@kurtbruns/kestrel 1.5.0 → 1.6.0

package/dist/worker/index.js

@@ -1,4 +1,4 @@
-// @kurtbruns/kestrel 1.5.0: the Worker, built by scripts/build-package.mjs.
+// @kurtbruns/kestrel 1.6.0: the Worker, built by scripts/build-package.mjs.
 
 // shared/sends.ts
 function refusalAdvice(cause) {
@@ -33,10 +33,10 @@ var BOUNCE_SPIKE_RECENT_MS = 7 * 24 * 60 * 60 * 1e3;
 
 // src/generated/version.ts
 var BUILD_INFO = {
-  version: "1.5.0",
-  sha: "cbf8e1d",
-  tag: "v1.5.0",
-  buildTime: "2026-10-09T18:42:46.844Z",
+  version: "1.6.0",
+  sha: "25b8b69",
+  tag: "v1.6.0",
+  buildTime: "2026-10-12T03:08:02.808Z",
   repoUrl: "https://github.com/kurtbruns/kestrel"
 };
 
@@ -358,6 +358,7 @@ function getConfig(env) {
   const accessTeamDomain = orUndefined(env.ACCESS_TEAM_DOMAIN);
   const devShaped = provider === "fake" && !accessTeamDomain && isLoopbackOrigin(appOrigin);
   const devAuthSecret = devShaped ? orUndefined(env.DEV_AUTH_SECRET) : void 0;
+  const devMode = devAuthSecret !== void 0;
   const notifyChannel = devShaped ? "fake" : env.NOTIFY ? "cloudflare" : "provider";
   return {
     provider,
@@ -375,8 +376,9 @@ function getConfig(env) {
     // Show the dev-only dashboard link, and register the dev routes, exactly when the
     // dev credential path is live (dev-shaped AND the secret resolved). Never true in a
     // deployed env, so the reader surface stays clean of any admin link there.
-    devMode: devAuthSecret !== void 0,
+    devMode,
     devAuthSecret,
+    devRunId: devMode ? orUndefined(env.DEV_RUN_ID) : void 0,
     // Only ever read in a dev-shaped env; a deployed env runs a real provider, so the
     // simulation can never engage there whatever the var says.
     simulation: devShaped ? readSimulation(env.SIMULATE_SENDS) : null,
@@ -544,7 +546,7 @@ function mediaTypeOf(req) {
   return declared ? (declared.split(";")[0] ?? "").trim().toLowerCase() || void 0 : void 0;
 }
 async function readJsonObject(c, opts = {}) {
-  const text = await c.req.text();
+  const text = new TextDecoder().decode(await c.req.arrayBuffer());
   if (text.trim() === "") {
     if (opts.optional) {
       return {};
@@ -579,23 +581,23 @@ function optString(o, key, at) {
   }
   return v;
 }
-function optStringOrNull(o, key, at) {
-  const v = o[key];
-  if (v === void 0 || v === null || typeof v === "string") {
-    return v;
-  }
-  throw fieldError(path(key, at), `${path(key, at)} must be a string or null`);
-}
-function optCount(o, key, at) {
+function optBoolean(o, key, at) {
   const v = o[key];
   if (v === void 0) {
     return void 0;
   }
-  if (typeof v !== "number" || !Number.isSafeInteger(v) || v < 0) {
-    throw fieldError(path(key, at), `${path(key, at)} must be a whole number of at least 0`);
+  if (typeof v !== "boolean") {
+    throw fieldError(path(key, at), `${path(key, at)} must be true or false`);
   }
   return v;
 }
+function optStringOrNull(o, key, at) {
+  const v = o[key];
+  if (v === void 0 || v === null || typeof v === "string") {
+    return v;
+  }
+  throw fieldError(path(key, at), `${path(key, at)} must be a string or null`);
+}
 function optStringList(o, key, at) {
   const v = o[key];
   if (v === void 0) {
@@ -901,13 +903,20 @@ function latestSentSendForPost(db, postId) {
     "SELECT * FROM sends WHERE post_id = ? AND status = 'sent' ORDER BY completed_at DESC LIMIT 1"
   ).bind(postId).first();
 }
+var PUBLISHED_SEND = "s.status IN ('sending', 'sent')";
+var PUBLISHED_AT = "COALESCE(s.started_at, s.fire_at)";
+function publishedSendForPost(db, postId) {
+  return db.prepare(
+    `SELECT * FROM sends s WHERE s.post_id = ? AND ${PUBLISHED_SEND} ORDER BY ${PUBLISHED_AT} DESC LIMIT 1`
+  ).bind(postId).first();
+}
 async function listPublishedPosts(db, limit = 200) {
   const { results } = await db.prepare(
-    `SELECT p.slug AS slug, s.subject AS subject, MAX(s.completed_at) AS sent_at
+    `SELECT p.slug AS slug, s.subject AS subject, MAX(${PUBLISHED_AT}) AS published_at
          FROM sends s JOIN posts p ON p.id = s.post_id
-         WHERE s.status = 'sent'
+         WHERE ${PUBLISHED_SEND}
          GROUP BY s.post_id
-         ORDER BY sent_at DESC
+         ORDER BY published_at DESC
          LIMIT ?`
   ).bind(Math.min(limit, 1e3)).all();
   return results;
@@ -1145,18 +1154,15 @@ function insertScheduledSendStmt(db, send, now, settingsVersion) {
     ...guard2.binds
   );
 }
-function inWindowAt(now, rev) {
-  return {
-    sql: "status = 'scheduled' AND fire_at > ? AND (? IS NULL OR rev = ?)",
-    binds: [now, rev, rev]
-  };
+function inWindowAt(now) {
+  return { sql: "status = 'scheduled' AND fire_at > ?", binds: [now] };
 }
-function rescheduleStmt(db, sendId, fireAt, now, rev = null) {
-  const guard2 = inWindowAt(now, rev);
+function rescheduleStmt(db, sendId, fireAt, now) {
+  const guard2 = inWindowAt(now);
   return db.prepare(`UPDATE sends SET fire_at = ?, rev = ${NEXT_REV} WHERE id = ? AND ${guard2.sql}`).bind(fireAt, sendId, ...guard2.binds);
 }
-function cancelStmt(db, sendId, now, rev = null) {
-  const guard2 = inWindowAt(now, rev);
+function cancelStmt(db, sendId, now) {
+  const guard2 = inWindowAt(now);
   return db.prepare(
     `UPDATE sends SET status = 'canceled', completed_at = ?, rev = ${NEXT_REV} WHERE id = ? AND ${guard2.sql}`
   ).bind(now, sendId, ...guard2.binds);
@@ -1608,7 +1614,8 @@ async function findReceiptTarget(db, u) {
     ).bind(normalizeEmail(u.email)).first();
   }
   if (u.email) {
-    return db.prepare(`SELECT ${cols} FROM deliveries WHERE email = ? ORDER BY updated_at DESC LIMIT 1`).bind(normalizeEmail(u.email)).first();
+    const row = await db.prepare(`SELECT ${cols} FROM deliveries WHERE email = ? ORDER BY updated_at DESC LIMIT 1`).bind(normalizeEmail(u.email)).first();
+    return row && row.status !== "pending" && row.status !== "dispatched" ? row : null;
   }
   return null;
 }
@@ -1625,15 +1632,20 @@ async function acceptedAwaitingEvent(db, limit) {
 }
 
 // src/db/posts.ts
+function fromStored(row) {
+  return { ...row, slug_auto: row.slug_auto === 1 };
+}
 function setPostStatusStmt(db, postId, from, to, now, guard2) {
   const extra = guard2 ? ` AND ${guard2.sql}` : "";
   return db.prepare(`UPDATE posts SET status = ?, updated_at = ? WHERE id = ? AND status = ?${extra}`).bind(to, now, postId, from, ...guard2?.binds ?? []);
 }
-function getPost(db, id) {
-  return db.prepare("SELECT * FROM posts WHERE id = ?").bind(id).first();
+async function getPost(db, id) {
+  const row = await db.prepare("SELECT * FROM posts WHERE id = ?").bind(id).first();
+  return row && fromStored(row);
 }
-function getBySlug(db, slug) {
-  return db.prepare("SELECT * FROM posts WHERE slug = ?").bind(slug).first();
+async function getBySlug(db, slug) {
+  const row = await db.prepare("SELECT * FROM posts WHERE slug = ?").bind(slug).first();
+  return row && fromStored(row);
 }
 var POST_LIST_SPEC = {
   columns: {
@@ -1677,7 +1689,7 @@ async function listPosts(db, filter = {}, page) {
          ${order}
          LIMIT ? OFFSET ?`
   ).bind(...binds, limit, offset).all();
-  return results;
+  return results.map(fromStored);
 }
 async function countPosts(db, filter = {}) {
   const { clause, binds } = postWhere(filter);
@@ -1722,12 +1734,13 @@ async function createPost(db, input, author2) {
   const revId = newId();
   const subject = input.subject ?? "";
   const markdown = input.markdown ?? "";
-  const slug = await uniqueSlug(db, slugify(input.slug ?? subject));
+  const auto = input.slug_auto ?? input.slug === void 0;
+  const slug = await uniqueSlug(db, slugify(auto ? subject : input.slug ?? subject));
   const metadata = JSON.stringify({ subject, slug });
   await db.batch([
     db.prepare(
-      "INSERT INTO posts (id, slug, subject, status, current_revision, created_at, updated_at) VALUES (?, ?, ?, 'draft', ?, ?, ?)"
-    ).bind(id, slug, subject, revId, now, now),
+      "INSERT INTO posts (id, slug, slug_auto, subject, status, current_revision, created_at, updated_at) VALUES (?, ?, ?, ?, 'draft', ?, ?, ?)"
+    ).bind(id, slug, auto ? 1 : 0, subject, revId, now, now),
     db.prepare(
       "INSERT INTO post_revisions (id, post_id, markdown, metadata, author, created_at) VALUES (?, ?, ?, ?, ?, ?)"
     ).bind(revId, id, markdown, metadata, author2, now)
@@ -1745,8 +1758,11 @@ async function updatePost(db, post, input, author2) {
   const revId = newId();
   const subject = input.subject ?? post.subject;
   const markdown = input.markdown ?? current?.markdown ?? "";
+  const auto = input.slug_auto ?? (input.slug === void 0 && post.slug_auto);
   let slug = post.slug;
-  if (input.slug !== void 0) {
+  if (auto) {
+    slug = await uniqueSlug(db, slugify(subject), post.id);
+  } else if (input.slug !== void 0) {
     slug = await uniqueSlug(db, slugify(input.slug), post.id);
   }
   const metadata = JSON.stringify({ subject, slug });
@@ -1755,8 +1771,8 @@ async function updatePost(db, post, input, author2) {
       "INSERT INTO post_revisions (id, post_id, markdown, metadata, author, created_at) VALUES (?, ?, ?, ?, ?, ?)"
     ).bind(revId, post.id, markdown, metadata, author2, now),
     db.prepare(
-      "UPDATE posts SET slug = ?, subject = ?, current_revision = ?, updated_at = ? WHERE id = ? AND status = 'draft'"
-    ).bind(slug, subject, revId, now, post.id)
+      "UPDATE posts SET slug = ?, slug_auto = ?, subject = ?, current_revision = ?, updated_at = ? WHERE id = ? AND status = 'draft'"
+    ).bind(slug, auto ? 1 : 0, subject, revId, now, post.id)
   ]);
   const updated = unwrap(await getPost(db, post.id), "post");
   const revision = unwrap(
@@ -1779,499 +1795,233 @@ async function deletePost(db, id) {
   ]);
 }
 
