The cron program ships in-tree though it is a third-party program on the public authoring API

[cansirin]

Summary

apps/tuval/src/cron/ ships a scheduler program — a row that wakes on a timer, spawns a Claude
session as its job and reports the run — inside the repo that owns the kernel it is written on.
Since #9250 gave @kampus/tuval an exports map, a program written on @kampus/tuval/authoring
no longer needs to live here to be installable. cron is now published outside this repo as
@cansirin/tuval-cron, so the in-tree copy is a second source of the same program.

What I was doing

Reading apps/tuval/src/authoring/index.ts after #9250 landed. Its docblock says the public set was
read off "the two programs in this repo that are written the way a third party writes one" — the
worked pr-review example and ../cron/cron.ts — and then names packages/tuval-cron as the first
outside consumer that found each name by failing to compile without it.

What I observed

• src/cron/cron.ts (328 lines) is a product feature: a cadence, a prompt, a status line, a ten-run
  history, a :cron run spell. None of it is kernel.
• It is default-off in every layer — features.cron is false in src/features.ts and in
  .tuval/tuval.config.ts (fix(tuval): cron is opt-in — the box config no longer starts a token-spending job by default #9247) — so a box desk boots 8 programs and never carries it. It is
  dead weight in the shipped desk.
• Everything the row actually taught the kernel already landed in the kernel: shapeOf over a
  compiled row (A shipped program row cannot satisfy a Program.shape arg: the compiled row erases its port schemas #8887/fix(tuval): a compiled row publishes its port schemas, so a shaped arg can be filled (#8887) #8959), a shaped arg's fill resolving at spawn (A spawn on a program-valued arg looks up the arg's service key as a program id #8762), child-exit delivery
  (feat(tuval): a child's end reaches its spawner, from one producer #9229), launch enrolling graph nodes in SpawnedProcesses (feat(tuval): one process table, so a graph-launched process answers the process spells #9230/process send cannot reach a graph-launched process: only ad-hoc spawns are addressable #8944), and the authoring
  door itself (feat(tuval): the authoring API has a door — three subpaths a consumer outside this repo can import #9250).
• The docblocks in src/authoring/index.ts, src/authoring/public-surface.unit.test.ts and
  src/sessions.ts cite cron as the example consumer, so removing the program without rewording
  them would leave dangling references.

Why it matters

The repo that owns an API should not also own the products written on it — the example consumer and
the API cannot be graded against each other when they share a tree, and the default-off row is 700+
lines of test and source a reader has to walk past to reach the kernel. The kernel behaviours cron
drove are the valuable part; they belong to the kernel's own test files, where they are proved
against fixtures rather than against one product's cells.

Pointers

• apps/tuval/src/cron/cron.ts, cron.unit.test.ts, cron-run.unit.test.ts
• apps/tuval/src/features.ts — TuvalFeatures.cron, featuresDefault.cron
• apps/tuval/.tuval/tuval.config.ts — the header comment, features.cron, cronNode, cronJob
• apps/tuval/src/authoring/index.ts, src/authoring/public-surface.unit.test.ts,
  src/sessions.ts — docblocks that name cron
• apps/tuval/README.md — "The public API"

Suggested next step

Delete apps/tuval/src/cron/ and its flag, move the kernel proofs its tests carried into the kernel
test files that own those behaviours, and name @cansirin/tuval-cron in the README as the
out-of-tree consumer of the authoring door.

Acceptance criteria

• apps/tuval/src/cron/ is gone, and with it TuvalFeatures.cron, featuresDefault.cron, the cron row / graph node / features.cron flag in apps/tuval/.tuval/tuval.config.ts, and the cron: false entries in the fixtures that enumerate flags (src/config.unit.test.ts, src/page/dev-server.unit.test.ts)
• The graph-launched reach proof (a compiled command's bare send reaches a graph-launched process; from cron-run.unit.test.ts, feat(tuval): one process table, so a graph-launched process answers the process spells #9230/process send cannot reach a graph-launched process: only ad-hoc spawns are addressable #8944) is ported onto a fixture program in src/authoring/own-process.unit.test.ts
• The shipped-row shape proof (a live claudeSession row fits a declared shape and fills a program-valued arg; from cron.unit.test.ts, A shipped program row cannot satisfy a Program.shape arg: the compiled row erases its port schemas #8887/fix(tuval): a compiled row publishes its port schemas, so a shaped arg can be filled (#8887) #8959) is ported into src/authoring/args.unit.test.ts, calling the shipped claudeSession factory
• Fill-resolves-at-spawn (A spawn on a program-valued arg looks up the arg's service key as a program id #8762) and child-exit delivery (feat(tuval): a child's end reaches its spawner, from one producer #9229/An authored spawner never hears an unsolicited child exit: stopped is only ever the answer to its own stop effect #9227) are stated as already covered by src/authoring/define-program.unit.test.ts, with nothing moved
• A box boot reports 8 program(s) and no HandlerFailed
• No dangling cron reference: grep -rn "cron" apps/tuval returns nothing that points at a program this repo no longer ships
• apps/tuval/README.md's "The public API" names @cansirin/tuval-cron as the out-of-tree consumer