fix(server): retain scheduled dispatch refusal reasons#32115

Problem

When an orchestrator refuses a bound scheduled task's fresh-session send, the task records only Failed to dispatch orchestration command message.dispatch (...). The actionable reason is present in the typed error's direct cause but is lost before lastRunError is persisted.

Related to the diagnostic symptom in #32100. This does not fix its background-work lifecycle problem or close that issue.

Change

After squashing the dispatch result's Effect cause, recognize OrchestratorDispatchError and format its direct string cause with the existing userFacingDispatchErrorMessage. Keep the existing outer-message fallback for missing, empty, generic, or non-string causes. The releaseStuckRun caller retains the unchanged formatter.

The boundary is specific to scheduled sends. The helper accepts a nongeneric direct string; it is not an allowlist or sanitizer. Unknown nested causes, including SQL details and cyclic objects, are not traversed. New-thread launch failures remain behind their existing wrapper.

Scope and approval

This is a small, focused repair of an obvious diagnostic loss: the service already receives a source-defined refusal, and the existing persisted error field drops it. It uses the focused bug-fix exception in CONTRIBUTING.md. No schedule state, bookkeeping, queue, retry, cancellation, session release, admission guard, contract, MCP schema, or client behavior changes.

Overlap checked against current main 6577c6b61851 and exact open heads of #23131 (017184de74c1) and #31366 (a037820fa42b): those PRs own terminal-outcome accounting and retain this formatter loss. This preserves #29889's stack-free diagnostics and follows the existing dispatch formatter precedent in #21027.

Verification

• Extended the existing fresh-session ScheduledTaskService.test.ts case. Before the source change it failed at the intended assertion: expected the background-work refusal, received the generic dispatch wrapper. Failed status, retained binding, run count and next-run assertions passed first. After the fix, the returned task, direct SQLite read and a newly constructed service all retain the reason. A later successful dispatch clears it.
• Added opaque-failure controls at the same service layer for defects, strings, interruption, missing/empty/generic wrapper causes, cyclic causes, nested Error text and private SQL detail. These fallback controls enter through the defect channel; the principal refusal regression exercises an actual typed failure. The existing webhook completion-write-failure test also checks that releaseStuckRun still records its safe outer error.
• vp test run apps/server/src/scheduledTasks/ScheduledTaskService.test.ts apps/server/src/scheduledTasks/ScheduledTaskService.webhook.test.ts apps/server/src/orchestration-v2/UserFacingErrors.test.ts: 73 tests passed.
• Final vp run check:changed: format, lint, both knip steps, GraphQL, affected typechecks (3 packages), and 88 tests in 5 files passed.
• Independent Codex review of the exact diff found no blocking correctness or privacy findings for the bounded scheduled-send path.

Runtime evidence: macOS, Node 26.13.0, two separate synthetic file-backed SQLite databases, actual ScheduledTaskService, ThreadManagementService, orchestrator, event/projection persistence and effect worker. The repository's ProviderReplayHarness.layerWithRegistry used the test adapter pattern from ProviderSwitch.integration.test.ts, with Claude capabilities and a session-wide background-work probe returning true after the root completed. No provider CLI or paid inference ran.

1. Create a thread and complete its first test-provider turn while its session's background probe remains true.
2. Persist an enabled interval task bound to that thread with threadMode: "fresh_session", then call the real runNow.
3. Drain the effect worker and inspect the returned task, SQL row and new service readback. Compare against the unchanged main service, with identical production dependencies.

The main comparison imported the exact main service source with only its relative imports relocated. The patched run imported the worktree service. Assertions also verified that provider sessions and root runs were unchanged; synchronization used worker draining and persisted events.

Not checked: a real Claude process, the reporter's indefinite lifecycle failure, or a UI capture. This proves diagnostic propagation through the real server services with a deterministic test provider.

Model and harness: GPT-6-based Codex; independent Codex review.