scheduled_prompts: address argus 🟡 on #849 — submit paths section + persistence.md anchor fix

docs/approvals.md

@@ -125,6 +125,15 @@ kind-specific payload carrier.
   inbox messages to each target at the scheduled time, recurring
   when `interval_seconds` is set.
 
+### Scheduled prompts (submit paths)
+
+Two ways a row lands in `scheduled_prompts`:
+
+- **Operator-direct** (`source = "operator"`): the operator adds a schedule through the dashboard form. Lands in the table immediately, no approval gate — operator action is already the trust boundary.
+- **Agent-requested** (`source = "approval:<id>"`): a sub-agent (or the manager) submits a `RequestSchedulePrompt` through the manager socket. An `ApprovalKind::SchedulePrompt` row is queued; on approve, hive-c0re inserts the schedule row with `source = approval:<id>` so the audit trail points back at the operator decision (above).
+
+No self-target shortcut: even agent-self schedules need approval. The existing `remind` MCP tool stays the quick self-wake path (no approval, lands directly in the agent's own inbox); this module is the bigger, multi-recipient, operator-visible thing.
+
 ### Scheduled prompt worker (catch-up clamp)
 
 When hive-c0re comes back from being down, the worker sees rows whose `next_fire_at_unix` is well in the past. For recurring rows that would mean firing N delayed pulses in a row — spammy and useless. Instead the worker fires **once** per row and bumps `next_fire_at_unix` to the next interval slot ≥ `now`, recording how many cycles were skipped in `last_result` (per-target). Operators see "fired late, caught up from 17 skipped" instead of 17 wake-up storms.

hive-c0re/src/scheduled_prompts.rs

@@ -4,11 +4,13 @@
 //! `interval_seconds` and re-arm `next_fire_at` on delivery;
 //! one-shots are reaped.
 //!
-//! Schema + retention: `docs/persistence.md::scheduled_prompts /
-//! scheduled_prompt_targets`. Submit paths (operator vs
-//! `ApprovalKind::SchedulePrompt`), catch-up clamp on resume, and
-//! per-target tombstoning semantics: `docs/approvals.md::Scheduled
-//! prompt worker (catch-up clamp)`.
+//! Schema + retention: `docs/persistence.md::/var/lib/hyperhive/broker.sqlite`
+//! (the `scheduled_prompts` / `scheduled_prompt_targets` table bullets).
+//! Submit paths (operator-direct vs `ApprovalKind::SchedulePrompt`,
+//! plus why even agent-self schedules go through approval):
+//! `docs/approvals.md::Scheduled prompts (submit paths)`.
+//! Catch-up clamp on resume + per-target tombstoning:
+//! `docs/approvals.md::Scheduled prompt worker (catch-up clamp)`.
 
 use std::path::Path;
 use std::sync::Mutex;