@cat-factory/app 0.217.2 → 0.219.0

package/app/components/board/BoardCanvas.vue

@@ -20,6 +20,9 @@ const execution = useExecutionStore()
 const ui = useUiStore()
 const github = useGitHubStore()
 const toast = useToast()
+// The drop resolves its target task at the moment of the drop, so the sandbox reading is a
+// function of that id rather than a computed over a bound block.
+const { forcedFor } = useDryRunPolicy()
 const access = useWorkspaceAccess()
 const { t } = useI18n()
 
@@ -184,6 +187,18 @@ async function onDrop(event: DragEvent) {
       })
       return
     }
+    // A dropped pipeline starts live and has nothing to ask for, but a preset that sandboxes the
+    // dropper's role means this run merges nothing. Said HERE, because the drop is the only
+    // moment this surface has: the ordinary start stays silent (it is already visible on the
+    // card it landed on), and only the sandbox, which is not, earns a toast.
+    if (forcedFor(target.id)) {
+      toast.add({
+        title: t('board.dryRunToast.title'),
+        description: t('board.dryRunToast.body', { name: pipeline.name }),
+        color: 'warning',
+        icon: 'i-lucide-shield',
+      })
+    }
     execution.start(target.id, pipeline)
     ui.select(target.id)
   }

package/app/components/board/nodes/TaskCard.vue

@@ -36,6 +36,13 @@ const typeBadge = computed(() => {
 })
 const selected = computed(() => ui.selectedBlockId === props.taskId)
 
+// This card's Start is a ONE-TAP live start, so it has nothing to ask for and offers no dry-run
+// request. What it does owe the reader is the half that is not a choice: a preset that sandboxes
+// their role means this button opens a pull request and merges nothing, and a card that said so
+// only after the fact would leave that to be discovered from a run that stops at the merge.
+const { forcedFor } = useDryRunPolicy()
+const sandboxed = computed(() => forcedFor(props.taskId))
+
 // Drag-to-connect: dragging from this card's handle onto another task makes THAT task
 // depend on this one (this is the prerequisite). The composable tracks the gesture.
 const { start: startConnect } = useDependencyConnect()
@@ -106,12 +113,16 @@ async function run() {
   const started = await execution.start(props.taskId, pipeline)
   if (started) {
     // Confirm the (optimistic) start landed — the button unmounts once the stream pushes
-    // in_progress, so without this the successful action gives no feedback.
+    // in_progress, so without this the successful action gives no feedback. A sandboxed start
+    // says so here rather than borrowing the live wording: this is the moment the reader learns
+    // what they just started, and the two runs differ in what they will end up doing.
     toast.add({
-      title: t('board.task.startedToast.title'),
-      description: t('board.task.startedToast.body', { name: pipeline.name }),
-      color: 'success',
-      icon: 'i-lucide-play',
+      title: sandboxed.value ? t('board.dryRunToast.title') : t('board.task.startedToast.title'),
+      description: sandboxed.value
+        ? t('board.dryRunToast.body', { name: pipeline.name })
+        : t('board.task.startedToast.body', { name: pipeline.name }),
+      color: sandboxed.value ? 'warning' : 'success',
+      icon: sandboxed.value ? 'i-lucide-shield' : 'i-lucide-play',
     })
   } else {
     starting.value = false
@@ -357,15 +368,19 @@ function selectTask() {
           :color="runnable ? 'primary' : 'neutral'"
           variant="soft"
           size="xs"
-          :icon="runnable ? 'i-lucide-play' : 'i-lucide-lock'"
+          :icon="!runnable ? 'i-lucide-lock' : sandboxed ? 'i-lucide-shield' : 'i-lucide-play'"
           :loading="starting"
           :disabled="!runnable || starting"
           :title="
-            runnable
-              ? t('board.task.startPipeline', {
-                  name: defaultPipeline?.name ?? t('board.task.pipelineFallback'),
-                })
-              : t('board.task.waitingOn', { deps: unmet.map((d) => d.title).join(', ') })
+            !runnable
+              ? t('board.task.waitingOn', { deps: unmet.map((d) => d.title).join(', ') })
+              : sandboxed
+                ? t('board.task.startPipelineDryRun', {
+                    name: defaultPipeline?.name ?? t('board.task.pipelineFallback'),
+                  })
+                : t('board.task.startPipeline', {
+                    name: defaultPipeline?.name ?? t('board.task.pipelineFallback'),
+                  })
           "
           @click.stop="run"
         >

package/app/components/focus/BlockFocusView.vue

@@ -47,10 +47,16 @@ const runOptions = computed(() => {
   )
 })
 
