okengine 0.10.1 → 0.10.3

package/src/plugins/ip-allowlist.test.ts

@@ -25,7 +25,7 @@ function get(ip?: string): Request {
 
 describe("ipAllowlist plugin", () => {
   test("allow list: listed IPs pass, others get 403 Forbidden", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "ips" }).plug(ipAllowlist({ allow: ["203.0.113.7"] }));
 
     const ok = await app.fetch(get("203.0.113.7"));
@@ -39,7 +39,7 @@ describe("ipAllowlist plugin", () => {
   });
 
   test("deny list: blocked IPs get 403 ip_denied, others pass", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "ips-deny" }).plug(
       ipAllowlist({ deny: ["198.51.100.9"] }),
     );
@@ -54,7 +54,7 @@ describe("ipAllowlist plugin", () => {
   });
 
   test("deny wins over allow on overlap", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "ips-both" }).plug(
       ipAllowlist({ allow: ["203.0.113.7"], deny: ["203.0.113.7"] }),
     );
@@ -64,7 +64,7 @@ describe("ipAllowlist plugin", () => {
   });
 
   test("XFF last hop is the client; a spoofed first hop cannot bypass allow", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "ips-xff" }).plug(
       ipAllowlist({ allow: ["203.0.113.7"] }),
     );
@@ -78,7 +78,7 @@ describe("ipAllowlist plugin", () => {
   });
 
   test("spoofed first hop cannot bypass a deny rule", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "ips-xff-deny" }).plug(
       ipAllowlist({ deny: ["198.51.100.9"] }),
     );
@@ -92,7 +92,7 @@ describe("ipAllowlist plugin", () => {
   });
 
   test("trustedProxyDepth selects the hop behind N trusted proxies", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     // Chain: spoofed, real-client, cdn-egress — depth 2 skips the nearest proxy hop.
     const app = oke({ autoBoot: false, name: "ips-depth" }).plug(
       ipAllowlist({ allow: ["203.0.113.7"], trustedProxyDepth: 2 }),
@@ -113,7 +113,7 @@ describe("ipAllowlist plugin", () => {
   });
 
   test("missing header: denied when allow is set, permitted for deny-only", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const strict = oke({ autoBoot: false, name: "ips-missing-allow" }).plug(
       ipAllowlist({ allow: ["203.0.113.7"] }),
     );
@@ -123,7 +123,7 @@ describe("ipAllowlist plugin", () => {
 
     resetBindings();
     resetFlowSeq();
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
 
     const lax = oke({ autoBoot: false, name: "ips-missing-deny" }).plug(
       ipAllowlist({ deny: ["198.51.100.9"] }),
@@ -133,7 +133,7 @@ describe("ipAllowlist plugin", () => {
   });
 
   test("custom header name is honored", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "ips-custom" }).plug(
       ipAllowlist({ allow: ["203.0.113.7"], header: "x-real-ip" }),
     );

package/src/plugins/magic-link.ts

@@ -107,9 +107,7 @@ export function magicLink(opts: MagicLinkOptions = {}): PluginDef {
         })
       : magicLinkTemplate;
 
-  const request = flow({
-    name: "auth.requestMagicLink",
-    unit: "auth",
+  const request = flow("auth.requestMagicLink", {
     plane: "user",
     in: z.object({ email: z.string().min(3) }),
     out: z.object({
@@ -144,9 +142,7 @@ export function magicLink(opts: MagicLinkOptions = {}): PluginDef {
     },
   });
 
