@edgehero/pi-dispatch-admin 5.1.0 → 5.2.1

package/dist/index.mjs

@@ -7620,6 +7620,13 @@ var init_worker_name = __esm({
 });
 
 // ../worker/src/job-size.mjs
+function wholeCpusOf(cpuCenti) {
+  return Math.ceil(cpuCenti / 100);
+}
+function jobSizeEnv(size) {
+  assertJobSize(size);
+  return { PI_JOB_SIZE_CPUS: String(wholeCpusOf(size.cpuCenti)), PI_JOB_SIZE_MEMORY_MIB: String(size.memMiB) };
+}
 function parseMemory(value) {
   if (typeof value !== "string" || !/^[1-9]\d*[mg]$/.test(value)) {
     throw new Error(`a memory size is a whole number of megabytes or gigabytes such as "512m", "1536m" or "4g" (got ${JSON.stringify(value)})`);
@@ -8803,6 +8810,19 @@ function roundCpusUp(cpuCenti) {
 function rank(sorted, pct5) {
   return sorted[Math.max(0, Math.ceil(pct5 * sorted.length / 100) - 1)];
 }
+function seenOf(record3) {
+  if (!CEILING_VENUES.includes(record3.backend)) return null;
+  const c = record3.capacity;
+  if (c === null || typeof c !== "object" || Array.isArray(c)) return null;
+  const cpus = Number.isSafeInteger(c.cpus) && c.cpus >= 1 && c.cpus <= HOST_CPUS_MAX ? c.cpus : null;
+  const budget = Number.isSafeInteger(c.cpuCenti) && c.cpuCenti >= 1 && c.cpuCenti <= HOST_CPUS_MAX * 100 ? c.cpuCenti : null;
+  const ceilingCenti = cpuCeilingCenti(cpus, budget);
+  return ceilingCenti === null ? null : seenCpusOf(ceilingCenti, cpus);
+}
+function seenCpusOf(ceilingCenti, runtimeCpus) {
+  if (ceilingCenti >= 100) return Math.floor(ceilingCenti / 100);
+  return Number.isSafeInteger(runtimeCpus) && runtimeCpus >= 1 ? runtimeCpus : null;
+}
 function evidenceOf(record3, project2, nowMs2) {
   if (record3 === null || typeof record3 !== "object" || Array.isArray(record3)) return null;
   if (record3.project !== project2) return null;
@@ -8822,7 +8842,7 @@ function evidenceOf(record3, project2, nowMs2) {
   };
   const memFullUsec = wallUsec !== null && isCount(r2.memFullUsec) ? r2.memFullUsec : null;
   if (memPeak === null && cpu.cpuUsec === null) return null;
-  return { at: at2, size, memPeak, oom: record3.reason === "oom-killed", wallUsec, ...cpu, memFullUsec };
+  return { at: at2, size, memPeak, oom: record3.reason === "oom-killed", wallUsec, ...cpu, memFullUsec, seenCpus: seenOf(record3) };
 }
 function heldToCap(wanted, current, cap) {
   if (wanted <= current) return { suggested: null, held: "largest" };
@@ -8831,6 +8851,14 @@ function heldToCap(wanted, current, cap) {
   if (wanted > cap) return { suggested: cap, held: "cap" };
   return { suggested: wanted, held: null };
 }
+function oomCeilingOf(relevant) {
+  const over = relevant.filter((e2) => e2.oom && e2.seenCpus !== null && e2.seenCpus > wholeCpusOf(e2.size.cpuCenti));
+  if (over.length === 0) return null;
+  const seen = over.map((e2) => e2.seenCpus);
+  const sizes = over.map((e2) => e2.size.cpuCenti);
+  const sizeCenti = Math.min(...sizes);
+  return { runs: over.length, seenCpus: Math.min(...seen), seenMaxCpus: Math.max(...seen), sizeCenti, sizeVaries: sizes.some((n3) => n3 !== sizeCenti) };
+}
 function suggestMemory(runs, current, cap) {
   const measured = runs.filter((e2) => e2.memPeak !== null);
   const relevant = measured.filter((e2) => e2.size.memMiB >= current);
@@ -8841,7 +8869,7 @@ function suggestMemory(runs, current, cap) {
   const oomSizes = measured.filter((e2) => e2.oom).map((e2) => e2.size.memMiB);
   const largestOom = oomSizes.length > 0 ? Math.max(...oomSizes) : null;
   const pressured = relevant.filter((e2) => !productAbove(e2.size.memMiB * MIB, 9, e2.memPeak, 10) && e2.memFullUsec !== null && productAbove(e2.memFullUsec, 100, e2.wallUsec, 1)).length;
-  const evidence = { samples, smaller: measured.length - samples, p95MiB: p95 === null ? null : Math.ceil(p95 / MIB), maxPeakMiB: maxPeak === null ? null : Math.ceil(maxPeak / MIB), ooms, largestOomMiB: largestOom, pressured };
