fix(tuval): cron is opt-in — the box config no longer starts a token-spending job by default

[cansirin]

cron (#9226) shipped stated ON in apps/tuval/.tuval/tuval.config.ts, and its node is planned, so
anyone who ran pnpm dev in apps/tuval got a scheduler standing up at boot and spending Claude
tokens every ten minutes without opting in. A row whose job costs money is a row you ask for, the
way prReviewExample is.

features.cron is false in this layer now. The comments that justified default-on state the
opt-in instead — the file header, the cronJob docblock and the row's own comment: flip the line,
restart the desk, and the row, its graph node and :cron run appear. src/features.ts already
declared the key off; its docblock no longer claims this repo's config flips it on, since it no
longer does.

src/boot.unit.test.ts goes back to its pre-#9226 shape: 8 program(s), 3 process(es), no
CRON_SPELLS in BOX_SPELLS, no process cron … line, and the case name that names three
processes rather than four. Cron's own coverage is untouched in src/cron/cron.unit.test.ts — all
28 cases, including the "puts the job on the row's fill" and :cron run ones — except its single
registration case, which pinned config.features?.cron === true and now pins the off default and
the absence of the row and its graph node.

No boot case proves the row with the flag on, and that is a real gap rather than one this PR could
close cheaply: boot.unit.test.ts boots the checked-in .tuval/tuval.config.ts by path through the
bin (--config <boxConfig>), so there is no copy of the config to flip a flag on. The on-path proof
stays where it was strongest anyway — cron.unit.test.ts drives the row's tick, spawn, fill, prompt
and result cells directly against a live claudeSession row.

Gates from apps/tuval at this head: pnpm typecheck 0 errors; npx biome check .tuval src/boot.unit.test.ts src/features.ts src/cron/cron.unit.test.ts — Checked 4 files. No fixes applied.; pnpm vitest run --project unit — Test Files 323 passed (323) / Tests 3385 passed (3385). (An earlier run of the same head flaked on the known attached-desk.unit.test.tsx › closes on Escape; the run above is the clean one.) The boot case is the end-to-end proof of the default:
8 program(s) … 3 process(es) live and no cron process line. No Claude tokens were spent.

src/config.unit.test.ts and src/page/dev-server.unit.test.ts enumerate the flag keys, not their
values, and are unchanged and green.

Reviewer's first stop: the features block and its three comments in
apps/tuval/.tuval/tuval.config.ts.

This off default reverses criteria 6 and 7 of #9225, which is closed and cannot take a new row;
#9248 is the contract it is graded against instead, and this PR closes it.

Deviations

• Leave-alone file edited — Said: src/features.ts is leave-alone, and the cron: false
  line is untouched. Did: two lines of its docblock were rewritten; they said the flag is
  "flipped on by this repo's own config". Why: this PR makes that claim false, and a docblock
  that lies about the config is worse than a file left pristine. Disposition: rewritten to
  state the opt-in default; the declaration, the featuresDefault entry and the ADR 0375 row-flag
  reference are unchanged.
• Pre-existing boot assertion removed — Said: src/boot.unit.test.ts:262 asserted the
  process cron … line in the boot output, and the case name that names four processes.
  Did: that assertion is gone; the file reverts to its pre-feat(tuval): cron wakes on a timer, starts a job program and reports the run on its tile #9226 shape — 8 program(s),
  3 process(es), no CRON_SPELLS in BOX_SPELLS. Why: the default reversed on purpose, so a
  box boot no longer launches cron and the old line cannot appear. Disposition: replaced by
  assertions pinning the off box — the program and process counts, the absent CRON_SPELLS and the
  absent cron process line are now the end-to-end proof of the off default. No boot case proves the
  row with the flag on; the bin boots the checked-in config by path, so there is no copy to flip —
  filed as No boot case proves the Tuval cron row with its flag flipped on #9249, non-blocking here.
• Three pre-existing registration assertions removed — Said:
  src/cron/cron.unit.test.ts:360-362 asserted config.features?.cron === true and that the row
  list and the graph node list each toContain("cron"). Did: all three are replaced with their
  negations. Why: the default reversed on purpose; those three pinned default-on and would now
  be false. Disposition: the replacement assertions pin the off default — features.cron not
  true, no cron row, no cron graph node. The other 27 cases in the file are untouched and stay
  the on-path proof: tick, spawn, fill, prompt, result and :cron run still drive a live
  claudeSession row.
• Linked issue changed mid-flight — Said: this PR was opened as Part of #9225.
  Did: it links Fixes #9248 instead. Why: Tuval has no scheduler: a cron program on defineProgram that starts a job program on a timer and reports each run on its tile #9225's criteria 6 and 7 state the on default,
  which this PR reverses, and the issue is closed so the new default cannot be appended there.
  Disposition: Tuval's cron row is flipped to opt-in with no criterion stating the off default #9248 carries the off-default contract — config cron: false, the flip-on
  restore of row, node and :cron run, the boot test pinning the off box, and cron's unit tests
  pinning the off default while remaining the on-path proof. Tuval has no scheduler: a cron program on defineProgram that starts a job program on a timer and reports each run on its tile #9225 stays the history and is cited
  in prose above, not as a second link line.

