refactor(errors): represent domain failures as Schema.TaggedError

[FreshlyBrewedCode]

Part of #32 · Closes #34

server/scheduler.ts decided whether a missed cron window reads as skipped-concurrency or
fire-failed by instanceof-checking a caught unknown against ConcurrencyLimitError. That is
a semantic decision resting on an untyped catch: a future error type thrown from the same path
would silently land in the wrong bucket, and a suppressed window would look like a failed one.
Schema.TaggedError is already used twice in the codebase (SchedulerError,
AgentStepChunkError), so this finishes that pattern for the daemon's four domain failures rather
than introducing a new one.

What changed

• ConcurrencyLimitError, DispatchCapError, DedupeKeyError (src/lib/dedupe.ts), and
  RunCancelledSignal (src/runtime/run.ts) are Schema.TaggedError classes instead of thrown
  Error subclasses. Each keeps its existing data: DedupeKeyError keeps key and
  holderRunId; ConcurrencyLimitError carries maxConcurrentRuns as a real field instead of
  only baking it into the message string; DispatchCapError keeps its formatted message as an
  explicit field; RunCancelledSignal stays field-less.
• server/scheduler.ts's skip-vs-fail catch in tickOnce is now genuinely exhaustive and
  compiler-checked: an instanceof-narrowed ScheduleFireError union (the four domain classes,
  value-imported) feeds a switch over the resulting literal _tag type, whose default arm is a
  satisfies never check — a tag added to the union without a matching case fails to typecheck
  rather than silently dropping the schedule's result. Anything outside the union (a non-Error
  throw, or a genuinely unrecognized future error) still produces exactly one fire-failed entry,
  never zero.
• ConcurrencyLimitError and DedupeKeyError now carry an overridden message getter, the same
  pattern DispatchCapError already used for its field — the collision/limit strings are written
  once, on the class, instead of being hand-duplicated at every catch site.
  domainErrorMessage() in runtime/run.ts collapses to the generic Error fallback now that all
  three domain errors format their own message; every call site (http.ts's three 409 handlers,
  run.ts) reads err.message instead of rebuilding the string inline. Output is verified
  byte-for-byte identical to the strings it replaces.
• Single-tag call sites (ready-sweep.ts, run.ts, http.ts) use instanceof DedupeKeyError /
  instanceof RunCancelledSignal instead of the _tag-cast pattern — only the scheduler's
  multi-tag exhaustive match needs to dispatch on _tag. http.ts no longer mixes both styles in
  the same catch block.
• sample/workflows/ready-sweep.ts regained the comment explaining why a dedupe collision
  continues the loop instead of aborting it, dropped in an earlier pass.
• Tests: construction/field/_tag coverage for all four errors and a scheduler test per known
  outcome (skipped-concurrency, fire-failed for DedupeKeyError and DispatchCapError), plus
  a new regression test that throws an error whose _tag the switch doesn't recognize and asserts
  it lands in fire-failed with exactly one result entry — the case the earlier version of this
  branch silently dropped.

Notes for reviewers

• The scheduler's exhaustiveness is enforced two ways: the switch lists all four known tags by
  name, and the default arm does return err satisfies never, which only typechecks once every
  member of ScheduleFireError has a preceding case. If a fifth tagged error is ever added to
  the union without a case, this fails to compile instead of reproducing the original bug.
• HTTP 409 response bodies (error, dedupeKey, holderRunId fields and status code) are
  byte-for-byte unchanged from a client's perspective — checked by comparing the literal template
  strings the getters replaced, character for character, and confirmed by the existing http.test.ts
  assertions on dedupeKey/holderRunId/error continuing to pass unmodified.
• RunCancelledSignal is still only checked in two places in runtime/run.ts (a re-throw guard in
  the write-back catch, and the terminal catch that emits RunCancelled), matching the pre-existing
  structure.

Verification

• bun run check (format:check + lint + typecheck + bun test) passes: 293 tests across 35
  files, 0 failures.
• Manually instantiated ConcurrencyLimitError/DedupeKeyError and diffed .message against the
  literal strings previously hand-written at each call site — identical.
• Did not additionally run bun run test:e2e.

Stack

1. refactor(cli): replace hand-rolled parsers with effect/unstable/cli #52 — 33-parse-cli-with-effect-cli (issue Parse CLI arguments with effect/unstable/cli #33)
2. refactor(errors): represent domain failures as Schema.TaggedError #53 — 34-domain-errors-as-tagged-errors (issue Represent domain failures as Schema.TaggedError #34) ← you are here
3. refactor(runtime): move chunk interpretation into the agent adapter #54 — 35-move-chunk-interpretation-into-adapter (issue Move chunk interpretation into the agent adapter #35)
4. refactor(runtime): move headless permission setup into the agent adapter #55 — 37-move-headless-permissions (issue Move headless permission setup out of the workspace allocator #37)
5. feat(runtime): add Effect composition root and agent runtime service #56 — 36-agent-runtime-service (issue Add an Effect composition root and make the agent runtime a service #36)
6. refactor(daemon): move singletons into per-daemon layers #57 — 38-move-singletons-into-layers (issue Move the daemon's remaining singletons into layers #38)

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}