+  const evidence = { samples, smaller: measured.length - samples, p95MiB: p95 === null ? null : Math.ceil(p95 / MIB), maxPeakMiB: maxPeak === null ? null : Math.ceil(maxPeak / MIB), ooms, largestOomMiB: largestOom, pressured, oomCeiling: oomCeilingOf(relevant) };
   const fact = pressured > 0 ? "pressure" : null;
   const out = (reason, suggested, more = {}) => ({ current, suggested: suggested === null || suggested === current ? null : suggested, reason, evidence, fact, held: null, wanted: null, ...more });
   if (ooms > 0) {
@@ -8964,6 +8992,15 @@ function notEnoughRunsText(dim, sizeText3) {
   const smaller = Number.isSafeInteger(e2.smaller) && e2.smaller > 0 ? `; ${e2.smaller} at smaller sizes` : "";
   return `not enough runs at ${sizeText3(dim.current)} (${samples}${smaller})`;
 }
+function oomCeilingWords(me) {
+  const o = me?.oomCeiling;
+  if (o === null || typeof o !== "object" || !Number.isSafeInteger(o.runs) || o.runs < 1 || !Number.isSafeInteger(o.seenCpus)) return "";
+  const ooms = Number.isSafeInteger(me.ooms) && me.ooms >= o.runs ? me.ooms : o.runs;
+  const whose = ooms === 1 ? "the killed run's tools" : o.runs === ooms ? "the killed runs' tools" : `the tools of ${o.runs} of the ${ooms} killed runs`;
+  const seen = `${o.seenCpus}${Number.isSafeInteger(o.seenMaxCpus) && o.seenMaxCpus > o.seenCpus ? ` to ${o.seenMaxCpus}` : ""} CPUs`;
+  const size = o.sizeVaries === true ? `sizes from ${cpusText(o.sizeCenti)}` : `a size of ${cpusText(o.sizeCenti)}`;
+  return `size per-CPU worker pools from PI_JOB_SIZE_CPUS: ${whose} counted at least ${seen} at ${size}`;
+}
 function suggestionEvidence(suggestion) {
   const m2 = suggestion?.memory ?? {};
   const c = suggestion?.cpu ?? {};
@@ -8994,10 +9031,11 @@ function suggestionEvidence(suggestion) {
     cpu: cpuWords[c.reason] ?? "",
     memoryHeld: heldWords[m2.held] ?? "",
     memoryFact: m2.fact === "pressure" ? `${me.pressured} of ${plural(me.samples, "run")} reached the memory limit while stalled for memory more than 1% of their time` : "",
-    cpuFact: c.fact === "ceiling" ? `the median run was held back ${ce.throttledPct}% of its time by this host's CPU ceiling (its CPU budget, shared by every job), which a job's cpus do not change` : ""
+    cpuFact: c.fact === "ceiling" ? `the median run was held back ${ce.throttledPct}% of its time by this host's CPU ceiling (its CPU budget, shared by every job), which a job's cpus do not change` : "",
+    memoryCeiling: m2.reason === "oom-killed" ? oomCeilingWords(me) : ""
   };
 }
-var SUGGEST_WINDOW_DAYS, SUGGEST_WINDOW_RUNS, SUGGEST_MIN_SAMPLES, SUGGEST_CLOCK_SKEW_MS, SUGGEST_MAX_WALL_MS, MEMORY_REASONS, CPU_REASONS, MEMORY_HELD, MEMORY_CAP_MISSING, SIZE_FACTS, MIB, DAY_MS, isCount, productAbove, quarterMoreMiB, quarterMoreCenti, capDim, isShare, shareOf, plural, coresText, cpusText;
+var SUGGEST_WINDOW_DAYS, SUGGEST_WINDOW_RUNS, SUGGEST_MIN_SAMPLES, SUGGEST_CLOCK_SKEW_MS, SUGGEST_MAX_WALL_MS, MEMORY_REASONS, CPU_REASONS, MEMORY_HELD, MEMORY_CAP_MISSING, SIZE_FACTS, CEILING_VENUES, MIB, DAY_MS, isCount, productAbove, quarterMoreMiB, quarterMoreCenti, capDim, isShare, shareOf, plural, coresText, cpusText;
 var init_size_suggest = __esm({
   "../worker/src/size-suggest.mjs"() {
     init_job_size();
@@ -9011,6 +9049,7 @@ var init_size_suggest = __esm({
     MEMORY_HELD = Object.freeze(["cap", "largest", "no-cap"]);
     MEMORY_CAP_MISSING = Object.freeze(["unread", "none-holds", "off"]);
     SIZE_FACTS = Object.freeze(["pressure", "ceiling"]);
+    CEILING_VENUES = Object.freeze(["local", "podman"]);
     MIB = 1024 * 1024;
     DAY_MS = 24 * 60 * 60 * 1e3;
     isCount = (v) => Number.isSafeInteger(v) && v >= 0;
@@ -10849,6 +10888,10 @@ var init_reserved_env = __esm({
       "PI_RUNNER_OBSERVABLE",
       // Issue #693: derived from the resolved job memory, never chosen by a trigger or forwarded host value.