-// src/db/settings.ts
-var BRANDING_LOGO_KEY = "branding/logo";
-var DEFAULT_CONFIRMATION_EMAIL = {
-  subject: "Confirm your subscription",
-  body: "Thanks for subscribing. Please confirm your email address to start receiving the newsletter.",
-  buttonLabel: "Confirm subscription",
-  reassurance: "If you didn't request this, you can safely ignore this email."
-};
-var DEFAULT_SETTINGS = {
-  testRecipients: [],
-  publication: { name: "", tagline: "", address: "", logo: null },
-  emailTemplate: "",
-  confirmationEmail: DEFAULT_CONFIRMATION_EMAIL,
-  notifications: { to: "" }
-};
-var MAX_TEST_RECIPIENTS = 20;
-var MAX_NAME = 120;
-var MAX_TAGLINE = 200;
-var MAX_ADDRESS = 300;
-var MAX_TEMPLATE = 4e4;
-var MAX_CE_SUBJECT = 200;
-var MAX_CE_BODY = 1e3;
-var MAX_CE_BUTTON = 80;
-var MAX_CE_REASSURANCE = 400;
-function coercePublication(raw) {
-  const o = raw && typeof raw === "object" ? raw : {};
-  const str = (v) => typeof v === "string" ? v : "";
-  const lr = o.logo;
-  const logo = lr && typeof lr === "object" && typeof lr.version === "number" ? { version: lr.version, contentType: str(lr.contentType) || "image/png" } : null;
-  return {
-    name: str(o.name).slice(0, MAX_NAME),
-    tagline: str(o.tagline).slice(0, MAX_TAGLINE),
-    address: str(o.address).slice(0, MAX_ADDRESS),
-    logo
-  };
-}
-function coerceConfirmation(raw) {
-  const o = raw && typeof raw === "object" ? raw : {};
-  const str = (v) => typeof v === "string" ? v : "";
-  return {
-    subject: str(o.subject).slice(0, MAX_CE_SUBJECT),
-    body: str(o.body).slice(0, MAX_CE_BODY),
-    buttonLabel: str(o.buttonLabel).slice(0, MAX_CE_BUTTON),
-    reassurance: str(o.reassurance).slice(0, MAX_CE_REASSURANCE)
-  };
+// src/lib/html.ts
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-function coerce(raw) {
-  const o = raw && typeof raw === "object" ? raw : {};
-  const list5 = Array.isArray(o.testRecipients) ? o.testRecipients : [];
-  return {
-    testRecipients: list5.filter((e) => typeof e === "string"),
-    publication: coercePublication(o.publication),
-    emailTemplate: typeof o.emailTemplate === "string" ? o.emailTemplate.slice(0, MAX_TEMPLATE) : "",
-    // A row that predates this feature has no `confirmationEmail` key at all — that's
-    // "never configured", so it gets the full built-in copy (reassurance included), NOT
-    // a blank-reassurance row. Only once the key exists (the operator saved copy) does a
-    // blank reassurance mean "deliberately omit the footer".
-    confirmationEmail: "confirmationEmail" in o ? coerceConfirmation(o.confirmationEmail) : { ...DEFAULT_CONFIRMATION_EMAIL },
-    notifications: coerceNotifications(o.notifications)
-  };
+function escapeHtmlAttr(s) {
+  return escapeHtml(s).replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
-function coerceNotifications(raw) {
-  const o = raw && typeof raw === "object" ? raw : {};
-  return { to: typeof o.to === "string" ? o.to : "" };
+
+// shared/page_policy.ts
+function pagePolicy(formAction, opts = {}) {
+  return [
+    "default-src 'none'",
+    "script-src 'none'",
+    "object-src 'none'",
+    "frame-src 'none'",
+    "base-uri 'none'",
+    `form-action ${formAction}`,
+    opts.framed ? null : "frame-ancestors 'none'",
+    "img-src * data:",
+    "style-src 'unsafe-inline' https://fonts.googleapis.com",
+    "font-src https://fonts.gstatic.com"
+  ].filter((d) => d !== null).join("; ");
 }
-function resolveConfirmationEmail(settings) {
-  const c = settings.confirmationEmail;
-  const d = DEFAULT_CONFIRMATION_EMAIL;
+
+// src/lib/page_headers.ts
+function headers(formAction) {
   return {
-    subject: c.subject.trim() || d.subject,
-    body: c.body.trim() || d.body,
-    buttonLabel: c.buttonLabel.trim() || d.buttonLabel,
-    reassurance: c.reassurance
+    "content-security-policy": pagePolicy(formAction),
+    "x-frame-options": "DENY",
+    "x-content-type-options": "nosniff"
   };
 }
-async function readSettings(db) {
-  const row = await db.prepare("SELECT data, updated_at FROM settings WHERE id = 1").first();
-  if (!row) {
-    return { settings: structuredClone(DEFAULT_SETTINGS), version: null };
-  }
-  return { settings: coerce(parseStored(row.data)), version: row.updated_at };
+var PAGE_SECURITY_HEADERS = headers("'self'");
+var POST_PAGE_SECURITY_HEADERS = headers("'none'");
+
+// src/lib/page.ts
+var READER_BG_LIGHT = "#fbfbfa";
+var READER_BG_DARK = "#12110f";
+var APP_ACCENT_TOKENS = `
+:root { --k-accent:#3355cc; --k-accent-contrast:#ffffff; }
+@media (prefers-color-scheme: dark) { :root { --k-accent:#7d9bff; --k-accent-contrast:#10131f; } }
+`;
+var DEV_BADGE_STYLE = `${APP_ACCENT_TOKENS}
+.r-dev { position:fixed; right:18px; bottom:18px; z-index:50; display:inline-flex; align-items:center; gap:8px;
+         font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif; line-height:1.6;
+         font-size:13px; font-weight:600; text-decoration:none; padding:9px 15px 9px 10px; border-radius:999px;
+         background:var(--k-accent); color:var(--k-accent-contrast); border:1px solid var(--k-accent);
+         box-shadow:0 6px 20px rgba(0,0,0,.22); }
+.r-dev:hover { filter:brightness(1.08); }
+/* Inverted badge \u2014 solid contrast fill, accent-colored text \u2014 so the tiny "DEV"
+   label clears WCAG AA on the accent pill in both themes (a translucent tint left
+   it ~3.6:1). */
+.r-dev .r-dev-tag { font-size:9.5px; letter-spacing:.09em; text-transform:uppercase; font-weight:700;
+                    padding:2px 7px; border-radius:999px;
+                    background:var(--k-accent-contrast); color:var(--k-accent); }
+.r-dev:focus-visible { outline:2px solid #2563eb; outline-offset:2px; }
+@media (prefers-color-scheme: dark) { .r-dev:focus-visible { outline-color:#60a5fa; } }
+`;
+var READER_BANNER_STYLE = `${APP_ACCENT_TOKENS}
+.r-banner { background:var(--k-accent); color:var(--k-accent-contrast);
+            font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;
+            font-size:13.5px; font-weight:500; line-height:1.4; }
+/* The tag runs in, inline with the sentence, so on a phone the sentence wraps beneath it at
+   the strip's full width rather than in a narrow column beside it. */
+.r-banner-in { max-width:var(--r-measure); margin:0 auto; padding:10px 24px; }
+.r-banner-tag { display:inline-block; margin-right:10px; font-size:10px; letter-spacing:.09em;
+                text-transform:uppercase; font-weight:700; padding:1px 7px; border-radius:999px;
+                background:var(--k-accent-contrast); color:var(--k-accent); }
+.r-banner-text { overflow-wrap:anywhere; }
+`;
+var READER_STYLE = `
+:root {
+  color-scheme: light dark;
+  --r-bg:${READER_BG_LIGHT}; --r-ink:#1b1a17; --r-card:#ffffff; --r-line:#e7e5df; --r-mut:#6b6a63;
+  --r-serif:Fraunces,Georgia,'Iowan Old Style','Times New Roman',serif;
+  --r-sans:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;
+  --r-measure:820px; /* one reading width shared by the masthead, body, and footer so their edges line up */
+  /* The masthead sits on the card surface with a hairline rule (the footer's top
+     rule, mirrored); the eyebrow/link accent inherits the ink color. */
+  --brand-ink:currentColor;
 }
-function parseStored(data) {
-  let parsed;
-  let problem = "is not a JSON object";
-  try {
-    parsed = JSON.parse(data);
-  } catch (err) {
-    problem = `is not valid JSON (${err instanceof Error ? err.message : String(err)})`;
-  }
-  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-    return parsed;
-  }
-  log.error("settings.corrupt", {
-    message: `the settings row (settings.id = 1) ${problem}; reads and writes of settings fail until it is repaired by hand`,
-    length: data.length
-  });
-  throw new HttpError(
-    500,
-    "settings_corrupt",
-    "The stored settings can't be read, so they are left as they are and nothing will save over them. The server log (settings.corrupt) says what's wrong."
-  );
+@media (prefers-color-scheme: dark) {
+  :root { --r-bg:${READER_BG_DARK}; --r-ink:#ece9e3; --r-card:#1b1a17; --r-line:#2c2a25; --r-mut:#a5a199; }
 }
-async function getSettings(db) {
-  return (await readSettings(db)).settings;
+* { box-sizing:border-box; }
+body { margin:0; font-family:var(--r-sans); background:var(--r-bg); color:var(--r-ink); line-height:1.6; }
+a { color:inherit; }
+img { max-width:100%; }
+
+/* Masthead: identity + a subscribe call to action, on the card surface with a
+   hairline bottom rule \u2014 light with dark text in light mode, and it inverts with
+   the reader tokens in dark mode. */
+.r-mast { background:var(--r-card); color:var(--r-ink); border-bottom:1px solid var(--r-line); }
+.r-mast-in { max-width:var(--r-measure); margin:0 auto; padding:24px; display:flex; align-items:center; gap:16px; }
+.r-brand { display:flex; align-items:center; gap:14px; text-decoration:none; color:inherit; min-width:0; }
+.r-logo { width:64px; height:64px; border-radius:14px; background:color-mix(in srgb, currentColor 12%, transparent);
+          flex:none; display:grid; place-items:center; overflow:hidden; }
+.r-logo img { max-width:100%; max-height:100%; display:block; }
+.r-name { font-family:var(--r-serif); font-size:23px; font-weight:600; letter-spacing:-.01em; line-height:1.15; }
+.r-tag { font-size:13px; opacity:.85; margin-top:2px; }
+.r-cta { margin-left:auto; flex:none; }
+.r-sub { display:inline-flex; align-items:center; gap:6px; font-size:13.5px; font-weight:600; color:inherit;
+         text-decoration:none; border:1px solid color-mix(in srgb, currentColor 45%, transparent);
+         padding:8px 14px; border-radius:999px; white-space:nowrap; }
+.r-sub:hover { background:color-mix(in srgb, currentColor 14%, transparent); }
+
+.r-body { max-width:var(--r-measure); margin:0 auto; padding:32px 24px 56px; }
+.r-ey { font-size:11px; letter-spacing:.1em; text-transform:uppercase; color:var(--brand-ink);
+        font-weight:700; margin:0 0 12px; }
+.r-feat { border:1px solid var(--r-line); background:var(--r-card); border-radius:12px; padding:22px 24px; margin:0 0 1.5rem; }
+.r-feat .r-k { font-size:12.5px; color:var(--r-mut); margin:0 0 8px; }
+.r-feat h2 { font-family:var(--r-serif); font-size:26px; line-height:1.15; font-weight:600; margin:0 0 12px; }
+.r-feat h2 a { text-decoration:none; }
+.r-feat h2 a:hover { text-decoration:underline; }
+.r-link { font-size:14px; font-weight:600; color:var(--brand-ink); text-decoration:none; }
+.r-link:hover { text-decoration:underline; }
+ul.r-list { list-style:none; margin:0; padding:0; }
+li.r-item { display:flex; gap:18px; align-items:baseline; padding:16px 0; border-top:1px solid var(--r-line); }
+/* Fixed date column so the titles line up. Sized to hold the widest en-US long date
+   ("September 30, 2026" \u2248 122px) \u2014 a narrower column lets a long month overflow its
+   box (flex:none + nowrap don't clip) and butt against the title. */
+li.r-item .r-d { font-size:12.5px; color:var(--r-mut); width:128px; flex:none; white-space:nowrap; }
+a.r-t { font-family:var(--r-serif); font-size:18px; font-weight:600; text-decoration:none; }
+a.r-t:hover { text-decoration:underline; }
+.r-empty { color:var(--r-mut); padding:20px 0; }
+.r-arch { display:inline-block; margin-top:24px; font-size:14px; font-weight:600; color:var(--brand-ink); text-decoration:none; }
+.r-arch:hover { text-decoration:underline; }
+/* A lede already ends in its own margin, so a link straight beneath it sits closer. */
+.r-lead + .r-arch { margin-top:0; }
+
+/* Subscribe / message pages: a headline, lede, and a branded form. */
+.r-h1 { font-family:var(--r-serif); font-size:30px; line-height:1.12; font-weight:600; letter-spacing:-.01em; margin:0 0 12px; }
+.r-lead { font-size:16px; color:var(--r-mut); margin:0 0 22px; max-width:54ch; }
+.r-lead strong { color:var(--r-ink); font-weight:600; }
+.r-form { display:flex; gap:10px; flex-wrap:wrap; max-width:460px; }
+.r-form input { flex:1 1 220px; font:inherit; font-size:16px; padding:11px 13px; border:1px solid var(--r-line);
+                border-radius:9px; background:var(--r-card); color:var(--r-ink); }
+.r-form input:focus-visible { outline:2px solid var(--brand-ink); outline-offset:1px; border-color:var(--brand-ink); }
+.r-btn { font:inherit; font-size:15px; font-weight:600; padding:11px 20px; border-radius:9px; border:1px solid var(--r-ink);
+         background:var(--r-ink); color:var(--r-bg); cursor:pointer; white-space:nowrap; }
+.r-btn:hover { filter:brightness(1.06); }
+.r-fine { font-size:12.5px; color:var(--r-mut); margin:16px 0 0; }
+
+.r-foot { border-top:1px solid var(--r-line); }
+.r-foot-in { max-width:var(--r-measure); margin:0 auto; padding:22px 24px 40px; font-size:12.5px; color:var(--r-mut); }
+
+a:focus-visible, .r-sub:focus-visible, .r-btn:focus-visible { outline:2px solid #2563eb; outline-offset:2px; }
+@media (prefers-color-scheme: dark) {
+  a:focus-visible, .r-sub:focus-visible, .r-btn:focus-visible { outline-color:#60a5fa; }
 }
-async function getSettingsForDisplay(db) {
-  try {
-    return await getSettings(db);
-  } catch (err) {
-    if (err instanceof HttpError && err.code === "settings_corrupt") {
-      return structuredClone(DEFAULT_SETTINGS);
-    }
-    throw err;
-  }
+@media (max-width:560px) {
+  .r-mast-in { flex-wrap:wrap; gap:12px; }
+  .r-cta { margin-left:0; }
+  li.r-item { flex-wrap:wrap; gap:6px 18px; }
+  li.r-item .r-d { width:100%; }
 }
-async function ensureSettingsRow(db) {
-  await db.prepare("INSERT OR IGNORE INTO settings (id, data, updated_at) VALUES (1, '{}', 0)").run();
+`;
+var FRAUNCES_FONT_LINKS = `<link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Fraunces:ital,opsz,wght@0,9..144,400..600;1,9..144,400..600&display=swap">`;
+var ARCHIVE_POST_HEAD = FRAUNCES_FONT_LINKS + `<style>body.k-bg,body .k-bg,body .k-card{background:${READER_BG_LIGHT}!important}.k-mast{color:#52525b;border-bottom:1px solid #e4e4e7}.k-mast a{color:#18181b}@media(prefers-color-scheme:dark){body.k-bg,body .k-bg,body .k-card{background:${READER_BG_DARK}!important}.k-mast{color:#a1a1aa;border-bottom-color:#2e2e33}.k-mast a{color:#ededed}}</style>`;
+function devDashboardStyle(url) {
+  return url ? `<style>${DEV_BADGE_STYLE}</style>` : "";
 }
-function persistSettingsStmt(db, next, expected, guard2) {
-  const extra = guard2 ? ` AND ${guard2.sql}` : "";
-  return db.prepare(
-    `UPDATE settings SET data = ?, updated_at = MAX(?, updated_at + 1)
-        WHERE id = 1 AND updated_at = ?${extra}`
-  ).bind(JSON.stringify(next), Date.now(), expected, ...guard2?.binds ?? []);
-}
-var WRITE_RETRIES = 5;
-var SettingsContention = class extends HttpError {
-  constructor() {
-    super(409, "conflict", "settings changed concurrently; try again");
-  }
-};
-async function updateSettingsWith(db, derive) {
-  await ensureSettingsRow(db);
-  for (let attempt = 0; attempt < WRITE_RETRIES; attempt++) {
-    const { settings, version } = await readSettings(db);
-    const next = derive(settings);
-    const res = await persistSettingsStmt(db, next, version ?? 0).run();
-    if ((res.meta.changes ?? 0) > 0) {
-      return next;
-    }
-  }
-  throw new SettingsContention();
-}
-async function updateSettings(db, patch) {
-  return updateSettingsWith(db, (current) => applyPatch(current, patch));
-}
-function applyPatch(current, patch) {
-  const next = {
-    ...current,
-    publication: { ...current.publication },
-    confirmationEmail: { ...current.confirmationEmail },
-    notifications: { ...current.notifications }
-  };
-  if (patch.testRecipients !== void 0) {
-    next.testRecipients = normalizeRecipients(patch.testRecipients);
-  }
-  if (patch.publication !== void 0) {
-    const p = patch.publication;
-    if (p.name !== void 0) {
-      next.publication.name = normalizeText(p.name, "name", MAX_NAME);
-    }
-    if (p.tagline !== void 0) {
-      next.publication.tagline = normalizeText(p.tagline, "tagline", MAX_TAGLINE);
-    }
-    if (p.address !== void 0) {
-      next.publication.address = normalizeText(p.address, "address", MAX_ADDRESS);
-    }
-  }
-  if (patch.emailTemplate !== void 0) {
-    if (typeof patch.emailTemplate !== "string") {
-      throw new Error("emailTemplate must be a string");
-    }
-    if (patch.emailTemplate.length > MAX_TEMPLATE) {
-      throw new Error(`emailTemplate must be ${MAX_TEMPLATE} characters or fewer`);
-    }
-    next.emailTemplate = patch.emailTemplate;
-  }
-  if (patch.confirmationEmail !== void 0) {
-    const c = patch.confirmationEmail;
-    if (c.subject !== void 0) {
-      next.confirmationEmail.subject = normalizeText(c.subject, "subject", MAX_CE_SUBJECT);
-    }
-    if (c.body !== void 0) {
-      next.confirmationEmail.body = normalizeText(c.body, "message", MAX_CE_BODY);
-    }
-    if (c.buttonLabel !== void 0) {
-      next.confirmationEmail.buttonLabel = normalizeText(
-        c.buttonLabel,
-        "button label",
-        MAX_CE_BUTTON
-      );
-    }
-    if (c.reassurance !== void 0) {
-      next.confirmationEmail.reassurance = normalizeText(
-        c.reassurance,
-        "reassurance line",
-        MAX_CE_REASSURANCE
-      );
-    }
-  }
-  if (patch.notifications?.to !== void 0) {
-    next.notifications.to = normalizeNotifyTo(patch.notifications.to);
-  }
-  return next;
-}
-function normalizeNotifyTo(raw) {
-  if (typeof raw !== "string") {
-    throw new Error("notifications address must be a string");
-  }
-  const email2 = normalizeEmail(raw);
-  if (email2 && !isValidEmail(email2)) {
-    throw new Error(`not a valid email address: ${raw}`);
-  }
-  return email2;
-}
-function withPublicationLogo(current, logo) {
-  return { ...current, publication: { ...current.publication, logo } };
-}
-async function setPublicationLogo(db, logo) {
-  return updateSettingsWith(db, (current) => withPublicationLogo(current, logo));
-}
-function normalizeText(v, what, max) {
-  if (typeof v !== "string") {
-    throw new Error(`${what} must be a string`);
-  }
-  return v.trim().slice(0, max);
-}
-function normalizeRecipients(input) {
-  if (!Array.isArray(input)) {
-    throw new Error("testRecipients must be a list of email addresses");
-  }
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const raw of input) {
-    if (typeof raw !== "string") {
-      throw new Error("each test recipient must be a string");
-    }
-    const email2 = normalizeEmail(raw);
-    if (!email2) {
-      continue;
-    }
-    if (!isValidEmail(email2)) {
-      throw new Error(`not a valid email address: ${raw}`);
-    }
-    if (seen.has(email2)) {
-      continue;
-    }
-    seen.add(email2);
-    out.push(email2);
-  }
-  if (out.length > MAX_TEST_RECIPIENTS) {
-    throw new Error(`at most ${MAX_TEST_RECIPIENTS} test recipients`);
-  }
-  return out;
-}
-
-// src/lib/html.ts
-function escapeHtml(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-function escapeHtmlAttr(s) {
-  return escapeHtml(s).replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-
-// src/lib/page_headers.ts
-function csp(formAction) {
-  return [
-    "default-src 'none'",
-    "script-src 'none'",
-    "object-src 'none'",
-    "frame-src 'none'",
-    "base-uri 'none'",
-    `form-action ${formAction}`,
-    "frame-ancestors 'none'",
-    "img-src * data:",
-    "style-src 'unsafe-inline' https://fonts.googleapis.com",
-    "font-src https://fonts.gstatic.com"
-  ].join("; ");
-}
-function headers(formAction) {
-  return {
-    "content-security-policy": csp(formAction),
-    "x-frame-options": "DENY",
-    "x-content-type-options": "nosniff"
-  };
+function devDashboardBadge(url) {
+  return url ? `<a class="r-dev" href="${escapeHtmlAttr(url)}" title="Shown only on your local dev server"><span class="r-dev-tag">Dev</span>Open dashboard &rarr;</a>` : "";
 }
-var PAGE_SECURITY_HEADERS = headers("'self'");
-var POST_PAGE_SECURITY_HEADERS = headers("'none'");
-
-// src/lib/page.ts
-var TOKENS = `
-:root {
-  color-scheme: light dark;
-  --fg:#18181b; --muted:#71717a; --line:#e4e4e7; --bg:#f4f4f5; --card:#fff;
-  --accent:#18181b; --accent-fg:#fff; --danger:#b91c1c; --danger-fg:#fff;
-  --font:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;
+function archiveDevDashboardChrome(url) {
+  return { head: devDashboardStyle(url), masthead: devDashboardBadge(url) };
 }
-@media (prefers-color-scheme: dark) {
-  :root { --fg:#ededed; --muted:#a1a1aa; --line:#2e2e33; --bg:#18181b; --card:#232327;
-          --accent:#e5e7eb; --accent-fg:#18181b; --danger:#f87171; --danger-fg:#18181b; }
+function readerBannerStyle(banner) {
+  return banner ? `<style>${READER_BANNER_STYLE}</style>` : "";
 }
-* { box-sizing: border-box; }
-body { margin:0; font-family:var(--font); background:var(--bg); color:var(--fg); }
-a { color: inherit; }
-.muted { color: var(--muted); }
-`;
-var CARD_STYLE = `${TOKENS}
-.wrap { max-width:480px; margin:64px auto; padding:32px; background:var(--card);
-        border:1px solid var(--line); border-radius:10px; line-height:1.6; }
-h1 { margin-top:0; }
-input { font:inherit; font-size:16px; padding:10px; width:100%; border:1px solid var(--line);
-        border-radius:6px; background:var(--card); color:var(--fg); }
-.btn { font:inherit; font-size:16px; margin-top:12px; padding:10px 18px; border-radius:6px;
-       border:1px solid var(--accent); background:var(--accent); color:var(--accent-fg); cursor:pointer; }
-.btn:hover { filter: brightness(1.08); }
-.btn:active { transform: translateY(1px); }
-.btn-danger { border-color:var(--danger); background:var(--danger); color:var(--danger-fg); }
-.btn:focus-visible, input:focus-visible, a:focus-visible { outline:2px solid #2563eb; outline-offset:2px; }
-.wrap p a { text-decoration: underline; }
-@media (prefers-color-scheme: dark) { .btn:focus-visible, input:focus-visible, a:focus-visible { outline-color:#60a5fa; } }
+function readerPage(opts) {
+  const { name, tagline, logoUrl } = opts.identity;
+  const logo = logoUrl ? `<span class="r-logo"><img src="${escapeHtmlAttr(logoUrl)}" alt=""></span>` : "";
+  const nameHtml = name ? `<span class="r-name">${escapeHtml(name)}</span>` : "";
+  const tag = tagline ? `<div class="r-tag">${escapeHtml(tagline)}</div>` : "";
+  const text = nameHtml || tag ? `<span>${nameHtml}${tag}</span>` : "";
+  const label = text ? "" : logo ? ' aria-label="Home"' : "";
+  const brand = `<a class="r-brand" href="${escapeHtmlAttr(opts.homeUrl)}"${label}>${logo || text ? `${logo}${text}` : "Archive"}</a>`;
+  const cta = opts.subscribeUrl ? `<span class="r-cta"><a class="r-sub" href="${escapeHtmlAttr(opts.subscribeUrl)}">Subscribe here &rarr;</a></span>` : "";
+  const masthead2 = `<header class="r-mast"><div class="r-mast-in">
+${brand}
+${cta}
+</div></header>
 `;
-function htmlPage(title, bodyHtml, status = 200, devDashboardUrl2) {
+  const banner = opts.banner ? `<div class="r-banner" role="note"><div class="r-banner-in"><span class="r-banner-tag">${escapeHtml(opts.banner.tag)}</span><span class="r-banner-text">${escapeHtml(opts.banner.text)}</span></div></div>` : "";
   const doc = `<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${escapeHtml(title)}</title>
-<style>${CARD_STYLE}</style>${devDashboardStyle(devDashboardUrl2)}
+<title>${escapeHtml(opts.title)}</title>
+${FRAUNCES_FONT_LINKS}
+<style>${READER_STYLE}</style>${readerBannerStyle(opts.banner)}${devDashboardStyle(opts.devDashboardUrl)}
 </head>
-<body><div class="wrap">${bodyHtml}</div>${devDashboardBadge(devDashboardUrl2)}</body>
+<body>
+${banner}${masthead2}<main class="r-body">${opts.mainHtml}</main>
+<footer class="r-foot"><div class="r-foot-in">Powered by Kestrel</div></footer>
+${devDashboardBadge(opts.devDashboardUrl)}
+</body>
 </html>`;
   return new Response(doc, {
-    status,
+    status: opts.status ?? 200,
     headers: {
       ...PAGE_SECURITY_HEADERS,
       "content-type": "text/html; charset=utf-8",
-      "x-robots-tag": "noindex"
+      ...opts.private ? { "cache-control": "no-store", "x-robots-tag": "noindex" } : { "cache-control": "public, max-age=300" }
     }
   });
 }
-var READER_BG_LIGHT = "#fbfbfa";
-var READER_BG_DARK = "#12110f";
-var DEV_BADGE_STYLE = `
-/* The app's brand accent (DESIGN.md \xA73), mirrored here for the ONE dev-only element
-   the reader surface carries. That badge is app chrome, not the publication's
-   identity, so it wears the app's action color, matching a Primary action, rather
-   than the reader ink; keep these values in sync with styles.css. This is the
-   single, deliberate exception to "the reader surface is not styled from the admin
-   tokens" (DESIGN.md, reader-surface note). */
-:root { --k-accent:#3355cc; --k-accent-contrast:#ffffff; }
-@media (prefers-color-scheme: dark) { :root { --k-accent:#7d9bff; --k-accent-contrast:#10131f; } }
-.r-dev { position:fixed; right:18px; bottom:18px; z-index:50; display:inline-flex; align-items:center; gap:8px;
-         font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif; line-height:1.6;
-         font-size:13px; font-weight:600; text-decoration:none; padding:9px 15px 9px 10px; border-radius:999px;
-         background:var(--k-accent); color:var(--k-accent-contrast); border:1px solid var(--k-accent);
-         box-shadow:0 6px 20px rgba(0,0,0,.22); }
-.r-dev:hover { filter:brightness(1.08); }
-/* Inverted badge \u2014 solid contrast fill, accent-colored text \u2014 so the tiny "DEV"
-   label clears WCAG AA on the accent pill in both themes (a translucent tint left
-   it ~3.6:1). */
-.r-dev .r-dev-tag { font-size:9.5px; letter-spacing:.09em; text-transform:uppercase; font-weight:700;
-                    padding:2px 7px; border-radius:999px;
-                    background:var(--k-accent-contrast); color:var(--k-accent); }
-.r-dev:focus-visible { outline:2px solid #2563eb; outline-offset:2px; }
-@media (prefers-color-scheme: dark) { .r-dev:focus-visible { outline-color:#60a5fa; } }
-`;
-var READER_STYLE = `
-:root {
-  color-scheme: light dark;
-  --r-bg:${READER_BG_LIGHT}; --r-ink:#1b1a17; --r-card:#ffffff; --r-line:#e7e5df; --r-mut:#6b6a63;
-  --r-serif:Fraunces,Georgia,'Iowan Old Style','Times New Roman',serif;
-  --r-sans:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;
-  --r-measure:820px; /* one reading width shared by the masthead, body, and footer so their edges line up */
-  /* The masthead sits on the card surface with a hairline rule (the footer's top
-     rule, mirrored); the eyebrow/link accent inherits the ink color. */
-  --brand-ink:currentColor;
+function pageTitle(page, name) {
+  return name ? `${page} \xB7 ${name}` : page;
 }
-@media (prefers-color-scheme: dark) {
-  :root { --r-bg:${READER_BG_DARK}; --r-ink:#ece9e3; --r-card:#1b1a17; --r-line:#2c2a25; --r-mut:#a5a199; }
+function messagePage(opts) {
+  return readerPage({
+    identity: opts.identity,
+    homeUrl: opts.homeUrl,
+    title: pageTitle(opts.title, opts.identity.name),
+    mainHtml: `<p class="r-ey">${escapeHtml(opts.eyebrow)}</p><h1 class="r-h1">${escapeHtml(opts.headline)}</h1><p class="r-lead">${opts.ledeHtml}</p>` + (opts.afterHtml ?? ""),
+    status: opts.status,
+    devDashboardUrl: opts.devDashboardUrl,
+    banner: opts.banner,
+    private: true
+  });
 }
-* { box-sizing:border-box; }
-body { margin:0; font-family:var(--r-sans); background:var(--r-bg); color:var(--r-ink); line-height:1.6; }
-a { color:inherit; }
-img { max-width:100%; }
-
-/* Masthead: identity + a subscribe call to action, on the card surface with a
-   hairline bottom rule \u2014 light with dark text in light mode, and it inverts with
-   the reader tokens in dark mode. */
-.r-mast { background:var(--r-card); color:var(--r-ink); border-bottom:1px solid var(--r-line); }
-.r-mast-in { max-width:var(--r-measure); margin:0 auto; padding:24px; display:flex; align-items:center; gap:16px; }
-.r-brand { display:flex; align-items:center; gap:14px; text-decoration:none; color:inherit; min-width:0; }
-.r-logo { width:64px; height:64px; border-radius:14px; background:color-mix(in srgb, currentColor 12%, transparent);
-          flex:none; display:grid; place-items:center; overflow:hidden; }
-.r-logo img { max-width:100%; max-height:100%; display:block; }
-.r-name { font-family:var(--r-serif); font-size:23px; font-weight:600; letter-spacing:-.01em; line-height:1.15; }
-.r-tag { font-size:13px; opacity:.85; margin-top:2px; }
-.r-cta { margin-left:auto; flex:none; }
-.r-sub { display:inline-flex; align-items:center; gap:6px; font-size:13.5px; font-weight:600; color:inherit;
-         text-decoration:none; border:1px solid color-mix(in srgb, currentColor 45%, transparent);
-         padding:8px 14px; border-radius:999px; white-space:nowrap; }
-.r-sub:hover { background:color-mix(in srgb, currentColor 14%, transparent); }
-
-.r-body { max-width:var(--r-measure); margin:0 auto; padding:32px 24px 56px; }
-.r-ey { font-size:11px; letter-spacing:.1em; text-transform:uppercase; color:var(--brand-ink);
-        font-weight:700; margin:0 0 12px; }
-.r-feat { border:1px solid var(--r-line); background:var(--r-card); border-radius:12px; padding:22px 24px; margin:0 0 1.5rem; }
-.r-feat .r-k { font-size:12.5px; color:var(--r-mut); margin:0 0 8px; }
-.r-feat h2 { font-family:var(--r-serif); font-size:26px; line-height:1.15; font-weight:600; margin:0 0 12px; }
-.r-feat h2 a { text-decoration:none; }
-.r-feat h2 a:hover { text-decoration:underline; }
-.r-link { font-size:14px; font-weight:600; color:var(--brand-ink); text-decoration:none; }
-.r-link:hover { text-decoration:underline; }
-ul.r-list { list-style:none; margin:0; padding:0; }
-li.r-item { display:flex; gap:18px; align-items:baseline; padding:16px 0; border-top:1px solid var(--r-line); }
-/* Fixed date column so the titles line up. Sized to hold the widest en-US long date
-   ("September 30, 2026" \u2248 122px) \u2014 a narrower column lets a long month overflow its
-   box (flex:none + nowrap don't clip) and butt against the title. */
-li.r-item .r-d { font-size:12.5px; color:var(--r-mut); width:128px; flex:none; white-space:nowrap; }
-a.r-t { font-family:var(--r-serif); font-size:18px; font-weight:600; text-decoration:none; }
-a.r-t:hover { text-decoration:underline; }
-.r-empty { color:var(--r-mut); padding:20px 0; }
-.r-arch { display:inline-block; margin-top:24px; font-size:14px; font-weight:600; color:var(--brand-ink); text-decoration:none; }
-.r-arch:hover { text-decoration:underline; }
-
-/* Subscribe / message pages: a headline, lede, and a branded form. */
-.r-h1 { font-family:var(--r-serif); font-size:30px; line-height:1.12; font-weight:600; letter-spacing:-.01em; margin:0 0 12px; }
-.r-lead { font-size:16px; color:var(--r-mut); margin:0 0 22px; max-width:54ch; }
-.r-form { display:flex; gap:10px; flex-wrap:wrap; max-width:460px; }
-.r-form input { flex:1 1 220px; font:inherit; font-size:16px; padding:11px 13px; border:1px solid var(--r-line);
-                border-radius:9px; background:var(--r-card); color:var(--r-ink); }
-.r-form input:focus-visible { outline:2px solid var(--brand-ink); outline-offset:1px; border-color:var(--brand-ink); }
-.r-btn { font:inherit; font-size:15px; font-weight:600; padding:11px 20px; border-radius:9px; border:1px solid var(--r-ink);
-         background:var(--r-ink); color:var(--r-bg); cursor:pointer; white-space:nowrap; }
-.r-btn:hover { filter:brightness(1.06); }
-.r-fine { font-size:12.5px; color:var(--r-mut); margin:16px 0 0; }
-
-.r-foot { border-top:1px solid var(--r-line); }
-.r-foot-in { max-width:var(--r-measure); margin:0 auto; padding:22px 24px 40px; font-size:12.5px; color:var(--r-mut); }
-
-a:focus-visible, .r-sub:focus-visible { outline:2px solid #2563eb; outline-offset:2px; }
-@media (prefers-color-scheme: dark) { a:focus-visible, .r-sub:focus-visible { outline-color:#60a5fa; } }
-@media (max-width:560px) {
-  .r-mast-in { flex-wrap:wrap; gap:12px; }
-  .r-cta { margin-left:0; }
-  li.r-item { flex-wrap:wrap; gap:6px 18px; }
-  li.r-item .r-d { width:100%; }
-}
-`;
-var FRAUNCES_FONT_LINKS = `<link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Fraunces:ital,opsz,wght@0,9..144,400..600;1,9..144,400..600&display=swap">`;
-var ARCHIVE_POST_HEAD = FRAUNCES_FONT_LINKS + `<style>body.k-bg,body .k-bg,body .k-card{background:${READER_BG_LIGHT}!important}.k-mast{color:#52525b;border-bottom:1px solid #e4e4e7}.k-mast a{color:#18181b}@media(prefers-color-scheme:dark){body.k-bg,body .k-bg,body .k-card{background:${READER_BG_DARK}!important}.k-mast{color:#a1a1aa;border-bottom-color:#2e2e33}.k-mast a{color:#ededed}}</style>`;
-function devDashboardStyle(url) {
-  return url ? `<style>${DEV_BADGE_STYLE}</style>` : "";
-}
-function devDashboardBadge(url) {
-  return url ? `<a class="r-dev" href="${escapeHtmlAttr(url)}" title="Shown only on your local dev server"><span class="r-dev-tag">Dev</span>Open dashboard &rarr;</a>` : "";
-}
-function archiveDevDashboardChrome(url) {
-  return { head: devDashboardStyle(url), masthead: devDashboardBadge(url) };
-}
-function readerPage(opts) {
-  const { name, tagline, logoUrl } = opts.identity;
-  const logo = logoUrl ? `<span class="r-logo"><img src="${escapeHtmlAttr(logoUrl)}" alt=""></span>` : "";
-  const tag = tagline ? `<div class="r-tag">${escapeHtml(tagline)}</div>` : "";
-  const cta = opts.subscribeUrl ? `<span class="r-cta"><a class="r-sub" href="${escapeHtmlAttr(opts.subscribeUrl)}">Subscribe here &rarr;</a></span>` : "";
-  const doc = `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${escapeHtml(opts.title)}</title>
-${FRAUNCES_FONT_LINKS}
-<style>${READER_STYLE}</style>${devDashboardStyle(opts.devDashboardUrl)}
-</head>
-<body>
-<header class="r-mast"><div class="r-mast-in">
-<a class="r-brand" href="${escapeHtmlAttr(opts.homeUrl)}">${logo}<span><span class="r-name">${escapeHtml(name)}</span>${tag}</span></a>
-${cta}
-</div></header>
-<main class="r-body">${opts.mainHtml}</main>
-<footer class="r-foot"><div class="r-foot-in">Powered by Kestrel</div></footer>
-${devDashboardBadge(opts.devDashboardUrl)}
-</body>
-</html>`;
-  return new Response(doc, {
-    status: opts.status ?? 200,
-    headers: {
-      ...PAGE_SECURITY_HEADERS,
-      "content-type": "text/html; charset=utf-8",
-      "cache-control": "public, max-age=300"
-    }
-  });
+function archiveLink(url, label) {
+  return `<a class="r-arch" href="${escapeHtmlAttr(url)}">${escapeHtml(label)} &rarr;</a>`;
 }
 function postRow(i) {
   return `<li class="r-item"><span class="r-d">${escapeHtml(i.dateLabel)}</span><a class="r-t" href="${escapeHtmlAttr(i.url)}">${escapeHtml(i.title)}</a></li>`;
@@ -2284,14 +2034,14 @@ function landingPage(opts) {
     const f = opts.featured;
     const feature = `<p class="r-ey">Latest post</p><article class="r-feat"><p class="r-k">${escapeHtml(f.dateLabel)}</p><h2><a href="${escapeHtmlAttr(f.url)}">${escapeHtml(f.title)}</a></h2><a class="r-link" href="${escapeHtmlAttr(f.url)}">Read here &rarr;</a></article>`;
     const list5 = opts.recent.length ? `<ul class="r-list">${opts.recent.map(postRow).join("")}</ul>` : "";
-    const archive = `<a class="r-arch" href="${escapeHtmlAttr(opts.archiveUrl)}">Browse the full archive &rarr;</a>`;
-    main = feature + list5 + archive;
+    main = feature + list5 + archiveLink(opts.archiveUrl, "Browse the full archive");
   }
   return readerPage({
     identity: opts.identity,
     subscribeUrl: opts.subscribeUrl,
     homeUrl: opts.homeUrl,
-    title: opts.identity.name,
+    // The front door is titled by the publication; with no name, by what it is.
+    title: opts.identity.name || "Home",
     mainHtml: main,
     devDashboardUrl: opts.devDashboardUrl
   });
@@ -2302,7 +2052,7 @@ function archiveIndexPage(opts) {
     identity: opts.identity,
     subscribeUrl: opts.subscribeUrl,
     homeUrl: opts.homeUrl,
-    title: `Archive \xB7 ${opts.identity.name}`,
+    title: pageTitle("Archive", opts.identity.name),
     mainHtml: `<p class="r-ey">Archive</p>${list5}`,
     devDashboardUrl: opts.devDashboardUrl
   });
@@ -2433,48 +2183,339 @@ function emailOnlyRegionsWhole(html) {
         open.push(name);
       }
     }
-    if (open.length > 0 || /[<>]/.test(span.replace(/<\/?[a-zA-Z][\w-]*\b[^<>]*>/g, ""))) {
-      return false;
+    if (open.length > 0 || /[<>]/.test(span.replace(/<\/?[a-zA-Z][\w-]*\b[^<>]*>/g, ""))) {
+      return false;
+    }
+  }
+  return true;
+}
+var HEADING_FONT = "Fraunces, Georgia, 'Times New Roman', serif";
+var FONT = "-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif";
+function emailLayout(i) {
+  const preheader = i.preheader ? `<span style="display:none!important;opacity:0;color:transparent;height:0;width:0;overflow:hidden;">${escapeHtml(
+    i.preheader
+  )}</span>` : "";
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="color-scheme" content="light dark"><meta name="supported-color-schemes" content="light dark">
+<title>${escapeHtml(i.subject)}</title>${ARCHIVE_HEAD_ANCHOR}
+<style>@media (prefers-color-scheme: dark) { .k-bg { background: #18181b !important; } }</style>
+</head>
+<body class="k-bg" style="margin:0;padding:0;background:#ffffff;">
+${preheader}
+<table role="presentation" width="100%" cellpadding="0" cellspacing="0" class="k-bg" style="background:#ffffff;"><tr><td align="center" style="padding:8px 12px 48px;">
+<table role="presentation" width="664" cellpadding="0" cellspacing="0" class="k-bg" style="max-width:664px;width:100%;background:#ffffff;">
+<tr><td style="padding:24px 32px 32px;font-family:${FONT};font-size:16px;line-height:1.6;color:#18181b;word-break:break-word;">
+${ARCHIVE_MASTHEAD_ANCHOR}${i.bodyHtml}
+</td></tr>
+</table>
+</td></tr></table>
+</body></html>`;
+}
+function archiveMasthead(opts) {
+  const name = escapeHtml(opts.name || "Archive");
+  const date = escapeHtml(opts.dateLabel);
+  const url = escapeHtmlAttr(opts.indexUrl);
+  return `<div class="k-mast" style="display:flex;justify-content:space-between;align-items:baseline;gap:16px;font-family:${FONT};font-size:13px;line-height:1.5;padding-bottom:14px;margin-bottom:28px;"><a href="${url}" style="text-decoration:none;font-weight:600;font-size:15px;font-family:${HEADING_FONT};"><span style="font-family:${FONT};font-weight:500;">&larr;</span>&nbsp;${name}</a><span style="white-space:nowrap;">${date}</span></div>`;
+}
+
+// src/render/template_engine.ts
+import { initWasm, inline } from "@css-inline/css-inline-wasm";
+import wasmModule from "@css-inline/css-inline-wasm/index_bg.wasm";
+
+// shared/publication.ts
+function fromDisplayName(fromAddress) {
+  const header = fromAddress.trim();
+  const lt = header.lastIndexOf("<");
+  if (lt < 0 || !header.endsWith(">")) {
+    return "";
+  }
+  const display = header.slice(0, lt).trim();
+  if (display.length >= 2 && display.startsWith('"') && display.endsWith('"')) {
+    return display.slice(1, -1).replace(/\\(.)/g, "$1").trim();
+  }
+  return display;
+}
+function publicationName(name, fromAddress) {
+  return name || fromDisplayName(fromAddress);
+}
+
+// src/db/settings.ts
+var BRANDING_LOGO_KEY = "branding/logo";
+function newLogoKey(version) {
+  return `${BRANDING_LOGO_KEY}/${version}-${crypto.randomUUID().slice(0, 8)}`;
+}
+var LOGO_KEY = /^branding\/logo\/\d+-[0-9a-f]{8}$/;
+function publicationLogoUrl(mediaBase, logo) {
+  if (!logo) {
+    return "";
+  }
+  return logo.key ? `${mediaBase}/${logo.key}` : `${mediaBase}/${BRANDING_LOGO_KEY}?v=${logo.version}`;
+}
+var DEFAULT_CONFIRMATION_EMAIL = {
+  subject: "Confirm your subscription",
+  body: "Thanks for subscribing. Please confirm your email address to start receiving the newsletter.",
+  buttonLabel: "Confirm subscription",
+  reassurance: "If you didn't request this, you can safely ignore this email."
+};
+var DEFAULT_SETTINGS = {
+  testRecipients: [],
+  publication: { name: "", tagline: "", address: "", logo: null },
+  emailTemplate: "",
+  confirmationEmail: DEFAULT_CONFIRMATION_EMAIL,
+  notifications: { to: "" }
+};
+var MAX_TEST_RECIPIENTS = 20;
+var MAX_NAME = 120;
+var MAX_TAGLINE = 200;
+var MAX_ADDRESS = 300;
+var MAX_TEMPLATE = 4e4;
+var MAX_CE_SUBJECT = 200;
+var MAX_CE_BODY = 1e3;
+var MAX_CE_BUTTON = 80;
+var MAX_CE_REASSURANCE = 400;
+function coercePublication(raw) {
+  const o = raw && typeof raw === "object" ? raw : {};
+  const str = (v) => typeof v === "string" ? v : "";
+  const lr = o.logo;
+  const key = lr && typeof lr.key === "string" && LOGO_KEY.test(lr.key);
+  const logo = lr && typeof lr === "object" && typeof lr.version === "number" ? {
+    version: lr.version,
+    contentType: str(lr.contentType) || "image/png",
+    ...key ? { key: lr.key } : {}
+  } : null;
+  return {
+    name: str(o.name).slice(0, MAX_NAME),
+    tagline: str(o.tagline).slice(0, MAX_TAGLINE),
+    address: str(o.address).slice(0, MAX_ADDRESS),
+    logo
+  };
+}
+function coerceConfirmation(raw) {
+  const o = raw && typeof raw === "object" ? raw : {};
+  const str = (v) => typeof v === "string" ? v : "";
+  return {
+    subject: str(o.subject).slice(0, MAX_CE_SUBJECT),
+    body: str(o.body).slice(0, MAX_CE_BODY),
+    buttonLabel: str(o.buttonLabel).slice(0, MAX_CE_BUTTON),
+    reassurance: str(o.reassurance).slice(0, MAX_CE_REASSURANCE)
+  };
+}
+function coerce(raw) {
+  const o = raw && typeof raw === "object" ? raw : {};
+  const list5 = Array.isArray(o.testRecipients) ? o.testRecipients : [];
+  return {
+    testRecipients: list5.filter((e) => typeof e === "string"),
+    publication: coercePublication(o.publication),
+    emailTemplate: typeof o.emailTemplate === "string" ? o.emailTemplate.slice(0, MAX_TEMPLATE) : "",
+    // A row that predates this feature has no `confirmationEmail` key at all — that's
+    // "never configured", so it gets the full built-in copy (reassurance included), NOT
+    // a blank-reassurance row. Only once the key exists (the operator saved copy) does a
+    // blank reassurance mean "deliberately omit the footer".
+    confirmationEmail: "confirmationEmail" in o ? coerceConfirmation(o.confirmationEmail) : { ...DEFAULT_CONFIRMATION_EMAIL },
+    notifications: coerceNotifications(o.notifications)
+  };
+}
+function coerceNotifications(raw) {
+  const o = raw && typeof raw === "object" ? raw : {};
+  return { to: typeof o.to === "string" ? o.to : "" };
+}
+function resolveConfirmationEmail(settings) {
+  const c = settings.confirmationEmail;
+  const d = DEFAULT_CONFIRMATION_EMAIL;
+  return {
+    subject: c.subject.trim() || d.subject,
+    body: c.body.trim() || d.body,
+    buttonLabel: c.buttonLabel.trim() || d.buttonLabel,
+    reassurance: c.reassurance
+  };
+}
+async function readSettings(db) {
+  const row = await db.prepare("SELECT data, updated_at FROM settings WHERE id = 1").first();
+  if (!row) {
+    return { settings: structuredClone(DEFAULT_SETTINGS), version: null };
+  }
+  return { settings: coerce(parseStored(row.data)), version: row.updated_at };
+}
+function parseStored(data) {
+  let parsed;
+  let problem = "is not a JSON object";
+  try {
+    parsed = JSON.parse(data);
+  } catch (err) {
+    problem = `is not valid JSON (${err instanceof Error ? err.message : String(err)})`;
+  }
+  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+    return parsed;
+  }
+  log.error("settings.corrupt", {
+    message: `the settings row (settings.id = 1) ${problem}; reads and writes of settings fail until it is repaired by hand`,
+    length: data.length
+  });
+  throw new HttpError(
+    500,
+    "settings_corrupt",
+    "The stored settings can't be read, so they are left as they are and nothing will save over them. The server log (settings.corrupt) says what's wrong."
+  );
+}
+async function getSettings(db) {
+  return (await readSettings(db)).settings;
+}
+async function getSettingsForDisplay(db) {
+  try {
+    return await getSettings(db);
+  } catch (err) {
+    if (err instanceof HttpError && err.code === "settings_corrupt") {
+      return structuredClone(DEFAULT_SETTINGS);
+    }
+    throw err;
+  }
+}
+async function ensureSettingsRow(db) {
+  await db.prepare("INSERT OR IGNORE INTO settings (id, data, updated_at) VALUES (1, '{}', 0)").run();
+}
+function persistSettingsStmt(db, next, expected, guard2) {
+  const extra = guard2 ? ` AND ${guard2.sql}` : "";
+  return db.prepare(
+    `UPDATE settings SET data = ?, updated_at = MAX(?, updated_at + 1)
+        WHERE id = 1 AND updated_at = ?${extra}`
+  ).bind(JSON.stringify(next), Date.now(), expected, ...guard2?.binds ?? []);
+}
+var WRITE_RETRIES = 5;
+var SettingsContention = class extends HttpError {
+  constructor() {
+    super(409, "conflict", "settings changed concurrently; try again");
+  }
+};
+async function updateSettingsWith(db, derive) {
+  await ensureSettingsRow(db);
+  for (let attempt = 0; attempt < WRITE_RETRIES; attempt++) {
+    const { settings, version } = await readSettings(db);
+    const next = derive(settings);
+    const res = await persistSettingsStmt(db, next, version ?? 0).run();
+    if ((res.meta.changes ?? 0) > 0) {
+      return next;
+    }
+  }
+  throw new SettingsContention();
+}
+async function updateSettings(db, patch) {
+  return updateSettingsWith(db, (current) => applyPatch(current, patch));
+}
+function applyPatch(current, patch) {
+  const next = {
+    ...current,
+    publication: { ...current.publication },
+    confirmationEmail: { ...current.confirmationEmail },
+    notifications: { ...current.notifications }
+  };
+  if (patch.testRecipients !== void 0) {
+    next.testRecipients = normalizeRecipients(patch.testRecipients);
+  }
+  if (patch.publication !== void 0) {
+    const p = patch.publication;
+    if (p.name !== void 0) {
+      next.publication.name = normalizeText(p.name, "name", MAX_NAME);
+    }
+    if (p.tagline !== void 0) {
+      next.publication.tagline = normalizeText(p.tagline, "tagline", MAX_TAGLINE);
+    }
+    if (p.address !== void 0) {
+      next.publication.address = normalizeText(p.address, "address", MAX_ADDRESS);
+    }
+  }
+  if (patch.emailTemplate !== void 0) {
+    if (typeof patch.emailTemplate !== "string") {
+      throw new Error("emailTemplate must be a string");
+    }
+    if (patch.emailTemplate.length > MAX_TEMPLATE) {
+      throw new Error(`emailTemplate must be ${MAX_TEMPLATE} characters or fewer`);
+    }
+    next.emailTemplate = patch.emailTemplate;
+  }
+  if (patch.confirmationEmail !== void 0) {
+    const c = patch.confirmationEmail;
+    if (c.subject !== void 0) {
+      next.confirmationEmail.subject = normalizeText(c.subject, "subject", MAX_CE_SUBJECT);
+    }
+    if (c.body !== void 0) {
+      next.confirmationEmail.body = normalizeText(c.body, "message", MAX_CE_BODY);
+    }
+    if (c.buttonLabel !== void 0) {
+      next.confirmationEmail.buttonLabel = normalizeText(
+        c.buttonLabel,
+        "button label",
+        MAX_CE_BUTTON
+      );
+    }
+    if (c.reassurance !== void 0) {
+      next.confirmationEmail.reassurance = normalizeText(
+        c.reassurance,
+        "reassurance line",
+        MAX_CE_REASSURANCE
+      );
+    }
+  }
+  if (patch.notifications?.to !== void 0) {
+    next.notifications.to = normalizeNotifyTo(patch.notifications.to);
+  }
+  return next;
+}
+function normalizeNotifyTo(raw) {
+  if (typeof raw !== "string") {
+    throw new Error("notifications address must be a string");
+  }
+  const email2 = normalizeEmail(raw);
+  if (email2 && !isValidEmail(email2)) {
+    throw new Error(`not a valid email address: ${raw}`);
+  }
+  return email2;
+}
+function withPublicationLogo(current, logo) {
+  return { ...current, publication: { ...current.publication, logo } };
+}
+async function setPublicationLogo(db, logo) {
+  return updateSettingsWith(db, (current) => withPublicationLogo(current, logo));
+}
+function normalizeText(v, what, max) {
+  if (typeof v !== "string") {
+    throw new Error(`${what} must be a string`);
+  }
+  return v.trim().slice(0, max);
+}
+function normalizeRecipients(input) {
+  if (!Array.isArray(input)) {
+    throw new Error("testRecipients must be a list of email addresses");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const raw of input) {
+    if (typeof raw !== "string") {
+      throw new Error("each test recipient must be a string");
+    }
+    const email2 = normalizeEmail(raw);
+    if (!email2) {
+      continue;
     }
+    if (!isValidEmail(email2)) {
+      throw new Error(`not a valid email address: ${raw}`);
+    }
+    if (seen.has(email2)) {
+      continue;
+    }
+    seen.add(email2);
+    out.push(email2);
   }
-  return true;
-}
-var HEADING_FONT = "Fraunces, Georgia, 'Times New Roman', serif";
-var FONT = "-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif";
-function emailLayout(i) {
-  const preheader = i.preheader ? `<span style="display:none!important;opacity:0;color:transparent;height:0;width:0;overflow:hidden;">${escapeHtml(
-    i.preheader
-  )}</span>` : "";
-  return `<!doctype html>
-<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<meta name="color-scheme" content="light dark"><meta name="supported-color-schemes" content="light dark">
-<title>${escapeHtml(i.subject)}</title>${ARCHIVE_HEAD_ANCHOR}
-<style>@media (prefers-color-scheme: dark) { .k-bg { background: #18181b !important; } }</style>
-</head>
-<body class="k-bg" style="margin:0;padding:0;background:#ffffff;">
-${preheader}
-<table role="presentation" width="100%" cellpadding="0" cellspacing="0" class="k-bg" style="background:#ffffff;"><tr><td align="center" style="padding:8px 12px 48px;">
-<table role="presentation" width="664" cellpadding="0" cellspacing="0" class="k-bg" style="max-width:664px;width:100%;background:#ffffff;">
-<tr><td style="padding:24px 32px 32px;font-family:${FONT};font-size:16px;line-height:1.6;color:#18181b;word-break:break-word;">
-${ARCHIVE_MASTHEAD_ANCHOR}${i.bodyHtml}
-</td></tr>
-</table>
-</td></tr></table>
-</body></html>`;
-}
-function archiveMasthead(opts) {
-  const name = escapeHtml(opts.name);
-  const date = escapeHtml(opts.dateLabel);
-  const url = escapeHtmlAttr(opts.indexUrl);
-  return `<div class="k-mast" style="display:flex;justify-content:space-between;align-items:baseline;gap:16px;font-family:${FONT};font-size:13px;line-height:1.5;padding-bottom:14px;margin-bottom:28px;"><a href="${url}" style="text-decoration:none;font-weight:600;font-size:15px;font-family:${HEADING_FONT};"><span style="font-family:${FONT};font-weight:500;">&larr;</span>&nbsp;${name}</a><span style="white-space:nowrap;">${date}</span></div>`;
+  if (out.length > MAX_TEST_RECIPIENTS) {
+    throw new Error(`at most ${MAX_TEST_RECIPIENTS} test recipients`);
+  }
+  return out;
 }
 