Fixes #9248

Base is main

[github-actions]

🚀 Preview deployed

• web — Stage pr-9247 torn down.

[cansirin]

review-code: PASS @ 1ed5896 content:2b5f55fce292 — merge-ready

Graded against #9248 (fixes, open). CI at head: settled / green (45 runs, 39 success, 6 skipped; 28 of 40 authored workflows ran). Body-only repair round at the same head: the prior FAIL's two blocking findings (malformed ## Deviations, undisclosed removed assertions) are closed by the rewritten body, and the third (no contract for the off default) is closed by linking #9248, whose five criteria state it.

Per-criterion

#	Criterion	Verdict	Evidence
1	tuval.config.ts sets features.cron: false; pnpm dev stands up no scheduler	PASS	.tuval/tuval.config.ts:74 const features = {prReviewExample: false, cron: false}; boot.unit.test.ts:245 asserts 8 program(s) … 3 process(es) live booting that config through the bin
2	Row stays registered behind the toggle; one-line flip restores row, graph node and :cron run	PASS	.tuval/tuval.config.ts:126 ...(features.cron ? [cronJob] : []), :136 ...(features.cron ? [{id: cronNode, program: cronJob.id, on: []}] : []); both gates unchanged by this diff, and cron.ts is not in the diff. The spell comes off the row's own commands, so registering the row registers :cron run
3	features.ts keeps cron on TuvalFeatures / featuresDefault with the ADR 0375 docblock, stating the off default	PASS	features.ts:69-79 declaration and ADR 0375 text unchanged; :74-75 now read "Declared off here and left off by this repo's own config"; featuresDefault.cron: false at :97 unchanged
4	boot.unit.test.ts pins the off box end to end	PASS	boot.unit.test.ts:36 BOX_SPELLS drops CRON_SPELLS; :245 and :271 assert 8 program(s) / 3 process(es); the process cron … assertion is removed and nothing in the case matches it
5	cron.unit.test.ts registration case pins the off default; the rest stays the on-path proof	PASS	cron.unit.test.ts:363-366 asserts features?.cron is false, no cron row, no cron graph node; the other 27 cases (tick, spawn, fill, prompt, result, :cron run) are outside the diff and still drive a live claudeSession row

Standing checks

• Test honesty: the four removed assertions are replaced by their negations pinning the new stated default, not rewritten against the implementation. All four are disclosed as deviation entries.
• Release containment: behaviour is flag-gated default-off; the header, cronJob docblock and row comment each state it, and the diff matches.
• Comment discipline: the row comment at .tuval/tuval.config.ts:123-125 restates the token-spend reason the header already gives — nit, not a finding.
• Staleness traps: none introduced.

Fan-out

• Silent-failure: none — config value and comments only.
• Type-design: none.
• Test-gap: no boot case proves the row with the flag on. Out of Tuval's cron row is flipped to opt-in with no criterion stating the off default #9248's scope, already filed as No boot case proves the Tuval cron row with its flag flipped on #9249; non-blocking.

Deviations

Entry	Substance	Matched to
Leave-alone file edited	features.ts:74-75 docblock	seen in diff
Pre-existing boot assertion removed	boot.unit.test.ts:262 process cron … line	verb's tier-m flag at :262
Three registration assertions removed	cron.unit.test.ts:360-362	verb's tier-m flags at :360-362
Linked issue changed mid-flight	Part of #9225 → Fixes #9248	scope reads fixes:9248

deviation-disclosure: PASS — nothing undisclosed that this gate could see.

Note for the record: #9248 carries status:needs-triage at post time. Its criteria block is well-formed and is what this verdict binds to; the label is not a fact this gate grades.

Verdict-written: 2026-09-15T20:24:10Z

Superseded verdict — 2026-09-15

review-code: FAIL @ 1ed5896 content:2b5f55fce292 — deviations section malformed; opt-in default has no contract row

Graded against #9225 (part-of, closed). CI at head: settled / green (45 runs, 39 success, 6 skipped; 28 of 40 authored workflows ran).

