@arcforgelabs/flow 2026.11.6 → 2026.11.7

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@arcforgelabs/flow",
-  "version": "2026.11.6",
+  "version": "2026.11.7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@arcforgelabs/flow",
-      "version": "2026.11.6",
+      "version": "2026.11.7",
       "license": "MIT",
       "dependencies": {
         "@clerk/backend": "3.25.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcforgelabs/flow",
-  "version": "2026.11.6",
+  "version": "2026.11.7",
   "description": "Invoicing, bill entry and a financial dashboard for labs, with Seazona and Xero integrations.",
   "license": "MIT",
   "repository": {

package/server/app.js

@@ -146,7 +146,7 @@ export function createApp({
   // Settings, Integrations: an owner turns integrations on and enters their
   // settings (server/integrations/setup.js).
   if (integrations && database && auth?.personAuth) {
-    app.use('/api/integrations', createSetupRouter({ db: database.db, registry: integrations, personAuth: auth.personAuth, secrets, log }));
+    app.use('/api/integrations', createSetupRouter({ db: database.db, registry: integrations, personAuth: auth.personAuth, secrets, log, buttonCooldowns }));
   }
   // Invoicing for signed-in people (server/api/invoicing.js). A job's draft
   // invoice needs a live check in the accounting system: the first enabled

package/server/core/sync-now.js

@@ -0,0 +1,38 @@
+// Sync now (docs/INTEGRATIONS.md, "Sync now"): a person asks Flow to read its
+// systems again now, not at the next background run. An integration takes
+// part while its own "Include in Sync now" setting is on, the default. Each
+// integration's page also has its own Sync, which reads that one integration
+// whatever the setting says. Each read goes through the integration's call guard
+// and rate limit, as a background read does. The pipeline joins what they
+// bring into jobs at its next run (every 2 minutes).
+
+const named = (adapter, answer) => ({ id: adapter.id, name: adapter.name, ...answer });
+
+// What the Sync now button shows: each integration that can take part,
+// whether it does, whether a read is going, and when the last one started.
+// Reads Flow's data only.
+export async function syncNowStatus(registry) {
+  return Promise.all(registry.with('syncNowStatus').map(async (adapter) => {
+    try {
+      return named(adapter, await adapter.capabilities.syncNowStatus());
+    } catch {
+      return named(adapter, { included: false, running: false, lastAt: null, ok: null });
+    }
+  }));
+}
+
+// Starts each included integration's read, one after the other, or only the
+// integration `only` names. An integration that cannot read answers
+// `unavailable` with its reason; the others still run.
+export async function startSyncNow(registry, { only = null, actor = null, log = console } = {}) {
+  const results = [];
+  for (const adapter of registry.with('syncNow').filter((a) => !only || a.id === only)) {
+    try {
+      results.push(named(adapter, await adapter.capabilities.syncNow({ asked: Boolean(only) })));
+    } catch (error) {
+      results.push(named(adapter, { state: 'unavailable', reason: error?.message || 'the read failed' }));
+    }
+  }
+  log.info?.(`[sync-now] person ${actor ?? 'unknown'}: ${results.map((r) => `${r.id} ${r.state}`).join(', ') || 'no integration can sync'}`);
+  return results;
+}

package/server/integrations/port.js

@@ -39,6 +39,8 @@ export const CAPABILITIES = Object.freeze([
   'readChanges', // { state: fresh | read | unavailable }: the accounting system's latest changes into its copy now, just before Flow drafts or sends (read before act)
   'itemMatches', // { organisationId, codes } -> the Flow price codes that send as an item the system sells (Xero: linked item, else same code), from its copy; null while not connected or its item list was never read; never a live call
   'listPriceItems', // the system's own price list from its copy in Flow, for the price list's links and check; never a live call
+  'syncNow', // { asked } -> { state: started | running | read | off | unavailable, reason?, changed? }: a person's Sync now; read the system's latest changes into its copy now, inside its call guard. off: its "Include in Sync now" setting is off and `asked` (a person's Sync for this integration alone) is false (server/core/sync-now.js)
+  'syncNowStatus', // {} -> { included, running, lastAt, ok }: for the Sync now button; reads Flow's data only
   'health', // connection state for Settings
   'alerts', // what only a person can clear (a refused sign-in, stopped calls), for the Integrations page; reads Flow's data only
   'captureError', // an error Flow logged, sent to the installation's own error service (Sentry)

