@edgehero/pi-dispatch-admin 5.1.0 → 5.2.0

package/dist/console.mjs

@@ -5744,6 +5744,7 @@ var connection_exports = {};
 __export(connection_exports, {
   DB_REFUSED: () => DB_REFUSED,
   JudgedConnector: () => JudgedConnector,
+  VALKEY_COMMAND_TIMEOUT_MS: () => VALKEY_COMMAND_TIMEOUT_MS,
   VALKEY_CONTEXT_KEYS: () => VALKEY_CONTEXT_KEYS,
   VALKEY_ERROR_QUIET_MS: () => VALKEY_ERROR_QUIET_MS,
   assertJudgedConnection: () => assertJudgedConnection,
@@ -5951,7 +5952,7 @@ async function claimValkeyOwner(url, folder2, { context = null, waitMs = 15e3, m
     await sleep(500);
   }
 }
-var SCRUBS, DB_REFUSED, SELECT_HOOK, VALKEY_ERROR_QUIET_MS, VALKEY_ERRORS_HELD, saidAt, BoundedRedis, JUDGE, JudgedConnector;
+var SCRUBS, DB_REFUSED, SELECT_HOOK, VALKEY_ERROR_QUIET_MS, VALKEY_ERRORS_HELD, saidAt, BoundedRedis, VALKEY_COMMAND_TIMEOUT_MS, JUDGE, JudgedConnector;
 var init_connection = __esm({
   "../worker/src/connection.mjs"() {
     init_valkey_auth();
@@ -6022,6 +6023,7 @@ var init_connection = __esm({
         return answer2;
       }
     };
+    VALKEY_COMMAND_TIMEOUT_MS = 5e3;
     JUDGE = "piDispatchValkeyJudge";
     JudgedConnector = class _JudgedConnector extends AbstractConnector {
       constructor(options) {
@@ -6313,8 +6315,9 @@ function pauseWindowsVersionRefusal(doc, { supported = PAUSE_WINDOWS_VERSION } =
 function heldPauseWindows(text4, path) {
   if ((text4 ?? "").trim() === "") return { doc: null, windows: [] };
   const { value, problem: problem2 } = heldDocument(text4, "windows");
-  const refused5 = problem2 ?? (findDuplicateKey(text4) ? "has a key written twice" : null);
-  if (refused5) return { doc: value ?? null, problem: `the pause-windows file ${path} ${refused5}, so its windows cannot be kept` };
+  const doubled = value !== void 0 && findDuplicateKey(text4) !== null;
+  const refused5 = doubled ? "has a key written twice" : problem2 ?? null;
+  if (refused5) return { doc: doubled ? null : value ?? null, problem: `the pause-windows file ${path} ${refused5}, so its windows cannot be kept` };
   return { doc: value, windows: Array.isArray(value.windows) ? value.windows : [] };
 }
 function pauseWindowsText(doc, windows, { table: table3 = PAUSE_WINDOW_FIELD_VERSIONS, valueTable = PAUSE_WINDOW_VALUE_VERSIONS } = {}) {
@@ -6365,6 +6368,10 @@ function parsePauseWindows(text4, path, { supported = PAUSE_WINDOWS_VERSION, tab
   } catch (error) {
     throw configError4(`pause-windows file is not valid JSON: ${path} (${error.message})`);
   }
+  const duplicate = findDuplicateKey(text4);
+  if (duplicate) {
+    throw configError4(`pause-windows file has a duplicate key ${JSON.stringify(duplicate.key)} at ${duplicate.at}: JSON keeps the LAST value, so the file a person reads and the file that applies are not the same: ${path}`);
+  }
   const problem2 = pauseWindowsVersionRefusal(parsed, { supported });
   if (problem2) {
     const error = configError4(`${problem2.message}: ${path}`);
@@ -17584,10 +17591,12 @@ function withdrawCancel({ redis, jobId, interventionOrigin = "human" }) {
   Promise.resolve().then(() => redis.del(cancelRequestKeyOf(jobId, interventionOrigin))).catch(() => {
   });
 }
-async function requestCancel({ redis, jobId, interventionOrigin = "human", ackTimeoutMs = 1e4, pollMs = 250, sleep = (ms3) => new Promise((r) => setTimeout(r, ms3)) }) {
+async function requestCancel({ redis, jobId, interventionOrigin = "human", ackTimeoutMs = 1e4, pollMs = 250, sleep = (ms3) => new Promise((r) => setTimeout(r, ms3)), now = Date.now, onWritten = null }) {
   const requestKey = cancelRequestKeyOf(jobId, interventionOrigin);
   const ackKey = interventionOrigin === "agent" ? agentCancelAckKey(jobId) : cancelAckKey(jobId);
   await redis.set(requestKey, interventionOrigin === "agent" ? "agent-cancel" : "operator-cancel", "PX", CANCEL_REQ_TTL_MS);
+  onWritten?.();
+  const deadline = now() + ackTimeoutMs;
   for (let waited = 0; ; waited += pollMs) {
     let host;
     try {
@@ -17597,7 +17606,7 @@ async function requestCancel({ redis, jobId, interventionOrigin = "human", ackTi
       throw err;
     }
     if (host !== null && host !== void 0) return { ack: host };
-    if (waited + pollMs > ackTimeoutMs) break;
+    if (waited + pollMs > ackTimeoutMs || now() >= deadline) break;
     await sleep(pollMs);
   }
   try {
@@ -22240,7 +22249,7 @@ function triggerLastRun(records, hostLoads = null) {
     ...sourcesOf(loaded, "package").filter((row2) => row2.toolNames?.length > 0).map((row2) => ({ kind: "package", from: row2.name ?? "a staged package", names: [...row2.toolNames] })),
     ...(overlay?.namedTools ?? []).map((row2) => ({ kind: "overlay", from: row2.name, names: [...row2.tools] }))
   ];
-  const sources = [...sourcesOf(loaded, "package"), ...(overlay?.names ?? []).map((name3) => ({ name: name3, version: null, tools: overlay.namedTools?.find((row2) => row2.name === name3)?.tools.length ?? 0, skills: 0, prompts: 0 }))];
+  const sources = [...sourcesOf(loaded, "package").map((row2) => ({ ...row2, kind: "package" })), ...(overlay?.names ?? []).map((name3) => ({ name: name3, version: null, kind: "overlay", tools: overlay.namedTools?.find((row2) => row2.name === name3)?.tools.length ?? 0, skills: 0, prompts: 0 }))];
   return {
     newest,
     quoted: { id: runIdOf2(record3), host: facts7.host, record: record3, rows: Object.fromEntries(loadedRows(record3, { past: true }).map((row2) => [row2.label, row2])), problems, sources, tools, notes: [...cutWords(loaded), ...wentOn(record3) && loaded.at !== "ready" ? [LOADED_WORDS.notedEarly] : []] }
@@ -22276,12 +22285,12 @@ function hostLoadsRow(hostLoads, name3) {
   const row2 = Array.isArray(hostLoads?.hosts) ? hostLoads.hosts.find((entry3) => entry3?.name === name3) : null;
   return row2 ?? { name: name3, state: "unknown", why: hostLoads?.unreachable ? "unreachable" : "absent" };
 }
-function sandboxFreshLine({ hostLoads, host, triggerIndex, withholdsPackages = false, excludes = [], image = null }) {
+function sandboxFreshLine({ hostLoads, host, triggerIndex, withholdsPackages = false, excludes = [], image = null, mcp = null }) {
   const row2 = hostLoadsRow(hostLoads, host);
   const first = noOverlay(hostPiFor(row2, image));
   const unknown4 = (why) => [`${first} What a job of trigger ${triggerIndex + 1} would load on this host is unknown: ${why}.`];
   if (row2.state === "unknown") return unknown4(row2.why === "unreachable" ? "the hosts\u2019 doctor runs could not be read" : row2.why === "unreadable" ? "its last doctor run could not be read" : "it has published no doctor run");
-  const unread2 = (row2.unread ?? []).filter((part) => (part !== "packages" || !withholdsPackages) && (part !== "extensions" || row2.overlayExtensionsAllowed));
+  const unread2 = (row2.unread ?? []).filter((part) => (part !== "packages" || !withholdsPackages) && (part !== "extensions" || row2.overlayExtensionsAllowed) && (part !== "mcp" || !Array.isArray(mcp) || mcp.length > 0));
   if (unread2.length > 0) return unknown4(`its last doctor run could not read ${listed(unread2.map((part) => UNREAD_PART_WORDS[part] ?? "part of what it publishes"))}`);
   const packages = withholdsPackages ? [] : (row2.packages ?? []).filter((entry3) => !excludes.includes(entry3.name)).map((entry3) => `${entry3.name} ${entry3.version}`);
   const extensions = row2.overlayExtensionsAllowed ? (row2.extensions ?? []).map((entry3) => entry3.name).filter((name3) => !excludes.some((excluded) => overlayEntryNamed(excluded, name3))) : [];
@@ -24710,6 +24719,8 @@ async function enqueueTriggerFire(plan, options = {}) {
     const canary = options.packageCanary ?? null;
     const id6 = (canary ? manualCanaryJobId : manualTriggerJobId)({ triggerId: current.schedulerId, now: instant9 });
     redis = redisFn(url);
+    redis.on?.("error", () => {
+    });
     if (await redis.set(`trigger-fire:${current.queue}:${id6}`, "1", "EX", 120, "NX") !== "OK") return { refusal: "This cron trigger was already fired this minute. Nothing was queued.", deduplicated: true };
     queue = queueFn(parseConnectionFn(url, { failFast: true }), { name: current.queue });
     const schedule = canary ? { ...current.schedule, data: withJobDataVersion({ ...current.schedule.data, packageCanary: canary }) } : current.schedule;
@@ -27204,6 +27215,8 @@ async function checkDispatchRun({
     let redis;
     try {
       redis = redisFn(valkeyUrl);
+      redis.on?.("error", () => {
+      });
       const key2 = hourKey(now());
       const count8 = Number(consumeRate ? await redis.incr(key2) : await redis.get(key2) ?? 0);
       if (consumeRate && count8 === 1) await redis.expire(key2, DISPATCH_RUN_TTL_SECONDS);
@@ -28077,6 +28090,8 @@ async function readHosts({ url, redisFn = makeRedisClient, timeoutMs = 2500, now
   try {
     parseConnection(url, { failFast: true });
     redis = redisFn(url);
+    redis.on?.("error", () => {
+    });
     const res = await withTimeout(readLiveHosts(redis, { now, timeoutMs: Math.max(250, Math.floor(timeoutMs / 2)) }), timeoutMs, { unreachable: "timed out reaching the registry" });
     if (res.unreachable) return { unreachable: res.unreachable };
     return { hosts: res.hosts };
@@ -28100,6 +28115,8 @@ async function readHeldJobs({ url, limit = 20, redisFn = makeRedisClient, timeou
   try {
     parseConnection(url, { failFast: true });
     redis = redisFn(url);
+    redis.on?.("error", () => {
+    });
     const settled = (async () => {
       const ids = await redis.smembers(HELD_SET);
       const hydrated = await Promise.all(
@@ -28168,6 +28185,8 @@ async function cancelHeldJob({ url, jobId, redisFn = makeRedisClient, queueFn =
   try {
     parseConnection(url, { failFast: true });
     redis = redisFn(url);
+    redis.on?.("error", () => {
+    });
     settled = (async () => {
       const { names: names2 } = await readFleetQueues({ url, redisFn, timeoutMs: Math.max(250, Math.floor(timeoutMs / 2)) });
       let owner2 = null;
@@ -28300,6 +28319,8 @@ async function readBudget({ url, redisFn = makeRedisClient, timeoutMs = 2500, no
   try {
     parseConnection(url, { failFast: true });
     redis = redisFn(url);
+    redis.on?.("error", () => {
+    });
     const settled = Promise.all([redis.get(dayKey(now)), redis.get(weekKey(now)), redis.get(monthKey(now)), redis.get(tokenDayKey(now))]).then(
       ([day2, week, month, tokens]) => ({ day: Number(day2 ?? 0), week: Number(week ?? 0), month: Number(month ?? 0), tokensToday: Number(tokens ?? 0) }),
       (err) => ({ unreachable: err?.message ?? String(err) })
@@ -36769,371 +36790,6 @@ var init_loaded_parts = __esm({
   }
 });
 
-// src/console/panels/sandboxes.mjs
-function state(v) {
-  const s = report(v)?.request;
-  if (!s) return null;
-  const success = s.state === "ready";
-  return banner({ status: success ? "ok" : ["refused", "failed"].includes(s.state) ? "attention" : "running", title: success ? `Sandbox ${s.result?.id ?? s.id} is ready` : `Sandbox request ${s.state}`, body: html`<span class="code">${s.id}</span> on ${s.host ?? "its host"}. ${s.message ?? s.reason ?? (success ? "No container has started. Open it from your terminal." : "Reload to read the worker's result.")}`, actions: success && s.result ? links(v, { ...s.result, id: s.result.id, host: s.result.host ?? s.host }, "open", true) : btn({ href: `/runs/sandboxes?${new URLSearchParams({ request: s.id, host: s.host ?? selected2(v).host ?? "" })}`, label: "Refresh request" }) });
-}
-function sandboxFromRun(v) {
-  if (!allowed3(v) || v.query?.gatewaySelect) return null;
-  const all = rows(v);
-  const id6 = v.query?.id;
-  const picked = all.find((r) => rowId(r) === id6 && (!v.query?.host || r.host === v.query.host));
-  const pickerHost = v.query?.host ?? selected2(v).host ?? all[0]?.host ?? "";
-  const picker = html`<form method="get" action="/runs/sandboxes" data-live-hold class="sx-picker">${field2({ label: "Workspace host", id: "sb-workspace-host", control: select({ id: "sb-workspace-host", name: "host", value: pickerHost, options: [{ value: "", label: "Choose a host" }, ...(report(v)?.hosts ?? []).map((h) => ({ value: h.name, label: h.name }))] }) })}${field2({ label: "Kept workspace", id: "sb-workspace", control: select({ id: "sb-workspace", name: "id", value: id6 ?? "", options: [{ value: "", label: "Choose a workspace" }, ...all.filter((r) => !pickerHost || r.host === pickerHost).map((r) => ({ value: rowId(r), label: `${rowId(r)} on ${r.host}${r.prepared ? " (prepared)" : ""}` }))] }) })}${btn({ type: "submit", label: "Show workspace" })}</form>`;
-  if (!report(v)) return card2("From a run", html`<p role="status">${SANDBOX_WORDS.unavailable}</p>`);
-  if (!picked) return card2("From a run", html`${state(v)}${v.data?.sandboxHostsProblem ? html`<p role="status">${v.data.sandboxHostsProblem}</p>` : null}${picker}<p class="card__sub">${all.length ? "Choose a kept workspace, or open Sandboxes from a run page." : SANDBOX_WORDS.empty}</p>`, "the image, workspace and isolation the run kept");
-  const workspace = picked.kind === "local" ? "Its original host folder" : isForgeKind(picked.kind) ? "Its retained clone" : "The workspace recorded in its kept manifest";
-  const piVersion = hostPiFor(hostLoadsRow(v.data?.hostLoads, picked.host), picked.image);
-  const loads = picked.prepared ? sandboxPreparedLine(piVersion) : sandboxRunLine(v.data?.sandboxRun ?? null, rowId(picked), { pi: piVersion, unread: v.data?.sandboxRunUnread === true });
-  const what2 = facts([["Image", picked.image ?? "As recorded in its kept manifest"], ["/workspace", workspace], ["/job", "Read only, with the retained job inputs"], ["pi and what it loads", wordsHtml(loads)], ["Processes", "None until you start them"], ["Credentials", "None, on purpose"], ["Network", "The host's current job egress policy"]], { cols: 1 });
-  return card2("From a run", html`${state(v)}${v.data?.sandboxHostsProblem ? html`<p role="status">${v.data.sandboxHostsProblem}</p>` : null}${picker}<div class="sx-run">${tile("ok", { icon: "box" })}<div><p class="sx-run__t"><span class="code">${rowId(picked)}</span>${picked.project ? ptag(picked.project) : null}${picked.prepared ? chip("Without a run") : null}</p><p class="sx-run__s">${picked.host} ${vtag(picked.v ?? picked.backend)}. ${retention(picked, v.now)}</p></div></div><h3 class="sx-h3">What opens</h3>${what2}<p class="sx-small">${icon("info", { size: "sm" })}<span>${LOADED_WORDS.sandboxFoot}</span></p><h3 class="sx-h3">How it opens</h3>${canOpen(picked) ? html`<div class="sx-ch sx-ch--on"><div class="sx-ch__h">${icon("terminal", { size: "sm" })}<b>In your terminal</b><span class="sx-rec sandbox-opener">recommended</span></div><p class="sx-ch__s">Your terminal opens with the command typed in and waits for Enter. The link holds no secret. On a phone, copy the command.</p>${links(v, picked)}</div><div class="sx-foot"><p>${icon("info", { size: "sm" })}<span>The shell uses a job's isolation and network. A published host port is refused while egress is on. Pinning uses this host's configured pin window.</span></p>${pinForm(v, picked)}</div>` : html`<p>This venue has no sandbox shell. Its workspace cannot be reopened here.</p>`}`, "the same image, workspace and isolation as the run");
-}
-function sandboxNew(v) {
-  if (!allowed3(v) || v.query?.gatewaySelect) return null;
-  const s = selected2(v), data5 = report(v), options = data5?.options ?? [];
-  const repositories = [...new Set(options.map((o) => o.repo).filter(Boolean))];
-  const triggers2 = options;
-  const hostOptions = (data5?.hosts ?? []).filter((h) => !h.unreadable && !h.stale && h.settings && (!data5?.eligibleHosts || data5.eligibleHosts.includes(h.name))).map((h) => ({ value: h.name, label: `${h.name}, ${h.settings.defaultBackend ?? "venue not published"}` }));
-  const fields2 = [
-    field2({ label: "Repository", id: "sb-repo", control: input2({ id: "sb-repo", name: "repo", value: s.repo ?? "", placeholder: "owner/repository", required: true, autocomplete: "off", spellcheck: false }) }),
-    field2({ label: "As the jobs of", id: "sb-trigger", control: select({ id: "sb-trigger", name: "index", value: s.index === void 0 ? "" : String(s.index), options: [{ value: "", label: "Choose a trigger" }, ...triggers2.map((o) => ({ value: String(o.index), label: o.label }))] }), hint: "Its image, size and egress are shown below, rather than chosen here." }),
-    field2({ label: "Start from", id: "sb-ref", control: input2({ id: "sb-ref", name: "ref", value: s.ref ?? "HEAD", code: true, required: true, autocomplete: "off", spellcheck: false }), hint: "HEAD means the default branch. Enter a branch, tag, full commit SHA, or pr:42 for a pull request." }),
-    field2({ label: "Host", id: "sb-host", control: select({ id: "sb-host", name: "host", value: s.host ?? "", options: [{ value: "", label: "Choose a host" }, ...hostOptions] }), hint: "The worker checks the trigger and its own policy again before cloning." }),
-    field2({ label: "Keep it", id: "sb-pin", control: select({ id: "sb-pin", name: "pin", value: s.pin ? "1" : "0", options: [{ value: "0", label: "Host's retention window" }, { value: "1", label: "Host's pin window" }] }) })
-  ];
-  const plan = data5?.plan;
-  const source2 = data5?.fromRun ? html`<p class="sx-p">Preparing from <a class="link" href="${`/run?${new URLSearchParams({ id: data5.fromRun })}`}">${data5.fromRun}</a>. The ref starts at HEAD because the record holds no created pull request. ${data5.sourceRun?.historicalIndex !== null && data5.sourceRun?.historicalIndex !== void 0 ? `Its historical trigger row was ${data5.sourceRun.historicalIndex + 1}; that does not prove the current row's identity.` : "Its original trigger identity is unavailable."} Choose the current trigger explicitly.${String(data5.sourceRun?.backend).startsWith("openshell") ? " Its original OpenShell venue cannot prepare a sandbox; deliberately choose a compatible local or podman trigger." : ""}</p>` : null;
-  const form = html`${source2}<form method="get" action="/runs/sandboxes" data-live-hold>${data5?.fromRun ? html`<input type="hidden" name="fromRun" value="${data5.fromRun}">` : null}<div class="sx-form">${fields2}</div><div class="sx-form-end">${btn({ type: "submit", label: "Review settings" })}</div></form>`;
