Reject malformed task schedules before database and scheduler calls
Malformed supplied task schedules currently pass validation, allowing creation to save a task before the provider rejects the schedule. Validate in the shared REST/MCP/persistence schemas so rejection occurs before database or scheduler calls, retaining the existing HTTP validation envelope and optional patch behavior.
Use maintained pinned cron-parser 5.10.2 with a field-specific provider-compatibility boundary: reject misplaced names/tokens and unsupported new syntax; preserve existing aliases, names, L/# forms and overlapping numeric/name/range/step lists. Deduplication is temporary validation only: stored and provider-bound expressions remain unchanged. A retained 420-case v4 comparison agrees for the tested cases, without claiming universal provider equivalence.
This is only the cron-validation slice of original #291. Existing auth, account ownership, plan/cadence interpretation, timezone, workers and jobs remain unchanged. Other create failures after insertion and existing stored schedules remain outside scope. No live schedule, provider job, paid operation or database change was performed.
Corrected head 7e0a3a0797d4856fe15f58443e214e6c24405b16: 474 focused tests/60 files pass; dedicated OAuth fixtures 247 passed, two skipped; lint and formatting pass. Whole-project TypeScript has 207 remaining existing diagnostics with zero added (four previous missing-UI setup diagnostics resolved after the complete workspace install/build). Wrong-field regressions test actual HTTP validators/direct functions before effects, and supported overlapping lists reach mocked persistence/scheduler calls unchanged.
Release status: HOLD for Records final acceptance. The initial compatibility findings were reproduced and corrected; prior green CI and the initial review do not clear this hold. Seven-file scope retained, with only helper/tests/verification-note changes in the correction.
Rebased onto actual main e47d32e6051150d6af45c6f5df25bade0cba8891, preserving #1101 contract fixtures. Feature range-diff unchanged; fresh focused/lint/TypeScript checks as above. Dedicated OAuth evidence is from the preceding identical-feature corrected head; fresh exact-head CI now passes; Records correction/base/delta final acceptance remains pending.
Fresh exact-head CI run 39708781631: 7,363 tests passed, 15 skipped; required test/lint/format/compatibility and preview checks passed, including response-contract type check. Records Spec re-review reports zero findings and closes both previous issues. Standards/final acceptance remains pending; this is not merge or deployment authorization.