diff --git a/.changeset/cron-tools.md b/.changeset/cron-tools.md
new file mode 100644
index 0000000000..98576443d6
--- /dev/null
+++ b/.changeset/cron-tools.md
@@ -0,0 +1,6 @@
+---
+"@moonshot-ai/agent-core": minor
+"@moonshot-ai/kimi-code": minor
+---
+
+Add session-scoped scheduled prompts so the assistant can register, list, and cancel recurring or one-shot reminders that fire later in the same session.
diff --git a/apps/kimi-code/src/tui/controllers/session-replay.ts b/apps/kimi-code/src/tui/controllers/session-replay.ts
index 106b384bf0..f806cd8145 100644
--- a/apps/kimi-code/src/tui/controllers/session-replay.ts
+++ b/apps/kimi-code/src/tui/controllers/session-replay.ts
@@ -203,6 +203,12 @@ export class SessionReplayRenderer {
     if (message.origin?.kind === 'injection') {
       return;
     }
+    // WHY: cron fires are not user turns (see isReplayUserTurnRecord); skip
+    // visual render and turn advance so the raw <cron-fire ...> envelope never
+    // surfaces in the resumed transcript.
+    if (message.origin?.kind === 'cron_job' || message.origin?.kind === 'cron_missed') {
+      return;
+    }
 
     this.flushAssistant(context);
     const skill = skillActivationFromOrigin(message.origin);
diff --git a/apps/kimi-code/src/tui/utils/message-replay.ts b/apps/kimi-code/src/tui/utils/message-replay.ts
index 510b5769e4..8b83186dd7 100644
--- a/apps/kimi-code/src/tui/utils/message-replay.ts
+++ b/apps/kimi-code/src/tui/utils/message-replay.ts
@@ -246,6 +246,8 @@ function isReplayUserTurnRecord(record: AgentReplayRecord): boolean {
       return message.origin.trigger === 'user-slash';
     case 'background_task':
     case 'compaction_summary':
+    case 'cron_job':
+    case 'cron_missed':
     case 'hook_result':
     case 'injection':
     case 'system_trigger':
diff --git a/apps/kimi-code/test/tui/message-replay.test.ts b/apps/kimi-code/test/tui/message-replay.test.ts
index c4a64fc99c..905fae2adc 100644
--- a/apps/kimi-code/test/tui/message-replay.test.ts
+++ b/apps/kimi-code/test/tui/message-replay.test.ts
@@ -371,6 +371,54 @@ describe('KimiTUI resume message replay', () => {
     ]);
   });
 
+  it('skips cron_job origin records during replay', async () => {
+    const cronFire =
+      '<cron-fire jobId="job-1" cron="*/5 * * * *" recurring="true" coalescedCount="1">\nrun nightly\n</cron-fire>';
+    const driver = await replayIntoDriver([
+      message('user', [{ type: 'text', text: 'real prompt' }]),
+      message('assistant', [{ type: 'text', text: 'real answer' }]),
+      message('user', [{ type: 'text', text: cronFire }], {
+        origin: {
+          kind: 'cron_job',
+          jobId: 'job-1',
+          cron: '*/5 * * * *',
+          recurring: true,
+          coalescedCount: 1,
+          stale: false,
+        },
+      }),
+    ]);
+
+    const transcript = driver.state.transcriptContainer.render(120).join('\n');
+    expect(transcript).not.toContain('<cron-fire');
+    expect(
+      driver.state.transcriptEntries
+        .filter((entry) => entry.kind === 'user')
+        .map((entry) => entry.content),
+    ).toEqual(['real prompt']);
+  });
+
+  it('skips cron_missed origin records during replay', async () => {
+    const cronMissed =
+      '<cron-fire jobId="job-2" missed="true" count="3">\n3 one-shot tasks missed while offline\n</cron-fire>';
+    const driver = await replayIntoDriver([
+      message('user', [{ type: 'text', text: 'real prompt' }]),
+      message('assistant', [{ type: 'text', text: 'real answer' }]),
+      message('user', [{ type: 'text', text: cronMissed }], {
+        origin: { kind: 'cron_missed', count: 3 },
+      }),
+    ]);
+
+    const transcript = driver.state.transcriptContainer.render(120).join('\n');
+    expect(transcript).not.toContain('<cron-fire');
+    expect(transcript).not.toContain('missed while offline');
+    expect(
+      driver.state.transcriptEntries
+        .filter((entry) => entry.kind === 'user')
+        .map((entry) => entry.content),
+    ).toEqual(['real prompt']);
+  });
+
   it('renders user-slash skill activation once without exposing injected prompt text', async () => {
     const activation = message(
       'user',
diff --git a/packages/agent-core/src/agent/context/projector.ts b/packages/agent-core/src/agent/context/projector.ts
index 3b5ac10a7a..d085a791fe 100644
--- a/packages/agent-core/src/agent/context/projector.ts
+++ b/packages/agent-core/src/agent/context/projector.ts
@@ -115,6 +115,7 @@ function isInjectionUserMessage(message: Message): boolean {
   if (trimmed.startsWith('<notification ')) return true;
   if (trimmed.startsWith('<system-reminder>')) return true;
   if (trimmed.startsWith('<hook_result ')) return true;
+  if (trimmed.startsWith('<cron-fire ')) return true;
   return false;
 }
 
diff --git a/packages/agent-core/src/agent/context/types.ts b/packages/agent-core/src/agent/context/types.ts
index b8d0770096..a366fce350 100644
--- a/packages/agent-core/src/agent/context/types.ts
+++ b/packages/agent-core/src/agent/context/types.ts
@@ -42,6 +42,23 @@ export interface BackgroundTaskOrigin {
   readonly notificationId: string;
 }
 
+export interface CronJobOrigin {
+  readonly kind: 'cron_job';
+  readonly jobId: string;
+  readonly cron: string;
+  readonly recurring: boolean;
+  /** Number of theoretical fires that were collapsed into this single delivery (>= 1). */
+  readonly coalescedCount: number;
+  /** True for recurring tasks past the 7-day age threshold. */
+  readonly stale: boolean;
+}
+
+export interface CronMissedOrigin {
+  readonly kind: 'cron_missed';
+  /** Number of one-shot tasks bundled into this missed-fire notification. */
+  readonly count: number;
+}
+
 export interface HookResultOrigin {
   readonly kind: 'hook_result';
   readonly event: string;
@@ -55,6 +72,8 @@ export type PromptOrigin =
   | CompactionSummaryOrigin
   | SystemTriggerOrigin
   | BackgroundTaskOrigin
+  | CronJobOrigin
+  | CronMissedOrigin
   | HookResultOrigin;
 
 export type ContextMessage = Message & {
diff --git a/packages/agent-core/src/agent/cron/index.ts b/packages/agent-core/src/agent/cron/index.ts
new file mode 100644
index 0000000000..fca7804e82
--- /dev/null
+++ b/packages/agent-core/src/agent/cron/index.ts
@@ -0,0 +1 @@
+export { CronManager, type CronManagerOptions } from './manager';
diff --git a/packages/agent-core/src/agent/cron/manager.ts b/packages/agent-core/src/agent/cron/manager.ts
new file mode 100644
index 0000000000..005a2f8caa
--- /dev/null
+++ b/packages/agent-core/src/agent/cron/manager.ts
@@ -0,0 +1,386 @@
+/**
+ * CronManager — Agent-facing facade for the session-only cron scheduler.
+ *
+ * This layer sits between the raw `CronScheduler` (which knows nothing
+ * about agents) and the rest of the agent runtime (Agent / turn /
+ * telemetry / tool surface). Its job is small but important:
+ *
+ *   - own the `SessionCronStore` for this session;
+ *   - hand `() => store.list()` to the scheduler so add / delete are
+ *     picked up automatically every tick;
+ *   - gate fires on `agent.turn.hasActiveTurn` rather than maintaining a
+ *     duplicate idle flag — the turn machinery already knows;
+ *   - translate a fired `CronTask` into a `steer(...)` call carrying a
+ *     `CronJobOrigin`, plus the `cron_fired` telemetry event;
+ *   - provide a `handleMissed(...)` entry point that Phase 2 boot-time
+ *     missed-task detection (P2.7 / P2.11) will call. In Phase 1 the
+ *     entry point is reachable but never invoked from the framework —
+ *     it is exposed now so the API surface stays stable across the
+ *     phase boundary.
+ *
+ * The manager does NOT read `Date.now()` directly anywhere; every
+ * wall-clock read goes through `this.clocks.wallNow()`. The
+ * `no-date-now.test.ts` guard does not list this file (it covers the
+ * scheduler / jitter layer), but the same discipline is intentional so
+ * bench / test clock injection holds end-to-end.
+ *
+ * Note on `recurring` semantics: the canonical task representation uses
+ * `recurring: boolean | undefined` where `undefined` means recurring
+ * (cron tasks default to repeating). One-shot is the explicit
+ * `recurring === false` opt-out. Every check in this file uses
+ * `task.recurring !== false` to keep that default behaviour even when
+ * the field is omitted by the caller.
+ */
+import type { ContentPart } from '@moonshot-ai/kosong';
+
+import type { Agent } from '../index';
+import type { CronJobOrigin, CronMissedOrigin } from '../context/types';
+import {
+  resolveClockSources,
+  SYSTEM_CLOCKS,
+  type ClockSources,
+} from '../../tools/cron/clock';
+import { renderCronFireXml } from '../../tools/cron/cron-fire-xml';
+import { SessionCronStore } from '../../tools/cron/session-store';
+import {
+  createCronScheduler,
+  type CronScheduler,
+} from '../../tools/cron/scheduler';
+import {
+  CRON_DELETED,
+  CRON_FIRED,
+  CRON_MISSED,
+  CRON_SCHEDULED,
+} from '../../tools/cron/telemetry-events';
+import type { CronTask } from '../../tools/cron/types';
+
+/**
+ * Threshold past which a recurring task is flagged `stale: true` on its
+ * fire `origin`. One-shot tasks never carry the stale flag — they are
+ * one-time, "we always fire at most once" by construction. Disabled by
+ * `KIMI_CRON_NO_STALE=1` (bench / acceptance tests).
+ *
+ * Seven days mirrors the wall-clock "this got forgotten about" window
+ * we want the LLM to notice; the figure also matches the auto-expire
+ * cadence documented in the user-facing schedule story.
+ */
+const STALE_THRESHOLD_MS = 7 * 24 * 60 * 60 * 1000;
+
+export interface CronManagerOptions {
+  /**
+   * Override for tests / bench. Defaults to
+   * `resolveClockSources(process.env.KIMI_CRON_CLOCK)` so production
+   * picks up `KIMI_CRON_CLOCK=file:...` automatically.
+   * When unset, falls through to {@link SYSTEM_CLOCKS}.
+   */
+  readonly clocks?: ClockSources;
+
+  /**
+   * Override scheduler poll interval. Defaults handled by the scheduler
+   * (1000ms unless `KIMI_CRON_MANUAL_TICK=1`, which forces `null` here
+   * so the auto-tick `setInterval` is never installed). `null` or `0`
+   * means "no automatic timer — caller drives `tick()` manually".
+   */
+  readonly pollIntervalMs?: number | null;
+}
+
+export class CronManager {
+  /** Session-only task store. Empty at construction. */
+  readonly store: SessionCronStore;
+
+  /**
+   * Clock source used for the stale judgment. Also passed to the
+   * scheduler so the entire stack shares one notion of "now".
+   */
+  readonly clocks: ClockSources;
+
+  private readonly scheduler: CronScheduler;
+  private readonly agent: Agent;
+  /**
+   * Tracks whether `start()` has been called without a matching `stop()`.
+   * Used to keep `start()` / `stop()` idempotent and — more importantly
+   * for P1.8 — to gate SIGUSR1 binding so we don't accumulate handlers
+   * across repeated start() calls.
+   */
+  private started = false;
+  /**
+   * Reference to the bound SIGUSR1 listener while the manager is
+   * running. Held so `stop()` can call `process.off('SIGUSR1', handler)`
+   * with the same function reference and not leak handlers across vitest
+   * files. `null` whenever the manager is not started, or when running
+   * on a platform that does not support SIGUSR1 (Windows).
+   */
+  private sigusr1Handler: NodeJS.SignalsListener | null = null;
+
+  constructor(agent: Agent, opts: CronManagerOptions = {}) {
+    this.agent = agent;
+    this.store = new SessionCronStore();
+    this.clocks =
+      opts.clocks ??
+      resolveClockSources(process.env['KIMI_CRON_CLOCK']) ??
+      SYSTEM_CLOCKS;
+
+    this.scheduler = createCronScheduler({
+      clocks: this.clocks,
+      source: () => this.store.list(),
+      isIdle: () => !agent.turn.hasActiveTurn,
+      isKilled: () => process.env['KIMI_DISABLE_CRON'] === '1',
+      onFire: (task, ctx) => this.handleFire(task, ctx),
+      removeOneShot: (id) => {
+        this.store.remove([id]);
+      },
+      // P1.8: `KIMI_CRON_MANUAL_TICK=1` forces the scheduler into
+      // manual-drive mode (no setInterval), so bench / time-injected
+      // tests can step time forward and call `tick()` explicitly without
+      // racing a 1-second auto-tick. Explicit caller overrides
+      // (`opts.pollIntervalMs`) lose to the env so a bench can flip the
+      // switch from the outside without rebuilding the manager wiring.
+      pollIntervalMs:
+        process.env['KIMI_CRON_MANUAL_TICK'] === '1'
+          ? null
+          : opts.pollIntervalMs,
+    });
+  }
+
+  /**
+   * Begin the scheduler's auto-tick loop and bind the SIGUSR1 manual-tick
+   * hook (P1.8). Idempotent: a second call is a no-op so the boot
+   * sequence and tests can opt into "ensure started" without bookkeeping.
+   */
+  start(): void {
+    if (this.started) return;
+    this.started = true;
+    this.scheduler.start();
+    this.bindSigusr1();
+  }
+
+  /**
+   * Stop the scheduler, clear in-flight bookkeeping, and unbind the
+   * SIGUSR1 handler. Idempotent and signal-handler-safe — multiple
+   * vitest files exercising the manager must not leave a SIGUSR1 listener
+   * dangling on the shared process.
+   */
+  async stop(): Promise<void> {
+    this.unbindSigusr1();
+    await this.scheduler.stop();
+    this.started = false;
+  }
+
+  /** Drive one scheduler tick synchronously. Used by tests + P1.8 SIGUSR1. */
+  tick(): void {
+    this.scheduler.tick();
+  }
+
+  /**
+   * Earliest theoretical (post-jitter) next-fire across all tasks, or
+   * null if there are no tasks / none have a future fire. Used by the
+   * `/cron` slash command and external monitoring.
+   */
+  getNextFireTime(): number | null {
+    return this.scheduler.getNextFireTime();
+  }
+
+  /**
+   * Per-task post-jitter next-fire. Forwards to the scheduler so
+   * CronList renders the same instant the scheduler will fire — even
+   * when an already-past ideal still has a pending jittered delivery
+   * in the current period.
+   */
+  getNextFireForTask(taskId: string): number | null {
+    return this.scheduler.getNextFireForTask(taskId);
+  }
+
+  /**
+   * Stale judgment.
+   *
+   *   - `KIMI_CRON_NO_STALE=1` short-circuits to false (bench).
+   *   - One-shot tasks (`recurring === false`) are never stale — they
+   *     fire at most once by construction; flagging them stale would be
+   *     a noisy false positive on every backlog wakeup.
+   *   - Otherwise: `wallNow() - createdAt >= 7 days`.
+   *
+   * `Number.isFinite` guards against the wall clock being broken (e.g.
+   * a mis-set bench env that returns `NaN`); a non-finite age is
+   * treated as "we don't know, don't claim stale".
+   */
+  isStale(task: CronTask): boolean {
+    if (process.env['KIMI_CRON_NO_STALE'] === '1') return false;
+    if (task.recurring === false) return false;
+    const age = this.clocks.wallNow() - task.createdAt;
+    return Number.isFinite(age) && age >= STALE_THRESHOLD_MS;
+  }
+
+  /**
+   * Translate a scheduler fire into a steer + telemetry event.
+   *
+   * `agent.turn.steer` returns the new turnId, or `null` when the input
+   * was buffered because a turn is in flight (see turn/index.ts:84).
+   * We propagate that as `buffered` on the telemetry props so dashboards
+   * can distinguish "fired into a fresh turn" from "fired into a steer
+   * buffer that may not run until the user's turn ends".
+   *
+   * Honours the documented 7-day auto-expire contract for recurring
+   * tasks: a stale recurring task gets exactly one final delivery
+   * (already issued above) and is then removed from the store. The
+   * scheduler picks up the deletion on its next tick via `source()`
+   * and stops re-firing the task. One-shots are not affected — they
+   * are deleted by the scheduler immediately after delivery via the
+   * `removeOneShot` callback.
+   */
+  private handleFire(
+    task: CronTask,
+    ctx: { readonly coalescedCount: number },
+  ): void {
+    const stale = this.isStale(task);
+    const origin: CronJobOrigin = {
+      kind: 'cron_job',
+      jobId: task.id,
+      cron: task.cron,
+      recurring: task.recurring !== false,
+      coalescedCount: ctx.coalescedCount,
+      stale,
+    };
+    const content: ContentPart[] = [
+      {
+        type: 'text',
+        text: renderCronFireXml(origin, task.prompt),
+      },
+    ];
+    const turnId = this.agent.turn.steer(content, origin);
+    this.agent.telemetry.track(CRON_FIRED, {
+      recurring: task.recurring !== false,
+      coalesced_count: ctx.coalescedCount,
+      stale,
+      buffered: turnId === null,
+    });
+
+    // 7-day auto-expire — the recurring branch of CronCreate's tool
+    // description promises this contract to the model. Without the
+    // removal a long-lived session keeps re-injecting a multi-day-old
+    // cron prompt forever; with it, the task fires one last time
+    // (above) and is then dropped. Emit `cron_deleted` symmetrically
+    // with manual deletion so dashboards see the lifecycle close.
+    if (stale && task.recurring !== false) {
+      this.store.remove([task.id]);
+      this.emitDeleted(task.id);
+    }
+  }
+
+  /**
+   * Called from P2.7 / P2.11 when boot-time missed one-shot tasks are
+   * detected. Stubbed in P1.3 because Phase 1 has no persistence — but
+   * the API surface is final so the consumer (file-backed missed-task
+   * detector) can land without touching this class again.
+   *
+   * The `renderMissedNotification` callback is supplied by the caller
+   * (rather than imported here) so this module stays free of UI / copy
+   * coupling; the same manager works for tests that want to inject a
+   * trivial renderer.
+   *
+   * `count: 0` is a no-op — the scheduler-side missed-task detector
+   * filters empties before calling us, but defending here keeps the
+   * contract simple ("safe to call with anything, no-op when empty").
+   */
+  handleMissed(
+    tasks: readonly CronTask[],
+    renderMissedNotification: (
+      tasks: readonly CronTask[],
+    ) => readonly ContentPart[],
+  ): void {
+    if (tasks.length === 0) return;
+    const content = renderMissedNotification(tasks);
+    const origin: CronMissedOrigin = {
+      kind: 'cron_missed',
+      count: tasks.length,
+    };
+    this.agent.turn.steer(content, origin);
+    this.agent.telemetry.track(CRON_MISSED, { count: tasks.length });
+  }
+
+  /**
+   * Emit `cron_scheduled` for a freshly-added task. Called by
+   * `CronCreate` after a successful `store.add(...)`. Kept as an
+   * explicit method so the tool layer never reaches into
+   * `manager.agent.telemetry` — preserves the "tools see the manager,
+   * the manager sees the agent" layering and matches the symmetric
+   * `emitDeleted` used by `CronDelete` (P1.6).
+   */
+  emitScheduled(task: CronTask): void {
+    this.agent.telemetry.track(CRON_SCHEDULED, {
+      recurring: task.recurring !== false,
+    });
+  }
+
+  /**
+   * Emit `cron_deleted` for a removed task. Wired up here so P1.6 can
+   * land without touching this file again. `task_id` matches the field
+   * naming used elsewhere in the telemetry surface (snake_case).
+   */
+  emitDeleted(taskId: string): void {
+    this.agent.telemetry.track(CRON_DELETED, { task_id: taskId });
+  }
+
+  /**
+   * Wire `SIGUSR1` to a manual `tick()` so bench scripts can advance the
+   * scheduler with `kill -USR1 <pid>` without a custom RPC.
+   *
+   * Gated on `KIMI_CRON_MANUAL_TICK=1` for two reasons:
+   *
+   *   1. SIGUSR1 only makes sense when auto-tick is off. When the 1s
+   *      interval is running, it already advances the scheduler — a
+   *      manual signal is redundant.
+   *   2. In production a single CLI process can host one main agent plus
+   *      many subagents. Each Agent unconditionally binding a SIGUSR1
+   *      listener would put us over Node's 10-listener default cap and
+   *      print a `MaxListenersExceededWarning`. Coupling the binding to
+   *      the same env that disables auto-tick keeps the production path
+   *      at zero listeners while still giving benches the affordance.
+   *
+   * Skipped on Windows because Node's signal layer does not deliver
+   * POSIX signals there; attempting to `process.on('SIGUSR1', ...)` is a
+   * silent no-op but we avoid the call entirely so the bookkeeping
+   * (`sigusr1Handler !== null` means "we did bind") stays accurate.
+   *
+   * Idempotent — repeated calls keep the same listener registered once,
+   * so `start() → start()` does not stack handlers.
+   *
+   * The handler swallows any throw from `tick()` because a signal-driven
+   * bench tool must never crash the host process; the tick failure mode
+   * is already surfaced via telemetry / logs inside the scheduler.
+   * Set `KIMI_CRON_DEBUG=1` to surface the swallowed error to stderr —
+   * mirrors `scheduler.ts`'s debugLog pattern so bench debugging can
+   * see a bad tick.
+   */
+  private bindSigusr1(): void {
+    if (process.platform === 'win32') return;
+    if (process.env['KIMI_CRON_MANUAL_TICK'] !== '1') return;
+    if (this.sigusr1Handler !== null) return;
+    const handler: NodeJS.SignalsListener = () => {
+      try {
+        this.tick();
+      } catch (error) {
+        if (process.env['KIMI_CRON_DEBUG'] === '1') {
+          const msg = error instanceof Error ? error.message : String(error);
+          process.stderr.write(
+            `[cron/manager] SIGUSR1 tick threw: ${msg}\n`,
+          );
+        }
+      }
+    };
+    this.sigusr1Handler = handler;
+    process.on('SIGUSR1', handler);
+  }
+
+  /**
+   * Detach the SIGUSR1 listener registered by `bindSigusr1`. Safe to
+   * call when nothing is bound (no-op). Pair this with `stop()` so
+   * vitest files don't leak signal handlers across the shared process —
+   * `process.listenerCount('SIGUSR1')` should return to its pre-`start()`
+   * value once `stop()` resolves.
+   */
+  private unbindSigusr1(): void {
+    if (this.sigusr1Handler === null) return;
+    process.off('SIGUSR1', this.sigusr1Handler);
+    this.sigusr1Handler = null;
+  }
+}
diff --git a/packages/agent-core/src/agent/index.ts b/packages/agent-core/src/agent/index.ts
index 88f95d9097..d4b19f23d5 100644
--- a/packages/agent-core/src/agent/index.ts
+++ b/packages/agent-core/src/agent/index.ts
@@ -34,6 +34,7 @@ import {
 import type { PromisableMethods } from '../utils/types';
 import { BackgroundManager } from './background';
 import { FullCompaction, type CompactionStrategy } from './compaction';
+import { CronManager } from './cron';
 import { ConfigState } from './config';
 import { ContextMemory } from './context';
 import { HookEngine } from './hooks';
@@ -111,6 +112,7 @@ export class Agent {
   readonly usage: UsageRecorder;
   readonly tools: ToolManager;
   readonly background: BackgroundManager;
+  readonly cron: CronManager;
   readonly replayBuilder: ReplayBuilder;
   readonly log: Logger;
 
@@ -161,6 +163,18 @@ export class Agent {
       maxRunningTasks: config.backgroundMaxRunningTasks,
       sessionDir: config.backgroundSessionDir,
     });
+    this.cron = new CronManager(this);
+    if (this.type !== 'sub') {
+      // Skip auto-tick for subagents: each session can spawn many
+      // subagents, and stacking 1s setInterval timers + SIGUSR1
+      // listeners per subagent serves no purpose — the default subagent
+      // profiles don't expose Cron tools, so the store stays empty.
+      // The scheduler unref()'s its setInterval so the cron timer never
+      // keeps the process alive on its own, and isKilled (reading
+      // KIMI_DISABLE_CRON) short-circuits every tick — no need to
+      // delay start when the killswitch is set.
+      this.cron.start();
+    }
     this.replayBuilder = new ReplayBuilder(this);
   }
 
diff --git a/packages/agent-core/src/agent/permission/policies/default-tool-approve.ts b/packages/agent-core/src/agent/permission/policies/default-tool-approve.ts
index c2944fa36e..7e5a5c2f2c 100644
--- a/packages/agent-core/src/agent/permission/policies/default-tool-approve.ts
+++ b/packages/agent-core/src/agent/permission/policies/default-tool-approve.ts
@@ -9,6 +9,7 @@ const DEFAULT_APPROVE_TOOLS = new Set([
   'TodoList',
   'TaskList',
   'TaskOutput',
+  'CronList',
   'WebSearch',
   'FetchURL',
   'Agent',
diff --git a/packages/agent-core/src/agent/permission/policies/plan-mode-guard-deny.ts b/packages/agent-core/src/agent/permission/policies/plan-mode-guard-deny.ts
index b25e294c93..0e02f9e421 100644
--- a/packages/agent-core/src/agent/permission/policies/plan-mode-guard-deny.ts
+++ b/packages/agent-core/src/agent/permission/policies/plan-mode-guard-deny.ts
@@ -28,12 +28,23 @@ export class PlanModeGuardDenyPermissionPolicy implements PermissionPolicy {
       };
     }
 
-    if (toolName !== 'TaskStop') return;
-    return {
-      kind: 'deny',
-      message:
-        'TaskStop is not available in plan mode. Call ExitPlanMode to exit plan mode before stopping a background task.',
-    };
+    if (toolName === 'TaskStop') {
+      return {
+        kind: 'deny',
+        message:
+          'TaskStop is not available in plan mode. Call ExitPlanMode to exit plan mode before stopping a background task.',
+      };
+    }
+
+    if (toolName === 'CronCreate' || toolName === 'CronDelete') {
+      return {
+        kind: 'deny',
+        message:
+          `${toolName} is not available in plan mode because it would mutate scheduled work that runs after plan exit. Call ExitPlanMode first.`,
+      };
+    }
+
+    return;
   }
 }
 
diff --git a/packages/agent-core/src/agent/tool/index.ts b/packages/agent-core/src/agent/tool/index.ts
index df928d43c0..c329ccaf42 100644
--- a/packages/agent-core/src/agent/tool/index.ts
+++ b/packages/agent-core/src/agent/tool/index.ts
@@ -375,6 +375,9 @@ export class ToolManager {
         new b.TaskListTool(background),
         new b.TaskOutputTool(background),
         new b.TaskStopTool(background),
+        this.agent.type !== 'sub' && new b.CronCreateTool(this.agent.cron),
+        this.agent.type !== 'sub' && new b.CronListTool(this.agent.cron),
+        this.agent.type !== 'sub' && new b.CronDeleteTool(this.agent.cron),
         this.agent.skills !== undefined &&
           this.agent.skills.registry.listInvocableSkills().length > 0 &&
           new b.SkillTool(this.agent),
diff --git a/packages/agent-core/src/profile/default/agent.yaml b/packages/agent-core/src/profile/default/agent.yaml
index 0c0490becb..82b81bd3ef 100644
--- a/packages/agent-core/src/profile/default/agent.yaml
+++ b/packages/agent-core/src/profile/default/agent.yaml
@@ -15,6 +15,9 @@ tools:
   - TaskList
   - TaskOutput
   - TaskStop
+  - CronCreate
+  - CronList
+  - CronDelete
   - ReadMediaFile
   - TodoList
   - Skill
diff --git a/packages/agent-core/src/session/index.ts b/packages/agent-core/src/session/index.ts
index ad621208ad..9ca223f033 100644
--- a/packages/agent-core/src/session/index.ts
+++ b/packages/agent-core/src/session/index.ts
@@ -183,6 +183,7 @@ export class Session {
   async close(): Promise<void> {
     try {
       await this.stopBackgroundTasksOnExit();
+      await this.stopCronOnExit();
       await this.flushMetadata();
       await this.triggerSessionEnd('exit');
     } finally {
@@ -194,6 +195,15 @@ export class Session {
     }
   }
 
+  // Stop every agent's cron scheduler on close. No keepAlive notion — cron
+  // intervals reference the agent/session graph and must die with the session.
+  // `allSettled` keeps one agent's failure from blocking the rest.
+  private async stopCronOnExit(): Promise<void> {
+    await Promise.allSettled(
+      Array.from(this.agents.values(), (agent) => agent.cron.stop()),
+    );
+  }
+
   private async stopBackgroundTasksOnExit(): Promise<void> {
     const keepAliveOnExit = resolveConfigValue({
       env: process.env,
diff --git a/packages/agent-core/src/tools/builtin/index.ts b/packages/agent-core/src/tools/builtin/index.ts
index 046d475576..ebbe0dc71e 100644
--- a/packages/agent-core/src/tools/builtin/index.ts
+++ b/packages/agent-core/src/tools/builtin/index.ts
@@ -2,6 +2,9 @@ export * from '../background/manager';
 export * from '../background/task-list';
 export * from '../background/task-output';
 export * from '../background/task-stop';
+export * from '../cron/cron-create';
+export * from '../cron/cron-delete';
+export * from '../cron/cron-list';
 export * from './collaboration/agent';
 export * from './collaboration/ask-user';
 export * from './collaboration/skill-tool';
diff --git a/packages/agent-core/src/tools/cron/clock.ts b/packages/agent-core/src/tools/cron/clock.ts
new file mode 100644
index 0000000000..98b784a87b
--- /dev/null
+++ b/packages/agent-core/src/tools/cron/clock.ts
@@ -0,0 +1,148 @@
+/**
+ * Clock sources for the cron scheduler.
+ *
+ * Two distinct notions of time are kept apart on purpose:
+ *
+ *   1. wall-clock — what the user perceives as "the current time". Used
+ *      for cron expression matching, `createdAt`, and the 7-day stale
+ *      judgment. May be overridden in tests / multi-process benches so
+ *      that scenarios can run in simulated time without `setTimeout`.
+ *
+ *   2. monotonic ms — a strictly non-decreasing counter that never
+ *      jumps backwards across NTP adjustments, suspend/resume, or
+ *      simulated-clock injection. Used for the poll cadence and the
+ *      lock heartbeat — anything where "did 5 seconds elapse since we
+ *      last looked" must hold even when the wall clock is frozen.
+ *
+ * Mixing the two pollutes test reproducibility: a heartbeat tied to
+ * `wallNow()` will appear stuck when the test clock is frozen; a cron
+ * fire tied to `monoNowMs()` will not advance when the bench rewinds
+ * the simulated day. Every component in `tools/cron/` MUST take a
+ * `ClockSources` and route every time read through it.
+ *
+ * `monoNowMs` is ALWAYS `process.hrtime.bigint()` (converted to ms).
+ * It is not overridable — accepting an external monotonic clock would
+ * defeat the safety net the lock heartbeat depends on.
+ *
+ * `wallNow` resolution is driven by the `KIMI_CRON_CLOCK` env var; see
+ * `resolveClockSources` below. Defaults to `Date.now()`.
+ */
+import { closeSync, openSync, readSync } from 'node:fs';
+
+export interface ClockSources {
+  /**
+   * Wall-clock epoch milliseconds. May be overridden in tests / bench
+   * via `KIMI_CRON_CLOCK`. Used for cron matching, `createdAt`, stale
+   * judgment.
+   */
+  wallNow(): number;
+
+  /**
+   * Strictly monotonic millisecond counter. Never overridden. Used for
+   * the 1-second poll cadence and the lock-heartbeat liveness window.
+   */
+  monoNowMs(): number;
+}
+
+const systemMonoNowMs = (): number => Number(process.hrtime.bigint() / 1_000_000n);
+
+/**
+ * Production default — `Date.now()` + `process.hrtime.bigint()`. Used
+ * whenever `KIMI_CRON_CLOCK` is unset, set to `"system"`, or set to a
+ * spec that fails to parse.
+ */
+export const SYSTEM_CLOCKS: ClockSources = {
+  wallNow: () => Date.now(),
+  monoNowMs: systemMonoNowMs,
+};
+
+/**
+ * Resolve a `ClockSources` implementation from a spec string (typically
+ * `process.env.KIMI_CRON_CLOCK`).
+ *
+ *   unset / `"system"`   → {@link SYSTEM_CLOCKS}
+ *   `"file:<path>"`      → `wallNow` reads the first line of `<path>`
+ *                          on every call (sync — the tick path is not
+ *                          async) and parses it as `Number(...)`. A
+ *                          missing file or bad parse falls back to
+ *                          `Date.now()` for that call. Used so a
+ *                          multi-process bench can share a single
+ *                          file-backed simulated clock.
+ *
+ * `monoNowMs` ALWAYS uses `process.hrtime.bigint()`. No spec overrides
+ * it — see file header.
+ *
+ * Each `wallNow()` call re-reads its source. We deliberately do NOT
+ * cache, because a multi-process bench tick mutating the file must be
+ * picked up by every reader immediately; a cache would silently lock
+ * each process to its first observation.
+ *
+ * Unrecognised specs fall back to {@link SYSTEM_CLOCKS} (with a
+ * debug-log on stderr). This is deliberate — bricking the agent on a
+ * typoed bench env var would be worse than running with system time.
+ */
+export function resolveClockSources(spec?: string): ClockSources {
+  if (spec === undefined || spec === '' || spec === 'system') {
+    return SYSTEM_CLOCKS;
+  }
+
+  if (spec.startsWith('file:')) {
+    const filePath = spec.slice('file:'.length);
+    if (filePath === '') {
+      debugInvalidSpec(spec, 'empty file path');
+      return SYSTEM_CLOCKS;
+    }
+    return {
+      wallNow: () => readFileWall(filePath),
+      monoNowMs: systemMonoNowMs,
+    };
+  }
+
+  debugInvalidSpec(spec, 'unrecognised scheme');
+  return SYSTEM_CLOCKS;
+}
+
+// Epoch-ms is always under 20 characters in practice; 64 bytes leaves
+// slack for a leading newline / `\r` and prevents OOM on a hostile or
+// accidentally-huge clock file (e.g. a `/dev/zero` redirect).
+const MAX_CLOCK_FILE_BYTES = 64;
+
+function readFileWall(filePath: string): number {
+  let bytesRead = 0;
+  const buf = Buffer.alloc(MAX_CLOCK_FILE_BYTES);
+  let fd: number;
+  try {
+    fd = openSync(filePath, 'r');
+  } catch {
+    return Date.now();
+  }
+  try {
+    bytesRead = readSync(fd, buf, 0, MAX_CLOCK_FILE_BYTES, 0);
+  } catch {
+    return Date.now();
+  } finally {
+    try {
+      closeSync(fd);
+    } catch {
+      /* swallow close errors */
+    }
+  }
+  const raw = buf.subarray(0, bytesRead).toString('utf8');
+  const firstLine = raw.split('\n', 1)[0]?.trim() ?? '';
+  if (firstLine === '') return Date.now();
+  const parsed = Number(firstLine);
+  if (!Number.isFinite(parsed)) return Date.now();
+  return parsed;
+}
+
+function debugInvalidSpec(spec: string, reason: string): void {
+  // We do not pull in a logger here — `clock.ts` is the lowest layer of
+  // the cron module and must stay dependency-free so it can be imported
+  // from anywhere (including lint rules, type files). A stderr write
+  // gated on KIMI_CRON_DEBUG is enough — production is silent.