       "PI_CODEMODE_MAX_WORKERS",
+      // Issue #865: the job's size as the job reads it (job-size.mjs `jobSizeEnv`). A trigger binding one through
+      // run.secrets, or a forwarded host value, would tell the job's tools a size the container was not given.
+      "PI_JOB_SIZE_CPUS",
+      "PI_JOB_SIZE_MEMORY_MIB",
       "PI_PROVIDER",
       "PI_MODEL",
       "PI_FORK_ENTRY",
@@ -13192,39 +13235,25 @@ function findDuplicateKey(text4) {
   };
   const skipString = () => {
     i2++;
+    let escaped = false;
     while (i2 < n3) {
-      const ch = s2[i2];
-      if (ch === '"') {
-        i2++;
-        return;
-      }
-      i2 += ch === "\\" ? 2 : 1;
-    }
-  };
-  const readString = () => {
-    i2++;
-    let out = "";
-    while (i2 < n3) {
-      const ch = s2[i2];
-      if (ch === '"') {
+      const c = s2.charCodeAt(i2);
+      if (c === 34) {
         i2++;
-        return out;
+        return escaped;
       }
-      if (ch === "\\") {
-        const esc = s2[i2 + 1];
+      if (c === 92) {
+        escaped = true;
         i2 += 2;
-        if (esc === "u") {
-          out += String.fromCharCode(Number.parseInt(s2.slice(i2, i2 + 4), 16));
-          i2 += 4;
-        } else {
-          out += SIMPLE_ESCAPES[esc] ?? esc;
-        }
-        continue;
+      } else {
+        i2++;
       }
-      out += ch;
-      i2++;
     }
-    return out;
+    return escaped;
+  };
+  const readKey = () => {
+    const start = i2;
+    return skipString() ? JSON.parse(s2.slice(start, i2)) : s2.slice(start + 1, i2 - 1);
   };
   let expectKey = false;
   while (i2 < n3) {
@@ -13273,8 +13302,11 @@ function findDuplicateKey(text4) {
     if (ch === '"') {
       const top = stack[stack.length - 1];
       if (expectKey && top && top.keys !== null) {
-        const key2 = readString();
-        if (top.keys.has(key2)) return { key: key2, at: [...path6, key2].join(".") };
+        const key2 = readKey();
+        if (top.keys.has(key2)) {
+          const own2 = JSON.parse(JSON.stringify(key2));
+          return { key: own2, at: [...path6, own2].join(".") };
+        }
         top.keys.add(key2);
         path6.push(key2);
         top.named = true;
@@ -13288,10 +13320,9 @@ function findDuplicateKey(text4) {
   }
   return null;
 }
-var SIMPLE_ESCAPES, STRUCTURAL;
+var STRUCTURAL;
 var init_json_duplicates = __esm({
   "../worker/src/json-duplicates.mjs"() {
-    SIMPLE_ESCAPES = { '"': '"', "\\": "\\", "/": "/", b: "\b", f: "\f", n: "\n", r: "\r", t: "	" };
     STRUCTURAL = /* @__PURE__ */ new Set([",", ":", "{", "}", "[", "]", '"', " ", "	", "\n", "\r"]);
   }
 });
@@ -15037,8 +15068,9 @@ function pauseWindowsVersionRefusal(doc, { supported = PAUSE_WINDOWS_VERSION } =
 function heldPauseWindows(text4, path6) {
   if ((text4 ?? "").trim() === "") return { doc: null, windows: [] };
   const { value, problem } = heldDocument(text4, "windows");
-  const refused3 = problem ?? (findDuplicateKey(text4) ? "has a key written twice" : null);
-  if (refused3) return { doc: value ?? null, problem: `the pause-windows file ${path6} ${refused3}, so its windows cannot be kept` };
+  const doubled = value !== void 0 && findDuplicateKey(text4) !== null;
+  const refused3 = doubled ? "has a key written twice" : problem ?? null;
+  if (refused3) return { doc: doubled ? null : value ?? null, problem: `the pause-windows file ${path6} ${refused3}, so its windows cannot be kept` };
   return { doc: value, windows: Array.isArray(value.windows) ? value.windows : [] };
 }
 function pauseWindowsText(doc, windows, { table: table3 = PAUSE_WINDOW_FIELD_VERSIONS, valueTable = PAUSE_WINDOW_VALUE_VERSIONS } = {}) {
