Summary

Ports the upstream OpenClaw fix openclaw#66083 ("stop unresolved next-run refire loops") into the fork's consolidated cron service. Closes #2702.

Root cause. When computeJobNextRunAtMs cannot resolve a recurring cron job's next run (returns undefined, or throws → caught), applyJobResult synthesized a phantom nextRunAtMs:

• success path → endedAt + MIN_REFIRE_GAP_MS (the 2 s spin-loop guard)
• error path → endedAt + backoff (the error backoff delay)

A synthesized time looks due on the next tick, so the job refires forever even though its schedule never actually resolved.

Fix. Add resolveCronNextRunWithLowerBound (cron-kind only): when the natural next run is unresolved, clear the schedule (undefined) instead of synthesizing a time. every jobs keep the arithmetic backoff fallback unchanged. The fork already has the recovery half — armTimer keeps a maintenance recheck armed while enabled jobs exist, and recomputeNextRunsForMaintenance always repairs a missing nextRunAtMs — so once the masking phantom time is gone, an initially-unresolved job is correctly re-armed and fires on a later tick once its next run becomes resolvable, instead of silently stalling.

Scope note (the "entangled refactor" the issue warns about)

The issue's referenced commit e1fe71872c3 and follow-up #66113 are written against upstream's post-SQLite-migration cron service; their test-case-3 backoff-floor semantics depend on that larger timer refactor (which "does not apply cleanly to the fork"). This PR ports #66083 — the coherent, minimal fix that satisfies both acceptance criteria — and intentionally does not drag in the SQLite-era evolution.

Changes

• src/cron/service/timer.ts — add resolveCronNextRunWithLowerBound; apply it in both branches of applyJobResult for cron-kind jobs.
• src/cron/service.issue-66019-unresolved-next-run.test.ts (new) — onTimer integration coverage: no spurious refire (success + errored), and reschedule-and-fire on a later tick once the next run resolves.
• src/cron/service.issue-regressions.test.ts — reconcile the two #30905 throw-path tests to the new clear-on-unresolved behavior (matching upstream verbatim), and add the unit-level #66019 applyJobResult regression cases.

Acceptance criteria

• A cron job whose next run is initially unresolved is correctly rescheduled and fires on a subsequent tick (positive integration test).
• A regression test asserts the refire behavior and passes in isolation (verified: all 3 new integration tests fail without the fix, pass with it).

Verification

• src/cron/ unit suite: 452 passed (49 files).
• pnpm check (format + tsgo typecheck + oxlint type-aware + fork lint gates): clean.
• Fork-integrity gates (throwing-stub-callers, stub-debt, rebrand): clean.
• Touches src/cron/, not src/middleware/, so the LIVE smoke-test gate does not apply.

🤖 Generated with Claude Code