-  const fresh = plan ? html`${facts([[`On ${plan.host}`, wordsHtml(sandboxFreshLine({ hostLoads: v.data?.hostLoads, host: plan.host, triggerIndex: s.index, withholdsPackages: data5?.withholdsPackages === true, excludes: data5?.excludes ?? [], image: plan.image }))]], { cols: 1 })}<p class="sx-small">${icon("info", { size: "sm" })}<span>${LOADED_WORDS.freshFoot}</span></p>` : null;
-  const preparation = plan ? html`<h3 class="sx-h3">Given by the trigger, not chosen here</h3>${facts4(plan)}${fresh}<p class="sx-p">${plan.pin ? `Pinned for ${plan.pinDays} days` : `Kept for ${plan.retentionHours} hours`}, on ${plan.host}. The worker clones on that host with a credential for this repository, then drops it. No container starts, no model runs, no dollars are spent and no run slot is taken.</p>${acts2(v) ? actForm({ action: "sandbox-prepare", hidden: [["repo", s.repo], ["index", s.index, "int"], ["ref", s.ref], ["host", s.host], ["pin", Boolean(s.pin), "json"]], label: "Preview preparation", kind: ["primary"], icon: "plus" }) : html`<p class="card__sub">This console is read-only. Prepare from the host's terminal.</p>`}${cmd(["pi-dispatch", "sandbox", "--new", s.repo, "--ref", s.ref, "--as", String(s.index), ...s.pin ? ["--pin"] : []])}<p class="card__sub">The CLI’s --as takes a zero-based file index: trigger row ${s.index + 1} is index ${s.index}.</p>` : html`<p class="sx-p" role="status">${data5?.refusal ?? "Choose a repository, its trigger, a ref and a host, then review their settings."}</p>`;
-  return card2("Without a run", html`${form}${preparation}<noscript><p class="card__sub">${SANDBOX_WORDS.noScript}</p></noscript>`, "a fresh clone with a trigger's image and a job's isolation");
-}
-function sandboxOpen(v) {
-  if (!allowed3(v)) return null;
-  const data5 = report(v), sessions = (data5?.sessions ?? []).filter((s) => !v.query?.gatewaySelect || s.host === v.query.host);
-  const incomplete = !data5 || data5.sessionsUnavailable || data5.sessionsMore > 0 || data5.sessionsUnreadable > 0;
-  const notices = (data5?.notices ?? []).filter((n2) => !v.query?.gatewaySelect || n2.host === v.query.host).map((n2) => html`<p class="sx-p" role="status">${icon("attention", { size: "sm" })} ${n2.host}, ${n2.id}: ${{ "network-kept": "The sandbox network was kept because cleanup could not be confirmed. Inspect this host\u2019s runtime and network before removing either.", "network-cleanup-failed": "Sandbox network cleanup failed. Inspect this host\u2019s runtime and egress network before retrying cleanup.", "runtime-unreadable": "The runtime could not be read. An expired shell registration does not prove the container stopped. Inspect this host before reopening or cleaning it." }[n2.reason] ?? "Sandbox cleanup needs inspection on this host."} <a class="link" href="${`/fleet/host?${new URLSearchParams({ name: n2.host })}`}">Inspect host</a>.</p>`);
-  if (v.query?.gatewaySelect && !v.data?.browserGateways?.enabledHosts?.includes(v.query.host)) return card2("Open now", html`<p role="status">The browser gateway is not enabled for ${v.query.host}, so there is no shell to choose here. <a class="link" href="/runs/sandboxes">Return to Sandboxes</a>.</p>`);
-  return card2("Open now", html`${v.query?.gatewaySelect ? html`<p class="sx-p">Choose an already-open shell on ${v.query.host}. Each browser opening needs your current operator token. <a class="link" href="/runs/sandboxes">Return to Sandboxes</a>.</p>` : null}${notices}${data5?.noticesUnavailable ? html`<p role="status">Some sandbox cleanup notices could not be read. Inspect the host if a terminal ended unexpectedly.</p>` : null}${data5?.sessionsMore > 0 || data5?.sessionsUnreadable > 0 ? html`<p role="status">The registered shell list is incomplete: at least ${data5.sessionsMore ?? 0} more and ${data5.sessionsUnreadable ?? 0} unreadable registrations.</p>` : null}${data5?.sessionsUnavailable ? html`<p role="status">Open shells could not be read. Reload to try again.</p>` : sessions.length ? html`<ul class="sx-opens">${sessions.map((s) => html`<li class="sx-open"><span class="dot tone-running"></span><div class="sx-open__b"><p class="sx-open__t"><span class="code">${s.id}</span>${vtag(s.venue)}</p><p class="sx-open__s">${s.host}, opened by ${s.by ?? "the terminal operator"}. Open since ${stamp(s.since)}.</p>${sandboxDriverLine(v, s)}<div class="sx-open__a">${links(v, s, "attach", true)}${sandboxBrowserLink(v, s)}${acts2(v) && !v.query?.gatewaySelect ? actForm({ action: "sandbox-end", hidden: [["host", s.host], ["id", s.id], ["nonce", s.nonce], ["containerId", s.containerId]], label: "Preview End", kind: ["sm", "danger"], icon: "cancel" }) : null}</div></div></li>`)}</ul>` : html`<p>${data5?.sessionsMore > 0 || data5?.sessionsUnreadable > 0 ? "No readable shell is in this bounded view. The incomplete registrations above prevent an exact empty count." : SANDBOX_WORDS.noShells}</p>`}<p class="sx-small">${icon("info", { size: "sm" })}<span>One shell per workspace at a time. End asks the terminal that opened it to close the shell and keeps the workspace. What you type is not recorded.</span></p>`, null, badge(incomplete ? "attention" : "running", `${sessions.length} ${incomplete ? "shown" : "open"}`));
-}
-function sandboxKept(v) {
-  if (!allowed3(v) || v.query?.gatewaySelect) return null;
-  const data5 = report(v), all = rows(v);
-  return card2("Kept workspaces", html`${data5?.more > 0 ? html`<p role="status">At least ${data5.more} more hosts have inventory beyond this bounded view. Inspect the fleet before treating this list as complete.</p>` : null}${!data5 ? html`<p role="status">${SANDBOX_WORDS.unavailable}</p>` : html`${(data5.hosts ?? []).filter((h) => h.stale || h.unreadable).map((h) => html`<p class="sx-p" role="status">${h.name}: ${h.unreadable ? "publication unreadable" : "publication stale; inspect this host before opening"}. Its list is incomplete.</p>`)}${all.length ? html`<ul class="sx-kepts">${all.map((r) => html`<li class="sx-kept${canOpen(r) ? "" : " sx-kept--no"}"><p class="sx-kept__t"><a class="code" href="${`/runs/sandboxes?${new URLSearchParams({ id: rowId(r), host: r.host })}`}">${rowId(r)}</a>${r.project ? ptag(r.project) : null}${r.prepared ? chip("Without a run") : null}</p><p class="sx-kept__s">${r.host} ${vtag(r.v ?? r.backend)}. ${retention(r, v.now)}${!canOpen(r) ? ". This venue has no sandbox shell." : null}</p>${canOpen(r) ? html`<div class="sx-kept__actions">${links(v, r, "open", true)}${pinForm(v, r)}</div>` : null}</li>`)}</ul>` : html`<p>${SANDBOX_WORDS.empty}</p>`}${(data5.hosts ?? []).filter((h) => h.more > 0).map((h) => html`<p class="sx-p">${h.name} has at least ${h.more} more retained workspaces. Inspect its full list with pi-dispatch sandbox --list.</p>`)}`}`, "what each host still keeps");
-}
-function sandboxBrowser(v) {
-  if (!allowed3(v) || v.query?.gatewaySelect) return null;
-  const gateway = v.data?.browserGateways;
-  const count8 = gateway?.enabledHosts?.length ?? 0;
-  return card2("In this browser", html`<p class="sx-p">${SANDBOX_WORDS.browser}</p>${gateway?.problem ? html`<p class="sx-p" role="status">${gateway.problem}</p>` : html`<p class="sx-p">${count8 ? `${count8} ${count8 === 1 ? "host is" : "hosts are"} enrolled.` : "No host is enrolled in this console. Ask the host operator to configure the optional gateway."}${count8 ? html`<span class="sandbox-opener"> Choose Open in browser beside a registered shell in Open now.</span>` : null}</p>`}<p class="sx-p">Each opening needs your current operator token again. Only one browser window attaches at a time. Closing it keeps the original sandbox; what you type is not recorded.</p><p class="sx-p">First open a kept or prepared workspace in your own terminal. The browser never starts a container.</p><p class="sx-p">Browser terminals require a window wider than 760 pixels. On a phone, copy the command for your own terminal.</p>${v.readOnly ? html`<p class="sx-p">This console is read-only, so browser attachment is unavailable.</p>` : null}`, "optional, separate gateway", chip(count8 ? "Enabled per host" : "Off by default", { status: count8 ? "ok" : "idle", icon: "shield" }));
-}
-var SANDBOX_WORDS, report, allowed3, acts2, rows, card2, stamp, rowId, canOpen, selected2, facts4, links, retention, pinForm, SANDBOX_PANELS;
-var init_sandboxes = __esm({
-  "src/console/panels/sandboxes.mjs"() {
-    init_html();
-    init_kit();
-    init_forges();
-    init_sandbox_links();
-    init_common();
-    init_loaded_words();
-    init_loaded_parts();
-    SANDBOX_WORDS = Object.freeze({
-      unavailable: "Sandbox information could not be read. Reload to try again; an unread host is not an empty host.",
-      empty: "No kept workspace was published. A worker publishes its retained workspaces while it is running.",
-      noShells: "No live sandbox shell was registered. A shell whose terminal stopped answering disappears when its short lease expires. An expired registration is not proof the container stopped; inspect its host if the terminal ended unexpectedly.",
-      browser: "A separate gateway can attach to an already-open sandbox. It is off by default and enabled by hand per host. Open in Terminal and copy-command support remain available.",
-      noScript: "Preparing, pinning, ending a shell and saving terminal targets require JavaScript for Preview and Confirm. Commands remain selectable and the settings form works without JavaScript."
-    });
-    report = (v) => v.data?.sandboxes;
-    allowed3 = (v) => v.role === "operator";
-    acts2 = (v) => allowed3(v) && !v.readOnly;
-    rows = (v) => (report(v)?.hosts ?? []).flatMap((h) => (h.rows ?? []).map((r) => ({ ...r, host: h.name, hostStale: h.stale, retentionHours: h.retentionHours })));
-    card2 = (title2, body, sub2 = null, end = null) => card({ title: title2, sub: sub2, body, end });
-    stamp = (ms3) => Number.isFinite(ms3) ? timeHtml(ms3) : "not published";
-    rowId = (r) => r.id ?? r.jobId;
-    canOpen = (r) => !String(rowId(r)).startsWith("sha256:") && r.canOpen !== false && ["local", "podman"].includes(r.v ?? r.backend);
-    selected2 = (v) => report(v)?.selected ?? {};
-    facts4 = (plan) => facts([
-      ["Image", plan.image ?? "not published"],
-      ["Size", plan.size ? `${plan.size.memMiB} MiB, ${plan.size.cpuCenti / 100} CPU` : "not published"],
-      ["Network", plan.egress?.armed ? "The host's job allowlist through its egress proxy" : "Open bridge, egress policy off"],
-      ["Credentials", "None in the shell"]
-    ]);
-    links = (v, r, verb = "open", compact2 = false) => sandboxLinks({ id: rowId(r), host: r.host, verb, compact: compact2, config: v.data?.sandboxHosts });
-    retention = (r, now) => html`${r.pin ? "Pinned" : "Kept"}${Number.isFinite(r.until) ? html` until ${stamp(r.until)}${r.until <= now ? " (past its window; pin before opening)" : html`, ${ageText(r.until - now)} left`}` : ": deadline not published"}`;
-    pinForm = (v, r) => acts2(v) && canOpen(r) ? actForm({ action: "sandbox-pin", hidden: [["host", r.host], ["id", rowId(r)]], label: "Preview pin", icon: "clock" }) : null;
-    SANDBOX_PANELS = Object.freeze([["p-sb-run", sandboxFromRun], ["p-sb-new", sandboxNew], ["p-sb-open", sandboxOpen], ["p-sb-kept", sandboxKept], ["p-sb-browser", sandboxBrowser]]);
-  }
-});
-
-// src/zero-touch-view.mjs
-function breakdown(row2, repository = false) {
-  const out = { project: text3(row2?.project ?? row2?.id, 64), scopeId: scope(row2?.scopeId), name: text3(row2?.name ?? row2?.target ?? row2?.project ?? row2?.id) ?? "Unassigned", target: text3(row2?.target), runs: count5(row2?.runs), touched: count5(row2?.touched), rate: number2(row2?.rate), deltaPoints: Number.isFinite(row2?.deltaPoints) ? row2.deltaPoints : null, previousRate: number2(row2?.previousRate), streakDays: row2?.waitingPartial === true ? null : number2(row2?.streakDays), zeroTouch: row2?.zeroTouch === true && row2?.waitingPartial !== true, waitingNow: row2?.waitingPartial === true ? null : count5(row2?.waitingNow ?? row2?.waiting), waitingPartial: row2?.waitingPartial === true, topCause: CAUSES.includes(row2?.topCause) ? row2.topCause : null, causes: causes(row2?.causes), touchedRunIds: runIds(row2?.touchedRunIds) };
-  if (!repository) out.repositories = Array.isArray(row2?.repositories) ? row2.repositories.map((r) => breakdown(r, true)) : [];
-  return out;
-}
-function zeroTouchView(raw, { role = "viewer", windowDays = 30, nowMs: nowMs2 = 0 } = {}) {
-  const observed = raw?.coverage ?? raw?.window;
-  const unobserved2 = Array.isArray(observed?.reasons) && observed.reasons.includes("touch-index-unavailable") || observed?.partial === true && number2(observed.fromMs) !== null && observed.fromMs >= (number2(raw?.nowMs) ?? nowMs2);
-  if (!raw || typeof raw !== "object" || raw.state === "unavailable" || unobserved2) return { state: "unavailable", nowMs: nowMs2, windowDays, coverage: { partial: true, reasons: [] }, totals: {}, projects: [], causes: causes([]), trend: [], groups: [], fixes: [], fixesPartial: true, touchedRunIds: [], waitingRuns: [], ungroupedRunIds: [], grouping: { enabled: false, pending: 0, unassigned: 0, state: "disabled", sources: [] } };
-  const totals = raw.totals ?? raw.summary ?? {};
-  const coverage2 = raw.coverage ?? raw.window ?? {};
-  const out = {
-    state: "ready",
-    nowMs: number2(raw.nowMs) ?? nowMs2,
-    windowDays: [7, 30, 90].includes(raw.windowDays ?? raw.days) ? raw.windowDays ?? raw.days : windowDays,
-    coverage: { requestedFromMs: number2(coverage2.requestedFromMs), fromMs: number2(coverage2.fromMs), partial: coverage2.partial === true || coverage2.complete === false, reasons: Array.isArray(coverage2.reasons) ? coverage2.reasons.map((v) => text3(v)).filter(Boolean) : [] },
-    totals: { runs: count5(totals.runs), touched: count5(totals.touched), rate: number2(totals.rate), previousRate: number2(totals.previousRate), stopped: count5(totals.stopped), stoppedUnattributed: count5(totals.stoppedUnattributed), waitingHours: totals.waitingPartial === true ? null : number2(totals.waitingHours), waitingPartial: totals.waitingPartial === true, waitingUnknown: count5(totals.waitingUnknown), medianWaitMs: totals.waitingPartial === true ? null : number2(totals.medianWaitMs) ?? (number2(totals.medianWaitHours) === null ? null : totals.medianWaitHours * 36e5), pending: totals.waitingPartial === true ? null : count5(totals.pending ?? totals.waitingNow), draftAnswers: count5(totals.draftAnswers), deltaPoints: Number.isFinite(totals.deltaPoints) ? totals.deltaPoints : null },
-    projects: Array.isArray(raw.projects) ? raw.projects.map((r) => breakdown(r)) : [],
-    causes: causes(raw.causes),
-    trend: Array.isArray(raw.trend) ? raw.trend.slice(-8).map((r) => ({ atMs: number2(r?.atMs ?? r?.at), rate: number2(r?.rate), runs: count5(r?.runs), touched: count5(r?.touched), partial: r?.partial === true })) : [],
-    waitingRuns: Array.isArray(raw.waitingRuns ?? totals.waitingNow) ? (raw.waitingRuns ?? totals.waitingNow).map((r) => ({ runId: id5(r?.runId ?? r?.jobId), parkedAt: number2(r?.parkedAt) })).filter((r) => r.runId && r.parkedAt !== null) : [],
-    touchedRunIds: runIds(raw.touchedRunIds),
-    ungroupedRunIds: role === "operator" ? runIds(raw.ungroupedRunIds) : [],
-    groups: [],
-    fixes: [],
-    fixesPartial: raw.fixesPartial === true,
-    grouping: { enabled: raw.grouping?.enabled === true, partial: raw.grouping?.partial === true, pending: count5(raw.grouping?.pending), unassigned: count5(raw.grouping?.unassigned), state: ["ready", "ok", "disabled", "pending", "partial", "failed", "configuration-unavailable", "unavailable"].includes(raw.grouping?.state) ? raw.grouping.state : "disabled", sources: role === "operator" && Array.isArray(raw.grouping?.sources ?? raw.groupingStatuses) ? (raw.grouping?.sources ?? raw.groupingStatuses).map((r) => ({ runId: id5(r?.runId), status: ["unassigned", "pending", "assigned", "source-expired", "source-unavailable", "source-oversize", "candidates-expired", "group-limit", "stale", "refused", "failed"].includes(r?.status) ? r.status : "source-unavailable" })).filter((r) => r.runId) : [] }
-  };
-  out.fixes = Array.isArray(raw.fixes) ? raw.fixes.map((f) => ({ id: id5(f?.id), at: number2(f?.at), undoneAt: number2(f?.undoneAt), kind: ["instructions", "config"].includes(f?.kind) ? f.kind : "config", groupId: id5(f?.groupId), reason: typeof f?.reason === "string" && /^[a-z][a-z0-9-]{0,79}$/.test(f.reason) ? f.reason : null, triggerIndex: Number.isSafeInteger(f?.triggerIndex) && f.triggerIndex >= 0 ? f.triggerIndex : null, beforeCount: number2(f?.beforeCount), afterCount: number2(f?.afterCount), spanMs: number2(f?.spanMs), partial: f?.partial !== false, subsequentRuns: count5(f?.subsequentRuns), status: ["observing", "improved", "unchanged", "worse"].includes(f?.status) ? f.status : "observing" })).filter((f) => f.id) : [];
-  if (role === "operator") out.groups = Array.isArray(raw.groups) ? raw.groups.map((g) => ({ id: id5(g?.id), name: text3(g?.name, 120), scopeId: scope(g?.scopeId), repo: text3(g?.repo), project: text3(g?.project, 64), count: count5(g?.count), runIds: runIds(g?.runIds), status: ["open", "fixed", "unassigned"].includes(g?.status) ? g.status : "open", fixedAt: number2(g?.fixedAt), triggerIndex: Number.isSafeInteger(g?.triggerIndex) && g.triggerIndex >= 0 ? g.triggerIndex : null })).filter((g) => g.id) : [];
-  return out;
-}
-var CAUSES, id5, number2, count5, text3, scope, causes, runIds;
-var init_zero_touch_view = __esm({
-  "src/zero-touch-view.mjs"() {
-    CAUSES = Object.freeze(["question-answer", "approval-decision", "rerun", "config-fix", "steer", "cancel"]);
-    id5 = (v) => typeof v === "string" && /^[A-Za-z0-9._:-]{1,200}$/.test(v) ? v : null;
-    number2 = (v) => Number.isFinite(v) && v >= 0 ? v : null;
-    count5 = (v) => Number.isSafeInteger(v) && v >= 0 ? v : 0;
-    text3 = (v, max = 200) => typeof v === "string" && [...v].length <= max && !/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/.test(v) ? v : null;
-    scope = (v) => typeof v === "string" && /^[a-f0-9]{32,64}$/.test(v) ? v : null;
-    causes = (v) => CAUSES.map((cause) => ({ cause, count: count5(Array.isArray(v) ? v.find((row2) => row2?.cause === cause)?.count : v?.[cause]) }));
-    runIds = (v) => Array.isArray(v) ? [...new Set(v.map(id5).filter(Boolean))].slice(0, 5e3) : [];
-  }
-});
-
-// src/console/panels/zero-touch.mjs
-function zeroTouchTabs(view) {
-  const here = view?.page === "zero-touch";
-  const sandboxes = view?.page === "sandboxes";
