diff --git a/docs/memory/feature-flows.md b/docs/memory/feature-flows.md
index cb505c206..50fbd7725 100644
--- a/docs/memory/feature-flows.md
+++ b/docs/memory/feature-flows.md
@@ -26,6 +26,7 @@
 | 2026-08-16 | #1710 | refactor(auth): **retire the `slack.py` INV-8 carve-out** left by #1310. The 11 inline `if not db.can_user_*_agent(...): raise 403` sites (each carrying a `# noqa: inv8` waiver) migrated onto the shared imperative guards — `assert_agent_access` (3 read) / `assert_agent_owner` (8 owner) in `dependencies.py`. **Behavior-preserving** (AC #6): same 403 + `detail` string byte-for-byte; every site was already access-first so no 404-before-403 enumeration oracle is introduced (AC #5); the helpers add `_enforce_connector_scope` first, redundant belt-and-braces since a connector key is already 403'd at the auth entry point before reaching any slack handler. Site #10 (proactive-consent toggle) keeps its ent#223 human-only `reject_agent_principal` line — `assert_agent_owner` is agent-permissive. **Zero** `# noqa: inv8` markers remain in-tree; the static guard `test_1310_auth_wiring` still trips a re-introduced inline gate. Behavioral proof added to `test_1310_auth_consolidation` (A9: stranger→403, shared-reader read/owner matrix, site-#10 human-only vs site-#11 send asymmetry) + a runtime ordering proof in `test_223_slack_channel_proactive_consent`. IDOR/public-link/rate-limit logic untouched. | [slack-integration.md](feature-flows/slack-integration.md), [role-model.md](feature-flows/role-model.md) |
 | 2026-08-16 | #1704 | feat(plugins): **an agent's Claude Code plugin selection is a declared, committed, self-healing manifest**. **Reframe first**: the issue's premise ("a recreate loses plugins") is not reproducible — HOME (`/home/developer`) IS the durable `agent-{name}-workspace` volume, no recreate removes it, and startup.sh preserves untracked files, so a plain recreate keeps `~/.claude.json` and the `~/.claude/plugins/` cache both. The real gap is a **git-based reconstitution** onto a fresh/empty volume or a new host (the #1169 move exports `data/` only; the #834/#1581 hard-purge removes the volume) — a gap #1705 completed by removing the last incidental crutch (the cache used to be auto-committed). Mechanism = the agent-local half of trinity-enterprise#192: a `template.yaml plugins:` block → total tolerant reader `services/template_plugins.py` (the ent#89 shape; both catalog builders surface `plugins`+`plugin_errors`) → `_TemplateResolution.declared_plugins` fed by **all three** resolver branches (github source metadata / local `template_data` / copy snapshot — NOT `template_data`, which is `{}` on the github: path) → `git_service.materialize_plugins` writes nested `~/.trinity/plugins.yaml` via the shared injection-safe heredoc writer (`sort_keys=True` for byte-stability so the 15-min auto-sync loop never re-commits a churning manifest), opt-in + ghost-skipped + non-fatal in the rollback fence. **Committed** via `_TRINITY_AUTHORED_PATHS` (the #2070 `!` re-include + rm-cached exemption) so it survives the reconstitution — while `.claude.json`/`.claude/plugins/` stay gitignored (**#1705 intact**, never un-ignored). **Boot self-heal**: `startup.sh` runs `agent_server.plugins_reinstall` AFTER credential injection (a private marketplace needs a git credential — resolved from `GITHUB_PAT` env, never the manifest), hardened-parses the untrusted manifest (`AliasPolicy.REJECT`), re-charset-validates every name and the marketplace **`source`** (the dangerous arg — refuses `user:token@` userinfo/traversal/leading `-`), reads current state via `claude plugin [marketplace] list --json` and installs only what's missing (arg-lists, hard `timeout`+`stdin=DEVNULL` so a no-TTY prompt can't hang) — **zero subprocesses** when present. Base-image change → old images silently skip the hook (release-note ordering). **Deferred**: capturing runtime `/plugin install`s (a distill of Claude's undocumented moving internals) and a commit-pinned (`auto_update: off`) mode. | [agent-plugin-manifest.md](feature-flows/agent-plugin-manifest.md), [github-sync.md](feature-flows/github-sync.md), [agent-data-volumes.md](feature-flows/agent-data-volumes.md) |
 | 2026-08-14 | #2127 | fix(agent-runtime): **a fan-out turn is no longer killed mid-wait and booked as SUCCESS**. `claude --print` emits one `{"type":"result"}` per turn *segment* and deliberately stays alive to await background subagents/workflows — they are exempt from the ~5s background-shell grace "because their result is part of the final output" — but #970's early-completion set `result_seen` on **any** result line and SIGTERMed the process group 2s later with `return_code = 0`. So the CLI was killed *during a wait it was performing correctly*: the run recorded **success** with the model's "I'll wait for the notification" announcement stored as its response, cost billed, subagents killed, nothing logged. **The issue's own stated root cause was wrong** — it blamed the result classifier for trusting a clean `end_turn`, but the classifier never runs, and building its suggested transcript-scanner would have been a detector layered on our own kill. **#1870 is the same defect from the other end** (fast notification → interrupted follow-on turn → `error_during_execution`), i.e. one bug filed twice. Root-caused by instrumenting Claude Code 2.1.220 in a live agent container: first result t+37.82s, real answer t+40.32s, exit t+40.72s — the kill lands ≤t+39.82s. Fix requires **all three** of `result_seen`, an empty ledger, and a quiet stream. Ledger half: `system/background_tasks_changed` carries a full snapshot of in-flight work (`[A]→[A,B]→[A,B,C]→[B,C]→[B]→[]`), so the latest event is the whole truth. **Idle half — not optional**: the ledger alone misses the reported shape, because once the fan-out ends the ledger drains to `[]` while the model composes the synthesis (measured: 5 subagents done by t+27.8s, real `FINAL REPORT` at t+55.9s), so a ledger-only gate lets the kill land on `"ECHO reported."`. Idleness is what #970's failure *is* — claude alive, blocked on an MCP child, silent. `_IDLE_FINALIZE_S`=**300s** (`AGENT_IDLE_FINALIZE_S`, `<=0` refused), set from the worst silence a healthy run makes: without `--include-partial-messages` one long message is one stdout line emitted only when complete — **40.54s of dead air for 9,840 chars**, vs a 7.33s worst gap across three fan-out runs — so ~7.4× headroom, biased large because too-large only delays the pathological #970 finalize while too-small destroys a deliverable and calls it success. Free on the happy path: the branch is only reachable when the process does **not** exit. `_NON_WAITED_BG_TASK_TYPES = {local_bash, local_shell}` is a **denylist** because the failures are asymmetric — an allowlist that hasn't heard of a future waited type restores the bug *silently*, a denylist miss costs a bounded wait — and a background shell must never hold the finalize, since the CLI kills it after ~5s (measured 5.09s) and gating on one re-opens #970's lingering-child class. Malformed ledger ⇒ 0 (degrades to pre-fix behaviour, never a new hang class); the read takes `task_type` only, never `description`/`prompt`/`summary` (subagent prompt text and output). `CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS` derived from the execution timeout at **both** spawn sites — the chat path never had the kill but inherits the same 10-minute CLI truncation, and fixing only the reported path is the recurring one-of-two-call-sites escape (#686, #1264). When the CLI stops waiting anyway, finalize prepends a notice + sets `metadata.background_tasks_pending_at_exit`, after the #160 empty-response branch so it can't make an empty result look populated. ⚠️ Consequence: fan-outs now run to completion, so they spend more and can newly reach `--max-turns`. Base-image rebuild + cold recreate required. 20 tests, asserting **end state** (the late answer survives, not the placeholder) and verified failing without the gate | [parallel-headless-execution.md](feature-flows/parallel-headless-execution.md) |
+| 2026-08-13 | #925 | feat(ui): **client-side cron validation + invalid-schedule warning icon** — the schedule form pre-validates as the user types via `utils/cronValidation.js`, a zero-dependency hand-rolled mirror of the backend's EXACT grammar (`schedule_validation.py` 5-field split + verbatim `_dow_to_apscheduler` port + APScheduler 3.11 field rules, incl. the prefix-match name expressions, the step-span rule and the Python-truthiness `last or MAX` fallback — JS `\|\|` on purpose, not `??`); cron libs were rejected on ≥8 proven verdict disagreements. Contract = `tests/fixtures/cron-grammar-cases.json` (111 rows PROBED against the live validator, never hand-typed) asserted row-for-row by BOTH `tests/unit/test_925_cron_grammar_fixture.py` (the drift alarm in the backend CI env) and the vitest spec — an APScheduler bump that moves the grammar fails CI loudly instead of desynchronizing the mirror. Form: the format-hint line doubles as the reserved error slot (no modal jump; every message shape measured ≤2 lines at the modal's real 400px width); submit disabled ONLY when non-empty-AND-invalid (empty keeps the native `required` bubble); editing shows an invalid stored cron unconditionally so a dead Update button is never unexplained. List: warning triangle inside the cron chip, tooltip exactly "Invalid cron expression". Fail-open (`{valid:true}` on internal error) — the backend 400 stays the authority; backend runtime untouched | [scheduling.md](feature-flows/scheduling.md) |
