Catch up every period within 24 hours, oldest first (F20-01) (#184)

Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>

cmd/server/main.go

@@ -130,7 +130,12 @@ func run(cfg config.Config, logger *slog.Logger) error {
 		return err
 	}
 
-	dinnerSvc, err := dinners.NewService(db, grounder, runner, logger)
+	// The scheduler is made before the services whose changes wake it.
+	sched, err := scheduler.New(db, settings, logger)
+	if err != nil {
+		return err
+	}
+	dinnerSvc, err := dinners.NewService(db, grounder, runner, sched.Wake, logger)
 	if err != nil {
 		return err
 	}
@@ -152,7 +157,7 @@ func run(cfg config.Config, logger *slog.Logger) error {
 		return err
 	}
 
-	planSvc, err := plan.NewService(db, weekDrafter(ai, guard), runner, googleSvc, notifier, cfg.PublicURL, logger)
+	planSvc, err := plan.NewService(db, weekDrafter(ai, guard), runner, googleSvc, notifier, sched.Wake, cfg.PublicURL, logger)
 	if err != nil {
 		return err
 	}
@@ -188,11 +193,31 @@ func run(cfg config.Config, logger *slog.Logger) error {
 		return err
 	}
 
-	sched, err := scheduler.New(db, settings, logger)
+	if err := sched.Register(suggestSvc.WeeklySchedule()); err != nil {
+		return err
+	}
+	if err := sched.Register(planSvc.DraftSchedule()); err != nil {
+		return err
+	}
+	for _, sch := range planSvc.ReminderSchedules() {
+		if err := sched.Register(sch); err != nil {
+			return err
+		}
+	}
+	if err := sched.Register(planSvc.RotationCheckSchedule()); err != nil {
+		return err
+	}
+	if err := sched.Register(shopSvc.ChatAutosendSchedule()); err != nil {
+		return err
+	}
+	if err := sched.Register(shopSvc.RolloverSchedule()); err != nil {
+		return err
+	}
+	purge, err := harness.PurgeSchedule(db, logger)
 	if err != nil {
 		return err
 	}
-	if err := sched.Register(suggestSvc.WeeklySchedule()); err != nil {
+	if err := sched.Register(purge); err != nil {
 		return err
 	}
 

docs/ARCHITECTURE.md

@@ -484,15 +484,13 @@ automatic** (D-021).
   `changed`, and answers 200 with the plan. A date outside the week is 400 `invalid_date`, an unknown dinner or
   a week with no plan 404, any other dinner 409 `dinner_not_plannable`, and
   a dinner already on another day of the week 409 `dinner_already_planned`.
-- Rotation check (`plan.Service`, D-021). This release provides the
-  `MarkTried` service method and the rotation review read and decide APIs
-  below. The `rotation_check` schedule that is to call `MarkTried` for the
-  household-local day just past is planned (Feature 20, the scheduler) and
-  not wired yet: nothing in production calls `MarkTried`, so no Rotation
-  check opens automatically. `MarkTried(date)` moves every `quest_log` dinner planned on that date, on a plan of any
-  status, to `tried` and opens a `pending` `rotation_reviews` row for it;
-  a dinner already checked for that date is left as it is, so it is
-  idempotent. `GET /api/v1/rotation-reviews` returns `{reviews}`, the
+- Rotation check (`plan.Service`, D-021). The `rotation_check` schedule
+  calls `MarkTried` for the household-local day just past (see Scheduler).
+  `MarkTried(date)` moves every `quest_log` dinner planned on that date, on a plan of any
+  status, to `tried`, opens a `pending` `rotation_reviews` row for it and
+  emits its `rotation_review`, in one transaction;
+  a dinner already checked for that date is left as it is and not
+  notified again, so it is idempotent. `GET /api/v1/rotation-reviews` returns `{reviews}`, the
   pending checks whose dinner is still tried, oldest `plan_date` first,
   each `{dinner: {id, name, photo}, plan_date}`. `POST
   /api/v1/dinners/{id}/rotation-review` takes `{decision}`: `keep` makes
@@ -537,8 +535,8 @@ automatic** (D-021).
   received.
   `harness.Purge` deletes rows older than `harness.RunRetention` (30 days),
   clearing the `suggestion_batches` and `week_plans` references first. The
-  harness does not call it: the scheduler's daily `ai_runs` purge
-  (Feature 20) must call `harness.Purge` with `now - RunRetention`.
+  daily `ai_runs_purge` schedule (`harness.PurgeSchedule`) calls it with
+  its fire time less `RunRetention`.
 - **Concurrency guards** (`harness.Guard`, one per process): `harness.Run`
   takes a scope key, and concurrent runs of one skill with one scope share a
   single in-flight run and its result, error included (single-flight); runs
@@ -653,7 +651,8 @@ job failed, the freeze finds the list still untitled and makes its own
 `archive_title` attempt before freezing. A job that starts during a freeze
 waits for it, then finds the list titled (that title stands) or frozen
 untitled (the job fails `title_failed`), and stores nothing. The
-`week_rollover` schedule is to call `Freeze` for last week.
+`week_rollover` schedule (`shopping.Service.RolloverSchedule`) calls
+`Freeze` for last week, judging the week ended by its fire time.
 
 ## Recipe grounding
 
@@ -780,17 +779,17 @@ purge are fixed and not configurable.
 | Schedule | When | Does |
 | --- | --- | --- |
 | `suggestions_weekly` | Sunday 08:00 | New batch of Side quests (`suggest.Service.WeeklySchedule`). |
-| `plan_draft` | Friday 09:00 | AI drafts next week's plan. |
-| `shopping_chat_autosend` | Saturday 08:00 | Sends the Supply run to Google Chat. |
-| `day_of_reminder` | Daily 16:30 | Tonight's dinner reminder. |
-| `rotation_check` | Daily 09:00 | Asks "Keep it in rotation?" for tried dinners. |
-| `week_rollover` | Monday 00:05 (fixed) | Freezes last week's Supply run into the Supply archive. |
-| `ai_runs` purge | Daily (fixed) | Calls `harness.Purge` to delete `ai_runs` rows past 30-day retention (Feature 20). |
+| `plan_draft` | Friday 09:00 | AI drafts next week's plan (`plan.Service.DraftSchedule`). |
+| `shopping_chat_autosend` | Saturday 08:00 | Sends the coming week's Supply run to Google Chat (`shopping.Service.ChatAutosendSchedule`). |
+| `day_of_reminder` | Daily 16:30, and 15 minutes before a crock-pot start_by earlier than that | Tonight's dinner reminder and the crock-pot start reminder (`plan.Service.ReminderSchedules`). |
+| `rotation_check` | Daily 09:00 | Marks yesterday's Quest log dinners tried and asks "Keep it in rotation?" (`plan.Service.RotationCheckSchedule`). |
+| `week_rollover` | Monday 00:05 (fixed) | Freezes last week's Supply run into the Supply archive (`shopping.Service.RolloverSchedule`). |
+| `ai_runs_purge` | Daily 03:00 (fixed) | Calls `harness.Purge` to delete `ai_runs` rows past 30-day retention (`harness.PurgeSchedule`). |
 
 Runs are recorded in `schedule_runs` and executed through `jobs`.
 
 `internal/scheduler` runs them. A schedule registers a name, a rule read
-from the settings (`scheduler.Daily`, `Weekly` or `WeeklyForNextWeek`) and a
+from the settings (`scheduler.Daily`, `Weekly` or `WeeklyForNextWeek`, or `DailyAt` for a time read from data) and a
 run function; settings changes reach it through `SettingsService.Subscribe`
 and move the next fire time without a restart. Each fire time has a period
 key (`Rule.PeriodKey`): the local date for a daily rule, the ISO week of the
@@ -814,6 +813,52 @@ Its run calls `StartScheduledBatch(period.Week)`, which starts the same
 batch and job as `POST /api/v1/suggestions/batches` (`StartBatch(manual)`),
 with the `scheduled` trigger, and returns at once; the batch runs as a job. When a
 batch is already pending or running the period starts none and logs it.
+`plan.Service.DraftSchedule()` is `plan_draft`, keyed by the ISO week
+after the fire date (`scheduler.WeeklyForNextWeek`). Its run calls
+`StartScheduledDraft(period.Week)`, which enqueues the same `draft_week`
+job as `POST /api/v1/plans/{weekStart}/draft` without confirm, so a stored
+draft emits `plan_ready:{weekStart}` from the job and a failed one (e.g.
+`ai_failed`, recorded in `ai_runs`) emits nothing. When the week already
+has a plan, in any status, it enqueues nothing; when a draft of the week
+is already queued or running it joins it. Either way it logs it.
+`plan.Service.ReminderSchedules()` is `day_of_reminder`, two schedules
+of one name. The first is `Daily(reminder_time)`, period `YYYY-MM-DD`,
+and calls `EmitDayOfReminder(period.Date)`. The second has `Key` `start`,
+so its periods are `start:YYYY-MM-DD`, and a `scheduler.DailyAt` rule:
+for each date it reads the plan and fires 15 minutes
+(`plan.StartReminderLead`) before the day's `start_by` (the same
+computation the plan API shows) when the dinner is a crock-pot dinner
+whose `start_by` is earlier than that day's `reminder_time`; its run
+calls `EmitStartReminder(period.Date)`, which checks the same again. A
+date whose week has no plan emits neither and logs it. A `DailyAt` fire
+time is looked up from the data on every pass. A committed change that
+can move a `start_by` calls `Scheduler.Wake` (passed to `plan.NewService`
+and `dinners.NewService` as `wake`): a plan swap or stored draft, and a
+dinner's method or minutes changed by edit or grounding. The next pass
+comes at once, so a crock-pot dinner swapped in for tonight is still
+reminded 15 minutes before its `start_by`, not at the next hourly timer
+(`maxWait`); a lookup that fails is logged and repeated every
+`ClaimRetry`.
+`shopping.Service.ChatAutosendSchedule()` is `shopping_chat_autosend`,
+`WeeklyForNextWeek(chat_autosend_dow, chat_autosend_time)`, so its period
+names the coming week. Its run calls `Autosend(period.Week)`, which posts
+with `SendToChat(week, false)`, the household's own send, only when a
+webhook is stored, `list_ready`'s Chat channel is on
+(`notify.Service.ChannelOn`) and the week has a Supply run neither sent
+nor with a send unconfirmed; otherwise it posts nothing and logs why,
+with the key `list_ready:chat:{weekStart}`. It never resends; a send that
+fails is the period's error. `shopping.Service.RolloverSchedule()` is
+`week_rollover`, `Weekly(Monday, 00:05)`; its run freezes the week before
+the fire date's, and a week with no Supply run freezes nothing and logs
+it. `plan.Service.RotationCheckSchedule()` is `rotation_check`,
+`Daily(review_time)`, claimed as `rotation_check:YYYY-MM-DD` of the fire
+date (`Schedule.PeriodKey`). Its run calls `MarkTried` for the day before
+the fire date, which emits one `rotation_review` per Rotation check it
+opens; it never makes a dinner a Regular, and a day with no Quest log
+dinner planned opens none and logs the count.
+`harness.PurgeSchedule(store, logger)` is `ai_runs_purge`,
+`Daily(03:00)`, deleting rows created more than 30 days before the fire
+time.
 Fake-clock tests of a schedule live in `internal/scheduler`, where
 `SetClock` is visible to tests.
 
@@ -825,8 +870,9 @@ Fake-clock tests of a schedule live in `internal/scheduler`, where
 - Where each event is emitted, with its idempotency key. Each is stored by
   `notify.EmitTx` in the transaction of the change it is about, so the
   change and its notification commit together or not at all:
-  - `plan_ready:{weekStart}` (URL `/plan`) when a draft job stores the
-    AI's draft of a week. Only the first draft of a week notifies: a
+  - `plan_ready:{weekStart}` (URL `/plan`) when a draft job, asked for
+    by the API or the `plan_draft` schedule, stores the AI's draft of a
+    week. Only the first draft of a week notifies: a
     redraft (Rebuild week) has the same key, and a manual swap never
     drafts. Its title is "Next week's plan is ready" (or "This week's",
     or "The plan for the week of Oct 26") and its body the drafted
@@ -848,9 +894,19 @@ Fake-clock tests of a schedule live in `internal/scheduler`, where
     notifies. This is the only place `new_suggestions` is emitted; the
     `suggestions_weekly` schedule does not emit it itself.
   - `day_of_reminder:{date}` (URL `/dinner/{id}`) through
-    `plan.Service.EmitDayOfReminder(date)`, which names the dinner planned
-    on the date and emits nothing for a week with no plan. The scheduler
-    calls it at `reminder_time` (Feature 20).
+    `plan.Service.EmitDayOfReminder(date)`, "Tonight: {dinner} · Recipe →",
+    naming the dinner planned on the date; it emits nothing for a week
+    with no plan. The `day_of_reminder` schedule calls it at
+    `reminder_time`.
+  - `day_of_reminder:start:{date}` (URL `/dinner/{id}`) through
+    `plan.Service.EmitStartReminder(date)`, "Start the crock pot by
+    {time}" with the dinner's name, only for a crock-pot dinner whose
+    `start_by` is earlier than `reminder_time`. The `day_of_reminder`
+    schedule calls it 15 minutes before `start_by`.
+  - `rotation_review:{dinnerId}:{planDate}` (URL `/`, where the Home card
+    asks) through `plan.Service.MarkTried(planDate)`, "How was {dinner}?
+    Keep it in rotation?", once per Rotation check it opens. The
+    `rotation_check` schedule calls it at `review_time` for yesterday.
 - Delivery goes through `notification_outbox`.
 - Web Push uses VAPID (`webpush-go`). Google Chat uses the stored incoming
   webhook.
@@ -1107,7 +1163,7 @@ Fake-clock tests of a schedule live in `internal/scheduler`, where
   request. 404 when the week has no Supply run, 409
   `archived` when it is in the Supply archive, 400 `invalid_request` for a
   bad body. `shopping.SendToChat(weekStart, resend)` is what
-  `shopping_chat_autosend` calls (Feature 20).
+  `shopping_chat_autosend` calls, through `Autosend`.
 - `PATCH /api/v1/shopping/items/{id}` takes `{needed}` (a required
   boolean; it sets the flag, it does not flip it) and answers `{id,
   needed, needed_count, total_count}` with the list's counts after the

internal/ai/harness/runs.go

@@ -34,8 +34,8 @@ const (
 	StatusProviderError RunStatus = "provider_error"
 )
 
-// RunRetention is how long ai_runs rows are kept. The daily purge calls
-// Purge with time.Now().Add(-RunRetention).
+// RunRetention is how long ai_runs rows are kept. The daily purge,
+// PurgeSchedule, calls Purge with its fire time less RunRetention.
 const RunRetention = 30 * 24 * time.Hour
 
 // runSaveTimeout bounds writing the ai_runs row of a run that has failed,
@@ -46,9 +46,6 @@ var runSaveTimeout = 5 * time.Second
 // Purge deletes the ai_runs rows created before olderThan and returns how
 // many it deleted. The suggestion_batches and week_plans references to
 // those rows are cleared first, in the same transaction.
-//
-// Nothing in this package calls Purge: the scheduler's daily ai_runs purge
-// (Feature 20) must call it with time.Now().Add(-RunRetention).
 func Purge(ctx context.Context, st *store.Store, olderThan time.Time) (int64, error) {
 	if olderThan.IsZero() {
 		return 0, errors.New("harness: purge ai_runs: zero cutoff")

internal/ai/harness/schedule.go

@@ -0,0 +1,46 @@
+package harness
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"time"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/scheduler"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
+)
+
+// PurgeTime is when, every day in the household zone, ai_runs_purge runs.
+// It is fixed, not a setting.
+const PurgeTime = "03:00"
+
+// PurgeSchedule is the ai_runs_purge schedule over st: every day at
+// PurgeTime it deletes the ai_runs rows created more than RunRetention
+// before the fire time with Purge, its period scheduler.Daily keyed
+// ai_runs_purge:YYYY-MM-DD. A purge caught up late deletes no row younger
+// than RunRetention; one that fails is the period's error and is not
+// retried, and the next day's purge deletes what it left.
+func PurgeSchedule(st *store.Store, logger *slog.Logger) (scheduler.Schedule, error) {
+	if st == nil {
+		return scheduler.Schedule{}, errors.New("harness: purge schedule: nil store")
+	}
+	if logger == nil {
+		return scheduler.Schedule{}, errors.New("harness: purge schedule: nil logger")
+	}
+	return scheduler.Schedule{
+		Name: scheduler.AIRunsPurge,
+		Rule: func(household.Settings) scheduler.Rule {
+			return scheduler.Daily(PurgeTime)
+		},
+		Run: func(ctx context.Context, p scheduler.Period) error {
+			cutoff := p.FireAt.Add(-RunRetention)
+			n, err := Purge(ctx, st, cutoff)
+			if err != nil {
+				return err
+			}
+			logger.InfoContext(ctx, "ai_runs purged", "period", p.Key, "deleted", n, "created_before", cutoff.UTC().Format(time.RFC3339))
+			return nil
+		},
+	}, nil
+}

internal/chat/chat_test.go

@@ -308,7 +308,7 @@ func TestSendThreadsByWeek(t *testing.T) {
 		ListReady(week, 19, 7),
 		DayOfReminder(mustDate(t, "2026-10-18"), "01J9DINNER", "Tacos"),
 		NewSuggestions("01J9BATCH", week, []string{"Pho"}),
-		RotationReview("01J9DINNER", "Pho", week),
+		RotationReview("01J9DINNER", "Pho", mustDate(t, "2026-10-14")),
 	}
 	for _, ev := range events {
 		if err := svc.Send(ctx, notify.Message{ID: "n1", EventKey: ev.Key, Channel: notify.ChannelChat, Payload: payloadOf(ev), Attempt: 1}); err != nil {

internal/chat/messages.go

@@ -65,12 +65,27 @@ func ListReady(week store.LocalDate, needed, dinners int) notify.Event {
 }
 
 // DayOfReminder is the day_of_reminder event of the dinner dinnerID, named
-// name, planned on date.
+// name, planned on date: "Tonight: Tacos · Recipe →", a title carrying its
+// own call to action.
 func DayOfReminder(date store.LocalDate, dinnerID, name string) notify.Event {
 	return notify.Event{
 		Type:  notify.DayOfReminder,
 		Key:   string(notify.DayOfReminder) + ":" + date.String(),
-		Title: "Tonight's dinner",
+		Title: "Tonight: " + name + " · Recipe →",
+		URL:   "/dinner/" + dinnerID,
+		Week:  household.WeekStart(date),
+	}
+}
+
+// StartReminder is the day_of_reminder event, keyed
+// day_of_reminder:start:{date}, reminding the household to start the
+// crock-pot dinner dinnerID, named name and planned on date, by startBy,
+// a time in the household zone: "Start the crock pot by 9:30 am".
+func StartReminder(date store.LocalDate, dinnerID, name string, startBy time.Time) notify.Event {
+	return notify.Event{
+		Type:  notify.DayOfReminder,
+		Key:   string(notify.DayOfReminder) + ":start:" + date.String(),
+		Title: "Start the crock pot by " + startBy.Format("3:04 pm"),
 		Body:  name,
 		URL:   "/dinner/" + dinnerID,
 		Week:  household.WeekStart(date),
@@ -92,17 +107,17 @@ func NewSuggestions(id string, week store.LocalDate, names []string) notify.Even
 	}
 }
 
-// RotationReview is the rotation_review event asking whether the dinner
-// dinnerID, named name and tried in the week starting on week, becomes a
-// Regular.
-func RotationReview(dinnerID, name string, week store.LocalDate) notify.Event {
+// RotationReview is the rotation_review event, keyed
+// rotation_review:{dinnerID}:{planDate}, of the Rotation check of the
+// dinner dinnerID, named name and tried on planDate: "How was Pho? Keep it
+// in rotation?". It opens Home, where the Rotation check card asks.
+func RotationReview(dinnerID, name string, planDate store.LocalDate) notify.Event {
 	return notify.Event{
 		Type:  notify.RotationReview,
-		Key:   string(notify.RotationReview) + ":" + dinnerID,
-		Title: "Keep it in rotation?",
-		Body:  "You tried " + name + ". Make it a Regular?",
+		Key:   string(notify.RotationReview) + ":" + dinnerID + ":" + planDate.String(),
+		Title: "How was " + name + "? Keep it in rotation?",
 		URL:   "/",
-		Week:  week,
+		Week:  household.WeekStart(planDate),
 	}
 }
 
@@ -173,9 +188,13 @@ func planTitle(week, thisWeek store.LocalDate) string {
 }
 
 // Text is the Google Chat message of p: its title, its body after a colon
-// and the event's call to action with an arrow.
+// and the event's call to action with an arrow. A title ending in an arrow,
+// with no body, carries its own call to action and is the message as it is.
 func Text(p notify.Payload) string {
 	text := p.Title
+	if p.Body == "" && strings.HasSuffix(text, "→") {
+		return text
+	}
 	if p.Body != "" {
 		if endsSentence(text) {
 			text += " "

internal/chat/messages_test.go

@@ -2,6 +2,7 @@ package chat
 
 import (
 	"testing"
+	"time"
 
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/notify"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
@@ -100,9 +101,19 @@ func TestMessages(t *testing.T) {
 			key:   "day_of_reminder:2026-10-15",
 			url:   "/dinner/01J9Z8Y7X6W5V4T3S2R1Q0P9N8",
 			week:  "2026-10-12",
-			title: "Tonight's dinner",
-			body:  "Tacos",
-			chatT: "Tonight's dinner: Tacos. Open the recipe →",
+			title: "Tonight: Tacos · Recipe →",
+			body:  "",
+			chatT: "Tonight: Tacos · Recipe →",
+		},
+		{
+			name:  "crock-pot start reminder",
+			ev:    StartReminder(mustDate(t, "2026-10-15"), "01J9Z8Y7X6W5V4T3S2R1Q0P9N8", "Beef Chili", time.Date(2026, 10, 15, 9, 30, 0, 0, time.FixedZone("CDT", -5*60*60))),
+			key:   "day_of_reminder:start:2026-10-15",
+			url:   "/dinner/01J9Z8Y7X6W5V4T3S2R1Q0P9N8",
+			week:  "2026-10-12",
+			title: "Start the crock pot by 9:30 am",
+			body:  "Beef Chili",
+			chatT: "Start the crock pot by 9:30 am: Beef Chili. Open the recipe →",
 		},
 		{
 			name:  "new suggestions",
@@ -126,13 +137,13 @@ func TestMessages(t *testing.T) {
 		},
 		{
 			name:  "rotation review",
-			ev:    RotationReview("01J9DINNER", "Lemon orzo", week),
-			key:   "rotation_review:01J9DINNER",
+			ev:    RotationReview("01J9DINNER", "Lemon orzo", mustDate(t, "2026-10-14")),
+			key:   "rotation_review:01J9DINNER:2026-10-14",
 			url:   "/",
 			week:  "2026-10-12",
-			title: "Keep it in rotation?",
-			body:  "You tried Lemon orzo. Make it a Regular?",
-			chatT: "Keep it in rotation? You tried Lemon orzo. Make it a Regular? Open MealQuest →",
+			title: "How was Lemon orzo? Keep it in rotation?",
+			body:  "",
+			chatT: "How was Lemon orzo? Keep it in rotation? Open MealQuest →",
 		},
 	} {
 		ev := tc.ev

internal/dinners/detail.go

@@ -147,11 +147,11 @@ func readRecipe(ctx context.Context, q *db.Queries, recipeID string, d *Detail)
 		return fmt.Errorf("recipe %s: %w", recipeID, err)
 	}
 	if !IsManualRecipe(rec.SourceUrl) {
-		site, err := pageSiteName(rec.SiteName, rec.SourceUrl)
+		src, err := SourceOf(rec.SiteName, rec.SourceUrl)
 		if err != nil {
 			return err
 		}
-		d.Source = &Source{SiteName: site, URL: safeSourceURL(rec.SourceUrl)}
+		d.Source = &src
 	}
 	ings, err := q.ListRecipeIngredients(ctx, recipeID)
 	if err != nil {
@@ -182,7 +182,22 @@ func readRecipe(ctx context.Context, q *db.Queries, recipeID string, d *Detail)
 	return nil
 }
 
