feat: implement cron window spread backend

[carderne]

Summary

Add the backend plumbing for cron schedule spreading/delaying.

Changes

• New DB fields on Schedule and ScheduleInstance
• Use queueTimestamp for the "effectiveAt" delayed start time, propagate it to Clickhouse TaskRun table
• Disable fastpath for delayed jobs
• Add schedule timing logic, API endpoints with windows, persistence
• Calculate phase for every schedule, only persist when window is non-null
• Additional o11y for phased rollout

Flag

• default off, window will still be accepted by API inert
• phase will still be calculated and logged but no effect

When switched on:

• ALL schedules will get phased within a 60s delay
• Schedules with a non-null window will get phased within that window

TODO:

• coordinate with @ericallam on feat(webapp): hosted webhook ingress, delivery pipeline, and dashboard #4344 before merging

[changeset-bot]

⚠️ No Changeset found

Latest commit: d78ed00

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The change adds schedule windows with duration and percentage formats, validation, persistence, and API presentation. The schedule engine now calculates nominal and effective schedule times, derives deterministic phases, and propagates both timestamps through scheduling and triggering. Task runs now store nullable queue timestamps in ClickHouse. Queue handling records queue wait time and prevents fast-path delivery for future messages. Tests cover schedule timing, recovery, queue timestamps, and future queue eligibility.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 19.05% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check	⚠️ Warning	The description explains the implementation and rollout behavior but omits the required checklist, testing, changelog, screenshots, and issue reference.	Add the required template sections, include the issue reference, complete the checklist, and document testing, changelog details, and screenshots or their absence.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: backend support for cron window spreading.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/cron-windows

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@beb6074

trigger.dev

npm i https://pkg.pr.new/trigger.dev@beb6074

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@beb6074

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@beb6074

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@beb6074

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@beb6074

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@beb6074

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@beb6074

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@beb6074

commit: beb6074

[github-actions]

Observability map

As of d78ed00.

19/100 over 417 measured of 433 entry points (base 18, up 1)

What this PR changed

route	base	head	now failing
/api/v1/dashboard-agent/eval-policy (suppressed: request-context)	new	0
/_app/orgs/new	0	50

FIX FIRST

• /api/v1/projects/:projectRef/envvars (sensitive) - auth-boundary, request-context
• /auth/sso (sensitive) - auth-boundary, request-context
• /_app/orgs/:organizationSlug/settings/team (sensitive) - error-classification, auth-scope, request-context

AUDIT 3 of 50 sensitive mutations record an actor. 47 without one.
CONTEXT 14 of 417 entry points name a tenant on a failure path. 325 appear only here, 39 of them sensitive, in the JSON rather than the fix list.

What the score is made of

CHECKS
  error-classification  171 applicable,  96 pass,   0 sole, global without it 10
  auth-boundary          62 applicable,  57 pass,   0 sole, global without it 15
  auth-scope             19 applicable,  17 pass,   0 sole, global without it 18
  request-context       417 applicable,  14 pass, 224 sole, global without it 64
  audit-trail            50 applicable,   3 pass,   0 sole, not in the score

The score and findings here are report-only and never gate the merge. Separately, a required test suite keeps this tool's symbol and route lists in sync with the code they name, and can fail a pull request that renames or removes a symbol they reference, or that adds the first route with a segment they anticipate. Each failure names the list to edit. The rules and their reasons: internal-packages/observability-map/README.md.

[devin-ai-integration]

Devin Review found 1 new potential issue.