+// The run MODE, shared with the inspector's Run menu so the two surfaces offer (and force) the
+// same thing. The toggle sits beside the picker rather than inside it because the picker's rows
+// START a run on click: a modifier reachable only by opening the list would be one the user has
+// to arm and re-open the menu to use.
+const runStart = useRunStart(() => block.value?.id)
+
 /** Start the picked pipeline immediately — the Run menu chooses an ACTION, it stores no default. */
 function runPipeline(id: string) {
   const pipeline = pipelines.getPipeline(id)
-  if (pipeline && block.value) void execution.start(block.value.id, pipeline)
+  if (pipeline && block.value) void runStart.start(pipeline)
 }
 
 /**
@@ -136,6 +142,28 @@ function openApprovalFor(approvalId: string) {
         >
           {{ t('initiative.inspector.runPlanning') }}
         </UButton>
+        <!-- A sandboxed role cannot ask its way out, so the badge REPLACES the toggle rather
+             than sitting beside it as a switch that does nothing. -->
+        <UBadge
+          v-if="!isInitiative && runStart.forced.value"
+          color="warning"
+          variant="subtle"
+          size="sm"
+          icon="i-lucide-shield"
+          :title="t('focus.dryRunForcedHint')"
+          data-testid="focus-dry-run-forced"
+        >
+          {{ t('focus.dryRun') }}
+        </UBadge>
+        <USwitch
+          v-else-if="!isInitiative && runStart.canRequest.value"
+          :model-value="runStart.requested.value"
+          size="sm"
+          :label="t('focus.dryRun')"
+          :title="t('focus.dryRunHint')"
+          data-testid="focus-dry-run"
+          @update:model-value="runStart.setRequested($event)"
+        />
         <!-- The rich picker rather than a list of names: the run starts the moment a row is
              clicked, so the preview is the only chance to see which agents it will run. -->
         <PipelinePicker

