@forgezero/runtime 0.1.14 → 0.1.16

package/README.md

@@ -7,7 +7,7 @@
 
 # @forgezero/runtime
 
-The machinery behind a request handler — jobs, queues, an outbox, a hash-chained audit trail, mail, backups, schema validation and exact money. 44 public modules, each imported on its own.
+The machinery behind a request handler — jobs, queues, an outbox, a hash-chained audit trail, mail, backups, schema validation and exact money. 30 public modules, each imported on its own.
 
 ## Package overview
 
@@ -44,7 +44,6 @@ These are supported consumer entry points, not every internal module shipped for
 | @forgezero/runtime/notify | Render a named template to text and HTML, escaped per part, refusing to send with a blank where a value should be. | portable | [Reference + usage](#forgezero-runtime-notify) |
 | @forgezero/runtime/notify/templates | The six transactional messages ForgeZero sends. | portable | [Reference + usage](#forgezero-runtime-notify-templates) |
 | @forgezero/runtime/calendar | Billing periods computed from an anchor, working days, holidays and due dates. | portable | [Reference + usage](#forgezero-runtime-calendar) |
-| @forgezero/runtime/compliance | Screening as a decision record — tiers, rules and lists, failing closed when a list is unreachable. | portable | [Reference + usage](#forgezero-runtime-compliance) |
 | @forgezero/runtime/totp | RFC 6238 TOTP on the existing HMAC — base32, an asymmetric window, and replay left to the caller. | portable | [Reference + usage](#forgezero-runtime-totp) |
 | @forgezero/runtime/passkey | Passkeys for sites that are not us. A vault-held credential is as unphishable as one in a security chip provided the RP ID check never slips — `evil-example.com` ends with `example.com` and is a different site. | portable | [Reference + usage](#forgezero-runtime-passkey) |
 | @forgezero/runtime/phrase | BIP-39 recovery phrases, and the salted verifier that proves one without being able to reconstruct it. | portable | [Reference + usage](#forgezero-runtime-phrase) |
@@ -58,25 +57,12 @@ These are supported consumer entry points, not every internal module shipped for
 | @forgezero/runtime/schema/typebox | The TypeBox validator behind that interface. | portable | [Reference + usage](#forgezero-runtime-schema-typebox) |
 | @forgezero/runtime/finance/discounts | Promotions as arithmetic over integer minor units. They never stack — one winner — and a percentage rounds down, because rounding a discount up gives away a unit of currency per invoice forever. | portable | [Reference + usage](#forgezero-runtime-finance-discounts) |
 | @forgezero/runtime/finance/money | Exact amounts in minor units with the asset attached, so two currencies cannot be added. | portable | [Reference + usage](#forgezero-runtime-finance-money) |
-| @forgezero/runtime/finance/venues | Trading venues, market types and symbols as data — spot, margin and futures behind one order model. | portable | [Reference + usage](#forgezero-runtime-finance-venues) |
-| @forgezero/runtime/finance/ledger | Double-entry postings and derived balances. A hold is a posting, not a lock — the queue does the ordering. | portable | [Reference + usage](#forgezero-runtime-finance-ledger) |
-| @forgezero/runtime/finance/commission | Profit net of flows, a high-water mark, the tier split and the referral share of our income. | portable | [Reference + usage](#forgezero-runtime-finance-commission) |