package/server/integrations/seazona/index.js

@@ -53,10 +53,15 @@ export const SEAZONA_SETUP = {
     { name: 'SEAZONA_API_CLIENT_SECRET', label: 'Client secret', secret: true, help: 'Stored encrypted. Flow never shows it again.' },
     { name: 'SEAZONA_ORDER_URL', label: 'Order address', kind: 'url', help: 'Optional. Open any order in Seazona and paste its address here, or write {ref} where the order id goes. Stage moves on the Jobs board and Open in Seazona use it.' },
     { name: 'SEAZONA_KEEP_PATIENT_REFERENCE', label: 'Keep patient names', kind: 'onoff', help: 'On: Flow keeps the patient name of each job for the invoice Reference.' },
+    { name: 'SEAZONA_SYNC_NOW', label: 'Include in Sync now', kind: 'onoff', default: 'on', help: 'On: Sync now on the Integrations page reads Seazona\'s new and changed orders, invoices and practices.' },
     { name: 'SEAZONA_API_READ_HIDE_PATIENT', label: 'Hide patient details', kind: 'onoff', help: 'On: an AI assistant reading Seazona through Flow gets no patient, note, file or clinical fields.' },
   ],
 };
 
+// The lanes Sync now reads: what changes from day to day. Products, lab
+// users, the history read and the sweep keep their own schedule.
+export const SYNC_NOW_LANES = Object.freeze(['invoices', 'orders_recent', 'orders_active', 'clients']);
+
 // What a person reads for each lane: the Seazona records it copies.
 const READ_NAMES = {
   invoices: 'invoices',
@@ -72,6 +77,10 @@ const readNames = (lanes) => lanes.map((lane) => READ_NAMES[lane.lane] ?? lane.l
 export function createSeazonaAdapter({ env = null, fetchImpl = null, now = Date.now, timers } = {}) {
   let runtime = null; // { settings, db, client, scheduler }
   const actReader = createActReader({ now });
+  // Sync now with no background sync (sandbox, replay, or background jobs
+  // off): one run at a time, and when the last one ended.
+  let manual = null;
+  let manualLast = null;
 
   function current() {
     if (!runtime) throw new Error('The Seazona adapter has not started');
@@ -121,6 +130,7 @@ export function createSeazonaAdapter({ env = null, fetchImpl = null, now = Date.
 
     async stop() {
       await runtime?.scheduler?.stop();
+      await manual;
       runtime = null;
     },
 
@@ -178,6 +188,40 @@ export function createSeazonaAdapter({ env = null, fetchImpl = null, now = Date.
         return alerts;
       },
 
+      // Sync now (server/core/sync-now.js): read new and changed orders,
+      // invoices and practices now, inside the rate governor. It answers at
+      // once; the run goes on in the background. Off while "Include in Sync
+      // now" is off, unless a person asked for Seazona alone (`asked`, its own
+      // Sync button).
+      async syncNow({ asked = false } = {}) {
+        if (!runtime) return { state: 'unavailable', reason: 'Seazona has not started' };
+        if (!runtime.settings.syncNow && !asked) return { state: 'off' };
+        const options = { only: SYNC_NOW_LANES };
+        if (runtime.scheduler) {
+          const state = runtime.scheduler.runNow(options);
+          return state === 'stopped' ? { state: 'unavailable', reason: 'Seazona is stopping' } : { state };
+        }
+        if (manual) return { state: 'running' };
+        const at = new Date(Number(now())).toISOString();
+        manual = runtime.run(options)
+          .then((result) => { manualLast = { at, ok: result.ok }; })
+          .catch(() => { manualLast = { at, ok: false }; })
+          .finally(() => { manual = null; });
+        return { state: 'started' };
+      },
+
+      async syncNowStatus() {
+        if (!runtime) return { included: false, running: false, lastAt: null, ok: null };
+        const scheduled = runtime.scheduler?.status();
+        const last = scheduled ? scheduled.lastRun : manualLast;
+        return {
+          included: runtime.settings.syncNow,
+          running: Boolean(scheduled?.running || manual),
+          lastAt: last?.at ?? null,
+          ok: last ? last.ok : null,
+        };
+      },
+
       // Billable work since a cursor: complete and shipped orders that
       // changed, with the Seazona invoice that carries each one. Orders
       // deleted in Seazona are never billable; they come back in `withdrawn`

package/server/integrations/seazona/scheduler.js

@@ -85,14 +85,14 @@ export function createSeazonaScheduler({
     timer?.unref?.();
   }
 
