@cat-factory/app 0.314.0 → 0.315.1

package/app/components/layout/NotificationsInbox.vue

@@ -2,6 +2,11 @@
 import type { Notification } from '~/types/domain'
 import type { ReviewEffort } from '~/types/merge'
 import SectionLabel from '~/components/common/SectionLabel.vue'
+import {
+  notificationTarget,
+  notificationVerbKey,
+  type NotificationRouteDeps,
+} from '~/utils/notificationRoutes'
 
 // The board's notification inbox: a bell with an open-count badge that opens a
 // panel of human-actionable items (a PR awaiting a merge decision, a completed
@@ -133,6 +138,45 @@ function actionLabel(n: Notification): string {
   return te(key) ? t(key) : t('layout.notifications.action.markRead')
 }
 
+// The store reads and openers every route uses (`utils/notificationRoutes.ts`).
+const routeDeps: NotificationRouteDeps = {
+  getInstance: (id) => execution.getInstance(id),
+  select: (id) => ui.select(id),
+  openStepDetail: (id, index) => ui.openStepDetail(id, index),
+  openDecision: (id, decisionId) => ui.openDecision(id, decisionId),
+  openFollowUps: (id) => ui.openFollowUps(id),
+  openForkDecision: (id) => ui.openForkDecision(id),
+  openPrReview: (id) => ui.openPrReview(id),
+  openBugFishing: (id) => ui.openBugFishing(id),
+  openRequirementReview: (id) => ui.openRequirementReview(id),
+  openClarityReview: (id) => ui.openClarityReview(id),
+  openInitiativeTracker: (id) => ui.openInitiativeTracker(id),
+  openOperatorDashboard: () => ui.openOperatorDashboard(),
+}
+
+/**
+ * The primary verb for a card whose act button only marks it read, from the same resolution its
+ * click takes. `te()`-guarded like the act label: a locale missing the key gets no button rather
+ * than a raw key path.
+ */
+function goToLabel(n: Notification): string | null {
+  const key = notificationVerbKey(n, routeDeps)
+  return key && te(key) ? t(key) : null
+}
+
+/** Each open card's go-to label, computed once per change rather than once per binding. */
+const goToLabels = computed(
+  () => new Map(notifications.open.map((n) => [n.id, goToLabel(n)] as const)),
+)
+
+// The popover is closed when a card takes the person somewhere, so it does not stay open under
+// the window it opened and reappear when that window closes.
+const open = ref(false)
+function goTo(n: Notification) {
+  open.value = false
+  reveal(n)
+}
+
 /** A notification the escalation sweep has flagged as overdue (waited past the threshold). */
 function isUrgent(n: Notification): boolean {
   return n.severity === 'urgent'
@@ -217,120 +261,9 @@ async function dismiss(n: Notification) {
   }
 }
 
