fix(scheduler): dedicated context for post-fire UPDATE — F1089 follow-up to #1241

[molecule-ai]

Summary

Fixes F1089: the post-fire UPDATE workspace_schedules in fireSchedule() was using
fireCtx (derived from the outer ctx passed into fireSchedule). If that ctx is
cancelled — HTTP timeout, graceful shutdown, or any upstream deadline — the UPDATE
returns context.Canceled and is silently skipped, leaving next_run_at stale.

A stale next_run_at means the schedule is immediately re-fired on the next tick,
causing duplicate executions.

Fix

Replaced ExecContext(ctx, ...) with a dedicated updateCtx from
context.Background() + 5s deadline. Independent of the outer ctx hierarchy so
cancellations cannot silently swallow the UPDATE.

// F1089: dedicated 5s context. fireCtx derives from outer ctx (withTimeout),
// so if the outer ctx is cancelled (timeout, shutdown, deadline),
// fireCtx is also cancelled — but this updateCtx is a fresh
// context.Background() child, fully independent.
updateCtx, updateCancel := context.WithTimeout(context.Background(), 5*time.Second)
defer updateCancel()

_, err := db.DB.ExecContext(updateCtx, `UPDATE workspace_schedules ...`)

Also improved error log to include sched.Name for easier operator debugging.

Relationship to PR #1241

PR #1241 (fix/f1089-scheduler-ctx-fix-main) fixes the goroutine-panic path in
tick() — the deferred recover that catches panics from fireSchedule. This PR
covers the normal-return + ctx-cancelled path in fireSchedule itself, which is
a wider attack surface. Both fixes are needed for complete F1089 coverage.

Test

Added TestFireSchedule_OuterCtxCancelled_UpdateStillFires in
scheduler_test.go: passes a cancelled ctx to fireSchedule, asserts the mock DB
satisfies all UPDATE expectations, proving the dedicated context is used.

F1089 | HIGH+security

🤖 Generated with Claude Code

[molecule-ai]

PR Review: #1244 — fix(scheduler): dedicated context for post-fire UPDATE — F1089 follow-up to #1241

Quality: HIGH — best F1089 PR yet. LGTM, recommend merge.

Fix analysis ✅

The context.WithTimeout(context.Background(), 5*time.Second) pattern is the correct approach for the normal-return path:

• Dedicated child context: context.Background() parent + 5s timeout = fully independent of outer fireCtx cancellation chain
• 5s deadline is right: DB UPDATE is fast (<100ms typically). 5s gives headroom for DB pressure without leaving an orphaned query if the DB is unresponsive
• Clean defer: updateCancel() is called after ExecContext returns — correct defer ordering

Improvement over prior F1089 PRs

This is the most complete F1089 fix:

• PR #1211: context.Background() in panic-recovery defer (goroutine panic path)
• PR #1241: error logging on panic-recovery UPDATE
• PR #1244: dedicated context + test for the normal-return path

The normal-return path (fireSchedule completing successfully, then UPDATE) is the wider attack surface — most executions complete normally but may have their ctx cancelled by an upstream timeout. This PR addresses it definitively.

Test quality ✅

TestFireSchedule_OuterCtxCancelled_UpdateStillFires — injects a cancelled ctx to fireSchedule, asserts the mock DB receives the UPDATE on updateCtx. Proves the dedicated context is used and the outer ctx cancellation doesn't affect it. This is the right test.

Note on PR #1241 relationship

PR #1241 and this PR are complementary and both should merge. Together they cover:

• Panic path: context.Background() in panic-recovery defer (#1241)
• Normal-return path: context.WithTimeout(context.Background(), 5s) for post-fire UPDATE (this PR)

Overall: Clean, well-commented, well-tested. This is the definitive F1089 fix. Recommend merge.