-  return tabs([{ label: "All runs", href: "/runs", icon: "runs", current: !here && !sandboxes }, { label: "Zero touch", href: "/runs/zero-touch", icon: "flag", current: here }, ...view?.role === "operator" ? [{ label: "Sandboxes", href: "/runs/sandboxes", icon: "box", current: sandboxes }] : []], { label: "Runs views" });
-}
-function zeroTouchControls(view) {
-  const m = model3(view);
-  return seg([7, 30, 90].map((days) => ({ label: `${days} days`, href: `/runs/zero-touch?${new URLSearchParams({ days: String(days), ...view?.query?.project ? { project: view.query.project } : {}, ...view?.query?.scope ? { scope: view.query.scope } : {} })}`, on: days === m.windowDays })), { label: "Window" });
-}
-function delta(n2, previousRate = null) {
-  if (!Number.isFinite(n2)) return html`<span class="zt-tr">Previous interval not covered</span>`;
-  return html`<span class="${`zt-tr${n2 < 0 ? " tone-ok" : n2 > 0 ? " tone-attention" : ""}`}">${icon(n2 < 0 ? "chev" : n2 > 0 ? "chev-r" : "info", { size: "sm" })}<b>${n2 === 0 ? "no change" : `${n2 < 0 ? "down" : "up"} ${amount2(Math.abs(n2))} points`}</b>${previousRate === null ? null : html`<small>from ${pct(previousRate)}</small>`}</span>`;
-}
-function coverage(m) {
-  return html`<p class="zt-coverage" role="status">${m.coverage.partial ? html`<b>Partial ${m.windowDays}-day window.</b> Covered from ${date(m.coverage.fromMs)} UTC. Older unknown runs are not counted as untouched.` : html`Whole ${m.windowDays}-day window.`}${m.coverage.reasons.length ? html` ${m.coverage.reasons.join("; ")}.` : null}</p>`;
-}
-function spark(m) {
-  const rows3 = m.trend;
-  if (!rows3.some((r) => Number.isFinite(r.rate) && !r.partial)) return html`<p class="zt-kps">Weekly trend is not covered yet.</p>`;
-  const top = Math.max(32, ...rows3.map((r) => r.rate ?? 0));
-  const x = (i) => rows3.length === 1 ? 200 : i * 200 / (rows3.length - 1);
-  const y = (n2) => 56 - n2 / top * 56;
-  const segments = [];
-  let points = [];
-  for (const [i, row2] of rows3.entries()) {
-    if (row2.rate === null || row2.partial) {
-      if (points.length) segments.push(points);
-      points = [];
-    } else points.push(`${svgNum(x(i), 0, 200)},${svgNum(y(row2.rate), 0, 56)}`);
-  }
-  if (points.length) segments.push(points);
-  const last = rows3[rows3.length - 1];
-  const label2 = `Rolling ${m.windowDays}-day touch rate at weekly intervals: ${rows3.map((r) => r.partial || r.rate === null ? "not covered" : pct(r.rate)).join(", ")}. Goal under 5 percent.`;
-  return html`<svg class="zt-spark" viewBox="-4 -4 208 64" preserveAspectRatio="none" role="img" aria-label="${label2}"><line class="zt-spark__goal" x1="0" x2="200" y1="${svgNum(y(5), 0, 56)}" y2="${svgNum(y(5), 0, 56)}"/>${segments.map((p) => html`<polyline class="zt-spark__l" points="${p.join(" ")}"/>`)}${last?.rate !== null && !last?.partial ? html`<circle class="zt-spark__d" cx="200" cy="${svgNum(y(last.rate), 0, 56)}" r="3.5"/>` : null}</svg><p class="zt-spark__ax"><span>${date(rows3[0]?.atMs)}</span><span>goal, dashed</span><span>now</span></p><p class="sr">${label2}</p>`;
-}
-function longest(m) {
-  return [...m.projects].filter((p) => p.streakDays !== null && !p.waitingNow).sort((a, b) => b.streakDays - a.streakDays)[0] ?? null;
-}
-function waitingHistory(m) {
-  return m.totals.waitingPartial ? html`<p class="zt-note" role="status">Waiting history is incomplete. An older park predates retained answer history; its current state and wait time are not known.</p>` : null;
-}
-function compact(m) {
-  const best = longest(m);
-  return html`<ul class="ztp-now"><li><span>${icon("flag", { size: "sm" })}Longest streak</span><b>${best ? `${best.name}, ${amount2(best.streakDays)} ${best.streakDays === 1 ? "day" : "days"}` : "Not enough history"}</b></li><li><span>${icon("clock", { size: "sm" })}Waited on a person</span><b>${m.totals.waitingPartial ? "Not known" : `${amount2(m.totals.waitingHours)}h, median ${span(m.totals.medianWaitMs)}`}</b></li><li><span>${icon("edit", { size: "sm" })}Answered from a draft</span><b>${m.totals.draftAnswers} ${m.totals.draftAnswers === 1 ? "run" : "runs"}</b><span>${ZERO_TOUCH_WORDS.drafts}${m.coverage.partial ? html` ${ZERO_TOUCH_WORDS.draftsPartial}` : null}</span></li><li><span>${icon("parked", { size: "sm" })}Waiting now</span><b>${m.totals.waitingPartial ? "Not known" : `${m.totals.pending} ${m.totals.pending === 1 ? "run" : "runs"}`}</b>${m.waitingRuns.slice(0, 3).map((r) => html`<span>${link(r.runId)}, ${span(m.nowMs - r.parkedAt)}</span>`)}</li></ul>${waitingHistory(m)}`;
-}
-function zeroTouchRate(view) {
-  const m = model3(view);
-  return card({ title: `Touch rate, ${m.windowDays} days`, body: html`${fail4(m)}${m.state === "ready" ? html`${kpi(m.totals.runs ? pct(m.totals.rate) : "No runs", `${m.totals.touched} of ${m.totals.runs} runs needed a person`)}${spark(m)}<p class="zt-kp"><span class="zt-kt">${icon("flag", { size: "sm" })}goal under 5%</span>${delta(m.totals.deltaPoints, m.totals.previousRate)}</p>${coverage(m)}<p class="zt-kps">${m.totals.stopped} stopped before they ran, outside the rate.${m.totals.stoppedUnattributed > 0 ? html` ${m.totals.stoppedUnattributed} stops have no recorded project or scope, so this selection may have more.` : null}</p><div class="zt-phone-summary">${compact(m)}</div>` : null}` });
-}
-function zeroTouchStreak(view) {
-  const m = model3(view), best = longest(m);
-  return card({ title: "Zero-touch streak", body: html`${fail4(m)}${kpi(best ? `${amount2(best.streakDays)} ${best.streakDays === 1 ? "day" : "days"}` : "Not enough history", best ? `${best.name}, the longest now` : "30 days of observed activity establish a zero-touch project")}<p class="zt-kp">${m.projects.filter((p) => p !== best).sort((a, b) => (b.streakDays ?? -1) - (a.streakDays ?? -1)).map((p) => p.waitingNow ? chip(`${p.name} waiting now`, { status: "parked", icon: "parked" }) : html`<span class="zt-kt">${p.name} ${p.streakDays === null ? "not known" : `${amount2(p.streakDays)} ${p.streakDays === 1 ? "day" : "days"}`}</span>`)}</p>` });
-}
-function zeroTouchWait(view) {
-  const m = model3(view);
-  if (m.state !== "ready") return card({ title: "Waiting for a person", body: fail4(m) });
-  return card({ title: "Waiting for a person", body: html`${fail4(m)}${kpi(m.totals.waitingPartial ? "Not known" : `${amount2(m.totals.waitingHours)}h`, `runs waited on a person in ${m.windowDays} days`)}<p class="zt-kps">Median wait for an answer <b>${span(m.totals.medianWaitMs)}</b></p>${waitingHistory(m)}<p class="zt-kp">${chip(m.totals.waitingPartial ? "Pending count not known" : `${m.totals.pending} waiting now`, { status: "parked", icon: "parked" })}${m.waitingRuns.slice(0, 3).map((r) => html`<span>${link(r.runId)}, ${span(m.nowMs - r.parkedAt)}</span>`)}</p>` });
-}
-function zeroTouchHandled(view) {
-  const m = model3(view);
-  return card({ title: "Answered from a draft", body: m.state !== "ready" ? fail4(m) : html`${kpi(m.totals.draftAnswers, "runs answered in the covered interval")}<p class="zt-kps">${ZERO_TOUCH_WORDS.drafts}</p>${m.coverage.partial ? html`<p class="zt-kps" role="status">${ZERO_TOUCH_WORDS.draftsPartial}</p>` : null}` });
-}
-function meter2(row2) {
-  if (row2.rate === null) return html`<span class="zt-m">Not enough history</span>`;
-  const tone = row2.rate < 5 ? "ok" : row2.rate < 30 ? "attention" : "failed";
-  const word4 = row2.rate < 5 ? "Under goal" : row2.rate < 30 ? "Above goal" : "High";
-  return html`<span class="zt-m"><svg class="${`pbar tone-${tone}`}" height="10" role="meter" aria-valuenow="${svgNum(row2.rate, 0, 100)}" aria-valuemin="0" aria-valuemax="100" aria-label="${`${row2.name}: ${pct(row2.rate)} of runs needed a person, goal under 5 percent; meter scale 40 percent`}"><rect class="pbar__bed" width="100%" height="10" rx="5"/><rect class="pbar__fill" width="${`${svgNum(row2.rate / 40 * 100, 0, 100)}%`}" height="10" rx="5"/><line class="zt-goal" x1="12.5%" x2="12.5%" y1="-4" y2="14"/></svg><span class="zt-mv"><b>${pct(row2.rate)}</b><span class="${`zt-lv tone-${tone}`}">${icon(tone === "ok" ? "done" : "attention", { size: "sm" })}${word4}</span></span></span>`;
-}
-function rowContent(row2, sub2 = false) {
-  const c = causesByKey.get(row2.topCause);
-  return html`<span class="zt-chev">${sub2 ? null : icon("chev-r", { size: "sm" })}</span><span class="zt-name"><b>${row2.name}</b><small>${sub2 ? `${row2.runs} runs` : row2.repositories.map((r) => r.name).join(" and ")}</small></span>${meter2(row2)}${delta(row2.deltaPoints, row2.previousRate)}<span class="zt-n"><b>${row2.touched}</b> of ${row2.runs} runs</span><span class="${`zt-st${row2.waitingNow ? " tone-parked" : ""}`}">${icon(row2.waitingNow ? "parked" : "flag", { size: "sm" })}${row2.waitingPartial ? "waiting history incomplete" : row2.waitingNow ? "waiting now" : row2.zeroTouch ? "zero touch, 30+ days" : row2.streakDays === null ? "not enough history" : `${amount2(row2.streakDays)} ${row2.streakDays === 1 ? "day" : "days"}`}</span><span class="zt-c">${c ? html`<span class="${`zt-cause tone-${c.tone}`}">${icon(c.icon, { size: "sm" })}${c.short}</span>` : "No touches"}</span>`;
-}
-function phoneProjects(m, view) {
-  const item2 = (row2, repository = false) => {
-    const c = causesByKey.get(row2.topCause), tone = row2.rate === null ? "idle" : row2.rate < 5 ? "ok" : row2.rate < 30 ? "attention" : "failed";
-    const word4 = row2.rate === null ? "Not known" : row2.rate < 5 ? "Under goal" : row2.rate < 30 ? "Above goal" : "High";
-    const query = new URLSearchParams({ days: String(m.windowDays), ...row2.project ? { project: row2.project } : {}, ...repository && row2.scopeId ? { scope: row2.scopeId } : {} });
-    return html`<li><a class="ztp-p" href="${`/runs/zero-touch?${query}`}" aria-label="${`${row2.name}: ${pct(row2.rate)}, open ${repository ? "repository" : "project"}`}"${repository ? html` data-repository` : null}><span class="ztp-p__n"><b>${row2.name}</b><small>${row2.touched} of ${row2.runs} runs</small></span><span class="ztp-p__r"><b>${pct(row2.rate)}</b><span class="${`zt-lv tone-${tone}`}">${icon(tone === "ok" ? "done" : "attention", { size: "sm" })}${word4}</span></span><span class="ztp-p__c">${c ? html`<span class="${`zt-cause tone-${c.tone}`}">${icon(c.icon, { size: "sm" })}${c.short}</span>` : html`<span>No touches</span>`}${delta(row2.deltaPoints, row2.previousRate)}</span><span class="ztp-p__go">${icon("chev-r", { size: "sm" })}</span></a></li>`;
-  };
-  return html`<ul class="ztp-ps zt-phone-projects">${m.projects.map((p) => html`${item2(p)}${view?.query?.project === p.project ? p.repositories.map((r) => item2(r, true)) : null}`)}</ul>`;
-}
-function zeroTouchProjects(view) {
-  const m = model3(view);
-  if (m.state !== "ready") return card({ title: "By project", body: fail4(m) });
-  const head = html`<div class="zt-row zt-row--head" aria-hidden="true"><span></span><span>Project</span><span>Touch rate, goal tick at 5%</span><span>Against the previous interval</span><span>Needed a person</span><span>Since the last touch</span><span>Most often</span></div>`;
-  const rows3 = m.projects.map((p) => html`<li><details class="zt-p"${view?.query?.project === p.project ? html` open` : null}><summary class="zt-row" aria-label="${`${p.name}: ${pct(p.rate)}, show its repositories or folders`}">${rowContent(p)}</summary><ul class="zt-subs">${p.repositories.map((r) => html`<li class="zt-row zt-row--sub">${rowContent(r, true)}</li>`)}</ul>${acts3(view) && p.touchedRunIds.length ? html`<p class="zt-foot"><a class="link" href="${`/runs?${new URLSearchParams({ project: p.project ?? "", touched: "1", days: String(m.windowDays) })}`}">Open touched runs</a></p>` : null}</details></li>`);
-  return card({ title: "By project", sub: `${m.totals.touched} of ${m.totals.runs} runs needed a person`, flush: true, body: html`${fail4(m)}${m.projects.length ? html`<div class="zt-tbl zt-desktop-projects">${head}<ul class="zt-list">${rows3}</ul></div>${phoneProjects(m, view)}<p class="zt-foot">${icon("info", { size: "sm" })}<span>A row opens to its repositories or folders. A run counts once, however many interventions it received.</span></p>` : html`<p class="zt-note">${ZERO_TOUCH_WORDS.empty}</p>`}` });
-}
-function causeCounts(values) {
-  return ZERO_TOUCH_CAUSES.map((c) => ({ ...c, count: values.find((v) => v.cause === c.cause)?.count ?? 0 }));
-}
-function causeBar(values, max, name3) {
-  const rows3 = causeCounts(values);
-  let at2 = 0;
-  max = Math.max(1, max, rows3.reduce((sum, row2) => sum + row2.count, 0));
-  const all = rows3.filter((r) => r.count > 0);
-  const label2 = `${name3}: ${all.map((r) => `${r.label} ${r.count}`).join(", ") || "no touches"}; full scale ${max} touched runs`;
-  return html`<svg class="zt-cause-svg" width="100%" height="28" role="img" aria-label="${label2}">${all.map((r) => {
-    const x = at2 / Math.max(1, max) * 500, w = r.count / Math.max(1, max) * 500;
-    at2 += r.count;
-    return html`<g class="${`tone-${r.tone}`}"><rect class="zt-cause-rect" x="${`${svgNum(x / 5, 0, 100)}%`}" y="0" width="${`${svgNum(w / 5, 0, 100)}%`}" height="28" rx="5"/>${w >= 22 ? html`<text class="zt-cause-label" x="${`${svgNum((x + w / 2) / 5, 0, 100)}%`}" y="18" text-anchor="middle">${r.count}</text>` : null}</g>`;
-  })}</svg>`;
-}
-function zeroTouchCauses(view) {
-  const m = model3(view), max = Math.max(1, ...m.projects.map((p) => Math.max(p.touched, causeCounts(p.causes).reduce((sum, row2) => sum + row2.count, 0))));
-  if (m.state !== "ready") return card({ title: "What needed a person", body: fail4(m) });
-  const bars = m.projects.map((p) => html`<li class="zt-cb"><span class="zt-cb__n"><b>${p.name}</b><small>${p.touched} of ${p.runs}</small></span>${causeBar(p.causes, max, p.name)}<p class="zt-cb__t">${causeCounts(p.causes).filter((c) => c.count).map((c) => `${c.short} ${c.count}`).join(" \xB7 ") || "No touches"}</p></li>`);
-  const scopeLabel = view?.query?.scope ? "selected repository" : view?.query?.project ? "selected project" : "all projects";
-  return card({ title: "What needed a person", sub: html`<span class="zt-desktop-label">last ${m.windowDays} days, by project</span><span class="zt-phone-label">${m.windowDays} days, ${scopeLabel}</span>`, body: html`${fail4(m)}<ul class="zt-bars zt-desktop-causes">${bars}</ul><div class="zt-phone-causes">${causeBar(m.causes, Math.max(1, m.totals.touched), scopeLabel === "all projects" ? "All projects" : scopeLabel)}</div><ul class="zt-whys">${causeCounts(m.causes).map((c) => html`<li class="zt-why">${tile(c.tone === "running" ? "running" : c.tone === "idle" ? "idle" : c.tone, { icon: c.icon, sm: true })}<span><b>${c.label}</b><small>${c.detail}</small></span><span class="zt-why__n">${c.count}</span></li>`)}<li class="zt-why zt-why--sum"><span></span><span><b>Runs that needed a person</b></span><span class="zt-why__n">${m.totals.touched}</span></li></ul><p class="zt-merge">${icon("pr", { size: "sm" })}<span>Merging is never a touch. <a class="link" href="#zt-counting">How touches are counted</a></span></p><details class="zt-counting" id="zt-counting"><summary>How touches are counted</summary><p class="zt-kps">The rate counts workload runs with a retained record that ended in the covered interval. Each run counts once. Bars assign it to its first successful human intervention; later interventions remain in history. Jobs stopped before starting are separate. Reads, sandbox opens, automatic starts and internal grouping jobs do not enter the touch count.</p></details>` });
-}
-function guardedForm(action2, { hidden: hidden2 = [], fields: fields2 = null, label: label2, kind = ["sm"] } = {}) {
-  return html`<form class="act zt-action" data-action="${action2}" autocomplete="off"><fieldset data-config-controls disabled>${hidden2.map(([name3, value, type]) => html`<input type="hidden" name="${name3}" value="${value}"${type ? html` data-type="${type}"` : null}>`)}${fields2}${btn({ type: "submit", kind, label: label2 })}</fieldset><noscript><p class="zt-kps">${ZERO_TOUCH_NO_SCRIPT}</p></noscript><p class="field__err" data-form-error hidden role="alert"></p></form>`;
-}
-function nameForm(g, index2) {
-  const key2 = `zt-name-${index2}`;
-  return html`<details class="zt-editor"><summary class="link">${g.name ? "Rename this group" : "Name this group"}</summary>${guardedForm("zero-touch-name", { hidden: [["groupId", g.id]], fields: field2({ label: "Group name", id: key2, control: input2({ id: key2, name: "name", value: g.name, required: true }), hint: "Write your own name, up to 120 characters. Question text is read only on its run page." }), label: "Preview name" })}</details>`;
-}
-function instructionForm(g, index2) {
-  if (!g.runIds[0] || g.triggerIndex === null) return html`<p class="zt-kps">Add to instructions is unavailable: a retained run and a current non-cron trigger are required.</p>`;
-  const key2 = `zt-sentence-${index2}`;
-  return html`<details class="zt-editor"><summary class="link">Add to instructions</summary>${guardedForm("zero-touch-instruction", { hidden: [["runId", g.runIds[0]], ["groupId", g.id], ["index", g.triggerIndex, "int"]], fields: field2({ label: "Sentence to add", id: key2, control: textarea({ id: key2, name: "sentence", required: true, rows: 3, maxlength: 2e3 }), hint: "Preview the exact diff, then Confirm. The trigger's existing instructions count toward the 2,000-character limit." }), label: `Preview trigger ${g.triggerIndex + 1}`, kind: ["sm", "primary"] })}</details>`;
-}
-function zeroTouchQuestions(view) {
-  if (view?.role !== "operator") return collapsed({ icon: "parked", title: "Questions it keeps asking", body: "are for operators. Rates, causes, streaks and fixes are shown here." });
-  const m = model3(view);
-  if (m.state !== "ready") return card({ title: "Questions it keeps asking", body: fail4(m) });