-  const verify = flow({
-    name: "auth.verifyMagicLink",
-    unit: "auth",
+  const verify = flow("auth.verifyMagicLink", {
     plane: "user",
     in: z.object({ token: z.string().min(1) }),
     out: SessionTokensOut,

package/src/plugins/maintenance-mode.test.ts

@@ -17,7 +17,7 @@ beforeEach(() => {
 
 describe("maintenanceMode plugin", () => {
   test("returns 503 with ServiceUnavailable envelope and Retry-After", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "maint" }).plug(maintenanceMode({ retryAfter: 120 }));
 
     const res = await app.fetch(new Request("http://localhost/x"));
@@ -35,7 +35,7 @@ describe("maintenanceMode plugin", () => {
   });
 
   test("enabled: false passes traffic through", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "maint-off" }).plug(
       maintenanceMode({ enabled: false }),
     );
@@ -46,8 +46,8 @@ describe("maintenanceMode plugin", () => {
   });
 
   test("allowPaths prefixes keep serving", async () => {
-    on(http.get("/health"), flow({ name: "health.get", do: () => ({ up: true }) }));
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/health"), flow("health.get", { do: () => ({ up: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "maint-allow" }).plug(
       maintenanceMode({ allowPaths: ["/health"] }),
     );
@@ -60,7 +60,7 @@ describe("maintenanceMode plugin", () => {
   });
 
   test("bypass header lets operators through (any non-empty value)", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "maint-bypass" }).plug(
       maintenanceMode({ bypassHeader: "x-ops-token" }),
     );
@@ -75,7 +75,7 @@ describe("maintenanceMode plugin", () => {
   });
 
   test("the 503 still flows through onResponse (other plugins stamp it)", async () => {
-    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    on(http.get("/x"), flow("x.get", { do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "maint-stamp" }).plug(maintenanceMode());
     app.hook("onResponse", (ctx) => {
       if (!ctx.response) return;

package/src/plugins/otp.ts

@@ -236,9 +236,7 @@ export function otp(opts: OtpOptions): PluginDef {
   });
 
   if (opts.mode === "provider") {
-    const request = flow({
-      name: "auth.requestOtp",
-      unit: "auth",
+    const request = flow("auth.requestOtp", {
       plane: "user",
       in: z.object({
         phone: z.string().min(8),
@@ -277,9 +275,7 @@ export function otp(opts: OtpOptions): PluginDef {
       },
     });
 
-    const verify = flow({
-      name: "auth.verifyOtp",
-      unit: "auth",
+    const verify = flow("auth.verifyOtp", {
       plane: "user",
       in: z.object({
         phone: z.string().min(8),
@@ -347,9 +343,7 @@ export function otp(opts: OtpOptions): PluginDef {
   }
 
   // ── App mode ───────────────────────────────────────────────────────────
-  const request = flow({
-    name: "auth.requestOtp",
-    unit: "auth",
+  const request = flow("auth.requestOtp", {
     plane: "user",
     in: z.object({
       email: z.string().min(3).optional(),
@@ -415,9 +409,7 @@ export function otp(opts: OtpOptions): PluginDef {
     },
   });
 
-  const resend = flow({
-    name: "auth.resendOtp",
-    unit: "auth",
+  const resend = flow("auth.resendOtp", {
     plane: "user",
     in: z.object({
       email: z.string().min(3).optional(),
@@ -486,9 +478,7 @@ export function otp(opts: OtpOptions): PluginDef {
     },
   });
 
-  const verify = flow({
-    name: "auth.verifyOtp",
-    unit: "auth",
+  const verify = flow("auth.verifyOtp", {
     plane: "user",
     in: z.object({
       email: z.string().min(3).optional(),

package/src/plugins/passkey.ts

@@ -87,9 +87,7 @@ export function passkey(opts: PasskeyOptions = {}): PluginDef {
   const rpId = opts.rpId ?? "localhost";
   const origins = opts.origins ?? ["http://localhost", "https://localhost"];
 
-  const registerOptions = flow({
-    name: "auth.passkeyRegisterOptions",
-    unit: "auth",
+  const registerOptions = flow("auth.passkeyRegisterOptions", {
     plane: "user",
     out: z.object({
       challenge: z.string(),
@@ -115,9 +113,7 @@ export function passkey(opts: PasskeyOptions = {}): PluginDef {
     },
   });
 