@@ -15089,6 +15121,10 @@ function parsePauseWindows(text4, path6, { supported = PAUSE_WINDOWS_VERSION, ta
   } catch (error) {
     throw configError4(`pause-windows file is not valid JSON: ${path6} (${error.message})`);
   }
+  const duplicate = findDuplicateKey(text4);
+  if (duplicate) {
+    throw configError4(`pause-windows file has a duplicate key ${JSON.stringify(duplicate.key)} at ${duplicate.at}: JSON keeps the LAST value, so the file a person reads and the file that applies are not the same: ${path6}`);
+  }
   const problem = pauseWindowsVersionRefusal(parsed, { supported });
   if (problem) {
     const error = configError4(`${problem.message}: ${path6}`);
@@ -39837,7 +39873,7 @@ function setMember(members, key2, value) {
     members[key2] = value;
   }
 }
-var MAX_REPORTED_DEPTH, ROOT_SLOT, CREDIT_PER_APPEND, CREDIT_PER_CHARACTER, MAX_PENDING_SCALAR_LENGTH, NUMBER, NUMBER_WITHOUT_EXPONENT_DIGITS, LITERALS, QUOTE, BACKSLASH, StreamingJsonParser, ToolCallArgumentsStream, SIMPLE_ESCAPES2;
+var MAX_REPORTED_DEPTH, ROOT_SLOT, CREDIT_PER_APPEND, CREDIT_PER_CHARACTER, MAX_PENDING_SCALAR_LENGTH, NUMBER, NUMBER_WITHOUT_EXPONENT_DIGITS, LITERALS, QUOTE, BACKSLASH, StreamingJsonParser, ToolCallArgumentsStream, SIMPLE_ESCAPES;
 var init_streaming_json = __esm({
   "../node_modules/@earendil-works/pi-ai/dist/utils/streaming-json.js"() {
     init_json_parse();
@@ -40030,7 +40066,7 @@ var init_streaming_json = __esm({
       /** Continue an escape with `char`; returns false when `char` is not part of it and must be read normally. */
       #continueEscape(open2, char) {
         if (open2.escape === "\\") {
-          const decoded2 = SIMPLE_ESCAPES2[char];
+          const decoded2 = SIMPLE_ESCAPES[char];
           if (decoded2 !== void 0) {
             open2.escape = "";
             this.#appendString(open2, decoded2);
@@ -40234,7 +40270,7 @@ var init_streaming_json = __esm({
         return this.#arguments;
       }
     };
-    SIMPLE_ESCAPES2 = {
+    SIMPLE_ESCAPES = {
       '"': '"',
       "\\": "\\",
       "/": "/",
@@ -114901,10 +114937,12 @@ function withdrawCancel({ redis, jobId, interventionOrigin = "human" }) {
   Promise.resolve().then(() => redis.del(cancelRequestKeyOf(jobId, interventionOrigin))).catch(() => {
   });
 }
-async function requestCancel({ redis, jobId, interventionOrigin = "human", ackTimeoutMs = 1e4, pollMs = 250, sleep: sleep5 = (ms3) => new Promise((r2) => setTimeout(r2, ms3)) }) {
+async function requestCancel({ redis, jobId, interventionOrigin = "human", ackTimeoutMs = 1e4, pollMs = 250, sleep: sleep5 = (ms3) => new Promise((r2) => setTimeout(r2, ms3)), now = Date.now, onWritten = null }) {
   const requestKey = cancelRequestKeyOf(jobId, interventionOrigin);
   const ackKey = interventionOrigin === "agent" ? agentCancelAckKey(jobId) : cancelAckKey(jobId);
   await redis.set(requestKey, interventionOrigin === "agent" ? "agent-cancel" : "operator-cancel", "PX", CANCEL_REQ_TTL_MS);
+  onWritten?.();
+  const deadline = now() + ackTimeoutMs;
   for (let waited = 0; ; waited += pollMs) {
     let host;
     try {
@@ -114914,7 +114952,7 @@ async function requestCancel({ redis, jobId, interventionOrigin = "human", ackTi
       throw err;
     }
     if (host !== null && host !== void 0) return { ack: host };
-    if (waited + pollMs > ackTimeoutMs) break;
+    if (waited + pollMs > ackTimeoutMs || now() >= deadline) break;
     await sleep5(pollMs);
   }
   try {
@@ -114931,31 +114969,44 @@ function ranBefore(job) {
   return made === 1 ? "it made 1 attempt before and was waiting to retry; whatever that attempt recorded stays, and cancel writes none" : `it made ${made} attempts before and was waiting to retry; whatever those attempts recorded stays, and cancel writes none`;