-/**
- * Clicking a notification's title takes the user where they can act on it. A
- * `requirement_review` / `clarity_review` summons them straight back into the matching review
- * window (the async incorporate/re-review raised new findings or hit the cap); every other
- * type just focuses the related block on the board.
- */
+/** Clicking a notification's title, or its verb, takes the user where they can act on it. */
 function reveal(n: Notification) {
-  // A `platform_health` card is deployment-scoped (no block) — send the operator to the
-  // dashboard where the live aggregate numbers behind the alert live.
-  if (n.type === 'platform_health') return ui.openOperatorDashboard()
-  if (!n.blockId) return
-  if (n.type === 'requirement_review') ui.openRequirementReview(n.blockId)
-  else if (n.type === 'clarity_review') ui.openClarityReview(n.blockId)
-  else if (n.type === 'decision_required') revealDecision(n)
-  else if (n.type === 'human_test_ready') revealHumanTest(n)
-  else if (n.type === 'visual_confirmation_ready') revealVisualConfirm(n)
-  else if (n.type === 'human_review') revealHumanReview(n)
-  else if (n.type === 'followup_pending') revealFollowUps(n)
-  else if (n.type === 'fork_decision_pending') revealForkDecision(n)
-  else if (n.type === 'judge_review') revealJudge(n)
-  else if (n.type === 'pr_review_ready') revealPrReview(n)
-  else if (n.type === 'bug_fishing_triage') revealBugFishing(n)
-  else if (n.type === 'initiative') ui.openInitiativeTracker(n.blockId)
-  else ui.select(n.blockId)
-}
-
-/**
- * Open the gate window for a parked `human-review` gate: find the run's human-review step and
- * open it through the universal step dispatch (its archetype declares the `gate` result view,
- * where the human can request a freeform fix). Falls back to focusing the block.
- */
-function revealHumanReview(n: Notification) {
-  const instance = n.executionId ? execution.getInstance(n.executionId) : undefined
-  const idx = instance?.steps.findIndex((s) => s.agentKind === 'human-review') ?? -1
-  if (instance && idx >= 0) ui.openStepDetail(instance.id, idx)
-  else if (n.blockId) ui.select(n.blockId)
-}
-
-/**
- * Open the Follow-up companion window for a run whose Coder parked on undecided items.
- * Falls back to focusing the block when the run isn't loaded.
- */
-function revealFollowUps(n: Notification) {
-  if (n.executionId && execution.getInstance(n.executionId)) ui.openFollowUps(n.executionId)
-  else if (n.blockId) ui.select(n.blockId)
-}
-
-/**
- * Open the implementation-fork decision window for a run parked awaiting a fork choice.
- * Falls back to focusing the block when the run isn't loaded.
- */
-function revealForkDecision(n: Notification) {
-  if (n.executionId && execution.getInstance(n.executionId)) ui.openForkDecision(n.executionId)
-  else if (n.blockId) ui.select(n.blockId)
-}
-
-/**
- * Open the judge window for a run parked on a rubric verdict: find the step carrying the parked
- * verdict and open it through the universal step dispatch (a registered judge declares the
- * `judge` result view). Falls back to focusing the block when the run isn't loaded.
- */
-function revealJudge(n: Notification) {
-  const instance = n.executionId ? execution.getInstance(n.executionId) : undefined
-  const idx = instance?.steps.findIndex((s) => s.judge?.status === 'awaiting_decision') ?? -1
-  if (instance && idx >= 0) ui.openStepDetail(instance.id, idx)
-  else if (n.blockId) ui.select(n.blockId)
-}
-
-/**
- * Open the PR deep-review window for a run parked awaiting a finding selection.
- * Falls back to focusing the block when the run isn't loaded.
- */
-function revealPrReview(n: Notification) {
-  if (n.executionId && execution.getInstance(n.executionId)) ui.openPrReview(n.executionId)
-  else if (n.blockId) ui.select(n.blockId)
-}
-
-/**
- * Open the bug-fishing expedition window for a run whose angles have all settled. Falls back to
- * focusing the block when the run is not loaded, exactly like its PR-review sibling.
- */
-function revealBugFishing(n: Notification) {
-  if (n.executionId && execution.getInstance(n.executionId)) ui.openBugFishing(n.executionId)
-  else if (n.blockId) ui.select(n.blockId)
-}
-
-/**
- * Open the human-testing window for a parked `human-test` gate: find the run's parked
- * human-test step and open it through the universal step dispatch (its archetype declares
- * the `human-test` result view). Falls back to focusing the block.
- */
-function revealHumanTest(n: Notification) {
-  const instance = n.executionId ? execution.getInstance(n.executionId) : undefined
-  const idx =
-    instance?.steps.findIndex(
-      (s) => s.agentKind === 'human-test' && s.state === 'waiting_decision',
-    ) ?? -1
-  if (instance && idx >= 0) ui.openStepDetail(instance.id, idx)
-  else if (n.blockId) ui.select(n.blockId)
-}
-
-/**
- * Open the visual-confirmation window for a parked `visual-confirmation` gate: find the run's
- * parked step and open it through the universal step dispatch (its archetype declares the
- * `visual-confirm` result view). Falls back to focusing the block.
- */
-function revealVisualConfirm(n: Notification) {
-  const instance = n.executionId ? execution.getInstance(n.executionId) : undefined
-  const idx =
-    instance?.steps.findIndex(
-      (s) => s.agentKind === 'visual-confirmation' && s.state === 'waiting_decision',
-    ) ?? -1
-  if (instance && idx >= 0) ui.openStepDetail(instance.id, idx)
-  else if (n.blockId) ui.select(n.blockId)
+  notificationTarget(n, routeDeps)?.open()
 }
 