-  const register = flow({
-    name: "auth.passkeyRegister",
-    unit: "auth",
+  const register = flow("auth.passkeyRegister", {
     plane: "user",
     in: CeremonyIn.extend({
       publicKey: z.string().min(1),
@@ -171,9 +167,7 @@ export function passkey(opts: PasskeyOptions = {}): PluginDef {
     },
   });
 
-  const authenticateOptions = flow({
-    name: "auth.passkeyAuthenticateOptions",
-    unit: "auth",
+  const authenticateOptions = flow("auth.passkeyAuthenticateOptions", {
     plane: "user",
     in: z.object({ email: z.string().optional() }),
     out: z.object({
@@ -199,9 +193,7 @@ export function passkey(opts: PasskeyOptions = {}): PluginDef {
     },
   });
 
-  const authenticate = flow({
-    name: "auth.passkeyAuthenticate",
-    unit: "auth",
+  const authenticate = flow("auth.passkeyAuthenticate", {
     plane: "user",
     in: CeremonyIn.extend({
       challenge: z.string().min(1),

package/src/plugins/two-factor.ts

@@ -59,9 +59,7 @@ export function twoFactor(opts: TwoFactorOptions = {}): PluginDef {
   const factors = opts.factors ?? createTwoFactorStore();
   const issuer = opts.issuer ?? "oke";
 
-  const enable = flow({
-    name: "auth.twoFactorEnable",
-    unit: "auth",
+  const enable = flow("auth.twoFactorEnable", {
     plane: "user",
     out: z.object({
       secret: z.string(),
@@ -91,9 +89,7 @@ export function twoFactor(opts: TwoFactorOptions = {}): PluginDef {
     },
   });
 
-  const verify = flow({
-    name: "auth.twoFactorVerify",
-    unit: "auth",
+  const verify = flow("auth.twoFactorVerify", {
     plane: "user",
     in: z.object({
       userId: z.string().min(1),
@@ -127,9 +123,7 @@ export function twoFactor(opts: TwoFactorOptions = {}): PluginDef {
     },
   });
 
-  const disable = flow({
-    name: "auth.twoFactorDisable",
-    unit: "auth",
+  const disable = flow("auth.twoFactorDisable", {
     plane: "user",
     out: z.object({ ok: z.literal(true) }),
     errors: { AuthFailed },

package/src/plugins/username.ts

@@ -319,9 +319,7 @@ export function username(opts: UsernamePluginOptions = {}): PluginDef {
   resolveUsernamePolicy(usernamePolicy);
   const crypto = createBunCrypto();
 
-  const signUp = flow({
-    name: "auth.signUpUsername",
-    unit: "auth",
+  const signUp = flow("auth.signUpUsername", {
     plane: "user",
     in: UsernameIn,
     out: SessionTokensOut,
@@ -385,9 +383,7 @@ export function username(opts: UsernamePluginOptions = {}): PluginDef {
     },
   });
 
-  const signIn = flow({
-    name: "auth.signInUsername",
-    unit: "auth",
+  const signIn = flow("auth.signInUsername", {
     plane: "user",
     in: UsernameIn,
     out: SessionTokensOut,

package/src/release/measure.ts

@@ -302,7 +302,7 @@ const { flow } = await import(${JSON.stringify(paths.flow)});
 const { on, resetBindings } = await import(${JSON.stringify(paths.on)});
 const { http } = await import(${JSON.stringify(paths.http)});
 resetBindings();
-on(http.get("/ping"), flow({ name: "ping", do: () => ({ ok: true }) }));
+on(http.get("/ping"), flow("ping", { do: () => ({ ok: true }) }));
 const app = oke({ name: "cold-start" });
 const rt = createBunRuntime();
 const server = rt.serve(app, { port: 0, hostname: "127.0.0.1" });