-// pageSiteName is the stored site name of a recipe fetched from sourceURL
+// SourceOf is the Source of a recipe fetched from sourceURL whose stored
+// site name is siteName: the name only when the page gave it (see
+// pageSiteName) and the link only when it is free of secrets (see
+// safeSourceURL). It is the one way a fetched recipe's source reaches a
+// client. A sourceURL that does not parse is an error, whether or not a
+// site name is stored.
+func SourceOf(siteName sql.NullString, sourceURL string) (Source, error) {
+	link, err := url.Parse(sourceURL)
+	if err != nil {
+		// Not wrapped: url.Parse's error quotes the link.
+		return Source{}, errors.New("source url does not parse")
+	}
+	return Source{SiteName: pageSiteName(siteName, link), URL: safeSourceURL(sourceURL)}, nil
+}
+
+// pageSiteName is the stored site name of a recipe fetched from link
 // when it is one the page gave, else nil. A page that names no site is
 // stored under recipes.HostSiteName of the URL it was served from: the
 // pasted link's host, which may hold a personal token (a private
@@ -192,23 +207,18 @@ func readRecipe(ctx context.Context, q *db.Queries, recipeID string, d *Detail)
 // is treated as one and withheld. A site that names itself as a domain,
 // such as "Food.com", loses its name with them: a credit that does not
 // name the site is better than one that leaks a link.
-func pageSiteName(stored sql.NullString, sourceURL string) (*string, error) {
+func pageSiteName(stored sql.NullString, link *url.URL) *string {
 	if !stored.Valid {
-		return nil, nil
-	}
-	link, err := url.Parse(sourceURL)
-	if err != nil {
-		// Not wrapped: url.Parse's error quotes the link.
-		return nil, errors.New("source url does not parse")
+		return nil
 	}
 	name := stored.String
 	if strings.EqualFold(name, recipes.HostSiteName(link)) || net.ParseIP(name) != nil {
-		return nil, nil
+		return nil
 	}
 	if u, err := url.Parse("https://" + name + "/"); err == nil && u.Host == name && strings.Contains(name, ".") {
-		return nil, nil
+		return nil
 	}
-	return &name, nil
+	return &name
 }
 
 // safeSourceURL is sourceURL when it is verifiably free of secrets — an

internal/dinners/dinners.go

@@ -138,6 +138,9 @@ type Service struct {
 	grounder  *recipes.Grounder
 	logger    *slog.Logger
 	groundJob *jobs.Kind[GroundJob]
+	// wake is called after every committed change to a dinner's method or
+	// minutes, which can move its crock-pot start reminder.
+	wake func()
 
 	// groundingsMu guards groundings: the KindGroundDinner jobs running,
 	// by dinner id, so archiving or renaming a dinner can stop them.
@@ -157,10 +160,11 @@ type Service struct {
 	offerSearches map[string]map[*offerSearch]struct{}
 }
 
-// NewService returns a service over st that grounds dinners with grounder
-// and registers the KindGroundDinner job on runner, which must not have
-// started yet.
-func NewService(st *store.Store, grounder *recipes.Grounder, runner *jobs.Runner, logger *slog.Logger) (*Service, error) {
+// NewService returns a service over st that grounds dinners with grounder,
+// calls wake (the scheduler's Wake) after every committed change to a
+// dinner's method or minutes, and registers the KindGroundDinner job on
+// runner, which must not have started yet.
+func NewService(st *store.Store, grounder *recipes.Grounder, runner *jobs.Runner, wake func(), logger *slog.Logger) (*Service, error) {
 	switch {
 	case st == nil:
 		return nil, errors.New("dinners: nil store")
@@ -168,10 +172,12 @@ func NewService(st *store.Store, grounder *recipes.Grounder, runner *jobs.Runner
 		return nil, errors.New("dinners: nil grounder")
 	case runner == nil:
 		return nil, errors.New("dinners: nil job runner")
+	case wake == nil:
+		return nil, errors.New("dinners: nil wake")
 	case logger == nil:
 		return nil, errors.New("dinners: nil logger")
 	}
-	s := &Service{st: st, grounder: grounder, logger: logger, groundings: make(map[string]map[*runningGrounding]struct{}), offerKey: make([]byte, 32), offers: make(map[string]*offerSet), offerSearches: make(map[string]map[*offerSearch]struct{})}
+	s := &Service{st: st, grounder: grounder, wake: wake, logger: logger, groundings: make(map[string]map[*runningGrounding]struct{}), offerKey: make([]byte, 32), offers: make(map[string]*offerSet), offerSearches: make(map[string]map[*offerSearch]struct{})}
 	rand.Read(s.offerKey) // never fails: it crashes the program instead
 	kind, err := jobs.Register(runner, KindGroundDinner, s.runGroundJob, Reasons...)
 	if err != nil {
@@ -502,6 +508,9 @@ func (s *Service) Update(ctx context.Context, id string, p Patch, updatedBy stri
 	if err != nil {
 		return Dinner{}, err
 	}
+	if p.Method != nil || p.MinutesTotal != nil {
+		s.wake()
+	}
 	if renamed {
 		updateCommitted()
 		s.clearOffers(row.ID, row.GroundingRevision)

internal/dinners/dinners_test.go

@@ -99,16 +99,19 @@ func TestPageSiteNameWithholdsHosts(t *testing.T) {
 		{"Bon Appétit", true, ptr("Bon Appétit")},
 		{"Mr. Food Test Kitchen", true, ptr("Mr. Food Test Kitchen")},
 	} {
-		got, err := dinners.PageSiteName(sql.NullString{String: tc.stored, Valid: tc.valid}, link)
+		src, err := dinners.SourceOf(sql.NullString{String: tc.stored, Valid: tc.valid}, link)
 		if err != nil {
-			t.Fatalf("PageSiteName(%q): %v", tc.stored, err)
+			t.Fatalf("SourceOf(%q): %v", tc.stored, err)
 		}
-		if (got == nil) != (tc.want == nil) || (got != nil && *got != *tc.want) {
-			t.Errorf("PageSiteName(%q) = %v, want %v", tc.stored, deref(got), deref(tc.want))
+		if got := src.SiteName; (got == nil) != (tc.want == nil) || (got != nil && *got != *tc.want) {
+			t.Errorf("SourceOf(%q) site name = %v, want %v", tc.stored, deref(got), deref(tc.want))
 		}
 	}
-	if _, err := dinners.PageSiteName(sql.NullString{String: "Delish", Valid: true}, "https://secret-token\x7f.example/%zz"); err == nil || strings.Contains(err.Error(), "secret-token") {
-		t.Errorf("PageSiteName of an unparseable link: err = %v, want one not quoting the link", err)
+	// A link that does not parse is an error with or without a site name.
+	for _, site := range []sql.NullString{{String: "Delish", Valid: true}, {}} {
+		if _, err := dinners.SourceOf(site, "https://secret-token\x7f.example/%zz"); err == nil || strings.Contains(err.Error(), "secret-token") {
+			t.Errorf("SourceOf(%v) of an unparseable link: err = %v, want one not quoting the link", site, err)
+		}
 	}
 }
 

internal/dinners/export_test.go

@@ -72,8 +72,5 @@ func (s *Service) RunGroundJob(ctx context.Context, p GroundJob) (string, error)
 	return r.GroundingStatus, err
 }
 
-// PageSiteName is pageSiteName.
-var PageSiteName = pageSiteName
-
 // SafeSourceURL is safeSourceURL.
 var SafeSourceURL = safeSourceURL

internal/dinners/grounding.go

@@ -196,6 +196,7 @@ func (s *Service) runGroundJob(ctx context.Context, p GroundJob, _ func(groundRe
 	if n == 0 {
 		return s.currentGrounding(ctx, row.ID)
 	}
+	s.wake()
 	return groundResult{DinnerID: row.ID, GroundingStatus: GroundingGrounded}, nil
 }
 
@@ -577,6 +578,7 @@ func (s *Service) Ground(ctx context.Context, id string, f Fix, updatedBy string
 	if err != nil {
 		return Dinner{}, fmt.Errorf("%w: dinner %s: record: %w", ErrGroundFailed, id, err)
 	}
+	s.wake()
 	s.clearOffers(cur.ID, math.MaxInt64)
 	return fromRow(row), nil
 }
@@ -700,6 +702,7 @@ func (s *Service) groundManual(ctx context.Context, id string, m ManualRecipe, u
 	if err != nil {
 		return Dinner{}, fmt.Errorf("%w: dinner %s: %w", ErrGroundFailed, id, err)
 	}
+	s.wake()
 	s.clearOffers(row.ID, math.MaxInt64)
 	return fromRow(row), nil
 }

internal/dinners/grounding_test.go

@@ -104,7 +104,7 @@ func newUnstartedEnvOn(t *testing.T, st *store.Store, dataDir string) *env {
 	if err != nil {
 		t.Fatal(err)
 	}
-	svc, err := dinners.NewService(st, g, runner, logger)
+	svc, err := dinners.NewService(st, g, runner, func() {}, logger)
 	if err != nil {
 		t.Fatal(err)
 	}

internal/ideas/ideas.go

@@ -11,6 +11,7 @@ package ideas
 
 import (
 	"context"
+	"database/sql"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -123,18 +124,18 @@ func NewService(st *store.Store, grounder *recipes.Grounder, generate Generator,
 	}
 	s := &Service{st: st, grounder: grounder, runner: runner, generate: generate, quick: quick, logger: logger}
 	var err error
-	if s.job, err = register(runner, KindFromIngredients, s.run, withoutIdeas[Result]); err != nil {
+	if s.job, err = register(runner, KindFromIngredients, s.run, shownJobResult[Result]); err != nil {
 		return nil, err
 	}
-	if s.quickJob, err = register(runner, KindQuick, s.runQuick, withoutIdeas[QuickResult]); err != nil {
+	if s.quickJob, err = register(runner, KindQuick, s.runQuick, shownJobResult[QuickResult]); err != nil {
 		return nil, err
 	}
 	return s, nil
 }
 
-// register registers the service-only job name, run by run, whose failed
-// jobs show their result through failed.
-func register[P any, R jobs.Public](runner *jobs.Runner, name string, run jobs.Handler[P, R], failed func(json.RawMessage) (json.RawMessage, error)) (*jobs.Kind[P], error) {
+// register registers the service-only job name, run by run, whose jobs
+// show their result through show.
+func register[P any, R jobs.Public](runner *jobs.Runner, name string, run jobs.Handler[P, R], show func(jobs.Status, json.RawMessage) (json.RawMessage, error)) (*jobs.Kind[P], error) {
 	kind, err := jobs.Register(runner, name, run, Reasons...)
 	if err != nil {
 		return nil, err
@@ -142,7 +143,7 @@ func register[P any, R jobs.Public](runner *jobs.Runner, name string, run jobs.H
 	if err := kind.ServiceOnly(); err != nil {
 		return nil, err
 	}
-	if err := kind.FailedResult(failed); err != nil {
+	if err := kind.ShownResult(show); err != nil {
 		return nil, err
 	}
 	return kind, nil
@@ -197,11 +198,13 @@ type Idea struct {
 	// Difficulty is easy, medium or hard.
 	Difficulty string `json:"difficulty"`
 	// Quick says whether the idea is a Quick dinner (see IsQuick).
-	Quick     bool   `json:"quick"`
-	RecipeID  string `json:"recipe_id"`
-	PhotoURL  string `json:"photo_url"`
-	SourceURL string `json:"source_url"`
-	SiteName  string `json:"site_name"`
+	Quick    bool   `json:"quick"`
+	RecipeID string `json:"recipe_id"`
+	PhotoURL string `json:"photo_url"`
+	// SourceURL and SiteName are the grounded recipe's source as
+	// dinners.SourceOf gives it: each null when it could leak a secret.
+	SourceURL *string `json:"source_url"`
+	SiteName  *string `json:"site_name"`
 }
 
 // Result is the KindFromIngredients result, published as the job goes:
@@ -251,6 +254,9 @@ type shownResult[R any] interface {
 	shown() int
 	// cleared is the result showing no ideas.
 	cleared() R
+	// withSafeSources is the result with each idea's source as
+	// shownSource gives it.
+	withSafeSources() (R, error)
 }
 
 func (r Result) shown() int { return len(r.Ideas) }
@@ -260,11 +266,25 @@ func (r Result) cleared() Result {
 	return r
 }
 
+func (r Result) withSafeSources() (Result, error) {
+	ideas := make([]Idea, len(r.Ideas))
+	for i, idea := range r.Ideas {
+		src, err := shownSource(idea.SourceURL, idea.SiteName)
+		if err != nil {
+			return Result{}, fmt.Errorf("ideas: idea %d: %w", i, err)
+		}
+		idea.SourceURL, idea.SiteName = src.URL, src.SiteName
+		ideas[i] = idea
+	}
+	r.Ideas = ideas
+	return r, nil
+}
+
 // finish ends a job whose work returned res and err. A job that failed
 // has its result published again with no ideas, to tidy the stored
 // result. That write is not what keeps a failed job from showing ideas,
 // since it may fail and a job interrupted by restart never makes it:
-// withoutIdeas, applied whenever a failed job is read, is.
+// shownJobResult, applied whenever a failed job is read, is.
 func finish[R shownResult[R]](ctx context.Context, logger *slog.Logger, what string, res R, err error, publish func(R) error) (R, error) {
 	var zero R
 	if err == nil {
@@ -312,9 +332,9 @@ func (s *Service) fill(ctx context.Context, p FromIngredientsJob, publish func(R
 	for i, idea := range out.Ideas {
 		reqs[i] = recipes.GroundRequest{DishName: idea.Name, Query: idea.SearchQuery}
 	}
-	err = keepGrounded(ctx, s.grounder, reqs, skills.IdeasKept, &res.Ideas, &res.Dropped, func(i int, gr recipes.Grounded) (Idea, bool) {
-		idea := ideaOf(out.Ideas[i], gr)
-		return idea, !p.QuickOnly || idea.Quick
+	err = keepGrounded(ctx, s.grounder, reqs, skills.IdeasKept, &res.Ideas, &res.Dropped, func(i int, gr recipes.Grounded) (Idea, bool, error) {
+		idea, err := ideaOf(out.Ideas[i], gr)
+		return idea, !p.QuickOnly || idea.Quick, err
 	}, func() error { return publish(res) })
 	if err != nil {
 		return res, err
@@ -333,9 +353,9 @@ func (s *Service) fill(ctx context.Context, p FromIngredientsJob, publish func(R
 // order (an idea that grounds sooner than one before it is shown first,
 // and the earlier one is put back in its place when it grounds) and
 // publish is called. An idea no recipe grounds, or that keep refuses,
-// counts in *dropped. Any other grounding failure, or publish failing, is
-// returned (see ground).
-func keepGrounded[T any](ctx context.Context, g *recipes.Grounder, reqs []recipes.GroundRequest, want int, shown *[]T, dropped *int, keep func(i int, gr recipes.Grounded) (T, bool), publish func() error) error {
+// counts in *dropped. Any other grounding failure, or keep or publish
+// failing, is returned (see ground).
+func keepGrounded[T any](ctx context.Context, g *recipes.Grounder, reqs []recipes.GroundRequest, want int, shown *[]T, dropped *int, keep func(i int, gr recipes.Grounded) (T, bool, error), publish func() error) error {
 	// order[k] is the index in reqs of (*shown)[k], so each idea is put in
 	// its place in reqs' order as it grounds.
 	var order []int
@@ -348,7 +368,10 @@ func keepGrounded[T any](ctx context.Context, g *recipes.Grounder, reqs []recipe
 				*dropped++
 				return nil
 			}
-			idea, ok := keep(first+i, *gr)
+			idea, ok, err := keep(first+i, *gr)
+			if err != nil {
+				return err
+			}
 			if !ok {
 				*dropped++
 				return nil
@@ -406,19 +429,32 @@ func ground(ctx context.Context, g *recipes.Grounder, reqs []recipes.GroundReque
 	return failed
 }
 
-// withoutIdeas is a failed job's stored result as the job shows it: with no
-// ideas, however the job failed, so a failed job never shows ideas kept
-// before the failure.
-func withoutIdeas[R shownResult[R]](stored json.RawMessage) (json.RawMessage, error) {
+// shownJobResult is a job's stored result as the job shows it. A failed
+// job's shows no ideas, however the job failed, so a failed job never
+// shows ideas kept before the failure. Any other job's shows each idea's
+// source as shownSource gives it, so a result stored before sources were
+// made safe never shows a link or name that could leak a secret.
+func shownJobResult[R shownResult[R]](status jobs.Status, stored json.RawMessage) (json.RawMessage, error) {
 	var res R
 	if err := json.Unmarshal(stored, &res); err != nil {
-		return nil, fmt.Errorf("ideas: decode failed job's result: %w", err)
+		return nil, fmt.Errorf("ideas: decode %s job's result: %w", status, err)
 	}
-	return res.cleared().PublicJSON()
+	if status == jobs.StatusFailed {
+		return res.cleared().PublicJSON()
+	}
+	safe, err := res.withSafeSources()
+	if err != nil {
+		return nil, err
+	}
+	return safe.PublicJSON()
 }
 
 // ideaOf is idea as grounded by gr.
-func ideaOf(idea skills.Idea, gr recipes.Grounded) Idea {
+func ideaOf(idea skills.Idea, gr recipes.Grounded) (Idea, error) {
+	src, err := sourceOf(gr)
+	if err != nil {
+		return Idea{}, err
+	}
 	return Idea{
 		Name:         idea.Name,
 		Uses:         idea.Uses,
@@ -430,9 +466,38 @@ func ideaOf(idea skills.Idea, gr recipes.Grounded) Idea {
 		Quick:        IsQuick(gr.Method, gr.MinutesTotal),
 		RecipeID:     gr.RecipeID,
 		PhotoURL:     dinners.PhotoURL(gr.PhotoID),
-		SourceURL:    gr.SourceURL,
-		SiteName:     gr.SiteName,
+		SourceURL:    src.URL,
+		SiteName:     src.SiteName,
+	}, nil
+}
+
+// sourceOf is gr's recipe source as a client may see it (see
+// dinners.SourceOf): a grounded recipe's site name is stored only when
+// not empty.
+func sourceOf(gr recipes.Grounded) (dinners.Source, error) {
+	src, err := dinners.SourceOf(sql.NullString{String: gr.SiteName, Valid: gr.SiteName != ""}, gr.SourceURL)
+	if err != nil {
+		return dinners.Source{}, fmt.Errorf("ideas: recipe %s: %w", gr.RecipeID, err)
 	}
+	return src, nil
+}
+
+// shownSource is the source of an idea as stored in a job's result, with
+// link sourceURL and site name siteName, as a client may see it (see
+// dinners.SourceOf). A result stored now already holds it, and one stored
+// before sources were made safe holds the grounded recipe's own, with ""
+// for no site name, as sourceOf reads it; a null link, which only a result
+// stored now holds, is checked as "".
+func shownSource(sourceURL, siteName *string) (dinners.Source, error) {
+	var link string
+	if sourceURL != nil {
+		link = *sourceURL
+	}
+	var site sql.NullString
+	if siteName != nil {
+		site = sql.NullString{String: *siteName, Valid: *siteName != ""}
+	}
+	return dinners.SourceOf(site, link)
 }
 
 // QuickJob is the KindQuick payload: the kind of Quick dinner wanted,
@@ -478,8 +543,9 @@ type QuickIdea struct {
 	Difficulty string `json:"difficulty"`
 	RecipeID   string `json:"recipe_id"`
 	PhotoURL   string `json:"photo_url"`
-	SourceURL  string `json:"source_url"`
-	SiteName   string `json:"site_name"`
+	// SourceURL and SiteName are as in Idea.
+	SourceURL *string `json:"source_url"`
+	SiteName  *string `json:"site_name"`
 }
 
 // QuickResult is the KindQuick result, published as the job goes: its
@@ -504,6 +570,20 @@ func (r QuickResult) cleared() QuickResult {
 	return r
 }
 
+func (r QuickResult) withSafeSources() (QuickResult, error) {
+	ideas := make([]QuickIdea, len(r.Ideas))
+	for i, idea := range r.Ideas {
+		src, err := shownSource(idea.SourceURL, idea.SiteName)
+		if err != nil {
+			return QuickResult{}, fmt.Errorf("ideas: idea %d: %w", i, err)
+		}
+		idea.SourceURL, idea.SiteName = src.URL, src.SiteName
+		ideas[i] = idea
+	}
+	r.Ideas = ideas
+	return r, nil
+}
+
 // OfQuickKind reports whether a recipe cooked by method in minutes (nil
 // when unknown) is a Quick dinner of kind: for skills.QuickCrockpot,
 // cooked in a crock pot (normalize_recipe writes a slow cooker as
@@ -564,8 +644,9 @@ func (s *Service) fillQuick(ctx context.Context, p QuickJob, publish func(QuickR
 	for i, idea := range out.Ideas {
 		reqs[i] = recipes.GroundRequest{DishName: idea.Name, Query: idea.SearchQuery}
 	}
-	err = keepGrounded(ctx, s.grounder, reqs, skills.QuickIdeasKept, &res.Ideas, &res.Dropped, func(i int, gr recipes.Grounded) (QuickIdea, bool) {
-		return quickIdeaOf(out.Ideas[i], gr), OfQuickKind(p.Kind, gr.Method, gr.MinutesTotal)
+	err = keepGrounded(ctx, s.grounder, reqs, skills.QuickIdeasKept, &res.Ideas, &res.Dropped, func(i int, gr recipes.Grounded) (QuickIdea, bool, error) {
+		idea, err := quickIdeaOf(out.Ideas[i], gr)
+		return idea, OfQuickKind(p.Kind, gr.Method, gr.MinutesTotal), err
 	}, func() error { return publish(res) })
 	if err != nil {
 		return res, err
@@ -578,7 +659,11 @@ func (s *Service) fillQuick(ctx context.Context, p QuickJob, publish func(QuickR
 }
 