 | 2026-08-12 | ent#100 | feat(grid): **Recent failures info tile** — the first DATA tile on the ent#325 widget chassis: newest failed executions fleet-wide plus the 24h total, from the EXISTING `GET /api/executions?status=failed` + `/api/executions/stats`, ridden on the one 60s visibility-aware batch poll and gated on the tile being enabled. **Zero backend change, no new endpoint, no schema change, no new timer** — the tile never fetches, because viewport culling *unmounts* tiles and an `onMounted` fetch would re-issue on every pan. The green "No failures in 24h ✓" is treated as a POSITIVE claim needing positive evidence and is unreachable from all three faults that would otherwise manufacture it: a failed rows GET (#1926), a failed `/stats` GET (the 24h total is a second request, so its failure means UNKNOWN, not zero — hence one `{data,loaded,error}` triple per GET, never shared), and an **unenumerable fleet** (`accessible_agent_names` → `list_all_agents_fast()` returns `[]` on ANY Docker fault, so a non-admin gets HTTP 200 + zeros — the ent#384 hazard, closed client-side by requiring a non-empty roster). A *refresh* failure over loaded rows still stays `ready`; only the CONFIRMATION needs everything green. Named AC deviation: **no error-code taxonomy** — `schedule_executions` has no `error_code` column, so `failureCodeFromSummary` READS an anchored lower-case `[code]` marker when the platform emitted one and returns null otherwise; a JS re-classifier was rejected as a third unenforced mirror of the byte-identical `failure_classifier.py` pair guessing at a 200-char truncation. Chassis fixes: info tiles get the **unfiltered** roster (`orgAgents || agents`) so the ent#261 type-to-filter can't degrade fleet-tile labels to raw slugs per keystroke; the shared 1s tick only reaches catalog entries declaring `wantsTick`; `InfoTile` sets `inheritAttrs: false`. Both tile guards were narrower than their own stated job and were widened: `gridTokens` now auto-discovers tiles recursively (it was a hand-written two-entry list) and `gridTileLinks` now brace-balances `to:` object literals built in `<script setup>` (it matched only a literal `link-to` ATTRIBUTE, so every per-row link was invisible — on the guard whose failure mode is a frozen dashboard). Sibling **Next schedules** (ent#99) deliberately HELD; its motivating `ORDER BY next_run_at` static guard ships anyway, because that latent bug exists today | [dashboard-grid-view.md](feature-flows/dashboard-grid-view.md) |
 | 2026-08-12 | #2137 | refactor(compat): **align the agent-compatibility catalog with what the platform implements and the marketplace generates**. 101 checks -> 88; a `create-agent`-scaffolded agent went from **9 findings (6 SOFT + 3 INFO)** — none the author's fault, none actionable — to **0 HARD, 0 SOFT, 5 INFO**. Three classes. (1) **Gating on fields nothing reads**: `template.yaml`'s `git:` block has no backend reader and no bundled template declares it, yet **T-017 was HARD** (+G-003/4/5); same for `metrics:` (D-006) and `.trinity/post-check` (I-005), whose only other mention was a `git_service` comment pointing back at I-005. The post-check PATH stays in `_TRINITY_AUTHORED_PATHS` — #2070 derives the `!` re-includes from it and 14 templates ship `!.trinity/post-check`. (2) **Failing every agent we ship**: `_slash_command()` anchored at position 0, but the marketplace writes `"Run /pipeline-tick"` — so **P-006, the HARD guard against a scheduled run hanging on an approval gate, had never fired**; `_command_names()` globbed `.claude/commands/` only, the one layout the wizards never produce, so X-007 false-failed skill-based agents; G-002 compared against the 58-entry fleet-wide list **Trinity itself injects** (`.bashrc`, `.ssh/`, …). (3) **Self-contradiction**: P-009 says split `SKILL.md`, P-004 then flagged the resulting `reference.md`. Plus: a "duplicate" is not always a severity duplicate — `c_k002` was literally `return c_t015(snap)` but K-002 was **HARD** and T-015 **SOFT**, so retiring it would have silently downgraded the credential gate and undone ent#128; **T-015 promoted to HARD**, caught by that issue's own test. P-006 now honours the marketplace `automation: gated|manual` opt-out (an intentional pause is a design choice). And the anti-drift test **did not hold**: `test_ids_match_doc` matched a SINGLE-letter `[A-Z]-\d{3}`, so `DP-001`..`DP-005` sat documented, indexed and unimplemented while the test reported the files in sync — regex widened, `DP-001..004` implemented (DP-001 shares `_is_safe_data_path` with the materializer), DP-005 retired, and a new `test_severities_match_doc` guards the column an operator actually reads. Retired ids are never reissued so persisted `checks_json` stays interpretable. | [agent-compatibility-validation.md](feature-flows/agent-compatibility-validation.md) |
 | 2026-08-09 | #1897 | fix(canary): **a rejected Slack post is undelivered, and gets retried**. `CanaryAlerts.emit_transition` was `-> None` and dropped `post_webhook`'s `success`, so the caller read "did not raise" as "delivered": it counted the transition, advanced `canary:last_cycle_at`, and continuing-red suppression then silenced that invariant **forever** — the alert unrecoverable while `cumulative_transitions` reported it sent. Fix = `AlertResult(outcome, error)` over a 3-state `AlertDelivery`; SKIPPED is deliberately **not** FAILED (no webhook configured is the default install, and folding it in would arm a retry per transition and end in a give-up ERROR on a correctly silent sink), and the caller withholds the count only on an **explicit** FAILED (`outcome is not AlertDelivery.FAILED`) so a stub returning a bare enum or `None` keeps today's reading. Retry state is per-invariant in the Redis hash `canary:alert_pending`, **not** the cycle-global cursor — withholding that cursor retries nothing (the invariant's own freshly-inserted row already post-dates it) while silently swallowing an unrelated red→green→red flip, which is why the issue's own proposed fix was rejected, on a corrected reason. The entry is armed **BEFORE** the POST and `HDEL`'d on success: `asyncio.CancelledError` is not an `Exception` and `stop()` cancels a live cycle, so arm-on-failure loses the alert on every deploy landing inside the 5s webhook await (removing the pre-await write turns exactly one test red). Bounded by **age**, not attempts — `MAX_ALERT_PENDING_AGE_SECONDS` (1800) per contiguous failure run, with a 3-interval run decay so brief flaps can't spend a later outage's window and a one-interval retry floor so the ungated manual `run-cycle` can't burn it; because the budget is checked *after* each attempt (so the ERROR quotes a real elapsed and a real `last_error`), a run ends on the first attempt whose age *exceeds* the window: **8 POSTs over 2100s** at the 5-min default, not 6 over 30 min. ⚠️ **API contract change:** `RunCycleResponse.transitions` now means *delivered*, not *detected* — `undelivered_invariant_ids` rides beside it so a webhook outage can't render as a green cycle, and `cumulative_transitions_detected` preserves the detection metric. Everything fails open to exactly the pre-#1897 behaviour, and the record is parsed per field so one corrupt value can't disable retry fleet-wide. No schema change, no migration, no flag (Redis-only) | [architecture.md](architecture.md) |
diff --git a/docs/memory/feature-flows/scheduling.md b/docs/memory/feature-flows/scheduling.md
index efcc2455e..641eba585 100644
--- a/docs/memory/feature-flows/scheduling.md
+++ b/docs/memory/feature-flows/scheduling.md
@@ -693,6 +693,32 @@ Broadcast via dedicated scheduler -> Redis pub/sub -> backend WebSocket relay fo
 - `0 */6 * * *` - Every 6 hours
 - `*/30 * * * *` - Every 30 minutes
 
+### Client-side cron validation (#925)
+
+The schedule form pre-validates the cron expression as the user types, and the list marks
+stored-invalid rows — the backend 400 is no longer the first feedback (design-system p17).
+
+- **Validator**: `src/frontend/src/utils/cronValidation.js` — a pure, zero-dependency mirror of
+  the backend's exact grammar (`services/schedule_validation.py::validate_cron_expression`:
+  5-field split + verbatim `_dow_to_apscheduler` port + APScheduler 3.11 field rules, including
+  the prefix-matched name expressions, the step-span rule, and the Python-truthiness
+  `last or MAX` fallback). Total + fail-open: an internal error returns `{valid: true}` so a
+  port bug can never brick the panel; the server 400 stays the authority.
+- **Form gating** (`SchedulesPanel.vue`): `shouldShowCronError` (pure, exported) — while
+  creating, the inline error appears only after first blur and only for non-empty input; while
+  editing, an invalid stored cron (incl. empty) shows unconditionally. The format-hint line is
+  the reserved error slot (no modal jump). Submit is disabled only when the cron is
+  **non-empty AND invalid** — empty keeps the native `required` bubble. Presets come from the
+  exported `CRON_PRESETS` and are fixture-proven valid.
+- **Row icon**: `computeCronValidityMap(schedules)` → warning triangle inside the cron chip for
+  invalid rows, tooltip/aria-label exactly `Invalid cron expression`.
+- **Drift alarm**: both suites assert the shared probe-generated fixture
+  `tests/fixtures/cron-grammar-cases.json` — `tests/unit/test_925_cron_grammar_fixture.py`
+  against the live backend validator (fires on an APScheduler grammar change),
+  `src/frontend/tests/unit/cronValidation.spec.js` against the client mirror. Quirk rows
+  (`MON/999`, `jan/0`, `lastx`, `0-6,1` vs `0-6`, falsy-zero `0-0/2`) are pinned verbatim and
+  must not be "fixed" — parity outranks tidiness.
