@inetafrica/open-claudia 3.0.3 → 3.0.5

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## v3.0.5 — the conflict handler owns the poll
+
+- **Hiccup heals no longer fight the 409 backoff.** During a 409 conflict streak the conflict handler pauses polling and retries on its own schedule — but a network hiccup (`ECONNRESET`) arriving mid-streak would schedule its own heal, which called `startPolling` straight back into the conflict and reset the streak clock. This was the live v2.15 burn mechanism: its own ghost long-poll after an ECONNRESET heal raised a 409, the old code exited on any 409, launchd respawned it (~1/hr, 208 lifetime startups), and every restart busted the prompt cache so the next turn re-billed the whole accumulated window uncached. Hiccup handling is now a no-op while a conflict streak is active — the conflict handler owns the poll lifecycle.
+- **The 10-minute wedge backstop stands down during a conflict.** A conflict streak looks exactly like a wedge (no updates flowing), so the backstop could `exit(1)` mid-streak — the one remaining path where a token fight still killed the lock-holding bot (2 wedge-exits observed in the field). The backstop now skips while a conflict is active; a genuine >10-min wedge with no conflict still exits for a clean restart.
+- **Investigated and cleared:** the v3 "token doubling" report was fully root-caused. Per-turn recall injection measured at parity (~4k tokens, 3 packs) across v2.15-classic, v2.15-discoverer, and v3-discoverer; the 160k→347k warning was the v3.0.0 cumulative-vs-peak display bug already fixed in v3.0.2; real spend was flat across the upgrade. The discoverer walker is identical in v2 and v3 (same haiku model via tier "low", same ~$0.015/turn) and stays on by default.
+- **Agent-space / OpenClaw:** no new deps, no new env, no schema change; Docker image builds identically. New hermetic test `test-telegram-conflict-heal-guard.js` (wired into `npm test`) proves all four paths: hiccup no-op during conflict, hiccup still heals without conflict, backstop skipped during conflict, genuine wedge still exits.
+
+## v3.0.4 — surviving the second mount, keeping the crons
+
+- **A Kubernetes PVC remount no longer crashloops the bot.** The migration snapshot validator demanded exact owner-only modes (`0700` dirs, `0600` files). But kubelet's fsGroup ownership pass ORs group `rwX` + setgid onto every file and directory each time the volume is mounted — so the first v3 boot passed (snapshot created after the mount), and the **second pod recreation** hit `INVALID_MIGRATION_SNAPSHOT: migration snapshot has unsafe permissions` at boot and went CrashLoopBackOff. Every v3 pod on an fsGroup-mounted PVC was one recreation away from this (euvy hit it live on 2026-07-12 and needed a manual chmod rescue). Validation now rejects only world-access bits — group access is the pod's own supplemental group, not an exposure — while snapshots are still *created* `0700`/`0600`.
+- **Legacy crons adopt your saved defaults instead of dying in the archive.** Pre-provider-aware jobs carried no pinned provider or project — they fired with whatever the bot had active — so the v3 migration classified every one of them "no unambiguous project" and archive-disabled it, silently killing real production crons (euvy's 6-hourly Airbyte data-sync among them). The jobs migration now looks up the owning user's saved state (`settings.backend` and `currentSession` name/dir, in both the v3 `users` shape and the pre-v3 global shape), adopts those as the job's provider/project, and marks the record `legacyDefaultsApplied` — preserving the old fire-time behaviour instead of erasing it. Jobs pinned to a removed provider (Cursor) keep their pin, stay archived, and are never reassigned; a job whose owner has no saved defaults still archives safely.
+- **Re-reading the jobs store no longer rewrites stored nulls.** `Number(null)` is `0`, so the re-migration pass that runs on every read flipped `nextAttemptAt`/`lastFireAt` from `null` to epoch-`0` — harmless at runtime but a silent mutation on every load. Migration output is now byte-stable across passes.
+- **Agent-space / OpenClaw:** no new deps, no new env, no schema change; Docker image builds identically. New hermetic probes: fsGroup-mode tolerance (group bits pass, world bits still refused) in `test-provider-migration-backup.js`; legacy-defaults adoption, v2/v3 state shapes, Cursor guard, and migration idempotency in `test-provider-scheduler.js`.
+
 ## v3.0.3 — the lock-holder stands its ground
 
