; Scheduler: redesign the installed-labels ledger around artifact OWNERSHIP, not bookkeeping #352's original case is "entry args edited". Both are fixed by the same reconcile-with-ownership-check.
• Command-mode label discriminator truncates at 40 chars — long-arg entries sharing a prefix collide (honestly, but confusingly) #345 — label collision fix that introduced the second legacy-label generation cleanup_stale_labels handles.
• Scheduler logs live in the iCloud-synced vault, so launchd can't open them and every job dies silently #315 — scheduler state must live outside the vault, which the ownership check respects (no vault-side ledger needed).

[kengio]

Parked: implementation branch pushed, PR deferred until v3.5 Gateway ships

Branch fix/scheduler-reconcile (11 commits on top of 515fc5c, head 3b6665e) implements the ownership-based reconcile. It is parked so it does not collide with the v3.5 Gateway work; when Gateway lands, rebase onto main, finish the items below, and open the PR as a fix (Closes #410, Closes #352, Refs #402).

What is on the branch

Commit	Content
8276b48	xml::unescape; normalize_path moved to core
db59d04 + 5407179	scheduler/reconcile.rs: Ownership { Vault, Unknown }, InstalledArtifact, ReconcilePlan, plan_reconcile, parsers owner_from_{plist,service_unit,task_xml}, task_names_from_csv, quote_env_assignment. Legacy --vault argv fallback is gated on argv[0] being the onebrain binary; plist key lookup is an allowlist
40d31d3 bb35dba d889b73	Ownership marker written by all three renderers: launchd EnvironmentVariables{ONEBRAIN_VAULT}, systemd Environment="ONEBRAIN_VAULT=…", Task Scheduler <Description>OneBrain scheduled entry for vault …</Description>; snapshots + accept-generated-* corpus regenerated; corpus README row
e5aca61 + da5c1d8	backend::list_installed / backend::owner_of seam, macOS / Linux / Windows arms
48711e2	build_scheduler_context: absolute vault path, crate::home::home_dir() (#402 scheduler site); read_vault_config_opt (missing file vs empty block)
567b03f	The sweep: sweep_orphans runs after every install loop (plain, --refresh, embedded; dry-run previews Would remove …); prunes only artifacts owned by this vault and absent from the config; unknown/foreign reported and kept; EmbeddedOutcome { written, pruned }; plugin update renders prunes as W_SCHEDULE_ORPHAN_REMOVED; 6 macOS + 2 Linux integration tests
3b6665e	Fix round for the Tasks 7–8 review — committed but NOT re-reviewed (see below): reconcile::same_vault (normalized OR canonical equality) + canonicalized vault_path; launchd::is_safe_label so list_installed skips any non-sanitize-stable filename (a stray com.onebrain.daily_x.plist could otherwise read ownership from, and delete, the live daily-x plist); animated (TTY) plugin update renderer now prints report.warnings; EmbeddedOutcome.warnings → W_SCHEDULE_SWEEP_FAILED; unit tests sandboxed; never-silent / scan-failure / stray-label guard tests; register() test helper cfg(unix)

Gates at head: cargo fmt clean · cargo +1.98.0 clippy --workspace --all-targets -D warnings clean · core scheduler 244 tests · CLI unit register_schedule 62 / plugin_update 29 / dispatch 46 · integration register_schedule 43 (macOS). Coverage gate not yet run.

Review state

• Tasks 1–6: task-reviewed, findings fixed and re-reviewed (2 fix rounds).
• Tasks 7–8 (the deletion boundary): reviewed by a 5-lens pass (deletion-boundary · spec · test-integrity · call-sites · quality) with every finding adversarially verified by 3 independent skeptics → 21 confirmed, consolidated into 10 items. 3b6665e addresses them, but the scoped re-review did not happen before parking. First step on resume: re-review 3b6665e against that list (items: A animated-renderer silence; B vault identity spelling; C stray-label round-trip; D register() dead code on Windows; E sandboxed unit tests; F never-silent tests; G scan-failure test; H minors — warnings channel, empty-block degrade, comments/test names, helper doc, Migrate remaining dirs::home_dir() call sites to crate::home::home_dir() #402 assertion comment).

Remaining work (in order)

1. Re-review 3b6665e (above).
2. --remove: also prunes owned orphans; --remove --dry-run previews and deletes nothing (today remove is routed before dry_run is read — Scheduler: redesign the installed-labels ledger around artifact OWNERSHIP, not bookkeeping #352). cleanup_stale_labels already skips artifacts provably owned by another vault (via same_vault).
3. --status: append a "Not in onebrain.yml:" section — ⚠ <label> (owned by this vault — removed on next register), ? <label> (owner unknown — remove manually), ℹ <label> (owned by <path>).
4. Migrate remaining dirs::home_dir() call sites to crate::home::home_dir() #402: migrate the remaining onebrain-cli sites (run_skill.rs write_job_log, doctor.rs ×2, codex_plugin.rs codex_home) to crate::home::home_dir() + fix the stale daemon.rs comment. The onebrain-fs site stays (needs home.rs hoisted to a shared crate).
5. Docs: docs/reference/onebrain-cli.md (register_schedule paragraph), docs/commands.md maintenance row; CHANGELOG under ## [3.5.0] — Unreleased → ### Fixed; no version bump.
6. Full gates incl. scripts/coverage.sh --ci-gate (ratchet 94), lex-only clippy config, then a final whole-branch review: one cold adversarial pass on the deletion boundary + one repo-consistency/deliverable pass.
7. PR.

Design rulings to carry (the design/plan docs live in a private vault; this is the substance)

• Ownership is read from the artifact, never inferred from a name. Marker ONEBRAIN_VAULT (a real CLI env var — meaningful to onebrain commands, inert to foreign binaries). Legacy artifacts: --vault argv only when argv[0] is onebrain/onebrain.exe; foreign legacy → Unknown.
• Prune iff label ∉ config AND same_vault(owner, ctx.vault_path). Unknown and other-vault artifacts are reported, never deleted. Labels in the config are never classified (global label namespace collision is pre-existing and out of scope).
• list_installed enumerates only sanitize-stable labels ([A-Za-z0-9-]) — anything else is not ours.
• Sweep after ALL installs (failure mode stays "nothing changed"); every register incl. embedded; dry-run previews. Empty schedule: block with a config file present → prunes everything owned; missing config file → no sweep (a missing file is not evidence of intent — resolve_vault_root falls back to cwd).
• A deletion is never silent: CLI prints ✓ Removed stale schedule '<label>' (no longer in onebrain.yml); embedded path returns pruned + warnings and plugin update renders them on BOTH the static and the animated renderer.
• cleanup_stale_labels keeps cleaning Unknown legacy labels of current entries (pre-marker foreign artifacts of our own entries; stale_legacy_plist_removed_on_reregister depends on it) but skips provable other-vault owners.
• Parked, documented: Windows list_installed glue has no test (matches the file's precedent; parsers are unit-tested; fail-safe); the removal-Err arm of the sweep is not portably reachable with an owned artifact; a pre-marker artifact vault B installed to run onebrain against vault A reads as A's until B's next register rewrites it.