 /**
@@ -370,23 +303,10 @@ function revealFailingRun(run: { executionId: string; blockId: string | null })
   if (execution.getInstance(run.executionId)) ui.openObservability(run.executionId)
   else if (run.blockId) ui.select(run.blockId)
 }
-
-/**
- * Open the decision surface for a parked iteration-cap run: find the run's step that is
- * waiting on a human and open it through the universal step dispatch — which routes a
- * `requirements-review` step to the review window and a companion step to its detail
- * panel (where the iteration-cap prompt lives). Falls back to focusing the block.
- */
-function revealDecision(n: Notification) {
-  const instance = n.executionId ? execution.getInstance(n.executionId) : undefined
-  const idx = instance?.steps.findIndex((s) => s.state === 'waiting_decision') ?? -1
-  if (instance && idx >= 0) ui.openStepDetail(instance.id, idx)
-  else if (n.blockId) ui.select(n.blockId)
-}
 </script>
 
 <template>
-  <UPopover v-if="notifications.count" :content="{ align: 'end' }">
+  <UPopover v-if="notifications.count" v-model:open="open" :content="{ align: 'end' }">
     <UButton
       data-testid="notifications-bell"
       :color="hasUrgent ? 'error' : 'warning'"
@@ -426,7 +346,7 @@ function revealDecision(n: Notification) {
                   variant="link"
                   class="block min-w-0 flex-1 truncate p-0 text-start text-sm font-medium text-default hover:underline"
                   :title="n.title"
-                  @click="reveal(n)"
+                  @click="goTo(n)"
                 >
                   {{ n.title }}
                 </UButton>
@@ -502,11 +422,24 @@ function revealDecision(n: Notification) {
                 @update:model-value="effortByCard[n.id] = $event"
               />
               <div class="mt-2 flex items-center gap-1.5">
+                <!-- The action, where marking read is not one: opens what the title opens. -->
+                <!-- Soft, not solid: the inbox lists many cards, and a solid button on each would put
+                     many primaries in one view. -->
                 <UButton
-                  data-testid="notification-act"
+                  v-if="goToLabels.get(n.id)"
+                  data-testid="notification-go-to"
                   :color="accent(n)"
                   variant="soft"
                   size="xs"
+                  @click="goTo(n)"
+                >
+                  {{ goToLabels.get(n.id) }}
+                </UButton>
+                <UButton
+                  data-testid="notification-act"
+                  :color="goToLabels.get(n.id) ? 'neutral' : accent(n)"
+                  :variant="goToLabels.get(n.id) ? 'outline' : 'soft'"
+                  size="xs"
                   :loading="busy === n.id"
                   :disabled="!access.canExecuteRuns.value"
                   :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"