+
 ---
 
 ## Dependencies
diff --git a/docs/memory/requirements/scheduling.md b/docs/memory/requirements/scheduling.md
index 84765dfc7..0dfc2e7c5 100644
--- a/docs/memory/requirements/scheduling.md
+++ b/docs/memory/requirements/scheduling.md
@@ -739,6 +739,54 @@ schedules:
   `docs/memory/feature-flows/scheduling.md`,
   `docs/memory/feature-flows/agent-compatibility-validation.md`
 
+### 10.17 Client-Side Cron Validation (#925)
+- **Status**: ✅ Implemented (2026-08-13)
+- **GitHub Issue**: #925
+- **Description**: The schedule form validated cron expressions only at save time — the backend's
+  400 was the first feedback — and a stored-invalid row (legacy croniter-era data, or rows created
+  before a validator tightening) sat in the list indistinguishable from a healthy one. The frontend
+  now pre-validates as the user types (design-system p17) and marks invalid stored rows.
+- **Requirement — mirror contract, not a second grammar**: the client validator
+  (`src/frontend/src/utils/cronValidation.js`, pure leaf, **zero npm deps**) is a hand-rolled
+  mirror of the backend's exact acceptance grammar —
+  `services/schedule_validation.py::validate_cron_expression` = strict 5-field split +
+  `_dow_to_apscheduler` translation (ported verbatim, branch order included) + APScheduler 3.11
+  field rules (`AllExpression`/`RangeExpression`/name-range prefix expressions, step-span rule,
+  Python-truthiness `last or MAX` fallback — deliberately `||` not `??` in JS). Cron libs
+  (`cron-parser`, `cronstrue`) were rejected: they implement a foreign grammar with ≥8 proven
+  verdict disagreements (`@daily`, 6-field, dow `0-6`, `last`, `7/2`, `L`/`#`, step-span,
+  `5/2`). This is the learnings.md #1472 lesson ("validate with the parser that registers")
+  applied one level up: the client validates with a pinned mirror of that parser.
+- **Drift alarm — shared fixture asserted by both suites**: the grammar contract is
+  `tests/fixtures/cron-grammar-cases.json` (~110 rows, **generated from a probe against the live
+  backend validator, never hand-typed**). `tests/unit/test_925_cron_grammar_fixture.py` re-proves
+  every row against `validate_cron_expression` in the backend CI env (an APScheduler bump that
+  changes the grammar fails there loudly); `src/frontend/tests/unit/cronValidation.spec.js`
+  asserts the client mirror agrees row-for-row. Quirk rows (prefix-matched names `MON/999` /
+  `jan/0` / `lastx`, comma-translation asymmetry `0-6,1` vs `0-6`, falsy-zero `0-0/2`) are
+  pinned and must NOT be "fixed" — parity outranks tidiness.
+- **Fail-open posture**: the validator is total (`String(expr ?? '')`) and a top-level catch
+  returns `{valid: true}` + `console.error` — an internal port bug must not brick the panel or
+  block saves. The backend 400 remains the enforcement authority; client validation is UX only.
+- **Form gating**: inline error in a reserved-footprint slot (the format-hint line doubles as the
+  error slot — no modal jump, p4/p6); submit disabled **only when non-empty AND invalid** — an
+  empty cron keeps the native `required` bubble path; while **editing**, an invalid (incl.
+  empty/whitespace) stored cron shows its error unconditionally so the disabled Update button is
+  never unexplained; while creating, errors appear only after first blur (no mid-typing flash).
+- **List surface**: each stored row with an invalid `cron_expression` renders a warning triangle
+  inside its cron chip, tooltip + aria-label exactly `Invalid cron expression` (shape + hue,
+  p24). Presets are sourced from the exported `CRON_PRESETS` so "presets never warn" is tested
+  against the shipped list.
+- **Documented divergence (client-stricter only)**: the client accepts ASCII digits only where
+  Python's `int()`/`\d` also accept Unicode digits / `+` signs / underscores — rejecting e.g.
+  `٥ * * * *` that the server accepts. Direction is client-stricter on absurd input; the
+  damaging direction (client-invalid/server-valid false warnings on real input) is guarded by
+  the quirk rows. The fixture marks such rows `divergence: "client-stricter"`.
+- **Out of scope**: no backend runtime change (400 contract byte-preserved); no server-side
+  migration/repair of stored invalid rows; no client timezone validation (the form select is a
+  fixed known-good list; cron field validity is timezone-independent).
+- **Flow**: `docs/memory/feature-flows/scheduling.md` (§ Client-side cron validation)
+
 ---
 
 ## 34. Agent-Defined Pipelines (#919)
diff --git a/src/frontend/src/components/SchedulesPanel.vue b/src/frontend/src/components/SchedulesPanel.vue
index 0287248dc..9bad359fd 100644
--- a/src/frontend/src/components/SchedulesPanel.vue
+++ b/src/frontend/src/components/SchedulesPanel.vue
@@ -74,16 +74,29 @@
                 type="text"
                 required
                 placeholder="0 9 * * *"
+                @blur="cronTouched = true"
                 class="w-full px-3 py-2 border border-gray-300 dark:border-gray-600 dark:bg-gray-700 dark:text-white rounded-md font-mono focus:outline-none focus:ring-2 focus:ring-action-primary-500"
               />
-              <p class="text-xs text-gray-500 dark:text-gray-400 mt-1">
-                Format: minute hour day month day_of_week (e.g., "0 9 * * *" for 9 AM daily)
+              <!-- #925: the format hint doubles as the reserved error slot — one
+                   footprint (min-h-8 ≈ the hint's own 2 wrapped lines), so the
+                   modal never jumps when validation kicks in (p4/p6). -->
+              <p
+                class="text-xs mt-1 min-h-8"
+                :class="showCronError ? 'text-status-danger-600 dark:text-status-danger-400' : 'text-gray-500 dark:text-gray-400'"
+              >
+                <template v-if="showCronError"><span data-testid="cron-error">{{ cronVerdict.error }}</span></template>
+                <template v-else>Format: minute hour day month day_of_week (e.g., "0 9 * * *" for 9 AM daily)</template>
               </p>
               <div class="mt-1 flex flex-wrap gap-1">
-                <button type="button" @click="setCronPreset('0 9 * * *')" class="text-xs px-2 py-0.5 bg-gray-100 dark:bg-gray-700 rounded hover:bg-gray-200 dark:hover:bg-gray-600 dark:text-gray-300">Daily 9 AM</button>
-                <button type="button" @click="setCronPreset('0 9 * * 1')" class="text-xs px-2 py-0.5 bg-gray-100 dark:bg-gray-700 rounded hover:bg-gray-200 dark:hover:bg-gray-600 dark:text-gray-300">Weekly Mon</button>
-                <button type="button" @click="setCronPreset('0 */6 * * *')" class="text-xs px-2 py-0.5 bg-gray-100 dark:bg-gray-700 rounded hover:bg-gray-200 dark:hover:bg-gray-600 dark:text-gray-300">Every 6h</button>
-                <button type="button" @click="setCronPreset('*/30 * * * *')" class="text-xs px-2 py-0.5 bg-gray-100 dark:bg-gray-700 rounded hover:bg-gray-200 dark:hover:bg-gray-600 dark:text-gray-300">Every 30m</button>
+                <!-- #925: presets come from the exported CRON_PRESETS so "presets
+                     never warn" is tested against the shipped list. -->
+                <button
+                  v-for="p in CRON_PRESETS"
+                  :key="p.expression"
+                  type="button"
+                  @click="setCronPreset(p.expression)"
+                  class="text-xs px-2 py-0.5 bg-gray-100 dark:bg-gray-700 rounded hover:bg-gray-200 dark:hover:bg-gray-600 dark:text-gray-300"
+                >{{ p.label }}</button>
               </div>
             </div>
 
@@ -248,9 +261,11 @@
               >
                 Cancel
               </button>
+              <!-- #925: disabled ONLY for non-empty-AND-invalid cron — an empty
+                   cron keeps the native `required` bubble path for the form. -->
               <button
                 type="submit"
-                :disabled="formLoading"
+                :disabled="formLoading || submitBlockedByCron"
                 class="px-4 py-2 text-sm font-medium text-white bg-action-primary-600 border border-transparent rounded-md hover:bg-action-primary-700 disabled:bg-gray-400"
               >
                 <span v-if="formLoading" class="flex items-center">
@@ -356,6 +371,21 @@
                   <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
                 </svg>
                 <code class="font-mono bg-gray-100 dark:bg-gray-700 px-1 rounded">{{ schedule.cron_expression }}</code>
+                <!-- #925: stored-invalid cron (won't register with the scheduler).
+                     Inside the chip span so flex-wrap can't detach the icon from
+                     its chip; `=== false` so a map miss can never false-warn. -->
+                <span
+                  v-if="cronValidity[schedule.id] === false"
+                  class="ml-1 text-status-warning-600 dark:text-status-warning-400"
+                  title="Invalid cron expression"
+                  aria-label="Invalid cron expression"
+                  role="img"
+                  data-testid="cron-invalid-warning"
+                >
+                  <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01M5.07 19H19a2 2 0 001.75-2.96l-6.93-12a2 2 0 00-3.5 0l-6.93 12A2 2 0 005.07 19z" />
+                  </svg>
+                </span>
               </span>
               <span class="flex items-center">
                 <svg class="w-3.5 h-3.5 mr-1" fill="none" stroke="currentColor" viewBox="0 0 24 24">
@@ -859,6 +889,14 @@ import ScheduleAnalyticsCard from './ScheduleAnalyticsCard.vue'
 import LoadFailed from './LoadFailed.vue'
 import InlineError from './InlineError.vue'
 import { apiErrorMessage } from '../utils/apiError'
+// #925: client-side mirror of the backend cron grammar (see utils/cronValidation.js
+// header — parity pinned by tests/fixtures/cron-grammar-cases.json in both suites).