package/src/runs/runs.test.ts

@@ -59,9 +59,7 @@ describe("zero-instrumentation dimensions", () => {
 
     on(
       http.get("/book").gate(member),
-      flow({
-        name: "book.create",
-        unit: "bookings",
+      flow("bookings.create", {
         plane: "user",
         effects: { reads: ["sql:bookings"] },
         do: async (_input, fx) => {
@@ -92,7 +90,7 @@ describe("zero-instrumentation dimensions", () => {
     const events = await runs.all();
     expect(events.length).toBe(1);
     const e = events[0]!;
-    expect(e.flow).toBe("book.create");
+    expect(e.flow).toBe("bookings.create");
     expect(e.unit).toBe("bookings");
     expect(e.trigger).toBe("http");
     expect(e.plane).toBe("user");
@@ -103,7 +101,7 @@ describe("zero-instrumentation dimensions", () => {
     expect(e.buildVersion).toBe("1.2.3");
     expect(e.logs.length).toBe(1);
     expect(e.logs[0]!.message).toBe("booking started");
-    expect(e.dimensions.flow).toBe("book.create");
+    expect(e.dimensions.flow).toBe("bookings.create");
     expect(e.dimensions.tenant).toBe("org_a41");
     expect(e.dimensions.cache).toBe("hit");
 

package/src/runtime/serve.test.ts

@@ -57,15 +57,13 @@ function rawHttp(port: number, payload: string): Promise<string> {
 function buildApp() {
   on(
     http.get("/ping").gate(gate.public),
-    flow({
-      name: "ping",
+    flow("ping", {
       do: () => ({ ok: true as const, n: 1 }),
     }),
   );
   on(
     http.get("/notes/:id").gate(gate.public),
-    flow({
-      name: "notes.get",
+    flow("notes.get", {
       do: ({ id }: { id: string }) => ({ id }),
     }),
   );

package/src/test/create-test-app.test.ts

@@ -37,9 +37,7 @@ describe("createTestApp — four-applications surface", () => {
 
     on(
       http.post("/orders").gate(member),
-      flow({
-        name: "orders.create",
-        unit: "orders",
+      flow("orders.create", {
         in: z.object({ sku: z.string(), qty: z.number() }),
         out: z.object({ id: z.string() }),
         effects: { emits: ["order-placed"] },
@@ -53,8 +51,7 @@ describe("createTestApp — four-applications surface", () => {
 
     on(
       orderPlaced,
-      flow({
-        name: "orders.onPlaced",
+      flow("orders.onPlaced", {
         effects: { sends: ["order-confirmed"] },
         do: async ({ orderId }, fx) => {
           await fx.send(orderConfirmed, {
@@ -67,8 +64,7 @@ describe("createTestApp — four-applications surface", () => {
 
     on(
       every("1h"),
-      flow({
-        name: "orders.expire",
+      flow("orders.expire", {
         do: (_i, fx) => {
           fx.log.info("expire");
         },

package/src/test/provisions.integration.test.ts

@@ -48,8 +48,7 @@ describe("Provisions integration", () => {
       }),
     });
 
-    const chargeOrder = flow({
-      name: "payments.chargeOrder",
+    const chargeOrder = flow("payments.chargeOrder", {
       durable: true,
       in: z.object({ orderId: z.string() }),
       out: z.boolean(),
@@ -69,9 +68,7 @@ describe("Provisions integration", () => {
 
     on(
       http.post("/orders").gate(member, canOrder),
-      flow({
-        name: "orders.create",
-        unit: "orders",
+      flow("orders.create", {
         in: z.object({ sku: z.string(), qty: z.number() }),
         out: z.object({ id: z.string() }),
         effects: { emits: ["order-placed"], calls: ["payments.chargeOrder"] },
@@ -85,8 +82,7 @@ describe("Provisions integration", () => {
 
     on(
       orderPlaced,
-      flow({
-        name: "orders.onPlaced",
+      flow("orders.onPlaced", {
         effects: { calls: ["payments.chargeOrder"] },
         do: async ({ orderId }, fx) => {
           await fx.call(chargeOrder, { orderId });
@@ -96,8 +92,7 @@ describe("Provisions integration", () => {
 
