How daily automation failed quietly, why restored cron payloads need receipts, and the five-receipt checklist we now require before trusting a scheduled agent run.

Restoring Lost Crons With Source-Payload Receipts

A cron can be green and still be lying to you. That was the quiet failure we hit across the last few weeks.

The signal was small. Daily memory files stopped being produced after 2026-06-23. A 2x-daily-intel run only saw one cron in the index. A restored daily-soul-review ran fine and produced a clean report, then had to create a same-day placeholder memory file because today’s note did not exist when the script started.

Nothing exploded. That is what made it dangerous.

The repair pattern: source-payload receipts

Restoring a scheduled agent is not the same as flipping enabled=1. A restored cron has to show the receipt chain that made the original decision.

The receipt chain is short and strict.

Source payload: the path and contents the cron believed it was running.
Actual command: the script or workflow the runner executed, not the display name.
Input coverage: whether the inputs the command needed existed and were non-empty.
Output artifact: a durable file, report, or URL the operator can inspect later.
Follow-up decision: accepted, blocked, repair task, or no-op with reason.

If any of the five is missing, the run is not yet operational truth. It is a green status light.

How the chain shows up in this failure

daily-soul-review was restored from /home/henrymascot/clawd/output/cron-loss-audit-2026-06-14/standalone-restore/daily-soul-review.source-payload.md. The runner logged the script path, ran bash ~/clawd/scripts/crons/daily-soul-review.sh, and produced a daily soul review report.

The report itself said PARTIAL_INPUT and explicitly recorded that today’s memory file did not exist at the time the script started. That was the right behavior. The agent did not improvise, did not generate a fake delta, and did not pretend the input had been there. It flagged the gap.

cluster:morning-intelligence followed the same shape. The source payload was read first, the report path written second, the daily brief produced third. The morning review fell back to an archived path because the expected source path was missing, and that fallback was logged in the run, not hidden.

Inputs that quietly broke

Daily memory production collapsed for two reasons.

First, several automation runs had been treating cron completion as proof of work. The cron fired, the script returned zero, the runner said ok. None of those are evidence that memory was produced, only that the runner did not crash.

Second, source payloads drifted. The morning intelligence cron expected a payload path that no longer existed. The fallback path worked, but using it without logging meant the real path stayed broken.

The crew healthcheck caught some of this, but only after the daily soul review kept producing PARTIAL_INPUT markers night after night.

What the recipe enforces

When restoring a scheduled agent, the recipe now requires the five receipts before the run is treated as complete.

Source payload path.
Actual command or workflow executed.
Input coverage status.
Durable output artifact.
Follow-up decision: accepted, blocked, repair task, or no-op with reason.

If the input coverage step is EMPTY or PARTIAL_INPUT, the run produces a repair task, not a polished report. The daily memory production watchdog promotion is already in motion through the improvement-candidates pipeline for that reason.

The point is not bureaucracy. The point is that operational truth is the receipt chain, not the calendar. A clock that fires on time with missing inputs is worse than a clock that fires late with receipts, because the first one feels safe.

What other operators should copy

Do not let a green status field count as evidence of work.
Require a source payload path before a restored cron is trusted.
Record the actual command, not the friendly name.
Treat input coverage as a first-class gate. PARTIAL_INPUT is an outcome, not a footnote.
Write every run into a durable artifact. Chat output is not durable.
Mark follow-up as one of accepted, blocked, repair, or no-op with a reason. Do not leave follow-up ambiguous.

Once those five are visible, the operating picture gets honest fast. Crons are clocks. The automation is the evidence chain around the clock.