 // quickIdeaOf is idea as grounded by gr.
-func quickIdeaOf(idea skills.QuickIdea, gr recipes.Grounded) QuickIdea {
+func quickIdeaOf(idea skills.QuickIdea, gr recipes.Grounded) (QuickIdea, error) {
+	src, err := sourceOf(gr)
+	if err != nil {
+		return QuickIdea{}, err
+	}
 	return QuickIdea{
 		Name:         idea.Name,
 		Method:       gr.Method,
@@ -586,9 +671,9 @@ func quickIdeaOf(idea skills.QuickIdea, gr recipes.Grounded) QuickIdea {
 		Difficulty:   gr.Difficulty,
 		RecipeID:     gr.RecipeID,
 		PhotoURL:     dinners.PhotoURL(gr.PhotoID),
-		SourceURL:    gr.SourceURL,
-		SiteName:     gr.SiteName,
-	}
+		SourceURL:    src.URL,
+		SiteName:     src.SiteName,
+	}, nil
 }
 
 // Origins of a dinner made from an idea (the dinners.origin column).

internal/ideas/quick_test.go

@@ -369,7 +369,7 @@ func TestStartQuickRunsTheJob(t *testing.T) {
 	if res.Stage != StageDone || res.Kind != skills.QuickCrockpot || !reflect.DeepEqual(res.Exclude, []string{"Beef Stew"}) || len(res.Ideas) != 1 {
 		t.Fatalf("result = %+v", res)
 	}
-	if got := res.Ideas[0]; got.Name != "Pulled Pork" || got.Method != "crockpot" || got.SiteName != "R Kitchen" {
+	if got := res.Ideas[0]; got.Name != "Pulled Pork" || got.Method != "crockpot" || got.SiteName == nil || *got.SiteName != "R Kitchen" {
 		t.Errorf("idea = %+v", got)
 	}
 }

internal/jobs/jobs.go

@@ -136,13 +136,13 @@ type runFunc func(ctx context.Context, payload string, publish func(json.RawMess
 
 // handler is a registered kind: run runs a job, check reports whether a
 // payload decodes into the kind's payload type, serviceOnly is set when
-// Runner.Enqueue refuses the kind, and failedResult, when set, is what Get
-// shows of a failed job's stored result (see Kind.FailedResult).
+// Runner.Enqueue refuses the kind, and shownResult, when set, is what Get
+// shows of a job's stored result (see Kind.ShownResult).
 type handler struct {
-	run          runFunc
-	check        func(payload []byte) bool
-	serviceOnly  bool
-	failedResult func(stored json.RawMessage) (json.RawMessage, error)
+	run         runFunc
+	check       func(payload []byte) bool
+	serviceOnly bool
+	shownResult func(status Status, stored json.RawMessage) (json.RawMessage, error)
 }
 
 // Runner owns the job handlers and the worker pool.
@@ -309,23 +309,24 @@ func (k *Kind[P]) ServiceOnly() error {
 	return nil
 }
 
-// FailedResult makes Get return, for a failed job of the kind with a
-// stored result, show's view of that result instead of the result itself.
-// It is applied on every read, so it holds however the job failed: by its
-// handler, as interrupted by restart, or after a write meant to tidy the
-// result failed. A show error fails Get. A kind that never calls it shows a
-// failed job's last result as stored. It must be called before Start.
-func (k *Kind[P]) FailedResult(show func(stored json.RawMessage) (json.RawMessage, error)) error {
+// ShownResult makes Get return, for a job of the kind with a stored
+// result, show's view of that result, given the job's status, instead of
+// the result itself. It is applied on every read, so it holds for every
+// stored result: however a job failed (by its handler, as interrupted by
+// restart, or after a write meant to tidy the result failed) and whatever
+// version of the kind stored it. A show error fails Get. A kind that never
+// calls it shows a job's result as stored. It must be called before Start.
+func (k *Kind[P]) ShownResult(show func(status Status, stored json.RawMessage) (json.RawMessage, error)) error {
 	if show == nil {
-		return fmt.Errorf("jobs: failed result %q: nil func", k.name)
+		return fmt.Errorf("jobs: shown result %q: nil func", k.name)
 	}
 	k.r.mu.Lock()
 	defer k.r.mu.Unlock()
 	if k.r.started {
-		return fmt.Errorf("jobs: failed result %q: runner already started", k.name)
+		return fmt.Errorf("jobs: shown result %q: runner already started", k.name)
 	}
 	h := k.r.handlers[k.name]
-	h.failedResult = show
+	h.shownResult = show
 	k.r.handlers[k.name] = h
 	return nil
 }
@@ -425,8 +426,8 @@ func (r *Runner) Wait() {
 	r.wg.Wait()
 }
 
-// Get returns the job with id, or ErrNotFound. A failed job's result is
-// shown through its kind's FailedResult, when the kind set one.
+// Get returns the job with id, or ErrNotFound. A job's result is shown
+// through its kind's ShownResult, when the kind set one.
 func (r *Runner) Get(ctx context.Context, id string) (Job, error) {
 	row, err := db.New(r.st.Reader).GetJob(ctx, id)
 	if errors.Is(err, sql.ErrNoRows) {
@@ -442,17 +443,17 @@ func (r *Runner) Get(ctx context.Context, id string) (Job, error) {
 	if row.Error.Valid {
 		job.Error = &row.Error.String
 	}
-	if job.Status == StatusFailed && job.Result != nil {
+	if job.Result != nil {
 		r.mu.Lock()
-		show := r.handlers[job.Kind].failedResult
+		show := r.handlers[job.Kind].shownResult
 		r.mu.Unlock()
 		if show != nil {
-			shown, err := show(job.Result)
+			shown, err := show(job.Status, job.Result)
 			if err != nil {
-				return Job{}, fmt.Errorf("jobs: show failed %s result: %w", job.Kind, err)
+				return Job{}, fmt.Errorf("jobs: show %s %s result: %w", job.Status, job.Kind, err)
 			}
 			if !json.Valid(shown) {
-				return Job{}, fmt.Errorf("jobs: show failed %s result: not one JSON value", job.Kind)
+				return Job{}, fmt.Errorf("jobs: show %s %s result: not one JSON value", job.Status, job.Kind)
 			}
 			job.Result = shown
 		}

internal/jobs/jobs_test.go

@@ -773,7 +773,7 @@ func TestServiceOnlyKind(t *testing.T) {
 	}
 }
 
-func TestFailedResultAppliesOnlyToItsKindsFailedJobs(t *testing.T) {
+func TestShownResultAppliesOnlyToItsKindsJobs(t *testing.T) {
 	t.Parallel()
 	st := migratedStore(t)
 	r := newRunner(t, st, 1)
@@ -788,17 +788,24 @@ func TestFailedResultAppliesOnlyToItsKindsFailedJobs(t *testing.T) {
 	}
 	hidden := register(t, r, "hidden", h, "stopped")
 	plain := register(t, r, "plain", h, "stopped")
-	if err := hidden.FailedResult(func(json.RawMessage) (json.RawMessage, error) {
-		return json.RawMessage(`{"done":0}`), nil
+	if err := hidden.ShownResult(func(status Status, stored json.RawMessage) (json.RawMessage, error) {
+		if status == StatusFailed {
+			return json.RawMessage(`{"done":0}`), nil
+		}
+		var res countResult
+		if err := json.Unmarshal(stored, &res); err != nil {
+			return nil, err
+		}
+		return json.Marshal(countResult{Done: res.Done * 10})
 	}); err != nil {
 		t.Fatal(err)
 	}
-	if err := hidden.FailedResult(nil); err == nil {
-		t.Error("FailedResult(nil) succeeded, want an error")
+	if err := hidden.ShownResult(nil); err == nil {
+		t.Error("ShownResult(nil) succeeded, want an error")
 	}
 	start(t, r)
-	if err := hidden.FailedResult(func(s json.RawMessage) (json.RawMessage, error) { return s, nil }); err == nil {
-		t.Error("FailedResult after Start succeeded, want an error")
+	if err := hidden.ShownResult(func(_ Status, s json.RawMessage) (json.RawMessage, error) { return s, nil }); err == nil {
+		t.Error("ShownResult after Start succeeded, want an error")
 	}
 
 	for _, tc := range []struct {
@@ -806,9 +813,10 @@ func TestFailedResultAppliesOnlyToItsKindsFailedJobs(t *testing.T) {
 		steps int
 		want  string
 	}{
-		{hidden, 0, `{"done":0}`}, // failed: shown through FailedResult
-		{hidden, 3, `{"done":3}`}, // succeeded: as stored
-		{plain, 0, `{"done":5}`},  // failed, kind without FailedResult: as stored
+		{hidden, 0, `{"done":0}`},  // failed: shown through ShownResult
+		{hidden, 3, `{"done":30}`}, // succeeded: shown through ShownResult
+		{plain, 0, `{"done":5}`},   // failed, kind without ShownResult: as stored
+		{plain, 3, `{"done":3}`},   // succeeded, kind without ShownResult: as stored
 	} {
 		job := waitFor(t, r, enqueue(t, tc.kind, countPayload{Steps: tc.steps}), finished)
 		if string(job.Result) != tc.want {

internal/notify/notify.go

@@ -27,6 +27,7 @@ import (
 	"fmt"
 	"log/slog"
 	"net/url"
+	"slices"
 	"strings"
 	"sync"
 	"time"
@@ -238,6 +239,19 @@ func (s *Service) emitTx(ctx context.Context, tx *sql.Tx, ev Event, channels fun
 	return nil
 }
 
+// ChannelOn reports whether the preference of event type ev switches
+// channel ch on. A type with no preference row is an error.
+func (s *Service) ChannelOn(ctx context.Context, ev EventType, ch Channel) (bool, error) {
+	pref, err := db.New(s.st.Reader).GetNotificationPref(ctx, string(ev))
+	if errors.Is(err, sql.ErrNoRows) {
+		return false, fmt.Errorf("notify: no notification preference for %s", ev)
+	}
+	if err != nil {
+		return false, fmt.Errorf("notify: read notification preference for %s: %w", ev, err)
+	}
+	return slices.Contains(enabledChannels(pref), ch), nil
+}
+
 // enabledChannels returns the channels pref switches on.
 func enabledChannels(pref db.NotificationPref) []Channel {
 	var chs []Channel

internal/plan/draft.go

@@ -234,6 +234,7 @@ func (s *Service) storeDraft(ctx context.Context, weekStart, thisWeek store.Loca
 		return "", err
 	}
 	s.notifier.Wake()
+	s.wake()
 	return planID, nil
 }
 

internal/plan/plan.go

@@ -141,6 +141,9 @@ type Service struct {
 	draft    Drafter
 	cal      Calendar
 	notifier *notify.Service
+	// wake is called after every committed change to a plan's days, which
+	// can move a crock-pot dinner's start reminder.
+	wake     func()
 	logger   *slog.Logger
 	draftJob *jobs.Kind[DraftJob]
 	// publicURL is MEALQUEST_PUBLIC_URL, under which a pushed event links
@@ -150,11 +153,12 @@ type Service struct {
 
 // NewService returns a service over st that drafts with draft, pushes to
 // cal with links under publicURL, tells the household through notifier,
-// which must be over st, and registers the KindDraftWeek job on
+// which must be over st, calls wake (the scheduler's Wake) after every
+// committed change to a plan's days, and registers the KindDraftWeek job on
 // runner, which must not have started yet. The kind is service-only:
-// StartDraft, which keeps one draft in flight per week, is the only way to
-// enqueue it.
-func NewService(st *store.Store, draft Drafter, runner *jobs.Runner, cal Calendar, notifier *notify.Service, publicURL *url.URL, logger *slog.Logger) (*Service, error) {
+// StartDraft and StartScheduledDraft, which keep one draft in flight per
+// week, are the only way to enqueue it.
+func NewService(st *store.Store, draft Drafter, runner *jobs.Runner, cal Calendar, notifier *notify.Service, wake func(), publicURL *url.URL, logger *slog.Logger) (*Service, error) {
 	switch {
 	case st == nil:
 		return nil, errors.New("plan: nil store")
@@ -166,12 +170,14 @@ func NewService(st *store.Store, draft Drafter, runner *jobs.Runner, cal Calenda
 		return nil, errors.New("plan: nil calendar")
 	case notifier == nil:
 		return nil, errors.New("plan: nil notifier")
+	case wake == nil:
+		return nil, errors.New("plan: nil wake")
 	case publicURL == nil:
 		return nil, errors.New("plan: nil public URL")
 	case logger == nil:
 		return nil, errors.New("plan: nil logger")
 	}
-	s := &Service{st: st, draft: draft, cal: cal, notifier: notifier, logger: logger, publicURL: publicURL}
+	s := &Service{st: st, draft: draft, cal: cal, notifier: notifier, wake: wake, logger: logger, publicURL: publicURL}
 	kind, err := jobs.Register(runner, KindDraftWeek, s.runDraft, Reasons...)
 	if err != nil {
 		return nil, err
@@ -233,10 +239,10 @@ func (s *Service) Get(ctx context.Context, weekStart store.LocalDate) (p Plan, e
 }
 
 // EmitDayOfReminder emits day_of_reminder for date, keyed by the date,
-// naming the dinner planned on it, and reports whether it did: a date whose
-// week has no plan emits nothing. The scheduler calls it at the
-// household's reminder_time (Feature 20); emitting a date again stores no
-// second notification.
+// "Tonight: {dinner} · Recipe →" for the dinner planned on it, and reports
+// whether it did: a date whose week has no plan emits nothing. The
+// day_of_reminder schedule calls it at the household's reminder_time
+// (ReminderSchedules); emitting a date again stores no second notification.
 func (s *Service) EmitDayOfReminder(ctx context.Context, date store.LocalDate) (bool, error) {
 	p, err := s.Get(ctx, household.WeekStart(date))
 	if errors.Is(err, ErrNotFound) {
@@ -245,15 +251,14 @@ func (s *Service) EmitDayOfReminder(ctx context.Context, date store.LocalDate) (
 	if err != nil {
 		return false, err
 	}
-	for _, d := range p.Days {
-		if d.Date == date.String() {
-			if err := s.notifier.Emit(ctx, chat.DayOfReminder(date, d.Dinner.ID, d.Dinner.Name)); err != nil {
-				return false, fmt.Errorf("plan: %w", err)
-			}
-			return true, nil
-		}
+	d, err := p.day(date)
+	if err != nil {
+		return false, err
 	}
-	return false, fmt.Errorf("plan: week %s has no day %s", p.WeekStart, date)
+	if err := s.notifier.Emit(ctx, chat.DayOfReminder(date, d.Dinner.ID, d.Dinner.Name)); err != nil {
+		return false, fmt.Errorf("plan: %w", err)
+	}
+	return true, nil
 }
 
 // readPlan reads the plan of the week starting weekStart through q, with
@@ -342,10 +347,27 @@ type Draft struct {
 // enqueues nothing. Drafting over a synced or changed plan needs confirm,
 // else it fails with ErrConfirmRequired and enqueues nothing.
 func (s *Service) StartDraft(ctx context.Context, weekStart store.LocalDate, confirm bool) (Draft, error) {
+	d, _, err := s.startDraft(ctx, weekStart, confirm, false)
+	return d, err
+}
+
+// StartScheduledDraft is StartDraft, without confirm, for the plan_draft
+// schedule: it enqueues the same KindDraftWeek job, or returns the one
+// queued or running, only while the week starting weekStart has no plan.
+// A week that has a plan, in any status, is left as it is: nothing is
+// enqueued and planned is true.
+func (s *Service) StartScheduledDraft(ctx context.Context, weekStart store.LocalDate) (d Draft, planned bool, err error) {
+	return s.startDraft(ctx, weekStart, false, true)
+}
+
+// startDraft is StartDraft, and when onlyUnplanned is set it enqueues
+// nothing for a week that has a plan and reports planned true.
+func (s *Service) startDraft(ctx context.Context, weekStart store.LocalDate, confirm, onlyUnplanned bool) (Draft, bool, error) {
 	if _, err := household.WeekDays(weekStart); err != nil {
-		return Draft{}, &InvalidWeekError{Value: weekStart.String()}
+		return Draft{}, false, &InvalidWeekError{Value: weekStart.String()}
 	}
 	var d Draft
+	planned := false
 	err := s.st.WithTx(ctx, func(tx *sql.Tx) error {
 		q := db.New(tx)
 		cur, err := q.GetWeekPlan(ctx, weekStart.String())
@@ -353,6 +375,9 @@ func (s *Service) StartDraft(ctx context.Context, weekStart store.LocalDate, con
 		case errors.Is(err, sql.ErrNoRows):
 		case err != nil:
 			return fmt.Errorf("plan: read week %s: %w", weekStart, err)
+		case onlyUnplanned:
+			planned = true
+			return nil
 		case cur.Status != StatusDraft && !confirm:
 			return ErrConfirmRequired
 		}
@@ -375,12 +400,12 @@ func (s *Service) StartDraft(ctx context.Context, weekStart store.LocalDate, con
 		return nil
 	})
 	if err != nil {
-		return Draft{}, err
+		return Draft{}, false, err
 	}
 	if d.Created {
 		s.draftJob.Wake()
 	}
-	return d, nil
+	return d, planned, nil
 }
 
 // Swap plans dinnerID on date of the week starting weekStart, marking the
@@ -450,6 +475,7 @@ func (s *Service) Swap(ctx context.Context, weekStart store.LocalDate, date, din
 	if err != nil {
 		return Plan{}, err
 	}
+	s.wake()
 	return p, nil
 }
 

internal/plan/plan_test.go

@@ -146,7 +146,7 @@ func newEnv(t *testing.T) *env {
 	if err != nil {
 		t.Fatal(err)
 	}
-	e.svc, err = plan.NewService(st, drafter, e.runner, e.gcal, notifytest.New(t, st), publicURL, logger)
+	e.svc, err = plan.NewService(st, drafter, e.runner, e.gcal, notifytest.New(t, st), func() {}, publicURL, logger)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -428,8 +428,8 @@ func TestEmitDayOfReminder(t *testing.T) {
 		t.Fatalf("day_of_reminder rows = %+v, want one on push", rows)
 	}
 	r := rows[0]
-	if r.Key != "day_of_reminder:2026-10-14" || r.Channel != notify.ChannelPush || r.Payload.Title != "Tonight's dinner" ||
-		r.Payload.Body != "Pad Thai" || r.Payload.URL != "/dinner/"+e.ids["Pad Thai"] || r.Payload.Week != "2026-10-12" {
+	if r.Key != "day_of_reminder:2026-10-14" || r.Channel != notify.ChannelPush || r.Payload.Title != "Tonight: Pad Thai · Recipe →" ||
+		r.Payload.Body != "" || r.Payload.URL != "/dinner/"+e.ids["Pad Thai"] || r.Payload.Week != "2026-10-12" {
 		t.Errorf("day_of_reminder row = %+v", r)
 	}
 }

internal/plan/reminder.go

@@ -0,0 +1,150 @@
+package plan
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/chat"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/db"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/scheduler"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
+)
+
+// StartReminderLead is how long before a crock-pot dinner's start_by its
+// start reminder fires.
+const StartReminderLead = 15 * time.Minute
+
+// StartReminderKey is the period key prefix of the crock-pot start
+// reminder: its periods are start:YYYY-MM-DD of the day_of_reminder
+// schedule.
+const StartReminderKey = "start"
+
+// ReminderSchedules are the day_of_reminder schedules. The first fires
+// every day at the household's reminder_time, period YYYY-MM-DD, and emits
+// day_of_reminder:YYYY-MM-DD for tonight's dinner (EmitDayOfReminder). The
+// second fires StartReminderLead before the start_by of a crock-pot dinner
+// whose start_by is earlier than that day's reminder_time, period
+// start:YYYY-MM-DD of the dinner's date, and emits
+// day_of_reminder:start:YYYY-MM-DD (EmitStartReminder). A date whose week
+// has no plan emits neither.
+func (s *Service) ReminderSchedules() []scheduler.Schedule {
+	return []scheduler.Schedule{
+		{
+			Name: scheduler.DayOfReminder,
+			Rule: func(settings household.Settings) scheduler.Rule {
+				return scheduler.Daily(settings.ReminderTime)
+			},
+			Run: func(ctx context.Context, p scheduler.Period) error {
+				sent, err := s.EmitDayOfReminder(ctx, p.Date)
+				if err != nil {
+					return err
+				}
+				if !sent {
+					s.logger.InfoContext(ctx, "day-of reminder not sent: the week has no plan",
+						"period", p.Key, "date", p.Date.String())
+				}
+				return nil
+			},
+		},
+		{
+			Name: scheduler.DayOfReminder,
+			Key:  StartReminderKey,
+			Rule: func(household.Settings) scheduler.Rule {
+				return scheduler.DailyAt(s.startReminderAt)
+			},
+			Run: func(ctx context.Context, p scheduler.Period) error {
+				sent, err := s.EmitStartReminder(ctx, p.Date)
+				if err != nil {
+					return err
+				}
+				if !sent {
+					s.logger.InfoContext(ctx, "start reminder not sent: no crock-pot dinner to start before the reminder",
+						"period", p.Key, "date", p.Date.String())
+				}
+				return nil
+			},
+		},
+	}
+}
+
+// EmitStartReminder emits day_of_reminder:start:{date}, "Start the crock
+// pot by {time}", for the crock-pot dinner planned on date, and reports
+// whether it did: it emits nothing unless date's dinner has a start_by
+// earlier than date's reminder_time. Emitting a date again stores no
+// second notification.
+func (s *Service) EmitStartReminder(ctx context.Context, date store.LocalDate) (bool, error) {
+	d, ok, err := s.startReminder(ctx, date)
+	if err != nil || !ok {
+		return false, err
+	}
+	if err := s.notifier.Emit(ctx, chat.StartReminder(date, d.Dinner.ID, d.Dinner.Name, *d.StartBy)); err != nil {
+		return false, fmt.Errorf("plan: %w", err)
+	}
+	return true, nil
+}
+
+// startReminderAt is the start reminder's scheduler.FireAt: the
+// StartReminderLead before start_by of the dinner date's start reminder,
+// if it has one.
+func (s *Service) startReminderAt(ctx context.Context, date store.LocalDate) (time.Time, bool, error) {
+	d, ok, err := s.startReminder(ctx, date)
+	if err != nil || !ok {
+		return time.Time{}, false, err
+	}
+	return d.StartBy.Add(-StartReminderLead), true, nil
+}
+
+// startReminder returns the plan day of date when it has a start reminder:
+// its dinner has a start_by (a crock-pot dinner of known minutes) earlier
+// than the household's reminder_time on date. The plan and the settings
+// come from one read transaction.
+func (s *Service) startReminder(ctx context.Context, date store.LocalDate) (d Day, ok bool, err error) {
+	tx, err := s.st.Reader.BeginTx(ctx, nil)
+	if err != nil {
+		return Day{}, false, fmt.Errorf("plan: begin read: %w", err)
+	}
+	defer func() {
+		err = errors.Join(err, tx.Rollback())
+	}()
+	q := db.New(tx)
+	p, err := readPlan(ctx, q, household.WeekStart(date))
+	if errors.Is(err, ErrNotFound) {
+		return Day{}, false, nil
+	}
+	if err != nil {
+		return Day{}, false, err
+	}
+	d, err = p.day(date)
+	if err != nil {
+		return Day{}, false, err
+	}
+	if d.StartBy == nil {
+		return Day{}, false, nil
+	}
+	settings, err := q.GetHouseholdSettings(ctx)
+	if err != nil {
+		return Day{}, false, fmt.Errorf("plan: read household settings: %w", err)
+	}
+	zone, err := household.LoadZone(settings.Timezone)
+	if err != nil {
+		return Day{}, false, fmt.Errorf("plan: household settings: %w", err)
+	}
+	remind, err := household.LocalTime(zone, date, settings.ReminderTime)
+	if err != nil {
+		return Day{}, false, fmt.Errorf("plan: reminder time of %s: %w", date, err)
+	}
+	return d, d.StartBy.Before(remind), nil
+}
+
+// day returns p's day on date; a plan holds all seven days of its week.
+func (p Plan) day(date store.LocalDate) (Day, error) {
+	for _, d := range p.Days {
+		if d.Date == date.String() {
+			return d, nil
+		}
+	}
+	return Day{}, fmt.Errorf("plan: week %s has no day %s", p.WeekStart, date)
+}

internal/plan/rotation.go

@@ -6,8 +6,11 @@ import (
 	"errors"
 	"fmt"
 