     on(
       orderNews,
-      flow({
-        name: "notifications.onNews",
+      flow("notifications.onNews", {
         effects: { sends: ["order-confirmed"] },
         do: async ({ orderId, status }, fx) => {
           if (status !== "confirmed") return;

package/src/test/reset-element-registries.ts

@@ -0,0 +1,31 @@
+/**
+ * Global safety net for the `store.sql` / `store.files` / `vault.secret` /
+ * `signal()` / `channel.<medium>().template()` auto-registries
+ * (`src/kernel/element-registries.ts`).
+ *
+ * Unlike `on()` bindings — created almost exclusively to wire a real app —
+ * these four factories are called throughout the suite as bare value
+ * constructors, completely unrelated to booting an app (hundreds of call
+ * sites across `src/elements/*.test.ts`). Since the registries are plain
+ * module-level arrays shared by every test file in one `bun test` process,
+ * leaving cleanup to per-file discipline (the convention `on.ts` relies on —
+ * see `resetBindings()` / `registry: "ignore"`) would let stray decls from
+ * one file silently reach a default-registry `oke()` call in a completely
+ * unrelated file. Reset after every test, globally, via `bunfig.toml`
+ * `[test].preload`.
+ */
+
+import { afterEach } from "bun:test";
+import {
+  channelTemplateRegistry,
+  secretRegistry,
+  signalRegistry,
+  storeRegistry,
+} from "../kernel/element-registries.ts";
+
+afterEach(() => {
+  storeRegistry.length = 0;
+  secretRegistry.length = 0;
+  signalRegistry.length = 0;
+  channelTemplateRegistry.length = 0;
+});

package/site/content/docs/console/access.mdx

@@ -1,29 +0,0 @@
----
-title: "Access"
-description: "Identities, roles, API keys."
-icon: "Users"
-source: "docs/spec/console.md"
----
-
-Answers: **identities, roles, API keys**
-
-<Callout title="Governing rule">
-  Granting an application scope to an operator is impossible in the UI — taught by absence, not
-  refusal.
-</Callout>
-
-## What this panel shows
-
-<Cards>
-  <Card title="Two planes" description="Operators and application users never mix." />
-  <Card title="Key creation" description="Value shown once; attenuation to creator scopes only." />
-  <Card title="Revocation" description="Blast radius plus honest JWT validity delay." />
-  <Card title="Hygiene" description="Unused keys, never-signed-in operators, expired invites." />
-</Cards>
-
-## Catalog
-
-<Cards>
-  <Card title="Dev" description="✓" />
-  <Card title="Prod" description="✓ (admin)" />
-</Cards>

package/site/content/docs/console/ai.mdx

@@ -1,35 +0,0 @@
----
-title: "AI"
-description: "Prompt versions, eval scores, cost, agent runs."
-icon: "Sparkles"
-source: "docs/spec/console.md"
----
-
-Answers: **prompt versions, eval scores, cost, agent runs**
-
-<Callout title="Governing rule">
-  Everything else in the Console is deterministic; this panel is built on distributions, not single
-  values.
-</Callout>
-
-## What this panel shows
-
-<Cards>
-  <Card title="Prompt versions" description="A version bump is Manifest Diff blast radius." />
-  <Card title="Eval + shape" description="Schema-validation failure is its own class." />
-  <Card
-    title="Agent tools"
-    description="Tools are the app’s own flows — undeclared reach is denied and shown."
-  />
-  <Card
-    title="Budgets"
-    description="Cost, semantic cache, and `allowPii` as standing review surfaces."
-  />
-</Cards>
-
-## Catalog
-
-<Cards>
-  <Card title="Dev" description="full" />
-  <Card title="Prod" description="read + budgets" />
-</Cards>