+import {
+  validateCronExpression,
+  shouldShowCronError,
+  computeCronValidityMap,
+  CRON_PRESETS,
+} from '../utils/cronValidation'
 import { useAuthStore } from '../stores/auth'
 import { useExecutionsStore } from '../stores/executions'
 
@@ -906,6 +944,29 @@ const showCreateForm = ref(false)
 const editingSchedule = ref(null)
 const formLoading = ref(false)
 const formError = ref('')
+
+// #925: client-side cron validation. Display gating lives in the pure, exported
+// shouldShowCronError/computeCronValidityMap (node-tested); these computeds are
+// thin wiring only.
+const cronTouched = ref(false) // first blur of the cron input (create flow)
+const cronVerdict = computed(() => validateCronExpression(formData.value.cron_expression))
+const showCronError = computed(() =>
+  shouldShowCronError({
+    valid: cronVerdict.value.valid,
+    expr: formData.value.cron_expression,
+    touched: cronTouched.value,
+    editing: !!editingSchedule.value,
+  })
+)
+// Submit blocked ONLY when non-empty AND invalid — empty keeps the native
+// `required` bubble (disabling on empty would kill the browser's
+// constraint-validation path for every field in the form).
+const submitBlockedByCron = computed(() => {
+  const expr = String(formData.value.cron_expression ?? '')
+  return expr.trim() !== '' && !cronVerdict.value.valid
+})
+// Row warning icons: id → validity, recomputed only when the list is replaced.
+const cronValidity = computed(() => computeCronValidityMap(schedules.value))
 const triggerLoading = ref(null)
 // #1634: a Set, not one id — two rows can be in flight at once, and a single ref
 // let the first completion re-enable the second row's control mid-request (AC #6).
@@ -1285,6 +1346,8 @@ function closeForm() {
   showCreateForm.value = false
   editingSchedule.value = null
   formError.value = ''
+  cronTouched.value = false // #925: next create starts un-flashed
+
   formData.value = {
     name: '',
     cron_expression: '',
@@ -1596,6 +1659,7 @@ watch(() => props.initialMessage, (newMessage) => {
     formData.value.enabled = true
     formData.value.timeout_seconds = 3600  // #665
     formData.value.allowed_tools = null
+    cronTouched.value = false // #925: this path opens the form without closeForm()
     showCreateForm.value = true
   }
 }, { immediate: true })
diff --git a/src/frontend/src/utils/cronValidation.js b/src/frontend/src/utils/cronValidation.js
new file mode 100644
index 000000000..7af32fb77
--- /dev/null
+++ b/src/frontend/src/utils/cronValidation.js
@@ -0,0 +1,264 @@
+/**
+ * cronValidation.js — client-side mirror of the backend's cron acceptance grammar (#925).
+ *
+ * SOURCE OF TRUTH: `src/backend/services/schedule_validation.py::validate_cron_expression`
+ * (strict 5-field split + `_dow_to_apscheduler` translation) + APScheduler 3.11's
+ * CronTrigger field expressions (`apscheduler/triggers/cron/expressions.py`).
+ * This file is a hand-rolled, zero-dependency port of that EXACT grammar — not of
+ * "standard cron". Cron libs (cron-parser, cronstrue) implement a foreign grammar
+ * (@daily, 6-field, quartz L/#, dow 0-6 wrap …) with proven verdict disagreements.
+ *
+ * CONTRACT: `tests/fixtures/cron-grammar-cases.json` — probe-generated against the live
+ * backend validator, asserted row-for-row by BOTH `tests/unit/test_925_cron_grammar_fixture.py`
+ * (backend CI env — fires on an APScheduler grammar change) and
+ * `src/frontend/tests/unit/cronValidation.spec.js` (this mirror). Grammar drift fails CI loudly.
+ *
+ * PARITY OUTRANKS TIDINESS. Several upstream behaviours look like bugs and must NOT be
+ * "fixed" here — each is probe-verified server-ACCEPT and pinned by a fixture row:
+ *   - Name expressions are START-ANCHORED PREFIX matches with no step group
+ *     (APScheduler's Month/Weekday/LastDay regexes carry no `$` anchor), so
+ *     `MON/999`, `jan/0`, `jan-feb/5`, `mon-`, `lastx`, `last/0` all ACCEPT
+ *     (trailing garbage / steps silently dropped).
+ *   - `_dow_to_apscheduler` comma-branch asymmetry: a range INSIDE a comma list stays raw
+ *     numeric (`0-6,1` → `0-6,mon` ACCEPT) while a bare range maps both endpoints
+ *     (`0-6` → `sun-sat` — inverted in APScheduler's mon=0..sun=6 order — REJECT).
+ *   - Falsy-zero range end: APScheduler computes the step span as `(self.last or MAX)`
+ *     (Python truthiness), so an explicit last of 0 falls back to the field max —
+ *     `0-0/2` (minute) ACCEPTs while `5-5/1` REJECTs. Mirrored with JS `||`, NOT `??`,
+ *     intentionally-because-upstream-buggy: `??` would reject every `N-0/step` row on a
+ *     min-0 field that the server accepts (a false warning — the damaging direction).
+ *
+ * DOCUMENTED DIVERGENCE (client-stricter, absurd input only): digits are ASCII `[0-9]`.
+ * Python's `\d` / `int()` also accept Unicode digits (`٥`), `+` signs and underscores;
+ * the server therefore accepts e.g. `٥ * * * *` that this mirror rejects. Marked
+ * `divergence: "client-stricter"` in the fixture; never mirrored on purpose.
+ *
+ * FAIL-OPEN: `validateCronExpression` is total and never throws. An internal error
+ * (port bug) returns `{valid: true, error: null}` + console.error — client validation
+ * is advisory UX; the backend 400 remains the enforcement authority.
+ */
+
+// Unix cron day-of-week (0/7=Sun) → APScheduler named days.
+// Mirrors schedule_validation._DOW_NAMES verbatim.
+const DOW_NAMES = { 0: 'sun', 1: 'mon', 2: 'tue', 3: 'wed', 4: 'thu', 5: 'fri', 6: 'sat', 7: 'sun' }
+
+const MONTHS = ['jan', 'feb', 'mar', 'apr', 'may', 'jun', 'jul', 'aug', 'sep', 'oct', 'nov', 'dec']
+// APScheduler order: mon=0 .. sun=6 (NOT unix 0=Sun).
+const WEEKDAYS = ['mon', 'tue', 'wed', 'thu', 'fri', 'sat', 'sun']
+
+// Field order + bounds mirror APScheduler's MIN_VALUES/MAX_VALUES for the five
+// fields the backend passes to CronTrigger.
+const FIELDS = [
+  { name: 'minute', min: 0, max: 59 },
+  { name: 'hour', min: 0, max: 23 },
+  { name: 'day', min: 1, max: 31, extra: 'day' },
+  { name: 'month', min: 1, max: 12, extra: 'month' },
+  { name: 'day_of_week', min: 0, max: 6, extra: 'dow' },
+]
+
+/** The schedule-form quick presets. Exported so "presets never warn" is tested
+ *  against the SHIPPED list, not a mirrored literal (labels/expressions are
+ *  byte-identical to the former hardcoded buttons). */
+export const CRON_PRESETS = [
+  { label: 'Daily 9 AM', expression: '0 9 * * *' },
+  { label: 'Weekly Mon', expression: '0 9 * * 1' },
+  { label: 'Every 6h', expression: '0 */6 * * *' },
+  { label: 'Every 30m', expression: '*/30 * * * *' },
+]
+
+// Verbatim port of schedule_validation._dow_to_apscheduler — BRANCH ORDER MATTERS
+// (`/` passthrough before `,` before `-` before single). Do not reorder.
+function dowToApscheduler(dow) {
+  const token = (t) => {
+    // Python `_DOW_NAMES[int(t)]` with ValueError/KeyError → token unchanged.
+    // ASCII-digits-only is the documented client-stricter divergence (int() also
+    // takes unicode digits / '+' / underscores — absurd inputs, not mirrored).
+    if (!/^[0-9]+$/.test(t)) return t
+    const name = DOW_NAMES[Number(t)]
+    return name !== undefined ? name : t
+  }
+  if (dow === '*' || dow.includes('/')) return dow
+  if (dow.includes(',')) return dow.split(',').map(token).join(',')
+  if (dow.includes('-')) {
+    // Python split('-', 1): split at the FIRST '-' only.
+    const i = dow.indexOf('-')
+    return `${token(dow.slice(0, i))}-${token(dow.slice(i + 1))}`
+  }
+  return token(dow)
+}
+
+// Echoed user tokens are bounded so a pasted blob can't balloon the error slot.
+function echo(item) {
+  return item.length > 24 ? `${item.slice(0, 24)}…` : item
+}
+
+function itemError(rawItem, field, reason) {
+  return `Invalid cron expression: "${echo(rawItem)}" is not valid for ${field.name}${reason ? ` — ${reason}` : ''}`
+}
+
+/**
+ * Validate one comma-separated item of one field. Mirrors APScheduler's
+ * compile_expression: compilers tried in order, first REGEX match wins (a match
+ * whose constructor/validate_range fails is an error, never a fall-through).
+ * `item` is the post-translation token (dow), `rawItem` the user's original.
+ * Returns an error string or null.