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/chat"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/db"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/dinners"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/scheduler"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
 )
 
@@ -79,12 +82,40 @@ type Decided struct {
 	UpdatedBy    string `json:"updated_by"`
 }
 
+// RotationCheckSchedule is the rotation_check schedule: every day at the
+// household's review_time it runs MarkTried for the day before, so each
+// Quest log dinner planned yesterday is tried and the household is asked
+// "Keep it in rotation?". Its period is the fire date, claimed as
+// rotation_check:YYYY-MM-DD. It never makes a dinner a Regular.
+func (s *Service) RotationCheckSchedule() scheduler.Schedule {
+	return scheduler.Schedule{
+		Name: scheduler.RotationCheck,
+		Rule: func(settings household.Settings) scheduler.Rule {
+			return scheduler.Daily(settings.ReviewTime)
+		},
+		PeriodKey: func(p scheduler.Period) string {
+			return scheduler.RotationCheck + ":" + p.Key
+		},
+		Run: func(ctx context.Context, p scheduler.Period) error {
+			yesterday := addDays(p.Date, -1)
+			n, err := s.MarkTried(ctx, yesterday)
+			if err != nil {
+				return err
+			}
+			s.logger.InfoContext(ctx, "Rotation check: Quest log dinners marked tried",
+				"period", p.Key, "plan_date", yesterday.String(), "tried", n)
+			return nil
+		},
+	}
+}
+
 // MarkTried moves every dinner in the Quest log planned on date, the
-// household-local day just past, on a plan of any status, to tried and
-// opens a pending Rotation check of it for date. It is idempotent: a
-// dinner already checked for date is left as it is, so a later run never
-// moves one returned to the Quest log ("We didn't make it") again. It
-// returns how many dinners it moved.
+// household-local day just past, on a plan of any status, to tried, opens
+// a pending Rotation check of it for date and emits its rotation_review
+// (chat.RotationReview), all in one transaction. It is idempotent: a
+// dinner already checked for date is left as it is and not notified of
+// again, so a later run never moves one returned to the Quest log ("We
+// didn't make it") again. It returns how many dinners it moved.
 func (s *Service) MarkTried(ctx context.Context, date store.LocalDate) (int, error) {
 	var n int
 	err := s.st.WithTx(ctx, func(tx *sql.Tx) error {
@@ -95,6 +126,10 @@ func (s *Service) MarkTried(ctx context.Context, date store.LocalDate) (int, err
 		}
 		now := store.Now().String()
 		for _, id := range ids {
+			d, err := q.GetDinner(ctx, id)
+			if err != nil {
+				return fmt.Errorf("plan: read dinner %s: %w", id, err)
+			}
 			moved, err := q.MarkDinnerTried(ctx, db.MarkDinnerTriedParams{UpdatedAt: now, ID: id})
 			if err != nil {
 				return fmt.Errorf("plan: mark %s tried: %w", id, err)
@@ -107,6 +142,9 @@ func (s *Service) MarkTried(ctx context.Context, date store.LocalDate) (int, err
 			}); err != nil {
 				return fmt.Errorf("plan: open Rotation check of %s for %s: %w", id, date, err)
 			}
+			if err := s.notifier.EmitTx(ctx, tx, chat.RotationReview(id, d.Name, date)); err != nil {
+				return fmt.Errorf("plan: %w", err)
+			}
 		}
 		n = len(ids)
 		return nil
@@ -114,6 +152,9 @@ func (s *Service) MarkTried(ctx context.Context, date store.LocalDate) (int, err
 	if err != nil {
 		return 0, err
 	}
+	if n > 0 {
+		s.notifier.Wake()
+	}
 	return n, nil
 }
 

internal/plan/schedule.go

@@ -0,0 +1,42 @@
+package plan
+
+import (
+	"context"
+	"time"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/scheduler"
+)
+
+// DraftSchedule is the plan_draft schedule: at the household's
+// plan_draft_dow and plan_draft_time it drafts the week after the fire
+// date's, its period scheduler.WeeklyForNextWeek keys plan_draft:YYYY-Www
+// for that week. The draft is the KindDraftWeek job a manual draft runs
+// (StartScheduledDraft), so a stored draft emits plan_ready keyed
+// plan_ready:{weekStart} and a draft that fails, as when the AI fails,
+// stores no plan and emits nothing. A week that already has a plan is left
+// as it is, and so is a draft of it already queued or running; either way
+// the period says so.
+func (s *Service) DraftSchedule() scheduler.Schedule {
+	return scheduler.Schedule{
+		Name: scheduler.PlanDraft,
+		Rule: func(settings household.Settings) scheduler.Rule {
+			return scheduler.WeeklyForNextWeek(time.Weekday(settings.PlanDraftDow), settings.PlanDraftTime)
+		},
+		Run: func(ctx context.Context, p scheduler.Period) error {
+			d, planned, err := s.StartScheduledDraft(ctx, p.Week)
+			if err != nil {
+				return err
+			}
+			switch {
+			case planned:
+				s.logger.InfoContext(ctx, "scheduled week draft not started: the week already has a plan",
+					"period", p.Key, "week_start", p.Week.String())
+			case !d.Created:
+				s.logger.WarnContext(ctx, "scheduled week draft not started: a draft of the week is already under way",
+					"period", p.Key, "week_start", p.Week.String(), "job_id", d.JobID)
+			}
+			return nil
+		},
+	}
+}

internal/scheduler/day_of_reminder_test.go

@@ -0,0 +1,328 @@
+package scheduler_test
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/harness"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/db"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/notify"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/notify/notifytest"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/scheduler"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
+)
+
+// The tests in this file run plan's day_of_reminder schedules on the fake
+// clock against the real plan service and notification outbox. The plan of
+// the week of Monday Oct 12 (w42) has poolNames Monday to Sunday: Beef
+// Chili on Monday, Pot Roast on Tuesday. The household's dinner time is the
+// seeded 17:30 and its reminder time the seeded 16:30, in Chicago.
+
+// w42 is the Monday of 2026-W42.
+var w42 = mustLocalDate("2026-10-12")
+
+// planWeek drafts the plan of the week starting weekStart and waits for it.
+func (p *planEnv) planWeek(weekStart store.LocalDate) {
+	p.e.t.Helper()
+	p.reply(weekStart)
+	if _, err := p.svc.StartDraft(context.Background(), weekStart, false); err != nil {
+		p.e.t.Fatal(err)
+	}
+	if jobs := p.e.drafts(); jobs[len(jobs)-1] != succeeded {
+		p.e.t.Fatalf("draft of %s = %+v, want succeeded", weekStart, jobs)
+	}
+}
+
+// crockPot makes the dinner name a crock-pot dinner of minutes.
+func (p *planEnv) crockPot(name string, minutes int) {
+	p.e.t.Helper()
+	if _, err := p.e.st.Writer.Exec(`UPDATE dinners SET method = 'crockpot', minutes_total = ? WHERE id = ?`, minutes, p.ids[name]); err != nil {
+		p.e.t.Fatal(err)
+	}
+}
+
+// reminders returns the day_of_reminder notifications stored, oldest
+// first. The seeded preference sends day_of_reminder to push only, so there
+// is one row per event.
+func (e *env) reminders() []notifytest.Row {
+	e.t.Helper()
+	rows := notifytest.Rows(e.t, e.st, notify.DayOfReminder)
+	for _, r := range rows {
+		if r.Channel != notify.ChannelPush {
+			e.t.Fatalf("day_of_reminder row %+v, want push only", r)
+		}
+	}
+	return rows
+}
+
+// reminderKeys returns the keys of e.reminders().
+func (e *env) reminderKeys() []string {
+	e.t.Helper()
+	var keys []string
+	for _, r := range e.reminders() {
+		keys = append(keys, r.Key)
+	}
+	return keys
+}
+
+// wantReminder fails unless the reminder keyed key was stored with title,
+// body and the link to the dinner name.
+func (p *planEnv) wantReminder(key, title, body, name string) {
+	p.e.t.Helper()
+	for _, r := range p.e.reminders() {
+		if r.Key != key {
+			continue
+		}
+		week := household.WeekStart(mustLocalDate(key[len(key)-len("YYYY-MM-DD"):]))
+		want := notify.Payload{Event: notify.DayOfReminder, Title: title, Body: body, URL: "/dinner/" + p.ids[name], Tag: key, Week: week.String()}
+		if r.Payload != want {
+			p.e.t.Errorf("reminder %s = %+v, want %+v", key, r.Payload, want)
+		}
+		return
+	}
+	p.e.t.Errorf("no reminder %s", key)
+}
+
+// TestDayOfReminderNormalNight: a night whose dinner is not a crock-pot
+// dinner gets exactly the daily reminder, at reminder_time 16:30, keyed
+// day_of_reminder:YYYY-MM-DD and linking to the dinner.
+func TestDayOfReminderNormalNight(t *testing.T) {
+	e := newEnv(t)
+	p := e.plans(e.pool())
+	p.planWeek(w42)
+
+	// Monday 08:00: the catch-up of Sunday 16:30 finds no plan for W41.
+	r := e.start(at(2026, 10, 12, 8, 0), p.svc.ReminderSchedules()...)
+	r.runUntil(at(2026, 10, 12, 16, 29))
+	wantKeys(t, "before 16:30", e.reminderKeys(), nil)
+
+	r.runUntil(at(2026, 10, 12, 16, 30))
+	wantKeys(t, "at 16:30", e.reminderKeys(), []string{"day_of_reminder:2026-10-12"})
+	p.wantReminder("day_of_reminder:2026-10-12", "Tonight: Beef Chili · Recipe →", "", "Beef Chili")
+
+	r.runUntil(at(2026, 10, 13, 23, 59))
+	wantKeys(t, "Tuesday", e.reminderKeys(), []string{"day_of_reminder:2026-10-12", "day_of_reminder:2026-10-13"})
+	p.wantReminder("day_of_reminder:2026-10-13", "Tonight: Pot Roast · Recipe →", "", "Pot Roast")
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.DayOfReminder), []string{"2026-10-11", "2026-10-12", "2026-10-13"})
+}
+
+// TestDayOfReminderCrockPotNight: a crock-pot night whose start_by is
+// earlier than reminder_time gets the start reminder at start_by minus 15
+// minutes, keyed day_of_reminder:start:YYYY-MM-DD, and the daily reminder
+// at reminder_time. A crock-pot night whose start_by is not earlier than
+// reminder_time gets only the daily one.
+func TestDayOfReminderCrockPotNight(t *testing.T) {
+	e := newEnv(t)
+	p := e.plans(e.pool())
+	p.crockPot("Beef Chili", 480) // Monday: start by 09:30
+	p.crockPot("Pot Roast", 30)   // Tuesday: start by 17:00, after 16:30
+	p.planWeek(w42)
+
+	r := e.start(at(2026, 10, 12, 8, 0), p.svc.ReminderSchedules()...)
+	r.runUntil(at(2026, 10, 12, 9, 14))
+	wantKeys(t, "before 09:15", e.reminderKeys(), nil)
+
+	r.runUntil(at(2026, 10, 12, 9, 15))
+	wantKeys(t, "at 09:15", e.reminderKeys(), []string{"day_of_reminder:start:2026-10-12"})
+	p.wantReminder("day_of_reminder:start:2026-10-12", "Start the crock pot by 9:30 am", "Beef Chili", "Beef Chili")
+
+	r.runUntil(at(2026, 10, 12, 16, 29))
+	wantKeys(t, "before 16:30", e.reminderKeys(), []string{"day_of_reminder:start:2026-10-12"})
+	r.runUntil(at(2026, 10, 12, 16, 30))
+	wantKeys(t, "at 16:30", e.reminderKeys(), []string{"day_of_reminder:start:2026-10-12", "day_of_reminder:2026-10-12"})
+	p.wantReminder("day_of_reminder:2026-10-12", "Tonight: Beef Chili · Recipe →", "", "Beef Chili")
+
+	r.runUntil(at(2026, 10, 13, 23, 59))
+	wantKeys(t, "Tuesday", e.reminderKeys(), []string{"day_of_reminder:start:2026-10-12", "day_of_reminder:2026-10-12", "day_of_reminder:2026-10-13"})
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.DayOfReminder), []string{"2026-10-11", "2026-10-12", "2026-10-13", "start:2026-10-12"})
+}
+
+// TestDayOfReminderEmptyNight: with no plan for tonight's week, here none
+// at all and then only next week's, nothing is emitted and nothing fails;
+// next week's crock-pot Monday is reminded on its own day.
+func TestDayOfReminderEmptyNight(t *testing.T) {
+	e := newEnv(t)
+	p := e.plans(e.pool())
+
+	r := e.start(at(2026, 10, 12, 8, 0), p.svc.ReminderSchedules()...)
+	r.runUntil(at(2026, 10, 13, 23, 59))
+	wantKeys(t, "with no plan", e.reminderKeys(), nil)
+
+	p.crockPot("Beef Chili", 480)
+	p.planWeek(w43)
+	r.runUntil(at(2026, 10, 18, 23, 59))
+	wantKeys(t, "with only next week's plan", e.reminderKeys(), nil)
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.DayOfReminder),
+		[]string{"2026-10-11", "2026-10-12", "2026-10-13", "2026-10-14", "2026-10-15", "2026-10-16", "2026-10-17", "2026-10-18"})
+	if logs := p.logs.String(); !strings.Contains(logs, "day-of reminder not sent: the week has no plan") || strings.Contains(logs, "level=ERROR") {
+		t.Errorf("logs = %s, want the empty nights logged and no error", logs)
+	}
+
+	r.runUntil(at(2026, 10, 19, 9, 15))
+	wantKeys(t, "next Monday", e.reminderKeys(), []string{"day_of_reminder:start:2026-10-19"})
+	p.wantReminder("day_of_reminder:start:2026-10-19", "Start the crock pot by 9:30 am", "Beef Chili", "Beef Chili")
+}
+
+// TestDayOfReminderFollowsReminderTimeWithoutRestart: a reminder_time
+// change takes effect in the running scheduler. Moved from 16:30 to 18:00,
+// the daily reminder fires at 18:00, not 16:30, and a crock-pot start_by
+// of 17:00, now earlier than reminder_time, gets its start reminder at
+// 16:45.
+func TestDayOfReminderFollowsReminderTimeWithoutRestart(t *testing.T) {
+	e := newEnv(t)
+	p := e.plans(e.pool())
+	p.crockPot("Beef Chili", 30) // start by 17:00
+	p.planWeek(w42)
+
+	r := e.start(at(2026, 10, 12, 8, 0), p.svc.ReminderSchedules()...)
+	e.update(household.SettingsPatch{ReminderTime: ptr("18:00")})
+	r.changed()
+	r.runUntil(at(2026, 10, 12, 16, 44))
+	wantKeys(t, "before 16:45", e.reminderKeys(), nil)
+	r.runUntil(at(2026, 10, 12, 16, 45))
+	wantKeys(t, "at 16:45", e.reminderKeys(), []string{"day_of_reminder:start:2026-10-12"})
+	p.wantReminder("day_of_reminder:start:2026-10-12", "Start the crock pot by 5:00 pm", "Beef Chili", "Beef Chili")
+	r.runUntil(at(2026, 10, 12, 17, 59))
+	wantKeys(t, "before 18:00", e.reminderKeys(), []string{"day_of_reminder:start:2026-10-12"})
+	r.runUntil(at(2026, 10, 12, 18, 0))
+	wantKeys(t, "at 18:00", e.reminderKeys(), []string{"day_of_reminder:start:2026-10-12", "day_of_reminder:2026-10-12"})
+}
+
+// TestDayOfReminderNoDuplicateAfterRestart: restarts after each reminder
+// of a crock-pot night, within the catch-up window, emit neither again:
+// each period is already claimed.
+func TestDayOfReminderNoDuplicateAfterRestart(t *testing.T) {
+	e := newEnv(t)
+	ids := e.pool()
+	p := e.plans(ids)
+	p.crockPot("Beef Chili", 480)
+	p.planWeek(w42)
+
+	r := e.start(at(2026, 10, 12, 8, 0), p.svc.ReminderSchedules()...)
+	r.runUntil(at(2026, 10, 12, 9, 15))
+	r.stop()
+	p.stop()
+
+	p2 := e.plans(ids)
+	r2 := e.start(at(2026, 10, 12, 9, 20), p2.svc.ReminderSchedules()...)
+	wantKeys(t, "after the first restart", e.reminderKeys(), []string{"day_of_reminder:start:2026-10-12"})
+	r2.runUntil(at(2026, 10, 12, 16, 30))
+	r2.stop()
+	p2.stop()
+
+	p3 := e.plans(ids)
+	r3 := e.start(at(2026, 10, 12, 16, 40), p3.svc.ReminderSchedules()...)
+	r3.runUntil(at(2026, 10, 13, 9, 0))
+	wantKeys(t, "after the second restart", e.reminderKeys(), []string{"day_of_reminder:start:2026-10-12", "day_of_reminder:2026-10-12"})
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.DayOfReminder), []string{"2026-10-11", "2026-10-12", "start:2026-10-12"})
+}
+
+// TestDailyAtLookupFailureIsRetried: a DailyAt rule fires at the instant
+// its lookup gives, its period keyed by the schedule's Key and the date;
+// a lookup that fails fires nothing and is looked up again after
+// ClaimRetry, then fires its period once.
+func TestDailyAtLookupFailureIsRetried(t *testing.T) {
+	e := newEnv(t)
+	var rec recorder
+	var mu sync.Mutex
+	failing := false
+	at915 := func(ctx context.Context, d store.LocalDate) (time.Time, bool, error) {
+		mu.Lock()
+		defer mu.Unlock()
+		if failing {
+			return time.Time{}, false, errors.New("database down")
+		}
+		y, m, day := d.Date()
+		return at(y, m, day, 9, 15), true, nil
+	}
+	sch := scheduler.Schedule{
+		Name: scheduler.DayOfReminder,
+		Key:  "start",
+		Rule: func(household.Settings) scheduler.Rule { return scheduler.DailyAt(at915) },
+		Run:  rec.run,
+	}
+
+	r := e.start(at(2026, 10, 12, 8, 0), sch)
+	wantKeys(t, "catch-up", rec.keys(), []string{"start:2026-10-11"})
+	mu.Lock()
+	failing = true
+	mu.Unlock()
+	r.runUntil(at(2026, 10, 12, 9, 16))
+	wantKeys(t, "while the lookup fails", rec.keys(), []string{"start:2026-10-11"})
+
+	mu.Lock()
+	failing = false
+	mu.Unlock()
+	r.runUntil(at(2026, 10, 12, 9, 17))
+	wantKeys(t, "after the lookup recovers", rec.keys(), []string{"start:2026-10-11", "start:2026-10-12"})
+	if p := rec.periods()[1]; !p.FireAt.Equal(at(2026, 10, 12, 9, 15)) || p.Date.String() != "2026-10-12" {
+		t.Errorf("period = %+v, want fired at 09:15 for 2026-10-12", p)
+	}
+	r.runUntil(at(2026, 10, 13, 12, 0))
+	wantKeys(t, "next day", rec.keys(), []string{"start:2026-10-11", "start:2026-10-12", "start:2026-10-13"})
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.DayOfReminder), rec.keys())
+}
+
+// questLog stores name as a Quest-log dinner, a crock-pot dinner of
+// minutes, and returns its id. It is not a Regular.
+func (p *planEnv) questLog(name string, minutes int) string {
+	p.e.t.Helper()
+	now := store.Now().String()
+	d, err := db.New(p.e.st.Writer).CreateDinner(context.Background(), db.CreateDinnerParams{
+		ID:              store.NewID(),
+		Name:            name,
+		NormalizedName:  harness.Normalize(name),
+		Status:          "quest_log",
+		Origin:          "side_quest",
+		GroundingStatus: "manual",
+		CreatedAt:       now,
+		UpdatedAt:       now,
+	})
+	if err != nil {
+		p.e.t.Fatal(err)
+	}
+	p.ids[name] = d.ID
+	p.crockPot(name, minutes)
+	return d.ID
+}
+
+// TestStartReminderAfterSwapFiresOnTime: swapping a crock-pot dinner in
+// for tonight wakes the scheduler, so its start reminder fires at start_by
+// minus 15 minutes, 09:15, and not at the next hourly check, 10:00. At
+// 09:00 tonight is Beef Chili, not a crock-pot dinner, and the scheduler's
+// next timer is 10:00; at 09:01 the household swaps in an eight-hour
+// crock-pot Quest-log dinner, start by 09:30. Each reminder fires once.
+func TestStartReminderAfterSwapFiresOnTime(t *testing.T) {
+	e := newEnv(t)
+	p := e.wakingPlans(e.pool())
+	stew := p.questLog("Crock Pot Stew", 480) // start by 09:30
+	p.planWeek(w42)
+
+	r := e.start(at(2026, 10, 12, 8, 0), p.svc.ReminderSchedules()...)
+	r.runUntil(at(2026, 10, 12, 9, 0))
+	if next, _ := r.clock.nextDeadline(); !next.Equal(at(2026, 10, 12, 10, 0)) {
+		t.Fatalf("next wake at 09:00 = %s, want the hourly 10:00", next)
+	}
+
+	r.runUntil(at(2026, 10, 12, 9, 1))
+	if _, err := p.svc.Swap(context.Background(), w42, "2026-10-12", stew); err != nil {
+		t.Fatal(err)
+	}
+	r.changed()
+	r.runUntil(at(2026, 10, 12, 9, 14))
+	wantKeys(t, "before 09:15", e.reminderKeys(), nil)
+
+	r.runUntil(at(2026, 10, 12, 9, 15))
+	wantKeys(t, "at 09:15", e.reminderKeys(), []string{"day_of_reminder:start:2026-10-12"})
+	p.wantReminder("day_of_reminder:start:2026-10-12", "Start the crock pot by 9:30 am", "Crock Pot Stew", "Crock Pot Stew")
+
+	r.runUntil(at(2026, 10, 13, 23, 59))
+	wantKeys(t, "Tuesday", e.reminderKeys(), []string{"day_of_reminder:start:2026-10-12", "day_of_reminder:2026-10-12", "day_of_reminder:2026-10-13"})
+	p.wantReminder("day_of_reminder:2026-10-12", "Tonight: Crock Pot Stew · Recipe →", "", "Crock Pot Stew")
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.DayOfReminder), []string{"2026-10-11", "2026-10-12", "2026-10-13", "start:2026-10-12"})
+}