package/app/components/layout/AccountFailureKindRules.vue

@@ -0,0 +1,285 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import type { AgentFailureKind, PlatformFailureKindRule } from '~/types/execution'
+import {
+  AGENT_FAILURE_KINDS,
+  FAILURE_KIND_KEYS,
+  failureKindRuleFaults,
+  isAgentFailureKind,
+  MAX_FAILURE_KIND_RULES,
+} from '~/utils/failureKinds'
+
+// The per-failure-kind alert rules of the platform-health sheet: "page when `evicted` reaches
+// 5% of the window's failures". Its own component because it edits a LIST where
+// its parent edits scalars, and the two have different notions of what an override is.
+//
+// That difference is the whole of this file. A scalar override is per field: leave the box
+// empty and that one ceiling inherits. A list cannot work that way — merging rule by rule would
+// let an account retune a deployment rule but never DROP one, and silently reinstating a rule an
+// operator deleted is the worse failure for something wired to a pager. So the account's list
+// REPLACES the deployment's, which makes "no rules at all" a setting somebody can choose, and
+// makes it indistinguishable from "inherit" unless the two are asked separately. Hence the
+// explicit override switch: off omits the field, on sends the list, empty included.
+
+const props = defineProps<{
+  /** The account's rules, or undefined when it inherits the deployment's. */
+  modelValue: PlatformFailureKindRule[] | undefined
+}>()
+const emit = defineEmits<{ 'update:modelValue': [PlatformFailureKindRule[] | undefined] }>()
+
+const { t } = useI18n()
+
+const overriding = computed(() => props.modelValue !== undefined)
+const rules = computed(() => props.modelValue ?? [])
+
+/**
+ * The kinds offered for a row: the known vocabulary, plus whatever this row already names.
+ *
+ * The second half matters on exactly the row that would otherwise lose data. A rule stored
+ * against a kind a later release RETIRED still parses (the contract keeps the field a string so
+ * one stale rule cannot take the account's whole settings row down with it), so it reaches this
+ * editor, and a select that only offered current members would silently re-point it at the first
+ * one the moment anything else on the sheet was saved. It is offered back, marked unrecognised,
+ * so the human decides whether to re-pick it or drop it.
+ */
+function kindItems(current: string) {
+  const known = AGENT_FAILURE_KINDS.map((kind) => ({
+    label: t(FAILURE_KIND_KEYS[kind]),
+    value: kind as string,
+  }))
+  if (current === '' || isAgentFailureKind(current)) return known
+  return [
+    ...known,
+    {
+      label: t('settings.platformAlerts.failureKinds.unknownKind', { kind: current }),
+      value: current,
+    },
+  ]
+}
+
+/** The kinds already spoken for, so the UI can say which row is the duplicate. */
+const duplicateKinds = computed(() => {
+  const seen = new Set<string>()
+  const dupes = new Set<string>()
+  for (const rule of rules.value) {
+    if (seen.has(rule.kind)) dupes.add(rule.kind)
+    seen.add(rule.kind)
+  }
+  return dupes
+})
+
+/** A share is edited in PERCENT, which is how the rule is spoken ("5% or more"), stored 0..1. */
+function sharePercent(rule: PlatformFailureKindRule): number {
+  return Math.round(rule.maxShare * 1000) / 10
+}
+
+function setOverriding(on: boolean) {
+  // Turning the override ON starts from the empty list rather than a seeded row: an editor that
+  // invented a rule would have the human deleting a page they never asked for.
+  emit('update:modelValue', on ? [] : undefined)
+}
+
+function patch(index: number, next: Partial<PlatformFailureKindRule>) {
+  emit(
+    'update:modelValue',
+    rules.value.map((rule, i) => (i === index ? { ...rule, ...next } : rule)),
+  )
+}
+
+function setShare(index: number, raw: string) {
+  const percent = Number(raw.trim())
+  // A blank or unreadable box is left at zero rather than dropped: `maxShare` has no "unset"
+  // (a rule without a ceiling is not a rule), and 0 is refused by the contract, so an incomplete
+  // row is REPORTED by `faults` below instead of being quietly discarded on save.
+  patch(index, { maxShare: Number.isFinite(percent) ? percent / 100 : 0 })
+}
+
+function setMinCount(index: number, raw: string) {
+  const trimmed = raw.trim()
+  if (trimmed === '') {
+    const { minCount: _dropped, ...rest } = rules.value[index]!
+    emit(
+      'update:modelValue',
+      rules.value.map((rule, i) => (i === index ? rest : rule)),
+    )
+    return
+  }
+  const parsed = Number(trimmed)
+  patch(index, { minCount: Number.isFinite(parsed) ? Math.round(parsed) : 1 })
+}
+
+/**
+ * The first kind nothing has claimed, or undefined once every one is spoken for.
+ *
+ * Undefined is what DISABLES the add button, rather than seeding a duplicate of the first kind
+ * and letting the duplicate warning explain it afterwards: at most one rule per kind is the
+ * contract, so a row the editor can only add in a state the contract refuses is a row it should
+ * not offer. It also puts the list's cap out of reach by construction — the vocabulary is far
+ * shorter than `MAX_FAILURE_KIND_RULES`, so unique-by-kind is the binding limit.
+ */
+const nextFreeKind = computed<AgentFailureKind | undefined>(() => {
+  const taken = new Set(rules.value.map((rule) => rule.kind))
+  return AGENT_FAILURE_KINDS.find((kind) => !taken.has(kind))
+})
+
+function addRule() {
+  const kind = nextFreeKind.value
+  if (kind === undefined) return