+  if (process.env['KIMI_CRON_DEBUG'] === '1') {
+    process.stderr.write(
+      `[cron/clock] invalid KIMI_CRON_CLOCK spec ${JSON.stringify(spec)}: ${reason} — falling back to system clock\n`,
+    );
+  }
+}
diff --git a/packages/agent-core/src/tools/cron/cron-create.md b/packages/agent-core/src/tools/cron/cron-create.md
new file mode 100644
index 0000000000..9b6d6850d9
--- /dev/null
+++ b/packages/agent-core/src/tools/cron/cron-create.md
@@ -0,0 +1,79 @@
+Schedule a prompt to be enqueued at a future time. Use for both recurring schedules and one-shot reminders.
+
+Uses standard 5-field cron in the user's local timezone: minute hour day-of-month month day-of-week. `0 9 * * *` means 9am local — no timezone conversion needed.
+
+## One-shot tasks (recurring: false)
+
+For "remind me at X" or "at <time>, do Y" requests — fire once then auto-delete.
+Pin minute/hour/day-of-month/month to specific values:
+  "remind me at 2:30pm today to check the deploy" → cron: "30 14 <today_dom> <today_month> *", recurring: false
+  "tomorrow morning, run the smoke test" → cron: "57 8 <tomorrow_dom> <tomorrow_month> *", recurring: false
+
+## Recurring jobs (recurring: true, the default)
+
+For "every N minutes" / "every hour" / "weekdays at 9am" requests:
+  "*/5 * * * *" (every 5 min), "0 * * * *" (hourly), "0 9 * * 1-5" (weekdays at 9am local)
+
+## Avoid the :00 and :30 minute marks when the task allows it
+
+Every user who asks for "9am" gets `0 9`, and every user who asks for "hourly" gets `0 *` — which means requests from across the planet land on the API at the same instant. When the user's request is approximate, pick a minute that is NOT 0 or 30:
+  "every morning around 9" → "57 8 * * *" or "3 9 * * *" (not "0 9 * * *")
+  "hourly" → "7 * * * *" (not "0 * * * *")
+  "in an hour or so, remind me to..." → pick whatever minute you land on, don't round
+
+Only use minute 0 or 30 when the user names that exact time and clearly means it ("at 9:00 sharp", "at half past", coordinating with a meeting). When in doubt, nudge a few minutes early or late — the user will not notice, and the fleet will.
+
+## Coalesce semantics
+
+If the scheduler slept past multiple ideal fire times (laptop closed, long-running turn, etc.), only **one** fire is delivered when it wakes up. The origin carries `coalescedCount` showing how many ideal fires were collapsed into this single delivery. You should treat `coalescedCount > 1` as "I missed some checks; only the latest state matters" rather than running the prompt that many times.
+
+## Cron-fire envelope
+
+When a cron task fires, the prompt you scheduled is re-injected wrapped in an XML envelope that exposes the fire context:
+
+```
+<cron-fire jobId="..." cron="..." recurring="true|false" coalescedCount="N" stale="true|false">
+<prompt>
+your original prompt text, verbatim
+</prompt>
+</cron-fire>
+```
+
+The envelope is parseable. Use `coalescedCount > 1` to know multiple ideal fires were collapsed into a single delivery (treat as "only the latest state matters"), and `stale="true"` as a cue that the task is past its 7-day threshold.
+
+## 7-day stale behavior
+
+Recurring tasks that have been alive for more than 7 days fire one
+final time with `stale: true` on the envelope, and the system then
+auto-deletes the task. The flag is the model's notice that this is
+the last delivery. If the schedule is still wanted, call `CronCreate`
+again with the same `cron` and `prompt` — that resets `createdAt` and
+starts a fresh 7-day window. One-shot tasks are never marked stale.
+
+Bench / acceptance runs can set `KIMI_CRON_NO_STALE=1` to disable the
+judgment entirely.
+
+## Jitter behavior
+
+Anti-herd jitter is applied deterministically per task id:
+  - Recurring: ideal fire time is shifted **forward** by an offset ≤ min(10% of the cron period, 15 minutes). A `*/5 * * * *` task can drift up to 30s; a `0 9 * * *` task can drift up to 15 minutes.
+  - One-shot: only when the ideal fire lands on `:00` or `:30` of the hour, the fire is pulled **earlier** by ≤ 90 seconds. Other minutes pass through unchanged.
+
+Bench / acceptance tests can set `KIMI_CRON_NO_JITTER=1` to disable jitter entirely.
+
+## One-shot vs recurring — when to pick which
+
+Use `recurring: false` for "remind me at X" style requests, single deadlines, "in N minutes do Y", and any task that should not repeat. Use `recurring: true` for periodic polling (CI status, build watchers, scheduled reports), workday rituals, and anything the user explicitly described as recurring.
+
+## Session-only
+
+Cron tasks live only in this CLI process. When the process exits, all
+scheduled tasks vanish — there is no cross-restart persistence in this
+build. If the user asks for something that needs to survive restarts,
+tell them so explicitly rather than silently scheduling something that
+will disappear.
+
+## Returned fields
+
+`id` (8-hex), `humanSchedule` (English summary), `recurring`,
+`nextFireAt` (ISO timestamp or null). `id` is needed by `CronDelete`.
diff --git a/packages/agent-core/src/tools/cron/cron-create.ts b/packages/agent-core/src/tools/cron/cron-create.ts
new file mode 100644
index 0000000000..020f2f36ef
--- /dev/null
+++ b/packages/agent-core/src/tools/cron/cron-create.ts
@@ -0,0 +1,273 @@
+/**
+ * CronCreateTool — schedule a prompt to be re-injected into this session
+ * at a future wall-clock time, either once (`recurring: false`) or on a
+ * cron cadence (`recurring: true`, the default).
+ *
+ * Phase 1 / P1.4 is session-only — tasks live in `SessionCronStore` and
+ * die when the process exits. A durable / file-backed branch is planned
+ * for Phase 2 but is intentionally absent from the public surface until
+ * the storage layer exists; exposing a `durable` flag now would mislead
+ * the model into promising persistence we can't yet deliver.
+ *
+ * The tool itself is pure validation + bookkeeping; the firing /
+ * coalesce / jitter logic lives in `CronScheduler` (one layer below)
+ * and `CronManager` (one layer up). This file only knows how to:
+ *
+ *   1. validate the request (killswitch, cron parse, 5-year window,
+ *      session cap, byte-length cap);
+ *   2. add it to the manager's session store;
+ *   3. report back the post-jitter `nextFireAt` and a human-readable
+ *      schedule for the model's benefit;
+ *   4. emit `cron_scheduled` telemetry through the manager (the tool
+ *      does **not** reach into `manager.agent.telemetry` directly).
+ */
+
+import { z } from 'zod';
+
+import type { BuiltinTool } from '../../agent/tool';
+import type { CronManager } from '../../agent/cron';
+import type { ToolExecution } from '../../loop/types';
+import { toInputJsonSchema } from '../support/input-schema';
+import {
+  computeNextCronRun,
+  cronToHuman,
+  hasFireWithinYears,
+  parseCronExpression,
+  type ParsedCronExpression,
+} from './cron-expr';
+import {
+  jitteredNextCronRunMs,
+  oneShotJitteredNextCronRunMs,
+} from './jitter';
+import CRON_CREATE_DESCRIPTION from './cron-create.md';
+
+// ── Constants ────────────────────────────────────────────────────────
+
+/**
+ * Session-level cap on the number of live cron tasks. Exported so tests
+ * can pre-fill the store without re-deriving the magic number.
+ */
+export const MAX_CRON_JOBS_PER_SESSION = 50;
+
+/**
+ * Hard ceiling on `prompt` byte length (UTF-8). The zod `.max(...)`
+ * upstream is in code units, which underflows multi-byte input
+ * (`'汉'.length === 1` even though it is 3 bytes); we re-check using
+ * `Buffer.byteLength` so the budget reflects the actual on-the-wire
+ * size the model will eventually see.
+ */
+const MAX_PROMPT_BYTES = 8 * 1024;
+
+// ── Input schema ─────────────────────────────────────────────────────
+
+export const CronCreateInputSchema = z.object({
+  cron: z
+    .string()
+    .describe(
+      '5-field cron expression in local time: "M H DoM Mon DoW" (e.g. "*/5 * * * *" = every 5 minutes, "30 14 28 2 *" = Feb 28 at 2:30pm local once).',
+    ),
+  prompt: z
+    .string()
+    .min(1)
+    .max(MAX_PROMPT_BYTES)
+    .describe('The prompt to enqueue at each fire time.'),
+  recurring: z
+    .boolean()
+    .optional()
+    .default(true)
+    .describe(
+      'true (default) = fire on every cron match until deleted or auto-expired after 7 days. false = fire once at the next match, then auto-delete. Use false for "remind me at X" one-shot requests with pinned minute/hour/dom/month.',
+    ),
+});
+
+export type CronCreateInput = z.Infer<typeof CronCreateInputSchema>;
+
+// ── Output shape (internal) ─────────────────────────────────────────
+
+interface CronCreateOutput {
+  readonly id: string;
+  readonly cron: string;
+  readonly humanSchedule: string;
+  readonly recurring: boolean;
+  readonly nextFireAt: number | null;
+}
+
+// ── Implementation ───────────────────────────────────────────────────
+
+export class CronCreateTool implements BuiltinTool<CronCreateInput> {
+  readonly name = 'CronCreate' as const;
+  readonly description = CRON_CREATE_DESCRIPTION;
+  readonly parameters: Record<string, unknown> = toInputJsonSchema(
+    CronCreateInputSchema,
+  );
+
+  constructor(private readonly manager: CronManager) {}
+
+  resolveExecution(args: CronCreateInput): ToolExecution {
+    // 1. Global killswitch — checked first so a flipped env stops all
+    //    further work, including the cron parse which can throw on
+    //    legitimately-malformed input.
+    if (process.env['KIMI_DISABLE_CRON'] === '1') {
+      return {
+        isError: true,
+        output: 'Cron scheduling is disabled (KIMI_DISABLE_CRON=1).',
+      };
+    }
+
+    // 2. Normalize whitespace BEFORE parsing so `parsed.raw` (which
+    //    `cronToHuman` falls back to for non-template shapes) is the
+    //    single-line form. Otherwise tabs/newlines from the raw input
+    //    leak into the rendered `humanSchedule:` row and break the
+    //    one-key-per-line tool output format. Parse errors still report
+    //    against canonical field positions; only whitespace is
+    //    degraded, not semantics.
+    const normalizedCron = args.cron.trim().split(/\s+/).join(' ');
+
+    // 3. Parse the cron expression. Any parse failure is a user error
+    //    rather than an internal one, so we surface the message
+    //    verbatim — the parser is already careful to name the
+    //    offending field.
+    let parsed: ParsedCronExpression;
+    try {
+      parsed = parseCronExpression(normalizedCron);
+    } catch (err) {
+      return {
+        isError: true,
+        output: `Invalid cron expression: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      };
+    }
+
+    // 4. Reject "legal but never fires within 5 years" — the same
+    //    bound the scheduler uses internally to refuse to spin.
+    //    `0 0 31 2 *` is the canonical example. The exact `nowMs` does
+    //    not matter for this judgment (it only changes the search
+    //    window by < 5 years), so we read it here at prepare time and
+    //    re-read inside `execute()` for the actual schedule anchor.
+    const nowAtPrepare = this.manager.clocks.wallNow();
+    if (!hasFireWithinYears(parsed, 5, nowAtPrepare)) {
+      return {
+        isError: true,
+        output: `Cron expression ${JSON.stringify(
+          normalizedCron,
+        )} has no fire within 5 years; refusing to schedule.`,
+      };
+    }
+
+    // 5. Session-level cap — preliminary check. We re-check inside
+    //    `execute()` because manual-approval mode can delay execution
+    //    long enough for parallel CronCreate calls to all pass this
+    //    gate and then collectively breach the cap on insert.
+    if (this.manager.store.list().length >= MAX_CRON_JOBS_PER_SESSION) {
+      return {
+        isError: true,
+        output: `Cron job cap reached (max ${String(
+          MAX_CRON_JOBS_PER_SESSION,
+        )} per session).`,
+      };
+    }
+
+    // 6. Byte-length cap. zod's `.max()` counts code units, which is
+    //    not the budget we actually want for a multi-byte prompt; the
+    //    Buffer.byteLength check makes the 8 KiB intent literal.
+    const byteLen = Buffer.byteLength(args.prompt, 'utf8');
+    if (byteLen > MAX_PROMPT_BYTES) {
+      return {
+        isError: true,
+        output: `Prompt exceeds ${String(
+          MAX_PROMPT_BYTES,
+        )} bytes (got ${String(byteLen)}).`,
+      };
+    }
+
+    // `recurring` is defaulted to true upstream; we re-derive the
+    // boolean (rather than trusting the post-default arg) to match the
+    // canonical "recurring iff not explicitly false" convention used
+    // everywhere else in the cron stack.
+    const recurring = args.recurring !== false;
+
+    return {
+      description: recurring
+        ? `Scheduling cron ${normalizedCron}`
+        : `Scheduling one-shot ${normalizedCron}`,
+      approvalRule: this.name,
+      execute: async () => {
+        // Anchor the schedule to the moment of execution, not the
+        // moment of preparation. Manual-approval mode can leave
+        // resolveExecution() and execute() minutes apart; inserting
+        // with a stale `nowMs` would let the scheduler treat a fresh
+        // one-shot as already overdue and fire it on the next tick
+        // with a phantom `coalescedCount > 1`.
+        const nowMs = this.manager.clocks.wallNow();
+
+        // Re-check the session cap against the live store size so two
+        // concurrently-prepared CronCreate calls cannot collectively
+        // breach it after both passed the prepare-time check.
+        if (this.manager.store.list().length >= MAX_CRON_JOBS_PER_SESSION) {
+          return {
+            isError: true,
+            output: `Cron job cap reached (max ${String(
+              MAX_CRON_JOBS_PER_SESSION,
+            )} per session).`,
+          };
+        }
+
+        const task = this.manager.store.add(
+          {
+            cron: normalizedCron,
+            prompt: args.prompt,
+            recurring,
+          },
+          nowMs,
+        );
+
+        // Post-jitter next-fire for the response. `computeNextCronRun`
+        // returns `null` if there's no fire in the 5-year window (we
+        // already rejected that above, but be defensive — the jitter
+        // helper would then have nothing to shift).
+        const ideal = computeNextCronRun(parsed, nowMs);
+        const nextFireAt =
+          ideal === null
+            ? null
+            : recurring
+              ? jitteredNextCronRunMs(task, parsed, ideal)
+              : oneShotJitteredNextCronRunMs(task, ideal);
+
+        const humanSchedule = cronToHuman(parsed);
+
+        // Telemetry goes through the manager so the tool stays out of
+        // `manager.agent.telemetry`. CronDelete (P1.6) will use the
+        // symmetric `emitDeleted`.
+        this.manager.emitScheduled(task);
+
+        const output: CronCreateOutput = {
+          id: task.id,
+          cron: normalizedCron,
+          humanSchedule,
+          recurring,
+          nextFireAt,
+        };
+
+        return {
+          output: formatOutput(output),
+          isError: false,
+          message: `Scheduled cron ${task.id}`,
+        };
+      },
+    };
+  }
+}
+
+function formatOutput(o: CronCreateOutput): string {
+  const lines = [
+    `id: ${o.id}`,
+    `cron: ${o.cron}`,
+    `humanSchedule: ${o.humanSchedule}`,
+    `recurring: ${String(o.recurring)}`,
+    `nextFireAt: ${
+      o.nextFireAt === null ? 'null' : new Date(o.nextFireAt).toISOString()
+    }`,
+  ];
+  return lines.join('\n');
+}
diff --git a/packages/agent-core/src/tools/cron/cron-delete.md b/packages/agent-core/src/tools/cron/cron-delete.md
new file mode 100644
index 0000000000..c1989092fd
--- /dev/null
+++ b/packages/agent-core/src/tools/cron/cron-delete.md
@@ -0,0 +1,39 @@
+Cancel a scheduled cron job by id.
+
+Use this tool to remove a cron task previously scheduled with
+`CronCreate`. The `id` is the 8-hex value returned by `CronCreate`, or
+shown in the `id:` column of `CronList` — quote it verbatim, no
+prefix.
+
+Behaviour by task kind:
+
+- **Recurring task** (`recurring: true`): stops all future fires
+  immediately. The scheduler picks up the deletion on its next tick.
+- **One-shot task** (`recurring: false`): cancels the pending fire if
+  it has not happened yet. One-shots that have already fired
+  auto-delete themselves, so calling `CronDelete` on a fired one-shot
+  returns "no cron job with id ...".
+
+Not-found is reported as an error (not a silent no-op) so you can
+correct yourself — typically by calling `CronList` to see which ids
+are actually live, rather than re-trying with the same stale id.
+
+Refresh pattern (use when you want a stale recurring schedule to
+continue):
+
+Stale recurring tasks are auto-deleted by the system after their final
+fire — there is nothing for `CronDelete` to remove at that point. To
+keep the schedule running, just call `CronCreate` with the same `cron`
+and `prompt`. Use `CronList`'s `prompt` field to recall the original
+text after a context compaction.
+
+`CronDelete` remains the right call when you want to cancel a task
+that is still live (recurring not yet stale, or a one-shot still
+pending).
+
+Guidelines:
+
+- Cron deletion is irreversible — there is no undo. If you delete the
+  wrong task, you must re-create it with `CronCreate`.
+- If the model is unsure which id is current (e.g. after a context
+  compaction), call `CronList` first rather than guessing.
diff --git a/packages/agent-core/src/tools/cron/cron-delete.ts b/packages/agent-core/src/tools/cron/cron-delete.ts
new file mode 100644
index 0000000000..363580fb2f
--- /dev/null
+++ b/packages/agent-core/src/tools/cron/cron-delete.ts
@@ -0,0 +1,118 @@
+/**
+ * CronDeleteTool — cancel a scheduled cron job by id.
+ *
+ * The tool's job is intentionally narrow: validate the id shape, ask the
+ * session store to drop the entry, and report whether anything was
+ * actually removed. The scheduler picks up the deletion on its next
+ * `tick()` automatically because `source: () => store.list()` is
+ * re-read every pass — there is no separate "unsubscribe" handshake to
+ * keep in sync.
+ *
+ * Why "not found" is reported as an error:
+ *
+ *   - The model uses the result string to decide whether to follow up
+ *     (e.g. confirm to the user, retry, or move on). Returning a
+ *     success-shaped message for a no-op would silently teach the model
+ *     that CronDelete is idempotent against missing ids, which it is
+ *     not — the next `CronList` would still show whatever id the model
+ *     thought it deleted. Surfacing `isError: true` lets the model
+ *     correct itself (typically by calling `CronList` again).
+ *
+ * Why the manager is not consulted for telemetry on the not-found
+ * branch:
+ *
+ *   - `cron_deleted` records an actual state change. Emitting it on a
+ *     miss would inflate the metric and break parity with `cron_create`
+ *     (which never fires on a rejected schedule). The branch is fully
+ *     observable through tool-call telemetry already.
+ *
+ * Refresh-cron pattern this tool participates in:
+ *
+ *   When `CronList` (or a fired job's origin) reports `stale: true`, the
+ *   documented "refresh" flow is `CronDelete(id)` followed by a fresh
+ *   `CronCreate` with the same cron + prompt. That resets `createdAt`,
+ *   clears the stale flag, and rejoins the herd-avoidance jitter draw
+ *   with a new task id. The doc string spells this out so the model can
+ *   reach for it without prompting from a system message.
+ */
+
+import { z } from 'zod';
+
+import type { BuiltinTool } from '../../agent/tool';
+import type { CronManager } from '../../agent/cron';
+import type { ToolExecution } from '../../loop/types';
+import { toInputJsonSchema } from '../support/input-schema';
+import CRON_DELETE_DESCRIPTION from './cron-delete.md';
+
+// ── Constants ────────────────────────────────────────────────────────
+
+/**
+ * Same id shape used by `SessionCronStore` (and Phase 2's file store).
+ * We re-check here so a malformed id never reaches the store — the
+ * regex is the single source of truth for the on-the-wire id format and
+ * an early reject keeps the error message close to the user's input.
+ */
+const ID_PATTERN = /^[0-9a-f]{8}$/;
+
+// ── Input schema ─────────────────────────────────────────────────────
+
+export const CronDeleteInputSchema = z.object({
+  id: z
+    .string()
+    .describe('The 8-hex cron job id returned by CronCreate / CronList.'),
+});
+export type CronDeleteInput = z.infer<typeof CronDeleteInputSchema>;
+
+// ── Implementation ───────────────────────────────────────────────────
+
+export class CronDeleteTool implements BuiltinTool<CronDeleteInput> {
+  readonly name = 'CronDelete' as const;
+  readonly description = CRON_DELETE_DESCRIPTION;
+  readonly parameters: Record<string, unknown> = toInputJsonSchema(
+    CronDeleteInputSchema,
+  );
+
+  constructor(private readonly manager: CronManager) {}
+
+  resolveExecution(args: CronDeleteInput): ToolExecution {
+    // Format check up front. The store would reject the lookup anyway,
+    // but the message is more actionable when it names the constraint
+    // ("8 lowercase hex characters") rather than a generic "not found".
+    if (!ID_PATTERN.test(args.id)) {
+      return {
+        isError: true,
+        output: `Invalid cron job id ${JSON.stringify(
+          args.id,
+        )} — must be 8 lowercase hex characters.`,
+      };
+    }
+
+    return {
+      description: `Deleting cron ${args.id}`,
+      approvalRule: this.name,
+      execute: async () => {
+        const removed = this.manager.store.remove([args.id]);
+        if (removed.length === 0) {
+          // Not found is reported as an error so the model can correct
+          // itself — see the module header for the rationale. We
+          // deliberately do NOT emit `cron_deleted` here; the metric
+          // tracks real state changes.
+          return {
+            isError: true,
+            output: `No cron job with id ${args.id}.`,
+          };
+        }
+
+        // Telemetry goes through the manager so the tool stays out of
+        // `manager.agent.telemetry` — symmetric with `CronCreate`'s use
+        // of `emitScheduled`.
+        this.manager.emitDeleted(args.id);
+
+        return {
+          output: `Deleted cron job ${args.id}.`,
+          isError: false,
+        };
+      },
+    };
+  }
+}
diff --git a/packages/agent-core/src/tools/cron/cron-expr.ts b/packages/agent-core/src/tools/cron/cron-expr.ts
new file mode 100644
index 0000000000..6569da3050
--- /dev/null
+++ b/packages/agent-core/src/tools/cron/cron-expr.ts
@@ -0,0 +1,451 @@
+/**
+ * 5-field cron expression parsing and "next fire time" computation, in
+ * local time. Self-contained — no external cron library is used because
+ * upstream `claude-code` mirrors the same semantics and we need exact
+ * lock-step behaviour with their implementation.
+ *
+ * Two flavours of correctness we care about:
+ *
+ *   1. **Semantics.** Standard 5 fields (minute hour day-of-month month
+ *      day-of-week). Day-of-month and day-of-week combine with cron's
+ *      OR rule when both are restricted (POSIX/Vixie tradition). dow
+ *      accepts 0..7 with 7 folded to 0 (Sunday).
+ *
+ *   2. **Termination.** Computing `next` for a legal-but-never-fires
+ *      expression like `0 0 31 2 *` must not spin. We bound the search
+ *      at a fixed window (5 years by default) and return `null` past
+ *      that — the validator at `CronCreate` reuses this signal.
+ */
+
+/** A parsed cron expression. Opaque to callers — pass it back into {@link computeNextCronRun}. */
+export interface ParsedCronExpression {
+  readonly raw: string;
+  readonly minutes: ReadonlySet<number>;
+  readonly hours: ReadonlySet<number>;
+  readonly daysOfMonth: ReadonlySet<number>;
+  readonly months: ReadonlySet<number>;
+  readonly daysOfWeek: ReadonlySet<number>;
+  /** True if the source field was `*` — needed so cron's dom/dow OR rule fires only when both are restricted. */
+  readonly daysOfMonthWildcard: boolean;
+  readonly daysOfWeekWildcard: boolean;
+}
+
+const MINUTE_RANGE = { min: 0, max: 59 } as const;
+const HOUR_RANGE = { min: 0, max: 23 } as const;
+const DOM_RANGE = { min: 1, max: 31 } as const;
+const MONTH_RANGE = { min: 1, max: 12 } as const;
+const DOW_RANGE = { min: 0, max: 7 } as const; // 7 → 0 fold after parse
+
+const MS_PER_MINUTE = 60_000;
+
+/**
+ * Parse a 5-field cron expression. Throws with a message naming the
+ * offending field on any syntax error. Whitespace-separated; exactly 5
+ * fields. Tokens supported per field: `*`, integers, ranges (`a-b`),
+ * lists (`a,b,c`), and step (e.g. star-slash-n or `a-b/n`).
+ */
+export function parseCronExpression(expr: string): ParsedCronExpression {
+  if (typeof expr !== 'string') {
+    throw new TypeError('cron expression must be a string');
+  }
+  const trimmed = expr.trim();
+  if (trimmed === '') {
+    throw new Error('cron expression is empty');
+  }
+  const fields = trimmed.split(/\s+/);
+  if (fields.length !== 5) {
+    throw new Error(
+      `cron expression must have exactly 5 fields (minute hour day-of-month month day-of-week); got ${fields.length}`,
+    );
+  }
+  const [minField, hourField, domField, monthField, dowField] = fields as [
+    string,
+    string,
+    string,
+    string,
+    string,
+  ];
+
+  const minutes = parseField(minField, MINUTE_RANGE.min, MINUTE_RANGE.max, 'minute');
+  const hours = parseField(hourField, HOUR_RANGE.min, HOUR_RANGE.max, 'hour');
+  const daysOfMonth = parseField(domField, DOM_RANGE.min, DOM_RANGE.max, 'day-of-month');
+  const months = parseField(monthField, MONTH_RANGE.min, MONTH_RANGE.max, 'month');
+  const dowRaw = parseField(dowField, DOW_RANGE.min, DOW_RANGE.max, 'day-of-week');
+  const daysOfWeek = new Set<number>();
+  for (const v of dowRaw) daysOfWeek.add(v === 7 ? 0 : v);
+
+  return {
+    raw: trimmed,
+    minutes,
+    hours,
+    daysOfMonth,
+    months,
+    daysOfWeek,
+    daysOfMonthWildcard: isWildcard(domField),
+    daysOfWeekWildcard: isWildcard(dowField),
+  };
+}
+
+function isWildcard(field: string): boolean {
+  // `*` and `*/n` both leave the field unconstrained in the
+  // "every value" sense — but only bare `*` should suppress the dom/dow
+  // OR rule. cron's tradition treats `*/n` as a restriction.
+  return field === '*';
+}
+
+function parseField(field: string, min: number, max: number, name: string): Set<number> {
+  if (field === '') {
+    throw new Error(`cron ${name} field is empty`);
+  }
+  const out = new Set<number>();
+  const terms = field.split(',');
+  for (const term of terms) {
+    if (term === '') {
+      throw new Error(`cron ${name} field has empty term in list`);
+    }
+    addTerm(out, term, min, max, name);
+  }
+  if (out.size === 0) {
+    throw new Error(`cron ${name} field matches no values`);
+  }
+  return out;
+}
+
+// Cron numeric fields are digit-only. `Number(...)` would otherwise
+// accept `''` (→ 0), `'1e1'`, `'0x10'`, `'+5'`, `'  3  '`, etc. — none
+// of which are valid cron syntax. This regex gate runs before the
+// conversion to surface a typo as a parse error instead of silently
+// rescheduling the task.
+const DIGIT_ONLY = /^\d+$/;
+
+function parseCronInt(raw: string, name: string, role: string): number {
+  if (!DIGIT_ONLY.test(raw)) {
+    throw new Error(
+      `cron ${name} ${role} must be a non-negative integer with digits only (got ${JSON.stringify(raw)})`,
+    );
+  }
+  return Number.parseInt(raw, 10);
+}
+
+function addTerm(out: Set<number>, term: string, min: number, max: number, name: string): void {
+  let rangePart = term;
+  let step = 1;
+  const slash = term.indexOf('/');
+  if (slash !== -1) {
+    rangePart = term.slice(0, slash);
+    const stepStr = term.slice(slash + 1);
+    if (stepStr === '') {
+      throw new Error(`cron ${name} step is empty in "${term}"`);
+    }
+    const parsedStep = parseCronInt(stepStr, name, 'step');
+    if (parsedStep <= 0) {
+      throw new Error(`cron ${name} step must be a positive integer (got "${stepStr}")`);
+    }
+    step = parsedStep;
+    if (rangePart === '') {
+      throw new Error(`cron ${name} step needs a range or "*" before "/" in "${term}"`);
+    }
+  }
+
+  let lo: number;
+  let hi: number;
+  if (rangePart === '*') {
+    lo = min;
+    hi = max;
+  } else {
+    const dash = rangePart.indexOf('-');
+    if (dash === -1) {
+      const single = parseCronInt(rangePart, name, 'value');
+      if (single < min || single > max) {
+        throw new Error(`cron ${name} value ${single} out of range ${min}..${max}`);
+      }
+      // A bare single value with a step (`5/10`) is unusual; treat as
+      // "from value through max stepping by N", which is what most cron
+      // dialects do.
+      if (slash !== -1) {
+        lo = single;
+        hi = max;
+      } else {
+        out.add(single);
+        return;
+      }
+    } else {
+      const loStr = rangePart.slice(0, dash);
+      const hiStr = rangePart.slice(dash + 1);
+      lo = parseCronInt(loStr, name, 'range lower bound');
+      hi = parseCronInt(hiStr, name, 'range upper bound');
+      if (lo < min || hi > max || lo > hi) {
+        throw new Error(
+          `cron ${name} range ${lo}-${hi} out of bounds (must be ${min}..${max}, ascending)`,
+        );
+      }
+    }
+  }
+
+  for (let v = lo; v <= hi; v += step) {
+    out.add(v);
+  }
+}
+
+/**
+ * Find the next wall-clock epoch ms strictly greater than `fromMs` that
+ * satisfies `expr`, using local-time semantics. Returns `null` if no
+ * match exists inside the default 5-year search window — defensive
+ * against legal-but-never-fires expressions like `0 0 31 2 *`.
+ *
+ * Uses an O(transitions) field-by-field skip algorithm rather than a
+ * minute-by-minute scan — month mismatch advances by months, day
+ * mismatch by days, etc., so the worst case for `0 12 1 1 *` is a
+ * handful of iterations, not 43 200.
+ *
+ * Termination is bounded by a wall-time deadline on the candidate
+ * date — not an iteration count — so a pathological expression that
+ * spends every iteration on `advanceMonth` still bails inside the
+ * documented window. A secondary `HARD_ITERATION_CAP` guards against
+ * a future refactor that fails to advance the date.
+ */
+export function computeNextCronRun(expr: ParsedCronExpression, fromMs: number): number | null {
+  return nextRunWithinMinutes(expr, fromMs, 5 * 366 * 24 * 60);
+}
+
+/**
+ * True iff at least one fire exists within `years` years of `fromMs`.
+ * Used by CronCreate validation to reject `0 0 31 2 *` and friends up
+ * front, with the same wall-time deadline {@link computeNextCronRun}
+ * uses (so the validator never says yes to something the scheduler
+ * will later refuse to compute).
+ */
+export function hasFireWithinYears(
+  expr: ParsedCronExpression,
+  years: number,
+  fromMs: number,
+): boolean {
+  const cap = Math.max(1, Math.floor(years * 366 * 24 * 60));
+  return nextRunWithinMinutes(expr, fromMs, cap) !== null;
+}
+
+function nextRunWithinMinutes(
+  expr: ParsedCronExpression,
+  fromMs: number,
+  capMinutes: number,
+): number | null {
+  // Seek strictly into the next minute: drop seconds/ms and add one
+  // minute. This guarantees we never return `fromMs` itself.
+  const start = new Date(fromMs);
+  start.setSeconds(0, 0);
+  const date = new Date(start.getTime() + MS_PER_MINUTE);
+
+  // Wall-clock deadline. Each loop body only advances `date` forward
+  // (month / day / hour / minute), so a single deadline check on
+  // `date.getTime()` bounds total work regardless of which granularity
+  // dominates — including the pathological case where `advanceMonth`
+  // is the dominant op (e.g. `0 0 30 2 *` never matches February).
+  const deadlineMs = fromMs + capMinutes * MS_PER_MINUTE;
+
+  // Secondary safety net: if a future refactor accidentally fails to
+  // advance `date`, this prevents an infinite loop. Generous enough to
+  // cover any minute-by-minute walk within a sane window, and many
+  // orders of magnitude below the previous iteration bound.
+  let iterations = 0;
+  const HARD_ITERATION_CAP = 10_000_000;
+
+  while (date.getTime() <= deadlineMs && iterations++ < HARD_ITERATION_CAP) {
+    // Month — coarsest. If wrong, jump to day 1 of the next allowed
+    // month and restart the day check.
+    if (!expr.months.has(date.getMonth() + 1)) {
+      advanceMonth(date);
+      continue;
+    }
+
+    // Day. Cron-style OR: when both dom and dow are restricted, match
+    // either; when one is `*`, only the other constrains.
+    if (!dayMatches(expr, date)) {
+      advanceDay(date);
+      continue;
+    }
+
+    if (!expr.hours.has(date.getHours())) {
+      advanceHour(date);
+      continue;
+    }
+
+    if (!expr.minutes.has(date.getMinutes())) {
+      advanceMinute(date);
+      continue;
+    }
+
+    return date.getTime();
+  }
+
+  return null;
+}
+
+function dayMatches(expr: ParsedCronExpression, date: Date): boolean {
+  const dom = date.getDate();
+  const dow = date.getDay();
+  const domOk = expr.daysOfMonth.has(dom);
+  const dowOk = expr.daysOfWeek.has(dow);
+
+  if (expr.daysOfMonthWildcard && expr.daysOfWeekWildcard) return true;
+  if (expr.daysOfMonthWildcard) return dowOk;
+  if (expr.daysOfWeekWildcard) return domOk;
+  // Both restricted: cron-style OR.
+  return domOk || dowOk;
+}
+
+function advanceMonth(date: Date): void {
+  // Jump to the 1st of the next month at 00:00. Date's wrap-around
+  // handles year rollover for us.
+  date.setDate(1);
+  date.setHours(0, 0, 0, 0);
+  date.setMonth(date.getMonth() + 1);
+}
+
+function advanceDay(date: Date): void {
+  date.setHours(0, 0, 0, 0);
+  date.setDate(date.getDate() + 1);
+}
+
+function advanceHour(date: Date): void {
+  date.setMinutes(0, 0, 0);
+  date.setHours(date.getHours() + 1);
+}
+
+function advanceMinute(date: Date): void {
+  date.setSeconds(0, 0);
+  date.setMinutes(date.getMinutes() + 1);
+}
+
+const MONTH_NAMES = [
+  'January',
+  'February',
+  'March',
+  'April',
+  'May',
+  'June',
+  'July',
+  'August',
+  'September',
+  'October',
+  'November',
+  'December',
+] as const;
+
+const DAY_NAMES = [
+  'Sunday',
+  'Monday',
+  'Tuesday',
+  'Wednesday',
+  'Thursday',
+  'Friday',
+  'Saturday',
+] as const;
+
+/**
+ * Cheap human-readable summary of an expression. Falls back to the raw
+ * string when the shape isn't one of the patterns we recognise — the
+ * caller (CronList) uses this purely for display, so a wordy fallback
+ * is fine and we don't try to be exhaustive.