+ */
+function checkItem(item, rawItem, field) {
+  if (item === '') {
+    return `Invalid cron expression: ${field.name} has an empty list item`
+  }
+
+  // 1. AllExpression: r'\*(?:/(?P<step>\d+))?$'
+  let m = /^\*(?:\/([0-9]+))?$/.exec(item)
+  if (m) {
+    if (m[1] !== undefined) {
+      const step = Number(m[1])
+      if (step === 0) return itemError(rawItem, field, 'step must be at least 1')
+      if (step > field.max - field.min) {
+        return itemError(rawItem, field, `step ${step} is larger than the ${field.min}–${field.max} range`)
+      }
+    }
+    return null
+  }
+
+  // 2. RangeExpression: r'(?P<first>\d+)(?:-(?P<last>\d+))?(?:/(?P<step>\d+))?$'
+  m = /^([0-9]+)(?:-([0-9]+))?(?:\/([0-9]+))?$/.exec(item)
+  if (m) {
+    const first = Number(m[1])
+    let last = m[2] !== undefined ? Number(m[2]) : undefined
+    const step = m[3] !== undefined ? Number(m[3]) : undefined
+    // AllExpression.__init__: zero step raises before anything else.
+    if (step === 0) return itemError(rawItem, field, 'step must be at least 1')
+    // RangeExpression.__init__: bare value ⇒ last = first (so `8` in dow hits the ≤max check).
+    if (last === undefined && step === undefined) last = first
+    if (last !== undefined && first > last) {
+      return itemError(rawItem, field, 'range first value is greater than last')
+    }
+    // validate_range, in APScheduler's order: super() full-span step check first…
+    if (step !== undefined && step > field.max - field.min) {
+      return itemError(rawItem, field, `step ${step} is larger than the ${field.min}–${field.max} range`)
+    }
+    if (first < field.min) {
+      return itemError(rawItem, field, `values must be ${field.min}–${field.max}`)
+    }
+    if (last !== undefined && last > field.max) {
+      return itemError(rawItem, field, `values must be ${field.min}–${field.max}`)
+    }
+    // …then the actual-span step check. `||` (not `??`) is INTENTIONAL: mirrors
+    // APScheduler's Python-truthiness `(self.last or MAX) - self.first`, where an
+    // explicit last of 0 falls back to the field max (probed: `0-0/2` ACCEPT,
+    // `5-5/1` REJECT). `??` would reject server-valid crons — see header comment.
+    // Single echo per message (the prefix already quotes the token): every
+    // shape measures ≤ 2 lines at the modal's 400px width, inside the min-h-8
+    // reserved slot — a second echo pushed worst cases to 3 lines (measured).
+    const span = (last || field.max) - first
+    if (step !== undefined && step > span) {
+      return itemError(rawItem, field, `step ${step} is larger than the range`)
+    }
+    return null
+  }
+
+  // 3. Field-specific compilers (all PREFIX matches — no `$` anchor upstream).
+  if (field.extra === 'day') {
+    // LastDayOfMonthExpression: re.compile(r'last', re.IGNORECASE), re.match ⇒
+    // start-anchored prefix. `lastx`/`last-`/`last/0` ACCEPT; `xlast` falls through.
+    // (WeekdayPositionExpression needs an embedded space — unreachable after the
+    // whitespace field split, so deliberately not ported.)
+    if (/^last/i.test(item)) return null
+  } else if (field.extra === 'month' || field.extra === 'dow') {
+    // Month/WeekdayRangeExpression: r'(?P<first>[a-z]+)(?:-(?P<last>[a-z]+))?'
+    // (IGNORECASE, no end anchor) — trailing garbage/steps silently dropped.
+    const names = field.extra === 'month' ? MONTHS : WEEKDAYS
+    const nm = /^([a-zA-Z]+)(?:-([a-zA-Z]+))?/.exec(item)
+    if (nm) {
+      // Regex matched ⇒ this compiler OWNS the item; a bad name is an error,
+      // never a fall-through (mirrors the propagating ValueError).
+      const firstIdx = names.indexOf(nm[1].toLowerCase())
+      if (firstIdx === -1) {
+        return itemError(rawItem, field, `not a recognized name (use ${names[0]}..${names[names.length - 1]})`)
+      }
+      if (nm[2] !== undefined) {
+        const lastIdx = names.indexOf(nm[2].toLowerCase())
+        if (lastIdx === -1) {
+          return itemError(rawItem, field, `not a recognized name (use ${names[0]}..${names[names.length - 1]})`)
+        }
+        if (firstIdx > lastIdx) {
+          return itemError(rawItem, field, 'range first value is greater than last')
+        }
+      }
+      return null
+    }
+  }
+
+  return itemError(rawItem, field, null)
+}
+
+/**
+ * Validate a cron expression exactly as the backend will.
+ * Total: coerces null/undefined/non-strings; never throws (fail-open on internal error).
+ * @returns {{valid: boolean, error: string|null}}
+ */
+export function validateCronExpression(expr) {
+  try {
+    const text = String(expr ?? '').trim()
+    // ''.split(/\s+/) is [''] — an empty expression is 0 fields, like Python's ''.split().
+    const fields = text === '' ? [] : text.split(/\s+/)
+    if (fields.length !== 5) {
+      return {
+        valid: false,
+        error:
+          `Invalid cron expression: expected 5 fields (minute hour day month day_of_week), ` +
+          `got ${fields.length} — e.g. "0 9 * * *"`,
+      }
+    }
+
+    for (let f = 0; f < FIELDS.length; f++) {
+      const field = FIELDS[f]
+      const raw = fields[f]
+      // The backend translates the WHOLE dow field before CronTrigger sees it.
+      const translated = field.extra === 'dow' ? dowToApscheduler(raw) : raw
+      // The translation never adds/removes commas, so raw/translated items align
+      // positionally — errors echo what the user actually typed.
+      const items = translated.split(',')
+      const rawItems = raw.split(',')
+      for (let i = 0; i < items.length; i++) {
+        const err = checkItem(items[i], rawItems[i] !== undefined ? rawItems[i] : items[i], field)
+        if (err) return { valid: false, error: err }
+      }
+    }
+    return { valid: true, error: null }
+  } catch (e) {
+    // Advisory layer: a port bug must not brick the panel or block saves.
+    // The server 400 remains the authority.
+    console.error('cronValidation: internal error (failing open)', e)
+    return { valid: true, error: null }
+  }
+}
+
+/**
+ * Pure display gate for the form's inline error (node-testable, not buried in a computed).
+ * - valid ⇒ never show.
+ * - editing ⇒ show whenever invalid (incl. empty/whitespace stored cron — a disabled
+ *   Update button must never be unexplained).
+ * - creating ⇒ show only after first blur (touched) AND for non-empty input — empty
+ *   stays with the native `required` bubble; no mid-typing flash before first blur.
+ */
+export function shouldShowCronError({ valid, expr, touched, editing }) {
+  if (valid) return false
+  if (editing) return true
+  return Boolean(touched) && String(expr ?? '').trim() !== ''
+}
+
+/**
+ * id → validity for the schedules list (row warning icons).
+ * Plain object (NOT a Map) — template bracket access. A null/absent cron on a row
+ * coerces to invalid without throwing.
+ */
+export function computeCronValidityMap(schedules) {
+  const map = {}
+  for (const s of schedules || []) {
+    if (!s || s.id === undefined || s.id === null) continue
+    map[s.id] = validateCronExpression(s.cron_expression).valid
+  }
+  return map
+}
diff --git a/src/frontend/tests/unit/cronValidation.spec.js b/src/frontend/tests/unit/cronValidation.spec.js
new file mode 100644
index 000000000..7ee795533
--- /dev/null
+++ b/src/frontend/tests/unit/cronValidation.spec.js
@@ -0,0 +1,192 @@
+// #925 — the client cron validator must agree with the backend grammar row-for-row.
+//
+// Contract: tests/fixtures/cron-grammar-cases.json (repo root) — verdicts PROBED
+// against the live `services/schedule_validation.py::validate_cron_expression`
+// at generation time. The backend twin `tests/unit/test_925_cron_grammar_fixture.py`
+// re-proves every row against the real validator in the backend CI env (the drift
+// alarm for APScheduler upgrades); THIS spec proves the mirror agrees. Rows marked
+// `divergence: "client-stricter"` are server-valid inputs the client deliberately
+// rejects (Python \d/int() accept Unicode digits etc.; the client is ASCII-only).
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import {
+  validateCronExpression,
+  shouldShowCronError,
+  computeCronValidityMap,
+  CRON_PRESETS,
+} from '@/utils/cronValidation'
+
+const FIXTURE_URL = new URL('../../../../tests/fixtures/cron-grammar-cases.json', import.meta.url)
+const rows = JSON.parse(readFileSync(fileURLToPath(FIXTURE_URL), 'utf-8'))
+
+describe('cron grammar fixture parity (client mirror)', () => {
+  it('loads a non-trivial fixture', () => {
+    expect(Array.isArray(rows)).toBe(true)
+    expect(rows.length).toBeGreaterThanOrEqual(100)
+    expect(rows.filter((r) => r.valid).length).toBeGreaterThanOrEqual(40)
+    expect(rows.filter((r) => !r.valid).length).toBeGreaterThanOrEqual(40)
+  })
+
+  for (const row of rows) {
+    const label = row.expr === null ? '<null>' : JSON.stringify(row.expr)
+    if (row.divergence === 'client-stricter') {
+      it(`${label} — documented divergence: server accepts, client rejects (${row.note})`, () => {
+        // The fixture records the SERVER verdict (true); the client is
+        // deliberately stricter on this absurd-input class.