-  const rows3 = m.groups.map((g, index2) => html`<li class="zt-q"><div class="zt-q__h"><span class="zt-q__n" aria-label="${`asked ${g.count} times`}">${g.count}×</span><div><p class="${`zt-q__t${g.name ? "" : " zt-q__t--un"}`}">${g.name ?? `${g.count} similar questions, not named yet`}</p><p class="zt-q__s"><span class="code">${g.repo ?? g.project ?? "Repository not known"}</span>${g.status === "fixed" && g.fixedAt !== null ? html` · fixed ${date(g.fixedAt)} UTC` : null}${g.status === "fixed" && m.fixes.some((f) => f.groupId === g.id && f.afterCount === 0 && f.subsequentRuns > 0 && !f.partial && f.undoneAt === null) ? html` · none since` : null}</p></div><span class="zt-q__st">${chip(g.status === "fixed" ? "Fixed" : g.status === "unassigned" ? "Unassigned" : "Open", { status: g.status === "fixed" ? "ok" : "parked", icon: g.status === "fixed" ? "done" : "parked" })}</span></div><p class="zt-said">${icon("runs", { size: "sm" })}<span>Asked in ${g.runIds.slice(0, 8).map((id6, at2) => html`${at2 ? ", " : ""}${link(id6)}`)}${g.runIds.length > 8 ? ` and ${g.runIds.length - 8} more` : null}.</span></p>${acts3(view) ? html`<div class="zt-q__act">${nameForm(g, index2)}${g.status !== "fixed" ? instructionForm(g, index2) : html`<a class="link" href="#p-zt-fixes">See the fix</a>`}</div>` : null}</li>`);
-  const phoneRows = m.groups.map((g, index2) => html`<li class="ztp-q"><span class="zt-q__n" aria-label="${`asked ${g.count} times`}">${g.count}×</span><span class="ztp-q__t"><b>${g.runIds[0] ? html`<a class="zt-group-link" href="${`/run?id=${encodeURIComponent(g.runIds[0])}`}">${g.name ?? `${g.count} similar, not named yet`}</a>` : g.name ?? `${g.count} similar, not named yet`}</b><small>${g.repo ?? g.project ?? "Repository not known"}</small></span><span class="ztp-q__st">${chip(g.status === "fixed" ? "Fixed" : g.status === "unassigned" ? "Unassigned" : "Open", { status: g.status === "fixed" ? "ok" : "parked", icon: g.status === "fixed" ? "done" : "parked" })}</span><span class="ztp-q__a">${acts3(view) ? g.status === "fixed" ? html`<a class="link" href="#p-zt-fixes">See the fix</a>` : g.name ? instructionForm(g, `phone-${index2}`) : nameForm(g, `phone-${index2}`) : null}</span></li>`);
-  const sources = m.grouping.sources.length ? m.grouping.sources : m.ungroupedRunIds.map((runId2) => ({ runId: runId2, status: "unassigned" }));
-  return card({ title: "Questions it keeps asking", sub: "operator only", body: html`<p class="zt-intro">Grouped by meaning. You name each group; read the questions on their run pages.</p>${fail4(m)}${m.grouping.partial ? html`<p class="zt-note" role="status">Question grouping is partial. Missing or unclassified sources are not evidence that a question stopped recurring.</p>` : null}${["unavailable", "configuration-unavailable"].includes(m.grouping.state) ? html`<p class="zt-note" role="status">${m.grouping.state === "configuration-unavailable" ? "Grouping configuration could not be read. Check the reviewed triggers file before starting a grouping job." : "Question groups could not be read. Reload to retry; missing assignments are not an empty group list."}</p>` : null}${rows3.length ? html`<ol class="zt-qs zt-desktop-questions">${rows3}</ol><ol class="ztp-qs zt-phone-questions">${phoneRows}</ol>` : html`<p class="zt-kps">${["unavailable", "configuration-unavailable"].includes(m.grouping?.state) ? "Grouping coverage is not known. Reload after the source is available." : ZERO_TOUCH_WORDS.noGroups}</p>`}${sources.length ? html`<ul class="zt-ungrouped">${sources.slice(0, 20).map((source2) => html`<li data-group-status="${source2.status}">${link(source2.runId)}<span>${ZERO_TOUCH_SOURCE_WORDS[source2.status]}</span>${acts3(view) && ["unassigned", "stale", "refused", "failed"].includes(source2.status) ? guardedForm("zero-touch-group", { hidden: [["runId", source2.runId]], label: "Group question", kind: ["sm", "paid"] }) : null}</li>`)}</ul>` : null}<p class="zt-foot zt-foot--in">${icon("info", { size: "sm" })}<span>${m.grouping.enabled ? `${plural5(m.grouping.pending, "grouping job")} pending; ${plural5(m.grouping.unassigned, "question")} unassigned. Expired or unavailable context stays ungrouped.` : "Private capture and a capped classifier must be enabled in the reviewed zeroTouch configuration before questions can be grouped."}</span></p>` });
-}
-function fixTone(f) {
-  if (f.partial || f.subsequentRuns === 0 || f.undoneAt !== null || f.status === "observing") return "idle";
-  return f.status === "improved" ? "ok" : f.status === "worse" ? "failed" : "idle";
-}
-function fixObservation(f) {
-  if (f.undoneAt !== null) return "Reverted: this observation does not establish current effectiveness.";
-  if (f.partial) return "Partial observation: effectiveness is not established.";
-  if (f.subsequentRuns === 0) return "No subsequent runs yet: effectiveness is not established.";
-  return f.status === "improved" ? "Fewer occurrences over equal observed spans." : f.status === "worse" ? "More occurrences over equal observed spans." : f.status === "unchanged" ? "The same number of occurrences over equal observed spans." : "Still observing the targeted cause.";
-}
-function beforeAfter(label2, value, max, tone = "attention") {
-  return html`<p class="zt-ba"><span>${label2}</span><svg class="${`pbar tone-${tone}`}" height="8" role="img" aria-label="${`${label2}: ${value === null ? "not known" : value}`}"><rect class="pbar__bed" width="100%" height="8" rx="4"/>${value ? html`<rect class="pbar__fill" width="${`${svgNum(value / max * 100, 0, 100)}%`}" height="8" rx="4"/>` : null}</svg><b>${value ?? "?"}</b></p>`;
-}
-function zeroTouchFixes(view) {
-  const m = model3(view);
-  const evidence = html`${m.fixesPartial ? html`<p class="zt-note" role="status">Fix history is incomplete. Reload to retry; missing changes are not evidence that no fix was made.</p>` : null}${m.fixes.length ? html`<ol class="zt-fxs">${m.fixes.map((f) => html`<li class="zt-fx"><p class="zt-fx__d">${date(f.at)} UTC${f.undoneAt === null ? null : html` · Reverted ${date(f.undoneAt)} UTC`}</p><p class="zt-fx__w">${f.kind === "instructions" ? `Trigger ${f.triggerIndex === null ? "not known" : f.triggerIndex + 1}'s instructions gained a sentence` : "Configuration changed to address a refusal"}</p><p class="zt-fx__m">${f.reason ? `${f.reason} refusals` : "Questions in the targeted group"}, equal ${span(f.spanMs)} spans before and after; ${f.subsequentRuns} workload runs after the fix.</p>${beforeAfter("Before", f.beforeCount, Math.max(f.beforeCount ?? 0, f.afterCount ?? 0, 1))}${beforeAfter("After", f.afterCount, Math.max(f.beforeCount ?? 0, f.afterCount ?? 0, 1), fixTone(f))}<p class="zt-kps">${fixObservation(f)}</p>${acts3(view) && f.kind === "instructions" && f.undoneAt === null ? guardedForm("zero-touch-undo", { hidden: [["fixId", f.id]], label: "Preview removing the sentence", kind: ["sm", "ghost"] }) : null}</li>`)}</ol>` : html`<p class="zt-kps">${m.fixesPartial ? "Fix history is not known. Reload after the source is available." : ZERO_TOUCH_WORDS.noFixes}</p>`}`;
-  const brief = m.fixes.map((f) => `${f.reason ?? "grouped questions"}: ${f.beforeCount ?? "?"} to ${f.afterCount ?? "?"}`).join("; ");
-  return card({ title: "Fixes that worked", sub: "what changed, and what it did", body: html`<div class="zt-desktop-fixes">${evidence}</div><details class="zt-phone-fixes"><summary>${icon("done", { size: "sm" })}<span><b>${m.fixesPartial ? "Fix history incomplete" : `${m.fixes.length} fixes recorded`}</b>${brief ? `: ${brief}. ` : ". "}<span class="link">Open observations</span></span></summary><div class="zt-fix-observations">${evidence}</div></details>` });
-}
-var ZERO_TOUCH_WORDS, ZERO_TOUCH_CAUSES, ZERO_TOUCH_SOURCE_WORDS, causesByKey, model3, acts3, pct, amount2, date, span, link, fail4, ZERO_TOUCH_NO_SCRIPT, ZERO_TOUCH_PANELS;
-var init_zero_touch = __esm({
-  "src/console/panels/zero-touch.mjs"() {
-    init_common();
-    init_html();
-    init_kit();
-    init_zero_touch_view();
-    ZERO_TOUCH_WORDS = Object.freeze({ unavailable: "Zero touch could not be read. Reload to try again; missing history is never counted as zero touches.", empty: "No workload runs ended in the covered interval.", drafts: "Sent by a person, edited or as drafted. Each run still counts as a touch.", draftsPartial: "Partial history; this counts retained runs only.", viewer: "Questions it keeps asking are for operators. Rates, causes, streaks and fixes are shown here.", noGroups: "No question groups yet. Group retained questions with a capped decision job; name each group yourself.", noFixes: "No cause-linked fixes recorded yet. Start a change from a refusal or a question group to measure it here." });
-    ZERO_TOUCH_CAUSES = Object.freeze([
-      { cause: "question-answer", label: "Questions", short: "Questions", icon: "parked", tone: "parked", detail: "A person answered a parked question and the source session resumed." },
-      { cause: "approval-decision", label: "Approvals", short: "Approvals", icon: "shield", tone: "attention", detail: "A person approved or declined a request. System expiry is excluded." },
-      { cause: "rerun", label: "Failed or refused, then re-run", short: "Re-run", icon: "failed", tone: "failed", detail: "A person started a failed or refused run again." },
-      { cause: "config-fix", label: "Refused until config was fixed", short: "Config fixed", icon: "refused", tone: "refused", detail: "A confirmed configuration change explicitly targeted the refusal." },
-      { cause: "steer", label: "Steered", short: "Steered", icon: "steer", tone: "running", detail: "A person's steering message was delivered to the run." },
-      { cause: "cancel", label: "Cancelled", short: "Cancelled", icon: "cancel", tone: "idle", detail: "A person cancelled the run while it was active." }
-    ]);
-    ZERO_TOUCH_SOURCE_WORDS = Object.freeze({
-      unassigned: "Not grouped yet.",
-      pending: "A grouping job is pending.",
-      assigned: "Assigned to a question group.",
-      "source-expired": "The retained question context expired. Open the run to read what remains; a new grouping job cannot restore it.",
-      "source-unavailable": "The worker could not retain safe question context. Check transcript capture on the source host.",
-      "source-oversize": "The private question context exceeds its byte limit. It remains ungrouped rather than being cut.",
-      "candidates-expired": "A group's representative context expired. Review the groups before trying again.",
-      "group-limit": "The repository reached the bounded group limit. Review existing groups before trying again.",
-      stale: "The group revision changed during classification. Preview a fresh grouping job.",
-      refused: "The grouping job was refused. Open its run to see the policy reason.",
-      failed: "The grouping job failed. Open its run and review the failure before trying again."
-    });
-    causesByKey = new Map(ZERO_TOUCH_CAUSES.map((c) => [c.cause, c]));
-    model3 = (v) => zeroTouchView(v?.data?.zeroTouch, { role: v?.role, windowDays: v?.query?.days ?? 30, nowMs: v?.now ?? 0 });
-    acts3 = (v) => v?.role === "operator" && !v?.readOnly;
-    pct = (n2) => Number.isFinite(n2) ? `${Math.round(n2)}%` : "Not known";
-    amount2 = (n2) => Number.isFinite(n2) ? new Intl.NumberFormat("en-US", { maximumFractionDigits: 1 }).format(n2) : "Not known";
-    date = (n2) => Number.isFinite(n2) && n2 >= 0 && n2 <= 864e13 ? new Date(n2).toISOString().slice(0, 10) : "not known";
-    span = (ms3) => ms3 === null ? "not known" : ms3 >= 36e5 ? `${amount2(ms3 / 36e5)}h` : `${amount2(ms3 / 6e4)}m`;
-    link = (id6) => html`<a class="link code" href="${`/run?id=${encodeURIComponent(id6)}`}">${id6}</a>`;
-    fail4 = (m) => m.state === "unavailable" ? html`<p class="zt-note" role="status">${ZERO_TOUCH_WORDS.unavailable}</p>` : null;
-    ZERO_TOUCH_NO_SCRIPT = "Enable JavaScript to preview and confirm a change. Reading and navigation work without it.";
-    ZERO_TOUCH_PANELS = Object.freeze([["p-zt-rate", zeroTouchRate], ["p-zt-streak", zeroTouchStreak], ["p-zt-wait", zeroTouchWait], ["p-zt-handled", zeroTouchHandled], ["p-zt-projects", zeroTouchProjects], ["p-zt-causes", zeroTouchCauses], ["p-zt-questions", zeroTouchQuestions], ["p-zt-fixes", zeroTouchFixes]]);
-  }
-});
-
-// src/trigger-policy.mjs
-function triggerWhoMayFire(trigger2) {
-  const on = trigger2.on ?? trigger2;
-  const forge = trigger2.run?.kind ?? trigger2.forge;
-  const kind = on.type;
-  if (kind === "cron") return "This deployment's scheduler starts it on its schedule; an operator may fire it by hand.";
-  if (forge === "gitlab") return "The actor must be a GitLab project member with Developer access (30) or higher, including inherited membership.";
-  if (forge === "forgejo") return "The actor must have Forgejo repository owner, admin or write permission.";
-  if (forge === "azure") return "The actor must be an Azure DevOps project member admitted by the receiver's membership check.";
-  if (kind === "label") return "A collaborator applies the matching issue label; the label event supplies the approval.";
-  if (kind === "comment") return "The commenter's GitHub association must be OWNER, MEMBER or COLLABORATOR; the service's own comments are refused.";
-  const actions = Array.isArray(on.action) ? on.action : [];
-  const gates = [];
-  if (kind === "issue" || actions.includes("closed")) gates.push("The closer must have repository write access");
-  if (actions.includes("labeled")) gates.push("A collaborator-applied matching label supplies approval");
-  if (actions.includes("review_submitted")) gates.push("The reviewer's association must be OWNER, MEMBER or COLLABORATOR, regardless of the pull request author's association");
-  if (actions.some((a) => ["opened", "synchronize", "reopened"].includes(a))) gates.push("The pull request author's association must be OWNER, MEMBER or COLLABORATOR");
-  return `${gates.join(". ") || "The receiver checks the actor's authority for the configured event"}.`;
-}
-var init_trigger_policy = __esm({
-  "src/trigger-policy.mjs"() {
-  }
-});
-
 // src/trigger-edit-core.mjs
 import * as nodeFs26 from "node:fs";
 import { createHash as createHash37 } from "node:crypto";
@@ -37333,6 +36989,7 @@ function flowAnswer(row2, trigger2) {
   const found = (row2.flows ?? []).find((entry3) => entry3.trigger === trigger2.index && entry3.flow === trigger2.flow);
   if (!found) return null;
   if (found.tier === "package" && (trigger2.excludeExtensions ?? []).includes(found.package)) return null;
+  if (found.tier === "package" && trigger2.packages === false) return null;
   return found.tier === "package" ? `from ${found.package ?? "a staged package"}` : FLOW_TIER_WORDS[found.tier] ?? null;
 }
 function lacksFlow(row2, trigger2) {
@@ -37472,7 +37129,7 @@ function overlayStem(segment) {
   for (let end = 1; end < segment.length; end += 1) if (overlayEntryNamed(segment.slice(0, end), segment)) return segment.slice(0, end);
   return segment;
 }
-function extensionsRow2({ trigger: trigger2, rows: rows3, last }) {
+function extensionsRow2({ trigger: trigger2, rows: rows3, last, records = [], historyUnread = false, hostLoads = null }) {
   const known2 = rows3.filter((row2) => row2.state === "current");
   const inFile = trigger2.excludeExtensions ?? [];
   const withheld = trigger2.packages === false;
@@ -37488,10 +37145,13 @@ function extensionsRow2({ trigger: trigger2, rows: rows3, last }) {
     for (const value of naming.length > 0 ? naming : [overlayStem(segment)]) groupOf(value).segments.add(segment);
   }
   for (const name3 of inFile) groupOf(name3);
-  const brought = (name3, version2 = null) => {
-    const row2 = (last?.sources ?? []).find((source2) => source2.name === name3 && (version2 === null || source2.version === version2));
-    const words = broughtWords(row2);
-    return words === null ? null : `${words}, as ${last.id} loaded it`;
+  const said = (Array.isArray(records) ? records : []).map((record3) => triggerLastRun([record3], hostLoads).quoted).filter(Boolean);
+  const brought = (name3, { kind, version: version2 = null }) => {
+    for (const run4 of [last, ...said].filter(Boolean)) {
+      const row2 = (run4.sources ?? []).find((source2) => source2.kind === kind && source2.name === name3 && (version2 === null || source2.version === version2));
+      if (row2) return `${broughtWords(row2) ?? "no tool, skill or prompt template"}, as ${run4.id} loaded it`;
+    }
+    return null;
   };
   const items = [...groups.values()].map(({ value, versions: versions2, segments }) => {
     const on = !inFile.includes(value);
@@ -37503,12 +37163,13 @@ function extensionsRow2({ trigger: trigger2, rows: rows3, last }) {
     const off = known2.filter((row2) => holdsEntry(row2) && row2.overlayExtensionsAllowed !== true).map((row2) => row2.name);
     const hostsOn = (version2) => known2.filter((row2) => (row2.packages ?? []).some((entry3) => entry3.name === value && entry3.version === version2)).map((row2) => row2.name);
     const stagedWhere = staged.length === 0 ? null : whereWords(rows3, "packages", holdsPackage, "staged", staged.length === 1 ? null : staged.map((version2) => `${version2} on ${listed(hostsOn(version2))}`).join(", "));
+    const fromEntries = () => entries.map((segment) => brought(segment, { kind: "overlay" })).find((words) => words !== null) ?? null;
     const quoted = (() => {
-      if (!on || withheld && entries.length === 0) return null;
-      if (staged.length === 0) return brought(entries[0]);
-      const running = staged.find((version2) => brought(value, version2) !== null);
-      if (running === void 0) return entries.length > 0 ? brought(entries[0]) : null;
-      return `${staged.length > 1 ? `${running}: ` : ""}${brought(value, running)}`;
+      if (withheld && entries.length === 0) return null;
+      if (staged.length === 0 || withheld) return fromEntries();
+      const running = staged.find((version2) => brought(value, { kind: "package", version: version2 }) !== null);
+      if (running === void 0) return fromEntries();
+      return `${staged.length > 1 ? `${running}: ` : ""}${brought(value, { kind: "package", version: running })}`;
     })();
     const also = inFile.includes(value) ? alsoNaming(inFile, value) : [];
     const named2 = staged.length > 0 ? `${value} ${listed(staged)}` : entries.length > 0 && also.length === 0 ? entries.join(", ") : value;
@@ -37518,7 +37179,9 @@ function extensionsRow2({ trigger: trigger2, rows: rows3, last }) {
       entries.length > 0 ? whereWords(rows3, "extensions", holdsEntry, "in the overlay") : null,
       off.length > 0 ? `its overlay extensions off on ${listed(off)}` : null,
       also.length > 0 ? `the file also names ${listed(also)}` : null,
-      quoted
+      quoted,
+      // Not said where the history could not be read: the card says so once, and a failed read is not "no run".