+ */
+export function cronToHuman(expr: ParsedCronExpression): string {
+  const allMin = isFullRange(expr.minutes, 0, 59);
+  const allHour = isFullRange(expr.hours, 0, 23);
+  const allDom = expr.daysOfMonthWildcard;
+  const allMonth = isFullRange(expr.months, 1, 12);
+  const allDow = expr.daysOfWeekWildcard;
+
+  // every N minutes — common LLM pattern (`*/5 * * * *`).
+  if (allHour && allDom && allMonth && allDow) {
+    const step = detectStep(expr.minutes, 0, 59);
+    if (step !== null && step > 1) return `every ${step} minutes`;
+    if (allMin) return 'every minute';
+    if (expr.minutes.size === 1) {
+      const m = [...expr.minutes][0]!;
+      return `at minute ${m} of every hour`;
+    }
+  }
+
+  // every N hours.
+  if (expr.minutes.size === 1 && allDom && allMonth && allDow) {
+    const m = [...expr.minutes][0]!;
+    const step = detectStep(expr.hours, 0, 23);
+    if (step !== null && step > 1) {
+      return `every ${step} hours at minute ${pad(m)}`;
+    }
+  }
+
+  // at HH:MM every day, optional dow restriction.
+  if (
+    expr.minutes.size === 1 &&
+    expr.hours.size === 1 &&
+    allDom &&
+    allMonth
+  ) {
+    const h = [...expr.hours][0]!;
+    const m = [...expr.minutes][0]!;
+    if (allDow) return `at ${pad(h)}:${pad(m)} every day`;
+    const dowStr = formatDows(expr.daysOfWeek);
+    if (dowStr !== null) return `at ${pad(h)}:${pad(m)} on ${dowStr}`;
+  }
+
+  // at HH:MM on day N of <month>.
+  if (
+    expr.minutes.size === 1 &&
+    expr.hours.size === 1 &&
+    expr.daysOfMonth.size === 1 &&
+    !expr.daysOfMonthWildcard &&
+    expr.months.size === 1 &&
+    allDow
+  ) {
+    const h = [...expr.hours][0]!;
+    const m = [...expr.minutes][0]!;
+    const d = [...expr.daysOfMonth][0]!;
+    const mo = [...expr.months][0]!;
+    return `at ${pad(h)}:${pad(m)} on day ${d} of ${MONTH_NAMES[mo - 1]}`;
+  }
+
+  return expr.raw;
+}
+
+function isFullRange(set: ReadonlySet<number>, min: number, max: number): boolean {
+  if (set.size !== max - min + 1) return false;
+  for (let v = min; v <= max; v++) if (!set.has(v)) return false;
+  return true;
+}
+
+/**
+ * If the set looks like `{min, min+step, ..., <=max}` with a constant
+ * step, return `step`. Otherwise null. Used to pretty-print star-slash-N.
+ */
+function detectStep(set: ReadonlySet<number>, min: number, max: number): number | null {
+  const values = [...set].toSorted((a, b) => a - b);
+  if (values.length < 2) return null;
+  if (values[0] !== min) return null;
+  const step = values[1]! - values[0]!;
+  if (step <= 0) return null;
+  let expected = min;
+  for (const v of values) {
+    if (v !== expected) return null;
+    expected += step;
+  }
+  // The last expected value should exceed `max` by less than `step`.
+  if (expected - step > max) return null;
+  return step;
+}
+
+function formatDows(set: ReadonlySet<number>): string | null {
+  const values = [...set].toSorted((a, b) => a - b);
+  if (values.length === 0) return null;
+  // Mon-Fri shortcut.
+  if (values.length === 5 && values.every((v, i) => v === i + 1)) {
+    return 'weekdays';
+  }
+  if (values.length === 2 && values[0] === 0 && values[1] === 6) {
+    return 'weekends';
+  }
+  return values.map((v) => DAY_NAMES[v]!).join(', ');
+}
+
+function pad(n: number): string {
+  return n < 10 ? `0${n}` : String(n);
+}
diff --git a/packages/agent-core/src/tools/cron/cron-fire-xml.ts b/packages/agent-core/src/tools/cron/cron-fire-xml.ts
new file mode 100644
index 0000000000..2c85cedc24
--- /dev/null
+++ b/packages/agent-core/src/tools/cron/cron-fire-xml.ts
@@ -0,0 +1,44 @@
+/**
+ * Cron-fire XML rendering — produces the chat-history injection text
+ * the scheduler hands to the model when a CronTask fires.
+ *
+ * Output shape:
+ *   <cron-fire jobId="..." cron="..." recurring="true|false" coalescedCount="N" stale="true|false">
+ *   <prompt>
+ *   verbatim user prompt
+ *   </prompt>
+ *   </cron-fire>
+ *
+ * Mirrors `agent/context/notification-xml.ts`: attribute values are
+ * escape-safe via `stringAttr`, but the body inside `<prompt>` is
+ * verbatim. The injection target is an LLM-visible transcript where
+ * double-escaping would be noisier than literal punctuation.
+ */
+import type { CronJobOrigin } from '../../agent/context/types';
+
+export function renderCronFireXml(
+  origin: CronJobOrigin,
+  prompt: string,
+): string {
+  const jobId = stringAttr(origin.jobId, 'unknown');
+  const cron = stringAttr(origin.cron, 'unknown');
+  const recurring = origin.recurring ? 'true' : 'false';
+  const coalescedCount = String(origin.coalescedCount);
+  const stale = origin.stale ? 'true' : 'false';
+
+  return [
+    `<cron-fire jobId="${jobId}" cron="${cron}" recurring="${recurring}" coalescedCount="${coalescedCount}" stale="${stale}">`,
+    '<prompt>',
+    prompt,
+    '</prompt>',
+    '</cron-fire>',
+  ].join('\n');
+}
+
+function stringAttr(value: unknown, fallback: string): string {
+  if (typeof value !== 'string' || value.length === 0) return fallback;
+  // Attribute boundary safety: escape `&` and `"`. Body-text `<` / `>`
+  // stay untouched — the injection target is an LLM-visible transcript
+  // where double-escaping would be noisier than literal punctuation.
+  return value.replaceAll('&', '&amp;').replaceAll('"', '&quot;');
+}
diff --git a/packages/agent-core/src/tools/cron/cron-list.md b/packages/agent-core/src/tools/cron/cron-list.md
new file mode 100644
index 0000000000..6c0ca74985
--- /dev/null
+++ b/packages/agent-core/src/tools/cron/cron-list.md
@@ -0,0 +1,53 @@
+List all cron jobs currently scheduled in this session.
+
+Use this tool to see every pending cron task — both recurring jobs and
+one-shot reminders — that you (or the user) have scheduled with
+`CronCreate`. The output is the entry point for inspecting scheduled
+work: it returns a stable id, the original cron expression, a human
+rendering, the next post-jitter fire time, the recurring flag, the
+task's age in days, and a stale indicator.
+
+Each record carries:
+
+- `id` — the 8-hex task id. Pass this to `CronDelete` to remove the
+  task, or quote it in user-facing messages when asking for
+  confirmation.
+- `cron` — the verbatim 5-field cron expression as scheduled.
+- `humanSchedule` — plain-English rendering (e.g. `every 5 minutes`).
+- `prompt` — the scheduled prompt text, JSON-encoded so embedded
+  newlines stay on one line. Truncated to 200 UTF-8 bytes with
+  `…(truncated)` if longer. Use this to recall what a task is for
+  after a context compaction, and as the source for the
+  `CronCreate` refresh ritual.
+- `nextFireAt` — ISO timestamp of the next fire **after jitter has
+  been applied**. The actual fire may land slightly before or after a
+  round `:00` / `:30` minute mark due to herd-avoidance jitter; this
+  is the value the scheduler will compare against, so it reflects
+  what will really happen. `null` if the expression has no fire in
+  the next 5 years (should not happen for tasks created through
+  `CronCreate`, which validates).
+- `recurring` — `true` for cadenced jobs, `false` for one-shots.
+- `ageDays` — `(now - createdAt) / day`, two decimal places. Useful
+  when deciding whether a long-running cron is still relevant.
+- `stale` — `true` when a recurring task is older than 7 days. The
+  system **auto-deletes the task after this fire** to bound session
+  lifetime; the `stale: true` flag is the model's notice that this is
+  the final delivery. To resume the same schedule, call `CronCreate`
+  again with the original `cron` and `prompt` (the `prompt` row above
+  carries it for exactly this purpose). One-shots are never marked
+  stale — they fire at most once by construction.
+  `KIMI_CRON_NO_STALE=1` disables the judgment entirely (bench /
+  acceptance runs).
+
+Guidelines:
+
+- This tool is read-only and never mutates state, so it is always
+  safe to call (including in plan mode).
+- The empty case returns `cron_jobs: 0\nNo cron jobs scheduled.`. All
+  cron tasks live only in this session — there is no cross-session
+  persistence.
+- After a context compaction, or whenever you are unsure which cron
+  jobs are live, call this tool to re-enumerate them rather than
+  guessing ids from earlier in the conversation.
+- Records are separated by a line containing just `---`, in the
+  insertion order they were scheduled.
diff --git a/packages/agent-core/src/tools/cron/cron-list.ts b/packages/agent-core/src/tools/cron/cron-list.ts
new file mode 100644
index 0000000000..717f92760b
--- /dev/null
+++ b/packages/agent-core/src/tools/cron/cron-list.ts
@@ -0,0 +1,170 @@
+/**
+ * CronListTool — enumerate the cron tasks currently scheduled in this
+ * session.
+ *
+ * Read-only and side-effect-free. The output mirrors the
+ * `key: value\n---\n` shape used by `tools/background/task-list.ts` so
+ * the LLM sees a consistent record layout across the "list scheduled
+ * work" tools.
+ *
+ * What each record carries:
+ *
+ *   - `id`            — the 8-hex task id (also accepted by CronDelete).
+ *   - `cron`          — verbatim 5-field expression as scheduled.
+ *   - `humanSchedule` — best-effort plain-English rendering via
+ *                       `cronToHuman`; falls back to the raw `cron`
+ *                       string if the expression can't be parsed.
+ *   - `nextFireAt`    — post-jitter ISO timestamp, or the literal
+ *                       string `null` when there is no fire in the
+ *                       5-year window (or the expression is malformed).
+ *                       This is the same jittered value `CronCreate`
+ *                       reports, so the LLM can reason about herd-
+ *                       avoidance offsets without surprise.
+ *   - `recurring`     — `true` unless the task was explicitly created
+ *                       with `recurring: false`.
+ *   - `ageDays`       — `(wallNow - createdAt) / day`, formatted to two
+ *                       decimal places. Useful context for the `stale`
+ *                       flag and for the LLM's "should I still be
+ *                       running?" judgement.
+ *   - `stale`         — mirrors `CronManager.isStale(task)`; see that
+ *                       method for the precise rules
+ *                       (`recurring && age >= 7 days`, gated by
+ *                       `KIMI_CRON_NO_STALE`).
+ *
+ * The tool never throws on malformed cron strings. A defensive
+ * try/catch around the parse path lets the record render with the raw
+ * `cron`, a `humanSchedule` fallback equal to `cron`, and
+ * `nextFireAt: null` — that should never happen for tasks that went
+ * through `CronCreate` (which validates), but guards against future
+ * direct `store.add(...)` inserts.
+ */
+
+import { z } from 'zod';
+
+import type { BuiltinTool } from '../../agent/tool';
+import type { CronManager } from '../../agent/cron';
+import type { ToolExecution } from '../../loop/types';
+import { toInputJsonSchema } from '../support/input-schema';
+import {
+  cronToHuman,
+  parseCronExpression,
+} from './cron-expr';
+import type { CronTask } from './types';
+import CRON_LIST_DESCRIPTION from './cron-list.md';
+
+// ── Input schema ─────────────────────────────────────────────────────
+
+/**
+ * No arguments. Strict so the loop's AJV validator rejects accidental
+ * extras (e.g. an `active_only` borrowed from `TaskList`) instead of
+ * silently ignoring them.
+ */
+export const CronListInputSchema = z.object({}).strict();
+export type CronListInput = z.infer<typeof CronListInputSchema>;
+
+// ── Constants ────────────────────────────────────────────────────────
+
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+
+// Cap each rendered prompt at 200 UTF-8 bytes so a 50-task list with
+// kilobyte-scale prompts can't blow up the context window.
+const PROMPT_PREVIEW_BYTES = 200;
+
+function previewPrompt(prompt: string): string {
+  const buf = Buffer.from(prompt, 'utf8');
+  if (buf.byteLength <= PROMPT_PREVIEW_BYTES) return prompt;
+  // Slice to PROMPT_PREVIEW_BYTES. If that lands inside a multi-byte
+  // sequence, walk back to the nearest UTF-8 char boundary (continuation
+  // bytes start with 10xxxxxx).
+  let end = PROMPT_PREVIEW_BYTES;
+  while (end > 0 && (buf[end]! & 0b1100_0000) === 0b1000_0000) end--;
+  return `${buf.subarray(0, end).toString('utf8')}…(truncated)`;
+}
+
+// ── Implementation ───────────────────────────────────────────────────
+
+export class CronListTool implements BuiltinTool<CronListInput> {
+  readonly name = 'CronList' as const;
+  readonly description = CRON_LIST_DESCRIPTION;
+  readonly parameters: Record<string, unknown> = toInputJsonSchema(
+    CronListInputSchema,
+  );
+
+  constructor(private readonly manager: CronManager) {}
+
+  resolveExecution(_args: CronListInput): ToolExecution {
+    return {
+      description: 'Listing scheduled cron jobs',
+      approvalRule: this.name,
+      execute: async () => {
+        // Snapshot the store once and pin "now" from the manager's
+        // clock — keeping both reads inside the same execute() call
+        // guarantees the `ageDays` and `nextFireAt` columns are
+        // computed against the same instant even if the bench-injected
+        // clock advances between the two.
+        const tasks = this.manager.store.list();
+        const nowMs = this.manager.clocks.wallNow();
+        const records = tasks.map((t) => this.renderRecord(t, nowMs));
+        const header = `cron_jobs: ${String(tasks.length)}`;
+        if (records.length === 0) {
+          return {
+            output: `${header}\nNo cron jobs scheduled.`,
+            isError: false,
+          };
+        }
+        return {
+          output: `${header}\n${records.join('\n---\n')}`,
+          isError: false,
+        };
+      },
+    };
+  }
+
+  private renderRecord(task: CronTask, nowMs: number): string {
+    // `recurring: undefined` is the canonical "repeat by default"
+    // shape across the cron stack; only an explicit `false` opts out.
+    const recurring = task.recurring !== false;
+
+    // `ageDays` is purely informational — a non-finite age (e.g.
+    // wallNow returned NaN from a misconfigured bench clock) is
+    // reported as 0.00 so the column stays parseable rather than
+    // emitting the string "NaN".
+    const ageMs = nowMs - task.createdAt;
+    const ageDays = Number.isFinite(ageMs) ? ageMs / MS_PER_DAY : 0;
+
+    const stale = this.manager.isStale(task);
+
+    let humanSchedule = task.cron;
+    let nextFireAtIso = 'null';
+    try {
+      const parsed = parseCronExpression(task.cron);
+      humanSchedule = cronToHuman(parsed);
+      // Delegate to the scheduler so the rendered ISO matches what the
+      // scheduler will actually deliver — including a pending jittered
+      // slot in the current period.
+      const nextFireMs = this.manager.getNextFireForTask(task.id);
+      if (nextFireMs !== null) {
+        nextFireAtIso = new Date(nextFireMs).toISOString();
+      }
+    } catch {
+      // Malformed cron string — leave humanSchedule as the raw
+      // expression and nextFireAt as `null`. Should never happen for
+      // tasks that went through CronCreate (which validates), but
+      // defends against direct store inserts (tests).
+    }
+
+    return [
+      `id: ${task.id}`,
+      `cron: ${task.cron}`,
+      `humanSchedule: ${humanSchedule}`,
+      // JSON-stringify so embedded newlines become `\n` escapes and
+      // the record stays one `key: value` per line — otherwise a
+      // multi-line prompt would corrupt the per-record parser.
+      `prompt: ${JSON.stringify(previewPrompt(task.prompt))}`,
+      `nextFireAt: ${nextFireAtIso}`,
+      `recurring: ${String(recurring)}`,
+      `ageDays: ${ageDays.toFixed(2)}`,
+      `stale: ${String(stale)}`,
+    ].join('\n');
+  }
+}
diff --git a/packages/agent-core/src/tools/cron/jitter.ts b/packages/agent-core/src/tools/cron/jitter.ts
new file mode 100644
index 0000000000..8f4d5d64c4
--- /dev/null
+++ b/packages/agent-core/src/tools/cron/jitter.ts
@@ -0,0 +1,170 @@
+/**
+ * Per-task deterministic jitter for cron fire times.
+ *
+ * Why this exists: if every user writes `0 9 * * *` ("every day at 9
+ * am") then every CLI fires at the same instant and the upstream API
+ * sees a thundering herd at :00. We soften that by shifting each
+ * task's ideal fire time by a small, **deterministic** per-task
+ * offset so a given task always lands at the same jittered point —
+ * reschedules and restarts don't drift, and bench reproducibility
+ * stays intact when {@link KIMI_CRON_NO_JITTER} is set.
+ *
+ * Two flavours:
+ *
+ *   - **Recurring**: shift *forward* by a fraction of the period
+ *     (cap 10% of period, hard cap 15 min). Long-period jobs (`0 9 *
+ *     * *`, period 1 day) hit the 15-minute cap; short-period jobs
+ *     (`*` /5 * * * *`, period 5 min) are bounded by the 10% rule.
+ *
+ *   - **One-shot**: shift *earlier* (negative), but only when the
+ *     ideal lands on `:00` or `:30` — that's the signal the model
+ *     picked a round number with no specific intent. Cap 90 s
+ *     earlier. Any other minute (`:07`, `:23`, …) passes through
+ *     unchanged because the model presumably meant that exact time.
+ *
+ * The function is pure given its inputs — no module-level cache; the
+ * hash is recomputed from `task.id` each call. That trades a handful
+ * of cheap arithmetic ops for a guarantee that there is no hidden
+ * state to invalidate when a task is rescheduled.
+ */
+import type { ParsedCronExpression } from './cron-expr';
+import { computeNextCronRun } from './cron-expr';
+
+/** Tunables for {@link jitteredNextCronRunMs} / {@link oneShotJitteredNextCronRunMs}. */
+export interface JitterConfig {
+  /** Recurring offset cap as a fraction of the cron period (0..1). */
+  readonly recurringMaxFractionOfPeriod: number;
+  /** Absolute cap on the recurring offset, in ms. */
+  readonly recurringMaxMs: number;
+  /** Absolute cap on the one-shot pull-forward, in ms. */
+  readonly oneShotMaxMs: number;
+}
+
+export const DEFAULT_CRON_JITTER_CONFIG: JitterConfig = {
+  recurringMaxFractionOfPeriod: 0.1,
+  recurringMaxMs: 15 * 60_000,
+  oneShotMaxMs: 90_000,
+};
+
+const MS_PER_DAY = 24 * 60 * 60_000;
+const MS_PER_MINUTE = 60_000;
+
+/**
+ * Map a task id to a deterministic fraction in `[0, 1)`. Cron task
+ * ids are 8 hex chars (`/^[0-9a-f]{8}$/`), so `parseInt(id, 16)` /
+ * `2^32` lands neatly in range. For non-hex inputs we fall back to a
+ * djb2-style reduction so callers passing test fixtures with
+ * arbitrary string ids still get a stable spread.
+ */
+function fractionFromId(id: string): number {
+  if (/^[0-9a-f]{8}$/i.test(id)) {
+    const n = Number.parseInt(id, 16);
+    if (Number.isFinite(n)) {
+      // 2^32 keeps the result strictly < 1.
+      return n / 0x1_0000_0000;
+    }
+  }
+  // djb2 reduction — overflow-safe in JS (operates on int32) and
+  // good enough spread for non-hex test ids.
+  let hash = 5381;
+  for (let i = 0; i < id.length; i++) {
+    hash = ((hash << 5) + hash + id.charCodeAt(i)) | 0;
+  }
+  // Map signed int32 to [0, 1).
+  const unsigned = hash >>> 0;
+  return unsigned / 0x1_0000_0000;
+}
+
+function jitterDisabledByEnv(): boolean {
+  return process.env['KIMI_CRON_NO_JITTER'] === '1';
+}
+
+/**
+ * Apply recurring-job jitter to an already-computed ideal fire time.
+ *
+ * The shift is **forward only** (≥ 0), bounded by both the relative
+ * fraction-of-period cap and the absolute ms cap. We discover the
+ * period by asking {@link computeNextCronRun} for the run *after*
+ * `idealMs`; if that returns `null` (legal-but-never-fires
+ * expression — should have been rejected upstream) we fall back to a
+ * 24-hour assumption so we still produce some sensible offset rather
+ * than spiking on the original `idealMs`.
+ */
+export function jitteredNextCronRunMs(
+  task: { id: string; cron: string; recurring?: boolean },
+  parsed: ParsedCronExpression,
+  idealMs: number,
+  config: JitterConfig = DEFAULT_CRON_JITTER_CONFIG,
+): number {
+  if (jitterDisabledByEnv()) {
+    return idealMs;
+  }
+  const nextNext = computeNextCronRun(parsed, idealMs);
+  const period =
+    nextNext !== null && nextNext > idealMs ? nextNext - idealMs : MS_PER_DAY;
+  const periodCap = period * config.recurringMaxFractionOfPeriod;
+  const cap = Math.min(periodCap, config.recurringMaxMs);
+  if (!(cap > 0)) {
+    return idealMs;
+  }
+  const offset = cap * fractionFromId(task.id);
+  return idealMs + offset;
+}
+
+/**
+ * Apply one-shot pull-forward jitter to an ideal fire time.
+ *
+ * Only fires on `:00` and `:30` of the hour — the minute marks the
+ * model is most likely to pick out of habit. Other minutes pass
+ * through verbatim so a user who said "remind me at 2:07" gets
+ * 2:07 exactly. The shift is in `[-oneShotMaxMs, 0)`; never exactly
+ * 0 unless the deterministic hash happens to land on 0 (which is
+ * fine — it just means this task is the unlucky one that pays the
+ * full delay).
+ *
+ * When the deterministic offset would land before `task.createdAt`,
+ * the jitter budget is too small to safely pull forward: a previous
+ * version clamped to `createdAt` itself, but the scheduler condition
+ * `now >= nextFireAt` then fires on the very next tick — for the
+ * canonical 08:59:30-created `0 9 * * *` case, that means firing
+ * ~29 s before the ideal 09:00 mark. We skip jitter instead and
+ * return `idealMs` unchanged; the task fires at the ideal time, no
+ * earlier. Callers without `createdAt` (legacy test fixtures) get
+ * the unclamped pulled-forward value, preserving the previous
+ * behaviour for them.
+ */
+export function oneShotJitteredNextCronRunMs(
+  task: { id: string; createdAt?: number | undefined },
+  idealMs: number,
+  config: JitterConfig = DEFAULT_CRON_JITTER_CONFIG,
+): number {
+  if (jitterDisabledByEnv()) {
+    return idealMs;
+  }
+  // `idealMs % MS_PER_MINUTE === 0` is a UTC minute-boundary check.
+  // It coincides with a local minute boundary in every modern timezone
+  // because all offsets are minute-aligned — there are no sub-minute
+  // offsets in current use. Cron firings are always on the minute, so
+  // this gate is almost always true; it remains as a guard against
+  // synthetic idealMs values from tests that aren't on the minute.
+  if (idealMs % MS_PER_MINUTE !== 0) {
+    return idealMs;
+  }
+  const minuteOfHour = new Date(idealMs).getMinutes();
+  if (minuteOfHour !== 0 && minuteOfHour !== 30) {
+    return idealMs;
+  }
+  if (!(config.oneShotMaxMs > 0)) {
+    return idealMs;
+  }
+  const offset = -config.oneShotMaxMs * fractionFromId(task.id);
+  const shifted = idealMs + offset;
+  // Skip jitter when the budget is insufficient: the previous version
+  // clamped to `createdAt`, but `now >= nextFireAt` then fired on the
+  // very next tick — ~29 s before ideal for the 08:59:30 → 09:00 case.
+  // Returning `idealMs` keeps the fire on schedule, never earlier.
+  if (task.createdAt !== undefined && shifted < task.createdAt) {
+    return idealMs;
+  }
+  return shifted;
+}
diff --git a/packages/agent-core/src/tools/cron/scheduler.ts b/packages/agent-core/src/tools/cron/scheduler.ts
new file mode 100644
index 0000000000..83e0dbe5e6
--- /dev/null
+++ b/packages/agent-core/src/tools/cron/scheduler.ts
@@ -0,0 +1,430 @@
+/**
+ * CronScheduler — the session-only scheduling engine.
+ *
+ * This is the bottom of the cron stack: it knows about tasks, clocks,
+ * jitter, and "is the REPL idle?", but nothing about agents, tools,
+ * persistence, locks, or the file system. The Phase 2 file-backed
+ * variant will extend this same module rather than fork it.
+ *
+ * Design notes worth keeping near the code:
+ *
+ *   - **No direct wall-clock reads.** Every wall-clock read goes
+ *     through `clocks.wallNow()`. The companion `no-date-now.test.ts`
+ *     enforces this at the file level; bypassing the abstraction
+ *     here would break bench / test clock injection.
+ *
+ *   - **`source()` is called every tick.** It returns the *current*
+ *     task list. Callers (the manager) typically wire it to
+ *     `() => store.list()`, so creating / deleting tasks between ticks
+ *     is picked up automatically. Keep `source()` cheap.
+ *
+ *   - **`isIdle()` gates fires, not state updates.** When the REPL is
+ *     mid-turn we skip firing — but we do NOT advance `lastSeenAt`. The
+ *     next idle tick will see the tasks as still due and fire them,
+ *     with `coalescedCount` reflecting the gap (so the LLM knows it
+ *     missed N ideal fires while the user was talking).
+ *
+ *   - **`coalescedCount` semantics.** When a sleep / busy turn / system
+ *     pause causes the scheduler to miss multiple ideal fires, we
+ *     deliver exactly ONE `onFire` call and tell the caller how many
+ *     ideal fires we collapsed into it. Floor at 1 — every fire that
+ *     happens counts as at least one occurrence.
+ *
+ *   - **`inFlight` is cleared at end of tick.** `onFire` is synchronous
+ *     (the manager's steer is fire-and-forget). The set exists only to
+ *     defend against re-entrant ticks within the same call stack — a
+ *     theoretical concern, but cheap insurance.
+ *
+ *   - **Bad tasks do not poison the loop.** Each task's processing is
+ *     wrapped in try/catch; failures are swallowed (with an optional
+ *     stderr trace gated on `KIMI_CRON_DEBUG=1`) so one busted cron
+ *     expression cannot starve the other tasks.
+ */
+
+import type { ParsedCronExpression } from './cron-expr';
+import { computeNextCronRun, parseCronExpression } from './cron-expr';
+import type { ClockSources } from './clock';
+import { jitteredNextCronRunMs, oneShotJitteredNextCronRunMs } from './jitter';
+import type { CronTask } from './types';
+
+export interface CronSchedulerOptions {
+  /** Required. Wall + monotonic clock source. */
+  readonly clocks: ClockSources;
+
+  /**
+   * Required. Returns the live task list (e.g. `() => store.list()`).
+   * Called every tick — keep cheap.
+   */
+  readonly source: () => readonly CronTask[];
+
+  /**
+   * Required. Called when a task fires. `coalescedCount >= 1`; > 1
+   * when the scheduler slept past multiple ideal fires.
+   */
+  readonly onFire: (task: CronTask, ctx: { readonly coalescedCount: number }) => void;
+
+  /**
+   * Required. Returns true when the REPL is idle and the scheduler
+   * may deliver a fire NOW. False during an active turn so we don't
+   * dump a cron fire mid-stream. When false, the tick returns without
+   * firing but does not lose tasks — the next idle tick fires them
+   * with coalescedCount reflecting the gap.
+   */
+  readonly isIdle: () => boolean;
+
+  /**
+   * Optional. Returns true when the global killswitch is on; tick()
+   * short-circuits to no-op.
+   */
+  readonly isKilled?: () => boolean;
+
+  /**
+   * Optional. Called when a one-shot task fires and must be removed
+   * from the store. Defaults to a no-op (manager is responsible).
+   */
+  readonly removeOneShot?: (id: string) => void;
+
+  /**
+   * Optional. Poll interval for the auto-tick setInterval, in ms.
+   *   - undefined (default) → 1000ms.
+   *   - 0 or null → no automatic polling. Caller drives tick()
+   *     manually.
+   *
+   * Used by P1.8 to wire `KIMI_CRON_MANUAL_TICK=1` to disable the
+   * timer.
+   */
+  readonly pollIntervalMs?: number | null;
+}
+
+export interface CronScheduler {
+  /** Begin the auto-tick loop. Idempotent — calling twice is a no-op. */
+  start(): void;
+
+  /**
+   * Stop the auto-tick loop and clear any in-flight bookkeeping.
+   * Idempotent.
+   */
+  stop(): Promise<void>;
+
+  /**
+   * Run one check cycle synchronously. Safe to call before start() or
+   * after stop().
+   */
+  tick(): void;
+
+  /**
+   * Earliest theoretical (post-jitter) next fire across all current
+   * tasks, or null if there are no tasks or none have a future fire.
+   * Used by /cron and by external monitoring.
+   */
+  getNextFireTime(): number | null;
+
+  /**
+   * Post-jitter next-fire for a single task using the scheduler's
+   * internal `lastSeenAt` baseline. Returns null if the task isn't in
+   * the current `source()` snapshot or its expression yields no future
+   * fire. Used by CronList so its rendered `nextFireAt` matches what
+   * the scheduler will actually deliver, including the in-flight
+   * jittered slot of the current period.
+   */
+  getNextFireForTask(taskId: string): number | null;
+}
+
+const DEFAULT_POLL_INTERVAL_MS = 1_000;
+
+/**
+ * Cap on how many ideal fires we attempt to enumerate when computing
+ * coalescedCount. With a 1-minute cron, this still covers 10 000
+ * minutes (~7 days). Beyond that we'd rather report 10 000 than spin —
+ * the LLM only needs the order of magnitude.
+ */
+const MAX_COALESCE_ITERATIONS = 10_000;
+
+export function createCronScheduler(opts: CronSchedulerOptions): CronScheduler {
+  const {
+    clocks,
+    source,
+    onFire,
+    isIdle,
+    isKilled,
+    removeOneShot,
+    pollIntervalMs,
+  } = opts;
+
+  // Cached parsed cron expressions. Keyed by the raw expression
+  // string. Per-session task counts are tiny, so we never evict.
+  const parsedCache = new Map<string, ParsedCronExpression>();
+
+  // Per-task wall-clock baseline for "where did we last look from".
+  // NOT persisted — restart starts from `task.createdAt` as the floor.
+  const lastSeenAt = new Map<string, number>();
+
+  // Defensive re-entry guard for the duration of a single tick.
+  const inFlight = new Set<string>();
+
+  let timerHandle: ReturnType<typeof setInterval> | null = null;
+
+  function getParsed(expr: string): ParsedCronExpression {
+    const cached = parsedCache.get(expr);
+    if (cached !== undefined) return cached;
+    const parsed = parseCronExpression(expr);
+    parsedCache.set(expr, parsed);
+    return parsed;
+  }
+
+  function debugLog(message: string): void {
+    if (process.env['KIMI_CRON_DEBUG'] === '1') {
+      process.stderr.write(`[cron/scheduler] ${message}\n`);
+    }
+  }
+
+  /**
+   * Compute the jittered next-fire for a task, starting from `baseMs`.
+   * Returns null when the cron expression has no future fire within
+   * the search budget (legal-but-never-fires expression).
+   */
+  function computeJitteredNext(
+    task: CronTask,
+    parsed: ParsedCronExpression,
+    baseMs: number,
+  ): number | null {
+    const ideal = computeNextCronRun(parsed, baseMs);
+    if (ideal === null) return null;
+    if (task.recurring === false) {
+      return oneShotJitteredNextCronRunMs(task, ideal);
+    }
+    return jitteredNextCronRunMs(task, parsed, ideal);
+  }
+
+  /**
+   * Count how many ideal fires fall in `(firstFireMs, nowMs]` whose
+   * **jittered delivery time** is also ≤ `nowMs`. Returns the count
+   * plus the timestamp of the last ideal occurrence that satisfied the
+   * jittered-due test — used by the caller as the new `lastSeenAt`
+   * baseline so the next scheduler pass still sees any later
+   * occurrence whose jittered delivery slipped past `nowMs`.
+   *
+   * Counting against `nowMs` alone (without re-applying jitter) over-
+   * counted on jobs whose jitter offset pushed the next ideal fire
+   * past the scheduler wake-up window; the caller would then advance
+   * `lastSeenAt` past that occurrence and the jittered delivery would
+   * never happen. The fix is to gate the counting loop on the same
+   * jitter the delivery path uses.
+   *
+   * Always returns at least 1 — every actual fire is one occurrence.
+   * Capped at MAX_COALESCE_ITERATIONS as a defence against runaway
+   * loops; an expression that produces more than 10 000 fires in the
+   * gap is degenerate and the LLM only needs the order of magnitude.
+   */
+  function countCoalesced(
+    task: CronTask,
+    parsed: ParsedCronExpression,
+    firstFireMs: number,
+    nowMs: number,
+  ): { count: number; lastDueMs: number } {
+    let count = 1;
+    let cursor = firstFireMs;
+    let lastDueMs = firstFireMs;
+    while (count < MAX_COALESCE_ITERATIONS) {
+      const next = computeNextCronRun(parsed, cursor);
+      if (next === null) break;
+      if (next > nowMs) break;
+      // The scheduler delivers at the jittered time, not the ideal
+      // one. Counting an ideal fire whose jitter pushes its delivery
+      // past `nowMs` would leak the occurrence — the caller advances
+      // `lastSeenAt` past it and the next tick can never re-pick it.
+      const jitteredNext =
+        task.recurring === false
+          ? oneShotJitteredNextCronRunMs(task, next)
+          : jitteredNextCronRunMs(task, parsed, next);
+      if (jitteredNext > nowMs) break;
+      count++;
+      cursor = next;
+      lastDueMs = next;
+    }
+    return { count, lastDueMs };
+  }
+
+  function tick(): void {
+    if (isKilled?.() === true) return;
+    if (!isIdle()) return;
+
+    const tasks = source();
+    if (tasks.length === 0) return;
+
+    const now = clocks.wallNow();
+
+    // We clear inFlight at the end of the tick; entry-time defence
+    // against re-entry handled by the `inFlight.has(id)` skip below.
+    try {
+      for (const task of tasks) {
+        try {
+          if (inFlight.has(task.id)) continue;
+
+          const parsed = getParsed(task.cron);
+
+          // Base from which to compute the next ideal fire. For a
+          // freshly-added task this is its createdAt; once we've fired
+          // (or seen it pass), bump to the wall clock at that moment
+          // so we don't double-count the same fire on the next tick.
+          const seen = lastSeenAt.get(task.id);
+          const baseFromMs =
+            seen !== undefined && seen > task.createdAt ? seen : task.createdAt;
+
+          const nextFireAt = computeJitteredNext(task, parsed, baseFromMs);
+          if (nextFireAt === null) continue;
+
+          if (now < nextFireAt) continue;
+
+          // Due — compute coalescedCount starting from the first
+          // ideal fire (not the jittered one — jitter only shifts the
+          // delivery point, not the underlying schedule). One-shot
+          // tasks are removed after a single delivery and must always
+          // report `coalescedCount: 1`; multi-occurrence semantics
+          // make no sense for "remind me at X" reminders that were
+          // simply slept-through.
