Summary

Operator-side view of disaster recovery + substrate epoch state. What Joshua checks when a PITR happens — confirms gate 3b fired, the epoch mismatch was detected, Kora paused safely, and walks the operator through the post-PITR `substrate_epoch` bump runbook.

Operationally critical when DR happens; lives quietly when it doesn't — the red DR alert is suppressed in the default clean-state render so the panel is unobtrusive in normal operation. Pairs with CC#1's in-flight KR-P2-M (DR/epoch consumer).

8th admin panel in the proven stub-first pattern (predecessors: #26 OPS, #31 SEA, #37 CONTROL, #45 BOOT, #49 COST, #52 CAP, #54 HEALTH).

Endpoint (kora_cli/web_server.py)

`GET /api/dr-state` — read-only stub. Returns:

Enums: `match_status` ∈ `{clean, mismatch_detected, pending_runbook, unknown}`; `source` ∈ `{boot-success, dr-recovery, operator-bump}`.

No POST/PUT/DELETE — the post-PITR `substrate_epoch` bump is an OS-level operator action (Fly secret + `flyctl restart`). This panel SURFACES the need + points at the runbook docs; it does not execute the runbook.

Frontend (web/)

• `pages/DRStatePage.tsx`
  • DR alert banner — red top-of-page, ONLY renders when `runbook_pending: true`. Spells out the post-PITR steps and links to `kora_docs/15_status_and_roadmap/dr_runbook.md` (pending KR-P2-M). Default render (clean state) hides the banner entirely.
  • Current epoch card — side-by-side big-number readout: `substrate_epoch` (green when match, red when substrate advanced) + `kora_known_epoch` (green match, amber catching-up). Match-status pill with tone + `PAUSED{substrate}` pill when applicable + last-check timestamp.
  • Epoch history table — sorted epoch desc; per-entry source badge + Kora's catch-up timestamp ("not yet" when source registered but Kora hasn't caught up).
  • Recent DR events table — collapsible; default-expanded when `runbook_pending` OR epoch history shows a non-monotonic jump (a prior DR happened). Shows epoch jump, discard counts, cleared-by status with check/X icon.
• `lib/api.ts` — `DRMatchStatus` + `EpochSource` type aliases + 4 interfaces (`DRCurrent`, `EpochHistoryEntry`, `DRObservedEvent`, `DRStateResponse`).
• `App.tsx` — `/dr-state` route + nav entry (ShieldAlert icon) between `/boot-status` and `/cost-state`.

Flip-over plan

When KR-P2-M lands and `DREpochState.current()` + `.recent_dr_events()` accessors exist, swap `get_dr_state` body to project from those and drop the `stub` flag. The page itself doesn't change.

Test plan

• `tests/kora_cli/test_web_server_dr_state.py` — 8/8 green, covers all 7 §4 scenarios + extra invariant guards:
  • `runbook_pending` ⇒ `match_status != "clean"` (avoid false DR alert on healthy systems)
  • `kora_paused_substrate` ⇒ `match_status ∈ {mismatch_detected, pending_runbook}` (don't hold the pause without an active mismatch)
  • epoch sequence monotonic when sorted by `observed_at` (PITR can jump by >1 but never decrease)
  • DR event `to_epoch >= from_epoch`
  • DR event `cleared_at` and `cleared_by` always paired (both null or both set)
• `test_web_server_{health_rollup,capabilities,cost_state,boot_status,kora_control,sea_tickets,cron_profiles,host_header,mcp,gateway_identity}.py` — 99/99 still green (107 total across 11 suites)
• `npx tsc -b` on `web/` — clean
• `npx vite build` on `web/` — clean
• Manual smoke: navigate to `/dr-state`, verify default render is QUIET (clean state, no red banner, both epoch readouts green); manual-swap stub to `runbook_pending: true` + `match_status: "mismatch_detected"` + `kora_paused_substrate: true` to verify red DR alert at top + per-field tone changes correctly

Dependency notes

• KR-P2-M (CC#1, in flight) wires the runtime-side DR consumer
• `DREpochState.current()` + `.recent_dr_events()` are the accessors that flip this from stub to real

🤖 Generated with Claude Code