-| @forgezero/runtime/finance/rates | What an asset is worth in USD, and how old that answer is. A peg never ages; a quote always does. | portable | [Reference + usage](#forgezero-runtime-finance-rates) |
-| @forgezero/runtime/finance/transfers | Deposits and withdrawals as ordered pipelines, with screening reserved at position zero. | portable | [Reference + usage](#forgezero-runtime-finance-transfers) |
-| @forgezero/runtime/finance/chain | Which chains exist, their confirmation depth by value band, assets and explorers — as data an admin edits. | portable | [Reference + usage](#forgezero-runtime-finance-chain) |
-| @forgezero/runtime/finance/custody | Derive CREATE2 deposit addresses and EIP-712 custody digests — arithmetic over a seed and a salt, needing no credential and no node. | portable | [Reference + usage](#forgezero-runtime-finance-custody) |
-| @forgezero/runtime/finance/derive | Declare a field ForgeZero generates rather than the tenant supplying: BIP-44 path arithmetic, and the choice of who is capable of generating the key. | portable | [Reference + usage](#forgezero-runtime-finance-derive) |
 | @forgezero/runtime/finance/tax | Which jurisdiction may tax a sale, who accounts for it, and the three ways to be zero that report differently. Rates are data. | portable | [Reference + usage](#forgezero-runtime-finance-tax) |
 | @forgezero/runtime/finance/storage | Write an amount so it is both exact and sortable: an authoritative string, and a number that is only an index. | portable | [Reference + usage](#forgezero-runtime-finance-storage) |
 | @forgezero/runtime/realtime | Provider-neutral realtime audience, shard, event and delivery contracts. | portable | [Reference + usage](#forgezero-runtime-realtime) |
 | @forgezero/runtime/passkey-hybrid | Versioned WebAuthn PRF plus ML-DSA companion proof construction and verification. | portable | [Reference + usage](#forgezero-runtime-passkey-hybrid) |
 | @forgezero/runtime/otpauth | Parse and render otpauth URIs without binding enrolment to a UI framework. | portable | [Reference + usage](#forgezero-runtime-otpauth) |
 | @forgezero/runtime/pipeline | Typed ordered application-pipeline execution with explicit evidence. | portable | [Reference + usage](#forgezero-runtime-pipeline) |
-| @forgezero/runtime/finance/chain-addresses | Chain-address derivation records and validation independent of a node provider. | portable | [Reference + usage](#forgezero-runtime-finance-chain-addresses) |
-| @forgezero/runtime/finance/chain-deposits | Provider-neutral deposit observation, confirmation and credit transitions. | portable | [Reference + usage](#forgezero-runtime-finance-chain-deposits) |
-| @forgezero/runtime/finance/chain-withdrawals | Provider-neutral withdrawal approval, broadcast and finality transitions. | portable | [Reference + usage](#forgezero-runtime-finance-chain-withdrawals) |
-| @forgezero/runtime/finance/chain-reconcile | Deterministic reconciliation between chain observations and durable transfer state. | portable | [Reference + usage](#forgezero-runtime-finance-chain-reconcile) |
-| @forgezero/runtime/finance/market | Market order, fill and quote contracts independent of any exchange adapter. | portable | [Reference + usage](#forgezero-runtime-finance-market) |
 | @forgezero/runtime/custody-share | Threshold-share parsing, validation and reconstruction. | portable | [Reference + usage](#forgezero-runtime-custody-share) |
 | @forgezero/runtime/custody-crypto | Hybrid ML-KEM-768 plus X25519 custody-share sealing and opening. | portable | [Reference + usage](#forgezero-runtime-custody-crypto) |
 