+        expect(row.valid).toBe(true)
+        expect(validateCronExpression(row.expr).valid).toBe(false)
+      })
+    } else {
+      it(`${label} — ${row.valid ? 'ACCEPT' : 'REJECT'} (${row.note})`, () => {
+        const verdict = validateCronExpression(row.expr)
+        expect(verdict.valid).toBe(row.valid)
+        if (row.valid) {
+          expect(verdict.error).toBeNull()
+        } else {
+          expect(typeof verdict.error).toBe('string')
+          expect(verdict.error.length).toBeGreaterThan(0)
+        }
+      })
+    }
+  }
+
+  it('quirk rows are present and pinned (guard against fixture pruning)', () => {
+    const byExpr = Object.fromEntries(rows.map((r) => [r.expr, r.valid]))
+    expect(byExpr['0-0/2 * * * *']).toBe(true) // falsy-zero last → span = max
+    expect(byExpr['5-5/1 * * * *']).toBe(false) // truthy last → span 0
+    expect(byExpr['0 9 * * MON/999']).toBe(true) // name prefix drops the step
+    expect(byExpr['0 9 * * 0-6,1']).toBe(true) // comma branch keeps ranges raw…
+    expect(byExpr['0 9 * * 0-6']).toBe(false) // …bare range → sun-sat inverted
+    expect(byExpr['0 9 lastx * *']).toBe(true) // 'last' is a prefix match
+  })
+})
+
+describe('CRON_PRESETS', () => {
+  it('ships exactly the four historical presets, byte-identical', () => {
+    expect(CRON_PRESETS).toEqual([
+      { label: 'Daily 9 AM', expression: '0 9 * * *' },
+      { label: 'Weekly Mon', expression: '0 9 * * 1' },
+      { label: 'Every 6h', expression: '0 */6 * * *' },
+      { label: 'Every 30m', expression: '*/30 * * * *' },
+    ])
+  })
+
+  it('every preset is valid (presets never warn)', () => {
+    for (const p of CRON_PRESETS) {
+      expect(validateCronExpression(p.expression).valid).toBe(true)
+    }
+  })
+
+  it('every preset is fixture-proven, not just mirror-proven', () => {
+    const byExpr = Object.fromEntries(rows.map((r) => [r.expr, r.valid]))
+    for (const p of CRON_PRESETS) {
+      expect(byExpr[p.expression]).toBe(true)
+    }
+  })
+})
+
+describe('error message shape (pinned loosely — substrings, not bytes)', () => {
+  it('field-count error names "5 fields" and shows an example', () => {
+    const { error } = validateCronExpression('@daily')
+    expect(error).toContain('5 fields')
+    expect(error).toContain('0 9 * * *')
+    expect(error).toContain('got 1')
+  })
+
+  it('empty input reports 0 fields', () => {
+    expect(validateCronExpression('').error).toContain('got 0')
+    expect(validateCronExpression('   ').error).toContain('got 0')
+  })
+
+  it('item errors name the failing field', () => {
+    expect(validateCronExpression('99 0 * * *').error).toContain('minute')
+    expect(validateCronExpression('0 24 * * *').error).toContain('hour')
+    expect(validateCronExpression('0 9 0 * *').error).toContain('day')
+    expect(validateCronExpression('0 9 * 13 *').error).toContain('month')
+    expect(validateCronExpression('0 9 * * 8').error).toContain('day_of_week')
+  })
+
+  it('echoed user tokens are truncated (no ballooning error slot)', () => {
+    const blob = 'x'.repeat(300)
+    const { valid, error } = validateCronExpression(`${blob} * * * *`)
+    expect(valid).toBe(false)
+    expect(error.length).toBeLessThan(160)
+  })
+})
+
+describe('shouldShowCronError (display gate truth table)', () => {
+  const cases = [
+    // [valid, expr, touched, editing] -> expected
+    [{ valid: true, expr: '0 9 * * *', touched: true, editing: false }, false, 'valid never shows'],
+    [{ valid: true, expr: '', touched: true, editing: true }, false, 'valid never shows even editing'],
+    // Create flow: no flash before first blur…
+    [{ valid: false, expr: 'garbage', touched: false, editing: false }, false, 'creating, untouched → no flash'],
+    // …live after first blur, non-empty only.
+    [{ valid: false, expr: 'garbage', touched: true, editing: false }, true, 'creating, touched, non-empty invalid → show'],
+    [{ valid: false, expr: '', touched: true, editing: false }, false, 'creating, empty → native required owns it'],
+    [{ valid: false, expr: '   ', touched: true, editing: false }, false, 'creating, whitespace-only → treated as empty'],
+    // Edit flow: unconditional when invalid (E1 — a dead Update button must be explained).
+    [{ valid: false, expr: 'garbage', touched: false, editing: true }, true, 'editing, invalid, untouched → show'],
+    [{ valid: false, expr: '', touched: false, editing: true }, true, 'editing, EMPTY stored cron, untouched → show'],
+    [{ valid: false, expr: null, touched: false, editing: true }, true, 'editing, null stored cron → show'],
+    [{ valid: false, expr: null, touched: false, editing: false }, false, 'creating, null expr, untouched → no flash'],
+  ]
+  for (const [input, expected, name] of cases) {
+    it(name, () => {
+      expect(shouldShowCronError(input)).toBe(expected)
+    })
+  }
+})
+
+describe('computeCronValidityMap', () => {
+  it('returns a plain object keyed by id (template bracket access)', () => {
+    const map = computeCronValidityMap([
+      { id: 'a', cron_expression: '0 9 * * *' },
+      { id: 'b', cron_expression: 'not a cron' },
+    ])
+    expect(map.constructor).toBe(Object)
+    expect(map['a']).toBe(true)
+    expect(map['b']).toBe(false)
+  })
+
+  it('a null cron on a row is invalid, never a throw', () => {
+    const map = computeCronValidityMap([{ id: 'x', cron_expression: null }])
+    expect(map['x']).toBe(false)
+  })
+
+  it('tolerates empty/absent lists and rows without ids', () => {
+    expect(computeCronValidityMap([])).toEqual({})
+    expect(computeCronValidityMap(null)).toEqual({})
+    expect(computeCronValidityMap(undefined)).toEqual({})
+    expect(computeCronValidityMap([null, { cron_expression: '* * * * *' }])).toEqual({})
+  })
+})
+
+describe('total / fail-open contract', () => {
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  it('null and undefined are REJECTED (0 fields), not a crash', () => {
+    expect(validateCronExpression(null).valid).toBe(false)
+    expect(validateCronExpression(undefined).valid).toBe(false)
+  })
+
+  it('non-string input is coerced, not thrown on', () => {
+    expect(validateCronExpression(5).valid).toBe(false) // "5" → 1 field
+    expect(validateCronExpression(['0 9 * * *']).valid).toBe(true) // String() → "0 9 * * *"
+  })
+
+  it('an internal crash fails OPEN {valid:true} with a console.error (server 400 is the backstop)', () => {
+    const spy = vi.spyOn(console, 'error').mockImplementation(() => {})
+    const evil = {
+      toString() {
+        throw new Error('boom — simulated port bug')
+      },
+    }
+    const verdict = validateCronExpression(evil)
+    expect(verdict).toEqual({ valid: true, error: null })
+    expect(spy).toHaveBeenCalled()
+  })
+})
diff --git a/tests/fixtures/cron-grammar-cases.json b/tests/fixtures/cron-grammar-cases.json
new file mode 100644
index 000000000..a052c0d55
--- /dev/null
+++ b/tests/fixtures/cron-grammar-cases.json
@@ -0,0 +1,558 @@
+[
+  {
+    "expr": "0 9 * * *",
+    "valid": true,
+    "note": "preset: Daily 9 AM"
+  },
+  {
+    "expr": "0 9 * * 1",
+    "valid": true,
+    "note": "preset: Weekly Mon"
+  },
+  {
+    "expr": "0 */6 * * *",
+    "valid": true,
+    "note": "preset: Every 6h"
+  },
+  {
+    "expr": "*/30 * * * *",
+    "valid": true,
+    "note": "preset: Every 30m"
+  },
+  {
+    "expr": "* * * * *",
+    "valid": true,
+    "note": "all-wildcards"
+  },
+  {
+    "expr": "00 09 * * *",
+    "valid": true,
+    "note": "leading zeros"
+  },
+  {
+    "expr": "0  9  *  *  *",
+    "valid": true,
+    "note": "multi-space separators"
+  },
+  {
+    "expr": "0\t9\t*\t*\t*",
+    "valid": true,
+    "note": "tab separators"
+  },
+  {
+    "expr": "  0 9 * * *  ",
+    "valid": true,
+    "note": "leading/trailing whitespace stripped"
+  },
+  {
+    "expr": "0 9 * * MON",
+    "valid": true,
+    "note": "dow uppercase name"
+  },
+  {
+    "expr": "0 9 * * mon",
+    "valid": true,
+    "note": "dow lowercase name"
+  },
+  {
+    "expr": "0 9 * * SUN",
+    "valid": true,
+    "note": "dow SUN"
+  },
+  {
+    "expr": "0 9 * * MON-FRI",
+    "valid": true,
+    "note": "dow name range"
+  },
+  {
+    "expr": "0 9 * * TUE,THU",
+    "valid": true,
+    "note": "dow name comma list"
+  },
+  {
+    "expr": "0 9 * * mon,wed,5",
+    "valid": true,
+    "note": "dow mixed names + numeric (5→fri)"
+  },
+  {
+    "expr": "0 9 * * tue-thu,sat",
+    "valid": true,
+    "note": "dow range inside comma list (names)"
+  },
+  {
+    "expr": "0 9 * * SAT-SUN",
+    "valid": true,