-  async function tick() {
+  async function tick(options = {}) {
     timer = null;
     if (stopped) return;
     const startedAt = new Date(Number(now())).toISOString();
     const turn = { abandoned: false };
     const thisRun = (async () => {
       try {
-        const result = await run();
+        const result = await run(options);
         const failed = Object.entries(result.results).filter(([, lane]) => !lane.ok);
         last = { at: startedAt, ok: result.ok, lanes: Object.keys(result.results), failed: failed.map(([lane]) => lane) };
         report(result.results);
@@ -135,6 +135,17 @@ export function createSeazonaScheduler({
       nextRunAt = null;
       await running;
     },
+    // Sync now (server/core/sync-now.js): a person asks for a run now, with
+    // `options` (the lanes to read). While a run is going it starts nothing
+    // and answers 'running'. Otherwise the waiting run moves to now; the
+    // schedule goes on from its end as usual.
+    runNow(options = {}) {
+      if (stopped) return 'stopped';
+      if (running) return 'running';
+      if (timer) timers.clearTimeout(timer);
+      tick(options);
+      return 'started';
+    },
     status() {
       return { running: Boolean(running), nextRunAt, lastRun: last, stuckSince };
     },

package/server/integrations/seazona/settings.js

@@ -206,6 +206,9 @@ export function resolveSeazonaSettings(env = process.env) {
     // order number, for "Open in Seazona" on a stage move. Optional; one
     // without {ref} is ignored.
     orderUrlTemplate: orderUrlTemplate(env.SEAZONA_ORDER_URL),
+    // "Include in Sync now" (server/core/sync-now.js): on unless the lab
+    // turns it off.
+    syncNow: !['0', 'false', 'off', 'no'].includes(text(env.SEAZONA_SYNC_NOW).toLowerCase()),
   };
 
   if (mode === 'live' || mode === 'sandbox') {

package/server/integrations/seazona/sweep.js

@@ -130,8 +130,15 @@ function laneReadsFrom(state, sync) {
   return Number.isFinite(cursorMs) ? cursorMs - sync.cursorOverlapMs : null;
 }
 
-function isDue(progress, at, sync) {
+// What an orders cycle reads from each list row. 2: the remake flag
+// (Seazona's isRemake, migration 0008). A cycle that finished before Flow
+// kept the flag does not count, so the next run starts a new one and old
+// orders get their flag without waiting out SEAZONA_SWEEP_CYCLE_DAYS.
+export const ORDER_CYCLE_READS = 2;
+
+function isDue(progress, at, sync, kind) {
   if (progress?.cycleStartedAt) return true;
+  if (kind === 'orders' && (progress?.reads ?? 1) < ORDER_CYCLE_READS) return true;
   const finished = Date.parse(progress?.lastFinishedAt ?? '');
   return !Number.isFinite(finished) || at.getTime() - finished >= sync.sweepCycleMs;
 }
@@ -253,7 +260,7 @@ async function sweepOrders(ctx, cursor, helpers, found) {
     progress.days.shift();
     progress.checkedDays += 1;
   }
-  cursor.orders = { lastFinishedAt: at.toISOString(), checkedDays: progress.checkedDays };
+  cursor.orders = { lastFinishedAt: at.toISOString(), checkedDays: progress.checkedDays, reads: ORDER_CYCLE_READS };
 }
 
 // Clients and invoices: the whole list, then the held records it left out.
@@ -501,7 +508,7 @@ export async function runSweep(ctx, helpers) {
   try {
     for (const kind of SWEEP_KINDS) {
       if (budget.left <= 0) break;
-      if (!isDue(cursor[kind], at, sync)) continue;
+      if (!isDue(cursor[kind], at, sync, kind)) continue;
       if (kind === 'orders') await sweepOrders(sweepCtx, cursor, helpers, found);
       else await sweepWholeList(sweepCtx, kind, cursor, laneStates, helpers, found);
     }

package/server/integrations/setup.js

@@ -2,6 +2,8 @@ import { eq, sql } from 'drizzle-orm';
 import express from 'express';
 import { FlowError } from '../core/errors.js';
 import { deriveKey, openSecret, sealSecret } from '../core/secrets.js';
+import { startSyncNow, syncNowStatus } from '../core/sync-now.js';
+import { createActionGuard } from './call-guard.js';
 import { integrationSettingEvents, integrationSettings, organisations } from '../db/schema.js';
 