+          const ideal = computeNextCronRun(parsed, baseFromMs);
+          let coalescedCount = 1;
+          let lastDueMs: number | null = null;
+          if (task.recurring !== false && ideal !== null) {
+            const result = countCoalesced(task, parsed, ideal, now);
+            coalescedCount = Math.max(1, result.count);
+            lastDueMs = result.lastDueMs;
+          }
+
+          inFlight.add(task.id);
+          let delivered = false;
+          try {
+            onFire(task, { coalescedCount });
+            delivered = true;
+          } catch (error) {
+            debugLog(
+              `onFire threw for task ${task.id}: ${
+                error instanceof Error ? error.message : String(error)
+              }`,
+            );
+          }
+
+          if (!delivered) {
+            // Leave lastSeenAt/store untouched — next tick will
+            // re-detect this task as due. A persistently-throwing
+            // onFire becomes loud retry rather than silent loss; the
+            // manager is the layer responsible for ironing out
+            // persistence-level failures so they don't reach here.
+            continue;
+          }
+
+          if (task.recurring === false) {
+            // One-shot: ask the caller to remove and drop our memory of it.
+            try {
+              removeOneShot?.(task.id);
+            } catch (error) {
+              debugLog(
+                `removeOneShot threw for task ${task.id}: ${
+                  error instanceof Error ? error.message : String(error)
+                }`,
+              );
+            }
+            lastSeenAt.delete(task.id);
+          } else {
+            // Recurring: advance the baseline to the last ideal fire
+            // whose jittered delivery has actually completed (or to
+            // `now` if no ideal fires were enumerated). Using the
+            // *delivered* timestamp — rather than `now` — keeps any
+            // later ideal fire whose jitter pushes its delivery past
+            // `now` reachable on the next tick. If `lastDueMs` is
+            // null (degenerate cron / no enumerated ideal) we fall
+            // back to `now`, matching the original behaviour.
+            lastSeenAt.set(task.id, lastDueMs ?? now);
+          }
+        } catch (error) {
+          // A single bad task must not stop the rest of the loop.
+          debugLog(
+            `tick failed for task ${task.id}: ${
+              error instanceof Error ? error.message : String(error)
+            }`,
+          );
+        }
+      }
+    } finally {
+      // onFire is synchronous so re-entrant ticks within the same
+      // call stack are the only thing inFlight defends against. Clear
+      // at end-of-tick to keep the invariant simple.
+      inFlight.clear();
+    }
+  }
+
+  function start(): void {
+    if (timerHandle !== null) return;
+
+    const interval =
+      pollIntervalMs === undefined ? DEFAULT_POLL_INTERVAL_MS : pollIntervalMs;
+    // 0 and null both mean "no automatic polling".
+    if (interval === null || interval === 0) return;
+
+    const handle = setInterval(tick, interval);
+    // Don't keep the event loop alive on the scheduler alone — the
+    // user's REPL / agent owns lifetime.
+    if (typeof handle === 'object' && handle !== null && 'unref' in handle) {
+      (handle as { unref: () => void }).unref();
+    }
+    timerHandle = handle;
+  }
+
+  async function stop(): Promise<void> {
+    if (timerHandle !== null) {
+      clearInterval(timerHandle);
+      timerHandle = null;
+    }
+    inFlight.clear();
+    lastSeenAt.clear();
+    parsedCache.clear();
+    // Async signature for forward compatibility with Phase 2 (file
+    // I/O cleanup, lock release). Session-only resolves immediately.
+  }
+
+  function nextFireFor(task: CronTask): number | null {
+    try {
+      const parsed = getParsed(task.cron);
+      const seen = lastSeenAt.get(task.id);
+      const baseFromMs =
+        seen !== undefined && seen > task.createdAt ? seen : task.createdAt;
+      return computeJitteredNext(task, parsed, baseFromMs);
+    } catch (error) {
+      debugLog(
+        `getNextFireFor skipping task ${task.id}: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+      return null;
+    }
+  }
+
+  function getNextFireTime(): number | null {
+    const tasks = source();
+    if (tasks.length === 0) return null;
+
+    let min: number | null = null;
+    for (const task of tasks) {
+      const next = nextFireFor(task);
+      if (next === null) continue;
+      if (min === null || next < min) min = next;
+    }
+    return min;
+  }
+
+  function getNextFireForTask(taskId: string): number | null {
+    const tasks = source();
+    const task = tasks.find((t) => t.id === taskId);
+    if (task === undefined) return null;
+    return nextFireFor(task);
+  }
+
+  return {
+    start,
+    stop,
+    tick,
+    getNextFireTime,
+    getNextFireForTask,
+  };
+}
diff --git a/packages/agent-core/src/tools/cron/session-store.ts b/packages/agent-core/src/tools/cron/session-store.ts
new file mode 100644
index 0000000000..99484efb29
--- /dev/null
+++ b/packages/agent-core/src/tools/cron/session-store.ts
@@ -0,0 +1,115 @@
+/**
+ * SessionCronStore — in-memory cron task store for a single CLI session.
+ *
+ * Tasks added here live only for the lifetime of the current process;
+ * on exit they vanish. There is no on-disk persistence in this build.
+ *
+ * The store is intentionally clock-agnostic: it does NOT call
+ * `Date.now()` itself. Callers pass `nowMs` (which the cron manager
+ * sources from `ClockSources.wallNow()`), so injected clocks in tests
+ * and benches stay authoritative. The `no-date-now` guard does not
+ * currently list this file, but the discipline matches.
+ *
+ * Insertion order is preserved by relying on `Map` iteration order —
+ * callers (CronList, scheduler `source: () => CronTask[]`) want a
+ * stable ordering that matches the user's mental model of "the one I
+ * added first comes first".
+ */
+
+import { randomBytes } from 'node:crypto';
+
+import type { CronTask } from './types';
+
+/**
+ * Input to {@link SessionCronStore.add}: everything the caller supplies,
+ * minus `id` and `createdAt` which the store generates.
+ */
+export type SessionCronTaskInit = Omit<CronTask, 'id' | 'createdAt'>;
+
+/** Matches the canonical cron task id shape (8 lower-hex chars). */
+const ID_REGEX = /^[0-9a-f]{8}$/;
+
+/**
+ * Upper bound on id-collision retries. With 32 bits of entropy and at
+ * most a few dozen live tasks per session, the probability of even one
+ * collision is on the order of 1e-8. Eight attempts is a hard ceiling
+ * to surface a real bug (e.g. PRNG degeneration) rather than silently
+ * spinning.
+ */
+const MAX_ID_ATTEMPTS = 8;
+
+export class SessionCronStore {
+  /**
+   * Backing map. `Map` preserves insertion order in JS, which we rely on
+   * for {@link list}.
+   */
+  private readonly tasks = new Map<string, CronTask>();
+
+  /**
+   * Generate a fresh 8-hex id and add the task. `createdAt` is set to
+   * the supplied `nowMs` — the store never reads its own clock.
+   *
+   * Throws if the PRNG fails to produce an unused id within
+   * {@link MAX_ID_ATTEMPTS} attempts. That should be unreachable in
+   * practice; surfacing it as a throw beats silently retrying forever.
+   */
+  add(init: SessionCronTaskInit, nowMs: number): CronTask {
+    const id = this.generateUniqueId();
+    const task: CronTask = {
+      ...init,
+      id,
+      createdAt: nowMs,
+    };
+    this.tasks.set(id, task);
+    return task;
+  }
+
+  /** Returns the task or `undefined`. */
+  get(id: string): CronTask | undefined {
+    return this.tasks.get(id);
+  }
+
+  /**
+   * Snapshot in insertion order. Returns a fresh array on every call —
+   * callers may mutate the returned array without affecting the store,
+   * and successive calls return distinct array references.
+   */
+  list(): readonly CronTask[] {
+    return Array.from(this.tasks.values());
+  }
+
+  /**
+   * Remove the given ids. Returns the subset that were actually present
+   * (so the caller can detect already-missing ids and report them).
+   * Order of the returned ids follows the input order, not insertion
+   * order.
+   */
+  remove(ids: readonly string[]): readonly string[] {
+    const removed: string[] = [];
+    for (const id of ids) {
+      if (this.tasks.delete(id)) {
+        removed.push(id);
+      }
+    }
+    return removed;
+  }
+
+  /** Empty the store. Convenience for tests / shutdown. */
+  clear(): void {
+    this.tasks.clear();
+  }
+
+  private generateUniqueId(): string {
+    for (let attempt = 0; attempt < MAX_ID_ATTEMPTS; attempt++) {
+      const candidate = randomBytes(4).toString('hex');
+      // randomBytes(4).toString('hex') is always 8 lowercase hex chars,
+      // so the regex check is belt-and-braces against future refactors
+      // that swap the id source.
+      if (!ID_REGEX.test(candidate)) continue;
+      if (!this.tasks.has(candidate)) return candidate;
+    }
+    throw new Error(
+      `SessionCronStore: failed to generate a unique 8-hex id after ${MAX_ID_ATTEMPTS} attempts`,
+    );
+  }
+}
diff --git a/packages/agent-core/src/tools/cron/telemetry-events.ts b/packages/agent-core/src/tools/cron/telemetry-events.ts
new file mode 100644
index 0000000000..2f88afd9eb
--- /dev/null
+++ b/packages/agent-core/src/tools/cron/telemetry-events.ts
@@ -0,0 +1,11 @@
+/** Telemetry event names emitted by the cron subsystem. Centralised so a typo can't drift a metric. */
+export const CRON_SCHEDULED = 'cron_scheduled' as const;
+export const CRON_FIRED = 'cron_fired' as const;
+export const CRON_MISSED = 'cron_missed' as const;
+export const CRON_DELETED = 'cron_deleted' as const;
+
+export type CronTelemetryEvent =
+  | typeof CRON_SCHEDULED
+  | typeof CRON_FIRED
+  | typeof CRON_MISSED
+  | typeof CRON_DELETED;
diff --git a/packages/agent-core/src/tools/cron/types.ts b/packages/agent-core/src/tools/cron/types.ts
new file mode 100644
index 0000000000..5d303598ec
--- /dev/null
+++ b/packages/agent-core/src/tools/cron/types.ts
@@ -0,0 +1,25 @@
+/**
+ * Persistent representation of a cron task.
+ *
+ *   - `id` — 8-hex; jitter is keyed off this hash, so stable id == stable
+ *     jitter across schedule rewrites.
+ *   - `cron` — 5-field expression, evaluated in local time.
+ *   - `createdAt` — wall-clock epoch ms at original scheduling. NOT updated
+ *     when the scheduler fires; recurring uses `max(createdAt, now)` to
+ *     re-derive `nextFireAt` after restart. `createdAt` is also the input
+ *     to the 7-day stale judgment.
+ *   - `recurring` — undefined / true means "fire repeatedly until deleted
+ *     or auto-expired"; false means "fire once then auto-delete".
+ *
+ * Notably absent: `lastFiredAt`. Persisting last-fire would let a fast
+ * restart skip a legitimately-due fire because the stored timestamp says
+ * "fired recently". Coalesce semantics make missing one fire across a
+ * restart acceptable; missing one fire because of bad bookkeeping is not.
+ */
+export interface CronTask {
+  readonly id: string;
+  readonly cron: string;
+  readonly prompt: string;
+  readonly createdAt: number;
+  readonly recurring?: boolean;
+}
diff --git a/packages/agent-core/test/agent/context.test.ts b/packages/agent-core/test/agent/context.test.ts
index 406183bfa2..0b5587d673 100644
--- a/packages/agent-core/test/agent/context.test.ts
+++ b/packages/agent-core/test/agent/context.test.ts
@@ -555,6 +555,24 @@ describe('Agent context notification projection', () => {
     expect(textOf(messages[0]!)).toContain('Task done');
     expect(textOf(messages[1]!)).toBe('Actual user prompt');
   });
+
+  it('does not merge a cron-fire envelope into an adjacent user message', () => {
+    // Cron fires arrive as user-role messages whose text starts with
+    // `<cron-fire `. `mergeAdjacentUserMessages` must treat them like
+    // <notification>/<system-reminder>/<hook_result> and keep them in
+    // separate messages — otherwise the envelope XML smears into a
+    // real user turn and confuses the LLM about where the system
+    // annotation ends.
+    const cronEnvelope =
+      '<cron-fire jobId="deadbeef" cron="*/5 * * * *" recurring="true" coalescedCount="1" stale="false">\n<prompt>\ncheck the deploy\n</prompt>\n</cron-fire>';
+    const messages = project([
+      userMessage(cronEnvelope),
+      userMessage('Actual follow-up from the user'),
+    ]);
+    expect(messages).toHaveLength(2);
+    expect(textOf(messages[0]!)).toBe(cronEnvelope);
+    expect(textOf(messages[1]!)).toBe('Actual follow-up from the user');
+  });
 });
 
 function userMessage(text: string): Message {
diff --git a/packages/agent-core/test/agent/cron/agent-integration.test.ts b/packages/agent-core/test/agent/cron/agent-integration.test.ts
new file mode 100644
index 0000000000..b8955185a5
--- /dev/null
+++ b/packages/agent-core/test/agent/cron/agent-integration.test.ts
@@ -0,0 +1,81 @@
+/**
+ * Agent + cron wiring smoke: verifies `new Agent(...)` constructs and
+ * starts a CronManager, registers the three cron tools, and that
+ * `KIMI_DISABLE_CRON=1` short-circuits `CronCreate`.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import {
+  CronCreateTool,
+  type CronCreateInput,
+} from '../../../src/tools/cron/cron-create';
+import { testAgent, type AgentTestContext } from '../harness/agent';
+
+describe('Agent + Cron integration (P1.7)', () => {
+  let ctx: AgentTestContext;
+
+  beforeEach(() => {
+    ctx = testAgent();
+    // `configure({ tools: [...] })` triggers `agent.config.update(...)`,
+    // which is the only path that calls `initializeBuiltinTools()`.
+    // Listing all three cron tools turns them on in `enabledTools` so
+    // `agent.tools.data()[i].active` is true — useful for callers that
+    // want to confirm the model would actually see the tool, not just
+    // that we registered it.
+    ctx.configure({ tools: ['CronCreate', 'CronList', 'CronDelete'] });
+  });
+
+  afterEach(async () => {
+    await ctx.agent.cron.stop();
+    vi.unstubAllEnvs();
+  });
+
+  it('exposes agent.cron with its session store on construction', () => {
+    expect(ctx.agent.cron).toBeDefined();
+    expect(ctx.agent.cron.store).toBeDefined();
+    expect(ctx.agent.cron.store.list()).toEqual([]);
+  });
+
+  it('registers CronCreate / CronList / CronDelete in the tool manager', () => {
+    const toolNames = ctx.agent.tools.data().map((info) => info.name);
+    expect(toolNames).toContain('CronCreate');
+    expect(toolNames).toContain('CronList');
+    expect(toolNames).toContain('CronDelete');
+
+    // All three came in through the builtin barrel.
+    for (const name of ['CronCreate', 'CronList', 'CronDelete'] as const) {
+      const info = ctx.agent.tools.data().find((i) => i.name === name);
+      expect(info?.source).toBe('builtin');
+      expect(info?.active).toBe(true);
+    }
+  });
+
+  it('KIMI_DISABLE_CRON=1 short-circuits CronCreate with a disabled error', () => {
+    vi.stubEnv('KIMI_DISABLE_CRON', '1');
+
+    // We construct a fresh CronCreateTool against the agent's cron
+    // manager rather than driving a full tool-dispatch loop — the
+    // killswitch lives in `resolveExecution`, so a direct call is the
+    // precise unit being asserted, and it stays robust if the loop /
+    // dispatch surface changes around it (P1.8 onwards).
+    const tool = new CronCreateTool(ctx.agent.cron);
+    const args: CronCreateInput = {
+      cron: '*/5 * * * *',
+      prompt: 'x',
+      recurring: true,
+    };
+    const result = tool.resolveExecution(args);
+
+    // resolveExecution returns a `ToolExecution` — when it errors
+    // up-front the shape is `{ isError: true, output: string }` with no
+    // `execute` callback (see CronCreate's killswitch branch).
+    expect(result).toMatchObject({ isError: true });
+    expect('output' in result ? result.output : '').toMatch(/disabled/i);
+    expect('execute' in result ? typeof result.execute : 'no-execute').toBe(
+      'no-execute',
+    );
+
+    // And no task slipped into the store.
+    expect(ctx.agent.cron.store.list()).toEqual([]);
+  });
+});
diff --git a/packages/agent-core/test/agent/cron/cron.e2e.test.ts b/packages/agent-core/test/agent/cron/cron.e2e.test.ts
new file mode 100644
index 0000000000..7d8aa20e03
--- /dev/null
+++ b/packages/agent-core/test/agent/cron/cron.e2e.test.ts
@@ -0,0 +1,207 @@
+/**
+ * Session-level cron end-to-end smoke: exercises the full
+ * `CronCreateTool → SessionCronStore → CronScheduler → CronManager →
+ * agent.turn.steer` pipeline through the real `AgentTestContext`,
+ * with a swapped CronManager wired to an injected clock so the
+ * `coalescedCount = 3` calibration after a 15-minute advance is
+ * deterministic regardless of host TZ.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { CronManager } from '../../../src/agent/cron';
+import { CronCreateTool } from '../../../src/tools/cron/cron-create';
+import { CronDeleteTool } from '../../../src/tools/cron/cron-delete';
+import { CronListTool } from '../../../src/tools/cron/cron-list';
+import type { ExecutableToolOutput } from '../../../src/loop/types';
+import { testAgent, type AgentTestContext } from '../harness/agent';
+import { createClocks } from './harness/stub';
+
+// Local-time anchor (cron-expr matches on local fields, so a UTC anchor
+// would shift the result by the host's offset). At noon + 15 min the
+// `*\/5 * * * *` ideal fires are 12:05/12:10/12:15 → coalescedCount=3.
+const LOCAL_ANCHOR_MS = new Date(2024, 5, 1, 12, 0, 0, 0).getTime();
+
+/**
+ * Coerce an `ExecutableToolOutput` (string | ContentPart[]) into a
+ * single string. The cron tools always return a string body, but the
+ * union forces us to handle the structured-content path — JSON keeps
+ * future-tool assertions safe and the `no-base-to-string` rule happy.
+ */
+function outputText(out: ExecutableToolOutput): string {
+  return typeof out === 'string' ? out : JSON.stringify(out);
+}
+
+describe('Cron — session E2E (P1.9)', () => {
+  let ctx: AgentTestContext;
+
+  beforeEach(() => {
+    // Pin jitter off so the recurring fire lands at the ideal 12:05:00
+    // mark (not 12:05:00 + up-to-30s) and the 15-minute advance is more
+    // than enough to clear it. Note: `coalescedCount` is computed from
+    // the unjittered schedule, so jitter has no effect on the count
+    // itself — this flag is belt-and-braces against any future refactor
+    // that widens the jitter window past 10 minutes.
+    vi.stubEnv('KIMI_CRON_NO_JITTER', '1');
+    ctx = testAgent();
+  });
+
+  afterEach(async () => {
+    // The harness's `onTestFinished` cleanup already calls
+    // `agent.cron.stop()`, but doing it here as well keeps the test
+    // self-contained against future harness changes and ensures the
+    // SIGUSR1 handler (if any) is unbound before the next test.
+    await ctx.agent.cron.stop();
+    vi.unstubAllEnvs();
+  });
+
+  it('recurring */5 task advances 15min → exactly one steer with coalescedCount=3', async () => {
+    // Swap the auto-built CronManager (which uses SYSTEM_CLOCKS) for one
+    // bound to our mock clock. The `as any` cast is the documented
+    // test-only escape hatch — Agent.cron is `readonly` precisely
+    // because production code must never overwrite it; tests are the
+    // only legitimate exception.
+    await ctx.agent.cron.stop();
+    const harness = createClocks(LOCAL_ANCHOR_MS);
+    (ctx.agent as unknown as { cron: CronManager }).cron = new CronManager(
+      ctx.agent,
+      {
+        clocks: harness.clocks,
+        // `null` → no setInterval; we drive `tick()` ourselves to keep
+        // the test free of timing races.
+        pollIntervalMs: null,
+      },
+    );
+    ctx.agent.cron.start();
+
+    // Spy on agent.turn.steer. We wrap rather than replace so the real
+    // steer logic still runs (and the `turn.steer` record is written /
+    // a turn is launched against the scripted-generate harness). A pure
+    // replacement would silence interesting failure modes — e.g. a
+    // regression that emits the wrong record type but still calls
+    // handleFire.
+    const steerCalls: Array<{
+      readonly content: readonly unknown[];
+      readonly origin: unknown;
+    }> = [];
+    const originalSteer = ctx.agent.turn.steer.bind(ctx.agent.turn);
+    (ctx.agent.turn as unknown as { steer: typeof ctx.agent.turn.steer }).steer =
+      (content, origin) => {
+        steerCalls.push({ content, origin });
+        return originalSteer(content, origin);
+      };
+
+    // Schedule via the full tool surface — the scheduling path goes
+    // through validation (parse, 5-year window, cap, byte length) just
+    // like the LLM-driven path. A back-door `store.add(...)` would
+    // bypass `emitScheduled` telemetry and skip the byte-length /
+    // expression checks; that would not be the production code path
+    // this commit is meant to smoke.
+    const createTool = new CronCreateTool(ctx.agent.cron);
+    const execution = createTool.resolveExecution({
+      cron: '*/5 * * * *',
+      prompt: 'cron-fired prompt',
+      recurring: true,
+    });
+    if (execution.isError === true) {
+      throw new Error(
+        `CronCreate unexpectedly errored: ${outputText(execution.output)}`,
+      );
+    }
+    const createResult = await execution.execute({
+      turnId: 'p19-turn',
+      toolCallId: 'p19-call',
+      signal: new AbortController().signal,
+    });
+    expect(createResult.isError ?? false).toBe(false);
+    expect(ctx.agent.cron.store.list().length).toBe(1);
+
+    // Advance 15 minutes — exactly three ideal */5 fires across the gap
+    // (12:05, 12:10, 12:15). See the file header for the calibration
+    // derivation.
+    harness.advance(15 * 60_000);
+    ctx.agent.cron.tick();
+
+    // ── Steer was called exactly once ─────────────────────────────────
+    expect(steerCalls.length).toBe(1);
+    const fire = steerCalls[0]!;
+
+    // ── Content carries the user prompt wrapped in the cron-fire envelope ─
+    expect(fire.content).toHaveLength(1);
+    const fireText = (fire.content[0] as { type: 'text'; text: string }).text;
+    expect(fireText).toContain('<cron-fire ');
+    expect(fireText).toContain('cron-fired prompt');
+
+    // ── Origin carries the full CronJobOrigin contract ───────────────
+    expect(fire.origin).toMatchObject({
+      kind: 'cron_job',
+      cron: '*/5 * * * *',
+      recurring: true,
+      coalescedCount: 3,
+      stale: false,
+    });
+    // jobId comes back as the same 8-hex shape the store guarantees.
+    const origin = fire.origin as { readonly jobId: string };
+    expect(typeof origin.jobId).toBe('string');
+    expect(origin.jobId).toMatch(/^[0-9a-f]{8}$/);
+  });
+
+  it('CronCreate → CronList → CronDelete cycle returns sensible output', async () => {
+    // Optional second case from the P1.9 plan: prove the three-tool
+    // surface composes correctly end-to-end on the real manager. No
+    // clock manipulation needed — list/delete are time-invariant.
+    const createTool = new CronCreateTool(ctx.agent.cron);
+    const listTool = new CronListTool(ctx.agent.cron);
+    const deleteTool = new CronDeleteTool(ctx.agent.cron);
+    const ctxArgs = {
+      turnId: 'p19-tools',
+      toolCallId: 'p19-tools-call',
+      signal: new AbortController().signal,
+    };
+
+    // 1. Create.
+    const createExec = createTool.resolveExecution({
+      cron: '*/10 * * * *',
+      prompt: 'noop',
+      recurring: true,
+    });
+    if (createExec.isError === true) {
+      throw new Error(`CronCreate failed: ${outputText(createExec.output)}`);
+    }
+    const createOut = await createExec.execute(ctxArgs);
+    expect(createOut.isError ?? false).toBe(false);
+    const idMatch = /id:\s*([0-9a-f]{8})/.exec(outputText(createOut.output));
+    expect(idMatch).not.toBeNull();
+    const id = idMatch![1]!;
+
+    // 2. List — should show one record carrying the id we just got.
+    const listExec = listTool.resolveExecution({});
+    if (listExec.isError === true) {
+      throw new Error(`CronList failed: ${outputText(listExec.output)}`);
+    }
+    const listOut = await listExec.execute(ctxArgs);
+    expect(listOut.isError ?? false).toBe(false);
+    const listText = outputText(listOut.output);
+    expect(listText).toContain('cron_jobs: 1');
+    expect(listText).toContain(`id: ${id}`);
+    expect(listText).toContain('cron: */10 * * * *');
+
+    // 3. Delete the task we just created.
+    const deleteExec = deleteTool.resolveExecution({ id });
+    if (deleteExec.isError === true) {
+      throw new Error(`CronDelete failed: ${outputText(deleteExec.output)}`);
+    }
+    const deleteOut = await deleteExec.execute(ctxArgs);
+    expect(deleteOut.isError ?? false).toBe(false);
+    expect(outputText(deleteOut.output)).toContain(`Deleted cron job ${id}`);
+
+    // 4. List again — empty.
+    const listExec2 = listTool.resolveExecution({});
+    if (listExec2.isError === true) {
+      throw new Error(`CronList failed: ${outputText(listExec2.output)}`);
+    }
+    const listOut2 = await listExec2.execute(ctxArgs);
+    expect(listOut2.isError ?? false).toBe(false);
+    expect(outputText(listOut2.output)).toContain('cron_jobs: 0');
+    expect(outputText(listOut2.output)).toContain('No cron jobs scheduled.');
+  });
+});
diff --git a/packages/agent-core/test/agent/cron/harness/stub.ts b/packages/agent-core/test/agent/cron/harness/stub.ts
new file mode 100644
index 0000000000..8e28e63b58
--- /dev/null
+++ b/packages/agent-core/test/agent/cron/harness/stub.ts
@@ -0,0 +1,123 @@
+/**
+ * Shared cron test stub: lightweight Agent stub + injectable ClockSources.
+ *
+ * Kept out of the broader `test/agent/harness/agent.ts` because cron unit
+ * tests only need three Agent surfaces (turn.hasActiveTurn, turn.steer,
+ * telemetry.track) and inflating them through `testAgent()` would drag
+ * kosong / records / context into every unit-level assertion.
+ */
+import type { ContentPart } from '@moonshot-ai/kosong';
+
+import type { Agent } from '../../../../src/agent';
+import type { PromptOrigin } from '../../../../src/agent/context/types';
+import type { ClockSources } from '../../../../src/tools/cron/clock';
+
+/**
+ * Stable wall-clock anchor (Nov 14 2023, 22:13:20 UTC). Deliberately
+ * off any round minute so the next `*\/5 * * * *` ideal fire is not
+ * exactly five minutes ahead, exercising the strict-greater-than
+ * branch of `computeNextCronRun`.
+ */
+export const WALL_ANCHOR = 1_700_000_000_000;
+
+export interface SteerCall {
+  readonly content: readonly ContentPart[];
+  readonly origin: PromptOrigin;
+}
+
+export interface TelemetryCall {
+  readonly event: string;
+  readonly props: unknown;
+}
+
+export interface AgentStubOptions {
+  /** Initial value of `agent.turn.hasActiveTurn`. Default false (idle). */
+  readonly hasActiveTurn?: boolean;
+  /**
+   * Value returned by `agent.turn.steer`. Default 42. Explicit `null`
+   * encodes "input was buffered into the steer queue" (turn in flight).
+   */
+  readonly steerReturns?: number | null;
+}
+
+export interface AgentStub {
+  readonly agent: Agent;
+  readonly steerCalls: SteerCall[];
+  readonly telemetryCalls: TelemetryCall[];
+  setHasActiveTurn(v: boolean): void;
+}
+
+export function createAgentStub(opts: AgentStubOptions = {}): AgentStub {
+  const steerCalls: SteerCall[] = [];
+  const telemetryCalls: TelemetryCall[] = [];
+  let hasActiveTurn = opts.hasActiveTurn ?? false;
+  // `?? 42` would collapse explicit `null` (buffered) into 42, so probe
+  // the property's presence instead of relying on nullish coalescing.
+  const steerReturns: number | null =
+    'steerReturns' in opts ? (opts.steerReturns as number | null) : 42;
+
+  const turn = {
+    get hasActiveTurn(): boolean {
+      return hasActiveTurn;
+    },
+    steer: (content: readonly ContentPart[], origin: PromptOrigin) => {
+      steerCalls.push({ content, origin });
+      return steerReturns;
+    },
+  };
+  const telemetry = {
+    track: (event: string, props: unknown) => {
+      telemetryCalls.push({ event, props });
+    },
+  };
+  const agent = { turn, telemetry } as unknown as Agent;
+  return {
+    agent,
+    steerCalls,
+    telemetryCalls,
+    setHasActiveTurn: (v: boolean) => {
+      hasActiveTurn = v;
+    },
+  };
+}
+
+export interface ClockHarness {
+  readonly clocks: ClockSources;
+  /** Set wall + mono to a specific epoch ms. */
+  setNow(v: number): void;
+  /** Advance wall + mono by `ms`. */
+  advance(ms: number): void;
+  /** Current wall-clock value. */
+  now(): number;
+}
+
+export function createClocks(initial: number = WALL_ANCHOR): ClockHarness {
+  let wall = initial;
+  let mono = 1_000_000;
+  return {
+    clocks: {
+      wallNow: () => wall,
+      monoNowMs: () => mono,
+    },
+    setNow: (v) => {
+      wall = v;
+      mono = v;
+    },
+    advance: (ms) => {
+      wall += ms;
+      mono += ms;
+    },
+    now: () => wall,
+  };
+}
+
+/**
+ * Normalise non-deterministic fields out of a cron tool's output so it
+ * can be fed to `toMatchInlineSnapshot`. Replaces randomly-generated
+ * 8-hex ids and ISO timestamps with stable placeholders.
+ */
+export function scrubCronOutput(out: string): string {
+  return out
+    .replaceAll(/\b[0-9a-f]{8}\b/g, '<id>')
+    .replaceAll(/\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z/g, '<iso>');
+}
diff --git a/packages/agent-core/test/agent/cron/manager.test.ts b/packages/agent-core/test/agent/cron/manager.test.ts
new file mode 100644
index 0000000000..fa5fc8ffe3
--- /dev/null
+++ b/packages/agent-core/test/agent/cron/manager.test.ts
@@ -0,0 +1,452 @@
+/**
+ * Tests for `agent/cron/manager.ts`. Uses a lightweight Agent stub
+ * (see ./harness/stub) — only the three surfaces the manager touches
+ * (turn.hasActiveTurn, turn.steer, telemetry.track) need to look real.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import type { ContentPart } from '@moonshot-ai/kosong';
+
+import { CronManager } from '../../../src/agent/cron/manager';
+import type { ClockSources } from '../../../src/tools/cron/clock';
+import {
+  CRON_FIRED,
+  CRON_MISSED,
+} from '../../../src/tools/cron/telemetry-events';
+import type { CronTask } from '../../../src/tools/cron/types';
+import {
+  createAgentStub,
+  createClocks,
+  WALL_ANCHOR,
+} from './harness/stub';
+
+const ONE_DAY_MS = 24 * 60 * 60 * 1000;
+
+describe('CronManager', () => {
+  beforeEach(() => {
+    // Pin jitter off so fire-count assertions are deterministic. Each
+    // test that actually exercises fires resets the env via stubEnv,
+    // but setting it here as well shields the construction-path tests
+    // from any leaked state.
+    vi.stubEnv('KIMI_CRON_NO_JITTER', '1');
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  describe('construction', () => {
+    it('does not throw with default clocks and supports start/stop', async () => {
+      const { agent } = createAgentStub();
+      // Disable the auto-tick timer so the test doesn't have to wait
+      // for setInterval / clean it up; we just want start() and stop()
+      // to be wired and idempotent.
+      const manager = new CronManager(agent, { pollIntervalMs: null });
+      expect(() => manager.start()).not.toThrow();
+      expect(() => manager.start()).not.toThrow(); // idempotent
+      await expect(manager.stop()).resolves.toBeUndefined();
+      await expect(manager.stop()).resolves.toBeUndefined();
+    });
+
+    it('exposes the session store as an empty list on construction', () => {
+      const { agent } = createAgentStub();
+      const manager = new CronManager(agent, { pollIntervalMs: null });
+      expect(manager.store.list()).toEqual([]);
+      expect(manager.getNextFireTime()).toBeNull();
+    });
+
+    it('getNextFireForTask delegates to the scheduler', () => {
+      const { agent } = createAgentStub();
+      const manager = new CronManager(agent, { pollIntervalMs: null });
+      const scheduler = (manager as unknown as {
+        scheduler: { getNextFireForTask: (id: string) => number | null };
+      }).scheduler;
+      const spy = vi.spyOn(scheduler, 'getNextFireForTask').mockReturnValue(123);
+      expect(manager.getNextFireForTask('deadbeef')).toBe(123);
+      expect(spy).toHaveBeenCalledWith('deadbeef');
+    });
+  });
+
+  describe('handleFire — recurring', () => {
+    it('steers with cron_job origin and emits cron_fired telemetry', () => {
+      const stub = createAgentStub({ steerReturns: 7 });
+      const harness = createClocks();
+      const manager = new CronManager(stub.agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: null,
+      });
+
+      manager.store.add(
+        { cron: '*/5 * * * *', prompt: 'check the deploy' },
+        harness.now() - 1,
+      );
+      // `*/5 * * * *` lands every 5 minutes; bump 6 minutes so we are
+      // safely past exactly one ideal fire.
+      harness.advance(6 * 60_000);
+      manager.tick();
+
+      expect(stub.steerCalls.length).toBe(1);
+      const call = stub.steerCalls[0]!;
+      expect(call.origin.kind).toBe('cron_job');
+      if (call.origin.kind !== 'cron_job') throw new Error('unreachable');
+      expect(call.origin.recurring).toBe(true);
+      expect(call.origin.stale).toBe(false);
+      expect(call.origin.coalescedCount).toBeGreaterThanOrEqual(1);
+      expect(call.origin.cron).toBe('*/5 * * * *');
+      expect(call.origin.jobId).toMatch(/^[0-9a-f]{8}$/);
+      // Content is wrapped in the cron-fire envelope (Bug A fix).
+      expect(call.content).toHaveLength(1);
+      const text = (call.content[0] as { type: 'text'; text: string }).text;
+      expect(text).toContain('<cron-fire ');
+      expect(text).toContain('<prompt>\ncheck the deploy\n</prompt>');
+      // Exactly one envelope — guards against an accidental double-wrap
+      // (e.g. handleFire calling renderCronFireXml on already-rendered
+      // content from a future refactor).
+      expect((text.match(/<cron-fire /g) ?? []).length).toBe(1);
+
+      expect(stub.telemetryCalls.length).toBe(1);
+      const tc = stub.telemetryCalls[0]!;
+      expect(tc.event).toBe(CRON_FIRED);
+      expect(tc.props).toMatchObject({
+        recurring: true,
+        stale: false,
+        buffered: false,
+      });
+    });
+  });
+
+  describe('handleFire — one-shot', () => {
+    it('uses recurring=false in origin and telemetry', () => {
+      const stub = createAgentStub();
+      const harness = createClocks();
+      const manager = new CronManager(stub.agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: null,
+      });
+
+      // Add a one-shot task that fires at the very next */5 mark, then
+      // advance the wall clock past it.
+      const task = manager.store.add(
+        {
+          cron: '*/5 * * * *',
+          prompt: 'one-shot ping',
+          recurring: false,
+        },
+        harness.now() - 1,
+      );
+      harness.advance(6 * 60_000);
+      manager.tick();
+
+      expect(stub.steerCalls.length).toBe(1);
+      const origin = stub.steerCalls[0]!.origin;
+      expect(origin.kind).toBe('cron_job');
+      if (origin.kind !== 'cron_job') throw new Error('unreachable');
+      expect(origin.recurring).toBe(false);
+      expect(origin.stale).toBe(false);
+      // Content carries the cron-fire envelope around the verbatim prompt.
