sched: crash-safe admin ordering, create watermark, poll freshness (T13 fix)

tests/scheduling/test_poll.py

@@ -303,3 +303,53 @@ def test_capacity_wait_then_expire_for_skip(tmp_path: Path) -> None:
     sched.poll(t0 + timedelta(seconds=30))
     assert len([r for r in _history(store, "a") if r["kind"] == "admitted"]) == 1
     sched.ownership.release()
+
+
+def test_poll_one_rereads_pause_before_deciding(tmp_path: Path) -> None:
+    sched, store, runs, sources = _harness(tmp_path, script={"*": "hang"})
+    t0 = ts(2026, 9, 8, 12, 0)
+    _add(sched, store, sources, "a", OneShotSource(t0), t0 - timedelta(hours=1))
+    stale = store.get_schedule("a")
+    # Same-process administration lands after the tick listed schedules:
+    # the decision must observe the pause, not the stale snapshot.
+    live = store.get_schedule("a")
+    live.paused = True
+    store.save_schedule(live)
+    assert sched._poll_one(stale, t0 + timedelta(seconds=1)) == "paused"
+    assert runs.list_runs() == []
+    assert runs.list_admissions() == []
+    sched.ownership.release()
+
+
+def test_poll_one_uses_fresh_definition_after_edit(tmp_path: Path) -> None:
+    sched, store, runs, sources = _harness(tmp_path, script={"*": "hang"})
+    t0 = ts(2026, 9, 8, 12, 0)
+    _add(
+        sched,
+        store,
+        sources,
+        "a",
+        OneShotSource(t0),
+        t0 - timedelta(hours=1),
+        input_bindings=[
+            {"target": "team", "expression": {"kind": "literal", "value": "old"}}
+        ],
+    )
+    stale = store.get_schedule("a")
+    live = store.get_schedule("a")
+    live.revision = 2
+    from wf_core.models.input_bindings import ScheduleInputBinding
+
+    live.input_bindings = [
+        ScheduleInputBinding.model_validate(
+            {"target": "team", "expression": {"kind": "literal", "value": "new"}}
+        )
+    ]
+    store.save_schedule(live)
+    result = sched._poll_one(stale, t0 + timedelta(seconds=1))
+    assert result.startswith("admit:run-")
+    run_id = result.split(":", 1)[1]
+    admission = runs.get_admission(run_id)
+    assert admission.resolved_input["team"] == "new"
+    assert admission.schedule_revision == 2
+    sched.ownership.release()