 // Integration setup in Settings (docs/INTEGRATIONS.md, "Set up in Flow"). An
@@ -183,8 +185,11 @@ export async function saveSettings(db, { adapter, secrets, actor, enabled, value
 
 // GET /api/integrations (owner): every adapter with settings, its state and
 // what is set. PUT /api/integrations/:id (owner): save and apply.
-export function createSetupRouter({ db, registry, personAuth, secrets, baseEnv = process.env, log = console }) {
+export function createSetupRouter({ db, registry, personAuth, secrets, baseEnv = process.env, log = console, buttonCooldowns = true }) {
   const router = express.Router();
+  // Sync now can call Xero at a press, so it is an action (docs/INTEGRATIONS.md,
+  // "Button presses"): one a minute, for all and for each integration alone.
+  const actions = createActionGuard({ integration: 'sync-now', actions: { syncNow: { cooldownMs: 60_000 } }, off: !buttonCooldowns });
   const owner = [personAuth.requireSession, personAuth.requireRole('owner')];
   // A change needs a verified owner sign-in, as connecting Xero does.
   const verifiedOwner = [personAuth.requireSession, personAuth.requireOwner];
@@ -205,6 +210,21 @@ export function createSetupRouter({ db, registry, personAuth, secrets, baseEnv =
     } catch (error) { next(error); }
   });
 
+  // Sync now (server/core/sync-now.js): what the button shows, and the
+  // press. Reads only; the reads stay inside each call guard.
+  router.get('/sync-now', ...owner, async (_req, res, next) => {
+    try {
+      res.json({ ok: true, integrations: await syncNowStatus(registry) });
+    } catch (error) { next(error); }
+  });
+  router.post('/sync-now', ...owner, express.json({ limit: '4kb' }), actions.route('syncNow', { key: (req) => req.body?.only ?? 'all' }), async (req, res, next) => {
+    try {
+      const only = req.body?.only ?? null;
+      if (only !== null && !registry.get(only)) return res.status(404).json({ ok: false, code: 'not_found', error: 'No such integration' });
+      res.json({ ok: true, results: await startSyncNow(registry, { only, actor: req.person.id, log }) });
+    } catch (error) { next(error); }
+  });
+
   router.put('/:id', ...verifiedOwner, express.json({ limit: '32kb' }), async (req, res) => {
     const adapter = registry.get(req.params.id);
     if (!adapter?.setup) return res.status(404).json({ ok: false, code: 'not_found', error: 'No such integration' });

