Release v0.5.11

Two session-reliability fixes from the 2026-07-12 waldemort-chk
facts-manager incident: zombie turns now self-settle when the Copilot
CLI subprocess dies mid-turn (inactivity watchdog, default 5 min, plus
the wall-clock turn cap now on by default at 10 min — both worker-side,
settling into the existing transport-loss retry path), and a stale cron
timer firing after cron(action="cancel") is ignored instead of throwing
a non-retryable TypeError that permanently failed the orchestration.

Full --all-providers suite green before release: baseline PgFactStore
153 passed / 2 skipped; HorizonDB overlay 18 provider files + 154
passed / 1 skipped. CHANGELOG + README banner updated; versions bumped
across the three published packages.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BtBRbuyZXVGJ6zf3p7HftN

Author: affandar

CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 0.5.11 — 2026-07-12
+
+### SDK
+
+- **Zombie turns now self-settle.** When the Copilot CLI subprocess died
+  mid-turn (e.g. V8 heap OOM), `session.idle` never arrived and
+  `ManagedSession.runTurn` awaited forever — the durable `runTurn` activity
+  stayed in-flight permanently and the session wedged while its message queue
+  backed up. Two worker-side guards now settle the turn (no orchestration
+  change; an explicit `0` disables either):
+  - **Inactivity watchdog** (`turnInactivityTimeoutMs`, default 5 minutes): a
+    live turn emits a steady event stream, so total silence means the
+    subprocess is dead or wedged. Settles as a retryable transport-loss error
+    whose message matches the connection-closed classifier, riding the
+    existing recovery path — release affinity, retry on a fresh subprocess,
+    bounded lossy-handoff fallback.
+  - **Wall-clock turn cap** (`turnTimeoutMs`, default 10 minutes): the
+    pre-existing timeout race was dead code — nothing ever set it. It is now
+    on by default as the blunt backstop.
+  - Guard timers are cleared when the turn settles and their rejections are
+    pre-handled; both guards also cover the text-tool-call correction loop's
+    idle waits.
+- **A stale cron timer fire after `cron(action="cancel")` no longer kills the
+  session.** Cancel clears the schedule, but the already-armed durable timer
+  for the next tick cannot be retracted. When it fired, `processTimer`'s
+  `cron` branch dereferenced the missing schedule and threw a `TypeError`
+  that surfaced as a non-retryable `OrchestrationFailed` — permanently
+  failing the session and orphaning its sub-agents. The stale fire is now
+  ignored (traced, no `session.cron_fired`), matching the guard the `cron_at`
+  branch already had.
+
+### Tests
+
+- `turn-inactivity-watchdog.test.js` — the incident shape (subprocess acks
+  `send()` then goes silent forever) must settle as a transport-loss error
+  the orchestration's connection-closed classifier accepts; steady event flow
+  past the threshold must never trip the watchdog; defaults-on behavior;
+  `0`-disables contract; no armed timers after a clean turn.
+- `orchestration-stale-cron-timer.test.mjs` — a stale cron fire after cancel
+  is a no-op (no throw, no `session.cron_fired`); an active cron fire still
+  records `session.cron_fired` first.
+
 ## 0.5.10 — 2026-07-12
 
 ### SDK

README.md

@@ -2,7 +2,7 @@
 
 > **Experimental** — This project is under active development and not yet ready for production use. APIs may change without notice.
 
-> **Latest release: v0.5.10** — The portal session list now shows real owner initials instead of `?` (a paged-list read path, `cms_list_sessions_page`, wasn't joining the owner — fixed in CMS migration 0028; ownership was always persisted). Agent mobile splash screens now persist correctly — `splashMobile` is carried through session creation so phones get the narrow-viewport banner instead of the wide desktop art. Plus redesigned management-agent desktop splashes (solid ANSI-Shadow logos with color bands).
+> **Latest release: v0.5.11** — Two session-reliability fixes. A dead Copilot CLI subprocess can no longer wedge a session forever: turns now self-settle via an inactivity watchdog (default 5 min of total event silence) plus a default 10-minute wall-clock turn cap, then retry on a fresh subprocess through the existing transport-loss recovery. And a stale cron timer firing after `cron(action="cancel")` no longer hard-fails the orchestration — the unretractable next-tick timer is now ignored instead of dereferencing the cleared schedule.
 
 A durable execution runtime for [GitHub Copilot SDK](https://github.com/github/copilot-sdk) agents. Crash recovery, durable timers, session dehydration, and multi-node scaling — powered by [duroxide](https://github.com/microsoft/duroxide). Just add a connection string.
 

package-lock.json

@@ -1,6 +1,6 @@
 {
     "name": "pilotswarm",
-    "version": "0.5.10",
+    "version": "0.5.11",
     "description": "PilotSwarm application package: terminal UI, browser portal + Web API server, and MCP server — one install, three bins.",
     "type": "module",
     "license": "MIT",
@@ -77,7 +77,7 @@
         "hono": "^4.12.10",
         "ink": "^6.8.0",
         "jose": "^6.2.2",
-        "pilotswarm-sdk": "^0.5.10",
+        "pilotswarm-sdk": "^0.5.11",
         "react": "^19.2.4",
         "react-dom": "^19.2.4",
         "ws": "^8.18.2"

packages/app/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pilotswarm-horizon-store",
-    "version": "0.5.10",
+    "version": "0.5.11",
     "type": "module",
     "description": "HorizonDB-backed enhanced facts and graph providers for PilotSwarm.",
     "main": "./dist/src/index.js",

packages/horizon-store/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pilotswarm-sdk",
-    "version": "0.5.10",
+    "version": "0.5.11",
     "description": "A durable execution runtime for GitHub Copilot SDK agents. Crash recovery, durable timers, session dehydration, and multi-node scaling — powered by duroxide.",
     "type": "module",
     "main": "./dist/index.js",