+    "note": "sat(5) ≤ sun(6) in APScheduler order"
+  },
+  {
+    "expr": "0 9 * * 1-5",
+    "valid": true,
+    "note": "dow 1-5 → mon-fri"
+  },
+  {
+    "expr": "0 9 * * 1-7",
+    "valid": true,
+    "note": "dow 1-7 → mon-sun"
+  },
+  {
+    "expr": "0 9 * * 6-7",
+    "valid": true,
+    "note": "dow 6-7 → sat-sun"
+  },
+  {
+    "expr": "0 9 * * 7",
+    "valid": true,
+    "note": "dow 7 → sun (unix Sunday alias)"
+  },
+  {
+    "expr": "0 9 * * 0",
+    "valid": true,
+    "note": "dow 0 → sun"
+  },
+  {
+    "expr": "0 9 * * */2",
+    "valid": true,
+    "note": "dow */2 — '/' passthrough, step ≤ span"
+  },
+  {
+    "expr": "0 9 * * 0/2",
+    "valid": true,
+    "note": "dow 0/2 — '/' passthrough raw numeric"
+  },
+  {
+    "expr": "0 9 * * 1,3,5",
+    "valid": true,
+    "note": "dow numeric comma list → mon,wed,fri"
+  },
+  {
+    "expr": "0 9 * * mon-mon",
+    "valid": true,
+    "note": "dow degenerate name range"
+  },
+  {
+    "expr": "0 9 * * 3-3",
+    "valid": true,
+    "note": "dow 3-3 → wed-wed"
+  },
+  {
+    "expr": "0 9 * * 7-7",
+    "valid": true,
+    "note": "dow 7-7 → sun-sun"
+  },
+  {
+    "expr": "5/2 * * * *",
+    "valid": true,
+    "note": "start/step with implicit max"
+  },
+  {
+    "expr": "1-10/2 * * * *",
+    "valid": true,
+    "note": "range with step"
+  },
+  {
+    "expr": "*/59 * * * *",
+    "valid": true,
+    "note": "wildcard step at field span"
+  },
+  {
+    "expr": "0-59/59 * * * *",
+    "valid": true,
+    "note": "explicit full range, step = span"
+  },
+  {
+    "expr": "1-1 * * * *",
+    "valid": true,
+    "note": "degenerate numeric range"
+  },
+  {
+    "expr": "1-5,10 * * * *",
+    "valid": true,
+    "note": "range + value in comma list"
+  },
+  {
+    "expr": "0-5/2 * * * *",
+    "valid": true,
+    "note": "small range with step"
+  },
+  {
+    "expr": "* * * jan *",
+    "valid": true,
+    "note": "month name"
+  },
+  {
+    "expr": "* * * JAN-MAR *",
+    "valid": true,
+    "note": "month name range uppercase"
+  },
+  {
+    "expr": "0 9 last * *",
+    "valid": true,
+    "note": "day 'last'"
+  },
+  {
+    "expr": "0 9 LAST * *",
+    "valid": true,
+    "note": "day 'LAST' case-insensitive"
+  },
+  {
+    "expr": "0 9 31 2 *",
+    "valid": true,
+    "note": "Feb 31: field-valid (semantics not checked)"
+  },
+  {
+    "expr": "0 9 lastx * *",
+    "valid": true,
+    "note": "QUIRK: 'last' is a start-anchored prefix match"
+  },
+  {
+    "expr": "0 9 last- * *",
+    "valid": true,
+    "note": "QUIRK: trailing garbage after 'last' ignored"
+  },
+  {
+    "expr": "0 9 last/0 * *",
+    "valid": true,
+    "note": "QUIRK: step after 'last' never parsed"
+  },
+  {
+    "expr": "0 9 * * mon-",
+    "valid": true,
+    "note": "QUIRK: name-range regex prefix — dangling '-' ignored"
+  },
+  {
+    "expr": "0 9 * * mon-fri/2",
+    "valid": true,
+    "note": "QUIRK: step after name range silently dropped"
+  },
+  {
+    "expr": "0 9 * * mon-fri/0",
+    "valid": true,
+    "note": "QUIRK: even a zero step is dropped after names"
+  },
+  {
+    "expr": "0 9 * * MON/2",
+    "valid": true,
+    "note": "QUIRK: step after single name dropped"
+  },
+  {
+    "expr": "0 9 * * MON/999",
+    "valid": true,
+    "note": "QUIRK: absurd step after name dropped"
+  },
+  {
+    "expr": "* * * jan/0 *",
+    "valid": true,
+    "note": "QUIRK: month name prefix — step dropped"
+  },
+  {
+    "expr": "* * * jan-feb/5 *",
+    "valid": true,
+    "note": "QUIRK: month name range prefix — step dropped"
+  },
+  {
+    "expr": "0 9 * * 0-6,1",
+    "valid": true,
+    "note": "QUIRK: range inside comma list stays raw numeric (vs bare 0-6)"
+  },
+  {
+    "expr": "0 9 * * 0-6/1",
+    "valid": true,
+    "note": "QUIRK: '/' passthrough keeps 0-6 raw numeric"
+  },
+  {
+    "expr": "0-0/2 * * * *",
+    "valid": true,
+    "note": "QUIRK: falsy-zero last → span falls back to max (minute)"
+  },
+  {
+    "expr": "0-0/59 * * * *",
+    "valid": true,
+    "note": "QUIRK: falsy-zero last, step = full span"
+  },
+  {
+    "expr": "* 0-0/23 * * *",
+    "valid": true,
+    "note": "QUIRK: falsy-zero last (hour)"
+  },
+  {
+    "expr": "0 9 * * 0-0/2",
+    "valid": true,
+    "note": "QUIRK: falsy-zero last (dow, raw passthrough)"
+  },
+  {
+    "expr": "",
+    "valid": false,
+    "note": "empty"
+  },
+  {
+    "expr": "   ",
+    "valid": false,
+    "note": "whitespace only"
+  },
+  {
+    "expr": "*/30",
+    "valid": false,
+    "note": "1 field"
+  },
+  {
+    "expr": "@daily",
+    "valid": false,
+    "note": "macro rejected by 5-field split"
+  },
+  {
+    "expr": "@hourly",
+    "valid": false,
+    "note": "macro rejected by 5-field split"
+  },
+  {
+    "expr": "0 9 * * 1 2026",
+    "valid": false,
+    "note": "6 fields"
+  },
+  {
+    "expr": "* * 1st mon * *",
+    "valid": false,
+    "note": "6 fields (quartz-ish day spec splits)"
+  },
+  {
+    "expr": "99 99 * * *",
+    "valid": false,
+    "note": "minute+hour out of range"
+  },
+  {
+    "expr": "60 * * * *",
+    "valid": false,
+    "note": "minute 60 > 59"
+  },
+  {
+    "expr": "* 24 * * *",
+    "valid": false,
+    "note": "hour 24 > 23"
+  },
+  {
+    "expr": "* * 0 * *",
+    "valid": false,
+    "note": "day 0 < 1"
+  },
+  {
+    "expr": "* * 32 * *",
+    "valid": false,
+    "note": "day 32 > 31"
+  },
+  {
+    "expr": "* * * 0 *",
+    "valid": false,
+    "note": "month 0 < 1"
+  },
+  {
+    "expr": "* * * 13 *",
+    "valid": false,
+    "note": "month 13 > 12"
+  },
+  {
+    "expr": "0 9 * * 8",
+    "valid": false,
+    "note": "dow 8 unmappable → 8 > 6"
+  },
+  {
+    "expr": "0 9 * * 29",
+    "valid": false,
+    "note": "dow 29 unmappable → out of range"
+  },
+  {
+    "expr": "0 9 * * 0-6",
+    "valid": false,
+    "note": "QUIRK: bare 0-6 → sun-sat inverted (vs 0-6,1 accept)"
+  },
+  {
+    "expr": "0 9 * * sun-sat",
+    "valid": false,
+    "note": "sun(6) > sat(5) inverted"
+  },
+  {
+    "expr": "0 9 * * SUN-SAT,1",
+    "valid": false,
+    "note": "inverted name range inside comma list still checked"
+  },
+  {
+    "expr": "0 9 * * fri-mon",
+    "valid": false,
+    "note": "fri(4) > mon(0) inverted"
+  },
+  {
+    "expr": "0 9 * * 5-1",
+    "valid": false,
+    "note": "5-1 → fri-mon inverted"
+  },
+  {
+    "expr": "* * * mar-jan *",
+    "valid": false,
+    "note": "month range inverted"
+  },
+  {
+    "expr": "* * * dec-feb *",
+    "valid": false,
+    "note": "month range inverted (no wrap)"
+  },
+  {
+    "expr": "* * * 11-2 *",
+    "valid": false,
+    "note": "numeric month range inverted (no wrap)"
+  },
+  {
+    "expr": "0 9 * * 7/2",
+    "valid": false,
+    "note": "dow 7/2 raw passthrough — span 6-7 < step"
+  },
+  {
+    "expr": "0 9 * * 6/2",
+    "valid": false,
+    "note": "dow 6/2 — span 0 < 2"
+  },
+  {
+    "expr": "0 9 * * 5/2",
+    "valid": false,
+    "note": "dow 5/2 — span 1 < 2"
+  },
+  {
+    "expr": "*/60 * * * *",
+    "valid": false,
+    "note": "wildcard step > field span"
+  },
+  {
+    "expr": "*/70 * * * *",
+    "valid": false,
+    "note": "wildcard step > field span"
+  },
+  {
+    "expr": "59/2 * * * *",
+    "valid": false,
+    "note": "start/step span 0 < 2"
+  },
+  {
+    "expr": "58/2 * * * *",
+    "valid": false,
+    "note": "start/step span 1 < 2"
+  },
+  {
+    "expr": "1-1/1 * * * *",
+    "valid": false,
+    "note": "truthy last ⇒ span 0 < 1"
+  },
+  {
+    "expr": "0-59/60 * * * *",
+    "valid": false,
+    "note": "step > full range"
+  },
+  {
+    "expr": "5-5/1 * * * *",
+    "valid": false,
+    "note": "truthy last ⇒ span 0 (contrast 0-0/2)"
+  },
+  {
+    "expr": "0 9 31/2 * *",
+    "valid": false,
+    "note": "day 31/2 — span 0 < 2"
+  },
+  {
+    "expr": "0 9 1-1/5 * *",
+    "valid": false,
+    "note": "day truthy last ⇒ span 0 < 5"
+  },
+  {
+    "expr": "* * * 1-1/5 *",
+    "valid": false,
+    "note": "month truthy last ⇒ span 0 < 5"
+  },
+  {
+    "expr": "*/0 * * * *",
+    "valid": false,
+    "note": "zero step on wildcard"
+  },
+  {
+    "expr": "5/0 * * * *",
+    "valid": false,
+    "note": "zero step on value"
+  },
+  {
+    "expr": "1-10/0 * * * *",
+    "valid": false,
+    "note": "zero step on range"
+  },
+  {
+    "expr": "0 9 * * L",
+    "valid": false,
+    "note": "quartz L"
+  },
+  {
+    "expr": "0 9 * * 5#3",
+    "valid": false,
+    "note": "quartz nth-weekday"
+  },
+  {
+    "expr": "0 9 * * 5L",
+    "valid": false,
+    "note": "quartz last-weekday"
+  },
+  {
+    "expr": "0 9 * * ?",
+    "valid": false,
+    "note": "quartz ?"