package/server/integrations/xero/index.js

@@ -48,6 +48,7 @@ export const XERO_SETUP = {
     { name: 'XERO_TENANT_NAME', label: 'Xero organisation name', help: 'Live mode connects only the organisation with this exact name.' },
     { name: 'XERO_ALLOW_LIVE_WRITES', label: 'Create draft invoices in live Xero', kind: 'onoff', help: 'Off: Flow only reads from Xero.' },
     { name: 'XERO_CREATE_CONTACTS', label: 'Create missing clients', kind: 'onoff', default: 'on', help: 'On: a pending invoice whose client is not in Xero offers Create. Off: add the client in Xero, then sync.' },
+    { name: 'XERO_SYNC_NOW', label: 'Include in Sync now', kind: 'onoff', default: 'on', help: 'On: Sync now on the Integrations page also reads Xero\'s changed invoices and credit notes. Each uses a few of the day\'s Xero calls.' },
     { name: 'XERO_WEBHOOK_KEY', label: 'Webhook key', secret: true, help: 'From the Xero app\'s Webhooks page. Empty: Flow reads Xero\'s changes every 15 minutes instead.' },
   ],
   derivedKeys: ['XERO_TOKEN_KEY'],
@@ -160,6 +161,30 @@ export function createXeroAdapter({ runtime: given = null } = {}) {
       // Xero's latest changes into the copy just before Flow drafts by rule or
       // sends (webhooks.js); no call when the copy is current.
       readChanges: ({ organisationId }) => readChangesFirst(database, current(), organisationId),
+      // Sync now (server/core/sync-now.js): Xero's latest invoice and credit
+      // note changes into the copy now, for each connected organisation, even
+      // when the copy counts as current. Off while "Include in Sync now" is off,
+      // unless a person asked for Xero alone (`asked`, its own Sync button).
+      syncNow: async ({ asked = false } = {}) => {
+        const { settings } = current();
+        if (!settings.syncNow && !asked) return { state: 'off' };
+        const { rows } = await database.execute(sql`select organisation_id from xero_connections where mode = ${settings.mode}`);
+        if (!rows.length) return { state: 'unavailable', reason: 'Xero is not connected' };
+        let changed = 0;
+        for (const row of rows) {
+          const answer = await readChangesFirst(database, current(), row.organisation_id, { force: true });
+          if (answer.state === 'unavailable') return answer;
+          changed += answer.changed ?? 0;
+        }
+        return { state: 'read', changed };
+      },
+      syncNowStatus: async () => {
+        const { settings } = current();
+        const { rows: [row] } = await database.execute(sql`select max(c.last_read_at) as at from xero_mirror_cursors c
+          join xero_connections x on x.organisation_id = c.organisation_id and x.mode = ${settings.mode}
+          where c.resource = 'invoices'`);
+        return { included: settings.syncNow, running: false, lastAt: row?.at ? new Date(row.at).toISOString() : null, ok: null };
+      },
       // Active Xero contacts, from Flow's copy (lookup.js).
       listCustomers: ({ organisationId }) => listCustomers(database, organisationId),
       // Create the Xero contact for one Flow contact, when that setting is on

package/server/integrations/xero/settings.js

@@ -196,6 +196,9 @@ export function resolveXeroSettings(env = process.env) {
     // On unless the lab turns it off: a pending invoice whose client is not
     // in Xero offers to create that client (docs/CONTACTS.md).
     createContacts: readOnOff(env, 'XERO_CREATE_CONTACTS', true),
+    // On unless the lab turns it off: Sync now (server/core/sync-now.js) also
+    // reads Xero's changes. Each Sync now costs a few of the day's calls.
+    syncNow: readOnOff(env, 'XERO_SYNC_NOW', true),
     mirrorPageSize: Math.min(readPositiveInteger(env, 'XERO_MIRROR_PAGE_SIZE', DEFAULT_MIRROR_PAGE_SIZE), MAX_MIRROR_PAGE_SIZE),
     // The share of the day's calls the mirror leaves for drafts and people.
     mirrorReserveFraction: readFraction(env, 'XERO_MIRROR_RESERVE_FRACTION', 0.3),

package/server/integrations/xero/webhooks.js

@@ -272,16 +272,17 @@ export async function dueDailyChecks(db, runtime, { now = Date.now() } = {}) {
 //   unavailable  the read could not run (`reason`); act on nothing
 export const READ_FIRST_MS = 10 * 60 * 1000;
 
-export async function readChangesFirst(db, runtime, organisationId, { now = Date.now } = {}) {
+// `force` (Sync now) reads even when the copy counts as current.
+export async function readChangesFirst(db, runtime, organisationId, { now = Date.now, force = false } = {}) {
   const { rows: [connection] } = await db.execute(sql`select tenant_id from xero_connections
     where organisation_id = ${organisationId} and mode = ${runtime.settings.mode}`);
   if (!connection) return { state: 'unavailable', reason: 'Xero is not connected' };
   const { rows: [{ waiting }] } = await db.execute(sql`select count(*)::int as waiting from xero_webhook_events
     where organisation_id = ${organisationId} and pending`);
-  if (!waiting && await webhooksActive(db, runtime, organisationId, { now: Number(now()) })) return { state: 'fresh' };
+  if (!force && !waiting && await webhooksActive(db, runtime, organisationId, { now: Number(now()) })) return { state: 'fresh' };
   const { rows: [{ oldest }] } = await db.execute(sql`select min(last_read_at) as oldest from xero_mirror_cursors
     where organisation_id = ${organisationId} and resource in ('invoices', 'credit_notes')`);
-  if (!waiting && oldest && Number(now()) - new Date(oldest).getTime() <= READ_FIRST_MS) return { state: 'fresh' };
+  if (!force && !waiting && oldest && Number(now()) - new Date(oldest).getTime() <= READ_FIRST_MS) return { state: 'fresh' };
   try {
     const inbox = await readInbox(db, runtime, organisationId, { now });
     if (inbox.stopped) return { state: 'unavailable', reason: inbox.stopped === 'budget' ? 'the day\'s Xero calls are kept for people' : 'Xero calls are stopped' };

package/server/ui/app.js

@@ -640,6 +640,50 @@ function integrationLogo(integration, size = '') {
     file ? h('img', { src: `/assets/ui/logos/${file}`, alt: '' }) : icon('plug'));
 }
 