+  emit('update:modelValue', [...rules.value, { kind, maxShare: 0.05 }])
+}
+
+function removeRule(index: number) {
+  emit(
+    'update:modelValue',
+    rules.value.filter((_, i) => i !== index),
+  )
+}
+
+/**
+ * What the backend would refuse about this list. The same helper the parent's save path calls,
+ * so what the sheet flags and what the save stops on cannot disagree.
+ */
+const faults = computed(() => failureKindRuleFaults(rules.value))
+</script>
+
+<template>
+  <div class="space-y-2" data-testid="platform-alert-failure-kinds">
+    <label class="text-[11px] font-medium text-slate-300">
+      {{ t('settings.platformAlerts.failureKinds.label') }}
+    </label>
+    <p class="text-[11px] text-slate-400">
+      {{ t('settings.platformAlerts.failureKinds.description') }}
+    </p>
+
+    <div class="space-y-1">
+      <UCheckbox
+        :model-value="overriding"
+        size="sm"
+        :label="t('settings.platformAlerts.failureKinds.overrideLabel')"
+        data-testid="platform-alert-failure-kinds-override"
+        @update:model-value="setOverriding(!!$event)"
+      />
+      <p class="ps-6 text-[11px] text-slate-400">
+        {{ t('settings.platformAlerts.failureKinds.overrideHint') }}
+      </p>
+    </div>
+
+    <template v-if="overriding">
+      <p
+        v-if="rules.length === 0"
+        class="text-[11px] text-slate-500"
+        data-testid="platform-alert-failure-kinds-empty"
+      >
+        {{ t('settings.platformAlerts.failureKinds.empty') }}
+      </p>
+
+      <div
+        v-for="(rule, index) in rules"
+        :key="index"
+        class="grid grid-cols-1 items-end gap-2 sm:grid-cols-[2fr_1fr_1fr_auto]"
+        :data-testid="`platform-alert-failure-kind-row-${index}`"
+      >
+        <div class="space-y-1">
+          <label class="block text-[11px] text-slate-300">
+            {{ t('settings.platformAlerts.failureKinds.kindLabel') }}
+          </label>
+          <USelect
+            :model-value="rule.kind"
+            :items="kindItems(rule.kind)"
+            value-key="value"
+            size="sm"
+            :data-testid="`platform-alert-failure-kind-${index}`"
+            @update:model-value="patch(index, { kind: String($event) })"
+          />
+        </div>
+        <div class="space-y-1">
+          <label class="block text-[11px] text-slate-300">
+            {{ t('settings.platformAlerts.failureKinds.shareLabel') }}
+          </label>
+          <UInput
+            :model-value="String(sharePercent(rule))"
+            type="number"
+            step="1"
+            size="sm"
+            :data-testid="`platform-alert-failure-share-${index}`"
+            @update:model-value="setShare(index, String($event))"
+          />
+          <p v-if="index === 0" class="text-[11px] text-slate-500">
+            {{ t('settings.platformAlerts.failureKinds.shareHint') }}
+          </p>
+        </div>
+        <div class="space-y-1">
+          <label class="block text-[11px] text-slate-300">
+            {{ t('settings.platformAlerts.failureKinds.minCountLabel') }}
+          </label>
+          <UInput
+            :model-value="rule.minCount === undefined ? '' : String(rule.minCount)"
+            type="number"
+            step="1"
+            size="sm"
+            :placeholder="t('settings.platformAlerts.failureKinds.minCountPlaceholder')"
+            :data-testid="`platform-alert-failure-min-count-${index}`"
+            @update:model-value="setMinCount(index, String($event))"
+          />
+        </div>
+        <UButton
+          color="neutral"
+          variant="subtle"
+          size="xs"
+          icon="i-lucide-trash-2"
+          :aria-label="t('settings.platformAlerts.failureKinds.removeRule')"
+          :data-testid="`platform-alert-failure-remove-${index}`"
+          @click="removeRule(index)"
+        />
+      </div>
+
+      <p
+        v-if="faults.tooMany"
+        class="text-[11px] text-amber-300"
+        data-testid="platform-alert-failure-kinds-too-many"
+      >
+        {{
+          t('settings.platformAlerts.failureKinds.tooManyRules', { max: MAX_FAILURE_KIND_RULES })
+        }}
+      </p>
+      <p
+        v-else-if="duplicateKinds.size > 0"
+        class="text-[11px] text-amber-300"
+        data-testid="platform-alert-failure-kinds-duplicate"
+      >
+        {{ t('settings.platformAlerts.failureKinds.duplicateKind') }}
+      </p>
+      <p
+        v-else-if="faults.rows.length > 0"
+        class="text-[11px] text-amber-300"
+        data-testid="platform-alert-failure-kinds-invalid"
+      >
+        {{
+          t('settings.platformAlerts.failureKinds.invalidRows', { rows: faults.rows.join(', ') })
+        }}
+      </p>
+
+      <UButton
+        color="neutral"
+        variant="subtle"
+        size="xs"
+        icon="i-lucide-plus"
+        :disabled="nextFreeKind === undefined"
+        data-testid="platform-alert-failure-kinds-add"
+        @click="addRule"
+      >
+        {{ t('settings.platformAlerts.failureKinds.addRule') }}
+      </UButton>
+      <p
+        v-if="nextFreeKind === undefined"
+        class="text-[11px] text-slate-500"
+        data-testid="platform-alert-failure-kinds-all-covered"
+      >
+        {{ t('settings.platformAlerts.failureKinds.allKindsCovered') }}
+      </p>
+      <p class="text-[11px] text-slate-500">
+        {{ t('settings.platformAlerts.failureKinds.minCountHint') }}
+      </p>
+    </template>
+  </div>
+</template>

