Reference
Scheduled jobs
What runs on its own, when, and why running one twice is harmless for some and not for others.
Six things run on a schedule. None of them is something you trigger, but knowing when they run answers a class of question that otherwise looks like a bug — chiefly *why has this month’s accrual not appeared yet*.
| Job | When | What it does |
|---|---|---|
| Leave year rollover | Daily, early | Carries unused entitlement into the new year for anybody whose leave year turned, applies the cap, and forfeits the rest |
| Leave accrual | Daily, early | Credits monthly and per-hour entitlement. Runs after rollover, so a new year is opened before it is credited into |
| Document expiry | Daily | Warns about passports, visas, permits and certifications approaching expiry, and about permits reaching a review date |
| Probation | Daily | Warns that a probation period is ending, and says once — the day after — when one has lapsed |
| Notification delivery | Every five minutes | Sends what is queued, retrying failures at widening intervals |
| Signature sync | Every fifteen minutes | Asks the signing provider what has happened to envelopes that are out |
Why two of them are protected and four are not
Accrual must not run twice in a day
The leave ledger is insert-only, so a second run does not overwrite — it double-credits. Rollover has the same shape. Both claim a lock for the day before doing anything, and a second attempt finds it taken and stops. This matters more here than in most products precisely because the ledger cannot be corrected by rewriting it.
Delivery, expiry warnings, probation and signature sync are all idempotent — filing a signed document twice files it once, and a notification already sent is not queued again — so they are free to run as often as is useful.
If one does not run
Nothing is lost. Accrual and rollover work out what should have happened from the dates rather than from having been run, so a missed day is caught up the next time they run. A delayed expiry warning arrives late rather than never. What a long outage costs is timeliness, not correctness.
Each one is an ordinary authenticated HTTP endpoint, driven by a scheduler running alongside the application rather than by anything inside it — so a job that hangs cannot take a request thread with it, and the schedule is visible in one place rather than spread across the code that needs it.