package/app/components/settings/ApiTokensPanel.vue

@@ -1,10 +1,11 @@
 <script setup lang="ts">
-// API access tokens — the workspace's inbound public-API keys external systems present to the
-// `/api/v1` surface (`Authorization: Bearer cf_live_…`). Keys are hashed one-way server-side,
-// so the raw secret is shown EXACTLY ONCE, on create; the list thereafter renders metadata
-// only (label + created / last-used). To rotate a token, revoke it and mint a new one.
-// Opened from the Integrations hub.
+// API access tokens: the account's inbound public-API keys that reach this workspace, which
+// external systems present to the `/api/v1` surface (`Authorization: Bearer cf_live_…`). Keys are
+// hashed one-way server-side, so the raw secret is shown EXACTLY ONCE, on create; the list thereafter
+// renders metadata only (label + created / last-used). To rotate a token, revoke it and mint a new
+// one. Opened from the Integrations hub.
 import { computed, ref, watch } from 'vue'
+import { showOverrideField } from '~/utils/uiMode'
 import type { PublicApiKey, PublicApiScope } from '~/types/publicApiKeys'
 import IntegrationBackTitle from '~/components/layout/IntegrationBackTitle.vue'
 import CopyButton from '~/components/common/CopyButton.vue'
@@ -36,6 +37,50 @@ const scopeItems = computed(() => SCOPES.map((value) => ({ value, label: scopeLa
 const ui = useUiStore()
 const auth = useAuthStore()
 const store = usePublicApiKeysStore()
+const accounts = useAccountsStore()
+const workspace = useWorkspaceStore()
+const uiMode = useUiModeStore()
+
+// A key's reach. The default is this board alone, which is what every key was before keys could
+// span workspaces; the wider choices are an override only an account admin can make, so the field
+// is hidden for everyone else rather than offered and refused.
+type TokenReach = 'this' | 'all' | 'selected'
+const reach = ref<TokenReach>('this')
+const selectedWorkspaceIds = ref<string[]>([])
+const canWidenReach = computed(
+  () =>
+    accounts.activeAccount?.roles?.includes('admin') === true &&
+    showOverrideField(uiMode.isAdvanced),
+)
+const reachItems = computed(() => [
+  { value: 'this' as const, label: t('settings.apiTokens.add.reachThis') },
+  { value: 'all' as const, label: t('settings.apiTokens.add.reachAll') },
+  { value: 'selected' as const, label: t('settings.apiTokens.add.reachSelected') },
+])
+const workspaceItems = computed(() =>
+  workspace.accountWorkspaces.map((w) => ({ value: w.id, label: w.name })),
+)
+/** The `workspaceIds` to mint with: omitted for this board, `null` for all, or the picked list. */
+function requestedReach(): string[] | null | undefined {
+  if (!canWidenReach.value || reach.value === 'this') return undefined
+  if (reach.value === 'all') return null
+  return selectedWorkspaceIds.value
+}
+// Gated on `canWidenReach` like `requestedReach`: a hidden picker left on 'selected' must not
+// disable the create button.
+const reachIncomplete = computed(
+  () =>
+    canWidenReach.value && reach.value === 'selected' && selectedWorkspaceIds.value.length === 0,
+)
+
+/** The reach badge for a listed key; none for a key reaching this one board. */
+function reachLabel(key: PublicApiKey): string | null {
+  if (key.workspaceIds === null) return t('settings.apiTokens.list.reachAll')
+  if (key.workspaceIds.length > 1) {
+    return t('settings.apiTokens.list.reachCount', { count: key.workspaceIds.length })
+  }
+  return null
+}
 
 /**
  * The minter to attribute a key to. When the minter is the signed-in user we show a localized
@@ -61,7 +106,7 @@ function minterLabel(key: PublicApiKey): string | null {
 /**
  * The badge for a key bound to a person's subscription, WHOSE person named.
  *
- * Keys are workspace-scoped and this list is shared, so a colleague's bound key is right here in
+ * This list shows every key reaching the board, so a colleague's bound key is right here in
  * everyone's panel: a fixed "your subscription" tells every other member that a token they never
  * minted reaches theirs, which is alarming and false. The same comparison {@link minterLabel} makes
  * is available (a binding is always to the minter), so the honest badge names the owner, and falls
@@ -147,11 +192,14 @@ async function createToken() {
       trimmed,
       scope.value,
       canBindSelf.value && identity.value === 'self',
+      requestedReach(),
     )
     newSecret.value = created.secret
     label.value = ''
     scope.value = 'write'
     identity.value = 'system'
+    reach.value = 'this'
+    selectedWorkspaceIds.value = []
     actionToast.success('settings.apiTokens.toast.created')
   } catch (e) {
     present(e, 'settings.apiTokens.toast.createFailed')
@@ -245,6 +293,15 @@ async function revokeToken(key: PublicApiKey) {
                 <!-- Always shown, never mode-gated: an existing key can already carry the
                      binding, and this is the only place its holder can see that a token they
                      are about to hand out reaches a personal subscription. -->
+                <UBadge
+                  v-if="reachLabel(key)"
+                  color="info"
+                  variant="subtle"
+                  size="sm"
+                  :data-testid="`api-token-reach-${key.id}`"
+                >
+                  {{ reachLabel(key) }}
+                </UBadge>
                 <UBadge
                   v-if="boundLabel(key)"
                   color="warning"
@@ -326,9 +383,31 @@ async function revokeToken(key: PublicApiKey) {
               data-testid="api-token-identity"
             />
           </UFormField>
+          <UFormField
+            v-if="canWidenReach"
+            :label="t('settings.apiTokens.add.reach')"
+            :help="t('settings.apiTokens.add.reachHelp')"
+          >
+            <USelect
+              v-model="reach"
+              :items="reachItems"
+              class="w-full"
+              data-testid="api-token-reach"
+            />
+            <USelectMenu
+              v-if="reach === 'selected'"
+              v-model="selectedWorkspaceIds"
+              :items="workspaceItems"
+              value-key="value"
+              multiple
+              :placeholder="t('settings.apiTokens.add.reachPick')"
+              class="mt-2 w-full"
+              data-testid="api-token-reach-workspaces"
+            />
+          </UFormField>
           <UButton
             :loading="busy"
-            :disabled="!label.trim()"
+            :disabled="!label.trim() || reachIncomplete"
             data-testid="api-token-create"
             @click="createToken"
           >