 // src/render/template_engine.ts
-import { initWasm, inline } from "@css-inline/css-inline-wasm";
-import wasmModule from "@css-inline/css-inline-wasm/index_bg.wasm";
 var UNSUB_SENTINEL = "%%UNSUBSCRIBE_URL%%";
 var SENTTO_SENTINEL = "%%SENT_TO%%";
-var TOKENS2 = {
+var TOKENS = {
   ".Post.Body": { phase: "render", escaping: "raw" },
   ".Post.Subject": { phase: "render", escaping: "attr" },
   ".Publication.Name": { phase: "render", escaping: "attr" },
@@ -2493,9 +2534,9 @@ var TOKENS2 = {
   ".Email.UnsubscribeURL": { phase: "delivery", escaping: "raw", sentinel: UNSUB_SENTINEL },
   ".Email.SentTo": { phase: "delivery", escaping: "attr", sentinel: SENTTO_SENTINEL }
 };
-var EMAIL_TEMPLATE_VARIABLES = Object.keys(TOKENS2);
+var EMAIL_TEMPLATE_VARIABLES = Object.keys(TOKENS);
 var KNOWN_VARS = new Set(EMAIL_TEMPLATE_VARIABLES);
-var DELIVERY_TOKENS = Object.entries(TOKENS2).flatMap(
+var DELIVERY_TOKENS = Object.entries(TOKENS).flatMap(
   ([key, spec]) => spec.phase === "delivery" ? [{ key, escaping: spec.escaping, sentinel: spec.sentinel }] : []
 );
 var TOKEN2 = /\{\{\s*([\w.]+)\s*\}\}/g;
@@ -2511,7 +2552,7 @@ function markEmailOnlyRegions(html) {
 }
 function fillEmailTemplate(html, ctx) {
   return markEmailOnlyRegions(html).replace(TOKEN2, (_m, key) => {
-    const spec = TOKENS2[key];
+    const spec = TOKENS[key];
     if (!spec) {
       return "";
     }
@@ -2648,22 +2689,20 @@ function onceUntilRejected(init) {
     return ready;
   };
 }
-var inlinerReady = onceUntilRejected(() => initWasm(wasmModule));
+var inlinerReady = onceUntilRejected(
+  () => initWasm({ module_or_path: wasmModule })
+);
 async function inlineEmailCss(html) {
   await inlinerReady();
   return inline(html, { keepAtRules: true });
 }
-function fromDisplayName(fromAddress) {
-  const m = /^\s*"?([^"<]*?)"?\s*<[^>]+>\s*$/.exec(fromAddress);
-  return m?.[1] ? m[1].trim() : "";
-}
 function resolveBranding(settings, config) {
   const p = settings.publication;
   return {
     template: settings.emailTemplate.trim() ? settings.emailTemplate : DEFAULT_EMAIL_TEMPLATE,
-    name: p.name || fromDisplayName(config.fromAddress),
+    name: publicationName(p.name, config.fromAddress),
     tagline: p.tagline,
-    logoUrl: p.logo ? `${config.mediaPublicBase}/${BRANDING_LOGO_KEY}?v=${p.logo.version}` : "",
+    logoUrl: publicationLogoUrl(config.mediaPublicBase, p.logo),
     address: p.address
   };
 }
@@ -2871,21 +2910,32 @@ function substituteRecipient(r, ctx) {
   };
 }
 