package/app/components/layout/AccountPlatformAlertSettings.vue

@@ -4,7 +4,14 @@ import type {
   PlatformAlertSettings,
   PlatformAlertThresholdOverrides,
   PlatformAlertWindow,
+  PlatformFailureKindRule,
 } from '~/types/execution'
+import AccountFailureKindRules from '~/components/layout/AccountFailureKindRules.vue'
+import {
+  failureKindRuleFaults,
+  hasFailureKindRuleFaults,
+  MAX_FAILURE_KIND_RULES,
+} from '~/utils/failureKinds'
 
 // Per-account tuning for the platform-health alert sweep (admin only): the ceilings the
 // deployment's aggregate run health is checked against, and the window they are evaluated over.
@@ -38,9 +45,12 @@ const windowItems = computed(() =>
 )
 
 /**
- * The numeric ceilings, each rendered as one row: the contract key plus the input's step.
+ * The NUMERIC ceilings, each rendered as one row: the contract key plus the input's step.
  * ONE table drives the form, the hydrate and the save, so adding a threshold to the contract
  * is a single entry rather than a form field plus a save branch free to disagree with it.
+ *
+ * `failureKindRules` is deliberately absent from it: it is a LIST, so it has neither a step nor
+ * a blank-means-inherit box, and it is edited by its own component below.
  */
 const THRESHOLDS = [
   { field: 'minRuns', step: 1 },
@@ -83,6 +93,10 @@ const thresholdHints = computed<Record<ThresholdField, string>>(() => ({
 const muted = ref(false)
 const alertWindow = ref<PlatformAlertWindow | ''>('')
 const values = ref<Record<ThresholdField, string>>(blankValues())
+// Undefined is "inherit the deployment's rules"; an EMPTY array is "this account has none".
+// Kept apart for the same reason blank and 0 are above, and here the two are further apart
+// still: one follows the deployment's pager wiring, the other switches it off.
+const failureKindRules = ref<PlatformFailureKindRule[] | undefined>(undefined)
 const saving = ref(false)
 
 function blankValues(): Record<ThresholdField, string> {
@@ -112,6 +126,9 @@ function hydrate() {
   const next = blankValues()
   for (const th of THRESHOLDS) next[th.field] = toDisplay(th.field, stored?.thresholds?.[th.field])
   values.value = next
+  // Copied, not aliased: the editor mutates by replacement, and hydrating from the store's own
+  // objects would let an unsaved edit read back as the account's stored state.
+  failureKindRules.value = stored?.thresholds?.failureKindRules?.map((rule) => ({ ...rule }))
 }
 
 onMounted(async () => {
@@ -159,9 +176,14 @@ function collectThresholds(): PlatformAlertThresholdOverrides {
     const parsed = fromDisplay(th.field, values.value[th.field])
     if (parsed !== undefined) out[th.field] = parsed
   }
+  // Sent whole or omitted whole. An empty list is a real setting and travels as one.
+  if (failureKindRules.value !== undefined) out.failureKindRules = failureKindRules.value
   return out
 }
 