internal/scheduler/plan_draft_test.go

@@ -0,0 +1,409 @@
+package scheduler_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/url"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/harness"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/llm"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/skills"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/db"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/gcal"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/jobs"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/notify"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/notify/notifytest"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/plan"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/scheduler"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
+)
+
+// The tests in this file run plan's plan_draft schedule on the fake clock
+// against the real plan service, job runner, harness, draft_week and
+// notification outbox, with the AI faked.
+
+// planEnv is a plan service over a scheduler env's store, the "process" a
+// scheduler runs it in. model answers draft_week.
+type planEnv struct {
+	e     *env
+	svc   *plan.Service
+	model *llm.Fake
+	ids   map[string]string
+	logs  *syncBuffer
+	stop  func()
+}
+
+// poolNames are the seven Regulars pool stores, enough for a week.
+var poolNames = []string{"Beef Chili", "Pot Roast", "Chicken Fajitas", "Spaghetti Bolognese", "Sheet Pan Salmon", "Tacos", "Pancakes"}
+
+// pool stores poolNames as Regulars and returns their ids by name.
+func (e *env) pool() map[string]string {
+	e.t.Helper()
+	ids := map[string]string{}
+	for _, name := range poolNames {
+		now := store.Now().String()
+		d, err := db.New(e.st.Writer).CreateDinner(context.Background(), db.CreateDinnerParams{
+			ID:              store.NewID(),
+			Name:            name,
+			NormalizedName:  harness.Normalize(name),
+			Status:          "regular",
+			Origin:          "regular",
+			GroundingStatus: "manual",
+			CreatedAt:       now,
+			UpdatedAt:       now,
+		})
+		if err != nil {
+			e.t.Fatal(err)
+		}
+		ids[name] = d.ID
+	}
+	return ids
+}
+
+// publicURL is MEALQUEST_PUBLIC_URL in these tests.
+var publicURL = &url.URL{Scheme: "https", Host: "meals.example.com"}
+
+// noCalendar is a Calendar the schedule must never push to.
+type noCalendar struct{ t *testing.T }
+
+func (c noCalendar) PushEvents(context.Context, []gcal.Event, func() error) error {
+	c.t.Error("plan_draft pushed to Calendar")
+	return errors.New("no calendar")
+}
+
+// plans builds a plan service drafting from the dinners ids over e with a
+// started job runner, which stop stops (and the test's end, if not before).
+// Its changes do not wake the scheduler: a draft job's wake would add a
+// pass the fake clock's waits do not expect.
+func (e *env) plans(ids map[string]string) *planEnv {
+	e.t.Helper()
+	return e.newPlans(ids, func() {})
+}
+
+// wakingPlans is plans whose changes wake the scheduler, as in the server.
+// A test using it changes plans only from its own goroutine and waits for
+// the wake's pass with changed.
+func (e *env) wakingPlans(ids map[string]string) *planEnv {
+	e.t.Helper()
+	return e.newPlans(ids, e.wake)
+}
+
+// newPlans is plans whose service calls wake after a plan change.
+func (e *env) newPlans(ids map[string]string, wake func()) *planEnv {
+	e.t.Helper()
+	p := &planEnv{e: e, model: &llm.Fake{}, ids: ids, logs: &syncBuffer{}}
+	guard, err := harness.NewGuard(harness.DefaultMaxCalls)
+	if err != nil {
+		e.t.Fatal(err)
+	}
+	cfg := harness.Config{
+		Settings:    llm.Settings{Provider: "anthropic", Model: "claude-test", Temperature: 0.7},
+		NewProvider: func(llm.Settings, string) (llm.Provider, error) { return p.model, nil },
+		Store:       e.st,
+		Guard:       guard,
+	}
+	drafter := func(ctx context.Context, scope string, in skills.WeekRequest) (skills.Week, error) {
+		return skills.DraftWeek(ctx, cfg, scope, in)
+	}
+	logger := slog.New(slog.NewTextHandler(p.logs, nil))
+	runner, err := jobs.NewRunner(e.st, logger, 1)
+	if err != nil {
+		e.t.Fatal(err)
+	}
+	p.svc, err = plan.NewService(e.st, drafter, runner, noCalendar{e.t}, notifytest.New(e.t, e.st), wake, publicURL, logger)
+	if err != nil {
+		e.t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	if err := runner.Start(ctx); err != nil {
+		cancel()
+		e.t.Fatal(err)
+	}
+	var once sync.Once
+	p.stop = func() {
+		once.Do(func() {
+			cancel()
+			runner.Wait()
+		})
+	}
+	e.t.Cleanup(p.stop)
+	return p
+}
+
+// reply scripts the next draft_week answer: poolNames on the days of the
+// week starting weekStart, Monday to Sunday.
+func (p *planEnv) reply(weekStart store.LocalDate) {
+	p.e.t.Helper()
+	dates, err := household.WeekDays(weekStart)
+	if err != nil {
+		p.e.t.Fatal(err)
+	}
+	var days []string
+	for i, name := range poolNames {
+		days = append(days, fmt.Sprintf(`{"date":%q,"dinner_id":%q}`, dates[i], p.ids[name]))
+	}
+	js := fmt.Sprintf(`{"days":[%s],"note":""}`, strings.Join(days, ","))
+	p.model.QueueGenerate(llm.GenerateResult{Response: llm.Response{Text: js, JSON: json.RawMessage(js)}})
+}
+
+// draftJob is a draft_week jobs row.
+type draftJob struct {
+	Status, Error string
+}
+
+// drafts waits until no draft_week job is queued or running and returns
+// them all, oldest first.
+func (e *env) drafts() []draftJob {
+	e.t.Helper()
+	deadline := time.Now().Add(10 * time.Second)
+	for {
+		rows, err := e.st.Reader.Query(`SELECT status, COALESCE(error, '') FROM jobs WHERE kind = ? ORDER BY created_at, id`, plan.KindDraftWeek)
+		if err != nil {
+			e.t.Fatal(err)
+		}
+		var out []draftJob
+		busy := false
+		for rows.Next() {
+			var j draftJob
+			if err := rows.Scan(&j.Status, &j.Error); err != nil {
+				e.t.Fatal(err)
+			}
+			busy = busy || j.Status == string(jobs.StatusQueued) || j.Status == string(jobs.StatusRunning)
+			out = append(out, j)
+		}
+		if err := rows.Err(); err != nil {
+			e.t.Fatal(err)
+		}
+		rows.Close()
+		if !busy {
+			return out
+		}
+		if time.Now().After(deadline) {
+			e.t.Fatalf("draft jobs still under way: %+v", out)
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+}
+
+// wantDrafts fails unless the draft_week jobs are got.
+func wantDrafts(t *testing.T, what string, got []draftJob, want ...draftJob) {
+	t.Helper()
+	if fmt.Sprint(got) != fmt.Sprint(want) {
+		t.Fatalf("%s: draft jobs = %+v, want %+v", what, got, want)
+	}
+}
+
+// weekPlans returns the week_start of every plan, oldest first.
+func (e *env) weekPlans() []string {
+	e.t.Helper()
+	rows, err := e.st.Reader.Query(`SELECT week_start FROM week_plans ORDER BY week_start`)
+	if err != nil {
+		e.t.Fatal(err)
+	}
+	defer rows.Close()
+	var out []string
+	for rows.Next() {
+		var w string
+		if err := rows.Scan(&w); err != nil {
+			e.t.Fatal(err)
+		}
+		out = append(out, w)
+	}
+	if err := rows.Err(); err != nil {
+		e.t.Fatal(err)
+	}
+	return out
+}
+
+// planReady returns the distinct plan_ready keys stored, oldest first.
+func (e *env) planReady() []string {
+	e.t.Helper()
+	var keys []string
+	for _, r := range notifytest.Rows(e.t, e.st, notify.PlanReady) {
+		if len(keys) == 0 || keys[len(keys)-1] != r.Key {
+			keys = append(keys, r.Key)
+		}
+	}
+	return keys
+}
+
+var (
+	succeeded = draftJob{Status: string(jobs.StatusSucceeded)}
+	aiFailed  = draftJob{Status: string(jobs.StatusFailed), Error: plan.ReasonAIFailed}
+	// w43 is the Monday of 2026-W43, the week after Friday Oct 16.
+	w43 = mustLocalDate("2026-10-19")
+	w44 = mustLocalDate("2026-10-26")
+)
+
+func mustLocalDate(s string) store.LocalDate {
+	d, err := store.ParseLocalDate(s)
+	if err != nil {
+		panic(err)
+	}
+	return d
+}
+
+// TestPlanDraftDraftsNextWeek: at the seeded Friday 09:00 the schedule
+// drafts the next ISO week through the plan service's draft job, period
+// plan_draft:YYYY-Www of that week, and the draft emits plan_ready keyed
+// by its Monday once.
+func TestPlanDraftDraftsNextWeek(t *testing.T) {
+	e := newEnv(t)
+	p := e.plans(e.pool())
+	p.reply(w43)
+	p.reply(w44)
+
+	// Wednesday Oct 14: the Friday Oct 9 09:00 fire is days ago, missed.
+	r := e.start(at(2026, 10, 14, 12, 0), p.svc.DraftSchedule())
+	r.runUntil(at(2026, 10, 16, 8, 59))
+	wantDrafts(t, "before Friday 09:00", e.drafts())
+	wantKeys(t, "plans before Friday 09:00", e.weekPlans(), nil)
+
+	r.runUntil(at(2026, 10, 16, 9, 0))
+	wantDrafts(t, "at Friday 09:00", e.drafts(), succeeded)
+	wantKeys(t, "plans at Friday 09:00", e.weekPlans(), []string{"2026-10-19"})
+	wantKeys(t, "plan_ready of W43", e.planReady(), []string{"plan_ready:2026-10-19"})
+	got, err := p.svc.Get(context.Background(), w43)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Days) != 7 || got.Days[0].Dinner.Name != "Beef Chili" || got.Status != plan.StatusDraft {
+		t.Errorf("plan of W43 = %+v, want the drafted week", got)
+	}
+
+	r.runUntil(at(2026, 10, 23, 9, 0))
+	wantDrafts(t, "W44", e.drafts(), succeeded, succeeded)
+	wantKeys(t, "plans", e.weekPlans(), []string{"2026-10-19", "2026-10-26"})
+	wantKeys(t, "plan_ready of W43 and W44", e.planReady(), []string{"plan_ready:2026-10-19", "plan_ready:2026-10-26"})
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.PlanDraft), []string{"2026-W42", "2026-W43", "2026-W44"})
+}
+
+// TestPlanDraftLeavesAnExistingPlan: when next week already has a plan,
+// here one the household drafted by hand, the period drafts nothing,
+// notifies no one and says so.
+func TestPlanDraftLeavesAnExistingPlan(t *testing.T) {
+	e := newEnv(t)
+	p := e.plans(e.pool())
+	p.reply(w43)
+	p.reply(w43) // a second draft would succeed too
+	if _, err := p.svc.StartDraft(context.Background(), w43, false); err != nil {
+		t.Fatal(err)
+	}
+	wantDrafts(t, "manual draft", e.drafts(), succeeded)
+	wantKeys(t, "plan_ready of the manual draft", e.planReady(), []string{"plan_ready:2026-10-19"})
+	before, err := p.svc.Get(context.Background(), w43)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := e.start(at(2026, 10, 16, 8, 0), p.svc.DraftSchedule())
+	r.runUntil(at(2026, 10, 16, 9, 0))
+	wantDrafts(t, "with a plan", e.drafts(), succeeded)
+	wantKeys(t, "plan_ready with a plan", e.planReady(), []string{"plan_ready:2026-10-19"})
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.PlanDraft), []string{"2026-W42", "2026-W43"})
+	after, err := p.svc.Get(context.Background(), w43)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if fmt.Sprint(after) != fmt.Sprint(before) {
+		t.Errorf("plan of W43 = %+v, want it unchanged from %+v", after, before)
+	}
+	if logs := p.logs.String(); !strings.Contains(logs, "the week already has a plan") || !strings.Contains(logs, "period=2026-W43") {
+		t.Errorf("logs = %s, want the skipped period logged", logs)
+	}
+}
+
+// TestPlanDraftNoDuplicateAfterRestart: a restart after the week was
+// drafted, still within the catch-up window, drafts nothing more and sends
+// no second plan_ready: the period is already claimed.
+func TestPlanDraftNoDuplicateAfterRestart(t *testing.T) {
+	e := newEnv(t)
+	ids := e.pool()
+	p := e.plans(ids)
+	p.reply(w43)
+	r := e.start(at(2026, 10, 16, 8, 0), p.svc.DraftSchedule())
+	r.runUntil(at(2026, 10, 16, 9, 0))
+	wantDrafts(t, "first process", e.drafts(), succeeded)
+	r.stop()
+	p.stop()
+
+	// The restarted process has a new job runner, plan service and
+	// scheduler; it would answer a second draft if one were started.
+	p2 := e.plans(ids)
+	p2.reply(w43)
+	r2 := e.start(at(2026, 10, 16, 10, 0), p2.svc.DraftSchedule())
+	r2.runUntil(at(2026, 10, 23, 8, 59))
+	wantDrafts(t, "after restart", e.drafts(), succeeded)
+	wantKeys(t, "plans after restart", e.weekPlans(), []string{"2026-10-19"})
+	wantKeys(t, "plan_ready after restart", e.planReady(), []string{"plan_ready:2026-10-19"})
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.PlanDraft), []string{"2026-W42", "2026-W43"})
+}
+
+// TestPlanDraftAIFailureEmitsNothing: when draft_week fails the draft job
+// fails as ai_failed with the failure recorded in ai_runs, no plan is made
+// up and no one is notified; a restart within the catch-up window does not
+// draft the claimed period again.
+func TestPlanDraftAIFailureEmitsNothing(t *testing.T) {
+	e := newEnv(t)
+	ids := e.pool()
+	p := e.plans(ids)
+	p.model.QueueGenerate(llm.GenerateResult{Err: errors.New("provider down")})
+
+	r := e.start(at(2026, 10, 16, 8, 0), p.svc.DraftSchedule())
+	r.runUntil(at(2026, 10, 16, 9, 0))
+	wantDrafts(t, "after the AI failed", e.drafts(), aiFailed)
+	wantKeys(t, "plans after the AI failed", e.weekPlans(), nil)
+	wantKeys(t, "plan_ready after the AI failed", e.planReady(), nil)
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.PlanDraft), []string{"2026-W42", "2026-W43"})
+
+	var status, msg string
+	if err := e.st.Reader.QueryRow(`SELECT status, COALESCE(error, '') FROM ai_runs WHERE skill = 'draft_week'`).Scan(&status, &msg); err != nil {
+		t.Fatalf("ai_runs row of draft_week: %v", err)
+	}
+	if status != string(harness.StatusProviderError) || msg == "" {
+		t.Errorf("ai_runs draft_week = %s %q, want %s with its message", status, msg, harness.StatusProviderError)
+	}
+	if logs := p.logs.String(); !strings.Contains(logs, "week draft failed") || !strings.Contains(logs, "reason="+plan.ReasonAIFailed) {
+		t.Errorf("logs = %s, want the draft failure with reason %s", logs, plan.ReasonAIFailed)
+	}
+
+	r.stop()
+	p.stop()
+	p2 := e.plans(ids)
+	p2.reply(w43)
+	e.start(at(2026, 10, 16, 10, 0), p2.svc.DraftSchedule())
+	wantDrafts(t, "after restart", e.drafts(), aiFailed)
+	wantKeys(t, "plan_ready after restart", e.planReady(), nil)
+}
+
+// TestPlanDraftFollowsSettingsWithoutRestart: a plan_draft_dow and
+// plan_draft_time change takes effect in the running scheduler; the old
+// Friday 09:00 no longer fires and the new Wednesday 18:30 drafts the next
+// week.
+func TestPlanDraftFollowsSettingsWithoutRestart(t *testing.T) {
+	e := newEnv(t)
+	p := e.plans(e.pool())
+	p.reply(w43)
+
+	r := e.start(at(2026, 10, 12, 12, 0), p.svc.DraftSchedule()) // Monday
+	e.update(household.SettingsPatch{PlanDraftDow: ptr(3), PlanDraftTime: ptr("18:30")})
+	r.changed()
+	r.runUntil(at(2026, 10, 14, 18, 29)) // Wednesday
+	wantDrafts(t, "before Wednesday 18:30", e.drafts())
+	r.runUntil(at(2026, 10, 14, 18, 30))
+	wantDrafts(t, "at Wednesday 18:30", e.drafts(), succeeded)
+	wantKeys(t, "plan_ready", e.planReady(), []string{"plan_ready:2026-10-19"})
+
+	// Friday 09:00, the old fire time, drafts nothing more.
+	r.runUntil(at(2026, 10, 16, 9, 0))
+	wantDrafts(t, "at Friday 09:00", e.drafts(), succeeded)
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.PlanDraft), []string{"2026-W42", "2026-W43"})
+}

internal/scheduler/rotation_check_test.go

@@ -0,0 +1,204 @@
+package scheduler_test
+
+import (
+	"context"
+	"testing"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/notify"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/notify/notifytest"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/scheduler"
+)
+
+// The tests in this file run plan's rotation_check schedule on the fake
+// clock against the real plan service and notification outbox. The plan of
+// the week of Monday Oct 12 (w42) has poolNames, all Regulars, Monday to
+// Sunday; a test that needs a Quest-log dinner swaps Lemon Orzo in for
+// Monday. The household's review time is the seeded 09:00, in Chicago.
+
+// orzoDay is the Monday Lemon Orzo is planned on.
+var orzoDay = mustLocalDate("2026-10-12")
+
+// orzoWeek plans w42 with the Quest-log dinner Lemon Orzo on Monday in
+// place of Beef Chili, and returns its id.
+func (p *planEnv) orzoWeek() string {
+	p.e.t.Helper()
+	id := p.questLog("Lemon Orzo", 30)
+	p.planWeek(w42)
+	if _, err := p.svc.Swap(context.Background(), w42, orzoDay.String(), id); err != nil {
+		p.e.t.Fatal(err)
+	}
+	return id
+}
+
+// rotationReviews returns the keys of the rotation_review notifications
+// stored, oldest first. The seeded preference sends rotation_review to push
+// only, so there is one row per event.
+func (e *env) rotationReviews() []string {
+	e.t.Helper()
+	var keys []string
+	for _, r := range notifytest.Rows(e.t, e.st, notify.RotationReview) {
+		if r.Channel != notify.ChannelPush {
+			e.t.Fatalf("rotation_review row %+v, want push only", r)
+		}
+		keys = append(keys, r.Key)
+	}
+	return keys
+}
+
+// status returns the status of the dinner name.
+func (p *planEnv) status(name string) string {
+	p.e.t.Helper()
+	var s string
+	if err := p.e.st.Reader.QueryRow(`SELECT status FROM dinners WHERE id = ?`, p.ids[name]).Scan(&s); err != nil {
+		p.e.t.Fatal(err)
+	}
+	return s
+}
+
+// pendingReviews returns the plan dates of the pending Rotation checks of
+// the dinner name.
+func (p *planEnv) pendingReviews(name string) []string {
+	p.e.t.Helper()
+	rows, err := p.e.st.Reader.Query(`SELECT plan_date FROM rotation_reviews WHERE dinner_id = ? AND status = 'pending' ORDER BY plan_date`, p.ids[name])
+	if err != nil {
+		p.e.t.Fatal(err)
+	}
+	defer rows.Close()
+	var out []string
+	for rows.Next() {
+		var d string
+		if err := rows.Scan(&d); err != nil {
+			p.e.t.Fatal(err)
+		}
+		out = append(out, d)
+	}
+	if err := rows.Err(); err != nil {
+		p.e.t.Fatal(err)
+	}
+	return out
+}
+
+// wantOrzoTried fails unless Lemon Orzo, id, is tried with one pending
+// Rotation check for orzoDay and exactly one rotation_review asking about
+// it, which opens Home.
+func (p *planEnv) wantOrzoTried(id string) {
+	p.e.t.Helper()
+	if got := p.status("Lemon Orzo"); got != "tried" {
+		p.e.t.Errorf("Lemon Orzo status = %s, want tried", got)
+	}
+	wantKeys(p.e.t, "Lemon Orzo pending Rotation checks", p.pendingReviews("Lemon Orzo"), []string{orzoDay.String()})
+	key := "rotation_review:" + id + ":" + orzoDay.String()
+	wantKeys(p.e.t, "rotation_review", p.e.rotationReviews(), []string{key})
+	got := notifytest.Rows(p.e.t, p.e.st, notify.RotationReview)[0].Payload
+	want := notify.Payload{Event: notify.RotationReview, Title: "How was Lemon Orzo? Keep it in rotation?", URL: "/", Tag: key, Week: w42.String()}
+	if got != want {
+		p.e.t.Errorf("rotation_review = %+v, want %+v", got, want)
+	}
+}
+
+// TestRotationCheckMarksQuestLogDinnerTried: at review_time 09:00 the day
+// after a Quest-log dinner was planned, the schedule, period
+// rotation_check:YYYY-MM-DD, marks it tried, opens its Rotation check and
+// emits one rotation_review. It never makes the dinner a Regular.
+func TestRotationCheckMarksQuestLogDinnerTried(t *testing.T) {
+	e := newEnv(t)
+	p := e.plans(e.pool())
+	id := p.orzoWeek()
+
+	// Tuesday 08:00: the catch-up of Monday 09:00 checks Sunday, unplanned.
+	r := e.start(at(2026, 10, 13, 8, 0), p.svc.RotationCheckSchedule())
+	r.runUntil(at(2026, 10, 13, 8, 59))
+	wantKeys(t, "before 09:00", e.rotationReviews(), nil)
+	if got := p.status("Lemon Orzo"); got != "quest_log" {
+		t.Fatalf("Lemon Orzo status before 09:00 = %s, want quest_log", got)
+	}
+
+	r.runUntil(at(2026, 10, 13, 9, 0))
+	p.wantOrzoTried(id)
+
+	// Days later, still tried: only the household's keep makes a Regular.
+	r.runUntil(at(2026, 10, 16, 12, 0))
+	p.wantOrzoTried(id)
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.RotationCheck), []string{
+		"rotation_check:2026-10-12", "rotation_check:2026-10-13", "rotation_check:2026-10-14",
+		"rotation_check:2026-10-15", "rotation_check:2026-10-16",
+	})
+}
+
+// TestRotationCheckLeavesRegulars: a day planning only Regulars marks
+// nothing tried, opens no Rotation check and emits nothing.
+func TestRotationCheckLeavesRegulars(t *testing.T) {
+	e := newEnv(t)
+	p := e.plans(e.pool())
+	p.planWeek(w42)
+
+	r := e.start(at(2026, 10, 13, 8, 0), p.svc.RotationCheckSchedule())
+	r.runUntil(at(2026, 10, 13, 9, 0))
+	wantKeys(t, "rotation_review", e.rotationReviews(), nil)
+	if got := p.status("Beef Chili"); got != "regular" {
+		t.Errorf("Beef Chili status = %s, want regular", got)
+	}
+	wantKeys(t, "Beef Chili pending Rotation checks", p.pendingReviews("Beef Chili"), nil)
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.RotationCheck), []string{"rotation_check:2026-10-12", "rotation_check:2026-10-13"})
+}
+
+// TestRotationCheckNoDuplicateSameDay: a restart the same day finds the
+// period claimed, and MarkTried run again for the same day finds the
+// Rotation check open, so neither opens a second check or notification.
+func TestRotationCheckNoDuplicateSameDay(t *testing.T) {
+	e := newEnv(t)
+	ids := e.pool()
+	p := e.plans(ids)
+	id := p.orzoWeek()
+
+	r := e.start(at(2026, 10, 13, 8, 0), p.svc.RotationCheckSchedule())
+	r.runUntil(at(2026, 10, 13, 9, 0))
+	p.wantOrzoTried(id)
+	r.stop()
+	p.stop()
+
+	p2 := e.plans(ids)
+	r2 := e.start(at(2026, 10, 13, 9, 30), p2.svc.RotationCheckSchedule())
+	r2.runUntil(at(2026, 10, 13, 23, 59))
+	p2.wantOrzoTried(id)
+
+	if n, err := p2.svc.MarkTried(context.Background(), orzoDay); err != nil || n != 0 {
+		t.Fatalf("MarkTried(%s) again = %d, %v, want 0", orzoDay, n, err)
+	}
+	p2.wantOrzoTried(id)
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.RotationCheck), []string{"rotation_check:2026-10-12", "rotation_check:2026-10-13"})
+}
+
+// TestRotationCheckCatchUpAtBoot: started 23 hours after a missed 09:00,
+// the scheduler runs that day's Rotation check once at boot.
+func TestRotationCheckCatchUpAtBoot(t *testing.T) {
+	e := newEnv(t)
+	p := e.plans(e.pool())
+	id := p.orzoWeek()
+
+	e.start(at(2026, 10, 14, 8, 0), p.svc.RotationCheckSchedule())
+	p.wantOrzoTried(id)
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.RotationCheck), []string{"rotation_check:2026-10-13"})
+}
+
+// TestRotationCheckFollowsReviewTimeWithoutRestart: a review_time change
+// takes effect in the running scheduler. Moved from 09:00 to 10:30, the
+// Rotation check does not run at 09:00 and runs at 10:30.
+func TestRotationCheckFollowsReviewTimeWithoutRestart(t *testing.T) {
+	e := newEnv(t)
+	p := e.plans(e.pool())
+	id := p.orzoWeek()
+
+	r := e.start(at(2026, 10, 13, 8, 0), p.svc.RotationCheckSchedule())
+	e.update(household.SettingsPatch{ReviewTime: ptr("10:30")})
+	r.changed()
+	r.runUntil(at(2026, 10, 13, 10, 29))
+	wantKeys(t, "before 10:30", e.rotationReviews(), nil)
+	if got := p.status("Lemon Orzo"); got != "quest_log" {
+		t.Fatalf("Lemon Orzo status before 10:30 = %s, want quest_log", got)
+	}
+	r.runUntil(at(2026, 10, 13, 10, 30))
+	p.wantOrzoTried(id)
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.RotationCheck), []string{"rotation_check:2026-10-12", "rotation_check:2026-10-13"})
+}