-// src/routes/archive.ts
-function fromDisplayName2(fromAddress) {
-  const lt = fromAddress.indexOf("<");
-  const display = (lt >= 0 ? fromAddress.slice(0, lt) : "").trim().replace(/^"|"$/g, "").trim();
-  return display || "Newsletter";
-}
+// src/routes/reader.ts
 async function readerIdentity(c, config) {
   const { publication: p } = await getSettingsForDisplay(c.env.DB);
   return {
-    name: p.name || fromDisplayName2(config.fromAddress),
+    name: publicationName(p.name, config.fromAddress),
     tagline: p.tagline,
-    logoUrl: p.logo ? `${config.mediaPublicBase}/${BRANDING_LOGO_KEY}?v=${p.logo.version}` : ""
+    logoUrl: publicationLogoUrl(config.mediaPublicBase, p.logo)
   };
 }
-function formatSentDate(ms) {
+function archiveHomeUrl(config) {
+  return `${config.archiveOrigin}${config.archiveBasePath}`;
+}
+function devDashboardUrl(config) {
+  return config.devMode ? `${config.appOrigin}/dashboard/` : void 0;
+}
+async function readerMessage(c, page, identity) {
+  return messagePage({
+    ...page,
+    identity: identity ?? await readerIdentity(c, c.config),
+    homeUrl: `${c.config.appOrigin}/`,
+    devDashboardUrl: devDashboardUrl(c.config)
+  });
+}
+
+// src/routes/archive.ts
+function formatPublishedDate(ms) {
   return new Date(ms).toLocaleDateString("en-US", {
     timeZone: "UTC",
     year: "numeric",
@@ -2893,12 +2943,6 @@ function formatSentDate(ms) {
     day: "numeric"
   });
 }
-function archiveHomeUrl(config) {
-  return `${config.archiveOrigin}${config.archiveBasePath}`;
-}
-function devDashboardUrl(config) {
-  return config.devMode ? `${config.appOrigin}/dashboard/` : void 0;
-}
 async function landing(c) {
   const [posts, identity] = await Promise.all([
     listPublishedPosts(c.env.DB, 6),
@@ -2907,7 +2951,7 @@ async function landing(c) {
   const mapped = posts.map((i) => ({
     title: i.subject,
     url: archiveUrl(c.config, i.slug),
-    dateLabel: formatSentDate(i.sent_at)
+    dateLabel: formatPublishedDate(i.published_at)
   }));
   const [featured, ...recent] = mapped;
   return landingPage({
@@ -2932,37 +2976,49 @@ async function archiveIndex(c) {
     posts: posts.map((i) => ({
       title: i.subject,
       url: archiveUrl(c.config, i.slug),
-      dateLabel: formatSentDate(i.sent_at)
+      dateLabel: formatPublishedDate(i.published_at)
     })),
     devDashboardUrl: devDashboardUrl(c.config)
   });
 }
-async function archivePage(c) {
-  const slug = param(c, "slug");
-  const post = await getBySlug(c.env.DB, slug);
-  const send = post ? await latestSentSendForPost(c.env.DB, post.id) : null;
-  if (!post || !send) {
-    return htmlPage(
-      "Not found",
-      `<h1 style="margin-top:0;">Not found</h1><p>This post isn't available.</p>`,
-      404,
-      devDashboardUrl(c.config)
-    );
-  }
-  const identity = await readerIdentity(c, c.config);
+function webVersion(html, opts) {
   const masthead2 = archiveMasthead({
-    name: identity.name,
-    dateLabel: formatSentDate(send.completed_at ?? send.fire_at),
+    name: opts.identity.name,
+    dateLabel: formatPublishedDate(opts.dateMs),
     // Back to the archive index the post belongs to, on the same (archive) origin —
     // so an apex-hosted post stays on the apex instead of jumping to the app subdomain.
-    indexUrl: archiveHomeUrl(c.config)
+    indexUrl: archiveHomeUrl(opts.config)
   });
-  const dev = archiveDevDashboardChrome(devDashboardUrl(c.config));
-  const html = fillDeliveryTokens(
-    omitEmailOnly(send.rendered_html),
-    { ".Email.UnsubscribeURL": `${c.config.appOrigin}/unsubscribe`, ".Email.SentTo": "" },
+  const dev = archiveDevDashboardChrome(opts.devDashboardUrl);
+  return fillDeliveryTokens(
+    omitEmailOnly(html),
+    { ".Email.UnsubscribeURL": `${opts.config.appOrigin}/unsubscribe`, ".Email.SentTo": "" },
     "html"
   ).split(ARCHIVE_MASTHEAD_ANCHOR).join(masthead2 + dev.masthead).split(ARCHIVE_HEAD_ANCHOR).join(ARCHIVE_POST_HEAD + dev.head);
+}
+function nothingHereYetPage(c) {
+  return readerMessage(c, {
+    title: "Nothing here yet",
+    eyebrow: "Archive",
+    headline: "Nothing here yet",
+    ledeHtml: "A post appears here as soon as it\u2019s sent.",
+    afterHtml: archiveLink(archiveHomeUrl(c.config), "Browse the archive"),
+    status: 404
+  });
+}
+async function archivePage(c) {
+  const slug = param(c, "slug");
+  const post = await getBySlug(c.env.DB, slug);
+  const send = post ? await publishedSendForPost(c.env.DB, post.id) : null;
+  if (!post || !send) {
+    return nothingHereYetPage(c);
+  }
+  const html = webVersion(send.rendered_html, {
+    config: c.config,
+    identity: await readerIdentity(c, c.config),
+    dateMs: send.started_at ?? send.fire_at,
+    devDashboardUrl: devDashboardUrl(c.config)
+  });
   return new Response(html, {
     headers: {
       ...POST_PAGE_SECURITY_HEADERS,
@@ -3029,10 +3085,11 @@ async function insertSuppressions(db, rows) {
 async function insertPost(db, post, revision) {
   await db.batch([
     db.prepare(
-      "INSERT INTO posts (id, slug, subject, status, current_revision, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)"
+      "INSERT INTO posts (id, slug, slug_auto, subject, status, current_revision, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)"
     ).bind(
       post.id,
       post.slug,
+      post.slug_auto ? 1 : 0,
       post.subject,
       post.status,
       post.current_revision,
@@ -3701,8 +3758,8 @@ function buildSendView(send, config, hasRetries, now) {
       deliveries: `/api/sends/${id}/deliveries`,
       deliveries_csv: `/api/sends/${id}/deliveries.csv`,
       post: `/api/posts/${send.post_id}`,
-      // The archive serves a post's page only once it is sent: before, the link would 404.
-      archive: send.status === "sent" && send.post_slug !== null ? archiveUrl(config, send.post_slug) : null
+      // The archive serves a post's page once its send starts: before, the link would 404.
+      archive: (send.status === "sending" || send.status === "sent") && send.post_slug !== null ? archiveUrl(config, send.post_slug) : null
     }
   };
 }
@@ -3812,19 +3869,11 @@ function isActiveSendConflict(err) {
   const message2 = err instanceof Error ? err.message : String(err);
   return /UNIQUE constraint failed:\s*sends\.post_id/i.test(message2);
 }
-async function readForAction(env, sendId, guard2) {
+async function readForAction(env, sendId) {
   const send = await getSend(env.DB, sendId);
   if (!send) {
     throw notFound("send");
   }
-  if (guard2.ifMatch !== void 0 && send.rev !== guard2.ifMatch) {
-    throw refusal(
-      412,
-      "precondition_failed",
-      `the send has changed since rev ${guard2.ifMatch} (it is at rev ${send.rev}); read it again and decide on what it is now`,
-      { send: await viewSend(env, send.id) }
-    );
-  }
   return send;
 }
 async function windowClosed(env, send, what) {
@@ -3833,8 +3882,8 @@ async function windowClosed(env, send, what) {
     send: await viewSend(env, send.id)
   });
 }
-async function reschedule(env, sendId, fireAt, minLeadMs, guard2 = {}) {
-  const send = await readForAction(env, sendId, guard2);
+async function reschedule(env, sendId, fireAt, minLeadMs) {
+  const send = await readForAction(env, sendId);
   const now = Date.now();
   if (send.status === "canceled") {
     throw refusal(409, "send_canceled", "send is canceled; schedule the post again instead", {
@@ -3848,9 +3897,9 @@ async function reschedule(env, sendId, fireAt, minLeadMs, guard2 = {}) {
     return { send, changed: false };
   }
   const target = acceptFireAt(fireAt, minLeadMs, { now });
-  const res = await rescheduleStmt(env.DB, sendId, target, now, guard2.ifMatch ?? null).run();
+  const res = await rescheduleStmt(env.DB, sendId, target, now).run();
   if ((res.meta.changes ?? 0) === 0) {
-    return reschedule(env, sendId, fireAt, minLeadMs, guard2);
+    return reschedule(env, sendId, fireAt, minLeadMs);
   }
   log.info("send.rescheduled", {
     sendId,
@@ -3860,8 +3909,8 @@ async function reschedule(env, sendId, fireAt, minLeadMs, guard2 = {}) {
   });
   return { send: unwrap(await getSend(env.DB, sendId), "send"), changed: true };
 }
-async function cancel(env, sendId, guard2 = {}) {
-  const send = await readForAction(env, sendId, guard2);
+async function cancel(env, sendId) {
+  const send = await readForAction(env, sendId);
   if (send.status === "canceled") {
     return { send, changed: false };
   }
@@ -3870,7 +3919,7 @@ async function cancel(env, sendId, guard2 = {}) {
     throw await windowClosed(env, send, "canceled");
   }
   const [res] = await env.DB.batch([
-    cancelStmt(env.DB, sendId, now, guard2.ifMatch ?? null),
+    cancelStmt(env.DB, sendId, now),
     setPostStatusStmt(
       env.DB,
       send.post_id,
@@ -3881,7 +3930,7 @@ async function cancel(env, sendId, guard2 = {}) {
     )
   ]);
   if ((res?.meta.changes ?? 0) === 0) {
-    return cancel(env, sendId, guard2);
+    return cancel(env, sendId);
   }
   log.info("send.canceled", { sendId, postId: send.post_id });
   return { send: unwrap(await getSend(env.DB, sendId), "send"), changed: true };
@@ -4510,6 +4559,8 @@ function renderInputFor(id, demoPost, at, markdown) {
   const post = {
     id,
     slug: demoPost.slug,
+    // A demo slug that is just its subject's reads as following it, as a new post's would.
+    slug_auto: demoPost.slug === slugify(demoPost.subject),
     subject: demoPost.subject,
     status: demoPost.status,
     current_revision: `${id}-rev`,
@@ -4548,10 +4599,11 @@ async function seedDatabase(env, config, imageFiles = [], logoFile, options) {
   });
   let logoWritten = false;
   if (logoFile) {
-    await env.MEDIA.put(BRANDING_LOGO_KEY, logoFile.bytes, {
+    const key = newLogoKey(now);
+    await env.MEDIA.put(key, logoFile.bytes, {
       httpMetadata: { contentType: logoFile.contentType }
     });
-    await setPublicationLogo(db, { version: now, contentType: logoFile.contentType });
+    await setPublicationLogo(db, { version: now, contentType: logoFile.contentType, key });
     logoWritten = true;
   }
   const size = options?.size;
@@ -4695,7 +4747,11 @@ async function token(c) {
   }
   const service = c.url.searchParams.get("kind") === "service";
   const jwt = await mintDevToken(c.config.devAuthSecret, service ? {} : { email: "dev@localhost" });
-  return json({ token: jwt, kind: service ? "service" : "human" });
+  return json({
+    token: jwt,
+    kind: service ? "service" : "human",
+    ...c.config.devRunId ? { runId: c.config.devRunId } : {}
+  });
 }
 async function seed(c) {
   requireDevMode(c);
@@ -4734,7 +4790,8 @@ async function reset(c) {
   requireDevMode(c);
   await resetAll(c.env.DB);
   try {
-    await c.env.MEDIA.delete(BRANDING_LOGO_KEY);
+    const { objects } = await c.env.MEDIA.list({ prefix: BRANDING_LOGO_KEY });
+    await c.env.MEDIA.delete(objects.map((o) => o.key));
   } catch {
   }
   return json({ reset: true, url: `${c.config.appOrigin}/dashboard/` });
@@ -4747,7 +4804,7 @@ import { Lexer } from "marked";
 var overview_default = "# Overview\n\nKestrel is a newsletter app you run yourself. You write a post in Markdown, preview it exactly as the email, and send it to a list you own. It runs on Cloudflare Workers, and an email provider delivers the mail.\n\nIn this guide, you deploy your own instance of Kestrel to your Cloudflare account and connect it to an email provider. You go from an empty repository to a newsletter that's ready for its first subscriber. Each step ends with a check, so you know it worked before you move on.\n\nYou run every step from your instance's repository, a small repository of your own. It holds your instance's configuration and names the release of Kestrel it runs, which installs from npm as `@kurtbruns/kestrel`. You return to it to deploy changes and upgrade to new releases. You don't need to run Kestrel on your computer to deploy it, but you can try it there first, with demo content.\n\n## Before you begin\n\nYou need:\n\n1. A [Cloudflare account](https://dash.cloudflare.com/sign-up), with your domain's DNS on Cloudflare. Your app's hostname and its login both live there.\n\n1. An account with an email provider: [Resend](https://resend.com/signup) or [Amazon SES](https://aws.amazon.com/ses/). These guides use Resend, the quicker to set up. Amazon SES costs less for a large list. It needs AWS to approve your account before it sends to subscribers, and Cloudflare's Workers Paid plan. To use SES, follow [Use Amazon SES instead of Resend](../guides/02-ses.md) in place of step 4.\n\n1. [Node.js](https://nodejs.org/) 22 or later, and [Git](https://git-scm.com/).\n\n1. A GitHub account, or another Git host, for your instance's repository.\n\n## Choose your hostnames\n\nKestrel uses two hostnames, because the app and the mail do different jobs:\n\n| Hostname | What it's for |\n| --- | --- |\n| `newsletter.example.com` | the editor, the API, and the public pages readers see |\n| `send.example.com` | the address your mail comes from, and its SPF, DKIM, and DMARC records |\n\nThese guides put the app on a subdomain, which leaves any website you already have on `example.com` untouched. If `example.com` has no website of its own, the app can live there instead. Use `example.com` wherever these guides say `newsletter.example.com`.\n\nIt's recommended to send from a subdomain rather than from `example.com` itself. Your apex domain carries the reputation of your regular email, and a newsletter shouldn't put that at risk. Avoid `mail.` as the sending name too, since mail servers read it as an inbound host. [Sending-domain DNS](../reference/02-sending-domain-dns.md#choose-your-sending-name) explains both.\n\nThroughout these guides, replace `example.com`, `newsletter.example.com`, and `send.example.com` with your own names. Replace any value written as `REPLACE_WITH_\u2026` too.\n\n## The steps\n\n1. **Overview**: what you need, and the hostnames you use.\n1. [Deploy the app](02-deploy.md): create your instance's repository, and put the app on your hostname.\n1. [Lock the dashboard with Access](03-access.md): add the login that keeps the editor and the API to you.\n1. [Connect Resend](04-resend.md): verify your sending domain, and connect Resend to the app.\n1. [Verify it works](05-verify.md): send real email to yourself, and test unsubscribing and bounces.\n1. [Go live](06-go-live.md): name your publication and share the subscribe link.\n\nFurther guides, like [connecting Claude](../guides/01-connect-claude.md) and [upgrading to a new release](../guides/07-upgrade.md), pick up from there.\n\nWhen you're ready, continue to [Deploy the app](02-deploy.md).\n";
 
 // docs/get-started/02-deploy.md
-var deploy_default = '# Deploy the app\n\nKestrel runs as one Cloudflare Worker, with a D1 database for posts and subscribers and an R2 bucket for images.\n\nIn this guide, you create your instance\'s repository, create the database and the bucket, and point Kestrel\'s production settings at them and at your hostname. Then you deploy, and check that the app answers on your hostname. You need what the [Overview](01-overview.md#before-you-begin) lists.\n\n## 1. Create your instance\'s repository\n\nYour instance\'s repository holds its configuration, its database migrations, and the release of Kestrel it runs. Kestrel itself installs from npm as `@kurtbruns/kestrel`, so the repository stays small, and an upgrade changes the version it names.\n\n1. On GitHub, [create a new repository](https://github.com/new) named `newsletter`. It can be private. Leave it empty, with no README, license, or `.gitignore`.\n\n1. Clone it, and write a new instance into it. Replace `YOUR_USERNAME` with your GitHub username:\n\n    ```bash\n    git clone https://github.com/YOUR_USERNAME/newsletter.git\n    cd newsletter\n    npx @kurtbruns/kestrel init\n    ```\n\n    This writes the instance\'s files: `wrangler.jsonc` for its settings, `package.json` with the release it runs, the release\'s database migrations, and a starting point for Claude Code in `.claude/`. The instance\'s `README.md` lists its commands.\n\n1. Install the release and its tools:\n\n    ```bash\n    npm install\n    ```\n\n1. Commit the new instance, and push it:\n\n    ```bash\n    git add -A\n    git commit -m "Start a Kestrel instance"\n    git push -u origin HEAD\n    ```\n\n1. **(Optional)** Try Kestrel on your computer before you deploy it. Local development sends email to a stand-in, so nothing reaches a real inbox:\n\n    ```bash\n    cp .dev.vars.example .dev.vars\n    npm run dev\n    ```\n\n    Open http://localhost:8787/dashboard/ to see the editor. To fill it with demo content, run `npm run seed` in a second terminal, and `npm run reset` to empty it again. Press <kbd>Ctrl</kbd>+<kbd>C</kbd> to stop the server.\n\n## 2. Sign in to Cloudflare\n\nEvery command from here on acts on your Cloudflare account through the Wrangler CLI.\n\n1. Sign in. A browser window opens for you to approve the login:\n\n    ```bash\n    npx wrangler login\n    ```\n\n1. Confirm which account you\'re signed in to:\n\n    ```bash\n    npx wrangler whoami\n    ```\n\n    It prints your email and the account name. If you belong to more than one account, make sure it\'s the one that holds your domain.\n\n## 3. Create the database and the image bucket\n\n1. Create the database:\n\n    ```bash\n    npx wrangler d1 create kestrel-production\n    ```\n\n    It prints the new database\'s settings, including a `database_id`. Copy the id for the next section. If Wrangler offers to add the database to your configuration for you, decline: you add it to the production settings yourself, below.\n\n1. Create the bucket for images:\n\n    ```bash\n    npx wrangler r2 bucket create kestrel-media-production\n    ```\n\n## 4. Configure production\n\n`wrangler.jsonc` holds two sets of settings. The top level is for local development, so leave it alone. The `production` block under `env` is yours to fill in.\n\n1. Open `wrangler.jsonc` and change the values marked here in the `production` block:\n\n    ```jsonc\n    "production": {\n      "routes": [{ "pattern": "newsletter.example.com", "custom_domain": true }], // \u2190 your app\'s hostname\n      "d1_databases": [\n        {\n          "binding": "DB",\n          "database_name": "kestrel-production",\n          "database_id": "REPLACE_WITH_PRODUCTION_D1_ID", // \u2190 the id from section 3\n          "migrations_dir": "migrations"\n        }\n      ],\n      "vars": {\n        "PROVIDER": "fake",                                        // \u2190 leave as is for now\n        "APP_ORIGIN": "https://newsletter.example.com",            // \u2190 your app\'s hostname\n        "ARCHIVE_BASE_PATH": "/archive",\n        "SENDING_DOMAIN": "send.example.com",                      // \u2190 your sending hostname\n        "FROM_ADDRESS": "Newsletter <newsletter@send.example.com>" // \u2190 who your mail is from\n      }\n    }\n    ```\n\n    What each one does:\n\n    - **`routes`** puts the app on your hostname when you deploy. Cloudflare creates the DNS record and the certificate. Your domain must be in the same Cloudflare account, and the hostname can\'t already have a CNAME record; delete one if it does. The block also turns off the `workers.dev` addresses, so the app answers only on your hostname.\n    - **`PROVIDER`** stays `fake` until you connect Resend in [step 4](04-resend.md). The `fake` transport delivers nothing, so don\'t schedule a post before then.\n    - **`ARCHIVE_BASE_PATH`** is permanent once you send. Every post you send carries its `/archive/\u2026` link, and changing the prefix later breaks the links you\'ve already mailed. Keep `/archive` unless you have a reason not to.\n    - **`FROM_ADDRESS`** is the address every email comes from. Keep it on your sending hostname, and set `SENDING_DOMAIN` to the part after the `@`.\n\n    Every other setting has a working default. [Configuration](../reference/01-configuration.md) lists them all, and what the app refuses.\n\n1. Check the file. This regenerates the binding types, and fails if the configuration doesn\'t parse:\n\n    ```bash\n    npm run typecheck\n    ```\n\n1. Commit your settings and push them to your repository. An upgrade changes only the release your instance runs, so your settings stay as they are:\n\n    ```bash\n    git commit -am "Configure production"\n    git push\n    ```\n\n## 5. Apply the schema\n\nCreate Kestrel\'s tables in the production database:\n\n```bash\nnpx wrangler d1 migrations apply DB --remote --env production\n```\n\nIt lists the migrations it\'s about to apply and asks you to confirm. It applies only the ones the database hasn\'t seen, so running it again is harmless.\n\n## 6. Deploy\n\n```bash\nnpx wrangler deploy --env production\n```\n\nThis deploys the release your instance runs, with your settings. The output ends with the hostname the app now answers on. Deploying also registers the once-a-minute schedule that sends posts, which you can see under the Worker\'s **Triggers** tab in the Cloudflare dashboard.\n\n## Check it\n\n1. The app answers on your hostname. A new hostname can take a few minutes to get its certificate.\n\n    ```bash\n    curl https://newsletter.example.com/health\n    ```\n\n    ```\n    {"status":"ok","service":"kestrel"}\n    ```\n\n1. The editor is locked. Until you set up Access in the next step, the app can\'t tell who is asking, so it lets no one in:\n\n    ```bash\n    curl -s -o /dev/null -w "%{http_code}\\n" https://newsletter.example.com/api/whoami\n    ```\n\n    ```\n    401\n    ```\n\n1. In a browser, `https://newsletter.example.com/` shows your newsletter\'s public landing page.\n\nIf every request instead answers `500` with a body like `{"error":"invalid_config","variable":"APP_ORIGIN",\u2026}`, the setting it names is missing or malformed. Fix it in `wrangler.jsonc`, commit, and deploy again.\n\nNext, [lock the dashboard with Access](03-access.md).\n';
+var deploy_default = '# Deploy the app\n\nKestrel runs as one Cloudflare Worker, with a D1 database for posts and subscribers and an R2 bucket for images.\n\nIn this guide, you create your instance\'s repository, create the database and the bucket, and point Kestrel\'s production settings at them and at your hostname. Then you deploy, and check that the app answers on your hostname. You need what the [Overview](01-overview.md#before-you-begin) lists.\n\n## 1. Create your instance\'s repository\n\nYour instance\'s repository holds its configuration, its database migrations, and the release of Kestrel it runs. Kestrel itself installs from npm as `@kurtbruns/kestrel`, so the repository stays small, and an upgrade changes the version it names.\n\n1. On GitHub, [create a new repository](https://github.com/new) named `newsletter`. It can be private. Leave it empty, with no README, license, or `.gitignore`.\n\n1. Clone it, and write a new instance into it. Replace `YOUR_USERNAME` with your GitHub username:\n\n    ```bash\n    git clone https://github.com/YOUR_USERNAME/newsletter.git\n    cd newsletter\n    npx @kurtbruns/kestrel init\n    ```\n\n    This writes the instance\'s files: `wrangler.jsonc` for its settings, `package.json` with the release it runs, the release\'s database migrations, and a starting point for Claude Code in `.claude/`. The instance\'s `README.md` lists its commands.\n\n1. Install the release and its tools:\n\n    ```bash\n    npm install\n    ```\n\n1. Commit the new instance, and push it:\n\n    ```bash\n    git add -A\n    git commit -m "Start a Kestrel instance"\n    git push -u origin HEAD\n    ```\n\n1. **(Optional)** Try Kestrel on your computer before you deploy it. Local development sends email to a stand-in, so nothing reaches a real inbox:\n\n    ```bash\n    cp .dev.vars.example .dev.vars\n    npm run dev\n    ```\n\n    Open http://localhost:8787/dashboard/ to see the editor. To fill it with demo content, run `npm run seed` in a second terminal in the same folder, and `npm run reset` to empty it again. Press <kbd>Ctrl</kbd>+<kbd>C</kbd> to stop the server.\n\n## 2. Sign in to Cloudflare\n\nEvery command from here on acts on your Cloudflare account through the Wrangler CLI.\n\n1. Sign in. A browser window opens for you to approve the login:\n\n    ```bash\n    npx wrangler login\n    ```\n\n1. Confirm which account you\'re signed in to:\n\n    ```bash\n    npx wrangler whoami\n    ```\n\n    It prints your email and the account name. If you belong to more than one account, make sure it\'s the one that holds your domain.\n\n## 3. Create the database and the image bucket\n\n1. Create the database:\n\n    ```bash\n    npx wrangler d1 create kestrel-production\n    ```\n\n    It prints the new database\'s settings, including a `database_id`. Copy the id for the next section. If Wrangler offers to add the database to your configuration for you, decline: you add it to the production settings yourself, below.\n\n1. Create the bucket for images:\n\n    ```bash\n    npx wrangler r2 bucket create kestrel-media-production\n    ```\n\n## 4. Configure production\n\n`wrangler.jsonc` holds two sets of settings. The top level is for local development, so leave it alone. The `production` block under `env` is yours to fill in.\n\n1. Open `wrangler.jsonc` and change the values marked here in the `production` block:\n\n    ```jsonc\n    "production": {\n      "routes": [{ "pattern": "newsletter.example.com", "custom_domain": true }], // \u2190 your app\'s hostname\n      "d1_databases": [\n        {\n          "binding": "DB",\n          "database_name": "kestrel-production",\n          "database_id": "REPLACE_WITH_PRODUCTION_D1_ID", // \u2190 the id from section 3\n          "migrations_dir": "migrations"\n        }\n      ],\n      "vars": {\n        "PROVIDER": "fake",                                        // \u2190 leave as is for now\n        "APP_ORIGIN": "https://newsletter.example.com",            // \u2190 your app\'s hostname\n        "ARCHIVE_BASE_PATH": "/archive",\n        "SENDING_DOMAIN": "send.example.com",                      // \u2190 your sending hostname\n        "FROM_ADDRESS": "Newsletter <newsletter@send.example.com>" // \u2190 who your mail is from\n      }\n    }\n    ```\n\n    What each one does:\n\n    - **`routes`** puts the app on your hostname when you deploy. Cloudflare creates the DNS record and the certificate. Your domain must be in the same Cloudflare account, and the hostname can\'t already have a CNAME record; delete one if it does. The block also turns off the `workers.dev` addresses, so the app answers only on your hostname.\n    - **`PROVIDER`** stays `fake` until you connect Resend in [step 4](04-resend.md). The `fake` transport delivers nothing, so don\'t schedule a post before then.\n    - **`ARCHIVE_BASE_PATH`** is permanent once you send. Every post you send carries its `/archive/\u2026` link, and changing the prefix later breaks the links you\'ve already mailed. Keep `/archive` unless you have a reason not to.\n    - **`FROM_ADDRESS`** is the address every email comes from. Keep it on your sending hostname, and set `SENDING_DOMAIN` to the part after the `@`.\n\n    Every other setting has a working default. [Configuration](../reference/01-configuration.md) lists them all, and what the app refuses.\n\n1. Check the file. This regenerates the binding types, and fails if the configuration doesn\'t parse:\n\n    ```bash\n    npm run typecheck\n    ```\n\n1. Commit your settings and push them to your repository. An upgrade changes only the release your instance runs, so your settings stay as they are:\n\n    ```bash\n    git commit -am "Configure production"\n    git push\n    ```\n\n## 5. Apply the schema\n\nCreate Kestrel\'s tables in the production database:\n\n```bash\nnpx wrangler d1 migrations apply DB --remote --env production\n```\n\nIt lists the migrations it\'s about to apply and asks you to confirm. It applies only the ones the database hasn\'t seen, so running it again is harmless.\n\n## 6. Deploy\n\n```bash\nnpx wrangler deploy --env production\n```\n\nThis deploys the release your instance runs, with your settings. The output ends with the hostname the app now answers on. Deploying also registers the once-a-minute schedule that sends posts, which you can see under the Worker\'s **Triggers** tab in the Cloudflare dashboard.\n\n## Check it\n\n1. The app answers on your hostname. A new hostname can take a few minutes to get its certificate.\n\n    ```bash\n    curl https://newsletter.example.com/health\n    ```\n\n    ```\n    {"status":"ok","service":"kestrel"}\n    ```\n\n1. The editor is locked. Until you set up Access in the next step, the app can\'t tell who is asking, so it lets no one in:\n\n    ```bash\n    curl -s -o /dev/null -w "%{http_code}\\n" https://newsletter.example.com/api/whoami\n    ```\n\n    ```\n    401\n    ```\n\n1. In a browser, `https://newsletter.example.com/` shows your newsletter\'s public landing page.\n\nIf every request instead answers `500` with a body like `{"error":"invalid_config","variable":"APP_ORIGIN",\u2026}`, the setting it names is missing or malformed. Fix it in `wrangler.jsonc`, commit, and deploy again.\n\nNext, [lock the dashboard with Access](03-access.md).\n';
 