 - **A persistent 409 no longer restarts the bot.** v3.0.1 taught the poller to ride out short 409 conflicts but still `exit(1)` once a conflict outlived 2 minutes, on the theory that the survivor had to be a real second instance. In practice the rogue poller is lock-blind — a debugger-run dev checkout, a copy on another config dir, or another host on the same token — so the exit killed the *legitimate*, lock-holding service and launchd respawned it straight back into the same fight (five boot→409→exit cycles on 2026-07-12). The poller now never exits over a 409: it pauses 15s per retry, slows to 60s once the streak passes 2 minutes, sends the owner a throttled Telegram alert (max one per hour) naming the likely culprits, and posts an all-clear once the rogue goes away.

package/channels/telegram/adapter.js

@@ -99,6 +99,11 @@ class TelegramAdapter {
   // old exit-for-relaunch *was* the restart the bot kept doing on every idle
   // timeout (a sleep/wake burst could exhaust all 6 attempts in seconds).
   _onPollingHiccup(msg) {
+    // During a 409 streak the conflict handler owns the poll lifecycle; a heal
+    // here would startPolling straight back into the conflict and its errors
+    // would keep _wedgedSince pinned until the 10-min backstop killed us (the
+    // two wedge-exits of 2026-07-12 during the v3 upgrade handoff).
+    if (this._conflictTimer || this._conflictSince) return;
     const now = Date.now();
     if (!this._wedgedSince) this._wedgedSince = now;
     if (now - this._lastHiccupLog > 60000) {
@@ -117,7 +122,10 @@ class TelegramAdapter {
     // restart-in-place won't fix it — exit for a clean launchd relaunch. On a
     // healthy network this never fires (heals recover in seconds); it replaces
     // the old hair-trigger ~90s exit that caused the restart storm.
-    if (this._wedgedSince && Date.now() - this._wedgedSince > 600000) {
+    if (this._wedgedSince && !this._conflictSince && Date.now() - this._wedgedSince > 600000) {
+      // Never fires during a 409 streak: that's a token fight, not a network
+      // wedge, and exiting busts the prompt cache (full uncached re-bill of the
+      // conversation window on the next turn).
       console.error("Polling wedged >10min — exiting for a clean restart.");
       process.exit(1);
     }

package/core/jobs.js

@@ -46,6 +46,14 @@ function clone(value) {
   return value === undefined ? undefined : structuredClone(value);
 }
 
+// Number(null) is 0, so a bare Number.isFinite gate rewrites stored nulls to
+// epoch timestamps on every re-migration pass.
+function finiteTimeOrNull(value) {
+  if (value === null || value === undefined) return null;
+  const number = Number(value);
+  return Number.isFinite(number) ? number : null;
+}
+
 function occurrenceId(job, options = {}) {
   if (nonEmpty(job.occurrenceId)) return nonEmpty(job.occurrenceId);
   const factory = options.occurrenceIdFactory || (() => (
@@ -155,9 +163,9 @@ function normalizeRunnableJob(record, options = {}) {
     disabled,
     attemptCount,
     maxAttempts,
-    nextAttemptAt: Number.isFinite(Number(record.nextAttemptAt)) ? Number(record.nextAttemptAt) : null,
+    nextAttemptAt: finiteTimeOrNull(record.nextAttemptAt),
     createdAt,
-    lastFireAt: Number.isFinite(Number(record.lastFireAt)) ? Number(record.lastFireAt) : null,
+    lastFireAt: finiteTimeOrNull(record.lastFireAt),
     lastFireOk: typeof record.lastFireOk === "boolean" ? record.lastFireOk : null,
     lastError: isRecord(record.lastError) ? clone(record.lastError) : null,
   };
@@ -169,6 +177,66 @@ function normalizeRunnableJob(record, options = {}) {
   return normalized;
 }
 