internal/scheduler/scheduler.go

@@ -15,13 +15,14 @@
 //
 // # Catch-up
 //
-// When the scheduler starts, and whenever it wakes late, it looks only at
-// each schedule's most recent fire time. If that time passed within
-// CatchUpWindow and the period is unclaimed, the period runs once. If it
-// passed longer ago, the period is claimed without running and logged as
-// missed, so it can never run later, not after a restart and not after a
-// settings change moves the fire time. Fire times before the most recent
-// one are never looked at.
+// When the scheduler starts, and whenever it wakes late, it handles, oldest
+// first, every fire time of each schedule that passed within CatchUpWindow,
+// and the most recent fire time even when it passed longer ago. Each
+// unclaimed period within CatchUpWindow runs once. A most recent one that
+// passed longer ago is claimed without running and logged as missed, so it
+// can never run later, not after a restart and not after a settings change
+// moves the fire time. Other fire times older than CatchUpWindow are never
+// looked at.
 //
 // # Claim failures
 //
@@ -44,6 +45,18 @@
 // occurrence. Either way the period key is that local date's, so the
 // period still runs exactly once.
 //
+// # Fire times from data
+//
+// A DailyAt rule fires at a time read from the household's data rather
+// than the settings: its function gives, for each household-local date,
+// the instant the date's period fires, or none. The period is that date
+// even when the instant falls on another day. The scheduler asks again on
+// every pass, and whoever changes that data calls Wake once the change is
+// committed, so the next pass comes at once and a fire time the change
+// moved fires on time rather than up to maxWait late; the claim still runs
+// a period at most once. A lookup that fails is logged and repeated every
+// ClaimRetry, as a failed claim is.
+//
 // # Settings changes
 //
 // The scheduler subscribes to the household settings and records each change
@@ -59,6 +72,8 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"slices"
+	"strings"
 	"sync"
 	"time"
 
@@ -102,8 +117,8 @@ const ClaimRetry = time.Minute
 const maxWait = time.Hour
 
 // Rule is when a schedule fires: at household-local Time ("HH:MM") every
-// day, or on Weekday only when Weekly is set. Build one with Daily, Weekly
-// or WeeklyForNextWeek.
+// day, or on Weekday only when Weekly is set, or every day at the instant
+// At gives. Build one with Daily, Weekly, WeeklyForNextWeek or DailyAt.
 type Rule struct {
 	Weekly  bool
 	Weekday time.Weekday
@@ -111,8 +126,15 @@ type Rule struct {
 	// NextWeek keys a weekly period by the ISO week after the fire date,
 	// for work done ahead for the coming week.
 	NextWeek bool
+	// At, instead of Time, gives the instant the period of a
+	// household-local date fires.
+	At FireAt
 }
 
+// FireAt gives the instant the period of household-local date fires, or
+// false when that date's period does not fire.
+type FireAt func(ctx context.Context, date store.LocalDate) (time.Time, bool, error)
+
 // Daily fires every day at hhmm; its period is the local date.
 func Daily(hhmm string) Rule {
 	return Rule{Time: hhmm}
@@ -129,6 +151,12 @@ func WeeklyForNextWeek(day time.Weekday, hhmm string) Rule {
 	return Rule{Weekly: true, Weekday: day, Time: hhmm, NextWeek: true}
 }
 
+// DailyAt fires at most once a day, at the instant at gives for the date;
+// its period is that date, wherever the instant falls.
+func DailyAt(at FireAt) Rule {
+	return Rule{At: at}
+}
+
 // PeriodKey returns the period key of a fire on household-local date
 // fireDate: the date ("2026-10-09") for a daily rule, the ISO week
 // ("2026-W53") for a weekly one, and the ISO week after that ("2027-W01")
@@ -151,6 +179,12 @@ func (r Rule) validate() error {
 	if !r.Weekly && (r.Weekday != time.Sunday || r.NextWeek) {
 		return errors.New("a daily rule has no weekday or next week")
 	}
+	if r.At != nil {
+		if r.Weekly || r.Time != "" {
+			return errors.New("a DailyAt rule has no weekday or time")
+		}
+		return nil
+	}
 	// Any date checks the time's form.
 	_, err := household.LocalTime(time.UTC, store.LocalDateOf(time.Unix(0, 0).UTC()), r.Time)
 	return err
@@ -173,6 +207,15 @@ type Period struct {
 type Schedule struct {
 	// Name is one of the schedule name constants.
 	Name string
+	// Key, when set, prefixes the schedule's period keys with Key and a
+	// colon ("start:2026-10-14"), so two schedules of one Name claim
+	// different periods. Name and Key together are unique.
+	Key string
+	// PeriodKey, when set, gives the period key claimed for p in place of
+	// the rule's, such as "list_ready:chat:2026-10-19" for the week p.Week;
+	// p.Key is the rule's key. It must give each period its own key. A
+	// schedule sets Key or PeriodKey, not both.
+	PeriodKey func(p Period) string
 	// Rule returns when the schedule fires under settings. It is called
 	// again after every settings change.
 	Rule func(settings household.Settings) Rule
@@ -183,6 +226,14 @@ type Schedule struct {
 	Run func(ctx context.Context, p Period) error
 }
 
+// label names sch in errors and logs: its Name, and its Key if set.
+func (sch Schedule) label() string {
+	if sch.Key == "" {
+		return sch.Name
+	}
+	return sch.Name + ":" + sch.Key
+}
+
 // Settings is the household settings source: *household.SettingsService.
 type Settings interface {
 	Get(ctx context.Context) (household.Settings, error)
@@ -199,8 +250,9 @@ type Scheduler struct {
 	now   func() time.Time
 	after func(d time.Duration) <-chan time.Time
 
-	// wake holds one token when the settings changed since the loop last
-	// looked; pending is the changes to apply, oldest first.
+	// wake holds one token when the settings or the data a DailyAt rule
+	// reads changed since the loop last looked; pending is the settings
+	// changes to apply, oldest first.
 	wake      chan struct{}
 	pendingMu sync.Mutex
 	pending   []change
@@ -240,19 +292,25 @@ func (s *Scheduler) Register(sch Schedule) error {
 		return fmt.Errorf("scheduler: register: unknown schedule %q", sch.Name)
 	}
 	if sch.Rule == nil {
-		return fmt.Errorf("scheduler: register %s: nil rule", sch.Name)
+		return fmt.Errorf("scheduler: register %s: nil rule", sch.label())
 	}
 	if sch.Run == nil {
-		return fmt.Errorf("scheduler: register %s: nil run", sch.Name)
+		return fmt.Errorf("scheduler: register %s: nil run", sch.label())
+	}
+	if strings.Contains(sch.Key, ":") {
+		return fmt.Errorf("scheduler: register %s: key has a colon", sch.label())
+	}
+	if sch.Key != "" && sch.PeriodKey != nil {
+		return fmt.Errorf("scheduler: register %s: both key and period key", sch.label())
 	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	if s.started {
-		return fmt.Errorf("scheduler: register %s: already started", sch.Name)
+		return fmt.Errorf("scheduler: register %s: already started", sch.label())
 	}
 	for _, have := range s.schedules {
-		if have.Name == sch.Name {
-			return fmt.Errorf("scheduler: register %s: already registered", sch.Name)
+		if have.Name == sch.Name && have.Key == sch.Key {
+			return fmt.Errorf("scheduler: register %s: already registered", sch.label())
 		}
 	}
 	s.schedules = append(s.schedules, sch)
@@ -260,7 +318,7 @@ func (s *Scheduler) Register(sch Schedule) error {
 }
 
 // Start reads the settings and starts the scheduler, which first catches
-// up on each schedule's most recent period and then fires schedules as
+// up on each schedule's recent periods and then fires schedules as
 // their times come. Settings whose zone or rules are invalid are an error
 // and nothing starts. The scheduler stops when ctx is cancelled; Wait waits
 // for it.
@@ -310,9 +368,21 @@ func (s *Scheduler) changed(settings household.Settings) {
 	s.pendingMu.Lock()
 	s.pending = append(s.pending, change{at: s.now(), settings: settings})
 	s.pendingMu.Unlock()
+	s.signal()
+}
+
+// Wake makes the scheduler look up its fire times again now rather than at
+// its next timer. Call it after committing a change to the data a DailyAt
+// rule reads, such as tonight's planned dinner. It never blocks.
+func (s *Scheduler) Wake() {
+	s.signal()
+}
+
+// signal leaves one token in wake for the loop.
+func (s *Scheduler) signal() {
 	select {
 	case s.wake <- struct{}{}:
-	default: // the loop already has a token and reads pending then
+	default: // the loop already has a token and looks again then
 	}
 }
 
@@ -346,7 +416,7 @@ func compile(schedules []Schedule, settings household.Settings) (*plan, error) {
 	for i, sch := range schedules {
 		rule := sch.Rule(settings)
 		if err := rule.validate(); err != nil {
-			return nil, fmt.Errorf("scheduler: %s: %w", sch.Name, err)
+			return nil, fmt.Errorf("scheduler: %s: %w", sch.label(), err)
 		}
 		p.items[i] = item{sch: sch, rule: rule}
 	}
@@ -396,7 +466,12 @@ func (s *Scheduler) loop(ctx context.Context, p *plan) {
 		case len(retry) > 0:
 			timeout = s.after(ClaimRetry)
 		case p != nil:
-			if next, ok := p.next(now); ok {
+			next, ok, err := p.next(ctx, now)
+			switch {
+			case err != nil:
+				s.logger.ErrorContext(ctx, "scheduler: look up next fire time failed; retrying", "error", err, "retry_in", ClaimRetry.String())
+				timeout = s.after(ClaimRetry)
+			case ok:
 				timeout = s.after(min(next.Sub(now), maxWait))
 			}
 		}
@@ -423,60 +498,105 @@ func (s *Scheduler) compileChange(ctx context.Context, settings household.Settin
 	return p
 }
 
-// target is one schedule's period, named by the fire time it belongs to.
+// target is one schedule's periods still to handle, oldest first, each
+// named by its fire time and the household-local date of its period. A
+// target whose fire times could not be looked up has lookup set instead,
+// with the stretch (done, until] to look them up in again.
 type target struct {
-	it  item
-	loc *time.Location
-	at  time.Time
+	it    item
+	loc   *time.Location
+	fires []fireTime
+
+	lookup      bool
+	done, until time.Time
 }
 
-// fire handles, for every schedule, its most recent fire time at or before
-// until if it is after done; now is the current instant. It returns the
-// targets whose claim failed, to be claimed again.
+// fire handles, for every schedule, its catch-up fire times after done and
+// at or before until; now is the current instant. It returns the
+// targets whose lookup or claim failed, to be handled again.
 func (s *Scheduler) fire(ctx context.Context, p *plan, done, until, now time.Time) []target {
 	var failed []target
 	for _, it := range p.items {
 		if ctx.Err() != nil {
 			return failed
 		}
-		at, due := fireBefore(it.rule, p.loc, until)
-		if !due || !at.After(done) {
-			continue
-		}
-		if t := (target{it: it, loc: p.loc, at: at}); !s.handle(ctx, t, now) {
+		if t, ok := s.fireItem(ctx, it, p.loc, done, until, now); !ok {
 			failed = append(failed, t)
 		}
 	}
 	return failed
 }
 
-// retry handles targets again at now and returns those whose claim still
-// failed.
+// fireItem handles, oldest first, it's fire times after done and at or
+// before until that passed within CatchUpWindow of now, and the most recent
+// of them even when it passed longer ago. It reports false, with the target
+// to handle again, when the fire times could not be looked up or a period's
+// claim failed.
+func (s *Scheduler) fireItem(ctx context.Context, it item, loc *time.Location, done, until, now time.Time) (target, bool) {
+	fs, err := fireBetween(ctx, it.rule, loc, done, until)
+	if err != nil {
+		s.logger.ErrorContext(ctx, "scheduler: look up fire time failed; retrying",
+			"schedule", it.sch.label(), "error", err, "retry_in", ClaimRetry.String())
+		return target{it: it, loc: loc, lookup: true, done: done, until: until}, false
+	}
+	i := 0
+	for i < len(fs)-1 && now.Sub(fs[i].at) > CatchUpWindow {
+		i++
+	}
+	return s.handleAll(ctx, target{it: it, loc: loc, fires: fs[i:]}, now)
+}
+
+// handleAll handles the periods of t in order, stopping at the first whose
+// claim failed. It reports false, with that period and those after it,
+// when one did.
+func (s *Scheduler) handleAll(ctx context.Context, t target, now time.Time) (target, bool) {
+	for i, f := range t.fires {
+		if !s.handle(ctx, t.it, f, now) {
+			t.fires = t.fires[i:]
+			return t, false
+		}
+	}
+	return target{}, true
+}
+
+// retry handles targets again at now and returns those whose lookup or
+// claim still failed.
 func (s *Scheduler) retry(ctx context.Context, targets []target, now time.Time) []target {
 	var failed []target
 	for i, t := range targets {
 		if ctx.Err() != nil {
 			return append(failed, targets[i:]...)
 		}
-		if !s.handle(ctx, t, now) {
-			failed = append(failed, t)
+		if t.lookup {
+			if again, ok := s.fireItem(ctx, t.it, t.loc, t.done, t.until, now); !ok {
+				failed = append(failed, again)
+			}
+			continue
+		}
+		if again, ok := s.handleAll(ctx, t, now); !ok {
+			failed = append(failed, again)
 		}
 	}
 	return failed
 }
 
-// handle claims the period of t and runs it, or records it as missed when
-// its fire time is more than CatchUpWindow before now. It reports false
+// handle claims the period of it's fire time f and runs it, or records it
+// as missed when f is more than CatchUpWindow before now. It reports false
 // when the claim failed and the period is still unclaimed.
-func (s *Scheduler) handle(ctx context.Context, t target, now time.Time) bool {
-	it, at := t.it, t.at
-	date := household.Today(at, t.loc)
+func (s *Scheduler) handle(ctx context.Context, it item, f fireTime, now time.Time) bool {
+	at, date := f.at, f.date
 	period := Period{Key: it.rule.PeriodKey(date), FireAt: at, Date: date}
 	if it.rule.NextWeek {
 		period.Week = household.WeekStart(addDays(date, 7))
 	} else {
 		period.Week = household.WeekStart(date)
 	}
+	switch {
+	case it.sch.Key != "":
+		period.Key = it.sch.Key + ":" + period.Key
+	case it.sch.PeriodKey != nil:
+		period.Key = it.sch.PeriodKey(period)
+	}
 	log := s.logger.With("schedule", it.sch.Name, "period", period.Key, "fire_at", at.Format(time.RFC3339))
 
 	claimed, err := s.claim(ctx, it.sch.Name, period.Key, now)
@@ -515,63 +635,102 @@ func (s *Scheduler) claim(ctx context.Context, name, key string, now time.Time)
 }
 
 // next returns the earliest fire time of any schedule after now, or false
-// when there is no schedule.
-func (p *plan) next(now time.Time) (time.Time, bool) {
+// when there is none.
+func (p *plan) next(ctx context.Context, now time.Time) (time.Time, bool, error) {
 	var next time.Time
 	for _, it := range p.items {
-		at, ok := fireAfter(it.rule, p.loc, now)
-		if ok && (next.IsZero() || at.Before(next)) {
-			next = at
+		f, ok, err := fireAfter(ctx, it.rule, p.loc, now)
+		if err != nil {
+			return time.Time{}, false, fmt.Errorf("%s: %w", it.sch.label(), err)
+		}
+		if ok && (next.IsZero() || f.at.Before(next)) {
+			next = f.at
 		}
 	}
-	return next, !next.IsZero()
+	return next, !next.IsZero(), nil
 }
 
-// window is how many days either side of a date fireBefore and fireAfter
+// window is how many days either side of a date fireBetween and fireAfter
 // search: more than a week, so a weekly rule always has a fire time on
 // each side.
 const window = 8
 
-// fireBefore returns the latest fire time of r in zone loc at or before t.
-func fireBefore(r Rule, loc *time.Location, t time.Time) (time.Time, bool) {
-	var best time.Time
-	for _, at := range fireTimes(r, loc, t) {
-		if !at.After(t) && (best.IsZero() || at.After(best)) {
-			best = at
+// atWindow is how many days either side of a date fireBetween and fireAfter
+// look up a DailyAt rule's fire times. A period firing further off is
+// looked up on a later pass, which comes within maxWait.
+const atWindow = 2
+
+// fireTime is a fire time and the household-local date of its period.
+type fireTime struct {
+	at   time.Time
+	date store.LocalDate
+}
+
+// fireBetween returns the fire times of r in zone loc after from and at or
+// before t, oldest first.
+func fireBetween(ctx context.Context, r Rule, loc *time.Location, from, t time.Time) ([]fireTime, error) {
+	fs, err := fireTimes(ctx, r, loc, t)
+	if err != nil {
+		return nil, err
+	}
+	var out []fireTime
+	for _, f := range fs {
+		if f.at.After(from) && !f.at.After(t) {
+			out = append(out, f)
 		}
 	}
-	return best, !best.IsZero()
+	slices.SortFunc(out, func(a, b fireTime) int { return a.at.Compare(b.at) })
+	return out, nil
 }
 
 // fireAfter returns the earliest fire time of r in zone loc after t.
-func fireAfter(r Rule, loc *time.Location, t time.Time) (time.Time, bool) {
-	var best time.Time
-	for _, at := range fireTimes(r, loc, t) {
-		if at.After(t) && (best.IsZero() || at.Before(best)) {
-			best = at
+func fireAfter(ctx context.Context, r Rule, loc *time.Location, t time.Time) (fireTime, bool, error) {
+	fs, err := fireTimes(ctx, r, loc, t)
+	if err != nil {
+		return fireTime{}, false, err
+	}
+	var best fireTime
+	for _, f := range fs {
+		if f.at.After(t) && (best.at.IsZero() || f.at.Before(best.at)) {
+			best = f
 		}
 	}
-	return best, !best.IsZero()
+	return best, !best.at.IsZero(), nil
 }
 
-// fireTimes returns r's fire times on the local dates within window days
-// of t's. A rule that fails to resolve was validated at compile, so it
-// cannot.
-func fireTimes(r Rule, loc *time.Location, t time.Time) []time.Time {
+// fireTimes returns r's fire times for the local dates within window days
+// of t's, or atWindow days for a DailyAt rule. A Time that fails to
+// resolve was validated at compile, so it cannot; a DailyAt lookup that
+// fails is an error.
+func fireTimes(ctx context.Context, r Rule, loc *time.Location, t time.Time) ([]fireTime, error) {
 	today := household.Today(t, loc)
-	var out []time.Time
-	for i := -window; i <= window; i++ {
+	span := window
+	if r.At != nil {
+		span = atWindow
+	}
+	var out []fireTime
+	for i := -span; i <= span; i++ {
 		d := addDays(today, i)
 		if r.Weekly && weekday(d) != r.Weekday {
 			continue
 		}
+		if r.At != nil {
+			at, ok, err := r.At(ctx, d)
+			if err != nil {
+				return nil, fmt.Errorf("fire time of %s: %w", d, err)
+			}
+			if ok {
+				out = append(out, fireTime{at: at, date: d})
+			}
+			continue
+		}
 		at, err := household.LocalTime(loc, d, r.Time)
 		if err != nil {
 			panic(fmt.Sprintf("scheduler: validated rule %+v: %v", r, err))
 		}
-		out = append(out, at)
+		out = append(out, fireTime{at: at, date: d})
 	}
-	return out
+	return out, nil
 }
 
 // addDays returns d plus n calendar days.

internal/scheduler/scheduler_test.go

@@ -7,6 +7,7 @@ import (
 	"log/slog"
 	"slices"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -59,10 +60,13 @@ func (c *fakeClock) Now() time.Time {
 	return c.now
 }
 
