fix(tasks): guard loop name length and surface loop ownership in the UI

Review follow-up:

- Reject loop files whose frontmatter name exceeds MAX_TASK_NAME_LENGTH
  (80): task names are clamped at storage time, so a raw name longer than
  the limit could never match the stored task identity. The file is treated
  as malformed (definition: null) instead of creating an unreachable
  definition; MAX_TASK_NAME_LENGTH is now exported from project-config.js
  and shared with loops.js.
- Surface loop-sourced tasks in the scheduled-tasks dialog: tasks carrying
  loopFile show a 'Managed by loop file <path>' note, and the enable
  toggle / edit / delete actions are disabled with an explanatory tooltip,
  since the file remains authoritative and would revert any such change.
  run-now stays available. New locale keys added to all 11 message files
  (i18n parity test enforces exact key sets).
- ScheduledTask type gains an optional loopFile field (additive, unknown
  to older clients).

packages/web/server/lib/projects/project-config.js

@@ -2,7 +2,7 @@ import { DateTime, IANAZone } from 'luxon';
 import parser from 'cron-parser';
 
 const PROJECT_CONFIG_VERSION = 1;
-const MAX_TASK_NAME_LENGTH = 80;
+export const MAX_TASK_NAME_LENGTH = 80;
 const MAX_TASK_PROMPT_LENGTH = 20_000;
 const MAX_CRON_LENGTH = 200;
 const MAX_LAST_ERROR_LENGTH = 2_000;

packages/web/server/lib/scheduled-tasks/DOCUMENTATION.md

@@ -48,7 +48,7 @@ Field mapping (model: `packages/ui/src/lib/scheduledTasksApi.ts`):
 
 | Frontmatter | Task field |
 |---|---|
-| `name` | `name` (required) |
+| `name` | `name` (required, max 80 characters — longer names are rejected as malformed) |
 | `schedule` | `schedule.kind: "cron"` + `schedule.cron` (required, cron-only in the portable format) |
 | `enabled` | `enabled` (default `false` — a loop only runs when the file explicitly enables it; add `enabled: true` to activate) |
 | `model` | split on the first `/` into `execution.providerID` / `execution.modelID` (required) |
@@ -97,7 +97,9 @@ project write lock on every `syncProject` when the project path is known:
   file remains authoritative: the next reconciliation re-applies the file's
   definition (including `enabled`). Use `enabled: false` in the file to
   disable. Deleting a loop-sourced task through the API is rejected with a 400 —
-  the loop file is the removal surface.
+  the loop file is the removal surface. The scheduled-tasks UI marks loop tasks
+  as file-managed and disables their edit/enable/delete actions for the same
+  reason; `run now` remains available.
 
 ## Public exports (runtime.js)
 

packages/web/server/lib/scheduled-tasks/loops.js

@@ -41,6 +41,7 @@ import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import { parseMdFile, getAncestors, findWorktreeRoot } from '../opencode/shared.js';
+import { MAX_TASK_NAME_LENGTH } from '../projects/project-config.js';
 
 const LOOP_DIR_NAME = 'loops';
 const USER_LOOP_ROOT = () => path.join(os.homedir(), '.agents', LOOP_DIR_NAME);
@@ -94,6 +95,12 @@ export const parseLoopDefinition = (filePath) => {
     console.warn(`[loops] skipped ${filePath}: frontmatter "name" is required`);
     return null;
   }
+  if (name.length > MAX_TASK_NAME_LENGTH) {
+    // Reject instead of clamping: task names are clamped to this length at
+    // storage time, so identity keys must match the stored value exactly.
+    console.warn(`[loops] skipped ${filePath}: frontmatter "name" exceeds ${MAX_TASK_NAME_LENGTH} characters`);
+    return null;
+  }
 
   const cron = asNonEmptyString(frontmatter.schedule);
   if (!cron) {

packages/web/server/lib/scheduled-tasks/loops.test.js

@@ -181,6 +181,33 @@ model: openai/gpt-5
       await cleanup();
     }
   });
+
+  it('rejects names longer than the storage limit', async () => {
+    const { projectPath, cleanup } = await createProject();
+    try {
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+      try {
+        const filePath = path.join(projectPath, 'long-name.md');
+        await writeFile(filePath, `---
+name: ${'x'.repeat(81)}
+schedule: "0 9 * * *"
+model: openai/gpt-5
+---
+Run.
+`, 'utf8');
+
+        // Task names are clamped to 80 chars at storage time; a raw name that
+        // exceeds it could never match the stored task, so the file is treated
+        // as malformed rather than creating an unreachable definition.
+        expect(parseLoopDefinition(filePath)).toBeNull();
+        expect(warn).toHaveBeenCalled();
+      } finally {
+        warn.mockRestore();
+      }
+    } finally {
+      await cleanup();
+    }
+  });
 });
 
 describe('discoverLoops', () => {