fix(cron): find unified-runtime cron runs by their scheduler admission

[dokterdok]

What does this PR do?

The problem. Since #106742 merged, new cron runs are missing from their job's run history (#138812).

• Desktop Cron page and sidebar: every run fired after the switch shows as a dead row, with no click and no transcript. Older runs still open.
• Runs API: each new fire appears only as an output-file row.
• Session detail: no longer marks these sessions as cron-owned.

The runs themselves are fine; nothing can find them. An older bug is fixed along the way (#92133): job backup's history also lists the runs of job backup_weekly.

Why. On the unified runtime a cron run gets a local-<hash> session id, but every history reader still looks for the old cron_<job>_<timestamp> id. The new id must stay: it is the hash of the fire's admission id, which exact-once retry depends on.

The fix. Runs are found through the record the runtime already keeps for every fire: the scheduler's admission, filed as cron:<job>:<execution>.

• Lookup: a new partial index makes this a range scan. In a synthetic benchmark it takes under 1 ms, where fix(cron): list unified runtime run sessions #138821's per-request scan took ~1.5 s at 40k sessions.
• Legacy runs: still found by id, but only when the id is the job prefix plus an exact timestamp. That fixes [Bug]: cron run history leaks runs across jobs when one job id is an underscore-prefix of another #92133.
• Desktop: decides that a row is a cron run from the row itself (source: 'cron'), not from the shape of its id.

Proof. On main the new tests fail: the local-* run is missing, detail ownership is None, and job daily lists the runs of daily_digest. The Desktop test fails too. All pass here. The first commit is #138821's (@KoNit-K), kept with its authorship.

Before / after:

Surface	Before	After
SessionDB.list_cron_job_runs / GET /api/cron/jobs/{id}/runs	post-switch runs missing; each shows up only as a synthetic cron_output doc row	listed as session rows, alongside legacy runs; output-doc and ledger rows are matched to their session by execution id, so a run appears once
Desktop Cron page and sidebar	new runs are inert rows (no click, no transcript)	open their transcript; a run is recognised by its row (source: 'cron'), with the legacy id as fallback
Session detail scheduler_owned	None for local-* runs (not recognised as cron)	works; ownership of a unified run is an exact execution match
Job backup vs job backup_weekly (legacy ids, #92133)	backup's history also lists backup_weekly's runs	a legacy id must be the prefix plus exactly YYYYmmdd_HHMMSS

Related Issue

Fixes #138812
Fixes #92133

Refs #134889 (CRON-1): work package #139162, lane 3. CRON-1 is #138812.

Thanks to @heerokod668 for the root-cause trace in #138812.

Overlap:

• Salvages and supersedes fix(cron): list unified runtime run sessions #138821 (@KoNit-K). Its commit is kept verbatim as the first commit, with authorship intact. The next commit replaces its query: it decoded the frozen policy receipt of every local session on each request, and its OR defeated the legacy id-range index. In a synthetic benchmark a 20-row page took ~56 ms at 2k local sessions and ~1.5 s at 40k; the admission lookup takes under 1 ms in the same benchmark. The commit message records the numbers.
• Supersedes fix(cron): keep prefixed jobs out of each other run history #92141 (@fangliquanflq) and fix(cron): stop run-history leaking a sibling job's runs on prefix overlap #92158 (@andyst-dev) for [Bug]: cron run history leaks runs across jobs when one job id is an underscore-prefix of another #92133. Both edit the same function and no longer apply to main.
• fix: settle interrupted cron sessions #138307 ([Bug]: a cron run killed by a gateway shutdown never gets its session row closed — the Desktop Cron view opens it read-only forever #138304) finds cron rows with the legacy id regex, so it misses local-* runs. SessionDB.cron_run_identity() from this PR is the hook it can use.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• hermes_state_keys.py: one shared definition of the scheduler's request id (cron:<job>:<execution>) and principal, used by producer and reader.
• hermes_state_common.py: partial covering index idx_session_admissions_cron_request on the scheduler's admissions.
  • It is declared in SCHEMA_SQL without a version bump, the documented convention for an index; an older store gains it on its next writable open and answers correctly, only unindexed, until then.
• hermes_state_portability.py:
  • list_cron_job_runs merges unified runs (an admission range scan) with legacy runs (the id-range scan, now constrained to the exact timestamp suffix).
  • Rows carry cron_job_id and cron_execution_id.
  • cron_run_identity() answers a single session.
• gateway/session_cron.py: refuses an execution id containing :. The request id splits at its last :, so fire x:y of job a would be filed under job a:x.
• hermes_cli/web_routers/cron.py, hermes_cli/web_routers/sessions.py: pair runs with their execution, and stamp detail's scheduler_owned for unified runs.
• Desktop (cron/open-cron-run.ts, cron/index.tsx, chat/sidebar/cron-jobs-section.tsx, use-prompt-actions/submit.ts): one predicate decides which rows open a transcript, keyed on the row rather than the id shape. The submit.ts change is a rename at a call site.