 // docs/get-started/03-access.md
 var access_default = '# Lock the dashboard with Access\n\nCloudflare Access puts a login in front of the editor and the API. Kestrel checks every request against that login as well, so a path left out of Access stays locked. The public pages readers see stay public.\n\nIn this guide, you set up Cloudflare Zero Trust, create one Access application that covers the editor and the API, and allow yourself in. Then you give the app two values from that application, and check that the login works.\n\n## 1. Set up Zero Trust\n\nAccess is part of Cloudflare Zero Trust. Your account needs a Zero Trust organization before it can create an Access application. Skip this section if your account already has one.\n\n1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), select **Zero Trust**.\n\n1. Choose a team name. It becomes your team domain, `YOUR_TEAM.cloudflareaccess.com`, where your login page lives.\n\n1. Choose a plan. The Free plan covers a newsletter\'s editors. Cloudflare asks for payment details even on the Free plan, and doesn\'t charge them.\n\n## 2. Create the Access application\n\nThe editor lives under `/dashboard`, and the API under `/api`. One application covers both, so they share one login.\n\n1. In **Zero Trust**, go to **Access controls \u2192 Applications**, and select **Create new application**.\n\n1. Select **Self-hosted and private**.\n\n1. Select **Add public hostname**, and enter your app\'s hostname with the first path:\n\n    - **Subdomain:** `newsletter`\n    - **Domain:** `example.com`\n    - **Path:** `dashboard`\n\n1. Add a second public hostname with the same subdomain and domain, and the path `api`:\n\n    | Path | What it covers |\n    | --- | --- |\n    | `dashboard` | the editor |\n    | `api` | everything the editor and Claude read and change: posts, sends, subscribers, settings, and the in-app docs |\n\n    Each path covers everything under it. Leave every other path out. The landing page, the archive, subscribing, unsubscribing, images, and your email provider\'s webhooks must stay public.\n\n## 3. Allow yourself in\n\nEvery Access application denies everyone until a policy allows them.\n\n1. Under **Access policies**, create a new policy:\n\n    - **Policy name:** `Publishers`\n    - **Action:** Allow\n    - **Include:** the **Emails** selector, with your email address\n\n1. Keep the login method a new Zero Trust organization starts with: you sign in with your Cloudflare account. To sign in another way, such as a one-time code by email, add it under **Zero Trust \u2192 Integrations \u2192 Identity providers** first.\n\n1. Select **Create**.\n\n## 4. Give the app its two values\n\nThe app verifies each login against your team domain, and checks that it was issued for this application.\n\n1. Find your team domain under **Zero Trust \u2192 Settings**. It looks like `YOUR_TEAM.cloudflareaccess.com`.\n\n1. Find the application\'s audience tag. Under **Access controls \u2192 Applications**, select **Configure** on your application. On the **Additional settings** tab, copy the **Application Audience (AUD) Tag**.\n\n1. Store the team domain as a secret. The command prompts you for the value. Enter it without `https://`:\n\n    ```bash\n    npx wrangler secret put ACCESS_TEAM_DOMAIN --env production\n    ```\n\n1. Store the audience tag the same way:\n\n    ```bash\n    npx wrangler secret put ACCESS_AUD --env production\n    ```\n\n    A secret takes effect as soon as you store it, with no redeploy. The app needs both values. With either one missing, it can\'t verify any login, so it lets no one in.\n\n1. **(Optional, recommended)** Limit the editor to named people. The Access policy decides who can sign in. This list keeps that true if the policy is widened later, for another app or by mistake. Enter a comma-separated list of email addresses at the prompt:\n\n    ```bash\n    npx wrangler secret put ACCESS_ALLOWED_EMAILS --env production\n    ```\n\n    Without it, the app lets in anyone your Access policy allows.\n\n## Check it\n\n1. In a private browser window, open `https://newsletter.example.com/dashboard/`. Cloudflare asks you to sign in.\n\n1. Sign in. The editor loads, and its sidebar shows the email address you signed in with.\n\n1. In the same window, open `https://newsletter.example.com/api/whoami`. It shows you as a signed-in person, verified through Access:\n\n    ```\n    {"principal":{"kind":"human","email":"you@example.com"},"auth":{"mode":"access"}}\n    ```\n\n1. The public pages still need no login:\n\n    ```bash\n    curl https://newsletter.example.com/health\n    ```\n\n    ```\n    {"status":"ok","service":"kestrel"}\n    ```\n\nIf Cloudflare lets you in but the editor answers `401`, check the two secrets. One may be missing or mistyped, or `ACCESS_ALLOWED_EMAILS` may leave out your address.\n\nNext, [connect Resend](04-resend.md).\n';
@@ -4756,7 +4813,7 @@ var access_default = '# Lock the dashboard with Access\n\nCloudflare Access puts
 var resend_default = '# Connect Resend\n\nKestrel sends your posts through an email provider. The provider only delivers the mail: Kestrel keeps your list, each subscriber\'s consent, and the record of every send. These guides use Resend. To use Amazon SES instead, follow [Use Amazon SES instead of Resend](../guides/02-ses.md) in place of this page.\n\nIn this guide, you verify your sending hostname with Resend and add a DMARC record. Then you give the app an API key and a webhook for bounces and complaints, switch it to Resend, and deploy.\n\n## 1. Verify your sending hostname\n\nResend sends only from a domain whose DNS proves you own it. These records also let inboxes trust your mail.\n\n1. In Resend, go to [Domains](https://resend.com/domains), select **Add Domain**, and enter `send.example.com`.\n\n1. Select **Sign in to Cloudflare**, and allow Resend to edit your DNS. Resend adds its records to your zone for you.\n\n    To add them by hand instead, copy each record from Resend into your zone\'s DNS records in Cloudflare. Because your sending hostname is itself a subdomain, some names look doubled, such as `send.send`. That\'s expected.\n\n1. Leave receiving turned off. Kestrel doesn\'t receive mail.\n\n1. Wait until Resend shows the domain as **Verified**.\n\n## 2. Add a DMARC record\n\nDMARC tells inboxes what to do with mail that fails its checks, and sends you reports about it. Resend doesn\'t add this record, so you add it yourself. It starts in monitor mode, which reports without blocking anything.\n\n1. In the Cloudflare dashboard, open your domain\'s DNS records, and add a record:\n\n    - **Type:** `TXT`\n    - **Name:** `_dmarc.send`\n    - **Content:** `v=DMARC1; p=none; rua=mailto:dmarc@example.com`\n\n1. Replace `dmarc@example.com` with an address that receives mail. Reports arrive there as attachments.\n\n[Sending-domain DNS](../reference/02-sending-domain-dns.md#dmarc-publish-a-policy-and-collect-reports) explains each record, and when to tighten DMARC.\n\n## 3. Create an API key\n\nThe app sends through this key. A key that can only send, from only your sending hostname, limits the harm if it ever leaks.\n\n1. In Resend, go to [API Keys](https://resend.com/api-keys), and select **Create API Key**.\n\n1. Fill in the key:\n\n    - **Name:** `kestrel-production`\n    - **Permission:** Sending access\n    - **Domain:** `send.example.com`\n\n1. Copy the key. Resend shows it only once.\n\n1. Store it as a secret, and paste the key at the prompt:\n\n    ```bash\n    npx wrangler secret put RESEND_API_KEY --env production\n    ```\n\n## 4. Add the webhook\n\nThe webhook tells the app when an address bounces or complains, and the app stops mailing it. Without it, you keep mailing those addresses, and your mail starts landing in spam.\n\n1. In Resend, go to [Webhooks](https://resend.com/webhooks), and select **Add Webhook**.\n\n1. Enter the endpoint URL:\n\n    ```\n    https://newsletter.example.com/webhooks/resend\n    ```\n\n1. Select these three events, and create the webhook:\n\n    - `email.delivered`\n    - `email.bounced`\n    - `email.complained`\n\n1. On the webhook\'s page, copy its signing secret. It starts with `whsec_`.\n\n1. Store it as a secret. The app checks every event against it:\n\n    ```bash\n    npx wrangler secret put RESEND_WEBHOOK_SECRET --env production\n    ```\n\n## 5. Switch the provider and deploy\n\nStore both secrets before you switch. With `PROVIDER` set to `resend` and a secret missing, every request answers `500` and names the missing secret.\n\n1. In `wrangler.jsonc`, in the `production` block\'s `vars`, change `PROVIDER` from `fake` to `resend`:\n\n    ```jsonc\n    "PROVIDER": "resend",\n    ```\n\n1. Commit the change, and push it:\n\n    ```bash\n    git commit -am "Send through Resend"\n    git push\n    ```\n\n1. Deploy:\n\n    ```bash\n    npx wrangler deploy --env production\n    ```\n\n## Check it\n\n1. The app answers on your hostname:\n\n    ```bash\n    curl https://newsletter.example.com/health\n    ```\n\n    ```\n    {"status":"ok","service":"kestrel"}\n    ```\n\n1. The webhook is public, and refuses a request without Resend\'s signature:\n\n    ```bash\n    curl -s -o /dev/null -w "%{http_code}\\n" -X POST https://newsletter.example.com/webhooks/resend\n    ```\n\n    ```\n    400\n    ```\n\n    Any other answer, such as a redirect to your Cloudflare login, means Access covers the webhook. Remove that path from your Access application.\n\n1. In the editor, **Settings \u2192 Email sender** shows Resend as the email provider, and your From address.\n\nThe test sends in the next step prove the rest.\n\nResend\'s free plan sends up to 100 emails a day and 3,000 a month, test emails included. A list of more than about a hundred subscribers needs a paid plan, listed on [Resend\'s pricing](https://resend.com/pricing) page. For a large list, [Amazon SES](../guides/02-ses.md) may cost less.\n\nNext, [verify it works](05-verify.md).\n';
 
 // docs/get-started/05-verify.md
-var verify_default = "# Verify it works\n\nSome things only show up with real email: whether inboxes trust your mail, how it looks in a real mail client, and whether bounces and unsubscribes come back to the app. Check them now, while your list is empty and every email goes only to you.\n\nIn this guide, you send yourself a test email and check that it passes authentication. Then you set up your notifications, send a real post to yourself as a subscriber, and unsubscribe. Finally, you check that bounces and complaints reach the app, and read the app's logs.\n\n## Before you begin\n\n- Two email addresses you own, such as a personal address and a work address. Some steps use both.\n- A Gmail address, or another mail client that shows a message's original source and an **Unsubscribe** button.\n\n## 1. Send yourself a test email\n\nA test email goes through the same code as a real send. If the test looks right, the real send looks the same.\n\n1. In the editor at `https://newsletter.example.com/dashboard/`, create a post with a subject, a short body, and an image.\n\n1. Select **Send test email**, enter your address, and send it.\n\n1. Open the email. It should arrive in your inbox, not in spam. The image loads, the links work, and the subject reads as you wrote it.\n\n## 2. Check that it passes authentication\n\nInboxes trust mail that passes DKIM and DMARC for the domain it's from. Passing both is the best single sign that your mail reaches the inbox.\n\n1. Open the test email's original source. In Gmail, open the message's menu and select **Show original**.\n\n1. Find the `Authentication-Results` header. It shows:\n\n    - `dkim=pass` for `send.example.com`\n    - `dmarc=pass` for `send.example.com`\n    - `spf=pass`, for a hostname under `send.example.com`\n\n    With Amazon SES and no custom MAIL FROM domain, SPF passes for `amazonses.com` instead. That's expected, and DMARC still passes.\n\nIf a check fails, compare your DNS records with the ones in [Connect Resend](04-resend.md#1-verify-your-sending-hostname). [Sending-domain DNS](../reference/02-sending-domain-dns.md#verify-alignment) explains each result.\n\n## 3. Set up your notifications\n\nKestrel emails you when a send finishes, and right away when one runs into a problem. Notifications go through your email provider. To send them through Cloudflare instead, see [Notifications through Cloudflare's email](../guides/03-notifications.md).\n\n1. In the editor, open **Settings \u2192 Notifications**.\n\n1. Enter your address, and select **Save**.\n\n1. Select **Send a test notification**. It arrives at that address.\n\n## 4. Send a real post to yourself\n\nThis is a real send, to a list of one. It proves the whole path: subscribing, confirming, scheduling, and sending.\n\n1. Open `https://newsletter.example.com/subscribe`, and subscribe with your second address.\n\n1. Open the confirmation email, follow its link, and select **Confirm**. In the editor, **Subscribers** shows the address as **Confirmed**.\n\n1. Open your post, select **Schedule**, and then **Send now**. Every send waits at least five minutes before it goes out, so you can cancel a mistake.\n\n1. Cancel the send, to see that canceling stops it. Then select **Send now** again, and let it go.\n\n1. When the send finishes, the post arrives at your second address. A notification arrives at your first, with the subject `Sent:` and the post's title.\n\n## 5. Unsubscribe\n\nEvery email carries an unsubscribe link, and a header that lets mail clients show their own **Unsubscribe** button. Both work in one step, with no login.\n\n1. Open the post from section 4 in your mail client. It shows an **Unsubscribe** button next to the sender.\n\n1. Select it. In the editor, **Subscribers** shows the address as **Unsubscribed**, and later sends leave it out.\n\n## 6. Check that bounces and complaints come back\n\nWhen an address bounces or marks your mail as spam, your provider tells the app through the webhook. The app then stops mailing that address. Your provider has test addresses that act out each case without reaching a real person.\n\n1. Open `https://newsletter.example.com/subscribe`, and subscribe each test address for your provider:\n\n    | Provider | Bounces | Marks as spam |\n    | --- | --- | --- |\n    | Resend | `bounced@resend.dev` | `complained@resend.dev` |\n    | Amazon SES | `bounce@simulator.amazonses.com` | `complaint@simulator.amazonses.com` |\n\n    Each one gets a confirmation email, which bounces or is marked as spam.\n\n1. In the editor, **Subscribers** lists both addresses as **Pending**, each with a **Suppressed** flag. The app never mails a suppressed address again.\n\nIf an address has no flag, the webhook isn't reaching the app. Check its URL and signing secret in [Connect Resend](04-resend.md#4-add-the-webhook).\n\n## 7. Read the logs\n\nThe app writes a log line for each thing it does, and Cloudflare keeps them for a few days. Nothing else tells you if the once-a-minute schedule that sends your posts stops, so it's worth knowing where to look.\n\n1. In the Cloudflare dashboard, go to **Workers & Pages**, select `kestrel-production`, and select **Observability**.\n\n1. Filter on `event` equal to `sweep.tick`. A line arrives every minute.\n\n1. Filter on `event` equal to `send.completed`. Your send from section 4 is there.\n\n1. Filter on `level` equal to `error`. A healthy instance shows nothing.\n\nWhen every section gives the result it describes, your instance is ready for subscribers.\n\nNext, [go live](06-go-live.md).\n";
+var verify_default = "# Verify it works\n\nSome things only show up with real email: whether inboxes trust your mail, how it looks in a real mail client, and whether bounces and unsubscribes come back to the app. Check them now, while your list is empty and every email goes only to you.\n\nIn this guide, you send yourself a test email and check that it passes authentication. Then you set up your notifications, send a real post to yourself as a subscriber, and unsubscribe. Finally, you check that bounces and complaints reach the app, and read the app's logs.\n\n## Before you begin\n\n- Two email addresses you own, such as a personal address and a work address. Some steps use both.\n- A Gmail address, or another mail client that shows a message's original source and an **Unsubscribe** button.\n\n## 1. Send yourself a test email\n\nA test email goes through the same code as a real send. If the test looks right, the real send looks the same.\n\n1. In the editor at `https://newsletter.example.com/dashboard/`, create a post with a subject, a short body, and an image.\n\n1. Select **Send test email**, enter your address, and send it.\n\n1. Open the email. It should arrive in your inbox, not in spam. The image loads and the subject reads as you wrote it. Its **View in browser** link opens \"Nothing here yet\" until the post goes out, and its unsubscribe link opens the page a subscriber sees, marked as a test and showing a sample address. Its button walks through to the confirmation, but a test email unsubscribes no one. Section 5 unsubscribes for real.\n\n## 2. Check that it passes authentication\n\nInboxes trust mail that passes DKIM and DMARC for the domain it's from. Passing both is the best single sign that your mail reaches the inbox.\n\n1. Open the test email's original source. In Gmail, open the message's menu and select **Show original**.\n\n1. Find the `Authentication-Results` header. It shows:\n\n    - `dkim=pass` for `send.example.com`\n    - `dmarc=pass` for `send.example.com`\n    - `spf=pass`, for a hostname under `send.example.com`\n\n    With Amazon SES and no custom MAIL FROM domain, SPF passes for `amazonses.com` instead. That's expected, and DMARC still passes.\n\nIf a check fails, compare your DNS records with the ones in [Connect Resend](04-resend.md#1-verify-your-sending-hostname). [Sending-domain DNS](../reference/02-sending-domain-dns.md#verify-alignment) explains each result.\n\n## 3. Set up your notifications\n\nKestrel emails you when a send finishes, and right away when one runs into a problem. Notifications go through your email provider. To send them through Cloudflare instead, see [Notifications through Cloudflare's email](../guides/03-notifications.md).\n\n1. In the editor, open **Settings \u2192 Notifications**.\n\n1. Enter your address, and select **Save**.\n\n1. Select **Send a test notification**. It arrives at that address.\n\n## 4. Send a real post to yourself\n\nThis is a real send, to a list of one. It proves the whole path: subscribing, confirming, scheduling, and sending.\n\n1. Open `https://newsletter.example.com/subscribe`, and subscribe with your second address.\n\n1. Open the confirmation email, follow its link, and select **Confirm**. In the editor, **Subscribers** shows the address as **Confirmed**.\n\n1. Open your post, select **Schedule**, and then **Send now**. Every send waits at least five minutes before it goes out, so you can cancel a mistake.\n\n1. Cancel the send, to see that canceling stops it. Then select **Send now** again, and let it go.\n\n1. When the send finishes, the post arrives at your second address. A notification arrives at your first, with the subject `Sent:` and the post's title.\n\n## 5. Unsubscribe\n\nEvery email carries an unsubscribe link, and a header that lets mail clients show their own **Unsubscribe** button. Both work in one step, with no login.\n\n1. Open the post from section 4 in your mail client. It shows an **Unsubscribe** button next to the sender.\n\n1. Select it. In the editor, **Subscribers** shows the address as **Unsubscribed**, and later sends leave it out.\n\n## 6. Check that bounces and complaints come back\n\nWhen an address bounces or marks your mail as spam, your provider tells the app through the webhook. The app then stops mailing that address. Your provider has test addresses that act out each case without reaching a real person.\n\n1. Open `https://newsletter.example.com/subscribe`, and subscribe each test address for your provider:\n\n    | Provider | Bounces | Marks as spam |\n    | --- | --- | --- |\n    | Resend | `bounced@resend.dev` | `complained@resend.dev` |\n    | Amazon SES | `bounce@simulator.amazonses.com` | `complaint@simulator.amazonses.com` |\n\n    Each one gets a confirmation email, which bounces or is marked as spam.\n\n1. In the editor, **Subscribers** lists both addresses as **Pending**, each with a **Suppressed** flag. The app never mails a suppressed address again.\n\nIf an address has no flag, the webhook isn't reaching the app. Check its URL and signing secret in [Connect Resend](04-resend.md#4-add-the-webhook).\n\n## 7. Read the logs\n\nThe app writes a log line for each thing it does, and Cloudflare keeps them for a few days. Nothing else tells you if the once-a-minute schedule that sends your posts stops, so it's worth knowing where to look.\n\n1. In the Cloudflare dashboard, go to **Workers & Pages**, select `kestrel-production`, and select **Observability**.\n\n1. Filter on `event` equal to `sweep.tick`. A line arrives every minute.\n\n1. Filter on `event` equal to `send.completed`. Your send from section 4 is there.\n\n1. Filter on `level` equal to `error`. A healthy instance shows nothing.\n\nWhen every section gives the result it describes, your instance is ready for subscribers.\n\nNext, [go live](06-go-live.md).\n";
 
 // docs/get-started/06-go-live.md
 var go_live_default = "# Go live\n\nYour instance works. What's left is making it yours, and telling people where to subscribe.\n\nIn this guide, you name your publication and share your subscribe link. You also see what to change as your list grows.\n\n## 1. Name your publication\n\nYour publication's name, tagline, and logo appear on the public pages readers see, and in every email. Set them before anyone sees those pages. Until you do, the name in your From address stands in.\n\n1. In the editor, open **Settings \u2192 Publication identity**.\n\n1. Enter the name and tagline, and upload a logo.\n\n1. **(Optional)** Select **Add a mailing address**. US law asks for a postal address in promotional email, and a P.O. box works. The built-in email template prints it in every email's footer.\n\n## 2. Share your subscribe link\n\nReaders subscribe on a page the app hosts. Every signup confirms by email before it joins your list.\n\n1. In the editor, open **Settings \u2192 Ways to subscribe**.\n\n1. Copy your subscribe page's link, `https://newsletter.example.com/subscribe`, and share it.\n\n1. **(Optional)** To take signups on your own website, copy the embeddable subscribe form from the same page, and paste it into your site.\n\n1. **(Optional)** Cap how often one visitor can submit the form. The app already sends any one address at most one confirmation every 15 minutes. A Cloudflare rule can also limit each visitor, and the Free plan includes one. See [Rate-limit the subscribe form](../guides/05-rate-limit.md).\n\n## As your list grows\n\nA new instance runs on free plans. As your list grows, two limits come into play.\n\n- **Your email provider's limits.** Resend's free plan sends up to 100 emails a day. A send that hits the limit waits, and the app emails you. It resumes on its own once the limit lifts, or after you upgrade your Resend plan, and mails no one twice. For a large list, [Amazon SES](../guides/02-ses.md) may cost less.\n- **How fast a send goes out.** On Cloudflare's free Workers plan, Resend sends about 400 recipients a minute. On the $5 Workers Paid plan, set [`SUBREQUEST_BUDGET`](../reference/01-configuration.md#subrequest_budget) to send far more each minute.\n\n## Check it\n\n1. `https://newsletter.example.com/subscribe` shows your publication's name and logo.\n\n1. `https://newsletter.example.com/` shows your publication's name, and the post you sent yourself in [Verify it works](05-verify.md#4-send-a-real-post-to-yourself).\n\n## What's next\n\nEach of these guides stands on its own. Pick the ones you want.\n\n- [Connect Claude to the API](../guides/01-connect-claude.md), so Claude can draft, proofread, and schedule posts through the same API the editor uses.\n- [Notifications through Cloudflare's email](../guides/03-notifications.md), so you hear about problems even when your email provider has stopped sending.\n\nWhen a new release comes out, [Upgrade to a new release](../guides/07-upgrade.md) shows how to move to it.\n";
@@ -4780,7 +4837,7 @@ var upgrade_default = "# Upgrade to a new release\n\nA new release of Kestrel is
 var README_default = "# Set up and run Kestrel\n\nThese guides deploy and run your own instance of Kestrel, from an empty repository to a newsletter on your own Cloudflare account.\n\n## Get started\n\nFollow these steps, from an empty repository to a live newsletter.\n\n1. [Overview](get-started/01-overview.md)\n1. [Deploy the app](get-started/02-deploy.md)\n1. [Lock the dashboard with Access](get-started/03-access.md)\n1. [Connect Resend](get-started/04-resend.md)\n1. [Verify it works](get-started/05-verify.md)\n1. [Go live](get-started/06-go-live.md)\n\n## Guides\n\nEach one stands on its own. Pick the ones you need.\n\n- [Connect Claude to the API](guides/01-connect-claude.md)\n- [Use Amazon SES instead of Resend](guides/02-ses.md)\n- [Notifications through Cloudflare's email](guides/03-notifications.md)\n- [Rate-limit the subscribe form](guides/05-rate-limit.md)\n- [Upgrade to a new release](guides/07-upgrade.md)\n\n## Reference\n\nThe detail behind the steps, for when you need it.\n\n- [Configuration](reference/01-configuration.md)\n- [Sending-domain DNS](reference/02-sending-domain-dns.md)\n";
 