@@ -316,29 +302,6 @@ import {
 export const selectedCapability = CalendarError;
 ```
 
-<a id="forgezero-runtime-compliance"></a>
-## @forgezero/runtime/compliance
-
-Screening as a decision record — tiers, rules and lists, failing closed when a list is unreachable. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
-
-```text
-import {
-  ComplianceError,
-} from '@forgezero/runtime/compliance';
-```
-
-## @forgezero/runtime/compliance — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  ComplianceError,
-} from '@forgezero/runtime/compliance';
-
-export const selectedCapability = ComplianceError;
-```
-
 <a id="forgezero-runtime-totp"></a>
 ## @forgezero/runtime/totp
 
@@ -658,190 +621,6 @@ import {
 export const selectedCapability = ASSETS;
 ```
 
-<a id="forgezero-runtime-finance-venues"></a>
-## @forgezero/runtime/finance/venues
-
-Trading venues, market types and symbols as data — spot, margin and futures behind one order model. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
-
-```text
-import {
-  MARKET_TYPES,
-} from '@forgezero/runtime/finance/venues';
-```
-
-## @forgezero/runtime/finance/venues — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  MARKET_TYPES,
-} from '@forgezero/runtime/finance/venues';
-
-export const selectedCapability = MARKET_TYPES;
-```
-
-<a id="forgezero-runtime-finance-ledger"></a>
-## @forgezero/runtime/finance/ledger
-
-Double-entry postings and derived balances. A hold is a posting, not a lock — the queue does the ordering. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
-
-```text
-import {
-  ACCOUNT_KINDS,
-} from '@forgezero/runtime/finance/ledger';
-```
-
-## @forgezero/runtime/finance/ledger — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  ACCOUNT_KINDS,
-} from '@forgezero/runtime/finance/ledger';
-
-export const selectedCapability = ACCOUNT_KINDS;
-```
-
-<a id="forgezero-runtime-finance-commission"></a>
-## @forgezero/runtime/finance/commission
-
-Profit net of flows, a high-water mark, the tier split and the referral share of our income. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
-
-```text
-import {
-  CommissionError,
-} from '@forgezero/runtime/finance/commission';
-```
-
-## @forgezero/runtime/finance/commission — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  CommissionError,
-} from '@forgezero/runtime/finance/commission';
-
-export const selectedCapability = CommissionError;
-```
-
-<a id="forgezero-runtime-finance-rates"></a>
-## @forgezero/runtime/finance/rates
-
-What an asset is worth in USD, and how old that answer is. A peg never ages; a quote always does. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
-
-```text
-import {
-  BASE_ASSET,
-} from '@forgezero/runtime/finance/rates';
-```
-
-## @forgezero/runtime/finance/rates — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  BASE_ASSET,
-} from '@forgezero/runtime/finance/rates';
-
-export const selectedCapability = BASE_ASSET;
-```
-
-<a id="forgezero-runtime-finance-transfers"></a>
-## @forgezero/runtime/finance/transfers
-
-Deposits and withdrawals as ordered pipelines, with screening reserved at position zero. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
-
-```text
-import {
-  DIRECTIONS,
-} from '@forgezero/runtime/finance/transfers';
-```
-
-## @forgezero/runtime/finance/transfers — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  DIRECTIONS,
-} from '@forgezero/runtime/finance/transfers';
-
-export const selectedCapability = DIRECTIONS;
-```
-
-<a id="forgezero-runtime-finance-chain"></a>
-## @forgezero/runtime/finance/chain
-
-Which chains exist, their confirmation depth by value band, assets and explorers — as data an admin edits. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
-
-```text
-import {
-  ADDRESS_SCHEMES,
-} from '@forgezero/runtime/finance/chain';
-```
-
-## @forgezero/runtime/finance/chain — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  ADDRESS_SCHEMES,
-} from '@forgezero/runtime/finance/chain';
-
-export const selectedCapability = ADDRESS_SCHEMES;
-```
-
-<a id="forgezero-runtime-finance-custody"></a>
-## @forgezero/runtime/finance/custody
-
-Derive CREATE2 deposit addresses and EIP-712 custody digests — arithmetic over a seed and a salt, needing no credential and no node. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
-
-```text
-import {
-  CustodyError,
-} from '@forgezero/runtime/finance/custody';
-```
-
-## @forgezero/runtime/finance/custody — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  CustodyError,
-} from '@forgezero/runtime/finance/custody';
-
-export const selectedCapability = CustodyError;
-```
-
-<a id="forgezero-runtime-finance-derive"></a>
-## @forgezero/runtime/finance/derive
-
-Declare a field ForgeZero generates rather than the tenant supplying: BIP-44 path arithmetic, and the choice of who is capable of generating the key. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
-
-```text
-import {
-  CUSTODY,
-} from '@forgezero/runtime/finance/derive';
-```
-
-## @forgezero/runtime/finance/derive — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  CUSTODY,
-} from '@forgezero/runtime/finance/derive';
-
-export const selectedCapability = CUSTODY;
-```
-
 <a id="forgezero-runtime-finance-tax"></a>
 ## @forgezero/runtime/finance/tax
 