package/site/content/docs/console/architecture.mdx

@@ -1,35 +0,0 @@
----
-title: "Architecture"
-description: "How it all connects — the diagram that is the code."
-icon: "Network"
-source: "docs/spec/console.md"
----
-
-Answers: **how it all connects — the diagram that _is_ the code**
-
-<Callout title="Governing rule">
-  Flows answers “which one”; Architecture answers “what shape”. Never shows the whole system by
-  default.
-</Callout>
-
-## What this panel shows
-
-<Cards>
-  <Card title="Unit clusters" description="Default aggregated edges; focus one or two hops." />
-  <Card title="Element layers" description="Toggle data, messaging, time, external edges." />
-  <Card
-    title="Live traffic"
-    description="Edge thickness from real traffic; dashed = never traversed."
-  />
-  <Card
-    title="Pathologies"
-    description="Cycles, god nodes, orphan signals, SPOFs — computed from the graph."
-  />
-</Cards>
-
-## Catalog
-
-<Cards>
-  <Card title="Dev" description="✓" />
-  <Card title="Prod" description="✓" />
-</Cards>

package/site/content/docs/console/channels.mdx

@@ -1,37 +0,0 @@
----
-title: "Channels"
-description: "Templates, delivery receipts, bounces, opt-outs."
-icon: "Mailbox"
-source: "docs/spec/console.md"
----
-
-Answers: **templates, delivery receipts, bounces, opt-outs, deliverability (SPF/DKIM/DMARC)**
-
-<Callout title="Governing rule">
-  Suppression is not failure — the taxonomy of “did not arrive” has seven states with verdicts.
-</Callout>
-
-## What this panel shows
-
-<Cards>
-  <Card title="Dev inbox" description="`console` driver lands every medium locally." />
-  <Card
-    title="Deliverability"
-    description="SPF/DKIM/DMARC, bounces, complaints, suppression list."
-  />
-  <Card
-    title="Fallback chains"
-    description="Recorded as chains (e.g. WhatsApp → SMS), not single outcomes."
-  />
-  <Card
-    title="Locale previews"
-    description="Template data bound to schema; RTL-accurate previews."
-  />
-</Cards>
-
-## Catalog
-
-<Cards>
-  <Card title="Dev" description="full + console inbox" />
-  <Card title="Prod" description="send test, inspect delivery" />
-</Cards>

package/site/content/docs/console/clock.mdx

@@ -1,51 +0,0 @@
----
-title: "Clock"
-description: "Upcoming crons, sleeping durable flows, journal."
-icon: "Clock"
-source: "docs/spec/console.md"
----
-
-Answers: **upcoming crons, sleeping durable flows, journal**
-
-<Callout title="Governing rule">
-  Looks like time — a forward timeline for schedules and pending wakes, not a flat grid.
-</Callout>
-
-## What this panel shows
-
-<Cards>
-  <Card title="Schedules" description="Drift, overdue, missed runs · catch-up one, lease holder." />
-  <Card title="Pending wakes" description="Every sleeping durable flow and when it wakes." />
-  <Card
-    title="DST warnings"
-    description="Gap or overlap badge — detect only, no schedule rewrite."
-  />
-  <Card title="Actions" description="Run now, wake early, pause; edit when overridable." />
-</Cards>
-
-## Health numbers
-
-Each cron row projects four numbers plus the lease holder:
-
-| Field           | Meaning                                                           |
-| --------------- | ----------------------------------------------------------------- |
-| Drift           | How far the last run sat from the expected slot                   |
-| Overdue         | Whether the schedule is past due                                  |
-| Missed + policy | Slot count while down · always catch-up `"one"` (one fire, not N) |
-| Lease           | Which instance holds the leader lease (empty when none)           |
-
-## Actions
-
-| Action        | When                                                                   |
-| ------------- | ---------------------------------------------------------------------- |
-| Pause         | Any cron — not gated by `overridable`                                  |
-| Edit schedule | Only when the declaration has `overridable: true`; else loud refuse    |
-| Wake early    | Sleeping durable run — advances `wakeAt` and can resume the journal    |
-| Run now       | Still requires the leader lease across replicas that share a CronStore |
-
-## Catalog
-
-<Cards>
-  <Card title="Dev" description="full" />
-  <Card title="Prod" description="trigger/pause; edit if `overridable`" />
-</Cards>