+  },
+  {
+    "expr": "0 9 * * monday",
+    "valid": false,
+    "note": "full day names not in 3-letter list"
+  },
+  {
+    "expr": "0 9 xlast * *",
+    "valid": false,
+    "note": "'last' must be a prefix, not a suffix"
+  },
+  {
+    "expr": "-5 * * * *",
+    "valid": false,
+    "note": "leading dash"
+  },
+  {
+    "expr": "5- * * * *",
+    "valid": false,
+    "note": "trailing dash (numeric, end-anchored regex)"
+  },
+  {
+    "expr": "1--5 * * * *",
+    "valid": false,
+    "note": "double dash"
+  },
+  {
+    "expr": "0 9 * * -mon",
+    "valid": false,
+    "note": "leading dash before name"
+  },
+  {
+    "expr": "* * * -jan *",
+    "valid": false,
+    "note": "leading dash before month name"
+  },
+  {
+    "expr": "1,2,,3 * * * *",
+    "valid": false,
+    "note": "empty comma-list item"
+  },
+  {
+    "expr": "a b c d e",
+    "valid": false,
+    "note": "5 unrecognized fields"
+  },
+  {
+    "expr": null,
+    "valid": false,
+    "note": "null/None input → 0 fields"
+  },
+  {
+    "expr": "٥ * * * *",
+    "valid": true,
+    "note": "unicode digit — Python \\d/int() accept; client is ASCII-only",
+    "divergence": "client-stricter"
+  }
+]
diff --git a/tests/unit/test_925_cron_grammar_fixture.py b/tests/unit/test_925_cron_grammar_fixture.py
new file mode 100644
index 000000000..5984d8d7c
--- /dev/null
+++ b/tests/unit/test_925_cron_grammar_fixture.py
@@ -0,0 +1,123 @@
+"""#925 — the client-side cron validator must mirror the backend grammar exactly.
+
+The schedule form pre-validates cron expressions in the browser
+(``src/frontend/src/utils/cronValidation.js``), a hand-rolled mirror of THIS
+backend's acceptance grammar: ``services/schedule_validation.py``'s strict
+5-field split + ``_dow_to_apscheduler`` translation + APScheduler 3.11's
+``CronTrigger`` field expressions. The contract between the two is the shared
+fixture ``tests/fixtures/cron-grammar-cases.json`` — verdicts PROBED against the
+live validator at generation time, never hand-typed — asserted row-for-row by
+both this pytest (against the real ``validate_cron_expression``) and the vitest
+spec ``src/frontend/tests/unit/cronValidation.spec.js`` (against the mirror).
+
+This test is the DRIFT ALARM: it runs in the backend CI environment with the
+pinned APScheduler, so an upgrade that changes the cron grammar fails HERE
+loudly instead of silently desynchronizing the client mirror (the damaging
+direction being client-invalid/server-valid false warnings in the schedules UI).
+
+If this test goes red after an APScheduler (or validator) change:
+  1. Re-probe every fixture row against the new grammar and rewrite the verdicts
+     (never hand-edit a verdict). From the repo root::
+
+         python3 - <<'EOF'
+         import importlib.util, json, pathlib
+         spec = importlib.util.spec_from_file_location(
+             "sv", "src/backend/services/schedule_validation.py")
+         sv = importlib.util.module_from_spec(spec); spec.loader.exec_module(sv)
+         p = pathlib.Path("tests/fixtures/cron-grammar-cases.json")
+         rows = json.loads(p.read_text())
+         for r in rows:
+             try:
+                 sv.validate_cron_expression(r["expr"], "UTC"); r["valid"] = True
+             except sv.ScheduleValidationError:
+                 r["valid"] = False
+         p.write_text(json.dumps(rows, indent=2, ensure_ascii=False) + "\n")
+         EOF
+
+  2. Port the grammar change into ``cronValidation.js`` and re-run the vitest
+     spec until it agrees with the regenerated fixture.
+
+Quirk rows (prefix-matched names ``MON/999``/``jan/0``/``lastx``, the
+comma-translation asymmetry ``0-6,1`` vs bare ``0-6``, the falsy-zero
+``0-0/2``) are pinned deliberately — parity outranks tidiness; do not "fix"
+them on either side. Rows carrying ``divergence: "client-stricter"`` record the
+SERVER verdict here; the vitest spec asserts the client's deliberate stricter
+verdict for those (documented: Python ``\\d``/``int()`` accept Unicode digits,
+the client is ASCII-only).
+
+Backend RUNTIME is untouched by #925 — this file is test-tree only.
+"""
+
+import json
+from pathlib import Path
+
+import pytest
+
+from services.schedule_validation import (
+    ScheduleValidationError,
+    validate_cron_expression,
+)
+
+_FIXTURE = Path(__file__).resolve().parent.parent / "fixtures" / "cron-grammar-cases.json"
+
+
+def _load_rows():
+    rows = json.loads(_FIXTURE.read_text(encoding="utf-8"))
+    assert isinstance(rows, list) and rows, "fixture must be a non-empty array"
+    return rows
+
+
+_ROWS = _load_rows()
+
+
+def _row_id(row):
+    expr = row["expr"]
+    return "<None>" if expr is None else repr(expr)
+
+
+@pytest.mark.parametrize("row", _ROWS, ids=[_row_id(r) for r in _ROWS])
+def test_fixture_row_matches_live_validator(row):
+    """Every fixture verdict re-proven against the REAL backend validator."""
+    expr = row["expr"]
+    try:
+        validate_cron_expression(expr, "UTC")
+        actual = True
+    except ScheduleValidationError:
+        actual = False
+    assert actual == row["valid"], (
+        f"Grammar drift: {row['expr']!r} ({row['note']}) — fixture says "
+        f"valid={row['valid']}, live validate_cron_expression says {actual}. "
+        f"Re-probe the fixture and update the client mirror (see module docstring)."
+    )
+
+
+def test_fixture_covers_both_verdicts_and_the_quirks():
+    """Structural floor: the fixture must keep exercising both verdicts and the
+    named quirk rows whose absence would let the client mirror drift silently."""
+    by_expr = {r["expr"]: r["valid"] for r in _ROWS}
+    # Both verdict classes present in force.
+    assert sum(1 for r in _ROWS if r["valid"]) >= 40
+    assert sum(1 for r in _ROWS if not r["valid"]) >= 40
+    # The load-bearing quirk rows (probed upstream behaviours, not typos).
+    assert by_expr["0-0/2 * * * *"] is True      # falsy-zero last → span = max
+    assert by_expr["5-5/1 * * * *"] is False     # truthy last → span 0
+    assert by_expr["0 9 * * MON/999"] is True    # name prefix match drops the step
+    assert by_expr["0 9 * * 0-6,1"] is True      # comma branch keeps ranges raw…
+    assert by_expr["0 9 * * 0-6"] is False       # …bare range maps to sun-sat (inverted)
+    assert by_expr["0 9 lastx * *"] is True      # 'last' is a prefix match
+    # The four shipped presets stay valid.
+    for preset in ("0 9 * * *", "0 9 * * 1", "0 */6 * * *", "*/30 * * * *"):
+        assert by_expr[preset] is True, f"preset {preset!r} must stay fixture-valid"
+
+
+def test_divergence_rows_are_server_valid_client_stricter_only():
+    """A divergence row records the SERVER verdict; the only sanctioned direction
+    is client-stricter (server-valid input the client rejects). A server-INVALID
+    divergence row would mean the client fails open on something the server
+    rejects — that is just a mirror bug, not a documented divergence."""
+    for row in _ROWS:
+        if row.get("divergence"):
+            assert row["divergence"] == "client-stricter"
+            assert row["valid"] is True, (
+                f"divergence row {row['expr']!r} must be server-valid"
+            )