+function readLegacyStateUsers(options = {}) {
+  if (options._legacyStateUsers !== undefined) return options._legacyStateUsers;
+  let users = null;
+  try {
+    if (!options.stateFile) throw new Error("no state file wired");
+    const raw = JSON.parse(fs.readFileSync(options.stateFile, "utf8"));
+    if (isRecord(raw)) {
+      // v3 state is { schemaVersion, users: { "<canonicalUserId>": {...} } };
+      // the pre-v3 file was one global user state at the top level.
+      users = isRecord(raw.users) ? raw.users : { "": raw };
+    }
+  } catch (_) {}
+  options._legacyStateUsers = users;
+  return users;
+}
+
+function legacyStateDefaultsFor(record, options = {}) {
+  const users = readLegacyStateUsers(options);
+  if (!users) return null;
+  const canonicalUserId = nonEmpty(record.canonicalUserId) || nonEmpty(options.defaultCanonicalUserId);
+  const user = (canonicalUserId && isRecord(users[canonicalUserId]) ? users[canonicalUserId] : null)
+    || (isRecord(users[""]) ? users[""] : null);
+  if (!user) return null;
+  const provider = nonEmpty(user.settings?.backend)?.toLowerCase() || null;
+  const session = isRecord(user.currentSession) ? user.currentSession : {};
+  return {
+    provider: provider && RUNNABLE_PROVIDERS.has(provider) ? provider : null,
+    project: nonEmpty(session.name),
+    projectDir: nonEmpty(session.dir),
+  };
+}
+
+// Pre-provider-aware jobs fired with whatever provider and project the bot had
+// active at fire time. Adopting the owning user's saved defaults preserves
+// that behaviour instead of archive-disabling every legacy cron. Jobs pinned
+// to a removed provider (Cursor) keep their pin and still archive.
+function applyLegacyDefaults(record, options = {}) {
+  if (!isRecord(record)) return record;
+  const provider = legacyProvider(record);
+  if (provider === "cursor") return record;
+  const hasProvider = !!provider;
+  const hasProject = !!nonEmpty(record.project);
+  if (hasProvider && hasProject) return record;
+  const defaults = legacyStateDefaultsFor(record, options);
+  if (!defaults) return record;
+  const next = clone(record);
+  let applied = false;
+  if (!hasProvider && defaults.provider) {
+    next.provider = defaults.provider;
+    applied = true;
+  }
+  if (!hasProject && defaults.project) {
+    next.project = defaults.project;
+    if (!nonEmpty(next.projectDir) && defaults.projectDir) next.projectDir = defaults.projectDir;
+    applied = true;
+  }
+  if (applied) next.legacyDefaultsApplied = true;
+  return next;
+}
+
 function migrationReason(record, options = {}) {
   const provider = legacyProvider(record);
   if (provider === "cursor") return "Pinned to removed provider Cursor Agent";
@@ -194,16 +262,18 @@ function normalizeArchived(record, options = {}) {
 }
 
 function migrateJobsDocument(raw, options = {}) {
-  const source = isRecord(raw) && raw.schemaVersion === JOBS_SCHEMA_VERSION
-    ? raw
-    : { jobs: Array.isArray(raw) ? raw : [], archived: [] };
+  const legacySource = !(isRecord(raw) && raw.schemaVersion === JOBS_SCHEMA_VERSION);
+  const source = legacySource
+    ? { jobs: Array.isArray(raw) ? raw : [], archived: [] }
+    : raw;
   const jobs = [];
   const archived = [];
 
   for (const record of Array.isArray(source.jobs) ? source.jobs : []) {
-    const normalized = normalizeRunnableJob(record, options);
+    const candidate = legacySource ? applyLegacyDefaults(record, options) : record;
+    const normalized = normalizeRunnableJob(candidate, options);
     if (normalized) jobs.push(normalized);
-    else archived.push(archiveLegacyJob(record, migrationReason(record, options), options));
+    else archived.push(archiveLegacyJob(candidate, migrationReason(candidate, options), options));
   }
   for (const record of Array.isArray(source.archived) ? source.archived : []) {
     const normalized = normalizeArchived(record, options);
@@ -281,6 +351,7 @@ function createJobsStore(options = {}) {
     defaultChannelId: defaults.channelId,
     defaultAdapter: defaults.adapter,
     defaultAdapterType: defaults.adapterType,
+    stateFile: options.stateFile || path.join(configDir, path.basename(STATE_FILE)),
     now: options.now,
     occurrenceIdFactory: options.occurrenceIdFactory,
   });

package/core/migration-backup.js

@@ -107,8 +107,13 @@ function assertRegularFile(filePath, code, label) {
   return stat;
 }
 