+/** What the backend would refuse about the per-kind rules, from the helper the editor shows. */
+const ruleFaults = computed(() => failureKindRuleFaults(failureKindRules.value ?? []))
+
 async function save() {
   if (!loaded.value) {
     toast.add({ title: t('settings.platformAlerts.notLoaded'), color: 'error' })
@@ -175,6 +197,22 @@ async function save() {
     })
     return
   }
+  // Refused here rather than left to the write boundary: the API rejects the WHOLE config blob,
+  // so a bad rule would read to the admin as the model policy beside it failing to save. The
+  // two faults describe themselves differently because they are fixed differently — a row
+  // number is useless advice for a list that is simply too long.
+  if (hasFailureKindRuleFaults(ruleFaults.value)) {
+    toast.add({
+      title: t('settings.platformAlerts.failureKinds.invalidTitle'),
+      description: ruleFaults.value.tooMany
+        ? t('settings.platformAlerts.failureKinds.tooManyRules', { max: MAX_FAILURE_KIND_RULES })
+        : t('settings.platformAlerts.failureKinds.invalidRows', {
+            rows: ruleFaults.value.rows.join(', '),
+          }),
+      color: 'error',
+    })
+    return
+  }
   const thresholds = collectThresholds()
   // Each key is omitted rather than nulled when it carries no override: an absent key is what
   // the backend reads as "inherit the deployment default", and a stored null would be a value.
@@ -210,12 +248,14 @@ function resetAll() {
   muted.value = false
   alertWindow.value = ''
   values.value = blankValues()
+  failureKindRules.value = undefined
 }
 
 const hasOverrides = computed(
   () =>
     muted.value ||
     alertWindow.value !== '' ||
+    failureKindRules.value !== undefined ||
     THRESHOLDS.some((th) => values.value[th.field].trim() !== ''),
 )
 </script>
@@ -288,6 +328,8 @@ const hasOverrides = computed(
       </div>
     </div>
 
+    <AccountFailureKindRules v-model="failureKindRules" />
+
     <!--
       A save REPLACES the whole account config and this sheet edits one key of it, so with the
       current config not in hand there is nothing to carry forward. Say so and disable the

package/app/components/panels/InspectorPanel.vue

@@ -178,6 +178,10 @@ const taskBranchUrl = computed(() => {
   return base ? `${base}/tree/${pr.branch}` : null
 })
 
+// The run MODE, shared with the focus view's Run picker so the two surfaces offer (and force)
+// the same thing.
+const runStart = useRunStart(() => block.value?.id)
+
 // Hide UI-testing pipelines when this block's frame has no UI to exercise, `'recurring'`-only
 // pipelines (a manual run of one is refused server-side), and every pipeline whose purpose doesn't
 // match this block's task type or LEVEL — they'd be refused at run start (see utils/pipeline + the
@@ -186,7 +190,7 @@ const taskBranchUrl = computed(() => {
 // frames and modules too, which is why it reads `block.level` rather than assuming a task.
 const runMenu = computed(() => {
   const frame = block.value ? board.serviceOf(block.value) : undefined
-  return pipelines.pipelines
+  const runnable = pipelines.pipelines
     .filter((p) =>
       pipelineAllowedForManualStart(
         p,
@@ -199,8 +203,40 @@ const runMenu = computed(() => {
     .map((p) => ({
       label: p.name,
       icon: 'i-lucide-play',
-      onSelect: () => block.value && execution.start(block.value.id, p),
+      onSelect: () => void runStart.start(p),
     }))
+  // The run MODE leads the menu, because it changes what every row below it does. A policy
+  // sandbox is stated in both interface tiers as a disabled row: there is nothing to choose, and
+  // a menu that said nothing would leave the user to discover it from a run that never merges.
+  if (runStart.forced.value) {
+    return [
+      [
+        {
+          label: t('panels.inspector.dryRunForced'),
+          icon: 'i-lucide-shield',
+          disabled: true,
+          type: 'label' as const,
+        },
+      ],
+      runnable,
+    ]
+  }
+  if (!runStart.canRequest.value) return runnable
+  return [
+    [
+      {
+        label: t('panels.inspector.dryRun'),
+        icon: 'i-lucide-shield',
+        type: 'checkbox' as const,
+        checked: runStart.requested.value,
+        // Keep the menu open: the choice is a modifier on the pipeline row the user is about to
+        // pick, so closing here would make them reopen the menu to act on it.
+        onSelect: (e: Event) => e.preventDefault(),
+        onUpdateChecked: (checked: boolean) => runStart.setRequested(checked),
+      },
+    ],
+    runnable,
+  ]
 })
 