For reviewers:

• Retention: admission rows are deleted only with their session (retire_terminal_receipts), so a unified run stays in history exactly as long as a legacy run does.
• Spoofing: the lookup filters on the scheduler principal. Only session_cron writes cron: request ids under it.
• Known limitation, unchanged from main: only a run's first session is listed. If a cron run compresses into a continuation, liveness and detail identity follow the first session, not the compression tip. This is documented on the method and will be a follow-up.
• An independent adversarial review of this branch checked the schema convention, retention, spoofing, wildcard job ids (_, %, :) and dedupe. Its findings (the : guard, the legacy collision, a lighter Desktop import) are folded in.

How to Test

scripts/run_tests.sh tests/hermes_state/test_cron_run_sessions.py tests/hermes_cli/test_cron_run_history_sessions.py
cd apps/desktop && npx vitest run --project ui src/app/cron/open-cron-run.test.ts

1. Fail first: run against main, the new Python tests fail. The local-* run is not listed, the web runs list shows ['cron_output', 'cron'] for one fire, detail scheduler_owned is None, an execution id with : is accepted and misfiled, and job daily lists cron_daily_digest_…. The legacy-id control passes. On fix(cron): list unified runtime run sessions #138821's commit alone, detail ownership, the failed-neighbour row and the index check still fail. The Desktop local-* gate fails on main ("expected false to be true").
2. On this branch:
   • New tests plus the cron ownership, cron-profile, session_cron, owner-loop, recovery and worker-index suites: 80 passed.
   • tests/hermes_state/test_hermes_state.py: 294 passed, 3 skipped.
   • vitest on 12 cron and sidebar files: 254 passed.
   • eslint and tsc --noEmit clean.
3. scripts/check --base upstream/main: 12 checks ok; code health 0 blocking, 0 advisory.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits
• I searched for existing PRs to make sure this isn't a duplicate. fix(cron): list unified runtime run sessions #138821, fix(cron): keep prefixed jobs out of each other run history #92141 and fix(cron): stop run-history leaking a sibling job's runs on prefix overlap #92158 are superseded, as described above
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass — not ticked: I ran the related suites above, not the whole tree; CI is the full run
• python scripts/check passes
• I've added tests for my changes
• I've tested on my platform: Windows 11 (native, Python 3.14)

Documentation & Housekeeping

• Documentation — the limitation is documented on list_cron_job_runs
• cli-config.yaml.example — N/A
• CONTRIBUTING.md / AGENTS.md — N/A
• Cross-platform impact considered — SQL and row-shape changes only
• Tool descriptions/schemas — N/A

[dokterdok]

Landed via #139273, which salvages this PR whole with authorship kept, plus two review fixes. Thanks @unsupportedpastels. Closing. The gap #139273 notes (a cron run that compresses mid-run is listed by its first session only) is fixed in draft #139268, which I'll rebase onto main.