+// Sync now (server/core/sync-now.js): reads each integration whose "Include
+// in Sync now" setting is on, now. With `only`, it is that integration's own
+// Sync on its page, and reads it whatever the setting says. Which ones, and
+// when the last read started, are on hover. While a read goes on, the button
+// says so and asks Flow again every 5 seconds (Flow's data only). Hidden while
+// nothing it would read can sync.
+function syncNowButton({ only = null } = {}) {
+  const word = only ? 'Sync' : 'Sync now';
+  const button = h('button', { class: 'fx-btn', type: 'button', hidden: true, disabled: true }, word);
+  const when = (at) => new Date(at).toLocaleString('en-AU', { dateStyle: 'medium', timeStyle: 'short' });
+  let timer = null;
+  const show = (all) => {
+    const list = only ? all.filter((i) => i.id === only) : all;
+    const included = only ? list : list.filter((i) => i.included);
+    const running = included.some((i) => i.running);
+    const last = included.map((i) => i.lastAt).filter(Boolean).sort().pop();
+    button.hidden = !list.length;
+    button.disabled = running || !included.length;
+    button.replaceChildren(...(running ? [h('span', { class: 'fx-spinner fx-spinner--sm', 'aria-hidden': 'true' }), 'Syncing'] : [word]));
+    button.title = included.length
+      ? `Reads ${included.map((i) => i.name).join(' and ')}.${last ? ` Last read ${when(last)}.` : ''}`
+      : 'Turn on "Include in Sync now" in an integration\'s settings.';
+    clearTimeout(timer);
+    if (running) timer = setTimeout(() => { if (button.isConnected) load(); }, 5000);
+  };
+  const load = () => flow('/api/integrations/sync-now')
+    .then(({ integrations }) => show(integrations))
+    .catch(() => { button.hidden = true; });
+  button.addEventListener('click', async () => {
+    button.disabled = true;
+    try {
+      const { results } = await flow('/api/integrations/sync-now', { method: 'POST', body: JSON.stringify(only ? { only } : {}) });
+      for (const r of results.filter((r) => r.state === 'unavailable')) toast(`${r.name}: ${r.reason}`, 'danger');
+      const reading = results.filter((r) => ['started', 'running', 'read'].includes(r.state));
+      if (reading.length) toast(`Reading ${reading.map((r) => r.name).join(' and ')}.`, 'success');
+    } catch (error) {
+      toast(error.message, 'danger');
+    }
+    load();
+  });
+  load();
+  return button;
+}
+
 async function renderIntegrations(main) {
   const state = { tab: 'all', category: 'all', q: '' };
   const tabs = h('div', { class: 'fx-seg', role: 'tablist' });
@@ -649,7 +693,7 @@ async function renderIntegrations(main) {
   const notices = h('div', { class: 'fx-fields' });
   const content = h('div', { class: 'fx-int-sections' }, h('div', { class: 'fx-skeleton' }));
   main.append(
-    pageHeader('Integrations'),
+    pageHeader('Integrations', { actions: [syncNowButton()] }),
     alertStrip(ui(), 'integrations').element,
     h('div', { class: 'fx-int-bar' }, tabs, h('div', { class: 'fx-row' }, category, search)),
     notices, content);
@@ -848,6 +892,18 @@ async function renderIntegration(main, id) {
       }
     };
 
+    // A disconnect stops the integration, so it asks first: one stray click
+    // must not stop a lab's sync.
+    const disconnect = async () => {
+      const ok = await dialog({
+        title: `Disconnect ${current.name}?`,
+        body: h('p', {}, `Flow stops working with ${current.name} until someone connects it again. Its settings and Flow's records stay.`),
+        confirm: 'Disconnect',
+        tone: 'danger',
+      });
+      if (ok) await save(false);
+    };
+
     const on = current.enabled;
     const guide = current.guide;
     const hostOwned = current.enabledBy === 'host';
@@ -855,10 +911,13 @@ async function renderIntegration(main, id) {
     const modeLabel = mode?.choices?.find((c) => c.value === mode.value)?.label ?? mode?.value;
     const busy = progress && progress.steps.some((step) => step.state === 'running');
 