+      quoted === null && !historyUnread && !(withheld && entries.length === 0) && (staged.length > 0 || entries.length > 0) ? staged.length > 0 && !withheld ? TRIGGER_GETS_WORDS.bringsUnknown : TRIGGER_GETS_WORDS.overlayBringsUnknown : null
     ].filter(Boolean).join(" \xB7 ");
     return { value, name: named2, on, moot, sub: sub2, backOn: also.length > 0 ? `${value} off the list` : `${value} back on` };
   });
@@ -37621,14 +37284,67 @@ function triggerGetsOf({ trigger: trigger2, records = [], historyUnread = false,
     last: { Model: under("Model"), Skills: under("Skills"), Extensions: under("Extensions"), MCP: under("MCP"), Tools: under("Tools"), pi: under("pi") },
     model: modelRow2({ trigger: trigger2, defaults: defaults2, modelChoices }),
     flow: { ...flowRow({ trigger: trigger2, rows: rows3, editor: editor3 }), ...watch ? { doctor: null, lacking: null } : {} },
-    extensions: extensionsRow2({ trigger: trigger2, rows: rows3, last: quoted }),
+    extensions: extensionsRow2({ trigger: trigger2, rows: rows3, last: quoted, records, historyUnread, hostLoads }),
     mcp: mcpRow2({ trigger: trigger2, rows: rows3, overlayServers }),
     tools: toolsRow2({ trigger: trigger2, last: quoted }),
     image: imageRow({ trigger: trigger2, rows: rows3 }),
     secrets: { profile: trigger2.secretsProfile ?? null, count: trigger2.secrets ?? 0, optedOut: trigger2.secretBundle === false }
   };
 }
-var TRIGGER_GETS_WORDS, code4, run2, time2, unique, overlayServersOf, packagesLoaded, overlayLoaded, serverDefinition, FLOW_TIER_WORDS, MODEL_CHOICES_MAX, PROVIDER_CHOICES_MAX, FLOW_CHOICES_MAX, listsWhole, plural6, alsoNaming;
+function freshFlowWords(row2, trigger2) {
+  if (trigger2.flow === null) return SANDBOX_FRESH_WORDS.noFlow;
+  const who = `a job of trigger ${trigger2.index + 1} on this host`;
+  const word4 = flowAnswer(row2, trigger2);
+  if (word4 === null) return `Whether ${who} would find ${trigger2.flow} is unknown: its last doctor run has no answer for it.`;
+  const tier = (row2.flows ?? []).find((entry3) => entry3.trigger === trigger2.index && entry3.flow === trigger2.flow)?.tier;
+  if (tier === "none" || tier === "unknown") return `Whether ${who} would find ${trigger2.flow} is unknown: doctor found it ${word4}, and the repository, which is on no host, may hold it.`;
+  if (tier === "repository") return `${who.charAt(0).toUpperCase()}${who.slice(1)} would find ${trigger2.flow} ${word4}.`;
+  return `${who.charAt(0).toUpperCase()}${who.slice(1)} would find ${trigger2.flow} ${word4}, unless the repository holds it at its base commit, which comes first.`;
+}
+function freshMcpWords(row2, named2) {
+  if (!Array.isArray(named2) || named2.length === 0) return null;
+  const on = [];
+  const off = [];
+  const lacking = [];
+  const unknown4 = [];
+  let forge = false;
+  for (const name3 of named2) {
+    if (name3 === FORGE_MCP_SERVER_NAME) {
+      forge = true;
+      continue;
+    }
+    const server = (row2.mcp ?? []).find((entry3) => entry3.name === name3);
+    if (server) (server.enabled === true ? on : off).push(name3);
+    else (freshListsWhole(row2, "mcp") ? lacking : unknown4).push(name3);
+  }
+  const refused5 = [off.length > 0 ? `${listed(off)} switched off here` : null, lacking.length > 0 ? `${listed(lacking)} not on this host` : null].filter(Boolean);
+  const said = [
+    on.length > 0 ? `${listed(on)} on this host` : null,
+    // The reason is not named: a host with no mcp.json publishes the same empty list, and its jobs are refused as
+    // mcp-config-invalid rather than mcp-server-unknown (`serverRefused`). Either way, before it spends.
+    refused5.length > 0 ? `${refused5.join(" and ")}, so a job there is refused before it spends` : null,
+    unknown4.length > 0 ? `${listed(unknown4)} unknown here` : null,
+    forge ? `${FORGE_MCP_SERVER_NAME}: ${TRIGGER_GETS_WORDS.forgeServer}` : null
+  ].filter(Boolean);
+  return `${said.join("; ")}.`;
+}
+function sandboxFreshRows({ hostLoads, host, triggerIndex, flow = null, mcp = [], withholdsPackages = false, excludes = [], image = null }) {
+  const rows3 = [[`On ${host}`, sandboxFreshLine({ hostLoads, host, triggerIndex, withholdsPackages, excludes, image, mcp })]];
+  const row2 = hostLoadsRow(hostLoads, host);
+  if (row2.state === "unknown") return rows3;
+  const named2 = typeof flow === "string" && flow !== "" ? flow : null;
+  if (row2.state !== "current") {
+    rows3.push([SANDBOX_FRESH_WORDS.flowLabel, [named2 === null ? SANDBOX_FRESH_WORDS.noFlow : `Whether a job of trigger ${triggerIndex + 1} on this host would find ${named2} is unknown: its last doctor run is old.`]]);
+    const listedNames = (mcp ?? []).filter((name3) => typeof name3 === "string");
+    if (listedNames.length > 0) rows3.push([SANDBOX_FRESH_WORDS.mcpLabel, [`${listed(listedNames)} unknown here: its last doctor run is old.`]]);
+    return rows3;
+  }
+  rows3.push([SANDBOX_FRESH_WORDS.flowLabel, [freshFlowWords(row2, { index: triggerIndex, flow: named2, excludeExtensions: excludes, packages: withholdsPackages ? false : void 0 })]]);
+  const mcpWords = freshMcpWords(row2, mcp);
+  if (mcpWords !== null) rows3.push([SANDBOX_FRESH_WORDS.mcpLabel, [mcpWords]]);
+  return rows3;
+}
+var TRIGGER_GETS_WORDS, code4, run2, time2, unique, overlayServersOf, packagesLoaded, overlayLoaded, serverDefinition, FLOW_TIER_WORDS, MODEL_CHOICES_MAX, PROVIDER_CHOICES_MAX, FLOW_CHOICES_MAX, listsWhole, plural6, alsoNaming, SANDBOX_FRESH_WORDS, freshListsWhole;
 var init_trigger_gets_view = __esm({
   "src/trigger-gets-view.mjs"() {
     init_mcp_config();
@@ -37664,6 +37380,8 @@ var init_trigger_gets_view = __esm({
       noExtensions: "The hosts that can say name no staged package or overlay extension.",
       noExtensionsKnown: "No host\u2019s doctor run can say which extensions it has.",
       forgeServer: "the job\u2019s own forge, with its own token; in no overlay",
+      bringsUnknown: "what it brings is known once a run has loaded it",
+      overlayBringsUnknown: "an overlay entry has no manifest, so what it brings is known once a run has loaded it",
       noServers: "The hosts that can say name no MCP server, and this trigger names none.",
       noServersKnown: "No host\u2019s doctor run can say which MCP servers it has, and this trigger names none.",
       serverRefused: "A job on a host without a server it names, or with it off, is refused as mcp-server-unknown, before it spends; a host with no overlay or no mcp.json refuses it as mcp-config-invalid. A key a server uses must reach the job, through run.secrets in the file or a host\u2019s PI_FORWARD_ENV, or the job is refused as mcp-secret-unmapped.",
@@ -37709,6 +37427,378 @@ var init_trigger_gets_view = __esm({
     listsWhole = (row2, part) => row2.state === "current" && !(row2.unread ?? []).includes(part) && !((row2.more?.[part] ?? 0) > 0);
     plural6 = (n2, one, many = `${one}s`) => `${n2} ${n2 === 1 ? one : many}`;
     alsoNaming = (list4, name3) => list4.filter((other) => other !== name3 && (overlayEntryNamed(other, name3) || overlayEntryNamed(name3, other)));
+    SANDBOX_FRESH_WORDS = Object.freeze({
+      noFlow: "This trigger names no flow.",
+      flowLabel: "Flow",
+      mcpLabel: "MCP servers"
+    });
+    freshListsWhole = (row2, part) => !(row2.unread ?? []).includes(part) && !((row2.more?.[part] ?? 0) > 0);
+  }
+});
+
+// src/console/panels/sandboxes.mjs
+function state(v) {
+  const s = report(v)?.request;
+  if (!s) return null;
+  const success = s.state === "ready";
+  return banner({ status: success ? "ok" : ["refused", "failed"].includes(s.state) ? "attention" : "running", title: success ? `Sandbox ${s.result?.id ?? s.id} is ready` : `Sandbox request ${s.state}`, body: html`<span class="code">${s.id}</span> on ${s.host ?? "its host"}. ${s.message ?? s.reason ?? (success ? "No container has started. Open it from your terminal." : "Reload to read the worker's result.")}`, actions: success && s.result ? links(v, { ...s.result, id: s.result.id, host: s.result.host ?? s.host }, "open", true) : btn({ href: `/runs/sandboxes?${new URLSearchParams({ request: s.id, host: s.host ?? selected2(v).host ?? "" })}`, label: "Refresh request" }) });
+}
+function sandboxFromRun(v) {
+  if (!allowed3(v) || v.query?.gatewaySelect) return null;
+  const all = rows(v);
+  const id6 = v.query?.id;
+  const picked = all.find((r) => rowId(r) === id6 && (!v.query?.host || r.host === v.query.host));
+  const pickerHost = v.query?.host ?? selected2(v).host ?? all[0]?.host ?? "";
+  const picker = html`<form method="get" action="/runs/sandboxes" data-live-hold class="sx-picker">${field2({ label: "Workspace host", id: "sb-workspace-host", control: select({ id: "sb-workspace-host", name: "host", value: pickerHost, options: [{ value: "", label: "Choose a host" }, ...(report(v)?.hosts ?? []).map((h) => ({ value: h.name, label: h.name }))] }) })}${field2({ label: "Kept workspace", id: "sb-workspace", control: select({ id: "sb-workspace", name: "id", value: id6 ?? "", options: [{ value: "", label: "Choose a workspace" }, ...all.filter((r) => !pickerHost || r.host === pickerHost).map((r) => ({ value: rowId(r), label: `${rowId(r)} on ${r.host}${r.prepared ? " (prepared)" : ""}` }))] }) })}${btn({ type: "submit", label: "Show workspace" })}</form>`;
+  if (!report(v)) return card2("From a run", html`<p role="status">${SANDBOX_WORDS.unavailable}</p>`);
+  if (!picked) return card2("From a run", html`${state(v)}${v.data?.sandboxHostsProblem ? html`<p role="status">${v.data.sandboxHostsProblem}</p>` : null}${picker}<p class="card__sub">${all.length ? "Choose a kept workspace, or open Sandboxes from a run page." : SANDBOX_WORDS.empty}</p>`, "the image, workspace and isolation the run kept");
+  const workspace = picked.kind === "local" ? "Its original host folder" : isForgeKind(picked.kind) ? "Its retained clone" : "The workspace recorded in its kept manifest";
+  const piVersion = hostPiFor(hostLoadsRow(v.data?.hostLoads, picked.host), picked.image);
+  const loads = picked.prepared ? sandboxPreparedLine(piVersion) : sandboxRunLine(v.data?.sandboxRun ?? null, rowId(picked), { pi: piVersion, unread: v.data?.sandboxRunUnread === true });
+  const what2 = facts([["Image", picked.image ?? "As recorded in its kept manifest"], ["/workspace", workspace], ["/job", "Read only, with the retained job inputs"], ["pi and what it loads", wordsHtml(loads)], ["Processes", "None until you start them"], ["Credentials", "None, on purpose"], ["Network", "The host's current job egress policy"]], { cols: 1 });
+  return card2("From a run", html`${state(v)}${v.data?.sandboxHostsProblem ? html`<p role="status">${v.data.sandboxHostsProblem}</p>` : null}${picker}<div class="sx-run">${tile("ok", { icon: "box" })}<div><p class="sx-run__t"><span class="code">${rowId(picked)}</span>${picked.project ? ptag(picked.project) : null}${picked.prepared ? chip("Without a run") : null}</p><p class="sx-run__s">${picked.host} ${vtag(picked.v ?? picked.backend)}. ${retention(picked, v.now)}</p></div></div><h3 class="sx-h3">What opens</h3>${what2}<p class="sx-small">${icon("info", { size: "sm" })}<span>${LOADED_WORDS.sandboxFoot}</span></p><h3 class="sx-h3">How it opens</h3>${canOpen(picked) ? html`<div class="sx-ch sx-ch--on"><div class="sx-ch__h">${icon("terminal", { size: "sm" })}<b>In your terminal</b><span class="sx-rec sandbox-opener">recommended</span></div><p class="sx-ch__s">Your terminal opens with the command typed in and waits for Enter. The link holds no secret. On a phone, copy the command.</p>${links(v, picked)}</div><div class="sx-foot"><p>${icon("info", { size: "sm" })}<span>The shell uses a job's isolation and network. A published host port is refused while egress is on. Pinning uses this host's configured pin window.</span></p>${pinForm(v, picked)}</div>` : html`<p>This venue has no sandbox shell. Its workspace cannot be reopened here.</p>`}`, "the same image, workspace and isolation as the run");
+}
+function sandboxNew(v) {
+  if (!allowed3(v) || v.query?.gatewaySelect) return null;
+  const s = selected2(v), data5 = report(v), options = data5?.options ?? [];
+  const repositories = [...new Set(options.map((o) => o.repo).filter(Boolean))];
+  const triggers2 = options;
+  const hostOptions = (data5?.hosts ?? []).filter((h) => !h.unreadable && !h.stale && h.settings && (!data5?.eligibleHosts || data5.eligibleHosts.includes(h.name))).map((h) => ({ value: h.name, label: `${h.name}, ${h.settings.defaultBackend ?? "venue not published"}` }));
+  const fields2 = [
+    field2({ label: "Repository", id: "sb-repo", control: input2({ id: "sb-repo", name: "repo", value: s.repo ?? "", placeholder: "owner/repository", required: true, autocomplete: "off", spellcheck: false }) }),
+    field2({ label: "As the jobs of", id: "sb-trigger", control: select({ id: "sb-trigger", name: "index", value: s.index === void 0 ? "" : String(s.index), options: [{ value: "", label: "Choose a trigger" }, ...triggers2.map((o) => ({ value: String(o.index), label: o.label }))] }), hint: "Its image, size and egress are shown below, rather than chosen here." }),
+    field2({ label: "Start from", id: "sb-ref", control: input2({ id: "sb-ref", name: "ref", value: s.ref ?? "HEAD", code: true, required: true, autocomplete: "off", spellcheck: false }), hint: "HEAD means the default branch. Enter a branch, tag, full commit SHA, or pr:42 for a pull request." }),
+    field2({ label: "Host", id: "sb-host", control: select({ id: "sb-host", name: "host", value: s.host ?? "", options: [{ value: "", label: "Choose a host" }, ...hostOptions] }), hint: "The worker checks the trigger and its own policy again before cloning." }),
+    field2({ label: "Keep it", id: "sb-pin", control: select({ id: "sb-pin", name: "pin", value: s.pin ? "1" : "0", options: [{ value: "0", label: "Host's retention window" }, { value: "1", label: "Host's pin window" }] }) })
+  ];
+  const plan = data5?.plan;
+  const source2 = data5?.fromRun ? html`<p class="sx-p">Preparing from <a class="link" href="${`/run?${new URLSearchParams({ id: data5.fromRun })}`}">${data5.fromRun}</a>. The ref starts at HEAD because the record holds no created pull request. ${data5.sourceRun?.historicalIndex !== null && data5.sourceRun?.historicalIndex !== void 0 ? `Its historical trigger row was ${data5.sourceRun.historicalIndex + 1}; that does not prove the current row's identity.` : "Its original trigger identity is unavailable."} Choose the current trigger explicitly.${String(data5.sourceRun?.backend).startsWith("openshell") ? " Its original OpenShell venue cannot prepare a sandbox; deliberately choose a compatible local or podman trigger." : ""}</p>` : null;
+  const form = html`${source2}<form method="get" action="/runs/sandboxes" data-live-hold>${data5?.fromRun ? html`<input type="hidden" name="fromRun" value="${data5.fromRun}">` : null}<div class="sx-form">${fields2}</div><div class="sx-form-end">${btn({ type: "submit", label: "Review settings" })}</div></form>`;
+  const fresh = plan ? html`${facts(sandboxFreshRows({ hostLoads: v.data?.hostLoads, host: plan.host, triggerIndex: s.index, flow: data5?.flow ?? null, mcp: data5?.mcp ?? [], withholdsPackages: data5?.withholdsPackages === true, excludes: data5?.excludes ?? [], image: plan.image }).map(([label2, parts2]) => [label2, wordsHtml(parts2)]), { cols: 1 })}<p class="sx-small">${icon("info", { size: "sm" })}<span>${LOADED_WORDS.freshFoot}</span></p>` : null;
+  const preparation = plan ? html`<h3 class="sx-h3">Given by the trigger, not chosen here</h3>${facts4(plan)}${fresh}<p class="sx-p">${plan.pin ? `Pinned for ${plan.pinDays} days` : `Kept for ${plan.retentionHours} hours`}, on ${plan.host}. The worker clones on that host with a credential for this repository, then drops it. No container starts, no model runs, no dollars are spent and no run slot is taken.</p>${acts2(v) ? actForm({ action: "sandbox-prepare", hidden: [["repo", s.repo], ["index", s.index, "int"], ["ref", s.ref], ["host", s.host], ["pin", Boolean(s.pin), "json"]], label: "Preview preparation", kind: ["primary"], icon: "plus" }) : html`<p class="card__sub">This console is read-only. Prepare from the host's terminal.</p>`}${cmd(["pi-dispatch", "sandbox", "--new", s.repo, "--ref", s.ref, "--as", String(s.index), ...s.pin ? ["--pin"] : []])}<p class="card__sub">The CLI’s --as takes a zero-based file index: trigger row ${s.index + 1} is index ${s.index}.</p>` : html`<p class="sx-p" role="status">${data5?.refusal ?? "Choose a repository, its trigger, a ref and a host, then review their settings."}</p>`;
+  return card2("Without a run", html`${form}${preparation}<noscript><p class="card__sub">${SANDBOX_WORDS.noScript}</p></noscript>`, "a fresh clone with a trigger's image and a job's isolation");
+}
+function sandboxOpen(v) {
+  if (!allowed3(v)) return null;
+  const data5 = report(v), sessions = (data5?.sessions ?? []).filter((s) => !v.query?.gatewaySelect || s.host === v.query.host);
+  const incomplete = !data5 || data5.sessionsUnavailable || data5.sessionsMore > 0 || data5.sessionsUnreadable > 0;
+  const notices = (data5?.notices ?? []).filter((n2) => !v.query?.gatewaySelect || n2.host === v.query.host).map((n2) => html`<p class="sx-p" role="status">${icon("attention", { size: "sm" })} ${n2.host}, ${n2.id}: ${{ "network-kept": "The sandbox network was kept because cleanup could not be confirmed. Inspect this host\u2019s runtime and network before removing either.", "network-cleanup-failed": "Sandbox network cleanup failed. Inspect this host\u2019s runtime and egress network before retrying cleanup.", "runtime-unreadable": "The runtime could not be read. An expired shell registration does not prove the container stopped. Inspect this host before reopening or cleaning it." }[n2.reason] ?? "Sandbox cleanup needs inspection on this host."} <a class="link" href="${`/fleet/host?${new URLSearchParams({ name: n2.host })}`}">Inspect host</a>.</p>`);
+  if (v.query?.gatewaySelect && !v.data?.browserGateways?.enabledHosts?.includes(v.query.host)) return card2("Open now", html`<p role="status">The browser gateway is not enabled for ${v.query.host}, so there is no shell to choose here. <a class="link" href="/runs/sandboxes">Return to Sandboxes</a>.</p>`);
