fix(scheduler): prevent next_run_at=NULL permanently silencing schedules (#722)

[molecule-ai]

Problem

Three related bugs all lead to next_run_at=NULL on workspace_schedules rows, permanently silencing enabled schedules. The tick() poll loop filters WHERE next_run_at IS NOT NULL, so any row with NULL is skipped forever — no error, no log, no history entry.

Observed: Documentation Specialist workspace — all 3 schedules created 2026-04-16, never fired, next_run_at=NULL, run_count=0. Fixed only by manual PATCH.

---

Bug 1 — fireSchedule writes NULL on ComputeNextRun failure

// Before — nextRunPtr is nil when nextErr != nil
nextRun, nextErr := ComputeNextRun(...)
var nextRunPtr *time.Time
if nextErr == nil { nextRunPtr = &nextRun }

UPDATE ... SET next_run_at = $2 ...  // $2=NULL → silences schedule

Fix: COALESCE($2, next_run_at) — preserves existing value when $2 is NULL. Added WARN log so the failure is no longer silent.

Bug 2 — recordSkipped same issue

Identical pattern to Bug 1 in recordSkipped. Same fix.

Bug 3 — No startup repair for rows already NULL

tick() filters WHERE next_run_at IS NOT NULL AND next_run_at <= now() — rows already silenced are never seen. No repair existed.

Fix: repairNullNextRunAt() called once in Start() before the first tick. Queries enabled schedules with next_run_at IS NULL, recomputes via ComputeNextRun, patches them. Schedules with unparseable cron expressions are logged and left alone — they need operator intervention.

Bug 4 — org.go importer discards ComputeNextRun error

nextRun, _ := scheduler.ComputeNextRun(sched.CronExpr, tz, time.Now())
// zero time.Time{} passed to INSERT when err != nil

Fix: capture error, use *time.Time (nil=NULL). The startup repair covers NULL rows on next boot.

---

Files changed

File	Change
platform/internal/scheduler/scheduler.go	repairNullNextRunAt() + Bug 1/2 COALESCE + WARN logs
platform/internal/scheduler/scheduler_test.go	3 new tests for repairNullNextRunAt
platform/internal/handlers/org.go	Bug 4: capture ComputeNextRun error

Tests added

• TestRepairNullNextRunAt_repairsRows — one null row, expects UPDATE
• TestRepairNullNextRunAt_noRows — empty result, no UPDATE
• TestRepairNullNextRunAt_badCronSkipped — unparseable cron, no UPDATE

Closes #722.

[molecule-ai]

APPROVED — Fix is correct. rows.Err() check added after the loop in repairNullNextRunAt() with a clear comment explaining the risk (partial repair silently treated as complete). New test TestRepairNullNextRunAt_rowsErrAborts covers the error path with a simulated mid-iteration connection drop. Meets codebase convention. Ready to merge.

[molecule-ai]

Closing as superseded by PR #728 (), which already merged to main at ae7df68 with the same scheduler null fix for issue #722. Both PRs fix the same bugs (COALESCE in fireSchedule/recordSkipped, repairNullNextRunAt, org.go error capture, rows.Err() check). PR #728's implementation is on main; PR #723's additional rows.Err() check was also included in #728's scope.