-    const primary = !canChange || hostOwned ? null : on
-      ? h('button', { class: 'fx-btn', type: 'button', onclick: () => save(false) }, 'Disconnect')
+    const primary = !canChange || hostOwned || on ? null
       : h('button', { class: 'fx-btn fx-btn--primary', type: 'button', disabled: busy, onclick: connect },
         busy ? h('span', { class: 'fx-spinner fx-spinner--sm', 'aria-hidden': 'true' }) : null, busy ? 'Connecting' : 'Connect');
+    // Disconnect sits at the end of the page, away from Sync.
+    const disconnectRow = !canChange || hostOwned || !on ? null
+      : h('div', { class: 'fx-int-section' }, h('div', { class: 'fx-row fx-row--end' },
+        h('button', { class: 'fx-btn fx-btn--ghost fx-btn--danger', type: 'button', onclick: disconnect }, 'Disconnect')));
 
     host.replaceChildren(
       crumbs(['/integrations', 'Integrations'], current.name),
@@ -869,6 +928,7 @@ async function renderIntegration(main, id) {
             h('h1', { class: 'fx-title' }, current.name),
             h('div', { class: 'fx-int-hero__actions' },
               on ? statusPill(current) : null,
+              on && current.state === 'ready' ? syncNowButton({ only: current.id }) : null,
               primary,
               progress ? connectProgress(progress) : null)),
           alerts.element,
@@ -893,6 +953,7 @@ async function renderIntegration(main, id) {
               h('summary', {}, 'Advanced'),
               h('div', { class: 'fx-settings' }, advanced)) : null,
             canChange && on && inputs.size ? h('div', { class: 'fx-row fx-row--end' }, h('button', { class: 'fx-btn', type: 'button', onclick: () => save(undefined) }, 'Save changes')) : null) : null,
+          disconnectRow,
         ].filter(Boolean)),
         h('aside', { class: 'fx-int-page__meta' },
           h('dl', { class: 'fx-meta' }, ...[

package/server/ui/flow.css

@@ -1888,7 +1888,8 @@ body[data-state="loading"] .fx-loading { display: grid; justify-items: center; }
   content: ''; position: absolute; top: 3px; left: 3px; width: 16px; height: 16px;
   border-radius: 50%; background: var(--t-paper); transition: transform 0.15s;
 }
-.fx-switch[aria-checked="true"] { background: var(--t-primary); }
+/* background-color only: the shorthand would reset background-clip and fill the touch border. */
+.fx-switch[aria-checked="true"] { background-color: var(--t-primary); }
 .fx-switch[aria-checked="true"]::after { transform: translateX(18px); }
 .fx-switch:focus-visible { outline: none; box-shadow: var(--fx-focus); }
 .fx-switch:disabled { cursor: default; opacity: 0.6; }

package/server/ui/kit.js

@@ -244,7 +244,7 @@ export function dialog({ title, body, confirm, tone = 'primary', choices = null
       h('h2', { class: 'fx-dialog__title' }, title),
       choiceList ?? body,
       actions);
-    const element = applyPhoneRule(h('dialog', { class: 'fx-dialog' }, form), 'dialog');
+    const element = applyPhoneRule(h('dialog', { class: 'fx-dialog', 'aria-label': title }, form), 'dialog');
     element.addEventListener('close', () => {
       const value = element.returnValue;
       element.remove();
@@ -258,7 +258,8 @@ export function dialog({ title, body, confirm, tone = 'primary', choices = null
     if (choices) element.addEventListener('click', (event) => { if (event.target === element) element.close(); });
     document.body.append(element);
     element.showModal();
-    element.querySelector(choices ? '.fx-sheet__choice' : 'input, select, button[value="ok"]')?.focus();
+    // A danger step starts on Cancel, so Enter or a second tap does not confirm it.
+    element.querySelector(choices ? '.fx-sheet__choice' : `input, select, button[value="${tone === 'danger' ? 'cancel' : 'ok'}"]`)?.focus();
   });
 }