Findings

1. Deviations disclosure is malformed. fabrika review deviations reads the ## Deviations section and finds no - entry — the section is a paragraph. Per the gate, absent-or-malformed fails closed. Repair: restate the disclosure as bullet entries.
2. Four removed assertions are not disclosed as deviations. The verb flags boot.unit.test.ts:262 (the process cron … boot line) and cron.unit.test.ts:360-362 (features.cron === true, row and node toContain("cron")). The body describes them above the section, but the Deviations section names only the features.ts docblock. The tests were not rewritten against the implementation — they pin the new default honestly — but a deleted pre-existing assertion is a disclosure the section owes.
3. The opt-in default reverses criteria 6 and 7 with no contract stating it. Criterion 6 reads "pnpm dev boots with it on, and one real tick lands a run"; criterion 7 says boot.unit.test.ts is updated for the extra program. This diff undoes both. append-criterion 9225 refuses (issue closed), so the finding is filed as Tuval's cron row is flipped to opt-in with no criterion stating the off default #9248 — link that issue (or its triaged successor) so the next round grades the off default against something.
4. Test gap, named in the body: no boot case proves the row with the flag on. Filed as No boot case proves the Tuval cron row with its flag flipped on #9249, non-blocking here.

Per-criterion

#	Criterion	Verdict	Evidence
1	cron(options) on defineProgram, fill at definition	N/A	not claimed by this diff; unchanged from #9226
2	tick spawns, prompts, records, stops	N/A	not claimed by this diff
3	restored cron with dead child records interrupted	N/A	not claimed by this diff
4	title@1/status@1 ports	N/A	not claimed by this diff
5	:cron run command cell	N/A	not claimed by this diff
6	config registers cron behind a toggle; pnpm dev boots with it on; one real tick lands ok: true	FAIL	tuval.config.ts:74 sets cron: false; the register-behind-toggle half holds (tuval.config.ts:126), the boots-with-it-on half is reversed by design with no criterion authorising it (#9248)
7	cron.unit.test.ts covers the cells; boot.unit.test.ts updated for the extra program, process and spell	FAIL	boot.unit.test.ts reverts to 8 programs / 3 processes and drops CRON_SPELLS; the cell coverage half stays (unchanged cases), the boot half is removed
8	cron declared on TuvalFeatures / featuresDefault with the ADR 0375 docblock	PASS	features.ts:74-77 keeps the declaration; only the docblock's two lines change, and they now state what the config does

Standing checks

• Test honesty: assertions deleted, not inverted against the implementation — see finding 2 for the disclosure gap.
• Release containment: behaviour is now flag-gated default-off, and the diff matches the statement in all three comments.
• Comment discipline: the rewritten header, cronJob docblock and row comment each state the token-spend rationale; the row comment repeats the header's reason a third time (nit, not a finding).
• Staleness traps: none introduced.

Deviations

Entry	Substance	Matched to
features.ts docblock rewritten though listed leave-alone	docblock lines 74-75	seen in diff; disclosed in prose, not as an entry (finding 1)
—	four removed assertions	undisclosed (finding 2)

deviation-disclosure: FAIL (malformed section; undisclosed removed assertions).

Verdict-written: 2026-09-15T20:19:22Z

[cansirin]

routed-elsewhere: review-ui @ 1ed5896 — flag default and docblocks only — no component, style or composition changed, nothing renders differently

Four files changed; the one raising the ui class is apps/tuval/src/features.ts, and its delta is two JSDoc lines in the cron flag's docblock — the readonly cron: boolean declaration and its default are untouched.

The remaining three are outside the rendered surface entirely: apps/tuval/.tuval/tuval.config.ts flips features.cron from true to false and rewrites three comments (not under a declared uiSurfaces prefix); apps/tuval/src/boot.unit.test.ts and apps/tuval/src/cron/cron.unit.test.ts re-pin the boot output and registration case to the off default.

No component, stylesheet, token or composition file is in the range. The five declared tuval uiSurfaces (board, chat, picker, pi-window, pi-vertical) are fixture-driven vite proofs that do not read .tuval/tuval.config.ts, so none of them renders differently at this head; the only observable effect is that a desk booted from the box config plans one fewer process, which the unchanged board renders through the same tile code as before. Text and test judgment is review's lane (review-code PASS already stands at this head).

LAW-SOURCE: manifest-prose (untyped registry, exit 13) — consulted, no row engaged because no pixels moved.