+      const content = stub.steerCalls[0]!.content;
+      const text = (content[0] as { type: 'text'; text: string }).text;
+      expect(text).toContain('<cron-fire ');
+      expect(text).toContain('recurring="false"');
+      expect(text).toContain('<prompt>\none-shot ping\n</prompt>');
+
+      const tc = stub.telemetryCalls[0]!;
+      expect(tc.props).toMatchObject({ recurring: false });
+
+      // One-shot was removed from the store after fire.
+      expect(manager.store.get(task.id)).toBeUndefined();
+    });
+  });
+
+  describe('isStale', () => {
+    it('flags recurring tasks older than 7 days as stale', () => {
+      const { agent } = createAgentStub();
+      const harness = createClocks();
+      const manager = new CronManager(agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: null,
+      });
+
+      const task: CronTask = {
+        id: 'deadbeef',
+        cron: '0 9 * * *',
+        prompt: 'morning report',
+        createdAt: harness.now() - 8 * ONE_DAY_MS,
+        recurring: true,
+      };
+      expect(manager.isStale(task)).toBe(true);
+    });
+
+    it('does not flag recurring tasks younger than 7 days', () => {
+      const { agent } = createAgentStub();
+      const harness = createClocks();
+      const manager = new CronManager(agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: null,
+      });
+      const task: CronTask = {
+        id: 'deadbeef',
+        cron: '0 9 * * *',
+        prompt: 'morning report',
+        createdAt: harness.now() - 6 * ONE_DAY_MS,
+        recurring: true,
+      };
+      expect(manager.isStale(task)).toBe(false);
+    });
+
+    it('treats undefined recurring as recurring for stale purposes', () => {
+      const { agent } = createAgentStub();
+      const harness = createClocks();
+      const manager = new CronManager(agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: null,
+      });
+      const task: CronTask = {
+        id: 'deadbeef',
+        cron: '0 9 * * *',
+        prompt: 'morning report',
+        createdAt: harness.now() - 8 * ONE_DAY_MS,
+        // recurring intentionally omitted
+      };
+      expect(manager.isStale(task)).toBe(true);
+    });
+
+    it('one-shot tasks are never stale even if old', () => {
+      const { agent } = createAgentStub();
+      const harness = createClocks();
+      const manager = new CronManager(agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: null,
+      });
+      const task: CronTask = {
+        id: 'deadbeef',
+        cron: '0 9 * * *',
+        prompt: 'morning report',
+        createdAt: harness.now() - 8 * ONE_DAY_MS,
+        recurring: false,
+      };
+      expect(manager.isStale(task)).toBe(false);
+    });
+
+    it('KIMI_CRON_NO_STALE=1 disables stale judgment for recurring', () => {
+      vi.stubEnv('KIMI_CRON_NO_STALE', '1');
+      const { agent } = createAgentStub();
+      const harness = createClocks();
+      const manager = new CronManager(agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: null,
+      });
+      const task: CronTask = {
+        id: 'deadbeef',
+        cron: '0 9 * * *',
+        prompt: 'morning report',
+        createdAt: harness.now() - 8 * ONE_DAY_MS,
+        recurring: true,
+      };
+      expect(manager.isStale(task)).toBe(false);
+    });
+
+    it('non-finite age (broken clock) is treated as not stale', () => {
+      const { agent } = createAgentStub();
+      const brokenClocks: ClockSources = {
+        wallNow: () => Number.NaN,
+        monoNowMs: () => 0,
+      };
+      const manager = new CronManager(agent, {
+        clocks: brokenClocks,
+        pollIntervalMs: null,
+      });
+      const task: CronTask = {
+        id: 'deadbeef',
+        cron: '0 9 * * *',
+        prompt: 'morning report',
+        createdAt: 0,
+        recurring: true,
+      };
+      expect(manager.isStale(task)).toBe(false);
+    });
+  });
+
+  describe('stale propagation into fire origin', () => {
+    it('origin.stale === true for a recurring task older than 7 days', () => {
+      const stub = createAgentStub();
+      const harness = createClocks();
+      const manager = new CronManager(stub.agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: null,
+      });
+
+      // Add a recurring task whose createdAt is 8 days ago. Note: the
+      // scheduler uses createdAt as the starting baseline for next-fire
+      // computation, so a task that's been "alive" for 8 days will be
+      // very overdue and will coalesce a lot of fires into one. That's
+      // fine for this test — we only assert on `stale` (which is
+      // computed from createdAt vs now) and `coalescedCount >= 1`.
+      manager.store.add(
+        { cron: '0 9 * * *', prompt: 'morning report', recurring: true },
+        harness.now() - 8 * ONE_DAY_MS,
+      );
+      manager.tick();
+
+      expect(stub.steerCalls.length).toBe(1);
+      const origin = stub.steerCalls[0]!.origin;
+      if (origin.kind !== 'cron_job') throw new Error('expected cron_job');
+      expect(origin.stale).toBe(true);
+      expect(stub.telemetryCalls[0]!.props).toMatchObject({ stale: true });
+      // Rendered envelope carries the stale flag too.
+      const text = (stub.steerCalls[0]!.content[0] as {
+        type: 'text';
+        text: string;
+      }).text;
+      expect(text).toContain('stale="true"');
+    });
+
+    it('stale recurring tasks get one final fire and are then removed', () => {
+      // Mirrors the documented contract on `CronCreate.description`:
+      // recurring tasks auto-expire after 7 days — they fire one final
+      // time, then are deleted. Without this branch a session that
+      // stays up past the stale threshold keeps re-injecting an old
+      // cron prompt forever.
+      const stub = createAgentStub();
+      const harness = createClocks();
+      const manager = new CronManager(stub.agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: null,
+      });
+      manager.store.add(
+        { cron: '*/5 * * * *', prompt: 'stale-recurring', recurring: true },
+        harness.now() - 8 * ONE_DAY_MS,
+      );
+      expect(manager.store.list()).toHaveLength(1);
+
+      manager.tick();
+      expect(stub.steerCalls.length).toBe(1);
+      expect(manager.store.list()).toHaveLength(0);
+
+      // A `cron_deleted` event closes the lifecycle in telemetry,
+      // symmetric with manual `CronDelete` calls.
+      const events = stub.telemetryCalls.map((c) => c.event);
+      expect(events).toContain('cron_fired');
+      expect(events).toContain('cron_deleted');
+
+      // No further fires after the task is gone.
+      harness.advance(6 * 60_000);
+      manager.tick();
+      expect(stub.steerCalls.length).toBe(1);
+    });
+  });
+
+  describe('buffered semantics', () => {
+    it('reports buffered=true on the telemetry event when steer returns null', () => {
+      const stub = createAgentStub({ steerReturns: null });
+      const harness = createClocks();
+      const manager = new CronManager(stub.agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: null,
+      });
+      manager.store.add(
+        { cron: '*/5 * * * *', prompt: 'while-active' },
+        harness.now() - 1,
+      );
+      harness.advance(6 * 60_000);
+      manager.tick();
+
+      expect(stub.telemetryCalls.length).toBe(1);
+      expect(stub.telemetryCalls[0]!.props).toMatchObject({ buffered: true });
+    });
+  });
+
+  describe('idle gating', () => {
+    it('does not fire while a turn is active', () => {
+      const stub = createAgentStub({ hasActiveTurn: true });
+      const harness = createClocks();
+      const manager = new CronManager(stub.agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: null,
+      });
+      manager.store.add(
+        { cron: '*/5 * * * *', prompt: 'ping' },
+        harness.now() - 1,
+      );
+      harness.advance(6 * 60_000);
+      manager.tick();
+      expect(stub.steerCalls.length).toBe(0);
+      expect(stub.telemetryCalls.length).toBe(0);
+
+      // Flip back to idle and the next tick fires.
+      stub.setHasActiveTurn(false);
+      manager.tick();
+      expect(stub.steerCalls.length).toBe(1);
+    });
+  });
+
+  describe('end-to-end via scheduler', () => {
+    it('fires once with coalescedCount=1 after a 6-minute gap on */5', () => {
+      const stub = createAgentStub();
+      const harness = createClocks();
+      const manager = new CronManager(stub.agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: null,
+      });
+      manager.store.add(
+        { cron: '*/5 * * * *', prompt: 'every five' },
+        harness.now() - 1,
+      );
+      // Six minutes past the anchor — exactly one ideal fire in the gap.
+      harness.advance(6 * 60_000);
+      manager.tick();
+
+      expect(stub.steerCalls.length).toBe(1);
+      const origin = stub.steerCalls[0]!.origin;
+      if (origin.kind !== 'cron_job') throw new Error('expected cron_job');
+      expect(origin.coalescedCount).toBe(1);
+    });
+  });
+
+  describe('handleMissed', () => {
+    it('no-ops on an empty task list', () => {
+      const stub = createAgentStub();
+      const manager = new CronManager(stub.agent, { pollIntervalMs: null });
+      manager.handleMissed([], () => [{ type: 'text', text: 'should not run' }]);
+      expect(stub.steerCalls.length).toBe(0);
+      expect(stub.telemetryCalls.length).toBe(0);
+    });
+
+    it('steers cron_missed origin and emits cron_missed telemetry', () => {
+      const stub = createAgentStub();
+      const manager = new CronManager(stub.agent, { pollIntervalMs: null });
+
+      const tasks: CronTask[] = [
+        {
+          id: '11111111',
+          cron: '0 9 * * *',
+          prompt: 'a',
+          createdAt: 1,
+          recurring: false,
+        },
+        {
+          id: '22222222',
+          cron: '0 10 * * *',
+          prompt: 'b',
+          createdAt: 2,
+          recurring: false,
+        },
+      ];
+      const rendered: ContentPart[] = [
+        { type: 'text', text: 'You missed 2 one-shot tasks.' },
+      ];
+      manager.handleMissed(tasks, () => rendered);
+
+      expect(stub.steerCalls.length).toBe(1);
+      const call = stub.steerCalls[0]!;
+      expect(call.content).toBe(rendered);
+      expect(call.origin.kind).toBe('cron_missed');
+      if (call.origin.kind !== 'cron_missed') throw new Error('unreachable');
+      expect(call.origin.count).toBe(2);
+
+      expect(stub.telemetryCalls.length).toBe(1);
+      expect(stub.telemetryCalls[0]!.event).toBe(CRON_MISSED);
+      expect(stub.telemetryCalls[0]!.props).toEqual({ count: 2 });
+    });
+  });
+});
diff --git a/packages/agent-core/test/agent/cron/manual-tick.test.ts b/packages/agent-core/test/agent/cron/manual-tick.test.ts
new file mode 100644
index 0000000000..922506913d
--- /dev/null
+++ b/packages/agent-core/test/agent/cron/manual-tick.test.ts
@@ -0,0 +1,229 @@
+/**
+ * Tests for `agent/cron/manager.ts` P1.8 affordances: the
+ * `KIMI_CRON_MANUAL_TICK=1` env disables the auto-tick interval and,
+ * in the same gate, binds SIGUSR1 to a no-throw `tick()` for benches.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { CronManager } from '../../../src/agent/cron/manager';
+import { createAgentStub, createClocks } from './harness/stub';
+
+describe('CronManager — P1.8 manual tick + SIGUSR1', () => {
+  beforeEach(() => {
+    // Disable jitter so fire-count assertions are deterministic.
+    vi.stubEnv('KIMI_CRON_NO_JITTER', '1');
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+    vi.useRealTimers();
+  });
+
+  describe('KIMI_CRON_MANUAL_TICK=1', () => {
+    it('does not install setInterval; tick() must be called manually', async () => {
+      vi.stubEnv('KIMI_CRON_MANUAL_TICK', '1');
+
+      const stub = createAgentStub();
+      const harness = createClocks();
+      // Caller passes pollIntervalMs: 50 — but the env flag overrides
+      // it, so no auto-tick should run even after we wait real time.
+      const manager = new CronManager(stub.agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: 50,
+      });
+      try {
+        manager.start();
+
+        manager.store.add(
+          { cron: '*/5 * * * *', prompt: 'manual-only' },
+          harness.now() - 1,
+        );
+        harness.advance(6 * 60_000);
+
+        // Real-time wait: if an interval were registered, 50ms is more
+        // than enough to fire at least once. We do NOT use fake timers
+        // here because the whole point is to prove no timer exists.
+        await new Promise((r) => setTimeout(r, 50));
+        expect(stub.steerCalls.length).toBe(0);
+
+        // Manual drive → fires.
+        manager.tick();
+        expect(stub.steerCalls.length).toBe(1);
+      } finally {
+        await manager.stop();
+      }
+    });
+  });
+
+  describe('without KIMI_CRON_MANUAL_TICK', () => {
+    it('auto-tick fires when fake timers advance past pollIntervalMs', async () => {
+      // Fake timers must be in place BEFORE the manager calls
+      // setInterval, otherwise the scheduler captures the real one.
+      vi.useFakeTimers();
+
+      const stub = createAgentStub();
+      const harness = createClocks();
+      const manager = new CronManager(stub.agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: 50,
+      });
+      try {
+        manager.start();
+
+        manager.store.add(
+          { cron: '*/5 * * * *', prompt: 'auto-tick' },
+          harness.now() - 1,
+        );
+        // Move the injected wall clock past one ideal fire, then let the
+        // setInterval drain by advancing fake timers past one poll.
+        harness.advance(6 * 60_000);
+        vi.advanceTimersByTime(60);
+
+        expect(stub.steerCalls.length).toBe(1);
+      } finally {
+        await manager.stop();
+      }
+    });
+  });
+
+  describe('SIGUSR1', () => {
+    // SIGUSR1 binding is opt-in via KIMI_CRON_MANUAL_TICK=1 so that
+    // production (1 main agent + N subagents) doesn't pile up listeners
+    // and trip Node's MaxListenersExceededWarning cap. All four SIGUSR1
+    // tests stub the env before constructing the manager.
+    beforeEach(() => {
+      vi.stubEnv('KIMI_CRON_MANUAL_TICK', '1');
+    });
+
+    it('triggers manager.tick() once per emit (POSIX only)', async () => {
+      if (process.platform === 'win32') return;
+
+      const stub = createAgentStub();
+      const harness = createClocks();
+      const manager = new CronManager(stub.agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: null,
+      });
+      try {
+        manager.start();
+        const spy = vi.spyOn(manager, 'tick');
+        process.emit('SIGUSR1', 'SIGUSR1');
+        expect(spy).toHaveBeenCalledTimes(1);
+      } finally {
+        await manager.stop();
+      }
+    });
+
+    it('swallows throws from tick() so the host process never crashes', async () => {
+      if (process.platform === 'win32') return;
+
+      const stub = createAgentStub();
+      const manager = new CronManager(stub.agent, { pollIntervalMs: null });
+      try {
+        manager.start();
+        vi.spyOn(manager, 'tick').mockImplementation(() => {
+          throw new Error('boom');
+        });
+        // If the handler re-threw, this `emit` would propagate. The
+        // assertion below is the "no throw" side-effect.
+        expect(() => process.emit('SIGUSR1', 'SIGUSR1')).not.toThrow();
+      } finally {
+        await manager.stop();
+      }
+    });
+
+    it('logs swallowed tick() throws to stderr when KIMI_CRON_DEBUG=1', async () => {
+      if (process.platform === 'win32') return;
+      vi.stubEnv('KIMI_CRON_DEBUG', '1');
+
+      const stub = createAgentStub();
+      const manager = new CronManager(stub.agent, { pollIntervalMs: null });
+      const writeSpy = vi
+        .spyOn(process.stderr, 'write')
+        .mockImplementation(() => true);
+      try {
+        manager.start();
+        vi.spyOn(manager, 'tick').mockImplementation(() => {
+          throw new Error('debug-boom');
+        });
+        process.emit('SIGUSR1', 'SIGUSR1');
+        expect(writeSpy).toHaveBeenCalled();
+        const calls = writeSpy.mock.calls.map((c) => String(c[0]));
+        expect(calls.some((s) => /cron\/manager.*SIGUSR1/.test(s))).toBe(true);
+        expect(calls.some((s) => s.includes('debug-boom'))).toBe(true);
+      } finally {
+        writeSpy.mockRestore();
+        await manager.stop();
+      }
+    });
+
+    it('does not write to stderr on tick() throw when KIMI_CRON_DEBUG is unset', async () => {
+      if (process.platform === 'win32') return;
+      // KIMI_CRON_DEBUG intentionally NOT set in this test.
+
+      const stub = createAgentStub();
+      const manager = new CronManager(stub.agent, { pollIntervalMs: null });
+      const writeSpy = vi
+        .spyOn(process.stderr, 'write')
+        .mockImplementation(() => true);
+      try {
+        manager.start();
+        vi.spyOn(manager, 'tick').mockImplementation(() => {
+          throw new Error('silent-boom');
+        });
+        process.emit('SIGUSR1', 'SIGUSR1');
+        // No cron/manager line was emitted because debug is off.
+        const calls = writeSpy.mock.calls.map((c) => String(c[0]));
+        expect(calls.some((s) => /cron\/manager/.test(s))).toBe(false);
+      } finally {
+        writeSpy.mockRestore();
+        await manager.stop();
+      }
+    });
+
+    it('stop() removes the SIGUSR1 listener (no leak)', async () => {
+      if (process.platform === 'win32') return;
+
+      const stub = createAgentStub();
+      const manager = new CronManager(stub.agent, { pollIntervalMs: null });
+      const before = process.listenerCount('SIGUSR1');
+      manager.start();
+      expect(process.listenerCount('SIGUSR1')).toBe(before + 1);
+      await manager.stop();
+      expect(process.listenerCount('SIGUSR1')).toBe(before);
+    });
+
+    it('start() is idempotent — second call does not double-bind', async () => {
+      if (process.platform === 'win32') return;
+
+      const stub = createAgentStub();
+      const manager = new CronManager(stub.agent, { pollIntervalMs: null });
+      const before = process.listenerCount('SIGUSR1');
+      try {
+        manager.start();
+        manager.start();
+        expect(process.listenerCount('SIGUSR1')).toBe(before + 1);
+      } finally {
+        await manager.stop();
+      }
+    });
+
+    it('does not bind when KIMI_CRON_MANUAL_TICK is unset', async () => {
+      if (process.platform === 'win32') return;
+      // Override the describe-scope stub so the env is genuinely unset.
+      vi.unstubAllEnvs();
+      // Re-pin jitter so other describe-scope state stays consistent.
+      vi.stubEnv('KIMI_CRON_NO_JITTER', '1');
+
+      const stub = createAgentStub();
+      const manager = new CronManager(stub.agent, { pollIntervalMs: null });
+      const before = process.listenerCount('SIGUSR1');
+      try {
+        manager.start();
+        expect(process.listenerCount('SIGUSR1')).toBe(before);
+      } finally {
+        await manager.stop();
+      }
+    });
+  });
+});
diff --git a/packages/agent-core/test/agent/cron/subagent-skip.test.ts b/packages/agent-core/test/agent/cron/subagent-skip.test.ts
new file mode 100644
index 0000000000..8dbc0dc741
--- /dev/null
+++ b/packages/agent-core/test/agent/cron/subagent-skip.test.ts
@@ -0,0 +1,88 @@
+/**
+ * Subagent cron suppression: each session can spawn many subagents, and
+ * unconditionally starting a CronManager per agent leaks 1s setInterval
+ * timers and SIGUSR1 listeners (under KIMI_CRON_MANUAL_TICK=1) that
+ * never serve any purpose — default subagent profiles don't expose the
+ * Cron tools to the LLM. This test pins both halves of the fix:
+ *
+ *   1. `agent.cron` is still constructed (consumers reach into
+ *      `agent.cron.store` and the field is `readonly` on the type).
+ *   2. `cron.start()` is skipped for `type: 'sub'` so the SIGUSR1
+ *      listener count stays put.
+ *   3. The three Cron tools (`CronCreate` / `CronList` / `CronDelete`)
+ *      are NOT registered in the subagent's tool manager.
+ *   4. `type: 'main'` and `type: 'independent'` keep the old behaviour
+ *      — listener bound, tools registered.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { testAgent } from '../harness/agent';
+
+const CRON_TOOL_NAMES = ['CronCreate', 'CronList', 'CronDelete'] as const;
+
+describe('Agent + Cron — subagent suppression', () => {
+  beforeEach(() => {
+    // SIGUSR1 binding only happens under KIMI_CRON_MANUAL_TICK=1
+    // (see manager.ts bindSigusr1). Using it as the probe lets us
+    // observe `start()` vs no-start without poking private fields.
+    vi.stubEnv('KIMI_CRON_MANUAL_TICK', '1');
+    vi.stubEnv('KIMI_CRON_NO_JITTER', '1');
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("type='sub': cron exists, start() is skipped, tools not registered", () => {
+    if (process.platform === 'win32') return;
+
+    const before = process.listenerCount('SIGUSR1');
+    const ctx = testAgent({ type: 'sub' });
+
+    // Manager is still wired so `agent.cron.store` access stays safe.
+    expect(ctx.agent.cron).toBeDefined();
+    expect(ctx.agent.cron.store).toBeDefined();
+
+    // start() was not called — no SIGUSR1 binding accrued.
+    expect(process.listenerCount('SIGUSR1')).toBe(before);
+
+    // Configure with the cron tool names in the whitelist; even with
+    // the LLM allowlist explicitly listing them, the BuiltinToolManager
+    // must not have constructed the instances for a subagent.
+    ctx.configure({ tools: [...CRON_TOOL_NAMES] });
+    const toolNames = ctx.agent.tools.data().map((info) => info.name);
+    for (const name of CRON_TOOL_NAMES) {
+      expect(toolNames).not.toContain(name);
+    }
+  });
+
+  it("type='main': start() runs, tools registered", () => {
+    if (process.platform === 'win32') return;
+
+    const before = process.listenerCount('SIGUSR1');
+    const ctx = testAgent({ type: 'main' });
+
+    expect(process.listenerCount('SIGUSR1')).toBe(before + 1);
+
+    ctx.configure({ tools: [...CRON_TOOL_NAMES] });
+    const toolNames = ctx.agent.tools.data().map((info) => info.name);
+    for (const name of CRON_TOOL_NAMES) {
+      expect(toolNames).toContain(name);
+    }
+  });
+
+  it("type='independent': start() runs, tools registered", () => {
+    if (process.platform === 'win32') return;
+
+    const before = process.listenerCount('SIGUSR1');
+    const ctx = testAgent({ type: 'independent' });
+
+    expect(process.listenerCount('SIGUSR1')).toBe(before + 1);
+
+    ctx.configure({ tools: [...CRON_TOOL_NAMES] });
+    const toolNames = ctx.agent.tools.data().map((info) => info.name);
+    for (const name of CRON_TOOL_NAMES) {
+      expect(toolNames).toContain(name);
+    }
+  });
+});
diff --git a/packages/agent-core/test/agent/harness/agent.ts b/packages/agent-core/test/agent/harness/agent.ts
index d44ddb9e2c..1a87908197 100644
--- a/packages/agent-core/test/agent/harness/agent.ts
+++ b/packages/agent-core/test/agent/harness/agent.ts
@@ -4,7 +4,7 @@ import { Readable, type Writable } from 'node:stream';
 import { createControlledPromise } from '@antfu/utils';
 import { localKaos, type Kaos, type KaosProcess } from '@moonshot-ai/kaos';
 import type { ModelCapability, ProviderConfig } from '@moonshot-ai/kosong';
-import { expect, vi } from 'vitest';
+import { expect, onTestFinished, vi } from 'vitest';
 
 import {
   Agent,
@@ -182,6 +182,16 @@ export class AgentTestContext {
       log: options.log,
     });
     this.rpc = this.createPromiseAgentApi(this.agent);
+    // The Agent constructor now eagerly binds a SIGUSR1 listener via
+    // CronManager.start(). Without per-test cleanup, every Agent built
+    // by this harness leaks one listener — Node prints a
+    // MaxListenersExceededWarning once the suite crosses 10 agents.
+    // onTestFinished is a vitest API callable from non-hook scopes, so
+    // we register cleanup transparently without forcing every test to
+    // remember an afterEach.
+    onTestFinished(async () => {
+      await this.agent.cron.stop();
+    });
   }
 
   configure({
diff --git a/packages/agent-core/test/agent/permission/default-tool-approve.test.ts b/packages/agent-core/test/agent/permission/default-tool-approve.test.ts
new file mode 100644
index 0000000000..0ca9a37dbf
--- /dev/null
+++ b/packages/agent-core/test/agent/permission/default-tool-approve.test.ts
@@ -0,0 +1,47 @@
+import type { ToolCall } from '@moonshot-ai/kosong';
+import { describe, expect, it } from 'vitest';
+
+import type { PermissionPolicyContext } from '../../../src/agent/permission';
+import { DefaultToolApprovePermissionPolicy } from '../../../src/agent/permission/policies/default-tool-approve';
+import { ToolAccesses } from '../../../src/loop';
+
+const signal = new AbortController().signal;
+
+function policyContext(toolName: string, args: unknown): PermissionPolicyContext {
+  return {
+    turnId: '0',
+    stepNumber: 1,
+    signal,
+    llm: {},
+    args,
+    toolCall: {
+      type: 'function',
+      id: `call_${toolName}`,
+      name: toolName,
+      arguments: JSON.stringify(args),
+    } satisfies ToolCall,
+    execution: {
+      accesses: ToolAccesses.none(),
+      approvalRule: toolName,
+      execute: async () => ({ output: '' }),
+    },
+  } as unknown as PermissionPolicyContext;
+}
+
+describe('DefaultToolApprovePermissionPolicy', () => {
+  const policy = new DefaultToolApprovePermissionPolicy();
+
+  it('auto-approves CronList', () => {
+    expect(policy.evaluate(policyContext('CronList', {}))).toEqual({ kind: 'approve' });
+  });
+
+  it('does not approve CronCreate', () => {
+    expect(
+      policy.evaluate(policyContext('CronCreate', { cron: '*/5 * * * *', prompt: 'ping' })),
+    ).toBeUndefined();
+  });
+
+  it('does not approve CronDelete', () => {
+    expect(policy.evaluate(policyContext('CronDelete', { id: 'job_1' }))).toBeUndefined();
+  });
+});
diff --git a/packages/agent-core/test/session/cron-stop-on-close.test.ts b/packages/agent-core/test/session/cron-stop-on-close.test.ts
new file mode 100644
index 0000000000..61df567761
--- /dev/null
+++ b/packages/agent-core/test/session/cron-stop-on-close.test.ts
@@ -0,0 +1,102 @@
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'pathe';
+
+import { localKaos, type Kaos } from '@moonshot-ai/kaos';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import type { SDKSessionRPC } from '../../src/rpc';
+import { Session } from '../../src/session';
+
+// Anchor the workspace type resolution: `tsgo` (CI's TypeScript native
+// preview) flaked when this file value-imported `localKaos` alone — the
+// other session tests that hit the same import all also bring in a
+// `type` from kaos. Naming `Kaos` here keeps the resolution stable.
+const KAOS: Kaos = localKaos;
+
+const OS_ENV = {
+  osKind: 'Linux',
+  osArch: 'arm64',
+  osVersion: 'test',
+  shellPath: '/bin/bash',
+  shellName: 'bash',
+} as const;
+
+const tempDirs: string[] = [];
+
+afterEach(async () => {
+  vi.unstubAllEnvs();
+  for (const dir of tempDirs.splice(0)) {
+    await rm(dir, { recursive: true, force: true, maxRetries: 3, retryDelay: 10 });
+  }
+});
+
+describe('Session.close stops cron', () => {
+  it('stops each agent cron scheduler on close', async () => {
+    const { sessionDir, workDir } = await sessionFixture();
+    const session = new Session({
+      runtime: { kaos: KAOS, osEnv: OS_ENV },
+      id: 'session-cron-stop',
+      homedir: sessionDir,
+      cwd: workDir,
+      rpc: createSessionRpc(),
+      skills: { explicitDirs: [join(workDir, 'missing-skills')] },
+    });
+    const main = await session.createMain();
+    const stopSpy = vi.spyOn(main.cron, 'stop');
+
+    await session.close();
+
+    expect(stopSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('observably tears down cron side effects (SIGUSR1 listener cleared)', async () => {
+    // The spy-only test above proves `stop()` was called but would
+    // still pass if `stop()` no-op'd. Gate manual-tick mode so the
+    // CronManager binds a real SIGUSR1 listener, then assert the
+    // listener count returns to its pre-construction baseline after
+    // `session.close()`. Anything short of `unbindSigusr1` running
+    // would leak a listener.
+    if (process.platform === 'win32') return;
+    vi.stubEnv('KIMI_CRON_MANUAL_TICK', '1');
+
+    const before = process.listenerCount('SIGUSR1');
+    const { sessionDir, workDir } = await sessionFixture();
+    const session = new Session({
+      runtime: { kaos: KAOS, osEnv: OS_ENV },
+      id: 'session-cron-stop-sigusr1',
+      homedir: sessionDir,
+      cwd: workDir,
+      rpc: createSessionRpc(),
+      skills: { explicitDirs: [join(workDir, 'missing-skills')] },
+    });
+    await session.createMain();
+    expect(process.listenerCount('SIGUSR1')).toBe(before + 1);
+
+    await session.close();
+    expect(process.listenerCount('SIGUSR1')).toBe(before);
+  });
+});
+
+async function sessionFixture(): Promise<{
+  readonly sessionDir: string;
+  readonly workDir: string;
+}> {
+  const dir = await mkdtemp(join(tmpdir(), 'kimi-session-cron-stop-'));
+  tempDirs.push(dir);
+  const workDir = join(dir, 'work');
+  const sessionDir = join(dir, 'session');
+  return { sessionDir, workDir };
+}
+
+function createSessionRpc(): SDKSessionRPC {
+  return {
+    emitEvent: vi.fn(async () => {}),
+    requestApproval: vi.fn(async () => ({ decision: 'cancelled' })),
+    requestQuestion: vi.fn(async () => null),
+    toolCall: vi.fn(async () => ({
+      output: 'custom tools are not supported in this test',
+      isError: true,
+    })),
+  } as SDKSessionRPC;
+}
diff --git a/packages/agent-core/test/tools/cron/clock.test.ts b/packages/agent-core/test/tools/cron/clock.test.ts
new file mode 100644
index 0000000000..5bfe70ba3a
--- /dev/null
+++ b/packages/agent-core/test/tools/cron/clock.test.ts
@@ -0,0 +1,147 @@
+/**
+ * Tests for `tools/cron/clock.ts`.
+ */
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import * as os from 'node:os';
+import { describe, expect, it } from 'vitest';
+import { join } from 'pathe';
+
+import { resolveClockSources, SYSTEM_CLOCKS } from '../../../src/tools/cron/clock';
+
+describe('clock.ts', () => {
+  describe('SYSTEM_CLOCKS', () => {
+    it('monoNowMs is strictly non-decreasing across 1000 calls', () => {
+      let prev = SYSTEM_CLOCKS.monoNowMs();
+      for (let i = 0; i < 1000; i++) {
+        const next = SYSTEM_CLOCKS.monoNowMs();
+        expect(next).toBeGreaterThanOrEqual(prev);
+        prev = next;
+      }
+    });
+
+    it('wallNow is close to Date.now', () => {
+      const before = Date.now();
+      const sample = SYSTEM_CLOCKS.wallNow();
+      const after = Date.now();
+      expect(sample).toBeGreaterThanOrEqual(before);
+      expect(sample).toBeLessThanOrEqual(after);
+    });
+
+    it('monoNowMs returns finite positive numbers', () => {
+      const sample = SYSTEM_CLOCKS.monoNowMs();
+      expect(Number.isFinite(sample)).toBe(true);
+      expect(sample).toBeGreaterThan(0);
+    });
+  });
+
+  describe('resolveClockSources — default / system', () => {
+    it('undefined spec returns SYSTEM_CLOCKS', () => {
+      expect(resolveClockSources(undefined)).toBe(SYSTEM_CLOCKS);
+    });
+
+    it('empty string returns SYSTEM_CLOCKS', () => {
+      expect(resolveClockSources('')).toBe(SYSTEM_CLOCKS);
+    });
+
+    it('"system" returns SYSTEM_CLOCKS', () => {
+      expect(resolveClockSources('system')).toBe(SYSTEM_CLOCKS);
+    });
+
+    it('unrecognised scheme falls back to SYSTEM_CLOCKS', () => {
+      expect(resolveClockSources('garbage:foo')).toBe(SYSTEM_CLOCKS);
+      expect(resolveClockSources('foobar')).toBe(SYSTEM_CLOCKS);
+    });
+  });
+
+  describe('resolveClockSources — file:<path>', () => {
+    it('reads file first line on every wallNow call', () => {
+      const tmpDir = mkdtempSync(join(os.tmpdir(), 'kimi-cron-clock-'));
+      const filePath = join(tmpDir, 'now.txt');
+
+      writeFileSync(filePath, '1000\n', 'utf8');
+      const clocks = resolveClockSources(`file:${filePath}`);
+      expect(clocks.wallNow()).toBe(1000);
+
+      writeFileSync(filePath, '2500', 'utf8');
+      expect(clocks.wallNow()).toBe(2500);
+
+      // Multi-line — only first line counts.
+      writeFileSync(filePath, '4242\ngarbage\n', 'utf8');
+      expect(clocks.wallNow()).toBe(4242);
+    });
+
+    it('missing file falls back to Date.now', () => {
+      const tmpDir = mkdtempSync(join(os.tmpdir(), 'kimi-cron-clock-'));
+      const filePath = join(tmpDir, 'never-created.txt');
+      const clocks = resolveClockSources(`file:${filePath}`);
+      const before = Date.now();
+      const sample = clocks.wallNow();
+      const after = Date.now();
+      expect(sample).toBeGreaterThanOrEqual(before);
+      expect(sample).toBeLessThanOrEqual(after);
+    });
+
+    it('unparseable content falls back to Date.now', () => {
+      const tmpDir = mkdtempSync(join(os.tmpdir(), 'kimi-cron-clock-'));
+      const filePath = join(tmpDir, 'now.txt');
+      writeFileSync(filePath, 'not-a-number\n', 'utf8');
+      const clocks = resolveClockSources(`file:${filePath}`);
+      const before = Date.now();
+      const sample = clocks.wallNow();
+      const after = Date.now();
+      expect(sample).toBeGreaterThanOrEqual(before);
+      expect(sample).toBeLessThanOrEqual(after);
+    });
+
+    it('empty file falls back to Date.now', () => {
+      const tmpDir = mkdtempSync(join(os.tmpdir(), 'kimi-cron-clock-'));
+      const filePath = join(tmpDir, 'now.txt');
+      writeFileSync(filePath, '', 'utf8');
+      const clocks = resolveClockSources(`file:${filePath}`);
+      const before = Date.now();
+      const sample = clocks.wallNow();
+      const after = Date.now();
+      expect(sample).toBeGreaterThanOrEqual(before);
+      expect(sample).toBeLessThanOrEqual(after);
+    });
+
+    it('monoNowMs is not affected by file clock', () => {
+      const tmpDir = mkdtempSync(join(os.tmpdir(), 'kimi-cron-clock-'));
+      const filePath = join(tmpDir, 'now.txt');
+      writeFileSync(filePath, '1000', 'utf8');
+      const clocks = resolveClockSources(`file:${filePath}`);
+      const a = clocks.monoNowMs();
+      const b = clocks.monoNowMs();
+      expect(a).not.toBe(1000);
+      expect(b).toBeGreaterThanOrEqual(a);
+    });
+
+    it('empty file path in spec falls back to SYSTEM_CLOCKS', () => {
+      expect(resolveClockSources('file:')).toBe(SYSTEM_CLOCKS);
+    });
+
+    it('caps file reads at 64 bytes and parses the prefix', () => {
+      const tmpDir = mkdtempSync(join(os.tmpdir(), 'kimi-cron-clock-'));
+      const filePath = join(tmpDir, 'now.txt');
+      // First line is a valid epoch-ms within the 64-byte window; the
+      // remainder is garbage that would break Number(...) if read.