+  return card2("Open now", html`${v.query?.gatewaySelect ? html`<p class="sx-p">Choose an already-open shell on ${v.query.host}. Each browser opening needs your current operator token. <a class="link" href="/runs/sandboxes">Return to Sandboxes</a>.</p>` : null}${notices}${data5?.noticesUnavailable ? html`<p role="status">Some sandbox cleanup notices could not be read. Inspect the host if a terminal ended unexpectedly.</p>` : null}${data5?.sessionsMore > 0 || data5?.sessionsUnreadable > 0 ? html`<p role="status">The registered shell list is incomplete: at least ${data5.sessionsMore ?? 0} more and ${data5.sessionsUnreadable ?? 0} unreadable registrations.</p>` : null}${data5?.sessionsUnavailable ? html`<p role="status">Open shells could not be read. Reload to try again.</p>` : sessions.length ? html`<ul class="sx-opens">${sessions.map((s) => html`<li class="sx-open"><span class="dot tone-running"></span><div class="sx-open__b"><p class="sx-open__t"><span class="code">${s.id}</span>${vtag(s.venue)}</p><p class="sx-open__s">${s.host}, opened by ${s.by ?? "the terminal operator"}. Open since ${stamp(s.since)}.</p>${sandboxDriverLine(v, s)}<div class="sx-open__a">${links(v, s, "attach", true)}${sandboxBrowserLink(v, s)}${acts2(v) && !v.query?.gatewaySelect ? actForm({ action: "sandbox-end", hidden: [["host", s.host], ["id", s.id], ["nonce", s.nonce], ["containerId", s.containerId]], label: "Preview End", kind: ["sm", "danger"], icon: "cancel" }) : null}</div></div></li>`)}</ul>` : html`<p>${data5?.sessionsMore > 0 || data5?.sessionsUnreadable > 0 ? "No readable shell is in this bounded view. The incomplete registrations above prevent an exact empty count." : SANDBOX_WORDS.noShells}</p>`}<p class="sx-small">${icon("info", { size: "sm" })}<span>One shell per workspace at a time. End asks the terminal that opened it to close the shell and keeps the workspace. What you type is not recorded.</span></p>`, null, badge(incomplete ? "attention" : "running", `${sessions.length} ${incomplete ? "shown" : "open"}`));
+}
+function sandboxKept(v) {
+  if (!allowed3(v) || v.query?.gatewaySelect) return null;
+  const data5 = report(v), all = rows(v);
+  return card2("Kept workspaces", html`${data5?.more > 0 ? html`<p role="status">At least ${data5.more} more hosts have inventory beyond this bounded view. Inspect the fleet before treating this list as complete.</p>` : null}${!data5 ? html`<p role="status">${SANDBOX_WORDS.unavailable}</p>` : html`${(data5.hosts ?? []).filter((h) => h.stale || h.unreadable).map((h) => html`<p class="sx-p" role="status">${h.name}: ${h.unreadable ? "publication unreadable" : "publication stale; inspect this host before opening"}. Its list is incomplete.</p>`)}${all.length ? html`<ul class="sx-kepts">${all.map((r) => html`<li class="sx-kept${canOpen(r) ? "" : " sx-kept--no"}"><p class="sx-kept__t"><a class="code" href="${`/runs/sandboxes?${new URLSearchParams({ id: rowId(r), host: r.host })}`}">${rowId(r)}</a>${r.project ? ptag(r.project) : null}${r.prepared ? chip("Without a run") : null}</p><p class="sx-kept__s">${r.host} ${vtag(r.v ?? r.backend)}. ${retention(r, v.now)}${!canOpen(r) ? ". This venue has no sandbox shell." : null}</p>${canOpen(r) ? html`<div class="sx-kept__actions">${links(v, r, "open", true)}${pinForm(v, r)}</div>` : null}</li>`)}</ul>` : html`<p>${SANDBOX_WORDS.empty}</p>`}${(data5.hosts ?? []).filter((h) => h.more > 0).map((h) => html`<p class="sx-p">${h.name} has at least ${h.more} more retained workspaces. Inspect its full list with pi-dispatch sandbox --list.</p>`)}`}`, "what each host still keeps");
+}
+function sandboxBrowser(v) {
+  if (!allowed3(v) || v.query?.gatewaySelect) return null;
+  const gateway = v.data?.browserGateways;
+  const count8 = gateway?.enabledHosts?.length ?? 0;
+  return card2("In this browser", html`<p class="sx-p">${SANDBOX_WORDS.browser}</p>${gateway?.problem ? html`<p class="sx-p" role="status">${gateway.problem}</p>` : html`<p class="sx-p">${count8 ? `${count8} ${count8 === 1 ? "host is" : "hosts are"} enrolled.` : "No host is enrolled in this console. Ask the host operator to configure the optional gateway."}${count8 ? html`<span class="sandbox-opener"> Choose Open in browser beside a registered shell in Open now.</span>` : null}</p>`}<p class="sx-p">Each opening needs your current operator token again. Only one browser window attaches at a time. Closing it keeps the original sandbox; what you type is not recorded.</p><p class="sx-p">First open a kept or prepared workspace in your own terminal. The browser never starts a container.</p><p class="sx-p">Browser terminals require a window wider than 760 pixels. On a phone, copy the command for your own terminal.</p>${v.readOnly ? html`<p class="sx-p">This console is read-only, so browser attachment is unavailable.</p>` : null}`, "optional, separate gateway", chip(count8 ? "Enabled per host" : "Off by default", { status: count8 ? "ok" : "idle", icon: "shield" }));
+}
+var SANDBOX_WORDS, report, allowed3, acts2, rows, card2, stamp, rowId, canOpen, selected2, facts4, links, retention, pinForm, SANDBOX_PANELS;
+var init_sandboxes = __esm({
+  "src/console/panels/sandboxes.mjs"() {
+    init_html();
+    init_kit();
+    init_forges();
+    init_sandbox_links();
+    init_common();
+    init_loaded_words();
+    init_loaded_parts();
+    init_trigger_gets_view();
+    SANDBOX_WORDS = Object.freeze({
+      unavailable: "Sandbox information could not be read. Reload to try again; an unread host is not an empty host.",
+      empty: "No kept workspace was published. A worker publishes its retained workspaces while it is running.",
+      noShells: "No live sandbox shell was registered. A shell whose terminal stopped answering disappears when its short lease expires. An expired registration is not proof the container stopped; inspect its host if the terminal ended unexpectedly.",
+      browser: "A separate gateway can attach to an already-open sandbox. It is off by default and enabled by hand per host. Open in Terminal and copy-command support remain available.",
+      noScript: "Preparing, pinning, ending a shell and saving terminal targets require JavaScript for Preview and Confirm. Commands remain selectable and the settings form works without JavaScript."
+    });
+    report = (v) => v.data?.sandboxes;
+    allowed3 = (v) => v.role === "operator";
+    acts2 = (v) => allowed3(v) && !v.readOnly;
+    rows = (v) => (report(v)?.hosts ?? []).flatMap((h) => (h.rows ?? []).map((r) => ({ ...r, host: h.name, hostStale: h.stale, retentionHours: h.retentionHours })));
+    card2 = (title2, body, sub2 = null, end = null) => card({ title: title2, sub: sub2, body, end });
+    stamp = (ms3) => Number.isFinite(ms3) ? timeHtml(ms3) : "not published";
+    rowId = (r) => r.id ?? r.jobId;
+    canOpen = (r) => !String(rowId(r)).startsWith("sha256:") && r.canOpen !== false && ["local", "podman"].includes(r.v ?? r.backend);
+    selected2 = (v) => report(v)?.selected ?? {};
+    facts4 = (plan) => facts([
+      ["Image", plan.image ?? "not published"],
+      ["Size", plan.size ? `${plan.size.memMiB} MiB, ${plan.size.cpuCenti / 100} CPU` : "not published"],
+      ["Network", plan.egress?.armed ? "The host's job allowlist through its egress proxy" : "Open bridge, egress policy off"],
+      ["Credentials", "None in the shell"]
+    ]);
+    links = (v, r, verb = "open", compact2 = false) => sandboxLinks({ id: rowId(r), host: r.host, verb, compact: compact2, config: v.data?.sandboxHosts });
+    retention = (r, now) => html`${r.pin ? "Pinned" : "Kept"}${Number.isFinite(r.until) ? html` until ${stamp(r.until)}${r.until <= now ? " (past its window; pin before opening)" : html`, ${ageText(r.until - now)} left`}` : ": deadline not published"}`;
+    pinForm = (v, r) => acts2(v) && canOpen(r) ? actForm({ action: "sandbox-pin", hidden: [["host", r.host], ["id", rowId(r)]], label: "Preview pin", icon: "clock" }) : null;
+    SANDBOX_PANELS = Object.freeze([["p-sb-run", sandboxFromRun], ["p-sb-new", sandboxNew], ["p-sb-open", sandboxOpen], ["p-sb-kept", sandboxKept], ["p-sb-browser", sandboxBrowser]]);
+  }
+});
+
+// src/zero-touch-view.mjs
+function breakdown(row2, repository = false) {
+  const out = { project: text3(row2?.project ?? row2?.id, 64), scopeId: scope(row2?.scopeId), name: text3(row2?.name ?? row2?.target ?? row2?.project ?? row2?.id) ?? "Unassigned", target: text3(row2?.target), runs: count5(row2?.runs), touched: count5(row2?.touched), rate: number2(row2?.rate), deltaPoints: Number.isFinite(row2?.deltaPoints) ? row2.deltaPoints : null, previousRate: number2(row2?.previousRate), streakDays: row2?.waitingPartial === true ? null : number2(row2?.streakDays), zeroTouch: row2?.zeroTouch === true && row2?.waitingPartial !== true, waitingNow: row2?.waitingPartial === true ? null : count5(row2?.waitingNow ?? row2?.waiting), waitingPartial: row2?.waitingPartial === true, topCause: CAUSES.includes(row2?.topCause) ? row2.topCause : null, causes: causes(row2?.causes), touchedRunIds: runIds(row2?.touchedRunIds) };
+  if (!repository) out.repositories = Array.isArray(row2?.repositories) ? row2.repositories.map((r) => breakdown(r, true)) : [];
+  return out;
+}
+function zeroTouchView(raw, { role = "viewer", windowDays = 30, nowMs: nowMs2 = 0 } = {}) {
+  const observed = raw?.coverage ?? raw?.window;
+  const unobserved2 = Array.isArray(observed?.reasons) && observed.reasons.includes("touch-index-unavailable") || observed?.partial === true && number2(observed.fromMs) !== null && observed.fromMs >= (number2(raw?.nowMs) ?? nowMs2);
+  if (!raw || typeof raw !== "object" || raw.state === "unavailable" || unobserved2) return { state: "unavailable", nowMs: nowMs2, windowDays, coverage: { partial: true, reasons: [] }, totals: {}, projects: [], causes: causes([]), trend: [], groups: [], fixes: [], fixesPartial: true, touchedRunIds: [], waitingRuns: [], ungroupedRunIds: [], grouping: { enabled: false, pending: 0, unassigned: 0, state: "disabled", sources: [] } };
+  const totals = raw.totals ?? raw.summary ?? {};
+  const coverage2 = raw.coverage ?? raw.window ?? {};
+  const out = {
+    state: "ready",
+    nowMs: number2(raw.nowMs) ?? nowMs2,
+    windowDays: [7, 30, 90].includes(raw.windowDays ?? raw.days) ? raw.windowDays ?? raw.days : windowDays,
+    coverage: { requestedFromMs: number2(coverage2.requestedFromMs), fromMs: number2(coverage2.fromMs), partial: coverage2.partial === true || coverage2.complete === false, reasons: Array.isArray(coverage2.reasons) ? coverage2.reasons.map((v) => text3(v)).filter(Boolean) : [] },
+    totals: { runs: count5(totals.runs), touched: count5(totals.touched), rate: number2(totals.rate), previousRate: number2(totals.previousRate), stopped: count5(totals.stopped), stoppedUnattributed: count5(totals.stoppedUnattributed), waitingHours: totals.waitingPartial === true ? null : number2(totals.waitingHours), waitingPartial: totals.waitingPartial === true, waitingUnknown: count5(totals.waitingUnknown), medianWaitMs: totals.waitingPartial === true ? null : number2(totals.medianWaitMs) ?? (number2(totals.medianWaitHours) === null ? null : totals.medianWaitHours * 36e5), pending: totals.waitingPartial === true ? null : count5(totals.pending ?? totals.waitingNow), draftAnswers: count5(totals.draftAnswers), deltaPoints: Number.isFinite(totals.deltaPoints) ? totals.deltaPoints : null },
+    projects: Array.isArray(raw.projects) ? raw.projects.map((r) => breakdown(r)) : [],
+    causes: causes(raw.causes),
+    trend: Array.isArray(raw.trend) ? raw.trend.slice(-8).map((r) => ({ atMs: number2(r?.atMs ?? r?.at), rate: number2(r?.rate), runs: count5(r?.runs), touched: count5(r?.touched), partial: r?.partial === true })) : [],
+    waitingRuns: Array.isArray(raw.waitingRuns ?? totals.waitingNow) ? (raw.waitingRuns ?? totals.waitingNow).map((r) => ({ runId: id5(r?.runId ?? r?.jobId), parkedAt: number2(r?.parkedAt) })).filter((r) => r.runId && r.parkedAt !== null) : [],
+    touchedRunIds: runIds(raw.touchedRunIds),
+    ungroupedRunIds: role === "operator" ? runIds(raw.ungroupedRunIds) : [],
+    groups: [],
+    fixes: [],
+    fixesPartial: raw.fixesPartial === true,
+    grouping: { enabled: raw.grouping?.enabled === true, partial: raw.grouping?.partial === true, pending: count5(raw.grouping?.pending), unassigned: count5(raw.grouping?.unassigned), state: ["ready", "ok", "disabled", "pending", "partial", "failed", "configuration-unavailable", "unavailable"].includes(raw.grouping?.state) ? raw.grouping.state : "disabled", sources: role === "operator" && Array.isArray(raw.grouping?.sources ?? raw.groupingStatuses) ? (raw.grouping?.sources ?? raw.groupingStatuses).map((r) => ({ runId: id5(r?.runId), status: ["unassigned", "pending", "assigned", "source-expired", "source-unavailable", "source-oversize", "candidates-expired", "group-limit", "stale", "refused", "failed"].includes(r?.status) ? r.status : "source-unavailable" })).filter((r) => r.runId) : [] }
+  };
+  out.fixes = Array.isArray(raw.fixes) ? raw.fixes.map((f) => ({ id: id5(f?.id), at: number2(f?.at), undoneAt: number2(f?.undoneAt), kind: ["instructions", "config"].includes(f?.kind) ? f.kind : "config", groupId: id5(f?.groupId), reason: typeof f?.reason === "string" && /^[a-z][a-z0-9-]{0,79}$/.test(f.reason) ? f.reason : null, triggerIndex: Number.isSafeInteger(f?.triggerIndex) && f.triggerIndex >= 0 ? f.triggerIndex : null, beforeCount: number2(f?.beforeCount), afterCount: number2(f?.afterCount), spanMs: number2(f?.spanMs), partial: f?.partial !== false, subsequentRuns: count5(f?.subsequentRuns), status: ["observing", "improved", "unchanged", "worse"].includes(f?.status) ? f.status : "observing" })).filter((f) => f.id) : [];
+  if (role === "operator") out.groups = Array.isArray(raw.groups) ? raw.groups.map((g) => ({ id: id5(g?.id), name: text3(g?.name, 120), scopeId: scope(g?.scopeId), repo: text3(g?.repo), project: text3(g?.project, 64), count: count5(g?.count), runIds: runIds(g?.runIds), status: ["open", "fixed", "unassigned"].includes(g?.status) ? g.status : "open", fixedAt: number2(g?.fixedAt), triggerIndex: Number.isSafeInteger(g?.triggerIndex) && g.triggerIndex >= 0 ? g.triggerIndex : null })).filter((g) => g.id) : [];
+  return out;
+}
+var CAUSES, id5, number2, count5, text3, scope, causes, runIds;
+var init_zero_touch_view = __esm({
+  "src/zero-touch-view.mjs"() {
+    CAUSES = Object.freeze(["question-answer", "approval-decision", "rerun", "config-fix", "steer", "cancel"]);
+    id5 = (v) => typeof v === "string" && /^[A-Za-z0-9._:-]{1,200}$/.test(v) ? v : null;
+    number2 = (v) => Number.isFinite(v) && v >= 0 ? v : null;
+    count5 = (v) => Number.isSafeInteger(v) && v >= 0 ? v : 0;
+    text3 = (v, max = 200) => typeof v === "string" && [...v].length <= max && !/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/.test(v) ? v : null;
+    scope = (v) => typeof v === "string" && /^[a-f0-9]{32,64}$/.test(v) ? v : null;
+    causes = (v) => CAUSES.map((cause) => ({ cause, count: count5(Array.isArray(v) ? v.find((row2) => row2?.cause === cause)?.count : v?.[cause]) }));
+    runIds = (v) => Array.isArray(v) ? [...new Set(v.map(id5).filter(Boolean))].slice(0, 5e3) : [];
+  }
+});
+
+// src/console/panels/zero-touch.mjs
+function zeroTouchTabs(view) {
+  const here = view?.page === "zero-touch";
+  const sandboxes = view?.page === "sandboxes";
+  return tabs([{ label: "All runs", href: "/runs", icon: "runs", current: !here && !sandboxes }, { label: "Zero touch", href: "/runs/zero-touch", icon: "flag", current: here }, ...view?.role === "operator" ? [{ label: "Sandboxes", href: "/runs/sandboxes", icon: "box", current: sandboxes }] : []], { label: "Runs views" });
+}
+function zeroTouchControls(view) {
+  const m = model3(view);
+  return seg([7, 30, 90].map((days) => ({ label: `${days} days`, href: `/runs/zero-touch?${new URLSearchParams({ days: String(days), ...view?.query?.project ? { project: view.query.project } : {}, ...view?.query?.scope ? { scope: view.query.scope } : {} })}`, on: days === m.windowDays })), { label: "Window" });
+}
+function delta(n2, previousRate = null) {
+  if (!Number.isFinite(n2)) return html`<span class="zt-tr">Previous interval not covered</span>`;
+  return html`<span class="${`zt-tr${n2 < 0 ? " tone-ok" : n2 > 0 ? " tone-attention" : ""}`}">${icon(n2 < 0 ? "chev" : n2 > 0 ? "chev-r" : "info", { size: "sm" })}<b>${n2 === 0 ? "no change" : `${n2 < 0 ? "down" : "up"} ${amount2(Math.abs(n2))} points`}</b>${previousRate === null ? null : html`<small>from ${pct(previousRate)}</small>`}</span>`;
+}
+function coverage(m) {
+  return html`<p class="zt-coverage" role="status">${m.coverage.partial ? html`<b>Partial ${m.windowDays}-day window.</b> Covered from ${date(m.coverage.fromMs)} UTC. Older unknown runs are not counted as untouched.` : html`Whole ${m.windowDays}-day window.`}${m.coverage.reasons.length ? html` ${m.coverage.reasons.join("; ")}.` : null}</p>`;
+}
+function spark(m) {
+  const rows3 = m.trend;
+  if (!rows3.some((r) => Number.isFinite(r.rate) && !r.partial)) return html`<p class="zt-kps">Weekly trend is not covered yet.</p>`;
+  const top = Math.max(32, ...rows3.map((r) => r.rate ?? 0));
+  const x = (i) => rows3.length === 1 ? 200 : i * 200 / (rows3.length - 1);
+  const y = (n2) => 56 - n2 / top * 56;
+  const segments = [];
+  let points = [];
+  for (const [i, row2] of rows3.entries()) {
+    if (row2.rate === null || row2.partial) {
+      if (points.length) segments.push(points);
+      points = [];
+    } else points.push(`${svgNum(x(i), 0, 200)},${svgNum(y(row2.rate), 0, 56)}`);
+  }
+  if (points.length) segments.push(points);
+  const last = rows3[rows3.length - 1];
+  const label2 = `Rolling ${m.windowDays}-day touch rate at weekly intervals: ${rows3.map((r) => r.partial || r.rate === null ? "not covered" : pct(r.rate)).join(", ")}. Goal under 5 percent.`;
+  return html`<svg class="zt-spark" viewBox="-4 -4 208 64" preserveAspectRatio="none" role="img" aria-label="${label2}"><line class="zt-spark__goal" x1="0" x2="200" y1="${svgNum(y(5), 0, 56)}" y2="${svgNum(y(5), 0, 56)}"/>${segments.map((p) => html`<polyline class="zt-spark__l" points="${p.join(" ")}"/>`)}${last?.rate !== null && !last?.partial ? html`<circle class="zt-spark__d" cx="200" cy="${svgNum(y(last.rate), 0, 56)}" r="3.5"/>` : null}</svg><p class="zt-spark__ax"><span>${date(rows3[0]?.atMs)}</span><span>goal, dashed</span><span>now</span></p><p class="sr">${label2}</p>`;