-function assertPrivateMode(stat, expectedMask, code, label) {
-  if (process.platform !== "win32" && (stat.mode & 0o777) !== expectedMask) {
+function assertPrivateMode(stat, code, label) {
+  // Kubernetes fsGroup ownership management ORs group rw(x) + setgid onto
+  // every file and directory each time the volume is mounted, so an exact
+  // owner-only mode check crashloops the second boot on any fsGroup-mounted
+  // PVC. Group access is the pod's own supplemental group; only world access
+  // is a real exposure.
+  if (process.platform !== "win32" && (stat.mode & 0o007) !== 0) {
     throw migrationError(code, `${label} has unsafe permissions`);
   }
 }
@@ -596,18 +601,18 @@ function validateMigrationSnapshot(snapshotDir, options = {}) {
   if (!snapshotStat.isDirectory() || snapshotStat.isSymbolicLink()) {
     throw migrationError("INVALID_MIGRATION_SNAPSHOT", "migration snapshot must be a real directory");
   }
-  assertPrivateMode(snapshotStat, 0o700, "INVALID_MIGRATION_SNAPSHOT", "migration snapshot");
+  assertPrivateMode(snapshotStat, "INVALID_MIGRATION_SNAPSHOT", "migration snapshot");
   const originalsStat = fs.lstatSync(path.join(resolvedSnapshot, "originals"));
   if (!originalsStat.isDirectory() || originalsStat.isSymbolicLink()) {
     throw migrationError("INVALID_MIGRATION_SNAPSHOT", "migration originals directory is invalid");
   }
-  assertPrivateMode(originalsStat, 0o700, "INVALID_MIGRATION_SNAPSHOT", "migration originals directory");
+  assertPrivateMode(originalsStat, "INVALID_MIGRATION_SNAPSHOT", "migration originals directory");
   const manifestPath = path.join(resolvedSnapshot, MANIFEST_FILE);
   const hashPath = path.join(resolvedSnapshot, MANIFEST_HASH_FILE);
   const manifestStat = assertRegularFile(manifestPath, "INVALID_MIGRATION_MANIFEST", "migration manifest");
   const manifestHashStat = assertRegularFile(hashPath, "INVALID_MIGRATION_MANIFEST", "migration manifest checksum");
-  assertPrivateMode(manifestStat, 0o600, "INVALID_MIGRATION_MANIFEST", "migration manifest");
-  assertPrivateMode(manifestHashStat, 0o600, "INVALID_MIGRATION_MANIFEST", "migration manifest checksum");
+  assertPrivateMode(manifestStat, "INVALID_MIGRATION_MANIFEST", "migration manifest");
+  assertPrivateMode(manifestHashStat, "INVALID_MIGRATION_MANIFEST", "migration manifest checksum");
   const manifestBytes = fs.readFileSync(manifestPath);
   const expectedManifestHash = fs.readFileSync(hashPath, "utf8").trim();
   if (!/^[a-f0-9]{64}$/.test(expectedManifestHash) || sha256(manifestBytes) !== expectedManifestHash) {
@@ -625,7 +630,7 @@ function validateMigrationSnapshot(snapshotDir, options = {}) {
     }
     if (!fs.existsSync(filePath)) throw migrationError("BACKUP_CHECKSUM_MISMATCH", `backup file is missing: ${entry.path}`);
     const stat = assertRegularFile(filePath, "BACKUP_CHECKSUM_MISMATCH", `backup file ${entry.path}`);
-    assertPrivateMode(stat, 0o600, "BACKUP_CHECKSUM_MISMATCH", `backup file ${entry.path}`);
+    assertPrivateMode(stat, "BACKUP_CHECKSUM_MISMATCH", `backup file ${entry.path}`);
     const bytes = fs.readFileSync(filePath);
     if (stat.size !== entry.size || bytes.length !== entry.size || sha256(bytes) !== entry.sha256) {
       throw migrationError("BACKUP_CHECKSUM_MISMATCH", `backup checksum verification failed: ${entry.path}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.0.3",
+  "version": "3.0.5",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {
@@ -10,7 +10,7 @@
     "setup": "node setup.js",
     "start": "node bot.js",
     "pretest": "node test-provider-fixture.js && node test-provider-core-prompt.js && node test-provider-prompt-parity.js && node test-provider-env-isolation.js && node test-provider-resume-parity.js && node test-provider-bootstrap.js && node test-provider-registry.js && node test-provider-stream-decoder.js && node test-provider-events.js && node test-provider-claude.js && node test-provider-codex.js && node test-provider-runner.js && node test-provider-run-lifecycle.js && node test-provider-gateway.js && node test-provider-side-chat.js && node test-single-runtime.js && node test-provider-migration-backup.js && node test-provider-state-migration.js && node test-provider-session-history.js && node test-provider-session-commands.js && node test-provider-compaction.js && node test-provider-scheduler.js && node test-cursor-removal.js && node test-utility-provider-policy.js && node test-provider-subagent.js && node test-provider-recall.js && node test-provider-pack-review.js && node test-memory-mutation-queue.js && node test-provider-dream.js && node test-provider-enforcer.js && node test-provider-tool-hooks.js && node test-provider-boot-matrix.js && node test-provider-capabilities.js && node test-provider-language.js && node test-provider-coupling-audit.js && node test-provider-parity-e2e.js",
-    "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-unified-identity.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-queue-routing.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-packs.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-speaker-persona.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-pipeline.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-relationship-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-relationship.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-enforcer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-identity-prune.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-kazee-message-id.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-delivery-contract.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-run-lock.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-web-sessions.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-poll-recovery.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-409-grace.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-single-instance.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-streaming-split.js"
+    "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-unified-identity.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-queue-routing.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-packs.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-speaker-persona.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-persona-pipeline.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-recall-relationship-gate.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-relationship.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-enforcer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-identity-prune.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-kazee-message-id.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-delivery-contract.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-run-lock.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-web-sessions.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-poll-recovery.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-409-grace.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-telegram-conflict-heal-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-single-instance.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=./test-fixtures/fake-agent-cli.js FAKE_AGENT_KIND=claude AGENT_ENV_PASSTHROUGH=FAKE_AGENT_KIND node test-streaming-split.js"
   },
   "files": [
     "bot.js",