 // docs/reference/01-configuration.md
-var configuration_default = "# Configuration\n\nEvery deploy-time setting: what it does, its default, and what the app refuses. Each environment's settings live in its block under `env` in `wrangler.jsonc`, and its secrets in Cloudflare.\n\n- **Vars** are public values in the block's `vars`, safe to commit.\n- **Secrets** are stored with `npx wrangler secret put NAME --env production`, and never committed. A secret takes effect as soon as you store it, with no redeploy.\n- **Bindings and triggers** connect the Worker to its database, its image bucket, and its schedule.\n\nNone of these can be read or changed from inside the app, by the editor or by Claude. Settings in the editor shows the public ones, read-only.\n\n## Vars\n\n| Var | What it is | Default |\n| --- | --- | --- |\n| `PROVIDER` | the email provider: `fake`, `resend`, or `ses` | required |\n| `APP_ORIGIN` | the origin the app is served from: scheme and host, no path | required |\n| `ARCHIVE_BASE_PATH` | the path the archive lives under | `/archive` |\n| `FROM_ADDRESS` | the `From:` of every email | required with a real provider |\n| `SENDING_DOMAIN` | the sending domain, shown in Settings | none |\n| `AWS_REGION` | the SES region; Resend ignores it | `us-east-1` in the template, required with SES |\n| `SES_MAX_SEND_RATE` | your SES account's maximum send rate, in messages a second | `14` |\n| `SUBREQUEST_BUDGET` | how many subrequests one minute's send work may use | `50` |\n| `MIN_LEAD_SECONDS` | the least time every send stays cancelable before it goes out | `300` |\n| `ARCHIVE_ORIGIN` | the origin archive links use, to put the archive on your website | `APP_ORIGIN` |\n| `MEDIA_PUBLIC_BASE` | the base URL images are served from | `APP_ORIGIN` + `/media` |\n| `NOTIFY_FROM` | the sender of notifications through Cloudflare's email | `Kestrel <kestrel@` + the app's hostname + `>` |\n\n### `PROVIDER`\n\n`fake` delivers nothing. It records a send as if every recipient accepted it. Local development runs on it, and so does a new deployment until its provider is connected. Never schedule a real post on it.\n\n### `FROM_ADDRESS` and `SENDING_DOMAIN`\n\n`FROM_ADDRESS` is the only address mail is sent from, and the identity your provider authenticates. `SENDING_DOMAIN` is for display: Settings shows it beside the From address. The app never checks that the two match, so set `SENDING_DOMAIN` to the part of `FROM_ADDRESS` after the `@`.\n\nNeither one is your publication's name, tagline, or logo. You set those in the editor, under **Settings \u2192 Publication identity**. Until you do, the From address's display name stands in for the name.\n\n### `ARCHIVE_BASE_PATH`\n\nEvery post you send carries its archive link, `ARCHIVE_BASE_PATH` followed by the post's slug, and those links are permanent. Changing the prefix later breaks every link already mailed, so pick it before your first send. To keep links from an older install working, set it to the prefix they use, such as `/newsletter`.\n\nA missing leading slash is added, and a trailing slash is dropped.\n\n### `SES_MAX_SEND_RATE`\n\nThe app starts SES requests no faster than this rate. Set it to the maximum send rate on your SES **Account dashboard**. That's `1` in the sandbox, and whatever AWS grants after that. The default, 14, is a common starting rate, not your account's.\n\nA rate set too high only means SES throttles some requests. Those recipients wait for the next minute, and no one is mailed twice.\n\n### `SUBREQUEST_BUDGET`\n\nCloudflare caps how many subrequests one run of a Worker may make. Database queries and outbound requests both count. It also caps database queries alone: 50 a run on Workers Free, and 1,000 on Workers Paid. Each minute's send work is one run, so a large send goes out over several minutes, each stopping short of both caps.\n\nThis setting is the subrequest cap. The app keeps database queries under theirs on its own.\n\n- **The default, 50,** is the Workers Free limit, and safe on any plan. Through Resend, a minute sends about 400 recipients. Through SES, which takes one recipient a request, it sends about 18.\n- **On Workers Paid,** which allows 10,000, set `\"SUBREQUEST_BUDGET\": \"10000\"`. Resend then sends about 19,000 recipients a minute. SES sends as fast as your account's rate allows, up to about 1,900.\n- **If you raised the Worker's own limit** with `limits.subrequests`, you may set this to match.\n\nNever set it above your plan's limit. A minute that hits the cap is cut off mid-batch, and the send stalls until a later minute picks it up. A value below 30 is raised to 30, the least a minute needs to send anything and still send a notification.\n\n### `MIN_LEAD_SECONDS`\n\nEvery send stays visible and cancelable for at least this long before it goes out, whether it's scheduled, sent now, or moved. It's the window to catch a mistake, including one in a send Claude prepared.\n\nThe floor is 60, since sends go out from a once-a-minute schedule. The ceiling is 86400, one day. It's the least wait before every send, not a limit on how far ahead you can schedule. It lives in deploy config on purpose, so neither the editor nor Claude can shorten it.\n\n### `ARCHIVE_ORIGIN` and `MEDIA_PUBLIC_BASE`\n\nLeave them unset to keep everything on the app's own hostname.\n\n`ARCHIVE_ORIGIN` points archive links at another origin, such as your website, `https://example.com`. The app doesn't answer there on its own. A Worker route on that domain, such as `example.com/archive*` in the environment's `routes`, sends the archive path to the app. Links already mailed keep working, since the app still answers on its own hostname.\n\n`MEDIA_PUBLIC_BASE` serves images from another base URL, such as a custom domain on the image bucket. The app's own `/media` path sends `Content-Security-Policy: sandbox` and `X-Content-Type-Options: nosniff` with every file, so a file in the bucket never runs as a page. A bucket's custom domain sends neither, so add both with a Response Header Transform Rule on that hostname.\n\n### `NOTIFY_FROM`\n\nUsed only with the `NOTIFY` binding. It must be an address on a domain set up for Cloudflare's email. Without the binding, notifications come from `FROM_ADDRESS`, through your email provider.\n\n## Secrets\n\n| Secret | What it is | Needed for |\n| --- | --- | --- |\n| `ACCESS_TEAM_DOMAIN` | your Zero Trust team domain, such as `your-team.cloudflareaccess.com` | every deployment |\n| `ACCESS_AUD` | the Access application's audience tag | every deployment |\n| `ACCESS_ALLOWED_EMAILS` | a comma-separated list of the people allowed to sign in | optional |\n| `RESEND_API_KEY` | the Resend API key | Resend |\n| `RESEND_WEBHOOK_SECRET` | the Resend webhook's signing secret | Resend |\n| `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` | the IAM user's access key | SES |\n| `SNS_TOPIC_ARN` | the SNS topic the SES webhook accepts; it refuses every other topic | SES |\n| `SES_CONFIGURATION_SET` | the configuration set named on every email, so SES reports bounces and complaints | SES, recommended |\n\n`ACCESS_ALLOWED_EMAILS` applies to people only. A service token, such as the one Claude uses, carries no email, so the Access policy alone decides whether it gets in.\n\nNever set `DEV_AUTH_SECRET` on a deployed environment. It's local development's stand-in for Access, and a deployed instance ignores it anyway. The app honors it only when the environment looks like local development: `PROVIDER` is `fake`, Access isn't set up, and `APP_ORIGIN` is on `localhost` or `127.0.0.1`. A real provider, Access, or a real hostname each turns it off, and Access becomes the only way in.\n\n## Bindings and triggers\n\nWrangler doesn't carry bindings or vars over from the top level of `wrangler.jsonc` to an environment. Each environment's block declares its own.\n\n| Setting | What it is | Default |\n| --- | --- | --- |\n| `name` | the Worker's name, such as `kestrel-production` | required |\n| `routes` | the app's hostname, attached on deploy, and any route on your website | required |\n| `workers_dev`, `preview_urls` | the Worker's `workers.dev` and preview addresses | `false` in the template |\n| `triggers.crons` | the once-a-minute schedule, `* * * * *` | required |\n| `observability` | Workers Logs, where the app's log lines land | on |\n| `d1_databases`, binding `DB` | the database: posts, subscribers, sends, and settings | required |\n| `r2_buckets`, binding `MEDIA` | the bucket for images and your logo | required |\n| `send_email`, binding `NOTIFY` | Cloudflare's email, for notifications | none |\n\n### `routes`, `workers_dev`, and `preview_urls`\n\nThe template turns off the `workers.dev` addresses, so the app answers only on your hostname. That's where your Access application and any rate-limiting rule apply. Each deploy replaces the Worker's routes with the ones in the file, so add a route here, never in the dashboard.\n\n### `triggers.crons`\n\nThe schedule runs every minute. It sends whatever is due, and the notifications about it. Without it, nothing scheduled ever goes out.\n\n### `observability`\n\nEvery invocation is logged, with no sampling. Sampling could drop the one minute that reports a stuck or missed send.\n\n### `NOTIFY`\n\nWhen declared, notifications go through Cloudflare's email instead of your provider, so they still arrive when your provider refuses your account. Local development ignores it, and sends notifications to a stand-in that delivers nothing.\n\n## What the app refuses\n\nThe app checks its configuration on every request. It refuses to run on one that would do the wrong thing quietly:\n\n- `PROVIDER` must be exactly `fake`, `resend`, or `ses`. A misspelling, or `SES`, is refused, never taken for `fake`.\n- `APP_ORIGIN` must be a plain `http` or `https` origin, with no path. So must `ARCHIVE_ORIGIN`, when set. `MEDIA_PUBLIC_BASE`, when set, must be a plain `http` or `https` URL, and may have a path. A trailing slash is dropped from each.\n- A real provider needs `FROM_ADDRESS`, and every secret the table marks for it. SES also needs `AWS_REGION`.\n- With a real provider, none of `APP_ORIGIN`, `ARCHIVE_ORIGIN`, `MEDIA_PUBLIC_BASE`, `SENDING_DOMAIN`, or `FROM_ADDRESS` may still be on `example.com`, the template's placeholder.\n- `SUBREQUEST_BUDGET`, `MIN_LEAD_SECONDS`, and `SES_MAX_SEND_RATE` must be whole numbers above zero. `MIN_LEAD_SECONDS` must also be within its bounds. Any other value is refused, never adjusted. The one exception is a `SUBREQUEST_BUDGET` below 30, which is raised to 30.\n\nUntil it's fixed, every request answers `500` with a body naming the variable, such as `{\"error\":\"invalid_config\",\"variable\":\"APP_ORIGIN\",\u2026}`. The Worker's log records it, and no sends go out. The editor's page still loads, since it's a static file, but everything it asks the API for fails the same way.\n";
+var configuration_default = "# Configuration\n\nEvery deploy-time setting: what it does, its default, and what the app refuses. Each environment's settings live in its block under `env` in `wrangler.jsonc`, and its secrets in Cloudflare.\n\n- **Vars** are public values in the block's `vars`, safe to commit.\n- **Secrets** are stored with `npx wrangler secret put NAME --env production`, and never committed. A secret takes effect as soon as you store it, with no redeploy.\n- **Bindings and triggers** connect the Worker to its database, its image bucket, and its schedule.\n\nNone of these can be read or changed from inside the app, by the editor or by Claude. Settings in the editor shows the public ones, read-only.\n\n## Vars\n\n| Var | What it is | Default |\n| --- | --- | --- |\n| `PROVIDER` | the email provider: `fake`, `resend`, or `ses` | required |\n| `APP_ORIGIN` | the origin the app is served from: scheme and host, no path | required |\n| `ARCHIVE_BASE_PATH` | the path the archive lives under | `/archive` |\n| `FROM_ADDRESS` | the `From:` of every email | required with a real provider |\n| `SENDING_DOMAIN` | the sending domain, shown in Settings | none |\n| `AWS_REGION` | the SES region; Resend ignores it | `us-east-1` in the template, required with SES |\n| `SES_MAX_SEND_RATE` | your SES account's maximum send rate, in messages a second | `14` |\n| `SUBREQUEST_BUDGET` | how many subrequests one minute's send work may use | `50` |\n| `MIN_LEAD_SECONDS` | the least time every send stays cancelable before it goes out | `300` |\n| `ARCHIVE_ORIGIN` | the origin archive links use, to put the archive on your website | `APP_ORIGIN` |\n| `MEDIA_PUBLIC_BASE` | the base URL images are served from | `APP_ORIGIN` + `/media` |\n| `NOTIFY_FROM` | the sender of notifications through Cloudflare's email | `Kestrel <kestrel@` + the app's hostname + `>` |\n\n### `PROVIDER`\n\n`fake` delivers nothing. It records a send as if every recipient accepted it. Local development runs on it, and so does a new deployment until its provider is connected. Never schedule a real post on it.\n\n### `FROM_ADDRESS` and `SENDING_DOMAIN`\n\n`FROM_ADDRESS` is the only address mail is sent from, and the identity your provider authenticates. `SENDING_DOMAIN` is for display: Settings shows it beside the From address. The app never checks that the two match, so set `SENDING_DOMAIN` to the part of `FROM_ADDRESS` after the `@`.\n\nNeither one is your publication's name, tagline, or logo. You set those in the editor, under **Settings \u2192 Publication identity**. Until you do, the From address's display name stands in for the name, and with neither, your emails and reader pages show no name at all.\n\n### `ARCHIVE_BASE_PATH`\n\nEvery post you send carries its archive link, `ARCHIVE_BASE_PATH` followed by the post's slug, and those links are permanent. Changing the prefix later breaks every link already mailed, so pick it before your first send. To keep links from an older install working, set it to the prefix they use, such as `/newsletter`.\n\nA missing leading slash is added, and a trailing slash is dropped.\n\n### `SES_MAX_SEND_RATE`\n\nThe app starts SES requests no faster than this rate. Set it to the maximum send rate on your SES **Account dashboard**. That's `1` in the sandbox, and whatever AWS grants after that. The default, 14, is a common starting rate, not your account's.\n\nA rate set too high only means SES throttles some requests. Those recipients wait for the next minute, and no one is mailed twice.\n\n### `SUBREQUEST_BUDGET`\n\nCloudflare caps how many subrequests one run of a Worker may make. Database queries and outbound requests both count. It also caps database queries alone: 50 a run on Workers Free, and 1,000 on Workers Paid. Each minute's send work is one run, so a large send goes out over several minutes, each stopping short of both caps.\n\nThis setting is the subrequest cap. The app keeps database queries under theirs on its own.\n\n- **The default, 50,** is the Workers Free limit, and safe on any plan. Through Resend, a minute sends about 400 recipients. Through SES, which takes one recipient a request, it sends about 18.\n- **On Workers Paid,** which allows 10,000, set `\"SUBREQUEST_BUDGET\": \"10000\"`. Resend then sends about 19,000 recipients a minute. SES sends as fast as your account's rate allows, up to about 1,900.\n- **If you raised the Worker's own limit** with `limits.subrequests`, you may set this to match.\n\nNever set it above your plan's limit. A minute that hits the cap is cut off mid-batch, and the send stalls until a later minute picks it up. A value below 30 is raised to 30, the least a minute needs to send anything and still send a notification.\n\n### `MIN_LEAD_SECONDS`\n\nEvery send stays visible and cancelable for at least this long before it goes out, whether it's scheduled, sent now, or moved. It's the window to catch a mistake, including one in a send Claude prepared.\n\nThe floor is 60, since sends go out from a once-a-minute schedule. The ceiling is 86400, one day. It's the least wait before every send, not a limit on how far ahead you can schedule. It lives in deploy config on purpose, so neither the editor nor Claude can shorten it.\n\n### `ARCHIVE_ORIGIN` and `MEDIA_PUBLIC_BASE`\n\nLeave them unset to keep everything on the app's own hostname.\n\n`ARCHIVE_ORIGIN` points archive links at another origin, such as your website, `https://example.com`. The app doesn't answer there on its own. A Worker route on that domain, such as `example.com/archive*` in the environment's `routes`, sends the archive path to the app. Links already mailed keep working, since the app still answers on its own hostname.\n\n`MEDIA_PUBLIC_BASE` serves images from another base URL, such as a custom domain on the image bucket. The app's own `/media` path sends `Content-Security-Policy: sandbox` and `X-Content-Type-Options: nosniff` with every file, so a file in the bucket never runs as a page. A bucket's custom domain sends neither, so add both with a Response Header Transform Rule on that hostname.\n\n### `NOTIFY_FROM`\n\nUsed only with the `NOTIFY` binding. It must be an address on a domain set up for Cloudflare's email. Without the binding, notifications come from `FROM_ADDRESS`, through your email provider.\n\n## Secrets\n\n| Secret | What it is | Needed for |\n| --- | --- | --- |\n| `ACCESS_TEAM_DOMAIN` | your Zero Trust team domain, such as `your-team.cloudflareaccess.com` | every deployment |\n| `ACCESS_AUD` | the Access application's audience tag | every deployment |\n| `ACCESS_ALLOWED_EMAILS` | a comma-separated list of the people allowed to sign in | optional |\n| `RESEND_API_KEY` | the Resend API key | Resend |\n| `RESEND_WEBHOOK_SECRET` | the Resend webhook's signing secret | Resend |\n| `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` | the IAM user's access key | SES |\n| `SNS_TOPIC_ARN` | the SNS topic the SES webhook accepts; it refuses every other topic | SES |\n| `SES_CONFIGURATION_SET` | the configuration set named on every email, so SES reports bounces and complaints | SES, recommended |\n\n`ACCESS_ALLOWED_EMAILS` applies to people only. A service token, such as the one Claude uses, carries no email, so the Access policy alone decides whether it gets in.\n\nNever set `DEV_AUTH_SECRET` on a deployed environment. It's local development's stand-in for Access, and a deployed instance ignores it anyway. The app honors it only when the environment looks like local development: `PROVIDER` is `fake`, Access isn't set up, and `APP_ORIGIN` is on `localhost` or `127.0.0.1`. A real provider, Access, or a real hostname each turns it off, and Access becomes the only way in.\n\n## Bindings and triggers\n\nWrangler doesn't carry bindings or vars over from the top level of `wrangler.jsonc` to an environment. Each environment's block declares its own.\n\n| Setting | What it is | Default |\n| --- | --- | --- |\n| `name` | the Worker's name, such as `kestrel-production` | required |\n| `routes` | the app's hostname, attached on deploy, and any route on your website | required |\n| `workers_dev`, `preview_urls` | the Worker's `workers.dev` and preview addresses | `false` in the template |\n| `triggers.crons` | the once-a-minute schedule, `* * * * *` | required |\n| `observability` | Workers Logs, where the app's log lines land | on |\n| `d1_databases`, binding `DB` | the database: posts, subscribers, sends, and settings | required |\n| `r2_buckets`, binding `MEDIA` | the bucket for images and your logo | required |\n| `send_email`, binding `NOTIFY` | Cloudflare's email, for notifications | none |\n\n### `routes`, `workers_dev`, and `preview_urls`\n\nThe template turns off the `workers.dev` addresses, so the app answers only on your hostname. That's where your Access application and any rate-limiting rule apply. Each deploy replaces the Worker's routes with the ones in the file, so add a route here, never in the dashboard.\n\n### `triggers.crons`\n\nThe schedule runs every minute. It sends whatever is due, and the notifications about it. Without it, nothing scheduled ever goes out.\n\n### `observability`\n\nEvery invocation is logged, with no sampling. Sampling could drop the one minute that reports a stuck or missed send.\n\n### `NOTIFY`\n\nWhen declared, notifications go through Cloudflare's email instead of your provider, so they still arrive when your provider refuses your account. Local development ignores it, and sends notifications to a stand-in that delivers nothing.\n\n## What the app refuses\n\nThe app checks its configuration on every request. It refuses to run on one that would do the wrong thing quietly:\n\n- `PROVIDER` must be exactly `fake`, `resend`, or `ses`. A misspelling, or `SES`, is refused, never taken for `fake`.\n- `APP_ORIGIN` must be a plain `http` or `https` origin, with no path. So must `ARCHIVE_ORIGIN`, when set. `MEDIA_PUBLIC_BASE`, when set, must be a plain `http` or `https` URL, and may have a path. A trailing slash is dropped from each.\n- A real provider needs `FROM_ADDRESS`, and every secret the table marks for it. SES also needs `AWS_REGION`.\n- With a real provider, none of `APP_ORIGIN`, `ARCHIVE_ORIGIN`, `MEDIA_PUBLIC_BASE`, `SENDING_DOMAIN`, or `FROM_ADDRESS` may still be on `example.com`, the template's placeholder.\n- `SUBREQUEST_BUDGET`, `MIN_LEAD_SECONDS`, and `SES_MAX_SEND_RATE` must be whole numbers above zero. `MIN_LEAD_SECONDS` must also be within its bounds. Any other value is refused, never adjusted. The one exception is a `SUBREQUEST_BUDGET` below 30, which is raised to 30.\n\nUntil it's fixed, every request answers `500` with a body naming the variable, such as `{\"error\":\"invalid_config\",\"variable\":\"APP_ORIGIN\",\u2026}`. The Worker's log records it, and no sends go out. The editor's page still loads, since it's a static file, but everything it asks the API for fails the same way.\n";
 