+// After returns a timer that fires d from now. The scheduler waits on only
+// its latest timer, so this one replaces any still pending: a timer the
+// scheduler gave up on when a wake came first never fires.
 func (c *fakeClock) After(d time.Duration) <-chan time.Time {
 	c.mu.Lock()
 	ch := make(chan time.Time, 1)
-	c.timers = append(c.timers, fakeTimer{deadline: c.now.Add(d), ch: ch})
+	c.timers = []fakeTimer{{deadline: c.now.Add(d), ch: ch}}
 	c.mu.Unlock()
 	c.waits <- struct{}{}
 	return ch
@@ -134,6 +138,16 @@ type env struct {
 	t        *testing.T
 	st       *store.Store
 	settings *household.SettingsService
+	// sched is the scheduler start last started, which wake wakes.
+	sched atomic.Pointer[scheduler.Scheduler]
+}
+
+// wake wakes the scheduler start last started, as the services' wake does
+// in the server; before the first start it does nothing.
+func (e *env) wake() {
+	if s := e.sched.Load(); s != nil {
+		s.Wake()
+	}
 }
 
 func newEnv(t *testing.T) *env {
@@ -214,6 +228,7 @@ func (e *env) start(now time.Time, schedules ...scheduler.Schedule) *running {
 		cancel()
 		e.t.Fatal(err)
 	}
+	e.sched.Store(s)
 	var once sync.Once
 	stop := func() {
 		once.Do(func() {
@@ -255,7 +270,8 @@ func (r *running) runUntil(to time.Time) {
 	}
 }
 
-// changed waits for the scheduler to apply a settings change.
+// changed waits for the scheduler to apply a settings change, or to look
+// again after a wake.
 func (r *running) changed() {
 	r.t.Helper()
 	r.idle()
@@ -387,6 +403,37 @@ func TestCatchUpOnlyMostRecentPeriod(t *testing.T) {
 	wantKeys(t, "schedule_runs", e.claimed(scheduler.DayOfReminder), []string{"2026-10-09"})
 }
 
+func TestCatchUpEveryPeriodWithin24HoursAcrossSpringForward(t *testing.T) {
+	// Clocks in Chicago jump 02:00 CST → 03:00 CDT on Sunday 2026-03-08,
+	// so 01:30 on Mar 8 and 01:30 on Mar 9 are only 23 hours apart.
+	e := newEnv(t)
+	e.update(household.SettingsPatch{ReviewTime: ptr("01:30")})
+	var rec recorder
+	review := scheduler.Schedule{
+		Name: scheduler.RotationCheck,
+		Rule: func(s household.Settings) scheduler.Rule { return scheduler.Daily(s.ReviewTime) },
+		Run:  rec.run,
+	}
+	// Boot at Mar 9 01:35: Mar 9 01:30 passed 5 minutes ago and Mar 8
+	// 01:30 23h05m ago, so both run, oldest first; Mar 7 01:30, 47h05m
+	// ago, is not looked at.
+	r := e.start(at(2026, 3, 9, 1, 35), review)
+	wantKeys(t, "catch-up", rec.keys(), []string{"2026-03-08", "2026-03-09"})
+	wantFired(t, rec.periods(),
+		time.Date(2026, 3, 8, 7, 30, 0, 0, time.UTC), // 01:30 CST
+		time.Date(2026, 3, 9, 6, 30, 0, 0, time.UTC), // 01:30 CDT
+	)
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.RotationCheck), []string{"2026-03-08", "2026-03-09"})
+	r.stop()
+
+	// A restart within the window finds both periods claimed.
+	var again recorder
+	review.Run = again.run
+	r2 := e.start(at(2026, 3, 9, 1, 40), review)
+	r2.runUntil(at(2026, 3, 9, 23, 0))
+	wantKeys(t, "after restart", again.keys(), nil)
+}
+
 func TestSpringForward(t *testing.T) {
 	// Clocks in Chicago jump 02:00 CST → 03:00 CDT on Sunday 2026-03-08.
 	e := newEnv(t)
@@ -706,6 +753,7 @@ func TestRegister(t *testing.T) {
 		{Name: "hourly", Rule: reminder(&rec).Rule, Run: rec.run},
 		{Name: scheduler.DayOfReminder, Run: rec.run},
 		{Name: scheduler.DayOfReminder, Rule: reminder(&rec).Rule},
+		{Name: scheduler.DayOfReminder, Key: "start", PeriodKey: func(p scheduler.Period) string { return p.Key }, Rule: reminder(&rec).Rule, Run: rec.run},
 	}
 	for _, sch := range bad {
 		if err := s.Register(sch); err == nil {

internal/scheduler/weekly_automation_test.go

@@ -0,0 +1,421 @@
+package scheduler_test
+
+import (
+	"context"
+	"crypto/rand"
+	"database/sql"
+	"encoding/base64"
+	"errors"
+	"log/slog"
+	"strings"
+	"testing"
+	"time"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/harness"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/skills"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/chat"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/chat/chattest"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/db"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/jobs"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/notify/notifytest"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/scheduler"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/secretbox"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/shopping"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
+)
+
+// The tests in this file run shopping's shopping_chat_autosend and
+// week_rollover schedules, and harness's ai_runs_purge, on the fake clock
+// against the real shopping service, Google Chat client (posting to a fake
+// webhook), notification preferences and ai_runs purge. The seeded
+// autosend is Saturday 08:00 in Chicago.
+
+// w41 is the Monday of 2026-W41.
+var w41 = mustLocalDate("2026-10-05")
+
+// shopEnv is a shopping service over a scheduler env's store. Its job
+// runner never starts, so Generate's title jobs stay queued and every
+// Supply run stays untitled until Freeze titles it, which fails.
+type shopEnv struct {
+	e     *env
+	svc   *shopping.Service
+	chat  *chattest.Chat
+	cs    *chat.Service
+	plans *planEnv
+	logs  *syncBuffer
+}
+
+// shopping builds a shopping service over e, with Regulars to plan from.
+func (e *env) shopping() *shopEnv {
+	e.t.Helper()
+	s := &shopEnv{e: e, chat: chattest.New(e.t), plans: e.plans(e.pool()), logs: &syncBuffer{}}
+	key := make([]byte, secretbox.KeySize)
+	rand.Read(key)
+	box, err := secretbox.New(base64.StdEncoding.EncodeToString(key))
+	if err != nil {
+		e.t.Fatal(err)
+	}
+	s.cs, err = chat.NewService(e.st, box, publicURL, s.chat.Transport())
+	if err != nil {
+		e.t.Fatal(err)
+	}
+	logger := slog.New(slog.NewTextHandler(s.logs, nil))
+	runner, err := jobs.NewRunner(e.st, logger, 1)
+	if err != nil {
+		e.t.Fatal(err)
+	}
+	noTitle := func(context.Context, string, skills.ArchiveTitleRequest) (skills.ArchiveTitle, error) {
+		return skills.ArchiveTitle{}, errors.New("no AI in this test")
+	}
+	s.svc, err = shopping.NewService(e.st, noTitle, runner, notifytest.New(e.t, e.st), s.cs, logger)
+	if err != nil {
+		e.t.Fatal(err)
+	}
+	return s
+}
+
+// list plans the week starting weekStart and generates its Supply run.
+func (s *shopEnv) list(weekStart store.LocalDate) {
+	s.e.t.Helper()
+	s.plans.planWeek(weekStart)
+	if _, err := s.svc.Generate(context.Background(), weekStart); err != nil {
+		s.e.t.Fatal(err)
+	}
+}
+
+// webhook stores the fake Google Chat webhook.
+func (s *shopEnv) webhook() {
+	s.e.t.Helper()
+	if _, err := s.cs.Put(context.Background(), chattest.Webhook, "Family"); err != nil {
+		s.e.t.Fatal(err)
+	}
+}
+
+// get returns the Supply run of the week starting weekStart.
+func (s *shopEnv) get(weekStart store.LocalDate) shopping.List {
+	s.e.t.Helper()
+	l, err := s.svc.Get(context.Background(), weekStart)
+	if err != nil {
+		s.e.t.Fatal(err)
+	}
+	return l
+}
+
+// wantLogged fails unless the service logged want and logged no error.
+func (s *shopEnv) wantLogged(want string) {
+	s.e.t.Helper()
+	if logs := s.logs.String(); !strings.Contains(logs, want) || strings.Contains(logs, "level=ERROR") {
+		s.e.t.Errorf("logs = %s, want %q and no error", logs, want)
+	}
+}
+
+// TestChatAutosendSendsComingWeek: at the seeded Saturday 08:00 the
+// schedule posts the coming week's Supply run, W43's, to Google Chat
+// through SendToChat, in that week's thread, and records sent_to_chat_at;
+// its period is claimed in schedule_runs as list_ready:chat:2026-10-19,
+// the coming week's start. It posts once.
+func TestChatAutosendSendsComingWeek(t *testing.T) {
+	e := newEnv(t)
+	s := e.shopping()
+	s.list(w43)
+	s.webhook()
+
+	// Saturday 07:00: the previous Saturday's period is past the
+	// catch-up window, so it is recorded as missed.
+	r := e.start(at(2026, 10, 17, 7, 0), s.svc.ChatAutosendSchedule())
+	r.runUntil(at(2026, 10, 17, 7, 59))
+	if n := len(s.chat.Posts()); n != 0 || s.get(w43).SentToChatAt != nil {
+		t.Fatalf("before 08:00: %d posts, sent_to_chat_at %v, want none", n, s.get(w43).SentToChatAt)
+	}
+
+	r.runUntil(at(2026, 10, 17, 8, 0))
+	posts := s.chat.Posts()
+	if len(posts) != 1 {
+		t.Fatalf("at 08:00: %d posts, want 1", len(posts))
+	}
+	if !strings.HasPrefix(posts[0].Text(), "Supply run · Week 43 · Oct 19 – 25") {
+		t.Errorf("posted %q, want the W43 Supply run", posts[0].Text())
+	}
+	if got := posts[0].Query.Get("threadKey"); got != chat.ThreadKey(w43) {
+		t.Errorf("posted in thread %q, want %q", got, chat.ThreadKey(w43))
+	}
+	if s.get(w43).SentToChatAt == nil {
+		t.Error("sent_to_chat_at not recorded")
+	}
+	s.wantLogged("Supply run sent to Google Chat")
+	s.wantLogged("period=list_ready:chat:2026-10-19")
+
+	r.runUntil(at(2026, 10, 24, 7, 0))
+	if n := len(s.chat.Posts()); n != 1 {
+		t.Errorf("a week on: %d posts, want 1", n)
+	}
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.ShoppingChatAutosend), []string{"list_ready:chat:2026-10-12", "list_ready:chat:2026-10-19"})
+}
+
+// TestChatAutosendFollowsSettings: chat_autosend_dow and
+// chat_autosend_time move the send without a restart, here to Friday
+// 18:00, still for the coming week.
+func TestChatAutosendFollowsSettings(t *testing.T) {
+	e := newEnv(t)
+	s := e.shopping()
+	s.list(w43)
+	s.webhook()
+
+	r := e.start(at(2026, 10, 16, 12, 0), s.svc.ChatAutosendSchedule())
+	e.update(household.SettingsPatch{ChatAutosendDow: ptr(5), ChatAutosendTime: ptr("18:00")})
+	r.changed()
+	r.runUntil(at(2026, 10, 16, 17, 59))
+	if n := len(s.chat.Posts()); n != 0 {
+		t.Fatalf("before Friday 18:00: %d posts, want 0", n)
+	}
+	r.runUntil(at(2026, 10, 16, 18, 0))
+	if n := len(s.chat.Posts()); n != 1 || s.get(w43).SentToChatAt == nil {
+		t.Fatalf("at Friday 18:00: %d posts, sent_to_chat_at %v, want 1 and set", n, s.get(w43).SentToChatAt)
+	}
+	r.runUntil(at(2026, 10, 17, 9, 0))
+	if n := len(s.chat.Posts()); n != 1 {
+		t.Errorf("Saturday: %d posts, want still 1", n)
+	}
+}
+
+// TestChatAutosendSkips: the schedule posts nothing, records no send and
+// fails nothing when the coming week's Supply run was already sent, when
+// the week has no Supply run, when list_ready is switched off for Google
+// Chat, and when no webhook is stored. Each period is still claimed and
+// the reason logged.
+func TestChatAutosendSkips(t *testing.T) {
+	cases := []struct {
+		name  string
+		setup func(t *testing.T, s *shopEnv)
+		// posts is how many posts the setup itself made.
+		posts  int
+		reason string
+	}{
+		{
+			name: "already sent",
+			setup: func(t *testing.T, s *shopEnv) {
+				s.list(w43)
+				s.webhook()
+				if _, err := s.svc.SendToChat(context.Background(), w43, false); err != nil {
+					t.Fatal(err)
+				}
+			},
+			posts:  1,
+			reason: shopping.AutosendAlreadySent,
+		},
+		{
+			name: "no list",
+			setup: func(t *testing.T, s *shopEnv) {
+				s.list(w42)
+				s.webhook()
+			},
+			reason: shopping.AutosendNoList,
+		},
+		{
+			name: "chat off for list_ready",
+			setup: func(t *testing.T, s *shopEnv) {
+				s.list(w43)
+				s.webhook()
+				if _, err := s.e.st.Writer.Exec(`UPDATE notification_prefs SET chat = 0 WHERE event = 'list_ready'`); err != nil {
+					t.Fatal(err)
+				}
+			},
+			reason: shopping.AutosendChatOff,
+		},
+		{
+			name: "no webhook",
+			setup: func(t *testing.T, s *shopEnv) {
+				s.list(w43)
+			},
+			reason: shopping.AutosendNotConfigured,
+		},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			e := newEnv(t)
+			s := e.shopping()
+			c.setup(t, s)
+			var sentBefore *string
+			if l, err := s.svc.Get(context.Background(), w43); err == nil {
+				sentBefore = l.SentToChatAt
+			}
+
+			r := e.start(at(2026, 10, 17, 7, 0), s.svc.ChatAutosendSchedule())
+			r.runUntil(at(2026, 10, 17, 9, 0))
+			if n := len(s.chat.Posts()); n != c.posts {
+				t.Errorf("posts = %d, want %d", n, c.posts)
+			}
+			if l, err := s.svc.Get(context.Background(), w43); err == nil && !equalPtr(l.SentToChatAt, sentBefore) {
+				t.Errorf("sent_to_chat_at = %v, want %v", l.SentToChatAt, sentBefore)
+			}
+			s.wantLogged("Supply run not sent to Google Chat: " + c.reason)
+			wantKeys(t, "schedule_runs", e.claimed(scheduler.ShoppingChatAutosend), []string{"list_ready:chat:2026-10-12", "list_ready:chat:2026-10-19"})
+		})
+	}
+}
+
+// TestChatAutosendFailureSurfaces: a send Google Chat refuses is the
+// period's error, logged as such; the period stays claimed and is not
+// retried, and sent_to_chat_at is not recorded.
+func TestChatAutosendFailureSurfaces(t *testing.T) {
+	e := newEnv(t)
+	s := e.shopping()
+	s.list(w43)
+	s.webhook()
+	s.chat.SetStatus(500)
+
+	var logs syncBuffer
+	sched, err := scheduler.New(e.st, e.settings, slog.New(slog.NewTextHandler(&logs, nil)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	clock := newFakeClock(at(2026, 10, 17, 7, 0))
+	scheduler.SetClock(sched, clock.Now, clock.After)
+	if err := sched.Register(s.svc.ChatAutosendSchedule()); err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(func() {
+		cancel()
+		sched.Wait()
+	})
+	if err := sched.Start(ctx); err != nil {
+		t.Fatal(err)
+	}
+	r := &running{t: t, clock: clock, stop: cancel}
+	r.idle()
+	r.runUntil(at(2026, 10, 17, 9, 0))
+
+	if n := len(s.chat.Posts()); n != 1 {
+		t.Errorf("posts = %d, want the one refused", n)
+	}
+	if s.get(w43).SentToChatAt != nil {
+		t.Error("sent_to_chat_at recorded for a refused send")
+	}
+	if got := logs.String(); !strings.Contains(got, "level=ERROR") || !strings.Contains(got, "scheduler: run failed") || !strings.Contains(got, "schedule=shopping_chat_autosend") {
+		t.Errorf("scheduler logs = %s, want the refused send logged as a failed run", got)
+	}
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.ShoppingChatAutosend), []string{"list_ready:chat:2026-10-12", "list_ready:chat:2026-10-19"})
+}
+
+func equalPtr(a, b *string) bool {
+	return (a == nil && b == nil) || (a != nil && b != nil && *a == *b)
+}
+
+// TestWeekRolloverFreezesPreviousWeek: at Monday 00:05 the schedule
+// freezes exactly the week that has just ended into the Supply archive,
+// not the week before it nor the new week; the next Monday freezes the
+// next week; a Monday whose previous week has no Supply run freezes
+// nothing and fails nothing. Its periods are week_rollover:YYYY-Www of the
+// Monday.
+func TestWeekRolloverFreezesPreviousWeek(t *testing.T) {
+	e := newEnv(t)
+	s := e.shopping()
+	s.list(w41)
+	s.list(w42)
+	s.list(w43)
+
+	status := func() []string {
+		return []string{s.get(w41).Status, s.get(w42).Status, s.get(w43).Status}
+	}
+	cur, arc := shopping.StatusCurrent, shopping.StatusArchived
+
+	// Sunday 23:00: last Monday's rollover is past the catch-up window and
+	// recorded as missed, so W41 is never frozen by it.
+	r := e.start(at(2026, 10, 18, 23, 0), s.svc.RolloverSchedule())
+	r.runUntil(at(2026, 10, 19, 0, 4))
+	wantKeys(t, "before Monday 00:05", status(), []string{cur, cur, cur})
+
+	r.runUntil(at(2026, 10, 19, 0, 5))
+	wantKeys(t, "at Monday 00:05", status(), []string{cur, arc, cur})
+	if s.get(w42).Title != nil {
+		t.Errorf("W42 title = %q, want frozen untitled", *s.get(w42).Title)
+	}
+	if _, err := s.svc.Generate(context.Background(), w42); !errors.Is(err, shopping.ErrFrozen) {
+		t.Errorf("generate W42 after the rollover: %v, want ErrFrozen", err)
+	}
+
+	r.runUntil(at(2026, 10, 26, 0, 5))
+	wantKeys(t, "next Monday", status(), []string{cur, arc, arc})
+
+	r.runUntil(at(2026, 11, 2, 0, 5))
+	s.wantLogged("week rollover froze nothing: the week has no Supply run")
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.WeekRollover), []string{"2026-W42", "2026-W43", "2026-W44", "2026-W45"})
+}
+
+// aiRun stores an ai_runs row created at created and returns its id.
+func (e *env) aiRun(created time.Time) string {
+	e.t.Helper()
+	id := store.NewID()
+	ts := store.Timestamp{Time: created.UTC()}.String()
+	if err := db.New(e.st.Writer).CreateAIRun(context.Background(), db.CreateAIRunParams{
+		ID: id, Skill: "draft_week", SkillVersion: "1", Provider: "anthropic", Model: "claude-test",
+		Temperature: 0.7, Status: "ok", RequestRedacted: "{}", ResponseRedacted: sql.NullString{String: "{}", Valid: true},
+		CreatedAt: ts, UpdatedAt: ts,
+	}); err != nil {
+		e.t.Fatal(err)
+	}
+	return id
+}
+
+// aiRuns returns the ids of the ai_runs rows, oldest first.
+func (e *env) aiRuns() []string {
+	e.t.Helper()
+	rows, err := e.st.Reader.Query(`SELECT id FROM ai_runs ORDER BY created_at`)
+	if err != nil {
+		e.t.Fatal(err)
+	}
+	defer rows.Close()
+	var ids []string
+	for rows.Next() {
+		var id string
+		if err := rows.Scan(&id); err != nil {
+			e.t.Fatal(err)
+		}
+		ids = append(ids, id)
+	}
+	if err := rows.Err(); err != nil {
+		e.t.Fatal(err)
+	}
+	return ids
+}
+
+// TestAIRunsPurgeDaily: every day at 03:00 the schedule deletes the
+// ai_runs rows created more than 30 days before, and no younger row; its
+// periods are ai_runs_purge:YYYY-MM-DD.
+func TestAIRunsPurgeDaily(t *testing.T) {
+	e := newEnv(t)
+	e.aiRun(at(2026, 9, 10, 12, 0)) // older than Sep 11 03:00
+	edge := e.aiRun(at(2026, 9, 12, 2, 59))
+	young := e.aiRun(at(2026, 9, 12, 3, 1))
+	recent := e.aiRun(at(2026, 10, 11, 12, 0))
+
+	sch, err := harness.PurgeSchedule(e.st, slog.New(slog.NewTextHandler(&syncBuffer{}, nil)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Monday 02:00: the catch-up of Sunday 03:00 purges before Sep 11 03:00.
+	r := e.start(at(2026, 10, 12, 2, 0), sch)
+	wantKeys(t, "after the catch-up", e.aiRuns(), []string{edge, young, recent})
+
+	r.runUntil(at(2026, 10, 12, 2, 59))
+	wantKeys(t, "before 03:00", e.aiRuns(), []string{edge, young, recent})
+	r.runUntil(at(2026, 10, 12, 3, 0))
+	wantKeys(t, "at 03:00", e.aiRuns(), []string{young, recent})
+	r.runUntil(at(2026, 10, 13, 3, 0))
+	wantKeys(t, "next day", e.aiRuns(), []string{recent})
+	wantKeys(t, "schedule_runs", e.claimed(scheduler.AIRunsPurge), []string{"2026-10-11", "2026-10-12", "2026-10-13"})
+}
+
+// TestPurgeScheduleRejectsNil: the purge schedule needs a store and a
+// logger.
+func TestPurgeScheduleRejectsNil(t *testing.T) {
+	e := newEnv(t)
+	if _, err := harness.PurgeSchedule(nil, slog.Default()); err == nil {
+		t.Error("nil store accepted")
+	}
+	if _, err := harness.PurgeSchedule(e.st, nil); err == nil {
+		t.Error("nil logger accepted")
+	}
+}

internal/server/dinners_test.go

@@ -93,7 +93,7 @@ func newDinnersEnv(t *testing.T) *dinnersEnv {
 	if err != nil {
 		t.Fatal(err)
 	}
-	svc, err := dinners.NewService(st, g, runner, logger)
+	svc, err := dinners.NewService(st, g, runner, func() {}, logger)
 	if err != nil {
 		t.Fatal(err)
 	}

internal/server/ideaactions_test.go

@@ -65,7 +65,7 @@ func newIdeaActionsRouter(t *testing.T, model, normalize *llm.Fake, search *reci
 	if err != nil {
 		t.Fatal(err)
 	}
-	dinnerSvc, err := dinners.NewService(st, g, runner, logger)
+	dinnerSvc, err := dinners.NewService(st, g, runner, func() {}, logger)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -73,7 +73,7 @@ func newIdeaActionsRouter(t *testing.T, model, normalize *llm.Fake, search *reci
 		t.Error("draft_week ran: an idea action must never draft a plan")
 		return skills.Week{}, context.Canceled
 	}
-	planSvc, err := plan.NewService(st, draft, runner, newTestGoogle(t), notifytest.New(t, st), &url.URL{Scheme: "https", Host: "mealquest.example"}, logger)
+	planSvc, err := plan.NewService(st, draft, runner, newTestGoogle(t), notifytest.New(t, st), func() {}, &url.URL{Scheme: "https", Host: "mealquest.example"}, logger)
 	if err != nil {
 		t.Fatal(err)
 	}