@@ -980,121 +759,6 @@ import {
 export const selectedCapability = GIT_PROVIDERS;
 ```
 
-<a id="forgezero-runtime-finance-chain-addresses"></a>
-## @forgezero/runtime/finance/chain-addresses
-
-Chain-address derivation records and validation independent of a node provider. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
-
-```text
-import {
-  AddressError,
-} from '@forgezero/runtime/finance/chain-addresses';
-```
-
-## @forgezero/runtime/finance/chain-addresses — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  AddressError,
-} from '@forgezero/runtime/finance/chain-addresses';
-
-export const selectedCapability = AddressError;
-```
-
-<a id="forgezero-runtime-finance-chain-deposits"></a>
-## @forgezero/runtime/finance/chain-deposits
-
-Provider-neutral deposit observation, confirmation and credit transitions. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
-
-```text
-import {
-  DepositError,
-} from '@forgezero/runtime/finance/chain-deposits';
-```
-
-## @forgezero/runtime/finance/chain-deposits — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  DepositError,
-} from '@forgezero/runtime/finance/chain-deposits';
-
-export const selectedCapability = DepositError;
-```
-
-<a id="forgezero-runtime-finance-chain-withdrawals"></a>
-## @forgezero/runtime/finance/chain-withdrawals
-
-Provider-neutral withdrawal approval, broadcast and finality transitions. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
-
-```text
-import {
-  WITHDRAWAL_STATES,
-} from '@forgezero/runtime/finance/chain-withdrawals';
-```
-
-## @forgezero/runtime/finance/chain-withdrawals — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  WITHDRAWAL_STATES,
-} from '@forgezero/runtime/finance/chain-withdrawals';
-
-export const selectedCapability = WITHDRAWAL_STATES;
-```
-
-<a id="forgezero-runtime-finance-chain-reconcile"></a>
-## @forgezero/runtime/finance/chain-reconcile
-
-Deterministic reconciliation between chain observations and durable transfer state. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
-
-```text
-import {
-  DISCREPANCY_KINDS,
-} from '@forgezero/runtime/finance/chain-reconcile';
-```
-
-## @forgezero/runtime/finance/chain-reconcile — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  DISCREPANCY_KINDS,
-} from '@forgezero/runtime/finance/chain-reconcile';
-
-export const selectedCapability = DISCREPANCY_KINDS;
-```
-
-<a id="forgezero-runtime-finance-market"></a>
-## @forgezero/runtime/finance/market
-
-Market order, fill and quote contracts independent of any exchange adapter. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
-
-```text
-import {
-  MarketError,
-} from '@forgezero/runtime/finance/market';
-```
-
-## @forgezero/runtime/finance/market — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  MarketError,
-} from '@forgezero/runtime/finance/market';
-
-export const selectedCapability = MarketError;
-```
-
 <a id="forgezero-runtime-custody-share"></a>
 ## @forgezero/runtime/custody-share
 
@@ -1161,51 +825,38 @@ import {
 
 ## What is in it
 
-Four groups. The service spine is what a process needs to keep working after the response is sent; the record keeps evidence; the finance modules are the ones that must never be approximated. Nothing here knows what your product does — a tenant binds its own business rules to these, it does not fork them.
+Four groups. The service spine keeps work ordered after a response; record modules preserve evidence and recovery; identity modules provide portable security primitives; finance modules provide exact USD and multi-currency representation without importing a trading product.
 
 ```text
-SPINE      jobs        scheduled work submitted through the common queue
-           queue       awaited result; parallel keys, sequential within one
-           outbox      business-owned durability, drained through handlers
+SPINE      jobs        fenced scheduled work
+           queue       parallel keys, sequential within one key
+           outbox      transactional intent, bounded draining
 
-RECORD     audit       append-only, hash-chained, names the first altered row
-           backup      encrypted, chunked, verified snapshots + the restore
-           compliance  screening as a decision record, failing closed
-           calendar    billing periods, working days, holidays, due dates
+RECORD     audit       append-only hash-chain verification
+           backup      encrypted snapshots and verified restore
+           calendar    periods, working days and due dates
 
-IDENTITY   identity    hybrid Ed25519 + ML-DSA-65 request signing
-           totp        RFC 6238, asymmetric window, replay rejected
-           notify      named templates to text and HTML, escaped per part
-           schema      JSON Schema validation, restricted and describable
+IDENTITY   identity    hybrid Ed25519 + ML-DSA-65 signing
+           passkey     WebAuthn and recovery primitives
+           totp        bounded RFC 6238 verification
+           notify      escaped named notification templates
+           schema      restricted validation and form descriptors
 
-FINANCE    money       minor units with the asset attached
-           storage      the same amount, exact AND sortable in a database
-           ledger      double-entry postings and derived balances
-           commission  profit net of flows, high-water mark, referral split
-           rates       what an asset is worth, and how old that answer is
-           transfers   deposits and withdrawals as ordered pipelines
-           tax         who may tax a sale, and who accounts for it
-           chain       chains, assets, confirmation depth by value band
-           custody     CREATE2 deposit addresses and EIP-712 digests
-           derive      declare a key ForgeZero generates, not the tenant
-           venues      trading venues, market types and symbols as data
-           binance     Binance behind the venue adapter
+FINANCE    money       exact minor-unit strings with currency and scale
+           storage     exact authority plus coarse indexed projection
+           discounts   bounded price adjustments
+           tax         jurisdiction and accounting decisions
 ```
 
 ## Optional peers — install only what your subpath needs
 
-Nothing third-party is bundled. Vendoring a crypto library means a fix for it never reaches you until this package is republished, so the imports stay real and the dependency stays yours. Most subpaths need nothing; four of them do, and the failure is a plain module-not-found rather than a silently wrong result.
+Nothing third-party is bundled. Vendoring a crypto library means a fix cannot reach you until this package republishes, so optional peer imports remain explicit. Most subpaths need nothing.
 