 // docs/reference/02-sending-domain-dns.md
 var sending_domain_dns_default = "# Sending-domain DNS\n\nInboxes decide whether to trust your mail by checking records in the DNS of the domain it comes from. This page explains the records that [Connect Resend](../get-started/04-resend.md) and [Use Amazon SES instead of Resend](../guides/02-ses.md) have you add. It covers what each one proves, how to check them, and when to tighten DMARC.\n\n## Why all three\n\nGmail requires every sender to pass SPF or DKIM. A sender of more than 5,000 messages a day to Gmail must have all three:\n\n- SPF and DKIM, both passing.\n- A DMARC record, with a policy of at least `p=none`.\n- Alignment: the domain in the `From:` header matches the SPF domain or the DKIM domain.\n\nGmail also requires one-click unsubscribe for such senders. Kestrel adds the `List-Unsubscribe` and `List-Unsubscribe-Post` headers to every email, through either provider, so that part needs nothing from you. [Google's sender guidelines](https://support.google.com/a/answer/81126) list the rest.\n\nA small list may never reach 5,000 a day, but the same records decide whether mail lands in the inbox. Set up all three from the start.\n\n## Choose your sending name\n\n- **Send from a subdomain.** It's recommended to send from a subdomain such as `send.example.com`, rather than from `example.com` itself. Your apex domain carries the reputation of your regular email, and a newsletter shouldn't put that at risk.\n- **Keep the app's name and the mail's name distinct.** The app and its public pages live at `newsletter.example.com`, and mail comes from `send.example.com`. Avoid `mail.` as the sending name, since mail servers read `mail.example.com` as a host that receives mail.\n\n## The three records\n\nEvery record lives in your domain's DNS, `example.com`, under the sending name. In Cloudflare, a record's name leaves off your domain, so `_dmarc.send.example.com` is entered as `_dmarc.send`.\n\nYour provider generates the SPF and DKIM values. Copy them exactly as its dashboard lists them, since the values differ by account and region. You write the DMARC record yourself.\n\n### SPF: authorize the return path\n\nSPF checks the message's return path, the address bounces go back to, not its `From:` header. DMARC passes when SPF or DKIM passes and aligns with the `From:` domain. DKIM aligns with either provider, so an aligned SPF is a second check in your favor, not a requirement.\n\n- **Resend** uses a return path on a subdomain of your sending name, `send.send.example.com` by default. Its dashboard lists an MX record and an SPF `TXT` record for it. In Cloudflare, both are named `send.send`. That name looks doubled because your sending name is itself `send`.\n- **SES** uses its own domain, `amazonses.com`, as the return path by default. SPF then passes for `amazonses.com` but doesn't align, and DMARC passes through DKIM alone. A custom MAIL FROM domain, such as `bounce.send.example.com`, aligns SPF too. [Use Amazon SES instead of Resend](../guides/02-ses.md#3-optional-set-a-custom-mail-from-domain) sets one up, with an MX record that names your region and an SPF record:\n\n    ```\n    bounce.send.example.com.  MX   10 feedback-smtp.us-east-1.amazonses.com.\n    bounce.send.example.com.  TXT  \"v=spf1 include:amazonses.com ~all\"\n    ```\n\nA name holds one SPF record. If one already exists there, add the provider's `include:` to it rather than adding a second.\n\n### DKIM: let the provider sign\n\nDKIM signs each message with a key your DNS publishes. An inbox checks the signature to tell the message came from you, unchanged.\n\n- **Resend** lists one `TXT` record at `resend._domainkey.send.example.com`. A domain added to Resend after August 2026 may get `CNAME` records instead.\n- **SES** lists three `CNAME` records, each at `TOKEN._domainkey.send.example.com`. Their targets depend on your region and account, so copy them as SES lists them.\n\nIn Cloudflare, set every `CNAME` for DKIM to **DNS only**, not proxied. Your provider reports the domain as verified only once the records resolve.\n\n### DMARC: publish a policy and collect reports\n\nDMARC tells an inbox what to do with mail that fails both checks, and asks it to send you reports. It's a `TXT` record at `_dmarc.send.example.com`:\n\n```\n_dmarc.send.example.com.  TXT  \"v=DMARC1; p=none; rua=mailto:dmarc@example.com\"\n```\n\n- **`p=none`** is monitor mode. Inboxes report on failing mail, but deliver it as usual.\n- **`rua`** is where reports go. They arrive as attachments, usually one a day from each inbox provider.\n\nLeave alignment relaxed, the default, with no `aspf=s` or `adkim=s`. Your return path is a subdomain of your sending name, so strict SPF alignment would fail.\n\nOnce the reports show your sends passing and aligned, tighten the policy to `p=quarantine`, which sends failing mail to spam. Later, tighten it to `p=reject`, which refuses it.\n\n## Verify alignment\n\nA test email proves alignment better than any DNS lookup. Send yourself one, as in [Verify it works](../get-started/05-verify.md#2-check-that-it-passes-authentication), and read its `Authentication-Results` header. In Gmail, open the message's menu, and select **Show original**. Expect:\n\n- `dkim=pass` for `send.example.com`.\n- `dmarc=pass` for `send.example.com`.\n- `spf=pass`. With Resend, or SES with a custom MAIL FROM domain, its domain is under `send.example.com`. With SES and no custom MAIL FROM domain, it's `amazonses.com`. That's expected, and DMARC still passes.\n";
@@ -5019,10 +5076,16 @@ function author(c) {
 }
 async function readBody(c, opts = {}) {
   const raw = await readJsonObject(c, opts);
+  const slug = optString(raw, "slug");
+  const slugAuto = optBoolean(raw, "slug_auto");
+  if (slug !== void 0 && slugAuto === true) {
+    throw fieldError("slug", "slug cannot be set while slug_auto is true");
+  }
   return {
     input: {
       subject: optString(raw, "subject"),
-      slug: optString(raw, "slug"),
+      slug,
+      slug_auto: slugAuto,
       markdown: optString(raw, "markdown")
     },
     base_revision: optStringOrNull(raw, "base_revision") ?? null
@@ -6647,25 +6710,38 @@ async function readToken(c) {
   }
   return "";
 }
+function toPublication(action2, name) {
+  return name ? `${action2} to ${name}` : action2;
+}
 function subscribeFormHtml() {
-  return `<form class="r-form" method="post" action="/subscribe"><input type="email" name="email" required placeholder="you@example.com" aria-label="Your email address"><button class="r-btn" type="submit">Subscribe</button></form><p class="r-fine">Double opt-in \u2014 we\u2019ll email a confirmation link to finish. Unsubscribe anytime.</p>`;
+  return `<form class="r-form" method="post" action="/subscribe"><input type="email" name="email" required placeholder="you@example.com" aria-label="Your email address"><button class="r-btn" type="submit">Subscribe</button></form><p class="r-fine">We\u2019ll email you a link to confirm. Unsubscribe anytime.</p>`;
 }
 function subscribePage(c, identity, mainHtml, status = 200) {
   return readerPage({
     identity,
     homeUrl: `${c.config.appOrigin}/`,
-    title: `Subscribe \xB7 ${identity.name}`,
+    title: pageTitle("Subscribe", identity.name),
     mainHtml,
     devDashboardUrl: devDashboardUrl(c.config),
     status
   });
 }
-async function subscribeForm(c) {
-  const identity = await readerIdentity(c, c.config);
+function subscribeFormPage(c, identity) {
   const lede = identity.tagline ? escapeHtml(identity.tagline) : "Get the next post delivered to your inbox.";
-  const main = `<p class="r-ey">Newsletter</p><h1 class="r-h1">Subscribe to ${escapeHtml(identity.name)}</h1><p class="r-lead">${lede}</p>` + subscribeFormHtml();
+  const main = `<p class="r-ey">Newsletter</p><h1 class="r-h1">${escapeHtml(toPublication("Subscribe", identity.name))}</h1><p class="r-lead">${lede}</p>` + subscribeFormHtml();
+  return subscribePage(c, identity, main);
+}
+function subscribeNotAnEmailPage(c, identity) {
+  const main = `<p class="r-ey">Newsletter</p><h1 class="r-h1">That doesn\u2019t look like an email</h1><p class="r-lead">Please check the address and try again.</p>` + subscribeFormHtml();
+  return subscribePage(c, identity, main, 400);
+}
+function subscribeCheckInboxPage(c, identity) {
+  const main = `<p class="r-ey">Newsletter</p><h1 class="r-h1">Almost there</h1><p class="r-lead">If that address isn\u2019t subscribed yet, a confirmation link is on its way. Check your inbox to finish subscribing.</p>`;
   return subscribePage(c, identity, main);
 }
+async function subscribeForm(c) {
+  return subscribeFormPage(c, await readerIdentity(c, c.config));
+}
 async function subscribe(c) {
   const raw = await readEmail(c);
   const email2 = raw ? normalizeEmail(raw) : "";
@@ -6673,9 +6749,7 @@ async function subscribe(c) {
     if (!wantsHtml(c)) {
       return json({ error: "bad_request", message: "a valid email is required" }, 400);
     }
-    const identity2 = await readerIdentity(c, c.config);
-    const main2 = `<p class="r-ey">Newsletter</p><h1 class="r-h1">That doesn\u2019t look like an email</h1><p class="r-lead">Please check the address and try again.</p>` + subscribeFormHtml();
-    return subscribePage(c, identity2, main2, 400);
+    return subscribeNotAnEmailPage(c, await readerIdentity(c, c.config));
   }
   c.ctx.waitUntil(
     requestSubscription(c, email2).catch((err) => {
@@ -6686,9 +6760,7 @@ async function subscribe(c) {
     const body = { status: "check_inbox" };
     return json(body);
   }
-  const identity = await readerIdentity(c, c.config);
-  const main = `<p class="r-ey">Newsletter</p><h1 class="r-h1">Almost there</h1><p class="r-lead">If that address isn\u2019t subscribed yet, a confirmation link is on its way. Check your inbox to finish subscribing.</p>`;
-  return subscribePage(c, identity, main);
+  return subscribeCheckInboxPage(c, await readerIdentity(c, c.config));
 }
 async function confirmLanding(c) {
   const token2 = c.url.searchParams.get("token") ?? "";
@@ -6698,98 +6770,197 @@ async function confirm2(c) {
   const token2 = await readToken(c);
   return confirmStatePage(c, await confirmSubscription2(c.env.DB, token2), token2);
 }
-function confirmStatePage(c, state, token2) {
-  const dev = devDashboardUrl(c.config);
+async function confirmStatePage(c, state, token2) {
+  const eyebrow = "Newsletter";
   switch (state.kind) {
-    case "ready":
-      return htmlPage(
-        "Confirm your subscription",
-        `<h1 style="margin-top:0;">Confirm your subscription</h1><p>Start sending the newsletter to <strong>${escapeHtml(
-          state.subscriber.email
-        )}</strong>?</p>
-<form method="post" action="/confirm">
-<input type="hidden" name="token" value="${escapeHtmlAttr(token2)}">
-<button type="submit" class="btn">Confirm subscription</button>
-</form>`,
-        200,
-        dev
+    case "ready": {
+      const identity = await readerIdentity(c, c.config);
+      return readerMessage(
+        c,
+        {
+          title: "Confirm your subscription",
+          eyebrow,
+          headline: toPublication("Confirm your subscription", identity.name),
+          ledeHtml: `Start sending the newsletter to <strong>${escapeHtml(state.subscriber.email)}</strong>?`,
+          afterHtml: `<form class="r-form" method="post" action="/confirm"><input type="hidden" name="token" value="${escapeHtmlAttr(token2)}"><button class="r-btn" type="submit">Confirm subscription</button></form>`
+        },
+        identity
       );
+    }
     case "confirmed":
-      return htmlPage(
-        "Subscribed",
-        `<h1 style="margin-top:0;">You're subscribed \u{1F389}</h1><p>Thanks for confirming <strong>${escapeHtml(
-          state.subscriber.email
-        )}</strong>. You'll hear from us soon.</p>`,
-        200,
-        dev
-      );
+      return readerMessage(c, {
+        title: "Subscribed",
+        eyebrow,
+        headline: "You\u2019re subscribed",
+        ledeHtml: `Thanks for confirming <strong>${escapeHtml(state.subscriber.email)}</strong>. The next post will land in your inbox.`,
+        afterHtml: archiveLink(archiveHomeUrl(c.config), "Browse the archive")
+      });
     case "expired":
-      return htmlPage(
-        "Link expired",
-        `<h1 style="margin-top:0;">This link has expired</h1><p>Confirmation links only work for a limited time. We can send a new one to <strong>${escapeHtml(
-          state.subscriber.email
-        )}</strong>.</p>
-<form method="post" action="/subscribe">
-<input type="hidden" name="email" value="${escapeHtmlAttr(state.subscriber.email)}">
-<button type="submit" class="btn">Send a new link</button>
-</form>`,
-        410,
-        dev
-      );
+      return readerMessage(c, {
+        title: "Link expired",
+        eyebrow,
+        headline: "This link has expired",
+        ledeHtml: `Confirmation links only work for a limited time. We can send a new one to <strong>${escapeHtml(state.subscriber.email)}</strong>.`,
+        afterHtml: `<form class="r-form" method="post" action="/subscribe"><input type="hidden" name="email" value="${escapeHtmlAttr(state.subscriber.email)}"><button class="r-btn" type="submit">Send a new link</button></form>`,
+        status: 410
+      });
     case "invalid":
-      return htmlPage(
-        "Invalid link",
-        `<h1 style="margin-top:0;">This link is invalid</h1><p><a href="/subscribe">Subscribe again</a> to get a new one.</p>`,
-        400,
-        dev
-      );
+      return readerMessage(c, {
+        title: "Invalid link",
+        eyebrow,
+        headline: "This link is invalid",
+        ledeHtml: `<a href="/subscribe">Subscribe again</a> to get a new one.`,
+        status: 400
+      });
   }
 }
+function unsubscribeInvalidPage(c) {
+  return readerMessage(c, {
+    title: "Invalid link",
+    eyebrow: "Unsubscribe",
+    headline: "This link is invalid",
+    ledeHtml: "It may be incomplete. The unsubscribe link at the bottom of any email from the newsletter will work.",
+    status: 400
+  });
+}
+function unsubscribedPage(c, email2, banner) {
+  return readerMessage(c, {
+    title: "Unsubscribed",
+    eyebrow: "Unsubscribe",
+    headline: "You\u2019re unsubscribed",
+    ledeHtml: `<strong>${escapeHtml(email2)}</strong> won\u2019t receive further emails.`,
+    banner
+  });
+}
+async function unsubscribeAskPage(c, email2, action2, banner) {
+  const identity = await readerIdentity(c, c.config);
+  return readerMessage(
+    c,
+    {
+      title: "Unsubscribe",
+      eyebrow: "Unsubscribe",
+      headline: identity.name ? `Unsubscribe from ${identity.name}?` : "Unsubscribe?",
+      ledeHtml: `We\u2019ll stop sending the newsletter to <strong>${escapeHtml(email2)}</strong>.`,
+      afterHtml: `<form class="r-form" method="post" action="${escapeHtmlAttr(action2)}"><button class="r-btn" type="submit">Unsubscribe</button></form>`,
+      banner
+    },
+    identity
+  );
+}
+var TEST_UNSUBSCRIBE_PARAM = "test";
+function testUnsubscribeUrl(config) {
+  return `${config.appOrigin}/unsubscribe?${TEST_UNSUBSCRIBE_PARAM}=1`;
+}
+function isTestUnsubscribe(c, token2) {
+  return token2 === "" && c.url.searchParams.get(TEST_UNSUBSCRIBE_PARAM) === "1";
+}
+var TEST_UNSUBSCRIBE_EMAIL = "reader@example.com";
+var TEST_UNSUBSCRIBE_BANNER = {
+  tag: "Test",
+  text: "This is the page a subscriber sees. Nothing here changes anyone\u2019s subscription."
+};
 async function unsubscribeLanding(c) {
   const token2 = c.url.searchParams.get("token") ?? "";
+  if (isTestUnsubscribe(c, token2)) {
+    return unsubscribeAskPage(
+      c,
+      TEST_UNSUBSCRIBE_EMAIL,
+      `/unsubscribe?${TEST_UNSUBSCRIBE_PARAM}=1`,
+      TEST_UNSUBSCRIBE_BANNER
+    );
+  }
   const row = await getByUnsubToken(c.env.DB, token2);
-  const dev = devDashboardUrl(c.config);
   if (!row) {
-    return htmlPage(
-      "Invalid link",
-      `<h1 style="margin-top:0;">This link is invalid</h1>`,
-      400,
-      dev
-    );
+    return unsubscribeInvalidPage(c);
   }
   if (row.status === "unsubscribed") {
-    return htmlPage(
-      "Unsubscribed",
-      `<h1 style="margin-top:0;">You're unsubscribed</h1><p>${escapeHtml(row.email)} won't receive further emails.</p>`,
-      200,
-      dev
-    );
+    return unsubscribedPage(c, row.email);
   }
-  return htmlPage(
-    "Unsubscribe",
-    `<h1>Unsubscribe?</h1><p>Stop sending the newsletter to <strong>${escapeHtml(
-      row.email
-    )}</strong>?</p>
-<form method="post" action="/unsubscribe?token=${encodeURIComponent(token2)}">
-<button type="submit" class="btn btn-danger">Unsubscribe</button>
-</form>`,
-    200,
-    dev
-  );
+  return unsubscribeAskPage(c, row.email, `/unsubscribe?token=${encodeURIComponent(token2)}`);
 }
 async function unsubscribe(c) {
   const token2 = await readToken(c);
+  if (isTestUnsubscribe(c, token2)) {
+    return wantsHtml(c) ? unsubscribedPage(c, TEST_UNSUBSCRIBE_EMAIL, TEST_UNSUBSCRIBE_BANNER) : new Response("test email", { status: 200 });
+  }
   const row = await unsubscribeByToken(c.env.DB, token2);
-  const dev = devDashboardUrl(c.config);
   if (!row) {
-    return wantsHtml(c) ? htmlPage("Invalid link", `<h1 style="margin-top:0;">This link is invalid</h1>`, 400, dev) : new Response("invalid token", { status: 400 });
+    return wantsHtml(c) ? unsubscribeInvalidPage(c) : new Response("invalid token", { status: 400 });
+  }
+  return wantsHtml(c) ? unsubscribedPage(c, row.email) : new Response("unsubscribed", { status: 200 });
+}
+
+// shared/reader_pages.ts
+var SUBSCRIBE = { base: "app", path: "/subscribe" };
+var CONFIRM = { base: "app", path: "/confirm?token=\u2026" };
+var UNSUBSCRIBE = { base: "app", path: "/unsubscribe?token=\u2026" };
+var READER_JOURNEYS = [
+  {
+    id: "subscribe",
+    label: "Subscribe",
+    flow: "steps",
+    states: [
+      { id: "form", label: "Form", at: SUBSCRIBE },
+      { id: "check-inbox", label: "Check your inbox", at: SUBSCRIBE },
+      { id: "not-an-email", label: "Not an email", offPath: true, at: SUBSCRIBE }
+    ]
+  },
+  {
+    id: "confirm",
+    label: "Confirm",
+    flow: "steps",
+    states: [
+      { id: "ready", label: "Ready", at: CONFIRM },
+      { id: "confirmed", label: "Confirmed", at: CONFIRM },
+      { id: "expired", label: "Expired", offPath: true, at: CONFIRM },
+      { id: "invalid", label: "Invalid link", offPath: true, at: CONFIRM }
+    ]
+  },
+  {
+    id: "unsubscribe",
+    label: "Unsubscribe",
+    flow: "steps",
+    states: [
+      { id: "ask", label: "Ask", at: UNSUBSCRIBE },
+      { id: "done", label: "Unsubscribed", at: UNSUBSCRIBE },
+      { id: "invalid", label: "Invalid link", offPath: true, at: UNSUBSCRIBE }
+    ]
+  },
+  {
+    id: "reading",
+    label: "Reading",
+    flow: "peers",
+    states: [
+      { id: "landing", label: "Landing page", at: { base: "app", path: "/" } },
+      { id: "archive", label: "Archive", at: { base: "archive", path: "" } },
+      // The sample post's slug, as the Worker's preview renders it.
+      { id: "post", label: "Post page", at: { base: "archive", path: "/sample-post" } },
+      // A publication with nothing sent yet: what its first visitors get.
+      {
+        id: "landing-empty",
+        label: "Landing, no posts yet",
+        offPath: true,
+        at: { base: "app", path: "/" }
+      },
+      {
+        id: "archive-empty",
+        label: "Archive, no posts yet",
+        offPath: true,
+        at: { base: "archive", path: "" }
+      },
+      {
+        id: "not-found",
+        label: "Nothing here yet",
+        offPath: true,
+        at: { base: "archive", path: "/\u2026" }
+      }
+    ]
   }
-  return wantsHtml(c) ? htmlPage(
-    "Unsubscribed",
-    `<h1 style="margin-top:0;">You've been unsubscribed</h1><p>${escapeHtml(row.email)} won't receive further emails.</p>`,
-    200,
-    dev
-  ) : new Response("unsubscribed", { status: 200 });
+];
+function findReaderPage(journey, state) {
+  const j = READER_JOURNEYS.find((x) => x.id === journey);
+  const s = j?.states.find((x) => x.id === state);
+  return j && s ? { journey: j, state: s } : null;
 }
 
 // src/notify/fake.ts
@@ -6822,9 +6993,6 @@ async function loadRenderInput(c) {
   const imgs = await listImages(c.env.DB, post.id);
   return { post, revision, images: imgs };
 }
-function genericUnsubscribeUrl(c) {
-  return `${c.config.appOrigin}/unsubscribe`;
-}
 async function loadBranding(c) {
   return resolveBranding(await getSettings(c.env.DB), c.config);
 }
@@ -6836,11 +7004,21 @@ async function loadPostEmail(c) {
       input,
       email: { subject: send.subject, html: send.rendered_html, text: send.rendered_text },
       warnings: [],
-      frozen: { id: send.id }
+      frozen: { id: send.id },
+      dateMs: send.started_at ?? send.fire_at
     };
   }
   const result = await render(input, c.config, await loadBranding(c));
-  return { input, email: result, warnings: result.warnings, frozen: null };
+  return { input, email: result, warnings: result.warnings, frozen: null, dateMs: Date.now() };
+}
+function postPage(html) {
+  return new Response(html, {
+    headers: {
+      ...POST_PAGE_SECURITY_HEADERS,
+      "content-type": "text/html; charset=utf-8",
+      "x-robots-tag": "noindex"
+    }
+  });
 }
 async function preview(c) {
   const { input, email: email2, warnings, frozen } = await loadPostEmail(c);
@@ -6855,16 +7033,22 @@ async function preview(c) {
 async function previewPage(c) {
   const { email: email2 } = await loadPostEmail(c);
   const html = substituteRecipient(email2, {
-    ".Email.UnsubscribeURL": genericUnsubscribeUrl(c),
+    // The preview is the email shown to the publisher, so its link opens the same page
+    // a test email's does, not one calling the link invalid (SPEC §7).
+    ".Email.UnsubscribeURL": testUnsubscribeUrl(c.config),
     ".Email.SentTo": ""
   }).html;
-  return new Response(html, {
-    headers: {
-      ...POST_PAGE_SECURITY_HEADERS,
-      "content-type": "text/html; charset=utf-8",
-      "x-robots-tag": "noindex"
-    }
-  });
+  return postPage(html);
+}
+async function webPage(c) {
+  const { email: email2, dateMs } = await loadPostEmail(c);
+  return postPage(
+    webVersion(email2.html, {
+      config: c.config,
+      identity: await readerIdentity(c, c.config),
+      dateMs
+    })
+  );
 }
 async function test(c) {
   const to = normalizeEmail(optString(await readJsonObject(c), "to") ?? "");
@@ -6874,7 +7058,7 @@ async function test(c) {
   const readAt = Date.now();
   const { input, email: email2, warnings, frozen } = await loadPostEmail(c);
   const provider = getProvider(c.config, c.env);
-  const unsubscribeUrl = `${c.config.appOrigin}/unsubscribe?test=1`;
+  const unsubscribeUrl = testUnsubscribeUrl(c.config);
   const recipients = [{ email: to, unsubscribeUrl }];
   const [res] = perRecipient(
     await provider.sendBatch(email2, recipients, {
@@ -6911,14 +7095,16 @@ var TEMPLATE_TEST_MARKDOWN = [
   "- The maples on Marsh Lane have finally turned.",
   "- Someone left a note in the little free library, addressed to no one.",
   "",
-  "This is a **sample post** sent to preview your email template \u2014 [links](https://example.com) render like this. A real post's Markdown fills this space."
+  "This is a **sample post**: [links](https://example.com) render like this, and a real post's Markdown fills this space."
 ].join("\n");
-function sampleRenderInput() {
+var SAMPLE_POST_SUBJECT = "The starlings are back";
+function sampleRenderInput(subject = TEMPLATE_TEST_SUBJECT) {
   const now = Date.now();
   const post = {
     id: "sample",
     slug: "sample-post",
-    subject: TEMPLATE_TEST_SUBJECT,
+    slug_auto: false,
+    subject,
     status: "draft",
     current_revision: "sample-rev",
     created_at: now,
@@ -6928,7 +7114,7 @@ function sampleRenderInput() {
     id: "sample-rev",
     post_id: "sample",
     markdown: TEMPLATE_TEST_MARKDOWN,
-    metadata: JSON.stringify({ subject: TEMPLATE_TEST_SUBJECT, slug: post.slug }),
+    metadata: JSON.stringify({ subject, slug: post.slug }),
     author: null,
     created_at: now
   };
@@ -6979,7 +7165,7 @@ async function templateTest(c) {
   }
   const result = await render(sampleRenderInput(), c.config, resolveBranding(settings, c.config));
   const provider = getProvider(c.config, c.env);
-  const unsubscribeUrl = `${c.config.appOrigin}/unsubscribe?test=1`;
+  const unsubscribeUrl = testUnsubscribeUrl(c.config);
   const testId = `template-test-${crypto.randomUUID()}`;
   const batch = recipients.map((email2) => ({ email: email2, unsubscribeUrl }));
   const results = perRecipient(
@@ -7008,6 +7194,116 @@ async function devOutbox(c) {
   return json({ messages: fakeOutbox(), notifications: fakeNotifications() });
 }
 
+// src/routes/reader_pages.ts
+var SAMPLE_EMAIL = "reader@example.com";
+var DAY_MS = 864e5;
+function samplePosts(c, now) {
+  return [
+    { title: SAMPLE_POST_SUBJECT, slug: "sample-post", at: now },
+    { title: "Notes from the first frost", slug: "first-frost", at: now - 7 * DAY_MS },
+    { title: "What the river kept", slug: "what-the-river-kept", at: now - 14 * DAY_MS }
+  ].map((p) => ({
+    title: p.title,
+    url: archiveUrl(c.config, p.slug),
+    dateLabel: formatPublishedDate(p.at)
+  }));
+}
+async function previewOf(c, journey, state) {
+  const home = `${c.config.appOrigin}/`;
+  const subscribeUrl = `${c.config.appOrigin}/subscribe`;
+  const sample = { email: SAMPLE_EMAIL };
+  switch (`${journey}/${state}`) {
+    case "subscribe/form":
+      return subscribeFormPage(c, await readerIdentity(c, c.config));
+    case "subscribe/check-inbox":
+      return subscribeCheckInboxPage(c, await readerIdentity(c, c.config));
+    case "subscribe/not-an-email":
+      return subscribeNotAnEmailPage(c, await readerIdentity(c, c.config));
+    case "confirm/ready":
+      return confirmStatePage(c, { kind: "ready", subscriber: sample }, "");
+    case "confirm/confirmed":
+      return confirmStatePage(c, { kind: "confirmed", subscriber: sample }, "");
+    case "confirm/expired":
+      return confirmStatePage(c, { kind: "expired", subscriber: sample }, "");
+    case "confirm/invalid":
+      return confirmStatePage(c, { kind: "invalid" }, "");
+    case "unsubscribe/ask":
+      return unsubscribeAskPage(c, SAMPLE_EMAIL, "/unsubscribe");
+    case "unsubscribe/done":
+      return unsubscribedPage(c, SAMPLE_EMAIL);
+    case "unsubscribe/invalid":
+      return unsubscribeInvalidPage(c);
+    case "reading/landing": {
+      const [featured, ...recent] = samplePosts(c, Date.now());
+      return landingPage({
+        identity: await readerIdentity(c, c.config),
+        subscribeUrl,
+        homeUrl: home,
+        archiveUrl: archiveHomeUrl(c.config),
+        featured,
+        recent
+      });
+    }
+    case "reading/archive":
+      return archiveIndexPage({
+        identity: await readerIdentity(c, c.config),
+        subscribeUrl,
+        homeUrl: home,
+        posts: samplePosts(c, Date.now())
+      });
+    // The same two pages before the first post is sent.
+    case "reading/landing-empty":
+      return landingPage({
+        identity: await readerIdentity(c, c.config),
+        subscribeUrl,
+        homeUrl: home,
+        archiveUrl: archiveHomeUrl(c.config),
+        recent: []
+      });
+    case "reading/archive-empty":
+      return archiveIndexPage({
+        identity: await readerIdentity(c, c.config),
+        subscribeUrl,
+        homeUrl: home,
+        posts: []
+      });
+    case "reading/post": {
+      const settings = await getSettings(c.env.DB);
+      const email2 = await render(
+        sampleRenderInput(SAMPLE_POST_SUBJECT),
+        c.config,
+        resolveBranding(settings, c.config)
+      );
+      const html = webVersion(email2.html, {
+        config: c.config,
+        identity: await readerIdentity(c, c.config),
+        dateMs: Date.now()
+      });
+      return new Response(html);
+    }
+    case "reading/not-found":
+      return nothingHereYetPage(c);
+  }
+  throw notFound("reader page");
+}
+async function readerPagePreview(c) {
+  const journey = param(c, "journey");
+  const state = param(c, "state");
+  if (!findReaderPage(journey, state)) {
+    throw notFound("reader page");
+  }
+  const pc = { ...c, config: { ...c.config, devMode: false } };
+  const page = await previewOf(pc, journey, state);
+  return new Response(page.body, {
+    headers: {
+      ...POST_PAGE_SECURITY_HEADERS,
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store",
+      "x-robots-tag": "noindex"
+    }
+  });
+}
+
 // src/routes/schedule.ts
 var ISO_WITH_OFFSET = /T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:\d{2})$/i;
 function parseFireAt(input) {
@@ -7067,70 +7363,60 @@ async function sendNow(c) {
   rejectStrayTemplateChoice(await readJsonObject(c, { optional: true }));
   const active = await getActiveSendForPost(c.env.DB, post.id);
   if (active) {
-    const repeat = {
-      ...unwrap(await viewWithCursor(c.env, active.id), "send"),
-      idempotent: true
-    };
-    return json(repeat);
+    return repeatAnswer(c, active.id);
   }
   const now = Date.now();
   const fireAt = acceptFireAt(now + c.config.minLeadMs, c.config.minLeadMs, { now });
-  const send = await freeze(c.env, c.config, post, fireAt);
+  let send;
+  try {
+    send = await freeze(c.env, c.config, post, fireAt);
+  } catch (err) {
+    if (err instanceof HttpError && err.code === "active_send_exists") {
+      const winner = await getActiveSendForPost(c.env.DB, post.id);
+      if (winner) {
+        return repeatAnswer(c, winner.id);
+      }
+    }
+    throw err;
+  }
   const frozen = unwrap(await viewWithCursor(c.env, send.id), "send");
   return json(frozen, 201);
 }
+async function repeatAnswer(c, sendId) {
+  const repeat = {
+    ...unwrap(await viewWithCursor(c.env, sendId), "send"),
+    idempotent: true
+  };
+  return json(repeat);
+}
 