internal/server/ideasource_test.go

@@ -0,0 +1,197 @@
+package server
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"reflect"
+	"strings"
+	"testing"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ai/llm"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/ideas"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/jobs"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/recipes"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/recipes/recipestest"
+)
+
+// sourceCase is a recipe page an idea grounds in: its link and the site
+// name its page gives (empty for none, so the host is stored instead).
+type sourceCase struct {
+	dish, link, site string
+	// want is the idea's source_url and site_name; nil is null.
+	wantURL, wantSite any
+}
+
+const (
+	cleanSourceLink = "https://kitchen.example/recipes/chicken-curry"
+	queryToken      = "query-token-abc123"
+	queryHost       = "query-host-q1.example"
+	userinfoToken   = "user-token-def456"
+	userinfoHost    = "userinfo-host-u2.example"
+)
+
+// sourceCases are a clean link, credited by its page's name, and links
+// carrying a token in the query and the userinfo whose pages name no site,
+// so the stored name is the link's host.
+var sourceCases = []sourceCase{
+	{"Chicken Curry", cleanSourceLink, "Curry House", cleanSourceLink, "Curry House"},
+	{"Beef Stew", "https://" + queryHost + "/stew?access_token=" + queryToken, "", nil, nil},
+	{"Bean Chili", "https://" + userinfoToken + "@" + userinfoHost + "/chili", "", nil, nil},
+}
+
+// sourceSecrets are what no idea job response may contain.
+var sourceSecrets = []string{queryToken, "access_token", queryHost, userinfoToken, userinfoHost}
+
+// sourceFakes makes the search for each case's dish find its page and
+// scripts the normalize_recipe reply grounding it takes.
+func sourceFakes(t *testing.T, minutes int) (*llm.Fake, *llm.Fake, *recipestest.Search, *recipestest.Pages, *recipestest.Images) {
+	t.Helper()
+	model, normalize, search, pages, images := newQuickFakes()
+	for i, c := range sourceCases {
+		photo := fmt.Sprintf("https://img.example/%d.jpg", i)
+		search.Results[c.dish] = []recipes.Candidate{{URL: c.link}}
+		pages.Bodies[c.link] = recipestest.RecipePage(c.dish, c.site, photo, minutes)
+		images.JPEGs[photo] = recipestest.JPEG(t, 400, 320, uint8(i+1))
+		normalize.QueueGenerate(recipestest.NormalizedReply("stovetop", minutes))
+	}
+	return model, normalize, search, pages, images
+}
+
+// checkIdeaSources checks the finished job id: each idea shows its case's
+// safe source, and the response holds nothing of a token-bearing link.
+func checkIdeaSources(t *testing.T, h http.Handler, id string) {
+	t.Helper()
+	job := waitJob(t, h, id)
+	if job["status"] != "succeeded" {
+		t.Fatalf("GET job = %v", job)
+	}
+	rec, _ := callDinners(t, h, http.MethodGet, "/api/v1/jobs/"+id, "")
+	for _, secret := range sourceSecrets {
+		if strings.Contains(rec.Body.String(), secret) {
+			t.Errorf("job response contains %q: %s", secret, rec.Body)
+		}
+	}
+	list := job["result"].(map[string]any)["ideas"].([]any)
+	if len(list) != len(sourceCases) {
+		t.Fatalf("ideas = %v, want %d", list, len(sourceCases))
+	}
+	for i, c := range sourceCases {
+		idea := list[i].(map[string]any)
+		if idea["name"] != c.dish {
+			t.Fatalf("idea %d = %v, want %s", i, idea, c.dish)
+		}
+		for key, want := range map[string]any{"source_url": c.wantURL, "site_name": c.wantSite} {
+			got, ok := idea[key]
+			if !ok || !reflect.DeepEqual(got, want) {
+				t.Errorf("%s %s = %v (present %t), want %v", c.dish, key, got, ok, want)
+			}
+		}
+		if idea["recipe_id"] == "" || idea["photo_url"] == "" {
+			t.Errorf("idea %s = %v, want a recipe and photo", c.dish, idea)
+		}
+	}
+}
+
+// An ideas_from_ingredients job shows a clean link and its page's name,
+// and neither a token-bearing link nor a name taken from its host.
+func TestIdeasJobShowsOnlySafeSources(t *testing.T) {
+	t.Parallel()
+	model, normalize, search, pages, images := sourceFakes(t, 25)
+	list := make([]string, len(sourceCases))
+	for i, c := range sourceCases {
+		list[i] = fmt.Sprintf(`{"name":%q,"uses":["rice"],"missing":[],"est_minutes":25,"method":"stovetop","difficulty":"easy","search_query":%q}`, c.dish, c.dish)
+	}
+	js := `{"ideas":[` + strings.Join(list, ",") + `]}`
+	model.QueueGenerate(llm.GenerateResult{Response: llm.Response{Text: js, JSON: json.RawMessage(js)}})
+	h, _, _ := newIdeasRouter(t, model, normalize, search, pages, images, true)
+	checkIdeaSources(t, h, startIdeasJob(t, h))
+}
+
+// A quick_ideas job shows sources as an ideas_from_ingredients job does.
+func TestQuickJobShowsOnlySafeSources(t *testing.T) {
+	t.Parallel()
+	model, normalize, search, pages, images := sourceFakes(t, 25)
+	ideas := make([][3]any, len(sourceCases))
+	for i, c := range sourceCases {
+		ideas[i] = [3]any{c.dish, "stovetop", 20}
+	}
+	quickReply(model, ideas...)
+	h, _, _ := newIdeasRouter(t, model, normalize, search, pages, images, true)
+	rec, body := callDinners(t, h, http.MethodPost, quickPath, `{"kind": "under30", "exclude": []}`)
+	if rec.Code != http.StatusAccepted {
+		t.Fatalf("POST = %d: %s", rec.Code, rec.Body)
+	}
+	checkIdeaSources(t, h, body["jobId"].(string))
+}
+
+// legacyIdea is an idea as the result builders stored it before sources
+// were made safe: the grounded recipe's raw link and stored site name,
+// which is the link's host when its page named no site.
+func legacyIdea(name, link, site string) map[string]any {
+	return map[string]any{
+		"name": name, "method": "stovetop", "minutes_total": 25, "difficulty": "easy",
+		"recipe_id": "01JLEGACY" + strings.ToUpper(strings.ReplaceAll(name, " ", "")), "photo_url": "/api/v1/photos/legacy",
+		"source_url": link, "site_name": site,
+	}
+}
+
+// A job of either idea kind whose result was stored before sources were
+// made safe is served with the sources a job stored now holds: neither a
+// token-bearing link nor a name taken from its host.
+func TestJobServesLegacyIdeaResultsWithOnlySafeSources(t *testing.T) {
+	t.Parallel()
+	model, normalize, search, pages, images := newQuickFakes()
+	h, _, st := newIdeasRouter(t, model, normalize, search, pages, images, false)
+	legacy := []any{
+		legacyIdea("Chicken Curry", cleanSourceLink, "Curry House"),
+		legacyIdea("Beef Stew", "https://"+queryHost+"/stew?access_token="+queryToken, queryHost),
+		legacyIdea("Bean Chili", "https://"+userinfoToken+"@"+userinfoHost+"/chili", userinfoHost),
+	}
+	for kind, result := range map[string]map[string]any{
+		ideas.KindFromIngredients: {"stage": "done", "ingredients": []string{"rice"}, "quick_only": false, "ideas": legacy, "dropped": 0},
+		ideas.KindQuick:           {"stage": "done", "kind": "under30", "exclude": []string{}, "ideas": legacy, "dropped": 0},
+	} {
+		js, err := json.Marshal(result)
+		if err != nil {
+			t.Fatal(err)
+		}
+		id := "legacy-" + kind
+		if _, err := st.Writer.ExecContext(t.Context(),
+			`INSERT INTO jobs (id, kind, status, payload, result, created_at, updated_at) VALUES (?, ?, 'succeeded', '{}', ?, '2026-10-01T00:00:00Z', '2026-10-01T00:00:00Z')`,
+			id, kind, string(js)); err != nil {
+			t.Fatal(err)
+		}
+		checkIdeaSources(t, h, id)
+	}
+}
+
+// An idea job whose grounded recipe's stored link does not parse fails,
+// even when no site name is stored, rather than show the idea without a
+// source.
+func TestIdeaJobFailsOnUnparseableSourceWithoutSiteName(t *testing.T) {
+	t.Parallel()
+	const badLink = "https://kitchen.example/%zz"
+	model, normalize, search, pages, images := sourceFakes(t, 25)
+	idea := fmt.Sprintf(`{"name":%q,"uses":["rice"],"missing":[],"est_minutes":25,"method":"stovetop","difficulty":"easy","search_query":%q}`, sourceCases[0].dish, sourceCases[0].dish)
+	js := `{"ideas":[` + idea + `]}`
+	for range 2 {
+		model.QueueGenerate(llm.GenerateResult{Response: llm.Response{Text: js, JSON: json.RawMessage(js)}})
+	}
+	h, _, st := newIdeasRouter(t, model, normalize, search, pages, images, true)
+	if job := waitJob(t, h, startIdeasJob(t, h)); job["status"] != "succeeded" {
+		t.Fatalf("grounding job = %v", job)
+	}
+	// The recipe is now stored under badLink with no site name, and the
+	// search finds it there.
+	res, err := st.Writer.ExecContext(t.Context(), `UPDATE recipes SET source_url = ?, site_name = NULL WHERE source_url = ?`, badLink, cleanSourceLink)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n, err := res.RowsAffected(); err != nil || n != 1 {
+		t.Fatalf("updated %d recipes (%v), want 1", n, err)
+	}
+	search.Results[sourceCases[0].dish] = []recipes.Candidate{{URL: badLink}}
+	job := waitJob(t, h, startIdeasJob(t, h))
+	assertFailedWithoutIdeas(t, job, jobs.CodeInternal)
+}

internal/server/plans_test.go

@@ -93,7 +93,7 @@ func newPlansRouterTitled(t *testing.T, title shopping.Titler) plansEnv {
 		t.Fatal(err)
 	}
 	notifier := notifytest.New(t, st)
-	svc, err := plan.NewService(st, fail, runner, googleSvc, notifier, pub, logger)
+	svc, err := plan.NewService(st, fail, runner, googleSvc, notifier, func() {}, pub, logger)
 	if err != nil {
 		t.Fatal(err)
 	}

internal/server/server_test.go

@@ -166,7 +166,7 @@ func newTestDinners(t *testing.T) *dinners.Service {
 		t.Fatal(err)
 	}
 	g := recipestest.NewGrounder(t, st, t.TempDir(), &recipestest.Search{}, &recipestest.Pages{}, &recipestest.Images{}, &llm.Fake{})
-	svc, err := dinners.NewService(st, g, runner, logger)
+	svc, err := dinners.NewService(st, g, runner, func() {}, logger)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -232,7 +232,7 @@ func newTestPlan(t *testing.T) *plan.Service {
 	fail := func(context.Context, string, skills.WeekRequest) (skills.Week, error) {
 		return skills.Week{}, errors.New("no model in this test")
 	}
-	svc, err := plan.NewService(st, fail, runner, newTestGoogle(t), notifytest.New(t, st), &url.URL{Scheme: "https", Host: "mealquest.example"}, logger)
+	svc, err := plan.NewService(st, fail, runner, newTestGoogle(t), notifytest.New(t, st), func() {}, &url.URL{Scheme: "https", Host: "mealquest.example"}, logger)
 	if err != nil {
 		t.Fatal(err)
 	}

internal/shopping/archive.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"strconv"
+	"time"
 
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/db"
 	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
@@ -39,11 +40,17 @@ const (
 // only when no job is running it. A job that runs after the freeze finds
 // the list titled, or frozen untitled, and stores nothing.
 func (s *Service) Freeze(ctx context.Context, weekStart store.LocalDate) error {
+	return s.freeze(ctx, weekStart, s.now())
+}
+
+// freeze is Freeze with the week ended by instant now rather than by the
+// service's clock.
+func (s *Service) freeze(ctx context.Context, weekStart store.LocalDate, now time.Time) error {
 	if _, err := household.WeekDays(weekStart); err != nil {
 		return fmt.Errorf("shopping: freeze: %w", err)
 	}
 	q := db.New(s.st.Writer)
-	thisWeek, err := s.thisWeek(ctx, q)
+	thisWeek, err := weekAt(ctx, q, now)
 	if err != nil {
 		return err
 	}
@@ -73,9 +80,9 @@ func (s *Service) Freeze(ctx context.Context, weekStart store.LocalDate) error {
 		}
 	}
 	// A list frozen meanwhile is left as it is: the freeze is done.
-	now := store.Now().String()
+	stamp := store.Now().String()
 	if _, err := q.FreezeShoppingList(ctx, db.FreezeShoppingListParams{
-		FrozenAt: sql.NullString{String: now, Valid: true}, UpdatedAt: now, ID: list.ID,
+		FrozenAt: sql.NullString{String: stamp, Valid: true}, UpdatedAt: stamp, ID: list.ID,
 	}); err != nil {
 		return fmt.Errorf("shopping: freeze %s: %w", weekStart, err)
 	}
@@ -103,6 +110,12 @@ func freezeTitleJob(ctx context.Context, q *db.Queries, list db.ShoppingList) (T
 // thisWeek returns the Monday of the household's current week, in its
 // time zone, by the service's clock.
 func (s *Service) thisWeek(ctx context.Context, q *db.Queries) (store.LocalDate, error) {
+	return weekAt(ctx, q, s.now())
+}
+
+// weekAt returns the Monday of the household's week at instant t, in its
+// time zone.
+func weekAt(ctx context.Context, q *db.Queries, t time.Time) (store.LocalDate, error) {
 	settings, err := q.GetHouseholdSettings(ctx)
 	if err != nil {
 		return store.LocalDate{}, fmt.Errorf("shopping: read household settings: %w", err)
@@ -111,7 +124,7 @@ func (s *Service) thisWeek(ctx context.Context, q *db.Queries) (store.LocalDate,
 	if err != nil {
 		return store.LocalDate{}, fmt.Errorf("shopping: household settings: %w", err)
 	}
-	return household.WeekStart(household.Today(s.now(), zone)), nil
+	return household.WeekStart(household.Today(t, zone)), nil
 }
 
 // Period is one heading of the Supply archive and its posts, newest first.

internal/shopping/schedule.go

@@ -0,0 +1,133 @@
+package shopping
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/household"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/notify"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/scheduler"
+	"code.cubecraftlabs.com/Maniacs_Mansion/Meal-Quest/internal/store"
+)
+
+// RolloverTime is when, every Monday in the household zone, week_rollover
+// freezes the week that has just ended. It is fixed, not a setting.
+const RolloverTime = "00:05"
+
+// Reasons Autosend posts nothing.
+const (
+	AutosendNotConfigured = "no Google Chat webhook is configured"
+	AutosendChatOff       = "list_ready is switched off for Google Chat"
+	AutosendNoList        = "the week has no Supply run"
+	AutosendAlreadySent   = "the Supply run was already sent to Google Chat"
+	AutosendUnconfirmed   = "a send of the Supply run to Google Chat is unconfirmed"
+)
+
+// AutosendKey identifies the automatic send of the Supply run of the week
+// starting weekStart, list_ready:chat:YYYY-MM-DD: it is the
+// shopping_chat_autosend period key claimed in schedule_runs. The send
+// itself is recorded in the list's sent_to_chat_at.
+func AutosendKey(weekStart store.LocalDate) string {
+	return string(notify.ListReady) + ":" + string(notify.ChannelChat) + ":" + weekStart.String()
+}
+
+// ChatAutosendSchedule is the shopping_chat_autosend schedule: at the
+// household's chat_autosend_dow and chat_autosend_time it sends the Supply
+// run of the coming week, the week after the fire date's, to Google Chat
+// with Autosend. Its period is that week, scheduler.WeeklyForNextWeek's,
+// claimed under AutosendKey of the week's Monday. A send that fails is the
+// period's error and is not retried; the household can still send it from
+// the Supply run.
+func (s *Service) ChatAutosendSchedule() scheduler.Schedule {
+	return scheduler.Schedule{
+		Name: scheduler.ShoppingChatAutosend,
+		Rule: func(settings household.Settings) scheduler.Rule {
+			return scheduler.WeeklyForNextWeek(time.Weekday(settings.ChatAutosendDow), settings.ChatAutosendTime)
+		},
+		PeriodKey: func(p scheduler.Period) string {
+			return AutosendKey(p.Week)
+		},
+		Run: func(ctx context.Context, p scheduler.Period) error {
+			skipped, err := s.Autosend(ctx, p.Week)
+			if err != nil {
+				return err
+			}
+			log := s.logger.With("period", p.Key, "week_start", p.Week.String())
+			if skipped != "" {
+				log.InfoContext(ctx, "Supply run not sent to Google Chat: "+skipped)
+				return nil
+			}
+			log.InfoContext(ctx, "Supply run sent to Google Chat")
+			return nil
+		},
+	}
+}
+
+// Autosend sends the Supply run of the week starting weekStart to Google
+// Chat with SendToChat, as the household's send does, when a webhook is
+// stored, list_ready's Google Chat channel is switched on, and the week has
+// a Supply run not yet sent and with no send unconfirmed. Otherwise it
+// posts nothing and returns which of those reasons stopped it; it never
+// resends. A send that fails is SendToChat's error.
+func (s *Service) Autosend(ctx context.Context, weekStart store.LocalDate) (skipped string, err error) {
+	settings, err := s.chat.Get(ctx)
+	if err != nil {
+		return "", fmt.Errorf("shopping: autosend: %w", err)
+	}
+	if settings.URLMasked == nil {
+		return AutosendNotConfigured, nil
+	}
+	on, err := s.notifier.ChannelOn(ctx, notify.ListReady, notify.ChannelChat)
+	if err != nil {
+		return "", fmt.Errorf("shopping: autosend: %w", err)
+	}
+	if !on {
+		return AutosendChatOff, nil
+	}
+	l, err := s.Get(ctx, weekStart)
+	if errors.Is(err, ErrListNotFound) {
+		return AutosendNoList, nil
+	}
+	if err != nil {
+		return "", err
+	}
+	switch {
+	case l.SentToChatAt != nil:
+		return AutosendAlreadySent, nil
+	case l.ChatSendUnconfirmedAt != nil:
+		return AutosendUnconfirmed, nil
+	}
+	if _, err := s.SendToChat(ctx, weekStart, false); err != nil {
+		return "", err
+	}
+	return "", nil
+}
+
+// RolloverSchedule is the week_rollover schedule: every Monday at
+// RolloverTime it freezes the Supply run of the week before the fire
+// date's into the Supply archive with Freeze, the week ending by the fire
+// time. Its period scheduler.Weekly keys week_rollover:YYYY-Www for the
+// fire date's week. A week with no Supply run has nothing to freeze, and
+// the period says so; a freeze that fails is the period's error and is not
+// retried.
+func (s *Service) RolloverSchedule() scheduler.Schedule {
+	return scheduler.Schedule{
+		Name: scheduler.WeekRollover,
+		Rule: func(household.Settings) scheduler.Rule {
+			return scheduler.Weekly(time.Monday, RolloverTime)
+		},
+		Run: func(ctx context.Context, p scheduler.Period) error {
+			y, m, d := p.Week.Date()
+			last := store.LocalDateOf(time.Date(y, m, d-7, 0, 0, 0, 0, time.UTC))
+			err := s.freeze(ctx, last, p.FireAt)
+			if errors.Is(err, ErrListNotFound) {
+				s.logger.InfoContext(ctx, "week rollover froze nothing: the week has no Supply run",
+					"period", p.Key, "week_start", last.String())
+				return nil
+			}
+			return err
+		},
+	}
+}

internal/shopping/shopping_test.go

@@ -516,7 +516,7 @@ func TestGenerateManualRecipe(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	dsvc, err := dinners.NewService(e.st, grounder, runner, logger)
+	dsvc, err := dinners.NewService(e.st, grounder, runner, func() {}, logger)
 	if err != nil {
 		t.Fatal(err)
 	}

internal/suggest/suggest_test.go

@@ -1102,7 +1102,7 @@ func TestBatchNeverStoresDishPassedWhileRunning(t *testing.T) {
 func TestLaterBatchNeverResuggestsRenamedPass(t *testing.T) {
 	e := newEnv(t) // runner not started: the replenish batch waits for the rename
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	dinnerSvc, err := dinners.NewService(e.st, e.grounder, e.runner, logger)
+	dinnerSvc, err := dinners.NewService(e.st, e.grounder, e.runner, func() {}, logger)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1150,14 +1150,14 @@ func TestLaterBatchNeverResuggestsRenamedDrop(t *testing.T) {
 	e := newEnv(t)
 	ctx := t.Context()
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
-	dinnerSvc, err := dinners.NewService(e.st, e.grounder, e.runner, logger)
+	dinnerSvc, err := dinners.NewService(e.st, e.grounder, e.runner, func() {}, logger)
 	if err != nil {
 		t.Fatal(err)
 	}
 	fail := func(context.Context, string, skills.WeekRequest) (skills.Week, error) {
 		return skills.Week{}, errors.New("no draft in this test")
 	}
-	planSvc, err := plan.NewService(e.st, fail, e.runner, noCalendar{}, notifytest.New(t, e.st), &url.URL{Scheme: "https", Host: "meals.example.com"}, logger)
+	planSvc, err := plan.NewService(e.st, fail, e.runner, noCalendar{}, notifytest.New(t, e.st), func() {}, &url.URL{Scheme: "https", Host: "meals.example.com"}, logger)
 	if err != nil {
 		t.Fatal(err)
 	}

web/src/ideas/CookFromPantryPage.test.tsx

@@ -33,7 +33,9 @@ function idea(name: string, summary: string, minutes: number | null = 30) {
 
 // The ideas of mock 1i.
 const CURRY = idea('Coconut chicken curry', 'Uses all 5 · missing: 1 lime')
-const BOWLS = idea('Garlic spinach rice bowls', 'Uses 4 of 5 · nothing missing', 25)
+// BOWLS's source is withheld, as the server sends one whose link could
+// carry a secret: the card shows all the same.
+const BOWLS = { ...idea('Garlic spinach rice bowls', 'Uses 4 of 5 · nothing missing', 25), source_url: null, site_name: null }
 const ONE_PAN = idea('One-pan chicken & rice', 'Uses 3 of 5 · missing: onion')
 
 type JobBody = { status: string; result: unknown; error: string | null }

web/src/ideas/QuickDinnersPage.test.tsx

@@ -30,7 +30,9 @@ function idea(name: string, method: string, minutes: number | null, difficulty:
 
 // The ideas of mock 1j, and more for later pages and the Crock pot tab.
 const ORZO = idea('Lemon garlic shrimp orzo', 'stovetop', 25, 'medium')
-const QUESADILLAS = idea('Chicken quesadillas', 'stovetop', 20, 'easy')
+// QUESADILLAS's source is withheld, as the server sends one whose link
+// could carry a secret: the card shows all the same.
+const QUESADILLAS = { ...idea('Chicken quesadillas', 'stovetop', 20, 'easy'), source_url: null, site_name: null }
 const BROCCOLI = idea('Beef & broccoli', 'stovetop', 30, 'easy')
 const GNOCCHI = idea('Pesto gnocchi & peas', 'stovetop', 15, 'easy')
 const CHILI = idea('Crock pot chili', 'crockpot', 360, 'easy')