+      const prefix = '1234567890\n';
+      const garbage = 'x'.repeat(10_000);
+      writeFileSync(filePath, prefix + garbage, 'utf8');
+      const clocks = resolveClockSources(`file:${filePath}`);
+      expect(clocks.wallNow()).toBe(1234567890);
+    });
+
+    it('rejects garbage longer than the 64-byte cap and falls back to Date.now', () => {
+      const tmpDir = mkdtempSync(join(os.tmpdir(), 'kimi-cron-clock-'));
+      const filePath = join(tmpDir, 'now.txt');
+      writeFileSync(filePath, 'x'.repeat(100), 'utf8');
+      const clocks = resolveClockSources(`file:${filePath}`);
+      const before = Date.now();
+      const sample = clocks.wallNow();
+      const after = Date.now();
+      expect(sample).toBeGreaterThanOrEqual(before);
+      expect(sample).toBeLessThanOrEqual(after);
+    });
+  });
+});
diff --git a/packages/agent-core/test/tools/cron/cron-create.test.ts b/packages/agent-core/test/tools/cron/cron-create.test.ts
new file mode 100644
index 0000000000..1160f7860f
--- /dev/null
+++ b/packages/agent-core/test/tools/cron/cron-create.test.ts
@@ -0,0 +1,458 @@
+/**
+ * Tests for `tools/cron/cron-create.ts`.
+ *
+ * Empty-prompt handling lives in the loop's AJV layer (`prompt.min(1)`
+ * runs before `resolveExecution`), so we document the path instead of
+ * asserting a false positive.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { CronManager } from '../../../src/agent/cron/manager';
+import {
+  CronCreateTool,
+  MAX_CRON_JOBS_PER_SESSION,
+  type CronCreateInput,
+} from '../../../src/tools/cron/cron-create';
+import { CRON_SCHEDULED } from '../../../src/tools/cron/telemetry-events';
+import type {
+  ExecutableToolErrorResult,
+  ExecutableToolResult,
+  RunnableToolExecution,
+  ToolExecution,
+} from '../../../src/loop/types';
+import {
+  createAgentStub,
+  createClocks,
+  scrubCronOutput,
+  type AgentStub,
+} from '../../agent/cron/harness/stub';
+
+interface Harness {
+  readonly stub: AgentStub;
+  readonly manager: CronManager;
+  readonly tool: CronCreateTool;
+}
+
+function makeHarness(): Harness {
+  const stub = createAgentStub();
+  const manager = new CronManager(stub.agent, {
+    clocks: createClocks().clocks,
+    pollIntervalMs: null,
+  });
+  const tool = new CronCreateTool(manager);
+  return { stub, manager, tool };
+}
+
+/**
+ * `resolveExecution` returns either a synchronous error (no `execute`)
+ * or a runnable execution. This narrows to the runnable case and runs
+ * `execute` with a minimal context.
+ */
+async function runTool(
+  tool: CronCreateTool,
+  input: CronCreateInput,
+): Promise<ExecutableToolResult> {
+  const execution = tool.resolveExecution(input);
+  if (isErrorExecution(execution)) {
+    return execution;
+  }
+  return execution.execute({
+    turnId: 'test-turn',
+    toolCallId: 'test-call',
+    signal: new AbortController().signal,
+  });
+}
+
+function isErrorExecution(
+  execution: ToolExecution,
+): execution is ExecutableToolErrorResult {
+  return (execution as RunnableToolExecution).execute === undefined;
+}
+
+function assertSuccess(result: ExecutableToolResult): string {
+  expect(result.isError ?? false).toBe(false);
+  expect(typeof result.output).toBe('string');
+  return result.output as string;
+}
+
+function assertError(result: ExecutableToolResult): string {
+  expect(result.isError).toBe(true);
+  expect(typeof result.output).toBe('string');
+  return result.output as string;
+}
+
+describe('CronCreateTool', () => {
+  beforeEach(() => {
+    // Disable jitter so the nextFireAt string we render is the bare
+    // ideal time — keeps the format assertions readable without
+    // dragging in a jittered offset.
+    vi.stubEnv('KIMI_CRON_NO_JITTER', '1');
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it('schedules a recurring task and emits cron_scheduled', async () => {
+    const { stub, manager, tool } = makeHarness();
+    const result = await runTool(tool, {
+      cron: '*/5 * * * *',
+      prompt: 'hi',
+      recurring: true,
+    });
+    const out = assertSuccess(result);
+
+    // id is randomly generated, nextFireAt depends on the host TZ —
+    // both are scrubbed so the snapshot pins the structural format.
+    expect(scrubCronOutput(out)).toMatchInlineSnapshot(`
+      "id: <id>
+      cron: */5 * * * *
+      humanSchedule: every 5 minutes
+      recurring: true
+      nextFireAt: <iso>"
+    `);
+
+    expect(manager.store.list()).toHaveLength(1);
+    expect(stub.telemetryCalls).toHaveLength(1);
+    expect(stub.telemetryCalls[0]!.event).toBe(CRON_SCHEDULED);
+    expect(stub.telemetryCalls[0]!.props).toEqual({
+      recurring: true,
+    });
+  });
+
+  it('schedules a one-shot task with recurring=false in the stored record', async () => {
+    const { manager, tool, stub } = makeHarness();
+    const result = await runTool(tool, {
+      cron: '0 12 * * *',
+      prompt: 'noon',
+      recurring: false,
+    });
+    const out = assertSuccess(result);
+    expect(scrubCronOutput(out)).toMatchInlineSnapshot(`
+      "id: <id>
+      cron: 0 12 * * *
+      humanSchedule: at 12:00 every day
+      recurring: false
+      nextFireAt: <iso>"
+    `);
+
+    const tasks = manager.store.list();
+    expect(tasks).toHaveLength(1);
+    expect(tasks[0]!.recurring).toBe(false);
+
+    expect(stub.telemetryCalls).toHaveLength(1);
+    expect(stub.telemetryCalls[0]!.props).toMatchObject({ recurring: false });
+  });
+
+  it('rejects an unparseable cron expression', async () => {
+    const { manager, tool, stub } = makeHarness();
+    const msg = assertError(
+      await runTool(tool, {
+        cron: 'not a cron',
+        prompt: 'x',
+        recurring: true,
+      }),
+    );
+    expect(msg).toMatchInlineSnapshot(
+      `"Invalid cron expression: cron expression must have exactly 5 fields (minute hour day-of-month month day-of-week); got 3"`,
+    );
+
+    expect(manager.store.list()).toHaveLength(0);
+    expect(stub.telemetryCalls).toHaveLength(0);
+  });
+
+  it('rejects a legal-but-never-fires cron expression', async () => {
+    const { manager, tool, stub } = makeHarness();
+    // Feb 31st — parses fine, never fires.
+    const msg = assertError(
+      await runTool(tool, {
+        cron: '0 0 31 2 *',
+        prompt: 'never',
+        recurring: false,
+      }),
+    );
+    expect(msg).toMatchInlineSnapshot(
+      `"Cron expression "0 0 31 2 *" has no fire within 5 years; refusing to schedule."`,
+    );
+
+    expect(manager.store.list()).toHaveLength(0);
+    expect(stub.telemetryCalls).toHaveLength(0);
+  });
+
+  it('returns an error when KIMI_DISABLE_CRON=1', async () => {
+    vi.stubEnv('KIMI_DISABLE_CRON', '1');
+    const { manager, tool, stub } = makeHarness();
+    const msg = assertError(
+      await runTool(tool, {
+        cron: '*/5 * * * *',
+        prompt: 'hi',
+        recurring: true,
+      }),
+    );
+    expect(msg).toMatchInlineSnapshot(
+      `"Cron scheduling is disabled (KIMI_DISABLE_CRON=1)."`,
+    );
+
+    expect(manager.store.list()).toHaveLength(0);
+    expect(stub.telemetryCalls).toHaveLength(0);
+  });
+
+  it('refuses to schedule past the session cap', async () => {
+    const { manager, tool, stub } = makeHarness();
+    // Pre-fill the store with the max number of tasks. The cap reads
+    // `store.list().length`, so any well-formed task seeds it.
+    const seedNow = manager.clocks.wallNow();
+    for (let i = 0; i < MAX_CRON_JOBS_PER_SESSION; i++) {
+      manager.store.add(
+        { cron: '*/5 * * * *', prompt: `seed-${String(i)}`, recurring: true },
+        seedNow,
+      );
+    }
+    expect(manager.store.list()).toHaveLength(MAX_CRON_JOBS_PER_SESSION);
+
+    const msg = assertError(
+      await runTool(tool, {
+        cron: '*/5 * * * *',
+        prompt: 'overflow',
+        recurring: true,
+      }),
+    );
+    expect(msg).toMatchInlineSnapshot(
+      `"Cron job cap reached (max 50 per session)."`,
+    );
+
+    expect(manager.store.list()).toHaveLength(MAX_CRON_JOBS_PER_SESSION);
+    expect(stub.telemetryCalls).toHaveLength(0);
+  });
+
+  it('rejects prompts above the 8 KiB byte budget (multi-byte input)', async () => {
+    const { manager, tool, stub } = makeHarness();
+    // '汉' is 3 bytes in UTF-8; 3000 repetitions = 9000 bytes > 8192.
+    // zod's `.max(8192)` is in code units and would accept this — the
+    // byte check inside the tool catches it.
+    const prompt = '汉'.repeat(3000);
+    const msg = assertError(
+      await runTool(tool, {
+        cron: '*/5 * * * *',
+        prompt,
+        recurring: true,
+      }),
+    );
+    expect(msg).toMatchInlineSnapshot(
+      `"Prompt exceeds 8192 bytes (got 9000)."`,
+    );
+
+    expect(manager.store.list()).toHaveLength(0);
+    expect(stub.telemetryCalls).toHaveLength(0);
+  });
+
+  it('documents empty-prompt handling as a loop-layer concern', () => {
+    // zod's `.min(1)` on `prompt` lives in the input schema, which
+    // the loop's AJV validator enforces before `resolveExecution` is
+    // ever invoked. The tool itself does not re-check that — see the
+    // module header for the rationale. This test exists as
+    // documentation rather than as a real assertion, so the rationale
+    // is co-located with the test list called out in the spec.
+    expect(true).toBe(true);
+  });
+
+  describe('whitespace normalization', () => {
+    it('normalizes newline-separated cron fields to single spaces in the store', async () => {
+      const { manager, tool } = makeHarness();
+      const result = await runTool(tool, {
+        cron: '*/5\n* * * *',
+        prompt: 'x',
+        recurring: true,
+      });
+      expect(result.isError ?? false).toBe(false);
+
+      const tasks = manager.store.list();
+      expect(tasks).toHaveLength(1);
+      expect(tasks[0]!.cron).toBe('*/5 * * * *');
+    });
+
+    it('normalizes tab-separated cron fields', async () => {
+      const { manager, tool } = makeHarness();
+      const result = await runTool(tool, {
+        cron: '*/5\t*\t*\t*\t*',
+        prompt: 'x',
+        recurring: true,
+      });
+      expect(result.isError ?? false).toBe(false);
+
+      const tasks = manager.store.list();
+      expect(tasks).toHaveLength(1);
+      expect(tasks[0]!.cron).toBe('*/5 * * * *');
+    });
+
+    it('normalizes leading/trailing whitespace', async () => {
+      const { manager, tool } = makeHarness();
+      const result = await runTool(tool, {
+        cron: '   */5 * * * *   ',
+        prompt: 'x',
+        recurring: true,
+      });
+      expect(result.isError ?? false).toBe(false);
+
+      const tasks = manager.store.list();
+      expect(tasks).toHaveLength(1);
+      expect(tasks[0]!.cron).toBe('*/5 * * * *');
+    });
+
+    it('normalized cron is what shows up in the rendered CronCreate output', async () => {
+      const { tool } = makeHarness();
+      const result = await runTool(tool, {
+        cron: '*/5\n* * * *',
+        prompt: 'x',
+        recurring: true,
+      });
+      const out = assertSuccess(result);
+      expect(out).toContain('cron: */5 * * * *');
+      // No literal newline between the cron field tokens — the only
+      // newlines should be the record separators between keys.
+      expect(out).not.toMatch(/cron: \*\/5\n\* \* \* \*/);
+    });
+
+    it('normalizes whitespace before parse so humanSchedule does not leak newlines', async () => {
+      // `cronToHuman` recognizes "*/5 * * * *" → "every 5 minutes",
+      // so the rendered humanSchedule should be the template output —
+      // a single line, no leaked newline from the raw input.
+      const { tool } = makeHarness();
+      const result = await runTool(tool, {
+        cron: '*/5\n* * * *',
+        prompt: 'x',
+        recurring: true,
+      });
+      const out = assertSuccess(result);
+      const match = /^humanSchedule: (.+)$/m.exec(out);
+      expect(match).not.toBeNull();
+      const value = match![1]!;
+      expect(value).toBe('every 5 minutes');
+      expect(value).not.toContain('\n');
+    });
+
+    it('humanSchedule fallback is single-line for a non-template cron with tabs in input', async () => {
+      // Five specific integers don't match any cronToHuman template,
+      // so the function falls back to `parsed.raw`. With normalization
+      // moved before parsing, `parsed.raw` is the single-line form;
+      // the rendered humanSchedule must not contain the original tabs
+      // or any newlines.
+      const { tool } = makeHarness();
+      const result = await runTool(tool, {
+        cron: '1\t2\t3\t4\t5',
+        prompt: 'x',
+        recurring: true,
+      });
+      const out = assertSuccess(result);
+      const match = /^humanSchedule: (.+)$/m.exec(out);
+      expect(match).not.toBeNull();
+      const value = match![1]!;
+      expect(value).toBe('1 2 3 4 5');
+      expect(value).not.toContain('\t');
+      expect(value.split('\n').length - 1).toBe(0);
+    });
+  });
+
+  describe('clock anchored at execute() time', () => {
+    it('uses the clock value at execute(), not resolveExecution()', async () => {
+      // Mirrors the manual-approval scenario: prepare returns a
+      // runnable, the user takes a while to approve, and only then
+      // does execute() run. If the schedule were anchored at prepare
+      // time, the one-shot would be inserted with a stale
+      // `createdAt` and could fire immediately on the next tick.
+      const stub = createAgentStub();
+      const harness = createClocks();
+      const manager = new CronManager(stub.agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: null,
+      });
+      const tool = new CronCreateTool(manager);
+
+      const execution = tool.resolveExecution({
+        cron: '*/5 * * * *',
+        prompt: 'after-delay',
+        recurring: false,
+      });
+      if (isErrorExecution(execution)) {
+        throw new Error('expected runnable execution');
+      }
+
+      // Advance the wall clock past prepare-time (manual-approval gap)
+      // before running execute(). The task should be created with
+      // `createdAt` equal to the new wall time, not the original one.
+      const beforeExecute = harness.now();
+      harness.advance(10 * 60_000);
+      const afterExecute = harness.now();
+
+      await execution.execute({
+        turnId: 't',
+        toolCallId: 'c',
+        signal: new AbortController().signal,
+      });
+
+      const tasks = manager.store.list();
+      expect(tasks).toHaveLength(1);
+      const task = tasks[0]!;
+      expect(task.createdAt).toBe(afterExecute);
+      expect(task.createdAt).not.toBe(beforeExecute);
+    });
+  });
+
+  describe('cap rechecked inside execute()', () => {
+    it('refuses insert when the store fills between prepare and execute', async () => {
+      // Two concurrently prepared CronCreate calls must not be able
+      // to both pass the cap check at prepare time and then both
+      // succeed at execute() time, breaching the cap. The first to
+      // execute wins; the second must observe the live store size and
+      // refuse.
+      const stub = createAgentStub();
+      const harness = createClocks();
+      const manager = new CronManager(stub.agent, {
+        clocks: harness.clocks,
+        pollIntervalMs: null,
+      });
+      const tool = new CronCreateTool(manager);
+
+      // Seed up to one below the cap, then prepare two CronCreate
+      // calls. Both see length === MAX - 1 < MAX and pass the
+      // prepare-time gate; the second's execute() must trip the
+      // re-check after the first executes.
+      const seedNow = manager.clocks.wallNow();
+      for (let i = 0; i < MAX_CRON_JOBS_PER_SESSION - 1; i++) {
+        manager.store.add(
+          { cron: '*/5 * * * *', prompt: `seed-${String(i)}`, recurring: true },
+          seedNow,
+        );
+      }
+
+      const first = tool.resolveExecution({
+        cron: '*/5 * * * *',
+        prompt: 'first',
+        recurring: true,
+      });
+      const second = tool.resolveExecution({
+        cron: '*/5 * * * *',
+        prompt: 'second',
+        recurring: true,
+      });
+      if (isErrorExecution(first) || isErrorExecution(second)) {
+        throw new Error('expected both to pass prepare-time cap');
+      }
+
+      const ctx = {
+        turnId: 't',
+        toolCallId: 'c',
+        signal: new AbortController().signal,
+      };
+      const firstResult = await first.execute(ctx);
+      const secondResult = await second.execute(ctx);
+
+      expect(firstResult.isError ?? false).toBe(false);
+      expect(secondResult.isError).toBe(true);
+      expect(secondResult.output).toMatchInlineSnapshot(
+        `"Cron job cap reached (max 50 per session)."`,
+      );
+      expect(manager.store.list()).toHaveLength(MAX_CRON_JOBS_PER_SESSION);
+    });
+  });
+});
diff --git a/packages/agent-core/test/tools/cron/cron-delete.test.ts b/packages/agent-core/test/tools/cron/cron-delete.test.ts
new file mode 100644
index 0000000000..d75c1ec5f9
--- /dev/null
+++ b/packages/agent-core/test/tools/cron/cron-delete.test.ts
@@ -0,0 +1,177 @@
+/**
+ * Tests for `tools/cron/cron-delete.ts`. Pins the report-and-correct
+ * contract: every code path that would otherwise be a silent no-op
+ * (missing id, malformed id) reports an error.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { CronManager } from '../../../src/agent/cron/manager';
+import {
+  CronDeleteTool,
+  type CronDeleteInput,
+} from '../../../src/tools/cron/cron-delete';
+import { CRON_DELETED } from '../../../src/tools/cron/telemetry-events';
+import type {
+  ExecutableToolErrorResult,
+  ExecutableToolResult,
+  RunnableToolExecution,
+  ToolExecution,
+} from '../../../src/loop/types';
+import {
+  createAgentStub,
+  createClocks,
+  scrubCronOutput,
+  type AgentStub,
+} from '../../agent/cron/harness/stub';
+
+interface Harness {
+  readonly stub: AgentStub;
+  readonly manager: CronManager;
+  readonly tool: CronDeleteTool;
+}
+
+function makeHarness(): Harness {
+  const stub = createAgentStub();
+  const manager = new CronManager(stub.agent, {
+    clocks: createClocks().clocks,
+    pollIntervalMs: null,
+  });
+  const tool = new CronDeleteTool(manager);
+  return { stub, manager, tool };
+}
+
+async function runTool(
+  tool: CronDeleteTool,
+  input: CronDeleteInput,
+): Promise<ExecutableToolResult> {
+  const execution = tool.resolveExecution(input);
+  if (isErrorExecution(execution)) {
+    return execution;
+  }
+  return execution.execute({
+    turnId: 'test-turn',
+    toolCallId: 'test-call',
+    signal: new AbortController().signal,
+  });
+}
+
+function isErrorExecution(
+  execution: ToolExecution,
+): execution is ExecutableToolErrorResult {
+  return (execution as RunnableToolExecution).execute === undefined;
+}
+
+function assertSuccess(result: ExecutableToolResult): string {
+  expect(result.isError ?? false).toBe(false);
+  expect(typeof result.output).toBe('string');
+  return result.output as string;
+}
+
+function assertError(result: ExecutableToolResult): string {
+  expect(result.isError).toBe(true);
+  expect(typeof result.output).toBe('string');
+  return result.output as string;
+}
+
+describe('CronDeleteTool', () => {
+  beforeEach(() => {
+    // Disable jitter — irrelevant to delete behaviour but keeps the
+    // manager construction path consistent with the create / list
+    // tests, in case a later assertion grows to read nextFireAt.
+    vi.stubEnv('KIMI_CRON_NO_JITTER', '1');
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it('deletes an existing task, drains the store, and emits cron_deleted', async () => {
+    const { stub, manager, tool } = makeHarness();
+    // Seed via the store directly so the test is independent of
+    // CronCreate's validation surface.
+    const task = manager.store.add(
+      { cron: '*/5 * * * *', prompt: 'hi', recurring: true },
+      manager.clocks.wallNow(),
+    );
+    expect(manager.store.list()).toHaveLength(1);
+
+    const out = assertSuccess(await runTool(tool, { id: task.id }));
+
+    expect(scrubCronOutput(out)).toMatchInlineSnapshot(
+      `"Deleted cron job <id>."`,
+    );
+    expect(manager.store.list()).toHaveLength(0);
+
+    // Exactly one telemetry event, keyed on the deleted id.
+    expect(stub.telemetryCalls).toHaveLength(1);
+    expect(stub.telemetryCalls[0]!.event).toBe(CRON_DELETED);
+    expect(stub.telemetryCalls[0]!.props).toEqual({ task_id: task.id });
+
+    // The delete tool never steers — guard against an accidental wiring
+    // mistake that would inject the prompt at delete time.
+    expect(stub.steerCalls).toHaveLength(0);
+  });
+
+  it('reports an error when the id is well-formed but absent, with no telemetry', async () => {
+    const { stub, manager, tool } = makeHarness();
+    // No tasks seeded — the lookup miss is the path under test.
+    const msg = assertError(await runTool(tool, { id: '0123abcd' }));
+    expect(msg).toMatchInlineSnapshot(`"No cron job with id 0123abcd."`);
+
+    expect(manager.store.list()).toHaveLength(0);
+    expect(stub.telemetryCalls).toHaveLength(0);
+  });
+
+  it('rejects an uppercase id (format check, no store mutation)', async () => {
+    const { stub, manager, tool } = makeHarness();
+    // Seed a real task so we can confirm the malformed id never reaches
+    // the store. (The seeded id won't collide with the uppercase one,
+    // but this guards against a regression that bypasses the format
+    // check entirely and somehow clears the store.)
+    manager.store.add(
+      { cron: '*/5 * * * *', prompt: 'hi', recurring: true },
+      manager.clocks.wallNow(),
+    );
+
+    const msg = assertError(await runTool(tool, { id: 'ABCD1234' }));
+    expect(msg).toMatchInlineSnapshot(
+      `"Invalid cron job id "ABCD1234" — must be 8 lowercase hex characters."`,
+    );
+
+    expect(manager.store.list()).toHaveLength(1);
+    expect(stub.telemetryCalls).toHaveLength(0);
+  });
+
+  it('rejects a too-short id', async () => {
+    const { stub, manager, tool } = makeHarness();
+    const msg = assertError(await runTool(tool, { id: 'abc' }));
+    expect(msg).toMatchInlineSnapshot(
+      `"Invalid cron job id "abc" — must be 8 lowercase hex characters."`,
+    );
+
+    expect(manager.store.list()).toHaveLength(0);
+    expect(stub.telemetryCalls).toHaveLength(0);
+  });
+
+  it('rejects a non-hex id of the right length', async () => {
+    const { stub, manager, tool } = makeHarness();
+    const msg = assertError(await runTool(tool, { id: 'zzzzzzzz' }));
+    expect(msg).toMatchInlineSnapshot(
+      `"Invalid cron job id "zzzzzzzz" — must be 8 lowercase hex characters."`,
+    );
+
+    expect(manager.store.list()).toHaveLength(0);
+    expect(stub.telemetryCalls).toHaveLength(0);
+  });
+
+  it('rejects an empty id', async () => {
+    const { stub, manager, tool } = makeHarness();
+    const msg = assertError(await runTool(tool, { id: '' }));
+    expect(msg).toMatchInlineSnapshot(
+      `"Invalid cron job id "" — must be 8 lowercase hex characters."`,
+    );
+
+    expect(manager.store.list()).toHaveLength(0);
+    expect(stub.telemetryCalls).toHaveLength(0);
+  });
+});
diff --git a/packages/agent-core/test/tools/cron/cron-expr.test.ts b/packages/agent-core/test/tools/cron/cron-expr.test.ts
new file mode 100644
index 0000000000..e655eb51ec
--- /dev/null
+++ b/packages/agent-core/test/tools/cron/cron-expr.test.ts
@@ -0,0 +1,398 @@
+/**
+ * Tests for `tools/cron/cron-expr.ts`. Dates are constructed via
+ * `new Date(year, monthIndex, day, h, m, s)` so the suite is stable
+ * regardless of the host TZ (cron expressions evaluate in local time).
+ */
+import { describe, expect, it } from 'vitest';
+
+import {
+  computeNextCronRun,
+  cronToHuman,
+  hasFireWithinYears,
+  parseCronExpression,
+} from '../../../src/tools/cron/cron-expr';
+
+function localDate(
+  y: number,
+  monthIndex: number,
+  d: number,
+  h = 0,
+  m = 0,
+  s = 0,
+): number {
+  return new Date(y, monthIndex, d, h, m, s, 0).getTime();
+}
+
+function nextLocalParts(ts: number) {
+  const d = new Date(ts);
+  return {
+    year: d.getFullYear(),
+    month: d.getMonth() + 1,
+    day: d.getDate(),
+    hour: d.getHours(),
+    minute: d.getMinutes(),
+    second: d.getSeconds(),
+    dow: d.getDay(),
+  };
+}
+
+describe('parseCronExpression', () => {
+  it('parses wildcard', () => {
+    const p = parseCronExpression('* * * * *');
+    expect(p.minutes.size).toBe(60);
+    expect(p.hours.size).toBe(24);
+    expect(p.daysOfMonth.size).toBe(31);
+    expect(p.months.size).toBe(12);
+    expect(p.daysOfWeek.size).toBe(7);
+    expect(p.daysOfMonthWildcard).toBe(true);
+    expect(p.daysOfWeekWildcard).toBe(true);
+  });
+
+  it('parses single integers', () => {
+    const p = parseCronExpression('5 9 1 6 3');
+    expect([...p.minutes]).toEqual([5]);
+    expect([...p.hours]).toEqual([9]);
+    expect([...p.daysOfMonth]).toEqual([1]);
+    expect([...p.months]).toEqual([6]);
+    expect([...p.daysOfWeek]).toEqual([3]);
+    expect(p.daysOfMonthWildcard).toBe(false);
+    expect(p.daysOfWeekWildcard).toBe(false);
+  });
+
+  it('parses ranges', () => {
+    const p = parseCronExpression('0 9-17 * * 1-5');
+    expect([...p.hours].toSorted((a, b) => a - b)).toEqual([9, 10, 11, 12, 13, 14, 15, 16, 17]);
+    expect([...p.daysOfWeek].toSorted((a, b) => a - b)).toEqual([1, 2, 3, 4, 5]);
+  });
+
+  it('parses lists', () => {
+    const p = parseCronExpression('0 9,12,17 * * *');
+    expect([...p.hours].toSorted((a, b) => a - b)).toEqual([9, 12, 17]);
+  });
+
+  it('parses step with wildcard', () => {
+    const p = parseCronExpression('*/5 * * * *');
+    expect([...p.minutes].toSorted((a, b) => a - b)).toEqual([
+      0, 5, 10, 15, 20, 25, 30, 35, 40, 45, 50, 55,
+    ]);
+  });
+
+  it('parses step with range', () => {
+    const p = parseCronExpression('0-30/10 * * * *');
+    expect([...p.minutes].toSorted((a, b) => a - b)).toEqual([0, 10, 20, 30]);
+  });
+
+  it('folds day-of-week 7 to 0 (Sunday)', () => {
+    const p = parseCronExpression('0 0 * * 7');
+    expect([...p.daysOfWeek]).toEqual([0]);
+  });
+
+  it('treats bare * as wildcard but */n as restriction', () => {
+    const a = parseCronExpression('* * * * *');
+    const b = parseCronExpression('*/5 * * * *');
+    expect(a.daysOfMonthWildcard).toBe(true);
+    expect(b.daysOfMonthWildcard).toBe(true);
+  });
+
+  it('throws on too few fields', () => {
+    expect(() => parseCronExpression('* * * *')).toThrow(/5 fields/);
+  });
+
+  it('throws on too many fields', () => {
+    expect(() => parseCronExpression('* * * * * *')).toThrow(/5 fields/);
+  });
+
+  it('throws on empty input', () => {
+    expect(() => parseCronExpression('')).toThrow(/empty/);
+    expect(() => parseCronExpression('   ')).toThrow(/empty/);
+  });
+
+  it('throws on out-of-range minute', () => {
+    expect(() => parseCronExpression('60 * * * *')).toThrow(/minute/);
+  });
+
+  it('throws on out-of-range hour', () => {
+    expect(() => parseCronExpression('0 24 * * *')).toThrow(/hour/);
+  });
+
+  it('throws on out-of-range day-of-month', () => {
+    expect(() => parseCronExpression('0 0 32 * *')).toThrow(/day-of-month/);
+  });
+
+  it('throws on out-of-range month', () => {
+    expect(() => parseCronExpression('0 0 * 13 *')).toThrow(/month/);
+  });
+
+  it('throws on out-of-range day-of-week', () => {
+    expect(() => parseCronExpression('0 0 * * 8')).toThrow(/day-of-week/);
+  });
+
+  it('throws on non-integer step', () => {
+    expect(() => parseCronExpression('*/x * * * *')).toThrow(/step/);
+  });
+
+  it('throws on zero step', () => {
+    expect(() => parseCronExpression('*/0 * * * *')).toThrow(/step/);
+  });
+
+  it('throws on descending range', () => {
+    expect(() => parseCronExpression('5-1 * * * *')).toThrow(/range/);
+  });
+
+  it('throws on empty list term', () => {
+    expect(() => parseCronExpression('1,,3 * * * *')).toThrow(/empty term/);
+  });
+});
+
+describe('rejects malformed numeric tokens', () => {
+  it('rejects negative range lower bound (-5 * * * *)', () => {
+    expect(() => parseCronExpression('-5 * * * *')).toThrow(/digits only|non-negative integer/);
+  });
+
+  it('rejects scientific notation (1e1 * * * *)', () => {
+    expect(() => parseCronExpression('1e1 * * * *')).toThrow(/digits only|non-negative integer/);
+  });
+
+  it('rejects hex notation (0x10 * * * *)', () => {
+    expect(() => parseCronExpression('0x10 * * * *')).toThrow(/digits only|non-negative integer/);
+  });
+
+  it('rejects leading-plus (+5 * * * *)', () => {
+    expect(() => parseCronExpression('+5 * * * *')).toThrow(/digits only|non-negative integer/);
+  });
+
+  it('rejects scientific notation in step (*/1e1 * * * *)', () => {
+    expect(() => parseCronExpression('*/1e1 * * * *')).toThrow(/digits only|non-negative integer/);
+  });
+
+  it('rejects hex notation in step (*/0x10 * * * *)', () => {
+    expect(() => parseCronExpression('*/0x10 * * * *')).toThrow(/digits only|non-negative integer/);
+  });
+
+  it('rejects scientific notation in range (1-1e1 * * * *)', () => {
+    expect(() => parseCronExpression('1-1e1 * * * *')).toThrow(/digits only|non-negative integer/);
+  });
+
+  it('rejects scientific notation in range lower bound (1e1-5 * * * *)', () => {
+    // Symmetric coverage of the lo path — hi was covered by the
+    // 1-1e1 case above. Both lo and hi go through parseCronInt.
+    expect(() => parseCronExpression('1e1-5 * * * *')).toThrow(/digits only|non-negative integer/);
+  });
+
+  it('still accepts plain integers, ranges, lists, and steps', () => {
+    expect(() => parseCronExpression('5 * * * *')).not.toThrow();
+    expect(() => parseCronExpression('1-5 * * * *')).not.toThrow();
+    expect(() => parseCronExpression('1,5,10 * * * *')).not.toThrow();
+    expect(() => parseCronExpression('*/5 * * * *')).not.toThrow();
+    expect(() => parseCronExpression('1-30/5 * * * *')).not.toThrow();
+  });
+});
+
+describe('computeNextCronRun', () => {
+  it('*/5 — from xx:00:30 advances to xx:05:00', () => {
+    const expr = parseCronExpression('*/5 * * * *');
+    const from = localDate(2024, 5, 1, 12, 0, 30);
+    const next = computeNextCronRun(expr, from);
+    expect(next).not.toBeNull();
+    const p = nextLocalParts(next!);
+    expect(p.year).toBe(2024);
+    expect(p.month).toBe(6);
+    expect(p.day).toBe(1);
+    expect(p.hour).toBe(12);
+    expect(p.minute).toBe(5);
+    expect(p.second).toBe(0);
+  });
+
+  it('*/5 — from xx:00:00 advances strictly to xx:05:00, never xx:00:00', () => {
+    const expr = parseCronExpression('*/5 * * * *');
+    const from = localDate(2024, 5, 1, 12, 0, 0);
+    const next = computeNextCronRun(expr, from);
+    expect(next).not.toBeNull();
+    expect(next!).toBeGreaterThan(from);
+    const p = nextLocalParts(next!);
+    expect(p.minute).toBe(5);
+  });
+
+  it('0 9 * * * — from 08:00 advances to 09:00 same day', () => {
+    const expr = parseCronExpression('0 9 * * *');
+    const from = localDate(2024, 5, 1, 8, 0, 0);
+    const next = computeNextCronRun(expr, from);
+    const p = nextLocalParts(next!);
+    expect(p.day).toBe(1);
+    expect(p.hour).toBe(9);
+    expect(p.minute).toBe(0);
+  });
+
+  it('0 9 * * 1-5 — from Saturday 09:00 → next Monday 09:00', () => {
+    const expr = parseCronExpression('0 9 * * 1-5');
+    // 2024-06-01 is a Saturday.
+    const sat = new Date(2024, 5, 1, 9, 0, 0, 0);
+    expect(sat.getDay()).toBe(6);
+    const next = computeNextCronRun(expr, sat.getTime());
+    const p = nextLocalParts(next!);
+    expect(p.dow).toBe(1); // Monday
+    expect(p.day).toBe(3); // 2024-06-03
+    expect(p.hour).toBe(9);
+    expect(p.minute).toBe(0);
+  });
+
+  it('0 12 1 1 * — from mid-year advances to next Jan 1 12:00', () => {
+    const expr = parseCronExpression('0 12 1 1 *');
+    const from = localDate(2024, 5, 1, 0, 0, 0);
+    const next = computeNextCronRun(expr, from);
+    const p = nextLocalParts(next!);
+    expect(p.year).toBe(2025);
+    expect(p.month).toBe(1);
+    expect(p.day).toBe(1);
+    expect(p.hour).toBe(12);
+  });
+
+  it('0 0 31 2 * — Feb has no day 31 → null', () => {
+    const expr = parseCronExpression('0 0 31 2 *');
+    const from = localDate(2024, 0, 1, 0, 0, 0);
+    expect(computeNextCronRun(expr, from)).toBeNull();
+  });
+
+  it('29 2 — Feb 29 fires on leap years', () => {
+    // `0 0 29 2 *` — every Feb 29 midnight.
+    const expr = parseCronExpression('0 0 29 2 *');
+    const from = localDate(2023, 0, 1, 0, 0, 0);
+    const next = computeNextCronRun(expr, from);
+    const p = nextLocalParts(next!);
+    expect(p.year).toBe(2024);
+    expect(p.month).toBe(2);
+    expect(p.day).toBe(29);
+  });
+
+  it('cron-style OR: 0 0 1 * 1 fires on every 1st AND every Monday', () => {
+    const expr = parseCronExpression('0 0 1 * 1');
+    // Sample a few fires across a couple months. Starting Jun 1 2024 (Sat).