package/app/composables/usePipelineErrorToast.ts

@@ -183,6 +183,10 @@ const CONFLICT_INFO: Record<Exclude<ConflictReason, BespokeConflictReason>, Conf
     titleKey: 'errors.conflict.title.session_stale',
     descriptionKey: 'errors.conflict.description.session_stale',
   },
+  cursor_expired: {
+    titleKey: 'errors.conflict.title.cursor_expired',
+    descriptionKey: 'errors.conflict.description.cursor_expired',
+  },
   task_limit_reached: {
     titleKey: 'errors.conflict.title.task_limit_reached',
     descriptionKey: 'errors.conflict.description.task_limit_reached',

package/app/stores/publicApiKeys.spec.ts

@@ -9,6 +9,7 @@ function key(over: Partial<PublicApiKey> = {}): PublicApiKey {
     id: 'pak_1',
     accountId: 'acc1',
     workspaceId: 'ws1',
+    workspaceIds: ['ws1'],
     label: 'CI',
     scope: 'write',
     createdByUserId: null,
@@ -110,6 +111,33 @@ describe('publicApiKeys store', () => {
     expect(body).toHaveBeenCalledWith({ label: 'mine', scope: 'write', actsAsSelf: true })
   })
 
+  it('sends a reach only when one was chosen, so the default stays this workspace alone', async () => {
+    // An omitted `workspaceIds` and a `null` one mean opposite things on the wire (this board vs
+    // every board in the account), so the store must never turn "not chosen" into a value.
+    const body = vi.fn((_body: unknown) => Promise.resolve({ key: key(), secret: 's' }))
+    vi.stubGlobal('useApi', () => ({ createPublicApiKey: (_ws: string, b: unknown) => body(b) }))
+
+    const store = usePublicApiKeysStore()
+    await store.create('ci', 'read')
+    expect(body).toHaveBeenLastCalledWith({ label: 'ci', scope: 'read', actsAsSelf: false })
+
+    await store.create('all', 'read', false, null)
+    expect(body).toHaveBeenLastCalledWith({
+      label: 'all',
+      scope: 'read',
+      actsAsSelf: false,
+      workspaceIds: null,
+    })
+
+    await store.create('two', 'read', false, ['ws1', 'ws2'])
+    expect(body).toHaveBeenLastCalledWith({
+      label: 'two',
+      scope: 'read',
+      actsAsSelf: false,
+      workspaceIds: ['ws1', 'ws2'],
+    })
+  })
+
   it('revoke drops the key from the list', async () => {
     vi.stubGlobal('useApi', () => ({
       listPublicApiKeys: () => Promise.resolve({ keys: [key({ id: 'a' }), key({ id: 'b' })] }),

package/app/stores/publicApiKeys.ts

@@ -58,17 +58,31 @@ export const usePublicApiKeysStore = defineStore('publicApiKeys', () => {
    * `actsAsSelf` binds the key to the signed-in user's PERSONAL subscriptions, so a headless run
    * it starts can unlock them with the password sent on that call. Passed through rather than
    * defaulted here: the server writes the id off the session, so this is only ever a yes/no.
+   *
+   * `workspaceIds` is the key's reach: omitted for this workspace alone, `null` for every workspace
+   * in the account, or a list. Anything past this workspace needs an account admin.
    */
   async function create(
     label: string,
     scope: PublicApiScope,
     actsAsSelf = false,
+    workspaceIds?: string[] | null,
   ): Promise<CreatedPublicApiKey> {
     const ws = useWorkspaceStore()
-    const created = await api.createPublicApiKey(ws.requireId(), { label, scope, actsAsSelf })
+    const workspaceId = ws.requireId()
+    const created = await api.createPublicApiKey(workspaceId, {
+      label,
+      scope,
+      actsAsSelf,
+      ...(workspaceIds === undefined ? {} : { workspaceIds }),
+    })
     // Prepend: the backend lists newest-first, so the freshly minted key belongs at the
-    // top — matching the order a subsequent `load()` would produce.
-    keys.value = [created.key, ...keys.value]
+    // top — matching the order a subsequent `load()` would produce. A key picked to reach only
+    // other workspaces is not in this board's list, and revoking it from here would be refused as
+    // a no-op, so it is not shown.
+    const reaches =
+      created.key.workspaceIds === null || created.key.workspaceIds.includes(workspaceId)
+    if (reaches) keys.value = [created.key, ...keys.value]
     available.value = true
     return created
   }