package/test-provider-dream.js

@@ -124,6 +124,9 @@ async function providerProbe(kind) {
   const { createUtilityAgentService } = require("./core/utility-agent");
   const utility = createUtilityAgentService({
     registry: registryFor(provider),
+    // This probe models a global/nightly dream with no active chat. Do not let
+    // the parent Open Claudia process's OC_PROVIDER leak into provider choice.
+    activeProvider: () => null,
     env: {
       UTILITY_PROVIDER: "active",
       DEFAULT_PROVIDER: kind,

package/test-provider-language.js

@@ -32,10 +32,11 @@ assert.doesNotMatch(setup, /Your Claude Code bot is connected|Description=Claude
 
 const pkg = JSON.parse(read("package.json"));
 assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
-// 3.0.3 approved by Sumeet 2026-07-12 ("Yes please" to patching the double-
-// poller bug as v3.0.3 — atomic single-instance lock, 409 handler never exits
-// while holding the lock, throttled owner alert; CHANGELOG documents it).
-assert.strictEqual(pkg.version, "3.0.3", "release version must remain unchanged without explicit approval");
+// 3.0.5 approved by Sumeet 2026-07-12 ("no do it on the latest co0de and push
+// a new version" — 409-conflict/heal/wedge guards so a token fight never
+// restarts the bot and busts the prompt cache; walker stays on per his call
+// that v2's walker was fine and v3's is identical).
+assert.strictEqual(pkg.version, "3.0.5", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }

package/test-provider-migration-backup.js

@@ -378,6 +378,54 @@ function sourceChangeProbe() {
   }
 }
 
+function fsGroupToleranceProbe() {
+  if (process.platform === "win32") return;
+  const root = tempRoot("fsgroup");
+  try {
+    const configDir = installFixture("claude-only", root);
+    const opts = options(configDir);
+    const snapshot = ensureMigrationSnapshot(opts);
+
+    // Simulate the kubelet fsGroup ownership pass: group rwX + setgid ORed
+    // onto every directory and group rw onto every file at each pod mount.
+    const applyFsGroup = (target) => {
+      const stat = fs.lstatSync(target);
+      if (stat.isDirectory()) {
+        fs.chmodSync(target, (stat.mode & 0o777) | 0o2070);
+        for (const entry of fs.readdirSync(target)) applyFsGroup(path.join(target, entry));
+      } else {
+        fs.chmodSync(target, (stat.mode & 0o777) | 0o060);
+      }
+    };
+    applyFsGroup(snapshot.snapshotDir);
+    // chmod may silently drop setgid for non-members of the dir group, so
+    // assert only the group bits — the part every fsGroup mount guarantees.
+    assert.strictEqual(fs.statSync(snapshot.snapshotDir).mode & 0o770, 0o770);
+
+    const validated = validateMigrationSnapshot(snapshot.snapshotDir, { sources: opts.sources, verifySources: true });
+    assert.strictEqual(validated.ok, true, "group bits from a k8s fsGroup mount must not invalidate the snapshot");
+    const reused = ensureMigrationSnapshot(opts);
+    assert.strictEqual(reused.reused, true, "fsGroup-touched snapshot is reused at boot, not rejected");
+
+    fs.chmodSync(manifestFile(snapshot.snapshotDir), 0o664);
+    assert.throws(
+      () => validateMigrationSnapshot(snapshot.snapshotDir),
+      (error) => error.code === "INVALID_MIGRATION_MANIFEST" && /unsafe permissions/.test(error.message),
+      "world-readable manifest must still be rejected",
+    );
+    fs.chmodSync(manifestFile(snapshot.snapshotDir), 0o660);
+
+    fs.chmodSync(snapshot.snapshotDir, 0o2775);
+    assert.throws(
+      () => validateMigrationSnapshot(snapshot.snapshotDir),
+      (error) => error.code === "INVALID_MIGRATION_SNAPSHOT" && /unsafe permissions/.test(error.message),
+      "world-accessible snapshot dir must still be rejected",
+    );
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
 function integrationAndDocsProbe() {
   const bot = fs.readFileSync(path.join(__dirname, "bot.js"), "utf8");
   const scheduler = fs.readFileSync(path.join(__dirname, "core", "scheduler.js"), "utf8");
@@ -420,5 +468,6 @@ activationProbe();
 rollbackProbe();
 sourceChangeProbe();
 rawByteProbe();
+fsGroupToleranceProbe();
 integrationAndDocsProbe();
 console.log("provider migration backup OK");

package/test-provider-scheduler.js

@@ -84,6 +84,90 @@ function migrationProbe(jobsApi) {
   assert.deepStrictEqual(rerun, cursor, "jobs migration must be idempotent");
 }
 