+    let cur = localDate(2024, 5, 1, 0, 0, 0) - 1;
+    const fires: { date: Date; dow: number; dom: number }[] = [];
+    for (let i = 0; i < 12; i++) {
+      const n = computeNextCronRun(expr, cur);
+      expect(n).not.toBeNull();
+      const d = new Date(n!);
+      fires.push({ date: d, dow: d.getDay(), dom: d.getDate() });
+      cur = n!;
+    }
+    // Every fire must be either a Monday OR the 1st of a month.
+    for (const f of fires) {
+      const isMonday = f.dow === 1;
+      const isFirst = f.dom === 1;
+      expect(isMonday || isFirst).toBe(true);
+    }
+    // We must see at least one of each (Monday and non-Monday 1st).
+    expect(fires.some((f) => f.dow === 1 && f.dom !== 1)).toBe(true);
+    expect(fires.some((f) => f.dom === 1)).toBe(true);
+  });
+
+  it('returns strictly greater than fromMs', () => {
+    const expr = parseCronExpression('* * * * *');
+    const from = localDate(2024, 5, 1, 12, 30, 45);
+    const next = computeNextCronRun(expr, from);
+    expect(next).not.toBeNull();
+    expect(next!).toBeGreaterThan(from);
+  });
+
+  it('DST transition still advances and never returns < fromMs', () => {
+    // Pick a date around the US DST transition (2024-03-10 spring
+    // forward in America/New_York). The test process TZ may not be
+    // NY, but the invariant "monotonic forward" must hold in any TZ.
+    const expr = parseCronExpression('0 * * * *');
+    const from = localDate(2024, 2, 10, 0, 0, 0);
+    let cur = from;
+    let prev = from;
+    for (let i = 0; i < 48; i++) {
+      const n = computeNextCronRun(expr, cur);
+      expect(n).not.toBeNull();
+      expect(n!).toBeGreaterThan(prev);
+      prev = cur;
+      cur = n!;
+    }
+  });
+});
+
+describe('hasFireWithinYears', () => {
+  it('0 0 31 2 * → false within 5 years', () => {
+    const expr = parseCronExpression('0 0 31 2 *');
+    expect(hasFireWithinYears(expr, 5, localDate(2024, 0, 1))).toBe(false);
+  });
+
+  it('0 12 1 1 * → true within 5 years', () => {
+    const expr = parseCronExpression('0 12 1 1 *');
+    expect(hasFireWithinYears(expr, 5, localDate(2024, 0, 1))).toBe(true);
+  });
+
+  it('* * * * * → true within any nonzero window', () => {
+    const expr = parseCronExpression('* * * * *');
+    expect(hasFireWithinYears(expr, 1, localDate(2024, 0, 1))).toBe(true);
+  });
+
+  it('computeNextCronRun returns null fast for never-firing 0 0 30 2 *', () => {
+    // Feb 30 never exists. Without a wall-time deadline this can scan
+    // tens of thousands of years before bailing. The fix bounds the
+    // search by candidate-date wall time, so this completes in < 500ms
+    // on any sane host.
+    const expr = parseCronExpression('0 0 30 2 *');
+    const start = performance.now();
+    const result = computeNextCronRun(expr, localDate(2024, 0, 1));
+    const elapsedMs = performance.now() - start;
+    expect(result).toBeNull();
+    expect(elapsedMs).toBeLessThan(500);
+  });
+
+  it('hasFireWithinYears returns false fast for never-firing 0 0 30 2 *', () => {
+    const expr = parseCronExpression('0 0 30 2 *');
+    const start = performance.now();
+    const result = hasFireWithinYears(expr, 5, localDate(2024, 0, 1));
+    const elapsedMs = performance.now() - start;
+    expect(result).toBe(false);
+    expect(elapsedMs).toBeLessThan(500);
+  });
+
+  it('hasFireWithinYears respects custom year windows around fire boundary', () => {
+    // Anchor: Jan 1 2024 at midnight. The expression `0 0 1 1 *` fires
+    // at Jan 1 of each year. Within 5 years we will see 5 fires
+    // (2025..2029). With a 0.5-year window starting after Jan 1 we see
+    // nothing until Jan 1 of the next year.
+    const expr = parseCronExpression('0 0 1 1 *');
+    const fromInsideYear = localDate(2024, 5, 1); // mid-2024
+    expect(hasFireWithinYears(expr, 5, fromInsideYear)).toBe(true);
+    // A window that ends before the next Jan 1 must return false.
+    // Jun 1 → ~7 months to Jan 1 2025; 0.5 years ≈ 6 months → false.
+    expect(hasFireWithinYears(expr, 0.5, fromInsideYear)).toBe(false);
+  });
+});
+
+describe('cronToHuman', () => {
+  it('every minute', () => {
+    expect(cronToHuman(parseCronExpression('* * * * *'))).toBe('every minute');
+  });
+
+  it('every 5 minutes', () => {
+    expect(cronToHuman(parseCronExpression('*/5 * * * *'))).toBe('every 5 minutes');
+  });
+
+  it('at HH:MM every day', () => {
+    expect(cronToHuman(parseCronExpression('0 9 * * *'))).toBe('at 09:00 every day');
+    expect(cronToHuman(parseCronExpression('30 14 * * *'))).toBe('at 14:30 every day');
+  });
+
+  it('weekdays / weekends shortcut', () => {
+    expect(cronToHuman(parseCronExpression('0 9 * * 1-5'))).toBe('at 09:00 on weekdays');
+    expect(cronToHuman(parseCronExpression('0 10 * * 0,6'))).toBe('at 10:00 on weekends');
+  });
+
+  it('at HH:MM on day N of <month>', () => {
+    expect(cronToHuman(parseCronExpression('0 12 1 1 *'))).toBe('at 12:00 on day 1 of January');
+  });
+
+  it('every N hours', () => {
+    expect(cronToHuman(parseCronExpression('0 */6 * * *'))).toBe('every 6 hours at minute 00');
+  });
+
+  it('falls back to raw expression for weird patterns', () => {
+    expect(cronToHuman(parseCronExpression('1,7,23 5,17 * * *'))).toBe('1,7,23 5,17 * * *');
+  });
+});
diff --git a/packages/agent-core/test/tools/cron/cron-fire-xml.test.ts b/packages/agent-core/test/tools/cron/cron-fire-xml.test.ts
new file mode 100644
index 0000000000..43b7e2ffe5
--- /dev/null
+++ b/packages/agent-core/test/tools/cron/cron-fire-xml.test.ts
@@ -0,0 +1,92 @@
+/**
+ * Tests for `tools/cron/cron-fire-xml.ts`. Cover the attribute envelope,
+ * recurring vs one-shot rendering, attribute escaping, and verbatim
+ * prompt-body handling (including multi-line and quote content).
+ */
+import { describe, expect, it } from 'vitest';
+
+import type { CronJobOrigin } from '../../../src/agent/context/types';
+import { renderCronFireXml } from '../../../src/tools/cron/cron-fire-xml';
+
+describe('renderCronFireXml', () => {
+  it('recurring origin renders all 5 attributes in order with prompt wrapped', () => {
+    const origin: CronJobOrigin = {
+      kind: 'cron_job',
+      jobId: 'deadbeef',
+      cron: '*/5 * * * *',
+      recurring: true,
+      coalescedCount: 3,
+      stale: false,
+    };
+    const out = renderCronFireXml(origin, 'check the deploy');
+    expect(out).toMatchInlineSnapshot(`
+      "<cron-fire jobId="deadbeef" cron="*/5 * * * *" recurring="true" coalescedCount="3" stale="false">
+      <prompt>
+      check the deploy
+      </prompt>
+      </cron-fire>"
+    `);
+  });
+
+  it('one-shot origin renders recurring="false", coalescedCount="1", stale="false"', () => {
+    const origin: CronJobOrigin = {
+      kind: 'cron_job',
+      jobId: 'cafebabe',
+      cron: '30 14 28 2 *',
+      recurring: false,
+      coalescedCount: 1,
+      stale: false,
+    };
+    const out = renderCronFireXml(origin, 'one-shot ping');
+    expect(out).toContain(
+      '<cron-fire jobId="cafebabe" cron="30 14 28 2 *" recurring="false" coalescedCount="1" stale="false">',
+    );
+    expect(out).toContain('<prompt>\none-shot ping\n</prompt>');
+  });
+
+  it('escapes `&` and `"` in attribute values; leaves prompt body verbatim', () => {
+    const origin: CronJobOrigin = {
+      kind: 'cron_job',
+      jobId: 'job&"id',
+      cron: '0 9 * * *',
+      recurring: true,
+      coalescedCount: 1,
+      stale: false,
+    };
+    const out = renderCronFireXml(origin, 'has a " quote and an & ampersand');
+
+    // Attribute value escapes `&` and `"`.
+    expect(out).toContain('jobId="job&amp;&quot;id"');
+    // Body is verbatim — no escaping of `"` or `&`.
+    expect(out).toContain('has a " quote and an & ampersand');
+    expect(out).not.toContain('&quot; quote');
+  });
+
+  it('preserves newlines in multi-line prompt body', () => {
+    const origin: CronJobOrigin = {
+      kind: 'cron_job',
+      jobId: 'aaaabbbb',
+      cron: '0 * * * *',
+      recurring: true,
+      coalescedCount: 1,
+      stale: false,
+    };
+    const prompt = 'line one\nline two\n\nline four';
+    const out = renderCronFireXml(origin, prompt);
+    expect(out).toContain(`<prompt>\n${prompt}\n</prompt>`);
+  });
+
+  it('renders stale="true" when origin.stale is true', () => {
+    const origin: CronJobOrigin = {
+      kind: 'cron_job',
+      jobId: 'staleone',
+      cron: '0 9 * * *',
+      recurring: true,
+      coalescedCount: 5,
+      stale: true,
+    };
+    const out = renderCronFireXml(origin, 'morning report');
+    expect(out).toContain('stale="true"');
+    expect(out).toContain('coalescedCount="5"');
+  });
+});
diff --git a/packages/agent-core/test/tools/cron/cron-list.test.ts b/packages/agent-core/test/tools/cron/cron-list.test.ts
new file mode 100644
index 0000000000..710258e5f3
--- /dev/null
+++ b/packages/agent-core/test/tools/cron/cron-list.test.ts
@@ -0,0 +1,381 @@
+/**
+ * Tests for `tools/cron/cron-list.ts`.
+ *
+ * Tasks are seeded via `manager.store.add(...)` so we can exercise
+ * corners CronCreate's validator would never let through (notably the
+ * malformed-cron path).
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { CronManager } from '../../../src/agent/cron/manager';
+import {
+  CronListTool,
+  type CronListInput,
+} from '../../../src/tools/cron/cron-list';
+import type {
+  ExecutableToolErrorResult,
+  ExecutableToolResult,
+  RunnableToolExecution,
+  ToolExecution,
+} from '../../../src/loop/types';
+import {
+  createAgentStub,
+  createClocks,
+  scrubCronOutput,
+  WALL_ANCHOR,
+  type AgentStub,
+} from '../../agent/cron/harness/stub';
+
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+
+interface Harness {
+  readonly stub: AgentStub;
+  readonly manager: CronManager;
+  readonly tool: CronListTool;
+}
+
+function makeHarness(wall = WALL_ANCHOR): Harness {
+  const stub = createAgentStub();
+  const manager = new CronManager(stub.agent, {
+    clocks: createClocks(wall).clocks,
+    pollIntervalMs: null,
+  });
+  const tool = new CronListTool(manager);
+  return { stub, manager, tool };
+}
+
+async function runTool(
+  tool: CronListTool,
+  input: CronListInput,
+): Promise<ExecutableToolResult> {
+  const execution = tool.resolveExecution(input);
+  if (isErrorExecution(execution)) {
+    return execution;
+  }
+  return execution.execute({
+    turnId: 'test-turn',
+    toolCallId: 'test-call',
+    signal: new AbortController().signal,
+  });
+}
+
+function isErrorExecution(
+  execution: ToolExecution,
+): execution is ExecutableToolErrorResult {
+  return (execution as RunnableToolExecution).execute === undefined;
+}
+
+function assertSuccess(result: ExecutableToolResult): string {
+  expect(result.isError ?? false).toBe(false);
+  expect(typeof result.output).toBe('string');
+  return result.output as string;
+}
+
+describe('CronListTool', () => {
+  beforeEach(() => {
+    // Disable jitter so `nextFireAt` is the unmodified ideal — keeps
+    // the one-shot-on-`:00` assertion bisectable without needing to
+    // reason about a deterministic-but-task-id-dependent offset.
+    vi.stubEnv('KIMI_CRON_NO_JITTER', '1');
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it('renders the empty case with a zero header and no separator', async () => {
+    const { tool } = makeHarness();
+    const out = assertSuccess(await runTool(tool, {}));
+    expect(out).toMatchInlineSnapshot(`
+      "cron_jobs: 0
+      No cron jobs scheduled."
+    `);
+  });
+
+  it('renders a single recurring task with all expected columns', async () => {
+    const { manager, tool } = makeHarness();
+    const nowMs = manager.clocks.wallNow();
+    manager.store.add(
+      { cron: '*/5 * * * *', prompt: 'hi', recurring: true },
+      nowMs,
+    );
+
+    const out = assertSuccess(await runTool(tool, {}));
+
+    // ageDays is exactly 0.00 (we set createdAt = wallNow); stale is
+    // false (recurring, only 0 days old). id + nextFireAt are scrubbed.
+    expect(scrubCronOutput(out)).toMatchInlineSnapshot(`
+      "cron_jobs: 1
+      id: <id>
+      cron: */5 * * * *
+      humanSchedule: every 5 minutes
+      prompt: "hi"
+      nextFireAt: <iso>
+      recurring: true
+      ageDays: 0.00
+      stale: false"
+    `);
+  });
+
+  it('separates multiple records with \\n---\\n in insertion order', async () => {
+    const { manager, tool } = makeHarness();
+    const nowMs = manager.clocks.wallNow();
+    manager.store.add(
+      { cron: '*/5 * * * *', prompt: 'first', recurring: true },
+      nowMs,
+    );
+    manager.store.add(
+      { cron: '0 12 * * *', prompt: 'second', recurring: false },
+      nowMs,
+    );
+
+    const out = assertSuccess(await runTool(tool, {}));
+    expect(scrubCronOutput(out)).toMatchInlineSnapshot(`
+      "cron_jobs: 2
+      id: <id>
+      cron: */5 * * * *
+      humanSchedule: every 5 minutes
+      prompt: "first"
+      nextFireAt: <iso>
+      recurring: true
+      ageDays: 0.00
+      stale: false
+      ---
+      id: <id>
+      cron: 0 12 * * *
+      humanSchedule: at 12:00 every day
+      prompt: "second"
+      nextFireAt: <iso>
+      recurring: false
+      ageDays: 0.00
+      stale: false"
+    `);
+  });
+
+  it('flags a recurring task older than 7 days as stale', async () => {
+    // Anchor "now" at WALL_ANCHOR; seed the task with createdAt 8
+    // days earlier so age > 7 d crosses the stale threshold.
+    const { manager, tool } = makeHarness();
+    const eightDaysAgo = WALL_ANCHOR - 8 * MS_PER_DAY;
+    manager.store.add(
+      { cron: '*/5 * * * *', prompt: 'old', recurring: true },
+      eightDaysAgo,
+    );
+
+    const out = assertSuccess(await runTool(tool, {}));
+    // ageDays formatted via toFixed(2) is deterministic at 8.00.
+    expect(scrubCronOutput(out)).toMatchInlineSnapshot(`
+      "cron_jobs: 1
+      id: <id>
+      cron: */5 * * * *
+      humanSchedule: every 5 minutes
+      prompt: "old"
+      nextFireAt: <iso>
+      recurring: true
+      ageDays: 8.00
+      stale: true"
+    `);
+  });
+
+  it('reports recurring=false for one-shots; jittered nextFireAt is at-or-before the ideal', async () => {
+    // KIMI_CRON_NO_JITTER is set in beforeEach, so the jittered value
+    // equals the ideal: that satisfies "at-or-before" without making
+    // the test sensitive to the per-task deterministic offset.
+    const { manager, tool } = makeHarness();
+    const nowMs = manager.clocks.wallNow();
+    manager.store.add(
+      { cron: '0 12 * * *', prompt: 'noon', recurring: false },
+      nowMs,
+    );
+
+    const out = assertSuccess(await runTool(tool, {}));
+
+    // Parse the rendered nextFireAt and confirm it is at-or-before
+    // the next ideal noon following `nowMs`. The snapshot scrubs the
+    // exact timestamp; this assertion guards the at-or-before bound.
+    const match = /^nextFireAt: (.+)$/m.exec(out);
+    expect(match).not.toBeNull();
+    const renderedMs = Date.parse(match![1]!);
+    expect(Number.isFinite(renderedMs)).toBe(true);
+    const expected = new Date(nowMs);
+    expected.setSeconds(0, 0);
+    expected.setMinutes(0);
+    expected.setHours(12);
+    if (expected.getTime() <= nowMs) {
+      expected.setDate(expected.getDate() + 1);
+    }
+    expect(renderedMs).toBeLessThanOrEqual(expected.getTime());
+
+    expect(scrubCronOutput(out)).toMatchInlineSnapshot(`
+      "cron_jobs: 1
+      id: <id>
+      cron: 0 12 * * *
+      humanSchedule: at 12:00 every day
+      prompt: "noon"
+      nextFireAt: <iso>
+      recurring: false
+      ageDays: 0.00
+      stale: false"
+    `);
+  });
+
+  it('renders malformed cron as raw / fallback humanSchedule / null nextFireAt without throwing', async () => {
+    const { manager, tool } = makeHarness();
+    // `store.add` does NOT validate — that's the seam we're using to
+    // simulate "this slipped past CronCreate".
+    const nowMs = manager.clocks.wallNow();
+    manager.store.add(
+      { cron: 'garbage', prompt: 'x', recurring: true },
+      nowMs,
+    );
+
+    const out = assertSuccess(await runTool(tool, {}));
+    expect(scrubCronOutput(out)).toMatchInlineSnapshot(`
+      "cron_jobs: 1
+      id: <id>
+      cron: garbage
+      humanSchedule: garbage
+      prompt: "x"
+      nextFireAt: null
+      recurring: true
+      ageDays: 0.00
+      stale: false"
+    `);
+  });
+
+  it('one-shot nextFireAt is anchored at createdAt, not nowMs (pending today’s slot)', async () => {
+    // Scenario from the Codex review: a daily one-shot scheduled for
+    // 12:00 that the agent could not yet deliver (busy turn, manual
+    // tick mode) and is listed 5 minutes after the ideal slot. The
+    // scheduler will still fire today's 12:00 slot from createdAt, so
+    // CronList must report today's 12:00 — not tomorrow's — to stay
+    // consistent with the pending work. Listing tomorrow would teach
+    // the LLM that today's reminder has shipped, even though the
+    // scheduler is still planning to deliver it.
+    const stub = createAgentStub();
+    const harness = createClocks();
+    const manager = new CronManager(stub.agent, {
+      clocks: harness.clocks,
+      pollIntervalMs: null,
+    });
+    const tool = new CronListTool(manager);
+
+    // Anchor "createdAt" at 11:55 local, then advance "now" to 12:05
+    // local without ticking. The scheduler hasn't fired yet (this
+    // test never calls tick); the list must report 12:00 today.
+    const today1155 = new Date();
+    today1155.setHours(11, 55, 0, 0);
+    harness.setNow(today1155.getTime());
+    const createdAt = harness.now();
+    manager.store.add(
+      { cron: '0 12 * * *', prompt: 'noon-pending', recurring: false },
+      createdAt,
+    );
+    harness.advance(10 * 60_000); // now = 12:05
+
+    // Build the expected today-12:00 ISO from the same local TZ the
+    // tool will render in.
+    const expectedToday12 = new Date(today1155);
+    expectedToday12.setHours(12, 0, 0, 0);
+
+    const out = assertSuccess(await runTool(tool, {}));
+    const match = /^nextFireAt: (.+)$/m.exec(out);
+    expect(match).not.toBeNull();
+    const renderedMs = Date.parse(match![1]!);
+    expect(renderedMs).toBe(expectedToday12.getTime());
+  });
+
+  it('nextFireAt for a recurring task in its pending jitter window is the current period, not next period', async () => {
+    // C1 regression: when the ideal slot is past but the jittered
+    // delivery is still pending, CronList must report the pending
+    // slot — otherwise the model is told the fire is one period away
+    // when the scheduler will actually deliver inside the jitter cap.
+    vi.unstubAllEnvs();
+    vi.stubEnv('KIMI_CRON_NO_STALE', '1');
+    const stub = createAgentStub();
+    const harness = createClocks();
+    const manager = new CronManager(stub.agent, {
+      clocks: harness.clocks,
+      pollIntervalMs: null,
+    });
+    const tool = new CronListTool(manager);
+
+    // Anchor at a sharp 5-minute boundary so the next ideal is exactly
+    // 5 min later — keeps the assertion bound simple regardless of
+    // any internal task-id offset (jitter cap is 30 s on a 5-min job).
+    const anchor = new Date();
+    anchor.setSeconds(0, 0);
+    anchor.setMinutes(Math.floor(anchor.getMinutes() / 5) * 5);
+    harness.setNow(anchor.getTime());
+
+    manager.store.add(
+      { cron: '*/5 * * * *', prompt: 'pending-jitter', recurring: true },
+      harness.now(),
+    );
+
+    // Advance 5 min + 1 s — past the next ideal but inside the 30 s
+    // jitter cap.
+    harness.advance(5 * 60_000 + 1_000);
+
+    const out = assertSuccess(await runTool(tool, {}));
+    const match = /^nextFireAt: (.+)$/m.exec(out);
+    expect(match).not.toBeNull();
+    const renderedMs = Date.parse(match![1]!);
+    const now = harness.now();
+    // Rendered fire must be in the *current* jittered window — within
+    // ~30 s of now — not the next-period skip (≥ 4 min ahead).
+    expect(renderedMs - now).toBeGreaterThanOrEqual(0);
+    expect(renderedMs - now).toBeLessThanOrEqual(60_000);
+  });
+
+  it('truncates prompts longer than 200 UTF-8 bytes with a …(truncated) marker', async () => {
+    // Explicit assertions instead of a snapshot: keeps the truncation
+    // boundary visible in the test source rather than buried in a
+    // mostly-x string.
+    const { manager, tool } = makeHarness();
+    const nowMs = manager.clocks.wallNow();
+    const longPrompt = 'x'.repeat(300);
+    manager.store.add(
+      { cron: '*/5 * * * *', prompt: longPrompt, recurring: true },
+      nowMs,
+    );
+
+    const out = assertSuccess(await runTool(tool, {}));
+    const promptMatch = /^prompt: (.+)$/m.exec(out);
+    expect(promptMatch).not.toBeNull();
+    const renderedPromptField = promptMatch![1]!;
+    // JSON-encoded, so closing quote terminates the line.
+    expect(renderedPromptField.endsWith('…(truncated)"')).toBe(true);
+    expect(renderedPromptField.length).toBeLessThan(longPrompt.length);
+    expect(out).toContain('prompt: ');
+  });
+
+  it('walks back to a UTF-8 char boundary when truncating multi-byte prompts', async () => {
+    // Regression: a naïve `subarray(0, 200)` could split a 3-byte CJK
+    // sequence and produce a `�` replacement char on decode. The
+    // `0b1100_0000` continuation-byte walk-back must back off to a
+    // legal char boundary so the rendered preview is valid UTF-8.
+    const { manager, tool } = makeHarness();
+    const nowMs = manager.clocks.wallNow();
+    // `你` is 3 bytes in UTF-8; 100 × 3 = 300 bytes, well past the cap.
+    const cjkPrompt = '你'.repeat(100);
+    manager.store.add(
+      { cron: '*/5 * * * *', prompt: cjkPrompt, recurring: true },
+      nowMs,
+    );
+
+    const out = assertSuccess(await runTool(tool, {}));
+    const promptMatch = /^prompt: (.+)$/m.exec(out);
+    expect(promptMatch).not.toBeNull();
+    const rendered = promptMatch![1]!;
+    expect(rendered.endsWith('…(truncated)"')).toBe(true);
+    // No replacement char — the walk-back stopped at a legal boundary.
+    expect(rendered).not.toContain('�');
+    // Inner content is JSON-stringified; strip the outer quotes and
+    // the trailing `…(truncated)` marker, then verify the remainder
+    // parses back to a run of `你` chars with no fractional sequence.
+    const stripped = rendered.replace(/^"|…\(truncated\)"$/g, '');
+    expect(stripped.length).toBeGreaterThan(0);
+    for (const ch of stripped) expect(ch).toBe('你');
+  });
+});
diff --git a/packages/agent-core/test/tools/cron/jitter.test.ts b/packages/agent-core/test/tools/cron/jitter.test.ts
new file mode 100644
index 0000000000..7815a339a7
--- /dev/null
+++ b/packages/agent-core/test/tools/cron/jitter.test.ts
@@ -0,0 +1,277 @@
+/**
+ * Tests for `tools/cron/jitter.ts`. Fire times are constructed via
+ * `new Date(y, m, d, h, mn, s)` so minute-of-hour assertions are
+ * TZ-stable.
+ */
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import { parseCronExpression } from '../../../src/tools/cron/cron-expr';
+import {
+  DEFAULT_CRON_JITTER_CONFIG,
+  jitteredNextCronRunMs,
+  oneShotJitteredNextCronRunMs,
+} from '../../../src/tools/cron/jitter';
+
+function localDate(
+  y: number,
+  monthIndex: number,
+  d: number,
+  h = 0,
+  m = 0,
+  s = 0,
+): number {
+  return new Date(y, monthIndex, d, h, m, s, 0).getTime();
+}
+
+/**
+ * Two distinct 8-hex ids that produce visibly different jitter
+ * fractions. `aaaaaaaa` ≈ 0.667, `11111111` ≈ 0.067, so any cap > a
+ * few ms yields a separable offset for the "two distinct ids" test.
+ */
+const ID_A = 'aaaaaaaa';
+const ID_B = '11111111';
+
+describe('jitteredNextCronRunMs — recurring', () => {
+  it('offset for */5 * * * * is within [0, 30s] (10% of 5min period)', () => {
+    const parsed = parseCronExpression('*/5 * * * *');
+    const ideal = localDate(2024, 5, 1, 12, 5, 0); // 12:05 local
+    const jittered = jitteredNextCronRunMs(
+      { id: ID_A, cron: '*/5 * * * *', recurring: true },
+      parsed,
+      ideal,
+    );
+    expect(jittered).toBeGreaterThanOrEqual(ideal);
+    expect(jittered - ideal).toBeLessThanOrEqual(30_000);
+  });
+
+  it('offset for daily 0 9 * * * is capped at 15min (NOT 10% of 1 day)', () => {
+    const parsed = parseCronExpression('0 9 * * *');
+    const ideal = localDate(2024, 5, 1, 9, 0, 0);
+    const jittered = jitteredNextCronRunMs(
+      { id: ID_A, cron: '0 9 * * *', recurring: true },
+      parsed,
+      ideal,
+    );
+    expect(jittered).toBeGreaterThanOrEqual(ideal);
+    // 10% of 1 day = 2.4h = 8 640 000 ms, but cap is 15 min.
+    expect(jittered - ideal).toBeLessThanOrEqual(15 * 60_000);
+    // And visibly bigger than the */5 case — long-period jobs spread
+    // further (good for anti-herd at :00).
+    expect(jittered - ideal).toBeGreaterThan(60_000);
+  });
+
+  it('different ids produce different offsets', () => {
+    const parsed = parseCronExpression('*/5 * * * *');
+    const ideal = localDate(2024, 5, 1, 12, 5, 0);
+    const a = jitteredNextCronRunMs(
+      { id: ID_A, cron: '*/5 * * * *', recurring: true },
+      parsed,
+      ideal,
+    );
+    const b = jitteredNextCronRunMs(
+      { id: ID_B, cron: '*/5 * * * *', recurring: true },
+      parsed,
+      ideal,
+    );
+    expect(a).not.toBe(b);
+  });
+
+  it('deterministic: same inputs → same output across calls', () => {
+    const parsed = parseCronExpression('0 9 * * *');
+    const ideal = localDate(2024, 5, 1, 9, 0, 0);
+    const calls = Array.from({ length: 5 }, () =>
+      jitteredNextCronRunMs(
+        { id: ID_A, cron: '0 9 * * *', recurring: true },
+        parsed,
+        ideal,
+      ),
+    );
+    for (const v of calls) {
+      expect(v).toBe(calls[0]);
+    }
+  });
+
+  it('respects KIMI_CRON_NO_JITTER=1 — no offset', () => {
+    const prev = process.env['KIMI_CRON_NO_JITTER'];
+    process.env['KIMI_CRON_NO_JITTER'] = '1';
+    try {
+      const parsed = parseCronExpression('*/5 * * * *');
+      const ideal = localDate(2024, 5, 1, 12, 5, 0);
+      const jittered = jitteredNextCronRunMs(
+        { id: ID_A, cron: '*/5 * * * *', recurring: true },
+        parsed,
+        ideal,
+      );
+      expect(jittered).toBe(ideal);
+    } finally {
+      if (prev === undefined) delete process.env['KIMI_CRON_NO_JITTER'];
+      else process.env['KIMI_CRON_NO_JITTER'] = prev;
+    }
+  });
+});
+
+describe('oneShotJitteredNextCronRunMs', () => {
+  it(':00 → offset within [-90s, 0)', () => {
+    const ideal = localDate(2024, 5, 1, 14, 0, 0);
+    const jittered = oneShotJitteredNextCronRunMs({ id: ID_A }, ideal);
+    expect(jittered - ideal).toBeLessThanOrEqual(0);
+    expect(jittered - ideal).toBeGreaterThanOrEqual(-90_000);
+    // ID_A's fraction ≈ 0.667 → expect ~ -60s, not 0.
+    expect(jittered).toBeLessThan(ideal);
+  });
+
+  it(':30 → offset within [-90s, 0)', () => {
+    const ideal = localDate(2024, 5, 1, 14, 30, 0);
+    const jittered = oneShotJitteredNextCronRunMs({ id: ID_A }, ideal);
+    expect(jittered - ideal).toBeLessThanOrEqual(0);
+    expect(jittered - ideal).toBeGreaterThanOrEqual(-90_000);
+    expect(jittered).toBeLessThan(ideal);
+  });
+
+  it(':07 → passthrough, offset = 0', () => {
+    const ideal = localDate(2024, 5, 1, 14, 7, 0);
+    const jittered = oneShotJitteredNextCronRunMs({ id: ID_A }, ideal);
+    expect(jittered).toBe(ideal);
+  });
+
+  it(':15 → passthrough, offset = 0', () => {
+    const ideal = localDate(2024, 5, 1, 14, 15, 0);
+    const jittered = oneShotJitteredNextCronRunMs({ id: ID_A }, ideal);
+    expect(jittered).toBe(ideal);
+  });
+
+  it('mid-minute (non-zero seconds component baked into idealMs) → passthrough', () => {
+    // Sub-minute granularity means the model didn't pick a round
+    // wall-clock minute — leave it alone.
+    const ideal = localDate(2024, 5, 1, 14, 0, 12);
+    const jittered = oneShotJitteredNextCronRunMs({ id: ID_A }, ideal);
+    expect(jittered).toBe(ideal);
+  });
+
+  it('deterministic: same id + same ideal → same output', () => {
+    const ideal = localDate(2024, 5, 1, 14, 0, 0);
+    const calls = Array.from({ length: 5 }, () =>
+      oneShotJitteredNextCronRunMs({ id: ID_A }, ideal),
+    );
+    for (const v of calls) {
+      expect(v).toBe(calls[0]);
+    }
+  });
+
+  it('respects KIMI_CRON_NO_JITTER=1', () => {
+    const prev = process.env['KIMI_CRON_NO_JITTER'];
+    process.env['KIMI_CRON_NO_JITTER'] = '1';
+    try {
+      const ideal = localDate(2024, 5, 1, 14, 0, 0);
+      const jittered = oneShotJitteredNextCronRunMs({ id: ID_A }, ideal);
+      expect(jittered).toBe(ideal);
+    } finally {
+      if (prev === undefined) delete process.env['KIMI_CRON_NO_JITTER'];
+      else process.env['KIMI_CRON_NO_JITTER'] = prev;
+    }
+  });
+
+  it('skips jitter when budget insufficient — returns idealMs, never earlier', () => {
+    // Schedule a one-shot at 08:59:30 for `0 9 * * *` with a high-hash
+    // id. The unclamped pull-forward lands at 08:58:30. A previous
+    // version clamped to `createdAt` (08:59:30), but the scheduler
+    // condition `now >= nextFireAt` then fires on the next tick —
+    // ~29 s before ideal. We skip jitter instead and return idealMs.
+    const ideal = localDate(2024, 5, 1, 9, 0, 0);
+    const createdAt = ideal - 30_000; // 08:59:30
+    const jittered = oneShotJitteredNextCronRunMs(
+      { id: 'ffffffff', createdAt },
+      ideal,
+    );
+    expect(jittered).toBeGreaterThanOrEqual(createdAt);
+    expect(jittered).toBeLessThanOrEqual(ideal);
+    expect(jittered).toBe(ideal);
+  });
+
+  it('still pulls forward when createdAt leaves enough room', () => {
+    // 5-minute gap between createdAt and ideal — well past the 90 s
+    // oneShotMaxMs cap, so the budget is sufficient and the jitter
+    // applies normally. Regression: the budget-insufficient branch
+    // must not poison the happy path.
+    const ideal = localDate(2024, 5, 1, 9, 0, 0);
+    const createdAt = ideal - 5 * 60_000;
+    const jittered = oneShotJitteredNextCronRunMs(
+      { id: 'ffffffff', createdAt },
+      ideal,
+    );
+    expect(jittered).toBeGreaterThanOrEqual(createdAt);
+    expect(jittered).toBeLessThan(ideal);
+    expect(ideal - jittered).toBeLessThanOrEqual(90_000);
+  });
+
+  it('passes through unchanged when createdAt is not provided (legacy callers)', () => {
+    // Backward-compat: existing test fixtures and external callers
+    // that don't carry a `createdAt` must keep getting the original
+    // unclamped behaviour.
+    const ideal = localDate(2024, 5, 1, 14, 0, 0);
+    const jittered = oneShotJitteredNextCronRunMs({ id: 'ffffffff' }, ideal);
+    expect(jittered).toBeLessThanOrEqual(ideal);
+    expect(ideal - jittered).toBeLessThanOrEqual(90_000);
+  });
+});
+
+describe('config knobs', () => {
+  it('default config is the documented constants', () => {
+    expect(DEFAULT_CRON_JITTER_CONFIG.recurringMaxFractionOfPeriod).toBe(0.1);
+    expect(DEFAULT_CRON_JITTER_CONFIG.recurringMaxMs).toBe(15 * 60_000);
+    expect(DEFAULT_CRON_JITTER_CONFIG.oneShotMaxMs).toBe(90_000);
+  });
+
+  it('custom oneShotMaxMs caps the pull-forward', () => {
+    const ideal = localDate(2024, 5, 1, 14, 0, 0);
+    const jittered = oneShotJitteredNextCronRunMs(
+      { id: ID_A },
+      ideal,
+      { ...DEFAULT_CRON_JITTER_CONFIG, oneShotMaxMs: 10_000 },
+    );
+    expect(jittered - ideal).toBeGreaterThanOrEqual(-10_000);
+    expect(jittered - ideal).toBeLessThanOrEqual(0);
+  });
+
+  it('custom recurringMaxMs caps the forward shift', () => {
+    const parsed = parseCronExpression('0 9 * * *');
+    const ideal = localDate(2024, 5, 1, 9, 0, 0);
+    const jittered = jitteredNextCronRunMs(
+      { id: ID_A, cron: '0 9 * * *', recurring: true },
+      parsed,
+      ideal,
+      { ...DEFAULT_CRON_JITTER_CONFIG, recurringMaxMs: 5_000 },
+    );
+    expect(jittered - ideal).toBeGreaterThanOrEqual(0);
+    expect(jittered - ideal).toBeLessThanOrEqual(5_000);
+  });
+});
+
+describe('id hashing fallback', () => {
+  it('non-hex id still produces a stable fraction', () => {
+    const parsed = parseCronExpression('*/5 * * * *');
+    const ideal = localDate(2024, 5, 1, 12, 5, 0);
+    const a1 = jitteredNextCronRunMs(
+      { id: 'non-hex-id!', cron: '*/5 * * * *', recurring: true },
+      parsed,
+      ideal,
+    );
+    const a2 = jitteredNextCronRunMs(
+      { id: 'non-hex-id!', cron: '*/5 * * * *', recurring: true },
+      parsed,
+      ideal,
+    );
+    expect(a1).toBe(a2);
+    expect(a1).toBeGreaterThanOrEqual(ideal);
+    expect(a1 - ideal).toBeLessThanOrEqual(30_000);
+  });
+});
+
+// Belt-and-suspenders: ensure env state we touched is clean after the
+// suite (in case a future test in the same vitest worker reads it).