+}
+function longest(m) {
+  return [...m.projects].filter((p) => p.streakDays !== null && !p.waitingNow).sort((a, b) => b.streakDays - a.streakDays)[0] ?? null;
+}
+function waitingHistory(m) {
+  return m.totals.waitingPartial ? html`<p class="zt-note" role="status">Waiting history is incomplete. An older park predates retained answer history; its current state and wait time are not known.</p>` : null;
+}
+function compact(m) {
+  const best = longest(m);
+  return html`<ul class="ztp-now"><li><span>${icon("flag", { size: "sm" })}Longest streak</span><b>${best ? `${best.name}, ${amount2(best.streakDays)} ${best.streakDays === 1 ? "day" : "days"}` : "Not enough history"}</b></li><li><span>${icon("clock", { size: "sm" })}Waited on a person</span><b>${m.totals.waitingPartial ? "Not known" : `${amount2(m.totals.waitingHours)}h, median ${span(m.totals.medianWaitMs)}`}</b></li><li><span>${icon("edit", { size: "sm" })}Answered from a draft</span><b>${m.totals.draftAnswers} ${m.totals.draftAnswers === 1 ? "run" : "runs"}</b><span>${ZERO_TOUCH_WORDS.drafts}${m.coverage.partial ? html` ${ZERO_TOUCH_WORDS.draftsPartial}` : null}</span></li><li><span>${icon("parked", { size: "sm" })}Waiting now</span><b>${m.totals.waitingPartial ? "Not known" : `${m.totals.pending} ${m.totals.pending === 1 ? "run" : "runs"}`}</b>${m.waitingRuns.slice(0, 3).map((r) => html`<span>${link(r.runId)}, ${span(m.nowMs - r.parkedAt)}</span>`)}</li></ul>${waitingHistory(m)}`;
+}
+function zeroTouchRate(view) {
+  const m = model3(view);
+  return card({ title: `Touch rate, ${m.windowDays} days`, body: html`${fail4(m)}${m.state === "ready" ? html`${kpi(m.totals.runs ? pct(m.totals.rate) : "No runs", `${m.totals.touched} of ${m.totals.runs} runs needed a person`)}${spark(m)}<p class="zt-kp"><span class="zt-kt">${icon("flag", { size: "sm" })}goal under 5%</span>${delta(m.totals.deltaPoints, m.totals.previousRate)}</p>${coverage(m)}<p class="zt-kps">${m.totals.stopped} stopped before they ran, outside the rate.${m.totals.stoppedUnattributed > 0 ? html` ${m.totals.stoppedUnattributed} stops have no recorded project or scope, so this selection may have more.` : null}</p><div class="zt-phone-summary">${compact(m)}</div>` : null}` });
+}
+function zeroTouchStreak(view) {
+  const m = model3(view), best = longest(m);
+  return card({ title: "Zero-touch streak", body: html`${fail4(m)}${kpi(best ? `${amount2(best.streakDays)} ${best.streakDays === 1 ? "day" : "days"}` : "Not enough history", best ? `${best.name}, the longest now` : "30 days of observed activity establish a zero-touch project")}<p class="zt-kp">${m.projects.filter((p) => p !== best).sort((a, b) => (b.streakDays ?? -1) - (a.streakDays ?? -1)).map((p) => p.waitingNow ? chip(`${p.name} waiting now`, { status: "parked", icon: "parked" }) : html`<span class="zt-kt">${p.name} ${p.streakDays === null ? "not known" : `${amount2(p.streakDays)} ${p.streakDays === 1 ? "day" : "days"}`}</span>`)}</p>` });
+}
+function zeroTouchWait(view) {
+  const m = model3(view);
+  if (m.state !== "ready") return card({ title: "Waiting for a person", body: fail4(m) });
+  return card({ title: "Waiting for a person", body: html`${fail4(m)}${kpi(m.totals.waitingPartial ? "Not known" : `${amount2(m.totals.waitingHours)}h`, `runs waited on a person in ${m.windowDays} days`)}<p class="zt-kps">Median wait for an answer <b>${span(m.totals.medianWaitMs)}</b></p>${waitingHistory(m)}<p class="zt-kp">${chip(m.totals.waitingPartial ? "Pending count not known" : `${m.totals.pending} waiting now`, { status: "parked", icon: "parked" })}${m.waitingRuns.slice(0, 3).map((r) => html`<span>${link(r.runId)}, ${span(m.nowMs - r.parkedAt)}</span>`)}</p>` });
+}
+function zeroTouchHandled(view) {
+  const m = model3(view);
+  return card({ title: "Answered from a draft", body: m.state !== "ready" ? fail4(m) : html`${kpi(m.totals.draftAnswers, "runs answered in the covered interval")}<p class="zt-kps">${ZERO_TOUCH_WORDS.drafts}</p>${m.coverage.partial ? html`<p class="zt-kps" role="status">${ZERO_TOUCH_WORDS.draftsPartial}</p>` : null}` });
+}
+function meter2(row2) {
+  if (row2.rate === null) return html`<span class="zt-m">Not enough history</span>`;
+  const tone = row2.rate < 5 ? "ok" : row2.rate < 30 ? "attention" : "failed";
+  const word4 = row2.rate < 5 ? "Under goal" : row2.rate < 30 ? "Above goal" : "High";
+  return html`<span class="zt-m"><svg class="${`pbar tone-${tone}`}" height="10" role="meter" aria-valuenow="${svgNum(row2.rate, 0, 100)}" aria-valuemin="0" aria-valuemax="100" aria-label="${`${row2.name}: ${pct(row2.rate)} of runs needed a person, goal under 5 percent; meter scale 40 percent`}"><rect class="pbar__bed" width="100%" height="10" rx="5"/><rect class="pbar__fill" width="${`${svgNum(row2.rate / 40 * 100, 0, 100)}%`}" height="10" rx="5"/><line class="zt-goal" x1="12.5%" x2="12.5%" y1="-4" y2="14"/></svg><span class="zt-mv"><b>${pct(row2.rate)}</b><span class="${`zt-lv tone-${tone}`}">${icon(tone === "ok" ? "done" : "attention", { size: "sm" })}${word4}</span></span></span>`;
+}
+function rowContent(row2, sub2 = false) {
+  const c = causesByKey.get(row2.topCause);
+  return html`<span class="zt-chev">${sub2 ? null : icon("chev-r", { size: "sm" })}</span><span class="zt-name"><b>${row2.name}</b><small>${sub2 ? `${row2.runs} runs` : row2.repositories.map((r) => r.name).join(" and ")}</small></span>${meter2(row2)}${delta(row2.deltaPoints, row2.previousRate)}<span class="zt-n"><b>${row2.touched}</b> of ${row2.runs} runs</span><span class="${`zt-st${row2.waitingNow ? " tone-parked" : ""}`}">${icon(row2.waitingNow ? "parked" : "flag", { size: "sm" })}${row2.waitingPartial ? "waiting history incomplete" : row2.waitingNow ? "waiting now" : row2.zeroTouch ? "zero touch, 30+ days" : row2.streakDays === null ? "not enough history" : `${amount2(row2.streakDays)} ${row2.streakDays === 1 ? "day" : "days"}`}</span><span class="zt-c">${c ? html`<span class="${`zt-cause tone-${c.tone}`}">${icon(c.icon, { size: "sm" })}${c.short}</span>` : "No touches"}</span>`;
+}
+function phoneProjects(m, view) {
+  const item2 = (row2, repository = false) => {
+    const c = causesByKey.get(row2.topCause), tone = row2.rate === null ? "idle" : row2.rate < 5 ? "ok" : row2.rate < 30 ? "attention" : "failed";
+    const word4 = row2.rate === null ? "Not known" : row2.rate < 5 ? "Under goal" : row2.rate < 30 ? "Above goal" : "High";
+    const query = new URLSearchParams({ days: String(m.windowDays), ...row2.project ? { project: row2.project } : {}, ...repository && row2.scopeId ? { scope: row2.scopeId } : {} });
+    return html`<li><a class="ztp-p" href="${`/runs/zero-touch?${query}`}" aria-label="${`${row2.name}: ${pct(row2.rate)}, open ${repository ? "repository" : "project"}`}"${repository ? html` data-repository` : null}><span class="ztp-p__n"><b>${row2.name}</b><small>${row2.touched} of ${row2.runs} runs</small></span><span class="ztp-p__r"><b>${pct(row2.rate)}</b><span class="${`zt-lv tone-${tone}`}">${icon(tone === "ok" ? "done" : "attention", { size: "sm" })}${word4}</span></span><span class="ztp-p__c">${c ? html`<span class="${`zt-cause tone-${c.tone}`}">${icon(c.icon, { size: "sm" })}${c.short}</span>` : html`<span>No touches</span>`}${delta(row2.deltaPoints, row2.previousRate)}</span><span class="ztp-p__go">${icon("chev-r", { size: "sm" })}</span></a></li>`;
+  };
+  return html`<ul class="ztp-ps zt-phone-projects">${m.projects.map((p) => html`${item2(p)}${view?.query?.project === p.project ? p.repositories.map((r) => item2(r, true)) : null}`)}</ul>`;
+}
+function zeroTouchProjects(view) {
+  const m = model3(view);
+  if (m.state !== "ready") return card({ title: "By project", body: fail4(m) });
+  const head = html`<div class="zt-row zt-row--head" aria-hidden="true"><span></span><span>Project</span><span>Touch rate, goal tick at 5%</span><span>Against the previous interval</span><span>Needed a person</span><span>Since the last touch</span><span>Most often</span></div>`;
+  const rows3 = m.projects.map((p) => html`<li><details class="zt-p"${view?.query?.project === p.project ? html` open` : null}><summary class="zt-row" aria-label="${`${p.name}: ${pct(p.rate)}, show its repositories or folders`}">${rowContent(p)}</summary><ul class="zt-subs">${p.repositories.map((r) => html`<li class="zt-row zt-row--sub">${rowContent(r, true)}</li>`)}</ul>${acts3(view) && p.touchedRunIds.length ? html`<p class="zt-foot"><a class="link" href="${`/runs?${new URLSearchParams({ project: p.project ?? "", touched: "1", days: String(m.windowDays) })}`}">Open touched runs</a></p>` : null}</details></li>`);
+  return card({ title: "By project", sub: `${m.totals.touched} of ${m.totals.runs} runs needed a person`, flush: true, body: html`${fail4(m)}${m.projects.length ? html`<div class="zt-tbl zt-desktop-projects">${head}<ul class="zt-list">${rows3}</ul></div>${phoneProjects(m, view)}<p class="zt-foot">${icon("info", { size: "sm" })}<span>A row opens to its repositories or folders. A run counts once, however many interventions it received.</span></p>` : html`<p class="zt-note">${ZERO_TOUCH_WORDS.empty}</p>`}` });
+}
+function causeCounts(values) {
+  return ZERO_TOUCH_CAUSES.map((c) => ({ ...c, count: values.find((v) => v.cause === c.cause)?.count ?? 0 }));
+}
+function causeBar(values, max, name3) {
+  const rows3 = causeCounts(values);
+  let at2 = 0;
+  max = Math.max(1, max, rows3.reduce((sum, row2) => sum + row2.count, 0));
+  const all = rows3.filter((r) => r.count > 0);
+  const label2 = `${name3}: ${all.map((r) => `${r.label} ${r.count}`).join(", ") || "no touches"}; full scale ${max} touched runs`;
+  return html`<svg class="zt-cause-svg" width="100%" height="28" role="img" aria-label="${label2}">${all.map((r) => {
+    const x = at2 / Math.max(1, max) * 500, w = r.count / Math.max(1, max) * 500;
+    at2 += r.count;
+    return html`<g class="${`tone-${r.tone}`}"><rect class="zt-cause-rect" x="${`${svgNum(x / 5, 0, 100)}%`}" y="0" width="${`${svgNum(w / 5, 0, 100)}%`}" height="28" rx="5"/>${w >= 22 ? html`<text class="zt-cause-label" x="${`${svgNum((x + w / 2) / 5, 0, 100)}%`}" y="18" text-anchor="middle">${r.count}</text>` : null}</g>`;
+  })}</svg>`;
+}
+function zeroTouchCauses(view) {
+  const m = model3(view), max = Math.max(1, ...m.projects.map((p) => Math.max(p.touched, causeCounts(p.causes).reduce((sum, row2) => sum + row2.count, 0))));
+  if (m.state !== "ready") return card({ title: "What needed a person", body: fail4(m) });
+  const bars = m.projects.map((p) => html`<li class="zt-cb"><span class="zt-cb__n"><b>${p.name}</b><small>${p.touched} of ${p.runs}</small></span>${causeBar(p.causes, max, p.name)}<p class="zt-cb__t">${causeCounts(p.causes).filter((c) => c.count).map((c) => `${c.short} ${c.count}`).join(" \xB7 ") || "No touches"}</p></li>`);
+  const scopeLabel = view?.query?.scope ? "selected repository" : view?.query?.project ? "selected project" : "all projects";
+  return card({ title: "What needed a person", sub: html`<span class="zt-desktop-label">last ${m.windowDays} days, by project</span><span class="zt-phone-label">${m.windowDays} days, ${scopeLabel}</span>`, body: html`${fail4(m)}<ul class="zt-bars zt-desktop-causes">${bars}</ul><div class="zt-phone-causes">${causeBar(m.causes, Math.max(1, m.totals.touched), scopeLabel === "all projects" ? "All projects" : scopeLabel)}</div><ul class="zt-whys">${causeCounts(m.causes).map((c) => html`<li class="zt-why">${tile(c.tone === "running" ? "running" : c.tone === "idle" ? "idle" : c.tone, { icon: c.icon, sm: true })}<span><b>${c.label}</b><small>${c.detail}</small></span><span class="zt-why__n">${c.count}</span></li>`)}<li class="zt-why zt-why--sum"><span></span><span><b>Runs that needed a person</b></span><span class="zt-why__n">${m.totals.touched}</span></li></ul><p class="zt-merge">${icon("pr", { size: "sm" })}<span>Merging is never a touch. <a class="link" href="#zt-counting">How touches are counted</a></span></p><details class="zt-counting" id="zt-counting"><summary>How touches are counted</summary><p class="zt-kps">The rate counts workload runs with a retained record that ended in the covered interval. Each run counts once. Bars assign it to its first successful human intervention; later interventions remain in history. Jobs stopped before starting are separate. Reads, sandbox opens, automatic starts and internal grouping jobs do not enter the touch count.</p></details>` });
+}
+function guardedForm(action2, { hidden: hidden2 = [], fields: fields2 = null, label: label2, kind = ["sm"] } = {}) {
+  return html`<form class="act zt-action" data-action="${action2}" autocomplete="off"><fieldset data-config-controls disabled>${hidden2.map(([name3, value, type]) => html`<input type="hidden" name="${name3}" value="${value}"${type ? html` data-type="${type}"` : null}>`)}${fields2}${btn({ type: "submit", kind, label: label2 })}</fieldset><noscript><p class="zt-kps">${ZERO_TOUCH_NO_SCRIPT}</p></noscript><p class="field__err" data-form-error hidden role="alert"></p></form>`;
+}
+function nameForm(g, index2) {
+  const key2 = `zt-name-${index2}`;
+  return html`<details class="zt-editor"><summary class="link">${g.name ? "Rename this group" : "Name this group"}</summary>${guardedForm("zero-touch-name", { hidden: [["groupId", g.id]], fields: field2({ label: "Group name", id: key2, control: input2({ id: key2, name: "name", value: g.name, required: true }), hint: "Write your own name, up to 120 characters. Question text is read only on its run page." }), label: "Preview name" })}</details>`;
+}
+function instructionForm(g, index2) {
+  if (!g.runIds[0] || g.triggerIndex === null) return html`<p class="zt-kps">Add to instructions is unavailable: a retained run and a current non-cron trigger are required.</p>`;
+  const key2 = `zt-sentence-${index2}`;
+  return html`<details class="zt-editor"><summary class="link">Add to instructions</summary>${guardedForm("zero-touch-instruction", { hidden: [["runId", g.runIds[0]], ["groupId", g.id], ["index", g.triggerIndex, "int"]], fields: field2({ label: "Sentence to add", id: key2, control: textarea({ id: key2, name: "sentence", required: true, rows: 3, maxlength: 2e3 }), hint: "Preview the exact diff, then Confirm. The trigger's existing instructions count toward the 2,000-character limit." }), label: `Preview trigger ${g.triggerIndex + 1}`, kind: ["sm", "primary"] })}</details>`;
+}
+function zeroTouchQuestions(view) {
+  if (view?.role !== "operator") return collapsed({ icon: "parked", title: "Questions it keeps asking", body: "are for operators. Rates, causes, streaks and fixes are shown here." });
+  const m = model3(view);
+  if (m.state !== "ready") return card({ title: "Questions it keeps asking", body: fail4(m) });
+  const rows3 = m.groups.map((g, index2) => html`<li class="zt-q"><div class="zt-q__h"><span class="zt-q__n" aria-label="${`asked ${g.count} times`}">${g.count}×</span><div><p class="${`zt-q__t${g.name ? "" : " zt-q__t--un"}`}">${g.name ?? `${g.count} similar questions, not named yet`}</p><p class="zt-q__s"><span class="code">${g.repo ?? g.project ?? "Repository not known"}</span>${g.status === "fixed" && g.fixedAt !== null ? html` · fixed ${date(g.fixedAt)} UTC` : null}${g.status === "fixed" && m.fixes.some((f) => f.groupId === g.id && f.afterCount === 0 && f.subsequentRuns > 0 && !f.partial && f.undoneAt === null) ? html` · none since` : null}</p></div><span class="zt-q__st">${chip(g.status === "fixed" ? "Fixed" : g.status === "unassigned" ? "Unassigned" : "Open", { status: g.status === "fixed" ? "ok" : "parked", icon: g.status === "fixed" ? "done" : "parked" })}</span></div><p class="zt-said">${icon("runs", { size: "sm" })}<span>Asked in ${g.runIds.slice(0, 8).map((id6, at2) => html`${at2 ? ", " : ""}${link(id6)}`)}${g.runIds.length > 8 ? ` and ${g.runIds.length - 8} more` : null}.</span></p>${acts3(view) ? html`<div class="zt-q__act">${nameForm(g, index2)}${g.status !== "fixed" ? instructionForm(g, index2) : html`<a class="link" href="#p-zt-fixes">See the fix</a>`}</div>` : null}</li>`);
+  const phoneRows = m.groups.map((g, index2) => html`<li class="ztp-q"><span class="zt-q__n" aria-label="${`asked ${g.count} times`}">${g.count}×</span><span class="ztp-q__t"><b>${g.runIds[0] ? html`<a class="zt-group-link" href="${`/run?id=${encodeURIComponent(g.runIds[0])}`}">${g.name ?? `${g.count} similar, not named yet`}</a>` : g.name ?? `${g.count} similar, not named yet`}</b><small>${g.repo ?? g.project ?? "Repository not known"}</small></span><span class="ztp-q__st">${chip(g.status === "fixed" ? "Fixed" : g.status === "unassigned" ? "Unassigned" : "Open", { status: g.status === "fixed" ? "ok" : "parked", icon: g.status === "fixed" ? "done" : "parked" })}</span><span class="ztp-q__a">${acts3(view) ? g.status === "fixed" ? html`<a class="link" href="#p-zt-fixes">See the fix</a>` : g.name ? instructionForm(g, `phone-${index2}`) : nameForm(g, `phone-${index2}`) : null}</span></li>`);
+  const sources = m.grouping.sources.length ? m.grouping.sources : m.ungroupedRunIds.map((runId2) => ({ runId: runId2, status: "unassigned" }));
+  return card({ title: "Questions it keeps asking", sub: "operator only", body: html`<p class="zt-intro">Grouped by meaning. You name each group; read the questions on their run pages.</p>${fail4(m)}${m.grouping.partial ? html`<p class="zt-note" role="status">Question grouping is partial. Missing or unclassified sources are not evidence that a question stopped recurring.</p>` : null}${["unavailable", "configuration-unavailable"].includes(m.grouping.state) ? html`<p class="zt-note" role="status">${m.grouping.state === "configuration-unavailable" ? "Grouping configuration could not be read. Check the reviewed triggers file before starting a grouping job." : "Question groups could not be read. Reload to retry; missing assignments are not an empty group list."}</p>` : null}${rows3.length ? html`<ol class="zt-qs zt-desktop-questions">${rows3}</ol><ol class="ztp-qs zt-phone-questions">${phoneRows}</ol>` : html`<p class="zt-kps">${["unavailable", "configuration-unavailable"].includes(m.grouping?.state) ? "Grouping coverage is not known. Reload after the source is available." : ZERO_TOUCH_WORDS.noGroups}</p>`}${sources.length ? html`<ul class="zt-ungrouped">${sources.slice(0, 20).map((source2) => html`<li data-group-status="${source2.status}">${link(source2.runId)}<span>${ZERO_TOUCH_SOURCE_WORDS[source2.status]}</span>${acts3(view) && ["unassigned", "stale", "refused", "failed"].includes(source2.status) ? guardedForm("zero-touch-group", { hidden: [["runId", source2.runId]], label: "Group question", kind: ["sm", "paid"] }) : null}</li>`)}</ul>` : null}<p class="zt-foot zt-foot--in">${icon("info", { size: "sm" })}<span>${m.grouping.enabled ? `${plural5(m.grouping.pending, "grouping job")} pending; ${plural5(m.grouping.unassigned, "question")} unassigned. Expired or unavailable context stays ungrouped.` : "Private capture and a capped classifier must be enabled in the reviewed zeroTouch configuration before questions can be grouped."}</span></p>` });