 // Delegate to the shared confirm-gated deletion so the button and the keyboard shortcut
@@ -515,10 +551,19 @@ const showOriginalDescription = ref(false)
             :color="canRun ? 'primary' : 'neutral'"
             variant="soft"
             size="sm"
-            :icon="canRun ? 'i-lucide-play' : 'i-lucide-lock'"
+            :icon="
+              !canRun
+                ? 'i-lucide-lock'
+                : runStart.dryRun.value
+                  ? 'i-lucide-shield'
+                  : 'i-lucide-play'
+            "
             trailing-icon="i-lucide-chevron-down"
             :disabled="!canRun"
-            :title="runBlockedReason ?? undefined"
+            :title="
+              runBlockedReason ??
+              (runStart.dryRun.value ? t('panels.inspector.dryRunHint') : undefined)
+            "
             data-testid="run-start"
           >
             {{ instance ? t('panels.inspector.reRun') : t('panels.inspector.run') }}

package/app/components/panels/OperatorDashboardPanel.vue

@@ -1,8 +1,9 @@
 <script setup lang="ts">
 import { computed, watch } from 'vue'
 import { onKeyStroke } from '@vueuse/core'
-import type { AgentFailureKind, PlatformObservabilityWindow } from '~/types/execution'
+import type { PlatformObservabilityWindow } from '~/types/execution'
 import { formatMs } from '~/utils/observability'
+import { FAILURE_KIND_KEYS, isAgentFailureKind } from '~/utils/failureKinds'
 
 // Deployment-level (platform-operator) observability dashboard: the aggregate health of the
 // active account's runs — outcome totals + success rate, a time-bucketed outcome trend, the
@@ -29,25 +30,12 @@ const WINDOWS: { value: PlatformObservabilityWindow; label: string }[] = [
   { value: '90d', label: t('platformObservability.window.ninetyDays') },
 ]
 
-// Exhaustive enum→label map (tier-2 dynamic-key guard): a new AgentFailureKind fails the
-// typecheck here, and an out-of-enum kind falls back to its raw code below.
-const FAILURE_KIND_KEYS: Record<AgentFailureKind, string> = {
-  preflight: 'platformObservability.failureKind.preflight',
-  dispatch: 'platformObservability.failureKind.dispatch',
-  environment: 'platformObservability.failureKind.environment',
-  evicted: 'platformObservability.failureKind.evicted',
-  timeout: 'platformObservability.failureKind.timeout',
-  agent: 'platformObservability.failureKind.agent',
-  job_failed: 'platformObservability.failureKind.job_failed',
-  rejected: 'platformObservability.failureKind.rejected',
-  companion_rejected: 'platformObservability.failureKind.companion_rejected',
-  stalled: 'platformObservability.failureKind.stalled',
-  cancelled: 'platformObservability.failureKind.cancelled',
-  unknown: 'platformObservability.failureKind.unknown',
-}
+// The enum→label map is SHARED with the alert-settings panel (`~/utils/failureKinds`), which
+// offers the same vocabulary as the subject of a per-kind alert rule: one map, so the kind an
+// operator points a page at and the kind this breakdown shows can never be labelled differently.
+// An out-of-enum kind (a retired one on an old row) falls back to its raw code.
 function failureLabel(kind: string): string {
-  const key = FAILURE_KIND_KEYS[kind as AgentFailureKind]
-  return key ? t(key) : kind
+  return isAgentFailureKind(kind) ? t(FAILURE_KIND_KEYS[kind]) : kind
 }
 
 const DAY_MS = 24 * 60 * 60 * 1000