package/app/utils/notificationRoutes.spec.ts

@@ -0,0 +1,81 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { ExecutionInstance, Notification } from '~/types/domain'
+import {
+  NOTIFICATION_ROUTES,
+  OPEN_TASK_VERB_KEY,
+  notificationTarget,
+  notificationVerbKey,
+  type NotificationRouteDeps,
+} from '~/utils/notificationRoutes'
+import { missingI18nKeys } from '../../test/i18nKeys'
+
+// The card's verb and the place its click lands come from ONE resolution, so a button named for
+// answering never just selects the task. These pin that, and that every verb names a real key.
+
+function deps(instances: ExecutionInstance[] = []): NotificationRouteDeps {
+  return {
+    getInstance: (id) => instances.find((i) => i.id === id),
+    select: vi.fn(),
+    openStepDetail: vi.fn(),
+    openDecision: vi.fn(),
+    openFollowUps: vi.fn(),
+    openForkDecision: vi.fn(),
+    openPrReview: vi.fn(),
+    openBugFishing: vi.fn(),
+    openRequirementReview: vi.fn(),
+    openClarityReview: vi.fn(),
+    openInitiativeTracker: vi.fn(),
+    openOperatorDashboard: vi.fn(),
+  }
+}
+
+const card = (type: Notification['type'], over: Partial<Notification> = {}) =>
+  ({ id: 'n1', type, blockId: 'blk', executionId: 'run', ...over }) as Notification
+
+const run = (steps: unknown[]) => ({ id: 'run', blockId: 'blk', steps }) as ExecutionInstance
+
+describe('notification routes', () => {
+  it('names a real catalog key for every verb', () => {
+    const keys = Object.values(NOTIFICATION_ROUTES)
+      .map((r) => r.verbKey)
+      .filter((k): k is string => k !== null)
+    expect(missingI18nKeys([...keys, OPEN_TASK_VERB_KEY])).toEqual([])
+  })
+
+  it('answers a parked agent question in the decision window', () => {
+    const d = deps([run([{ state: 'waiting_decision', decision: { id: 'dec', chosen: null } }])])
+    const n = card('decision_required')
+    expect(notificationVerbKey(n, d)).toBe('layout.notifications.goTo.answer')
+    notificationTarget(n, d)!.open()
+    expect(d.openDecision).toHaveBeenCalledWith('run', 'dec')
+  })
+
+  it('opens the step for any other park, such as an approval gate', () => {
+    const d = deps([run([{ state: 'done' }, { state: 'waiting_decision' }])])
+    notificationTarget(card('decision_required'), d)!.open()
+    expect(d.openStepDetail).toHaveBeenCalledWith('run', 1)
+  })
+
+  it('says "Open" when only the task can be opened, and opens the task', () => {
+    // The run is not loaded, or it is loaded and not parked (a Ralph loop that gave up).
+    for (const d of [deps(), deps([run([{ state: 'failed' }])])]) {
+      const n = card('decision_required')
+      expect(notificationVerbKey(n, d)).toBe(OPEN_TASK_VERB_KEY)
+      notificationTarget(n, d)!.open()
+      expect(d.select).toHaveBeenCalledWith('blk')
+    }
+    expect(notificationVerbKey(card('fork_decision_pending'), deps())).toBe(OPEN_TASK_VERB_KEY)
+  })
+
+  it('gives no verb to a card whose act button is the action, or that has nowhere to go', () => {
+    expect(notificationVerbKey(card('merge_review'), deps())).toBeNull()
+    expect(notificationVerbKey(card('budget_paused', { blockId: null }), deps())).toBeNull()
+    expect(notificationTarget(card('budget_paused', { blockId: null }), deps())).toBeNull()
+  })
+
+  it('sends a deployment-scoped health alert to the operator dashboard, with no block', () => {
+    const d = deps()
+    notificationTarget(card('platform_health', { blockId: null }), d)!.open()
+    expect(d.openOperatorDashboard).toHaveBeenCalled()
+  })
+})