 ```text
-# most subpaths: nothing to add
-
-# finance/custody  — CREATE2 and EIP-712 digests
-bun add @noble/hashes
-
-# identity         — hybrid post-quantum signing
+# identity and hybrid passkeys
 bun add @noble/curves @noble/post-quantum
 
-# schema/typebox   — only if you validate with TypeBox
+# schema/typebox — only if you validate with TypeBox
 bun add @sinclair/typebox
 ```
 
@@ -1234,18 +885,6 @@ const row = toStored(fee);
 rangeBounds(parseAmount('10', 'USD'), null);   // { gte: 10 }
 ```
 
-## The contracts ship with it
-
-The Solidity behind `finance/custody` is in the package rather than in a repository you have to go find. `finance/custody` computes the counterfactual address; `DepositFactory` is what makes that address real on first sweep, and `ColdVault` is the M-of-N EIP-712 approval the digests are built for. Address arithmetic without the contract that honours it is half an answer.
-
-```text
-node_modules/@forgezero/runtime/contracts/src/
-  DepositProxy.sol      lazily deployed at first sweep — no key, no gas per address
-  DepositFactory.sol    CREATE2, salt opaque to the contract
-  ColdVault.sol         M-of-N, signatures ordered by ascending signer
-  SafeTransferLib.sol   tokens that do not return a bool
-```
-
 ## Jobs — background work that never overlaps
 
 The lock and the cursor store are interfaces, so this runs against a database, Redis, or nothing at all in a test.
@@ -1289,13 +928,13 @@ Fetch a batch, process every item, then write the cursor — never per item and
 
 ```text
 cursorJob({
-  key: 'scan-deposits',
-  label: 'Scan deposits',
-  every: '15s',
+  key: 'rotate-provider-credentials',
+  label: 'Rotate provider credentials',
+  every: '1m',
   store: cursors,
   from: '0',
-  fetch: (cursor) => fetchBlocks(cursor),
-  process: (transfer) => credit(transfer)   // keyed, so a retry is free
+  fetch: (cursor) => dueRotations(cursor),
+  process: (record) => rotateOnce(record)   // keyed and idempotent
 });
 ```
 
@@ -1306,7 +945,7 @@ Returning from stop() before in-flight work settles is how a deploy leaves a rec
 ```text
 await scheduler.stop();       // clears timers, aborts, awaits in-flight
 scheduler.pause();            // stop scheduling, let in-flight finish
-await scheduler.runNow('scan-deposits');
+await scheduler.runNow('rotate-provider-credentials');
 ```
 
 ## Status somebody can read during an incident
@@ -1315,7 +954,7 @@ Last run, duration, result, error and consecutive failures per job. Without it a
 
 ```text
 scheduler.status();
-// [{ key: 'scan-deposits', state: 'idle', runs: 412,
+// [{ key: 'rotate-provider-credentials', state: 'idle', runs: 412,
 //    lastDurationMs: 840, lastResult: { processed: 17, batches: 2 },
 //    consecutiveFailures: 0, skippedLocked: 0 }]
 ```

package/dist/jobs.d.ts

@@ -1,15 +1,14 @@
 /**
  * Jobs — background work that does not corrupt anything when it goes wrong.
  *
- * ForgeZero needs session and step-up reaping, provider health probes and
- * invoice runs. An exchange needs a deposit scanner and a withdrawal processor.
- * They are the same machinery, and the same four mistakes sink all of them:
+ * ForgeZero needs session and step-up reaping, provider health probes, Vault
+ * rotations and invoice runs. The same four mistakes sink all of them:
  *
  *   OVERLAP    `setInterval` fires again while the previous run is still going.
- *              Two deposit scans reading the same block credit it twice.
+ *              Two rotation scans may promote competing credential generations.
  *   CURSOR     the cursor advances past a batch that failed halfway, so the
- *              deposits in it are never seen again and the shortfall is found
- *              by a customer.
+ *              records in it are never seen again and the missed work is found
+ *              only after an operational failure.
  *   DUPLICATE  two processes run the same job because nothing coordinated them.
  *   SHUTDOWN   a deploy kills a run mid-write, leaving a record half-updated.
  *

package/dist/notify-templates.js

@@ -132,7 +132,7 @@ var invitation = defineTemplate({
   data: ["inviter", "organisation", "link", "days"],
   sample: {
     inviter: "Aravind",
-    organisation: "AltPilot",
+    organisation: "Example Company",
     link: "https://forgezero.net/invite?token=abc",
     days: "7"
   },