+}
+function fixTone(f) {
+  if (f.partial || f.subsequentRuns === 0 || f.undoneAt !== null || f.status === "observing") return "idle";
+  return f.status === "improved" ? "ok" : f.status === "worse" ? "failed" : "idle";
+}
+function fixObservation(f) {
+  if (f.undoneAt !== null) return "Reverted: this observation does not establish current effectiveness.";
+  if (f.partial) return "Partial observation: effectiveness is not established.";
+  if (f.subsequentRuns === 0) return "No subsequent runs yet: effectiveness is not established.";
+  return f.status === "improved" ? "Fewer occurrences over equal observed spans." : f.status === "worse" ? "More occurrences over equal observed spans." : f.status === "unchanged" ? "The same number of occurrences over equal observed spans." : "Still observing the targeted cause.";
+}
+function beforeAfter(label2, value, max, tone = "attention") {
+  return html`<p class="zt-ba"><span>${label2}</span><svg class="${`pbar tone-${tone}`}" height="8" role="img" aria-label="${`${label2}: ${value === null ? "not known" : value}`}"><rect class="pbar__bed" width="100%" height="8" rx="4"/>${value ? html`<rect class="pbar__fill" width="${`${svgNum(value / max * 100, 0, 100)}%`}" height="8" rx="4"/>` : null}</svg><b>${value ?? "?"}</b></p>`;
+}
+function zeroTouchFixes(view) {
+  const m = model3(view);
+  const evidence = html`${m.fixesPartial ? html`<p class="zt-note" role="status">Fix history is incomplete. Reload to retry; missing changes are not evidence that no fix was made.</p>` : null}${m.fixes.length ? html`<ol class="zt-fxs">${m.fixes.map((f) => html`<li class="zt-fx"><p class="zt-fx__d">${date(f.at)} UTC${f.undoneAt === null ? null : html` · Reverted ${date(f.undoneAt)} UTC`}</p><p class="zt-fx__w">${f.kind === "instructions" ? `Trigger ${f.triggerIndex === null ? "not known" : f.triggerIndex + 1}'s instructions gained a sentence` : "Configuration changed to address a refusal"}</p><p class="zt-fx__m">${f.reason ? `${f.reason} refusals` : "Questions in the targeted group"}, equal ${span(f.spanMs)} spans before and after; ${f.subsequentRuns} workload runs after the fix.</p>${beforeAfter("Before", f.beforeCount, Math.max(f.beforeCount ?? 0, f.afterCount ?? 0, 1))}${beforeAfter("After", f.afterCount, Math.max(f.beforeCount ?? 0, f.afterCount ?? 0, 1), fixTone(f))}<p class="zt-kps">${fixObservation(f)}</p>${acts3(view) && f.kind === "instructions" && f.undoneAt === null ? guardedForm("zero-touch-undo", { hidden: [["fixId", f.id]], label: "Preview removing the sentence", kind: ["sm", "ghost"] }) : null}</li>`)}</ol>` : html`<p class="zt-kps">${m.fixesPartial ? "Fix history is not known. Reload after the source is available." : ZERO_TOUCH_WORDS.noFixes}</p>`}`;
+  const brief = m.fixes.map((f) => `${f.reason ?? "grouped questions"}: ${f.beforeCount ?? "?"} to ${f.afterCount ?? "?"}`).join("; ");
+  return card({ title: "Fixes that worked", sub: "what changed, and what it did", body: html`<div class="zt-desktop-fixes">${evidence}</div><details class="zt-phone-fixes"><summary>${icon("done", { size: "sm" })}<span><b>${m.fixesPartial ? "Fix history incomplete" : `${m.fixes.length} fixes recorded`}</b>${brief ? `: ${brief}. ` : ". "}<span class="link">Open observations</span></span></summary><div class="zt-fix-observations">${evidence}</div></details>` });
+}
+var ZERO_TOUCH_WORDS, ZERO_TOUCH_CAUSES, ZERO_TOUCH_SOURCE_WORDS, causesByKey, model3, acts3, pct, amount2, date, span, link, fail4, ZERO_TOUCH_NO_SCRIPT, ZERO_TOUCH_PANELS;
+var init_zero_touch = __esm({
+  "src/console/panels/zero-touch.mjs"() {
+    init_common();
+    init_html();
+    init_kit();
+    init_zero_touch_view();
+    ZERO_TOUCH_WORDS = Object.freeze({ unavailable: "Zero touch could not be read. Reload to try again; missing history is never counted as zero touches.", empty: "No workload runs ended in the covered interval.", drafts: "Sent by a person, edited or as drafted. Each run still counts as a touch.", draftsPartial: "Partial history; this counts retained runs only.", viewer: "Questions it keeps asking are for operators. Rates, causes, streaks and fixes are shown here.", noGroups: "No question groups yet. Group retained questions with a capped decision job; name each group yourself.", noFixes: "No cause-linked fixes recorded yet. Start a change from a refusal or a question group to measure it here." });
+    ZERO_TOUCH_CAUSES = Object.freeze([
+      { cause: "question-answer", label: "Questions", short: "Questions", icon: "parked", tone: "parked", detail: "A person answered a parked question and the source session resumed." },
+      { cause: "approval-decision", label: "Approvals", short: "Approvals", icon: "shield", tone: "attention", detail: "A person approved or declined a request. System expiry is excluded." },
+      { cause: "rerun", label: "Failed or refused, then re-run", short: "Re-run", icon: "failed", tone: "failed", detail: "A person started a failed or refused run again." },
+      { cause: "config-fix", label: "Refused until config was fixed", short: "Config fixed", icon: "refused", tone: "refused", detail: "A confirmed configuration change explicitly targeted the refusal." },
+      { cause: "steer", label: "Steered", short: "Steered", icon: "steer", tone: "running", detail: "A person's steering message was delivered to the run." },
+      { cause: "cancel", label: "Cancelled", short: "Cancelled", icon: "cancel", tone: "idle", detail: "A person cancelled the run while it was active." }
+    ]);
+    ZERO_TOUCH_SOURCE_WORDS = Object.freeze({
+      unassigned: "Not grouped yet.",
+      pending: "A grouping job is pending.",
+      assigned: "Assigned to a question group.",
+      "source-expired": "The retained question context expired. Open the run to read what remains; a new grouping job cannot restore it.",
+      "source-unavailable": "The worker could not retain safe question context. Check transcript capture on the source host.",
+      "source-oversize": "The private question context exceeds its byte limit. It remains ungrouped rather than being cut.",
+      "candidates-expired": "A group's representative context expired. Review the groups before trying again.",
+      "group-limit": "The repository reached the bounded group limit. Review existing groups before trying again.",
+      stale: "The group revision changed during classification. Preview a fresh grouping job.",
+      refused: "The grouping job was refused. Open its run to see the policy reason.",
+      failed: "The grouping job failed. Open its run and review the failure before trying again."
+    });
+    causesByKey = new Map(ZERO_TOUCH_CAUSES.map((c) => [c.cause, c]));
+    model3 = (v) => zeroTouchView(v?.data?.zeroTouch, { role: v?.role, windowDays: v?.query?.days ?? 30, nowMs: v?.now ?? 0 });
+    acts3 = (v) => v?.role === "operator" && !v?.readOnly;
+    pct = (n2) => Number.isFinite(n2) ? `${Math.round(n2)}%` : "Not known";
+    amount2 = (n2) => Number.isFinite(n2) ? new Intl.NumberFormat("en-US", { maximumFractionDigits: 1 }).format(n2) : "Not known";
+    date = (n2) => Number.isFinite(n2) && n2 >= 0 && n2 <= 864e13 ? new Date(n2).toISOString().slice(0, 10) : "not known";
+    span = (ms3) => ms3 === null ? "not known" : ms3 >= 36e5 ? `${amount2(ms3 / 36e5)}h` : `${amount2(ms3 / 6e4)}m`;
+    link = (id6) => html`<a class="link code" href="${`/run?id=${encodeURIComponent(id6)}`}">${id6}</a>`;
+    fail4 = (m) => m.state === "unavailable" ? html`<p class="zt-note" role="status">${ZERO_TOUCH_WORDS.unavailable}</p>` : null;
+    ZERO_TOUCH_NO_SCRIPT = "Enable JavaScript to preview and confirm a change. Reading and navigation work without it.";
+    ZERO_TOUCH_PANELS = Object.freeze([["p-zt-rate", zeroTouchRate], ["p-zt-streak", zeroTouchStreak], ["p-zt-wait", zeroTouchWait], ["p-zt-handled", zeroTouchHandled], ["p-zt-projects", zeroTouchProjects], ["p-zt-causes", zeroTouchCauses], ["p-zt-questions", zeroTouchQuestions], ["p-zt-fixes", zeroTouchFixes]]);
+  }
+});
+
+// src/trigger-policy.mjs
+function triggerWhoMayFire(trigger2) {
+  const on = trigger2.on ?? trigger2;
+  const forge = trigger2.run?.kind ?? trigger2.forge;
+  const kind = on.type;
+  if (kind === "cron") return "This deployment's scheduler starts it on its schedule; an operator may fire it by hand.";
+  if (forge === "gitlab") return "The actor must be a GitLab project member with Developer access (30) or higher, including inherited membership.";
+  if (forge === "forgejo") return "The actor must have Forgejo repository owner, admin or write permission.";
+  if (forge === "azure") return "The actor must be an Azure DevOps project member admitted by the receiver's membership check.";
+  if (kind === "label") return "A collaborator applies the matching issue label; the label event supplies the approval.";
+  if (kind === "comment") return "The commenter's GitHub association must be OWNER, MEMBER or COLLABORATOR; the service's own comments are refused.";
+  const actions = Array.isArray(on.action) ? on.action : [];
+  const gates = [];
+  if (kind === "issue" || actions.includes("closed")) gates.push("The closer must have repository write access");
+  if (actions.includes("labeled")) gates.push("A collaborator-applied matching label supplies approval");
+  if (actions.includes("review_submitted")) gates.push("The reviewer's association must be OWNER, MEMBER or COLLABORATOR, regardless of the pull request author's association");
+  if (actions.some((a) => ["opened", "synchronize", "reopened"].includes(a))) gates.push("The pull request author's association must be OWNER, MEMBER or COLLABORATOR");
+  return `${gates.join(". ") || "The receiver checks the actor's authority for the configured event"}.`;
+}
+var init_trigger_policy = __esm({
+  "src/trigger-policy.mjs"() {
   }
 });
 
@@ -62515,11 +62605,37 @@ function settingDone(out) {
   const sayable = typeof old === "string" && old.trim() !== "" || typeof old === "number" && Number.isFinite(old);
   return sayable ? `Changed ${key2} from ${String(old)} to ${value}` : `Changed ${key2} to ${value}`;
 }
+function pauseListShapeRefusal(windows) {
+  for (const [i, w] of windows.entries()) {
+    const at2 = atIndex("pause window", i);
+    if (w === null || typeof w !== "object" || Array.isArray(w)) return `${at2} is not an object`;
+    for (const [k, value] of Object.entries(w)) {
+      if (!PAUSE_WINDOW_FIELDS.includes(k)) return `${at2} has a field this file does not take (${PAUSE_WINDOW_FIELDS.join(", ")} only)`;
+      const plain3 = typeof value === "string" || k === "days" && Array.isArray(value) && value.every((d) => typeof d === "string");
+      if (!plain3) return `${at2}: ${k} must be ${k === "days" ? "a list of weekday names" : "a string"}`;
+    }
+  }
+  return null;
+}
 function pauseListBack(out) {
   const unread2 = typeof out.beforeText === "string" && !Array.isArray(jsonOf(out.beforeText)?.windows);
   if (unread2) return { undo: twice(UNDO_SENTENCES.tooBig, UNDO_SENTENCES.tooBigAfter), inverse: null };
+  if (!pauseListGoesBack(out)) return { undo: twice(UNDO_SENTENCES.refusedList, UNDO_SENTENCES.refusedListAfter), inverse: null };
   return { undo: "Put the previous pause windows back", inverse: { action: "pause-windows", body: { windows: out.extra.before } } };
 }
+function pauseListGoesBack(out) {
+  const before = out.extra?.before;
+  if (!Array.isArray(before) || !plainBody({ windows: before }) || pauseListShapeRefusal(before) !== null) return false;
+  if (typeof out.beforeText !== "string") return true;
+  const held = heldPauseWindows(out.beforeText, out.target ?? "pause-windows.json");
+  if (held.problem) return false;
+  try {
+    parsePauseWindows(pauseWindowsText(held.doc, before), out.target ?? "pause-windows.json");
+    return true;
+  } catch {
+    return false;
+  }
+}
 function triggerEditBack(out) {
   const p = out.plan ?? {};
   const n2 = atIndex("trigger", p.index);
@@ -63001,15 +63117,8 @@ var init_actions = __esm({
       needs: [],
       async preview(body, ctx) {
         if (!Array.isArray(body.windows)) return { refusal: 'send {"windows": [...]} with the whole new list of pause windows' };
-        for (const [i, w] of body.windows.entries()) {
-          const at2 = atIndex("pause window", i);
-          if (w === null || typeof w !== "object" || Array.isArray(w)) return { refusal: `${at2} is not an object; nothing was changed` };
-          for (const [k, value] of Object.entries(w)) {
-            if (!PAUSE_WINDOW_FIELDS.includes(k)) return { refusal: `${at2} has a field this file does not take (${PAUSE_WINDOW_FIELDS.join(", ")} only); nothing was changed` };
-            const plain3 = typeof value === "string" || k === "days" && Array.isArray(value) && value.every((d) => typeof d === "string");
-            if (!plain3) return { refusal: `${at2}: ${k} must be ${k === "days" ? "a list of weekday names" : "a string"}; nothing was changed` };
-          }
-        }
+        const shape2 = pauseListShapeRefusal(body.windows);
+        if (shape2) return { refusal: `${shape2}; nothing was changed` };
         const path = ctx.config.pauseWindowsPath;
         const snap = readNow(ctx.fs, path);
         if (snap.refusal) return snap;
@@ -63687,6 +63796,8 @@ var init_actions = __esm({
       envelopeAfter: "Set it back with the envelope form: the console kept no copy of the old values.",
       tooBig: "Put the previous list back by hand: this preview showed it; the console keeps no copy.",
       tooBigAfter: "Put the previous list back by hand: the console kept no copy of it.",
+      refusedList: "Put the previous list back by hand: the console would refuse it as an Undo (a window it does not take, or more than 256 windows or days); this preview showed it, and the console keeps no copy.",
+      refusedListAfter: "Put the previous list back by hand: the console would refuse it as an Undo (a window it does not take, or more than 256 windows or days), and kept no copy of it.",
       resumeUnread: "Pause the queues that were paused again by hand: the fleet was not read before the resume, so which they were is not known.",
       resumeShort: "Pause the queues that were paused again by hand: not every queue was read before the resume, so which they were is not fully known."
     });
@@ -74188,6 +74299,8 @@ async function readScheduleHosts({ url, now = () => Date.now(), timeoutMs = 2e3,
   let redis;
   try {
     redis = redisFn(url, { failFast: true, disconnectTimeoutMs: 0 });
+    redis.on?.("error", () => {
+    });
     const names2 = await bounded14(() => redis.smembers(HOST_SET), timeoutMs, null);
     if (!Array.isArray(names2)) return { hosts: [], complete: false };
     const valid2 = [...new Set(names2.filter((n2) => typeof n2 === "string" && NAME_RE2.test(n2)))];
@@ -74539,7 +74652,10 @@ async function readConnections({ deploymentDir, env = {}, paths = {}, snapshot:
     if (redis) return redis;
     if (owned) return owned;
     if (injectedRead && typeof paths.valkeyUrl !== "string") return null;
-    return owned = redisFn(paths.valkeyUrl);
+    owned = redisFn(paths.valkeyUrl);
+    owned.on?.("error", () => {
+    });
+    return owned;
   };
   const endpointFleetDeclared = endpointFleetDeclaration(file, environmentUnknown);
   let endpointStatus = { state: "unknown", hosts: [], more: 0, partial: true };
@@ -76315,14 +76431,20 @@ function makeSandboxService({ paths, env = {}, deploymentDir, fleet, fs: fs2 = n
       }
       const selected4 = { repo: query.repo ?? sourceRun?.repo ?? null, index: query.index, ref: query.ref ?? "HEAD", host: query.host ?? (query.fromRun ? sourceRun?.host ?? null : inv.hosts.find((h) => !h.stale && !h.unreadable && h.settings)?.name ?? null), pin: query.pin === true };
       if (selected4.index === null || selected4.index === void 0) selected4.index = query.fromRun ? null : options[0]?.index ?? null;
-      const rawTrigger = cfg.triggers[selected4.index]?.run;
+      const rawTrigger = cfg.triggers[selected4.index]?.on?.type === "disarmed" ? (() => {
+        try {
+          return JSON.parse(cfg.triggersText).triggers?.[selected4.index]?.run;
+        } catch {
+          return void 0;
+        }
+      })() : cfg.triggers[selected4.index]?.run;
       const eligibleHosts = inv.hosts.filter((h) => {
         const backend = rawTrigger?.backend ?? h.settings?.defaultBackend;
         return !h.stale && !h.unreadable && h.settings && ["local", "podman"].includes(backend) && h.settings.backends.includes(backend);
       }).map((h) => h.name);
       const judged = selected4.repo && selected4.host && selected4.index !== null ? preparation(selected4, inv, cfg) : {};
       const request = query.request && query.host ? await fleet.sandboxPreparationStatus(query.host, query.request) : null;
-      return { ...inv, options, eligibleHosts, selected: selected4, withholdsPackages: rawTrigger?.packages === false, excludes: Array.isArray(rawTrigger?.excludeExtensions) ? rawTrigger.excludeExtensions : [], ...judged, request, ...query.fromRun ? { fromRun: query.fromRun, sourceRun } : {} };
+      return { ...inv, options, eligibleHosts, selected: selected4, withholdsPackages: rawTrigger?.packages === false, flow: typeof rawTrigger?.flow === "string" ? rawTrigger.flow : null, mcp: Array.isArray(rawTrigger?.mcp) ? rawTrigger.mcp.filter((name3) => typeof name3 === "string") : [], excludes: Array.isArray(rawTrigger?.excludeExtensions) ? rawTrigger.excludeExtensions : [], ...judged, request, ...query.fromRun ? { fromRun: query.fromRun, sourceRun } : {} };
     },
     async preview(name3, params) {
       if (name3 === "sandbox-host-set") {