+function legacyDefaultsProbe(jobsApi) {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "open-claudia-legacy-defaults-"));
+  try {
+    const baseDefaults = {
+      defaultCanonicalUserId: "telegram:fixture",
+      defaultChannelId: "fixture-channel",
+      defaultAdapter: "telegram-fixture",
+      defaultAdapterType: "telegram",
+      now: () => 1_720_000_000_000,
+      occurrenceIdFactory: (job) => `occ-${job.id}`,
+    };
+    const legacyCron = {
+      id: "legacy-orphan-cron",
+      kind: "cron",
+      schedule: "0 */6 * * *",
+      prompt: "run the production sync",
+      canonicalUserId: "telegram:100",
+      channelId: "chan-100",
+      adapter: "telegram-fixture",
+      adapterType: "telegram",
+    };
+
+    const v3State = path.join(temp, "state-v3.json");
+    fs.writeFileSync(v3State, JSON.stringify({
+      schemaVersion: 3,
+      users: {
+        "telegram:100": {
+          settings: { backend: "codex" },
+          currentSession: { name: "data-sync-runner", dir: "/workspace/data-sync-runner" },
+        },
+      },
+    }));
+    const adopted = jobsApi.migrateJobsDocument([{ ...legacyCron }], { ...baseDefaults, stateFile: v3State });
+    assert.deepStrictEqual(adopted.archived, [], "legacy cron with saved user defaults must stay runnable");
+    assert.strictEqual(adopted.jobs.length, 1);
+    assert.strictEqual(adopted.jobs[0].provider, "codex");
+    assert.strictEqual(adopted.jobs[0].project, "data-sync-runner");
+    assert.strictEqual(adopted.jobs[0].projectDir, "/workspace/data-sync-runner");
+    assert.strictEqual(adopted.jobs[0].legacyDefaultsApplied, true);
+    assert.strictEqual(adopted.jobs[0].disabled, false);
+
+    const rerun = jobsApi.migrateJobsDocument(adopted, { ...baseDefaults, stateFile: v3State });
+    assert.deepStrictEqual(rerun, adopted, "legacy defaults adoption must be idempotent");
+
+    const pinned = jobsApi.migrateJobsDocument(
+      [{ ...legacyCron, id: "legacy-provider-pinned", provider: "claude" }],
+      { ...baseDefaults, stateFile: v3State },
+    );
+    assert.strictEqual(pinned.jobs[0].provider, "claude", "explicit legacy provider must win over the saved default");
+    assert.strictEqual(pinned.jobs[0].project, "data-sync-runner");
+    assert.strictEqual(pinned.jobs[0].legacyDefaultsApplied, true);
+
+    const v2State = path.join(temp, "state-v2.json");
+    fs.writeFileSync(v2State, JSON.stringify({
+      settings: { backend: "claude" },
+      currentSession: { name: "alpha", dir: "/workspace/alpha" },
+    }));
+    const globalShape = jobsApi.migrateJobsDocument([{ ...legacyCron }], { ...baseDefaults, stateFile: v2State });
+    assert.strictEqual(globalShape.jobs.length, 1, "pre-v3 global state shape must supply defaults");
+    assert.strictEqual(globalShape.jobs[0].provider, "claude");
+    assert.strictEqual(globalShape.jobs[0].project, "alpha");
+    assert.strictEqual(globalShape.jobs[0].legacyDefaultsApplied, true);
+
+    const cursor = jobsApi.migrateJobsDocument(
+      [{ ...legacyCron, id: "legacy-cursor-cron", sessionKey: "cursorSessionId" }],
+      { ...baseDefaults, stateFile: v3State },
+    );
+    assert.deepStrictEqual(cursor.jobs, [], "Cursor-pinned jobs must not adopt defaults");
+    assert.strictEqual(cursor.archived[0].provider, "cursor");
+    assert.strictEqual(cursor.archived[0].project, null, "archived Cursor evidence must stay pristine");
+    assert.ok(!cursor.archived[0].legacyDefaultsApplied);
+    assert.match(cursor.archived[0].archiveReason, /removed provider/i);
+
+    const noState = jobsApi.migrateJobsDocument(
+      [{ ...legacyCron }],
+      { ...baseDefaults, stateFile: path.join(temp, "missing.json") },
+    );
+    assert.deepStrictEqual(noState.jobs, [], "without saved defaults the legacy cron still archives");
+    assert.match(noState.archived[0].archiveReason, /provider/i);
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+}
+
 function migrationIntegrationProbe(jobsApi, migrationApi) {
   const temp = fs.mkdtempSync(path.join(os.tmpdir(), "open-claudia-jobs-migration-"));
   try {
@@ -669,6 +753,7 @@ async function main() {
   assert.strictEqual(typeof schedulerApi.createSchedulerService, "function");
 
   migrationProbe(jobsApi);
+  legacyDefaultsProbe(jobsApi);
   migrationIntegrationProbe(jobsApi, migrationApi);
   await immutableTerminalProbe(schedulerApi.createSchedulerService);
   await duplicateFireProbe(schedulerApi.createSchedulerService);