+beforeEach(() => {
+  delete process.env['KIMI_CRON_NO_JITTER'];
+});
+afterEach(() => {
+  delete process.env['KIMI_CRON_NO_JITTER'];
+});
diff --git a/packages/agent-core/test/tools/cron/no-date-now.test.ts b/packages/agent-core/test/tools/cron/no-date-now.test.ts
new file mode 100644
index 0000000000..b7f836089c
--- /dev/null
+++ b/packages/agent-core/test/tools/cron/no-date-now.test.ts
@@ -0,0 +1,53 @@
+/**
+ * Guard: forbid `Date.now()` in cron scheduler-adjacent files.
+ *
+ * The natural home for this rule is ESLint `no-restricted-syntax`, but
+ * oxlint 1.59 does not implement it — so we scan source files here
+ * instead. `clock.ts` is excluded because it is where the wall-clock
+ * abstraction is *defined*. Non-existent files (P2 additions) are
+ * skipped so the guard activates automatically when they land.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { describe, expect, it } from 'vitest';
+import { dirname, join } from 'pathe';
+import { fileURLToPath } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+// `test/tools/cron/` → package root → `src/tools/cron/`.
+const cronSrcDir = join(here, '..', '..', '..', 'src', 'tools', 'cron');
+
+const GUARDED_FILES = [
+  'scheduler.ts',
+  'persist.ts',
+  'lock.ts',
+  'jitter.ts',
+] as const;
+
+// Matches a `Date.now(` call. Word boundary on the `D` side so it
+// won't trip on `myDate.now(` or `notDate.now(`; arbitrary whitespace
+// between `now` and `(` so `Date.now ()` and `Date . now (` both
+// catch.  The intent is "the CallExpression `Date.now(...)`" — this
+// regex is the cheap proxy for the AST selector we'd use in ESLint.
+const DATE_NOW_REGEX = /\bDate\s*\.\s*now\s*\(/;
+
+describe('cron scheduler files do not call Date.now()', () => {
+  for (const file of GUARDED_FILES) {
+    it(`${file} contains no Date.now() call`, () => {
+      const path = join(cronSrcDir, file);
+      if (!existsSync(path)) {
+        // File hasn't been added yet (P1/P2 commits introduce
+        // scheduler.ts, persist.ts, lock.ts). The guard activates
+        // automatically once they exist.
+        return;
+      }
+      const source = readFileSync(path, 'utf8');
+      const match = DATE_NOW_REGEX.exec(source);
+      expect(
+        match,
+        `Found \`Date.now()\` in ${file} at offset ${match?.index ?? -1}. ` +
+          `Use ClockSources.wallNow() instead — direct Date.now() bypasses ` +
+          `test/bench clock injection. clock.ts is the single legal exception.`,
+      ).toBeNull();
+    });
+  }
+});
diff --git a/packages/agent-core/test/tools/cron/scheduler.test.ts b/packages/agent-core/test/tools/cron/scheduler.test.ts
new file mode 100644
index 0000000000..91bc6f9254
--- /dev/null
+++ b/packages/agent-core/test/tools/cron/scheduler.test.ts
@@ -0,0 +1,618 @@
+/**
+ * Tests for `tools/cron/scheduler.ts`. Time is injected via
+ * `ClockSources`; `KIMI_CRON_NO_JITTER=1` pins fire counts on the
+ * recurring tests.
+ */
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import type { ClockSources } from '../../../src/tools/cron/clock';
+import {
+  createCronScheduler,
+  type CronScheduler,
+} from '../../../src/tools/cron/scheduler';
+import type { CronTask } from '../../../src/tools/cron/types';
+
+interface HarnessOptions {
+  readonly isIdle?: boolean;
+  readonly isKilled?: boolean;
+  readonly pollIntervalMs?: number | null;
+  readonly onFireThrows?: boolean;
+}
+
+interface Harness {
+  readonly scheduler: CronScheduler;
+  readonly tasks: CronTask[];
+  readonly fired: Array<{ task: CronTask; coalescedCount: number }>;
+  readonly removed: string[];
+  advance(ms: number): void;
+  setIdle(v: boolean): void;
+  setKilled(v: boolean): void;
+  setOnFireThrows(v: boolean): void;
+  now(): number;
+}
+
+// Fixed wall-clock anchor (Nov 14 2023, 22:13:20 UTC). Picked so it
+// doesn't sit on any "round" minute mark — the next "every 5 minutes"
+// fire lands 4-5 minutes ahead, not exactly 5.
+const WALL_ANCHOR = 1_700_000_000_000;
+
+function createHarness(opts: HarnessOptions = {}): Harness {
+  let now = WALL_ANCHOR;
+  let mono = 1_000_000;
+  const clocks: ClockSources = {
+    wallNow: () => now,
+    monoNowMs: () => mono,
+  };
+  const tasks: CronTask[] = [];
+  const fired: Array<{ task: CronTask; coalescedCount: number }> = [];
+  const removed: string[] = [];
+  let idle = opts.isIdle ?? true;
+  let killed = opts.isKilled ?? false;
+  let onFireThrows = opts.onFireThrows ?? false;
+
+  const scheduler = createCronScheduler({
+    clocks,
+    source: () => tasks,
+    onFire: (task, ctx) => {
+      if (onFireThrows) {
+        throw new Error('onFire boom');
+      }
+      fired.push({ task, coalescedCount: ctx.coalescedCount });
+    },
+    isIdle: () => idle,
+    isKilled: () => killed,
+    removeOneShot: (id) => {
+      removed.push(id);
+      const i = tasks.findIndex((t) => t.id === id);
+      if (i >= 0) tasks.splice(i, 1);
+    },
+    // Tests use manual tick() unless they explicitly opt into the timer.
+    pollIntervalMs: opts.pollIntervalMs ?? null,
+  });
+
+  return {
+    scheduler,
+    tasks,
+    fired,
+    removed,
+    advance: (ms: number) => {
+      now += ms;
+      mono += ms;
+    },
+    setIdle: (v: boolean) => {
+      idle = v;
+    },
+    setKilled: (v: boolean) => {
+      killed = v;
+    },
+    setOnFireThrows: (v: boolean) => {
+      onFireThrows = v;
+    },
+    now: () => now,
+  };
+}
+
+/**
+ * Tiny helper: 8-hex id deterministic per-call so each test gets a
+ * stable id without colliding across tasks within a test.
+ */
+let idCounter = 0;
+function nextId(): string {
+  idCounter++;
+  return idCounter.toString(16).padStart(8, '0');
+}
+
+function makeTask(overrides: Partial<CronTask> & { cron: string; createdAt: number }): CronTask {
+  return {
+    id: overrides.id ?? nextId(),
+    prompt: overrides.prompt ?? 'do the thing',
+    cron: overrides.cron,
+    createdAt: overrides.createdAt,
+    recurring: overrides.recurring,
+  };
+}
+
+const ORIGINAL_ENV_NO_JITTER = process.env['KIMI_CRON_NO_JITTER'];
+
+describe('createCronScheduler — tick behaviour', () => {
+  beforeEach(() => {
+    // Pin exact fire times in every test by default. The single test
+    // that exercises jitter restores the env explicitly.
+    process.env['KIMI_CRON_NO_JITTER'] = '1';
+    idCounter = 0;
+  });
+
+  afterEach(() => {
+    if (ORIGINAL_ENV_NO_JITTER === undefined) {
+      delete process.env['KIMI_CRON_NO_JITTER'];
+    } else {
+      process.env['KIMI_CRON_NO_JITTER'] = ORIGINAL_ENV_NO_JITTER;
+    }
+  });
+
+  it('recurring task fires once when due', () => {
+    const h = createHarness();
+    h.tasks.push(
+      makeTask({ cron: '*/5 * * * *', createdAt: h.now(), recurring: true }),
+    );
+    // Not yet due — first call to tick should not fire.
+    h.scheduler.tick();
+    expect(h.fired).toHaveLength(0);
+
+    // Advance ~6 minutes — past the next */5 boundary regardless of
+    // where WALL_ANCHOR landed in the minute cycle.
+    h.advance(6 * 60_000);
+    h.scheduler.tick();
+
+    expect(h.fired).toHaveLength(1);
+    expect(h.fired[0]!.coalescedCount).toBe(1);
+  });
+
+  it('recurring task coalesces missed fires when scheduler sleeps', () => {
+    const h = createHarness();
+    h.tasks.push(
+      makeTask({ cron: '*/5 * * * *', createdAt: h.now(), recurring: true }),
+    );
+    // Advance 15 minutes — we should see 3 collapsed ideal fires.
+    h.advance(15 * 60_000);
+    h.scheduler.tick();
+
+    expect(h.fired).toHaveLength(1);
+    expect(h.fired[0]!.coalescedCount).toBeGreaterThanOrEqual(3);
+    expect(h.fired[0]!.coalescedCount).toBeLessThanOrEqual(4);
+  });
+
+  it('one-shot task fires once then is removed', () => {
+    const h = createHarness();
+    // createdAt is 1 minute earlier so we can advance past the next
+    // 12:00 without anchoring needing a precise local-tz computation.
+    h.tasks.push(
+      makeTask({
+        cron: '0 12 * * *',
+        createdAt: h.now() - 60_000,
+        recurring: false,
+      }),
+    );
+    const taskId = h.tasks[0]!.id;
+
+    // Advance one full day — guaranteed to pass at least one 12:00.
+    h.advance(25 * 60 * 60_000);
+    h.scheduler.tick();
+
+    expect(h.fired).toHaveLength(1);
+    expect(h.fired[0]!.coalescedCount).toBe(1);
+    expect(h.removed).toEqual([taskId]);
+    expect(h.tasks).toHaveLength(0);
+  });
+
+  it('isIdle=false suppresses fire but does not lose the task', () => {
+    const h = createHarness({ isIdle: false });
+    h.tasks.push(
+      makeTask({ cron: '*/5 * * * *', createdAt: h.now(), recurring: true }),
+    );
+
+    // Five minutes pass mid-turn — tick should not fire.
+    h.advance(6 * 60_000);
+    h.scheduler.tick();
+    expect(h.fired).toHaveLength(0);
+
+    // Turn ends — the next tick picks the missed fire up.
+    h.setIdle(true);
+    h.scheduler.tick();
+    expect(h.fired).toHaveLength(1);
+    expect(h.fired[0]!.coalescedCount).toBe(1);
+  });
+
+  it('isKilled=true short-circuits even when due and idle', () => {
+    const h = createHarness({ isKilled: true });
+    h.tasks.push(
+      makeTask({ cron: '*/5 * * * *', createdAt: h.now(), recurring: true }),
+    );
+    h.advance(6 * 60_000);
+    h.scheduler.tick();
+    expect(h.fired).toHaveLength(0);
+
+    // Lifting the killswitch lets the missed fire through.
+    h.setKilled(false);
+    h.scheduler.tick();
+    expect(h.fired).toHaveLength(1);
+  });
+
+  it('bad cron expression does not stop other tasks in the same tick', () => {
+    const h = createHarness();
+    // Insert a task whose cron string will throw at parse time. We
+    // bypass any normal "constructor" by pushing a raw object — the
+    // scheduler must swallow the parse failure for this one task and
+    // continue processing the rest.
+    const bad: CronTask = {
+      id: nextId(),
+      cron: 'not a cron at all',
+      prompt: 'bad',
+      createdAt: h.now(),
+      recurring: true,
+    };
+    const good: CronTask = {
+      id: nextId(),
+      cron: '*/5 * * * *',
+      prompt: 'good',
+      createdAt: h.now(),
+      recurring: true,
+    };
+    h.tasks.push(bad, good);
+
+    h.advance(6 * 60_000);
+    h.scheduler.tick();
+
+    expect(h.fired).toHaveLength(1);
+    expect(h.fired[0]!.task.id).toBe(good.id);
+  });
+
+  it('only the due task fires when two tasks are scheduled', () => {
+    const h = createHarness();
+    h.tasks.push(
+      makeTask({ cron: '*/5 * * * *', createdAt: h.now(), recurring: true }),
+      makeTask({ cron: '0 0 1 1 *', createdAt: h.now(), recurring: true }),
+    );
+    const dueId = h.tasks[0]!.id;
+
+    h.advance(6 * 60_000);
+    h.scheduler.tick();
+
+    expect(h.fired).toHaveLength(1);
+    expect(h.fired[0]!.task.id).toBe(dueId);
+  });
+
+  it('recurring fires exactly once per turn even if multiple ideal fires elapse mid-turn', () => {
+    // Regression for US-15: a long busy turn over the 1-hour boundary
+    // must collapse into a single fire when idle returns.
+    const h = createHarness({ isIdle: false });
+    h.tasks.push(
+      makeTask({ cron: '*/5 * * * *', createdAt: h.now(), recurring: true }),
+    );
+
+    // 17 minutes elapse mid-turn — three ideal fires missed.
+    h.advance(17 * 60_000);
+    h.scheduler.tick();
+    expect(h.fired).toHaveLength(0);
+
+    h.setIdle(true);
+    h.scheduler.tick();
+    expect(h.fired).toHaveLength(1);
+    expect(h.fired[0]!.coalescedCount).toBeGreaterThanOrEqual(3);
+  });
+
+  it('recurring task whose onFire throws is retried on the next tick', () => {
+    // C3 regression: a throwing onFire must NOT advance lastSeenAt or
+    // consume the ideal fire. Otherwise a transient persistence error
+    // silently drops the reminder.
+    const h = createHarness({ onFireThrows: true });
+    h.tasks.push(
+      makeTask({ cron: '*/5 * * * *', createdAt: h.now(), recurring: true }),
+    );
+
+    // Past the next */5 boundary — task is due.
+    h.advance(6 * 60_000);
+    h.scheduler.tick();
+    // Throw swallowed; no delivery recorded.
+    expect(h.fired).toHaveLength(0);
+
+    // Recover and tick again — the same ideal must still be reachable.
+    h.setOnFireThrows(false);
+    h.scheduler.tick();
+    expect(h.fired).toHaveLength(1);
+    // Coalesced from the same just-past slot, not a phantom past
+    // delivery — the count is the natural 1 (or up to the gap), never
+    // skipped to a later period.
+    expect(h.fired[0]!.coalescedCount).toBe(1);
+  });
+
+  it('one-shot whose onFire throws is NOT removed and retries on the next tick', () => {
+    // C3 regression for one-shots: removeOneShot must be gated on a
+    // successful delivery so a transient throw doesn't lose the
+    // reminder entirely.
+    const h = createHarness({ onFireThrows: true });
+    h.tasks.push(
+      makeTask({
+        cron: '*/5 * * * *',
+        createdAt: h.now(),
+        recurring: false,
+      }),
+    );
+    const taskId = h.tasks[0]!.id;
+
+    h.advance(6 * 60_000);
+    h.scheduler.tick();
+    expect(h.fired).toHaveLength(0);
+    // Critical: still present in the store, not removed.
+    expect(h.tasks).toHaveLength(1);
+    expect(h.tasks[0]!.id).toBe(taskId);
+    expect(h.removed).toEqual([]);
+
+    // Recover — delivery succeeds and removeOneShot runs.
+    h.setOnFireThrows(false);
+    h.scheduler.tick();
+    expect(h.fired).toHaveLength(1);
+    expect(h.removed).toEqual([taskId]);
+    expect(h.tasks).toHaveLength(0);
+  });
+});
+
+describe('createCronScheduler — getNextFireTime', () => {
+  beforeEach(() => {
+    process.env['KIMI_CRON_NO_JITTER'] = '1';
+    idCounter = 0;
+  });
+
+  afterEach(() => {
+    if (ORIGINAL_ENV_NO_JITTER === undefined) {
+      delete process.env['KIMI_CRON_NO_JITTER'];
+    } else {
+      process.env['KIMI_CRON_NO_JITTER'] = ORIGINAL_ENV_NO_JITTER;
+    }
+  });
+
+  it('returns null when there are no tasks', () => {
+    const h = createHarness();
+    expect(h.scheduler.getNextFireTime()).toBeNull();
+  });
+
+  it('returns the minimum next-fire across tasks', () => {
+    const h = createHarness();
+    // Soonest: every minute. Latest: yearly Jan 1.
+    h.tasks.push(
+      makeTask({ cron: '* * * * *', createdAt: h.now(), recurring: true }),
+      makeTask({ cron: '0 0 1 1 *', createdAt: h.now(), recurring: true }),
+    );
+
+    const next = h.scheduler.getNextFireTime();
+    expect(next).not.toBeNull();
+    // The minute-cron's next fire is within 1 minute of now; the
+    // yearly cron is at least days away. So `next` must be within
+    // 65s of now.
+    expect(next! - h.now()).toBeLessThanOrEqual(65_000);
+  });
+});
+
+describe('createCronScheduler — getNextFireForTask', () => {
+  beforeEach(() => {
+    process.env['KIMI_CRON_NO_JITTER'] = '1';
+    idCounter = 0;
+  });
+
+  afterEach(() => {
+    if (ORIGINAL_ENV_NO_JITTER === undefined) {
+      delete process.env['KIMI_CRON_NO_JITTER'];
+    } else {
+      process.env['KIMI_CRON_NO_JITTER'] = ORIGINAL_ENV_NO_JITTER;
+    }
+  });
+
+  it('returns null for unknown id', () => {
+    const h = createHarness();
+    expect(h.scheduler.getNextFireForTask('00000000')).toBeNull();
+    h.tasks.push(
+      makeTask({ cron: '*/5 * * * *', createdAt: h.now(), recurring: true }),
+    );
+    // Unknown id even when there are other tasks.
+    expect(h.scheduler.getNextFireForTask('ffffffff')).toBeNull();
+  });
+
+  it('returns the same value getNextFireTime would for a single-task store', () => {
+    const h = createHarness();
+    h.tasks.push(
+      makeTask({ cron: '*/5 * * * *', createdAt: h.now(), recurring: true }),
+    );
+    const taskId = h.tasks[0]!.id;
+    const aggregate = h.scheduler.getNextFireTime();
+    const perTask = h.scheduler.getNextFireForTask(taskId);
+    expect(perTask).not.toBeNull();
+    expect(perTask).toBe(aggregate);
+  });
+
+  it('preserves pending jittered slot when ideal is just past', () => {
+    // C1 load-bearing assertion: an already-past ideal whose jittered
+    // delivery is still in the future must be returned as the next
+    // fire, not skipped to the following period.
+    delete process.env['KIMI_CRON_NO_JITTER'];
+    const h = createHarness();
+    // id `ffffffff` → fraction ≈ 1.0 → recurring offset ≈ 30s (10% of
+    // 5-min period).
+    h.tasks.push(
+      makeTask({
+        id: 'ffffffff',
+        cron: '*/5 * * * *',
+        createdAt: h.now(),
+        recurring: true,
+      }),
+    );
+    const taskId = h.tasks[0]!.id;
+
+    // Burn one fire so lastSeenAt advances onto a known 5-min slot;
+    // from this point the period structure is regular.
+    h.advance(6 * 60_000 + 30_000);
+    h.scheduler.tick();
+    expect(h.fired).toHaveLength(1);
+    const firedAtIdeal = h.fired[0]!.task; // proves we delivered
+
+    // The next ideal sits 5 min after the previous ideal. Capture
+    // `getNextFireForTask` as the source of truth, then advance just
+    // past that ideal but BEFORE the jittered +30s delivery.
+    const idealPlusJitter = h.scheduler.getNextFireForTask(taskId);
+    expect(idealPlusJitter).not.toBeNull();
+    expect(firedAtIdeal.id).toBe(taskId);
+
+    // Step to 20s past the next ideal: ideal is at (idealPlusJitter -
+    // 30s); we are now 10s short of the jittered delivery point.
+    const stepTo = idealPlusJitter! - 10_000;
+    h.advance(stepTo - h.now());
+
+    // Pending current-period slot — should still report the same
+    // jittered timestamp, NOT skip to the next period.
+    const next = h.scheduler.getNextFireForTask(taskId);
+    expect(next).toBe(idealPlusJitter);
+    // Sanity: that timestamp is in the very near future, not 5 min
+    // later (which would be the next-period skip we are preventing).
+    expect(next! - h.now()).toBeLessThanOrEqual(15_000);
+    expect(next! - h.now()).toBeGreaterThan(0);
+  });
+});
+
+describe('createCronScheduler — start/stop lifecycle', () => {
+  beforeEach(() => {
+    process.env['KIMI_CRON_NO_JITTER'] = '1';
+    idCounter = 0;
+  });
+
+  afterEach(() => {
+    if (ORIGINAL_ENV_NO_JITTER === undefined) {
+      delete process.env['KIMI_CRON_NO_JITTER'];
+    } else {
+      process.env['KIMI_CRON_NO_JITTER'] = ORIGINAL_ENV_NO_JITTER;
+    }
+  });
+
+  it('start() with pollIntervalMs=null does not auto-tick', async () => {
+    const h = createHarness({ pollIntervalMs: null });
+    h.tasks.push(
+      makeTask({ cron: '*/5 * * * *', createdAt: h.now(), recurring: true }),
+    );
+    h.scheduler.start();
+    h.advance(60 * 60_000);
+    // Yield so any (unintended) timer would have fired.
+    await new Promise((resolve) => setTimeout(resolve, 30));
+    expect(h.fired).toHaveLength(0);
+    await h.scheduler.stop();
+  });
+
+  it('start() with a small pollIntervalMs wires up the auto-tick', async () => {
+    const h = createHarness({ pollIntervalMs: 20 });
+    h.tasks.push(
+      makeTask({ cron: '*/5 * * * *', createdAt: h.now(), recurring: true }),
+    );
+    h.advance(6 * 60_000); // task is now due
+    h.scheduler.start();
+
+    // Wait long enough for at least one interval tick to elapse.
+    await new Promise((resolve) => setTimeout(resolve, 80));
+    await h.scheduler.stop();
+
+    expect(h.fired.length).toBeGreaterThanOrEqual(1);
+    // Coalesced to a single fire — auto-ticks subsequent to the first
+    // see lastSeenAt = now and have nothing new to fire.
+    expect(h.fired[0]!.coalescedCount).toBe(1);
+  });
+
+  it('stop() is idempotent and clears state', async () => {
+    const h = createHarness({ pollIntervalMs: null });
+    h.scheduler.start();
+    await h.scheduler.stop();
+    await h.scheduler.stop();
+    // Calling tick() after stop is still safe.
+    h.scheduler.tick();
+    expect(h.fired).toHaveLength(0);
+  });
+
+  it('start() is idempotent', () => {
+    const h = createHarness({ pollIntervalMs: null });
+    expect(() => {
+      h.scheduler.start();
+      h.scheduler.start();
+    }).not.toThrow();
+    // No auto-tick (interval is null) → no fires sneak in.
+    expect(h.fired).toHaveLength(0);
+  });
+});
+
+describe('createCronScheduler — jitter integration', () => {
+  beforeEach(() => {
+    delete process.env['KIMI_CRON_NO_JITTER'];
+    idCounter = 0;
+  });
+
+  afterEach(() => {
+    if (ORIGINAL_ENV_NO_JITTER === undefined) {
+      delete process.env['KIMI_CRON_NO_JITTER'];
+    } else {
+      process.env['KIMI_CRON_NO_JITTER'] = ORIGINAL_ENV_NO_JITTER;
+    }
+  });
+
+  it('recurring task with jitter fires after advancing past the cap', () => {
+    const h = createHarness();
+    // 30s past 6 minutes guarantees we crossed the ideal + max(10% of
+    // 5min = 30s) jitter cap.
+    h.tasks.push(
+      makeTask({ cron: '*/5 * * * *', createdAt: h.now(), recurring: true }),
+    );
+    h.advance(6 * 60_000 + 30_000);
+    h.scheduler.tick();
+
+    expect(h.fired).toHaveLength(1);
+    expect(h.fired[0]!.coalescedCount).toBe(1);
+  });
+
+  it('one-shot task always reports coalescedCount=1 even after a long backlog', () => {
+    // A daily one-shot left un-delivered for a week should still
+    // report `coalescedCount: 1` — one-shots are removed after a
+    // single delivery, so multi-occurrence counts are meaningless and
+    // would mislead the LLM into thinking it missed multiple
+    // scheduled events.
+    process.env['KIMI_CRON_NO_JITTER'] = '1';
+    try {
+      const h = createHarness();
+      const task = makeTask({
+        cron: '0 9 * * *',
+        createdAt: h.now(),
+        recurring: false,
+      });
+      h.tasks.push(task);
+      h.advance(7 * 24 * 60 * 60_000);
+      h.scheduler.tick();
+
+      expect(h.fired).toHaveLength(1);
+      expect(h.fired[0]!.coalescedCount).toBe(1);
+      expect(h.removed).toEqual([task.id]);
+    } finally {
+      delete process.env['KIMI_CRON_NO_JITTER'];
+    }
+  });
+
+  it('does not advance baseline past a not-yet-jittered ideal fire', () => {
+    // The bot-flagged scenario: when the next ideal fire's jittered
+    // delivery is still in the future, `countCoalesced` must not
+    // include it and `lastSeenAt` must not advance past it — otherwise
+    // the jittered delivery is lost on the next tick. (jitter ON).
+    //
+    // Setup: id `ffffffff` → fraction ≈ 1.0 → recurring offset = 10%
+    // of 5-min period = 30s. After firing the first slot, the next
+    // ideal is +5 min and its jittered delivery is +5 min 30s.
+    delete process.env['KIMI_CRON_NO_JITTER'];
+    const h = createHarness();
+    h.tasks.push(
+      makeTask({
+        id: 'ffffffff',
+        cron: '*/5 * * * *',
+        createdAt: h.now(),
+        recurring: true,
+      }),
+    );
+    // Cross the first jittered fire (6m past anchor + 30s buffer).
+    h.advance(6 * 60_000 + 30_000);
+    h.scheduler.tick();
+    expect(h.fired).toHaveLength(1);
+
+    // The next ideal is the very next `*/5` after the first ideal —
+    // 5 minutes later — with the same 30s jitter offset. Advance just
+    // past the ideal but short of the jittered delivery; the
+    // scheduler must NOT fire yet, and must keep the slot reachable.
+    h.advance(20_000); // now is 20s past the next ideal, still 10s short of jittered
+    h.scheduler.tick();
+    expect(h.fired).toHaveLength(1);
+
+    // Cross the jittered delivery point — the slot fires now.
+    h.advance(60_000);
+    h.scheduler.tick();
+    expect(h.fired).toHaveLength(2);
+    expect(h.fired[1]!.coalescedCount).toBe(1);
+  });
+});
diff --git a/packages/agent-core/test/tools/cron/session-store.test.ts b/packages/agent-core/test/tools/cron/session-store.test.ts
new file mode 100644
index 0000000000..9e75af98cb
--- /dev/null
+++ b/packages/agent-core/test/tools/cron/session-store.test.ts
@@ -0,0 +1,180 @@
+/**
+ * Tests for `tools/cron/session-store.ts`.
+ */
+import { describe, expect, it } from 'vitest';
+
+import {
+  SessionCronStore,
+  type SessionCronTaskInit,
+} from '../../../src/tools/cron/session-store';
+
+const ID_REGEX = /^[0-9a-f]{8}$/;
+
+/** Convenience: minimal valid init that varies by suffix so tests can
+ *  tell two tasks apart in `list()` snapshots. */
+function makeInit(suffix: string, overrides: Partial<SessionCronTaskInit> = {}): SessionCronTaskInit {
+  return {
+    cron: '*/5 * * * *',
+    prompt: `prompt-${suffix}`,
+    recurring: true,
+    ...overrides,
+  };
+}
+
+describe('SessionCronStore', () => {
+  describe('add', () => {
+    it('returns a task with id matching /^[0-9a-f]{8}$/', () => {
+      const store = new SessionCronStore();
+      const task = store.add(makeInit('a'), 1000);
+      expect(task.id).toMatch(ID_REGEX);
+    });
+
+    it('preserves cron / prompt / recurring from the init', () => {
+      const store = new SessionCronStore();
+      const init: SessionCronTaskInit = {
+        cron: '0 9 * * 1-5',
+        prompt: 'sync PRs',
+        recurring: true,
+      };
+      const task = store.add(init, 1000);
+      expect(task.cron).toBe('0 9 * * 1-5');
+      expect(task.prompt).toBe('sync PRs');
+      expect(task.recurring).toBe(true);
+    });
+
+    it('sets createdAt to the supplied nowMs (no internal clock read)', () => {
+      const store = new SessionCronStore();
+      const task = store.add(makeInit('a'), 1_700_000_000_000);
+      expect(task.createdAt).toBe(1_700_000_000_000);
+    });
+
+    it('does not consult Date.now()', () => {
+      // Sentinel: a nowMs deliberately not close to "now" makes
+      // accidental Date.now() use obvious in createdAt.
+      const store = new SessionCronStore();
+      const task = store.add(makeInit('a'), 0);
+      expect(task.createdAt).toBe(0);
+    });
+
+    it('rapid sequential adds produce distinct ids', () => {
+      const store = new SessionCronStore();
+      const ids = new Set<string>();
+      for (let i = 0; i < 32; i++) {
+        ids.add(store.add(makeInit(`x${i}`), 1000 + i).id);
+      }
+      expect(ids.size).toBe(32);
+    });
+  });
+
+  describe('get', () => {
+    it('returns a previously-added task', () => {
+      const store = new SessionCronStore();
+      const task = store.add(makeInit('a'), 1000);
+      expect(store.get(task.id)).toEqual(task);
+    });
+
+    it('returns undefined for an unknown id', () => {
+      const store = new SessionCronStore();
+      expect(store.get('deadbeef')).toBeUndefined();
+    });
+  });
+
+  describe('list', () => {
+    it('returns tasks in insertion order', () => {
+      const store = new SessionCronStore();
+      const t1 = store.add(makeInit('1'), 1000);
+      const t2 = store.add(makeInit('2'), 1001);
+      const t3 = store.add(makeInit('3'), 1002);
+      expect(store.list().map((t) => t.id)).toEqual([t1.id, t2.id, t3.id]);
+    });
+
+    it('returns a fresh array on each call (no aliasing)', () => {
+      const store = new SessionCronStore();
+      store.add(makeInit('a'), 1000);
+      const a = store.list();
+      const b = store.list();
+      expect(a).not.toBe(b);
+      expect(a).toEqual(b);
+    });
+
+    it('mutating the returned array does not affect the store', () => {
+      const store = new SessionCronStore();
+      store.add(makeInit('a'), 1000);
+      const snap = store.list() as unknown as CronTaskLike[];
+      snap.length = 0;
+      expect(store.list()).toHaveLength(1);
+    });
+
+    it('returns empty array on a fresh store', () => {
+      const store = new SessionCronStore();
+      expect(store.list()).toEqual([]);
+    });
+  });
+
+  describe('remove', () => {
+    it('returns only the ids that were actually present', () => {
+      const store = new SessionCronStore();
+      const t1 = store.add(makeInit('1'), 1000);
+      const t2 = store.add(makeInit('2'), 1001);
+      const removed = store.remove([t1.id, 'missing0', t2.id]);
+      expect(removed).toEqual([t1.id, t2.id]);
+    });
+
+    it('actually removes the tasks from list / get', () => {
+      const store = new SessionCronStore();
+      const t1 = store.add(makeInit('1'), 1000);
+      store.remove([t1.id]);
+      expect(store.get(t1.id)).toBeUndefined();
+      expect(store.list()).toHaveLength(0);
+    });
+
+    it('returns empty array when nothing matches', () => {
+      const store = new SessionCronStore();
+      store.add(makeInit('a'), 1000);
+      expect(store.remove(['ffffffff', 'eeeeeeee'])).toEqual([]);
+    });
+
+    it('preserves insertion order of remaining tasks', () => {
+      const store = new SessionCronStore();
+      const t1 = store.add(makeInit('1'), 1000);
+      const t2 = store.add(makeInit('2'), 1001);
+      const t3 = store.add(makeInit('3'), 1002);
+      store.remove([t2.id]);
+      expect(store.list().map((t) => t.id)).toEqual([t1.id, t3.id]);
+    });
+  });
+
+  describe('clear', () => {
+    it('empties the store', () => {
+      const store = new SessionCronStore();
+      store.add(makeInit('a'), 1000);
+      store.add(makeInit('b'), 1001);
+      store.clear();
+      expect(store.list()).toEqual([]);
+    });
+
+    it('is a no-op on an already-empty store', () => {
+      const store = new SessionCronStore();
+      expect(() => store.clear()).not.toThrow();
+      expect(store.list()).toEqual([]);
+    });
+  });
+
+  describe('id uniqueness at scale', () => {
+    it('256 adds produce 256 unique 8-hex ids', () => {
+      const store = new SessionCronStore();
+      const ids = new Set<string>();
+      for (let i = 0; i < 256; i++) {
+        const task = store.add(makeInit(`x${i}`), 1000 + i);
+        expect(task.id).toMatch(ID_REGEX);
+        ids.add(task.id);
+      }
+      expect(ids.size).toBe(256);
+      expect(store.list()).toHaveLength(256);
+    });
+  });
+});
+
+/** Local alias for the mutate-snapshot test that needs a writable view
+ *  of `readonly CronTask[]` without dragging in the real CronTask type. */
+type CronTaskLike = { id: string };
diff --git a/packages/agent-core/test/tools/plan-mode-hard-block.test.ts b/packages/agent-core/test/tools/plan-mode-hard-block.test.ts
index edee34cc2d..90fb2ca13e 100644
--- a/packages/agent-core/test/tools/plan-mode-hard-block.test.ts
+++ b/packages/agent-core/test/tools/plan-mode-hard-block.test.ts
@@ -237,6 +237,35 @@ describe('Plan mode permission policy', () => {
     },
   );
 
+  it('denies CronCreate when plan mode is active', async () => {
+    const { agent } = await activePlanAgent();
+
+    const result = evaluatePlanPolicy(agent, 'CronCreate', {
+      cron: '*/5 * * * *',
+      prompt: 'ping',
+    });
+
+    const deny = expectDeny(result);
+    expect(deny.message ?? '').toContain('CronCreate');
+    expect(deny.message ?? '').toContain('plan mode');
+  });
+
+  it('denies CronDelete when plan mode is active', async () => {
+    const { agent } = await activePlanAgent();
+
+    const result = evaluatePlanPolicy(agent, 'CronDelete', { id: 'job_1' });
+
+    const deny = expectDeny(result);
+    expect(deny.message ?? '').toContain('CronDelete');
+    expect(deny.message ?? '').toContain('plan mode');
+  });
+
+  it('allows CronList when plan mode is active', async () => {
+    const { agent } = await activePlanAgent();
+
+    expect(evaluatePlanPolicy(agent, 'CronList', {})).toBeUndefined();
+  });
+
   it('does not block anything once plan mode has exited', async () => {
     const { agent, planMode } = await activePlanAgent();
     planMode.exit();