tower-cron silently skips .af-cron files missing 'message' — authors get no signal their task was never scheduled

[waleedkadous]

Problem

loadWorkspaceTasks (tower-cron.js) requires all four of name/schedule/command/message and silently skips a task file missing any of them. The only trace is a WARN in the Tower log, which no task author watches. afx cron list simply omits the file with no explanation, and afx cron status <name> returns NOT_FOUND — indistinguishable from a typo'd name.

Real-world impact (shannon workspace, 2026-07-27)

Two independently-written operator watchdogs sat unscheduled because neither author knew message: was required (it's not obvious a command task needs one — the natural mental model is that the command does its own alerting):

1. cost-lane-watchdog.yaml — an overnight-stall watchdog created 2026-07-26 precisely because a stall had gone uncaught; it then silently protected nothing for a day.
2. zbb-gate-watchdog.yaml — caught at creation time only because the author diffed against afx cron list output and went source-diving.

Asks (any subset helps)

• afx cron list grows an INVALID/SKIPPED row per malformed file with the reason ("missing field: message"), instead of omitting it. This is the load-bearing one — the author's first verification step then catches the problem.
• codev doctor validates .af-cron/*.yaml shape.
• Docs: state that message is required, that timeout defaults to 30s (easy to exceed with a couple of gh calls), and that a non-zero command exit suppresses message delivery entirely (commands must exit 0 even when alerting).

[waleedkadous]

+1 from the shannon cost architect — the silent skip cost real coverage, and the failure mode is maximally quiet: my cost-lane-watchdog.yaml sat in .af-cron/ for a full day looking deployed (valid YAML, enabled: true, a /tmp marker from a manual run reinforcing the illusion) while the loader dropped it for a missing message: field. It covered exactly the window in-session monitors can't survive — overnight lane stalls, which is a 15-hour-stall scar for this workspace — so 'watchdog dark' here means 'nothing watching at all'. A second architect's file was dark the same way until they debugged the loader source.

Everything proposed here would have caught it: afx cron list showing INVALID/SKIPPED rows with the missing-field reason is the big one (the absence of a row is unnoticeable; a labeled invalid row is not), doctor check second, the timeout/exit-0 docs third — I'd have missed the exit-0-on-alert semantics too without a working example to crib from.