c7a5de7d6e
pause_job already sets enabled=false atomically with state/paused_at, but get_due_jobs only checked enabled — so a contradictory record (enabled=true + paused_at/state=paused) still fired. That was the 07-30 outage failure mode: list looked frozen, fleet kept merging. - is_job_runnable / effective_job_state: pause markers gate fire; display derives from the scheduler-honoured enabled flag so half-paused never renders as [paused] - get_due_jobs self-heals enabled=false + logs error on contradiction - claim_job_for_fire uses is_job_runnable (paused_at counts too) - list/format paths use effective_job_state - behavioural tests: pause blocks due fire; half-pause self-disables