 // src/send/resolve.ts
-async function resolveStuckSend(env, sendId, outcome, actor, guard2 = {}) {
+async function resolveStuckSend(env, sendId, outcome, actor) {
   const send = await getSend(env.DB, sendId);
   if (!send) {
     throw notFound("send");
   }
-  const refuse = async (status, code, message2) => refusal(status, code, message2, { send: await viewSend(env, send.id) });
-  if (guard2.ifMatch !== void 0 && send.rev !== guard2.ifMatch) {
-    throw await refuse(
-      412,
-      "precondition_failed",
-      `the send has changed since rev ${guard2.ifMatch} (it is at rev ${send.rev}); read it again before resolving`
-    );
-  }
+  const refuse = async (code, message2) => refusal(409, code, message2, { send: await viewSend(env, send.id) });
   const now = Date.now();
   if (send.status === "sending" && send.locked_until !== null && send.locked_until > now) {
     throw await refuse(
-      409,
       "run_in_progress",
       "this send is being worked on right now; try Resolve again in a moment"
     );
   }
   if (!isWedged(send)) {
     throw await refuse(
-      409,
       "not_wedged",
       send.status === "sending" ? "send is not wedged: it still has recipients to hand off, or a run has yet to look at those in flight" : `send is ${send.status}, with no ambiguous deliveries to resolve`
     );
   }
-  if (guard2.expectedCount !== void 0 && guard2.expectedCount !== send.c_in_flight) {
-    throw await refuse(
-      409,
-      "count_changed",
-      `the send has ${send.c_in_flight} ambiguous recipients, not the ${guard2.expectedCount} expected; read it again before resolving`
-    );
-  }
   const lease = await acquireLease(env.DB, sendId, now, LEASE_TTL_MS);
   if (!lease) {
     const current = await getSend(env.DB, sendId);
-    if (current && guard2.ifMatch !== void 0 && current.rev !== guard2.ifMatch) {
-      throw await refuse(
-        412,
-        "precondition_failed",
-        `the send has changed since rev ${guard2.ifMatch} (it is at rev ${current.rev}); read it again before resolving`
-      );
-    }
     if (!current || !isWedged(current)) {
-      throw await refuse(409, "not_wedged", "send is no longer wedged");
+      throw await refuse("not_wedged", "send is no longer wedged");
     }
     throw await refuse(
-      409,
       "run_in_progress",
       "this send is being worked on right now; try Resolve again in a moment"
     );
@@ -7363,21 +7649,9 @@ async function answerWith(c, id) {
   }
   return read;
 }
-function parseIfMatch(c) {
-  const raw = c.req.headers.get("if-match");
-  if (raw === null) {
-    return void 0;
-  }
-  const match = /^\s*(?:W\/)?"?(\d+)(?:-[0-9a-z]+)?"?\s*$/.exec(raw);
-  const rev = match?.[1] === void 0 ? Number.NaN : Number(match[1]);
-  if (!Number.isSafeInteger(rev)) {
-    throw badRequest(`If-Match must be a send's rev, as "<rev>"`, { field: "If-Match" });
-  }
-  return rev;
-}
 async function cancel2(c) {
   const id = param(c, "id");
-  const { changed } = await cancel(c.env, id, { ifMatch: parseIfMatch(c) });
+  const { changed } = await cancel(c.env, id);
   const body = { ...await answerWith(c, id), changed };
   return json(body);
 }
@@ -7385,22 +7659,16 @@ async function reschedule2(c) {
   const body = await readJsonObject(c);
   const fireAt = parseFireAt(body.fire_at);
   const id = param(c, "id");
-  const { changed } = await reschedule(c.env, id, fireAt, c.config.minLeadMs, {
-    ifMatch: parseIfMatch(c)
-  });
+  const { changed } = await reschedule(c.env, id, fireAt, c.config.minLeadMs);
   const response = { ...await answerWith(c, id), changed };
   return json(response);
 }
 async function resolve(c) {
   const request = await readJsonObject(c);
   const outcome = oneOf(request, "resolution", ["unsent", "accepted"]);
-  const expectedCount = optCount(request, "expected_count");
   const actor = c.principal?.email ?? "service";
   const id = param(c, "id");
-  const { resolved, completed } = await resolveStuckSend(c.env, id, outcome, actor, {
-    ifMatch: parseIfMatch(c),
-    expectedCount
-  });
+  const { resolved, completed } = await resolveStuckSend(c.env, id, outcome, actor);
   const body = { ...await answerWith(c, id), resolved, completed };
   return json(body);
 }
@@ -7554,6 +7822,12 @@ var ProviderNotifier = class {
   }
 };
 
+// shared/dashboard_link.ts
+var PARAM = "to";
+function dashboardLink(appOrigin, route) {
+  return `${appOrigin}/dashboard/?${PARAM}=${encodeURIComponent(route).replaceAll("%2F", "/")}`;
+}
+
 // src/notify/compose.ts
 function when(ms) {
   return `${new Date(ms).toISOString().slice(0, 16).replace("T", " ")} UTC`;
@@ -7562,7 +7836,7 @@ function minutes2(ms) {
   return Math.round(ms / 6e4);
 }
 function sendLink(config, sendId) {
-  return `${config.appOrigin}/dashboard/#/sent/${encodeURIComponent(sendId)}`;
+  return dashboardLink(config.appOrigin, `/sent/${encodeURIComponent(sendId)}`);
 }
 function message(subject, paragraphs, link) {
   const text = `${paragraphs.join("\n\n")}
@@ -7640,7 +7914,7 @@ function sampleNotification(config) {
       "This is a test of the notifications that tell you when a send goes out, and right away if a send runs into a problem.",
       "If it arrived, the channel works; nothing else was sent."
     ],
-    `${config.appOrigin}/dashboard/#/settings`
+    dashboardLink(config.appOrigin, "/settings")
   );
 }
 
@@ -7779,7 +8053,7 @@ function publicationView(settings, cfg) {
     name: p.name,
     tagline: p.tagline,
     address: p.address,
-    logoUrl: p.logo ? `${cfg.mediaPublicBase}/${BRANDING_LOGO_KEY}?v=${p.logo.version}` : ""
+    logoUrl: publicationLogoUrl(cfg.mediaPublicBase, p.logo)
   };
 }
 function settingsView(settings, cfg) {
@@ -7901,14 +8175,15 @@ async function uploadLogo(c) {
     throw badRequest("logo must be 512 KB or smaller");
   }
   const version = Date.now();
+  const key = newLogoKey(version);
   const ack = readAckQuery(c);
   const { settings, remade } = await saveSettingsRemaking(
     c.env,
     c.config,
-    (current) => withPublicationLogo(current, { version, contentType: type }),
+    (current) => withPublicationLogo(current, { version, contentType: type, key }),
     ack,
     async () => {
-      await c.env.MEDIA.put(BRANDING_LOGO_KEY, bytes, { httpMetadata: { contentType: type } });
+      await c.env.MEDIA.put(key, bytes, { httpMetadata: { contentType: type } });
     }
   );
   const body = { settings: settingsView(settings, c.config), remade };
@@ -7921,7 +8196,10 @@ async function deleteLogo(c) {
     c.config,
     (current) => withPublicationLogo(current, null),
     ack,
-    () => c.env.MEDIA.delete(BRANDING_LOGO_KEY)
+    // The bytes stay: emails already sent, and their archive pages, still show them (I3).
+    // Removing the logo takes it out of what renders from now on, nothing more.
+    async () => {
+    }
   );
   const body = { settings: settingsView(settings, c.config), remade };
   return json(body);
@@ -8112,7 +8390,7 @@ function createRouter({
   const devOnly = (...defs) => devMode ? defs : [];
   const lead = `${formatLead(minLeadMs)} on this deployment (\`deployment.minLeadMs\` in \`GET /api/settings\`); a deployment sets it with \`MIN_LEAD_SECONDS\`, never below ${formatLead(MIN_LEAD_FLOOR_MS)}`;
   const conditionsText = `\`conditions\` is what is wrong with the send, or worth knowing, now (SPEC \xA78, \xA712), derived by the server from the send and the same on every route, most severe first: \`missed\` (still scheduled ${MISSED_THRESHOLD_MS / 6e4} minutes past its fire time: the sweep is not running), \`stuck\` (still sending ${STUCK_THRESHOLD_MS / 6e4} minutes after it started, whatever the cause), \`wedged\` (\`count\` recipients whose delivery is unknown, settled by Resolve), \`refused\` (the provider refusing the account, with its \`cause\`, its own words as \`error\`, the \`advice\` for the fix, which is outside this API, and \`retry_at\`; the send resumes on its own once the account is fixed, having consumed no one), \`provider_unavailable\` (an outage or a rate limit, retried on its own at \`retry_at\`), \`bounce_spike\` (a send finished within ${BOUNCE_SPIKE_RECENT_MS / 864e5} days whose confirmed bounces reached ${BOUNCE_SPIKE_RATE * 100}% of its audience at fire, at least ${BOUNCE_SPIKE_MIN}; \`bounced\` and \`rate\`), and \`remade\` (a template or identity change re-made the scheduled email after its last test, \`tested_at\`; a test of the post clears it). Each has a \`severity\` (\`action\`: a person must act; \`warn\`: worth a look; \`info\`), \`since\` (null when the record does not say), a \`message\` to show or relay as it stands, and the \`action\` that settles it, if any. \`actions\` is exactly what the server would accept on the send now, each \`{name, method, path}\`: \`cancel\` and \`reschedule\` while it is scheduled and its fire time is still ahead, \`resolve\` while it is wedged.`;
-  const actionText = 'Send `If-Match: "<rev>"` (the send\'s `rev` as you last read it) to act only on the send you decided about: a send that has changed since is a 412 `precondition_failed` carrying the send as it stands. That includes a change your own earlier attempt made, so a retry after a lost answer that sends `If-Match` gets the 412, with the send showing whether the act landed; a retry without it is answered `changed: false`. Every refusal carries the send as it stands in `send`, in the `GET /api/sends` row shape.';
+  const actionText = "An act carries no precondition on the send you read: it applies to the send as it stands, within the rules above, and the answer shows the result. An `If-Match` header is ignored. Every refusal carries the send as it stands in `send`, in the `GET /api/sends` row shape.";
   const sendExample = (over = {}) => ({
     id: "s_xyz789",
     post_id: "p_abc123",
@@ -8234,7 +8512,7 @@ function createRouter({
       access: "public",
       resource: "dev",
       summary: "Mint an admin token (local dev only).",
-      description: "Public because it's how a local client gets the token every admin route requires. Registered only on a local instance.",
+      description: "Public because it's how a local client gets the token every admin route requires. Registered only on a local instance. When `kestrel dev` started the server, the answer also carries `runId`, the ID it recorded for this run, which `kestrel seed` and `kestrel reset` check before wiping the database.",
       query: [
         {
           name: "kind",
@@ -8332,7 +8610,7 @@ function createRouter({
       accepts: FORM_UPLOAD,
       resource: "settings",
       summary: "Upload the publication logo (multipart `file`); served publicly via /media.",
-      description: "The logo is part of the identity, so when the template renders it and sends are scheduled this re-makes their emails under the same rule as `PUT /api/settings`, acknowledged as `?remake=` (comma-separated send ids) since the request carries no JSON body; the bytes are written only once the refusals are ruled out.",
+      description: "The logo is part of the identity, so when the template renders it and sends are scheduled this re-makes their emails under the same rule as `PUT /api/settings`, acknowledged as `?remake=` (comma-separated send ids) since the request carries no JSON body; the bytes are written only once the refusals are ruled out. The image is stored as sent: every surface shows the logo as a square, and an email stretches one that isn't, so send a square image at least 256 \xD7 256 px (the editor crops and scales to that before uploading).",
       handler: uploadLogo
     },
     {
@@ -8341,7 +8619,7 @@ function createRouter({
       access: "admin",
       resource: "settings",
       summary: "Remove the publication logo.",
-      description: "Under the same re-make rule as `PUT /api/settings` when the template renders the logo and sends are scheduled: acknowledged as `?remake=` (comma-separated send ids), refused inside the minimum lead.",
+      description: "Under the same re-make rule as `PUT /api/settings` when the template renders the logo and sends are scheduled: acknowledged as `?remake=` (comma-separated send ids), refused inside the minimum lead. The image itself stays served, since emails already sent still show it (I3); only what renders from then on loses it.",
       handler: deleteLogo
     },
     {
@@ -8371,6 +8649,15 @@ function createRouter({
       example: { response: { to: "you@example.com", channel: "cloudflare" } },
       handler: notificationTest
     },
+    {
+      method: "GET",
+      path: "/api/reader-pages/:journey/:state",
+      access: "admin",
+      resource: "settings",
+      summary: "A page a reader can land on, as a standalone HTML page: Settings' preview of it (SPEC \xA75).",
+      description: "`journey` is `subscribe` (`form`, `check-inbox`, `not-an-email`), `confirm` (`ready`, `confirmed`, `expired`, `invalid`), `unsubscribe` (`ask`, `done`, `invalid`), or `reading` (`landing`, `archive`, `post`, `landing-empty`, `archive-empty`, `not-found`), naming the `state`. Rendered by the code that serves the real page, with the saved publication identity and a sample address and sample posts in place of a reader's own (the `-empty` pages show the landing page and archive before any post is sent), and nothing marking it as a preview, since Settings frames it as one; the post page renders the sample post through the saved template. Always 200, whatever status the real page carries; an unknown pair is a 404. A preview changes nothing: its forms submit nowhere (`form-action 'none'`).",
+      handler: readerPagePreview
+    },
     // --- posts + revisions (authed) ---
     {
       method: "POST",
@@ -8378,11 +8665,11 @@ function createRouter({
       access: "admin",
       accepts: JSON_BODY,
       resource: "posts",
-      summary: "Create a draft post.",
+      summary: "Create a draft post. Its slug follows the subject (`slug_auto: true`) unless you send a `slug`, which sets it by hand.",
       example: {
         request: { subject: "Hello, world", markdown: "# Hello\n\nWelcome." },
         response: {
-          post: { id: "p_abc123", status: "draft", slug: "hello-world" },
+          post: { id: "p_abc123", status: "draft", slug: "hello-world", slug_auto: true },
           revision_id: "r_1"
         }
       },
@@ -8431,15 +8718,22 @@ function createRouter({
       accepts: JSON_BODY,
       resource: "posts",
       summary: "Update a draft. Send the revision you read as `base_revision` (or If-Match): a save without one is a 428 `base_required` carrying the post as it stands, and one whose base is no longer current is a 409 `stale_revision`.",
-      description: "Only a draft is editable; a scheduled post is soft-locked until its schedule is canceled.",
+      description: "Only a draft is editable; a scheduled post is soft-locked until its schedule is canceled. While the post's slug follows the subject (`slug_auto: true`), every save derives it from the subject again and numbers it if another post holds it, so take the slug from the answer. Sending `slug` sets it by hand and turns `slug_auto` off; `slug_auto: true` has it follow the subject again. Sending both is a 400 naming `slug`.",
       example: {
         request: {
-          subject: "Hello, world",
-          slug: "hello-world",
+          subject: "Hello again, world",
           markdown: "# Hello\n\nEdited.",
           base_revision: "r_1"
         },
-        response: { post: { id: "p_abc123", current_revision: "r_2", status: "draft" } }
+        response: {
+          post: {
+            id: "p_abc123",
+            current_revision: "r_2",
+            status: "draft",
+            slug: "hello-again-world",
+            slug_auto: true
+          }
+        }
       },
       handler: updatePost2
     },
@@ -8508,10 +8802,19 @@ function createRouter({
       path: "/api/posts/:id/preview",
       access: "admin",
       resource: "posts",
-      summary: "The rendered email as a standalone HTML page (editor preview / open-in-browser).",
+      summary: "The rendered email as a standalone HTML page (the editor's preview).",
       description: "Once the post is scheduled this is its frozen copy, exactly as it will fire, and once sent the record's; a draft renders live (SPEC \xA75).",
       handler: previewPage
     },
+    {
+      method: "GET",
+      path: "/api/posts/:id/web",
+      access: "admin",
+      resource: "posts",
+      summary: "The post's web version as a standalone HTML page: what its public post page will show.",
+      description: "Built from the same copy as the preview (a draft's live render, the frozen copy once scheduled, the record once sent) by the post page's own code: the email-only regions left out, the masthead and display font added (SPEC \xA75). Once the send starts it matches the public post page, less the local-dev dashboard link.",
+      handler: webPage
+    },
     {
       method: "POST",
       path: "/api/posts/:id/test",
@@ -8688,7 +8991,7 @@ function createRouter({
       access: "admin",
       resource: "sends",
       summary: "One send: its view, the delivery-outcome breakdown of its record, and the `cursor` marking where this read stood among the changes to sends, to follow it from with `GET /api/sends/feed` (it carries no pace, so read the feed at once from it).",
-      description: "`send` is the send's view, the one shape every send route carries (the list, the feed, every action's answer and refusal), so a client keeps one copy current from any of them and tells two apart by `rev`, the higher the newer. It holds the stored facts: `status` (`scheduled`, `sending`, `sent`, `canceled`), the times, `remade_at` (a template or identity change re-made it while scheduled) and `tested_at`, and `audience` (`count`, an estimate until the send fires and the audience at fire once `fixed`, from `fixed_at`). Beside them, what the server derives as of `as_of`, the server's clock at the read: `counts` (every recipient in one bucket), `dispatch` (hand-off progress; `rate_per_min` is what a sweep tick carries, one tick a minute, and `eta_ms` counts the ticks the rest needs, the wait between them included, given only while it is handing off and once a tick has finished, never while paused), `delivery` (receipts over accepted), `provider` (its `name`, and `halt` while the provider refuses its batches), `phase` (`scheduled`, `due`, `progressing`, `retrying`, `backing-off`, `needs-attention`, `settling`, `complete`, `canceled`), `conditions`, `actions`, and `next_change_at` (see `GET /api/sends/feed`). `links` names the send's other resources: the frozen email (`email_html`, `email_text`), the recipient rows and their CSV, the post, and `archive`, the published page, absolute, once the send is sent. " + conditionsText + " `outcomes` counts the record's recipients by outcome from its rows, summing to the audience at fire. The answer carries `ETag`: the send's `rev` and a tag of what the clock derives from it, so a request with `If-None-Match` answers 304 while nothing about the send has changed, written or derived. An action's `If-Match` takes this `ETag` or the bare `rev`.",
+      description: "`send` is the send's view, the one shape every send route carries (the list, the feed, every action's answer and refusal), so a client keeps one copy current from any of them and tells two apart by `rev`, the higher the newer. It holds the stored facts: `status` (`scheduled`, `sending`, `sent`, `canceled`), the times, `remade_at` (a template or identity change re-made it while scheduled) and `tested_at`, and `audience` (`count`, an estimate until the send fires and the audience at fire once `fixed`, from `fixed_at`). Beside them, what the server derives as of `as_of`, the server's clock at the read: `counts` (every recipient in one bucket), `dispatch` (hand-off progress; `rate_per_min` is what a sweep tick carries, one tick a minute, and `eta_ms` counts the ticks the rest needs, the wait between them included, given only while it is handing off and once a tick has finished, never while paused), `delivery` (receipts over accepted), `provider` (its `name`, and `halt` while the provider refuses its batches), `phase` (`scheduled`, `due`, `progressing`, `retrying`, `backing-off`, `needs-attention`, `settling`, `complete`, `canceled`), `conditions`, `actions`, and `next_change_at` (see `GET /api/sends/feed`). `links` names the send's other resources: the frozen email (`email_html`, `email_text`), the recipient rows and their CSV, the post, and `archive`, the published page, absolute, once the send is sent. " + conditionsText + " `outcomes` counts the record's recipients by outcome from its rows, summing to the audience at fire. The answer carries `ETag`: the send's `rev` and a tag of what the clock derives from it, so a request with `If-None-Match` answers 304 while nothing about the send has changed, written or derived.",
       example: {
         response: {
           send: sendExample(),
@@ -8809,10 +9112,10 @@ function createRouter({
       access: "admin",
       accepts: JSON_BODY,
       resource: "sends",
-      summary: "Resolve a send wedged on ambiguous (dispatched) deliveries; body {resolution: 'unsent'|'accepted', expected_count?}.",
-      description: "On a non-idempotent provider a mid-batch transport error leaves recipients `dispatched` \u2014 the loop won't blind-retry them (I4), so the send can't reach its completion gate. This adjudicates those rows: 'unsent' (assume not sent; the address is picked up by the next post) or 'accepted' (assume sent, operator-confirmed), then completes the send. Never re-mails an already-accepted recipient. Offered in `actions` exactly while the send is wedged. Refusals: 409 `run_in_progress` while a run holds the send (its in-flight rows may still get the provider's answer, so try again a moment later), 409 `not_wedged` when the send is not wedged (nothing ambiguous, recipients still to hand off, or a run yet to look at them), and, when `expected_count` (the wedged count you decided on) is given, 409 `count_changed` if the count has moved. " + actionText,
+      summary: "Resolve a send wedged on ambiguous (dispatched) deliveries; body {resolution: 'unsent'|'accepted'}.",
+      description: "On a non-idempotent provider a mid-batch transport error leaves recipients `dispatched` \u2014 the loop won't blind-retry them (I4), so the send can't reach its completion gate. This adjudicates those rows: 'unsent' (assume not sent; the address is picked up by the next post) or 'accepted' (assume sent, operator-confirmed), then completes the send. Never re-mails an already-accepted recipient. Offered in `actions` exactly while the send is wedged. Refusals: 409 `run_in_progress` while a run holds the send (its in-flight rows may still get the provider's answer, so try again a moment later), 409 `not_wedged` when the send is not wedged (nothing ambiguous, recipients still to hand off, or a run yet to look at them) and when another Resolve has settled it. Once a send is wedged no run touches it, so the recipients Resolve settles are the ones the send showed; an `expected_count` in the body is ignored. " + actionText,
       example: {
-        request: { resolution: "unsent", expected_count: 12 },
+        request: { resolution: "unsent" },
         response: {
           send: sendExample({ status: "sent", phase: "settling", completed_at: 176846762e4 }),
           cursor: "58.1768467620000",
@@ -8984,12 +9287,15 @@ function createRouter({
       path: "/unsubscribe",
       access: "public",
       resource: "subscriptions",
-      summary: "Unsubscribe landing page (`?token=`).",
+      summary: "Unsubscribe landing page (`?token=`, or `?test=1` on a test email or a preview).",
       query: [
         {
           name: "token",
-          description: "The subscriber's unsubscribe token, from any delivered email's link.",
-          required: true
+          description: "The subscriber's unsubscribe token, from any delivered email's link."
+        },
+        {
+          name: "test",
+          description: "`1` on the link of a test email or a preview, which carries no token: the page a subscriber sees, marked as a test and showing a sample address, whose button posts back with the marker. It unsubscribes no one. A token, when present, wins."
         }
       ],
       handler: unsubscribeLanding
@@ -8999,12 +9305,15 @@ function createRouter({
       path: "/unsubscribe",
       access: "public",
       resource: "subscriptions",
-      summary: "Process a one-click / form unsubscribe (`?token=`).",
+      summary: "Process a one-click / form unsubscribe (`?token=`, or `?test=1` on a test email or a preview).",
       query: [
         {
           name: "token",
-          description: "The subscriber's unsubscribe token, from any delivered email's link.",
-          required: true
+          description: "The subscriber's unsubscribe token, from any delivered email's link."
+        },
+        {
+          name: "test",
+          description: "`1` on the link of a test email or a preview, which carries no token: answers 200 (a form gets the page a subscriber sees once unsubscribed, marked as a test and showing a sample address) and unsubscribes no one. A token, when present, wins."
         }
       ],
       handler: unsubscribe
@@ -9030,7 +9339,7 @@ function createRouter({
       path: `${archiveBasePath}{/}?`,
       access: "public",
       resource: "archive",
-      summary: "The public archive index: every sent post, newest first.",
+      summary: "The public archive index: every published post (its send has started), newest first.",
       handler: archiveIndex
     },
     {
@@ -9038,7 +9347,7 @@ function createRouter({
       path: `${archiveBasePath}/:slug`,
       access: "public",
       resource: "archive",
-      summary: "A frozen post's archive page / view-in-browser (I3).",
+      summary: "A published post's archive page / view-in-browser (I3), from the moment its send starts.",
       handler: archivePage
     },
     // --- media bytes (public; readers + archive load these unauthenticated) ---