fix(scheduler): make Schedule() actually fire job only once

[marcus]

Summary

Scheduler.Schedule(at, job) was documented as a one-time job, but its closure ran on every scheduler tick after at was reached. With a typical 5-minute interval, a job scheduled for 14:00 would fire at 14:00, 14:05, 14:10, … indefinitely.

The fix wraps the inner call in sync.Once so the job fires exactly once. Also switches from time.Now().After(at) to !time.Now().Before(at) so the boundary tick (exactly at at) is included.

Bug detail

Before:

func (s *Scheduler) Schedule(at time.Time, job func()) {
    s.AddJob(func(ctx context.Context) error {
        if time.Now().After(at) {
            job()  // runs every tick after `at`
        }
        return nil
    })
}

After: a sync.Once around the call gives one-shot semantics. The job stays in the slice (harmless — closures cost nothing once Once has fired).

Audit context

Ran go vet, staticcheck, and golangci-lint against the repo — all clean. Manual review focused on resource leaks, concurrency, error handling, and time/scheduling. Inspected internal/orchestrator, internal/budget, internal/state, internal/db, internal/snapshots, internal/providers, and internal/scheduler. The only high-confidence concrete bug found was this one. (Two other suspected issues — ParseMetadataBlock index arithmetic and Copilot.GetResetTime("weekly") — were verified and turned out to be intentional / correct.)

Test plan

• go test ./internal/scheduler/... passes
• Two new tests:
  • TestSchedule_RunsExactlyOnce: simulates 5 ticks after at, asserts job ran 1×.
  • TestSchedule_NotBeforeTargetTime: schedules for 1h in the future, asserts job runs 0× across 3 ticks.
• Full go test ./... passes
• go vet ./..., gofmt, go build ./... all clean (also enforced by pre-commit hook)

🤖 Generated with Claude Code

---

Automated by nightshift