 }
 async function holdInPlace(redis, jobId) {
-  if (typeof redis?.hexists !== "function") return false;
+  if (typeof redis?.hexists !== "function") return null;
   try {
     return await redis.hexists(jobKey(jobId), "since") === 1;
   } catch {
-    return false;
+    return null;
   }
 }
+function neverSent(err) {
+  return err?.code === "ETIMEDOUT" && err?.message === "Command timed out" && err?.valkeyMayStillRun !== true;
+}
+function noAnswer(err) {
+  return err?.code === "ETIMEDOUT" || err?.valkeyMayStillRun === true;
+}
 async function removeHeldJob({ redis, queue, jobId, timeoutMs = 2e3, dropDefer = false, touchStore = void 0, touchOutbox = null, now = Date.now, interventionOrigin = "human" }) {
   let cleared = false;
+  let step = null;
   try {
     const hash2 = await redis.hgetall(jobKey(jobId));
     if (!hash2 || !hash2.since) return { invalid: `job ${jobId} is not waiting on a condition` };
     const job = await queue.getJob(jobId);
     if (!job) return { invalid: `job ${jobId} is no longer in the queue` };
-    const state5 = await job.getState().catch(() => null);
+    let unread2 = null;
+    const state5 = await job.getState().catch((err) => (unread2 = err, null));
+    if (unread2 !== null) return { invalid: `the state of job ${jobId} could not be read, so nothing was changed: ${unread2?.message ?? String(unread2)}`, ...noAnswerOf(unread2) };
     if (state5 !== "delayed" && state5 !== "waiting" && state5 !== "prioritized") {
       return { invalid: `job ${jobId} is ${state5 ?? "in an unknown state"}, not waiting -- it has already left the hold` };
     }
     cleared = true;
+    step = "hold";
     try {
       await redis.del(jobKey(jobId));
     } catch (err) {
-      if (await holdInPlace(redis, jobId)) cleared = false;
+      const inPlace = await holdInPlace(redis, jobId);
+      if (inPlace === true || neverSent(err)) cleared = false;
+      else if (inPlace === false) step = null;
       throw err;
     }
+    step = null;
     await redis.srem(HELD_SET, jobId).catch(() => {
     });
     if (hash2.dedupId) {
@@ -114963,24 +115014,33 @@ async function removeHeldJob({ redis, queue, jobId, timeoutMs = 2e3, dropDefer =
       if (holder === jobId) await redis.del(leaseKey(hash2.dedupId));
     }
     const store = touchStore === void 0 ? typeof redis?.eval === "function" ? makeTouchStore({ redis, now }) : null : touchStore;
-    const removal2 = interventionOrigin === "agent" ? (await job.remove(), { ok: true }) : await trackTouchAction({ store, outbox: touchOutbox, event: stopTouch(job, queue, jobId, now), act: async () => {
+    const remove2 = async () => {
+      step = "job";
       await job.remove();
       return { ok: true };
-    }, succeeded: () => !(job.attemptsMade > 0) && isWorkload(job) });
+    };
+    const removal2 = interventionOrigin === "agent" ? await remove2() : await trackTouchAction({ store, outbox: touchOutbox, event: stopTouch(job, queue, jobId, now), act: remove2, succeeded: () => !(job.attemptsMade > 0) && isWorkload(job) });
+    step = null;
     await Promise.all([dropDefer ? dropDeferRecord(redis, jobId, timeoutMs) : null, dropAttemptOf(redis, queue, jobId, timeoutMs)]);
     return { ok: true, jobId, attemptsMade: Number.isInteger(job.attemptsMade) && job.attemptsMade > 0 ? job.attemptsMade : 0, ...removal2.touchWarning ? { touchWarning: removal2.touchWarning } : {} };
   } catch (err) {
     const invalid = err?.message ?? String(err);
-    return cleared ? { invalid, cleared: true } : { invalid };
+    if (!cleared) return { invalid, ...noAnswerOf(err) };
+    return { invalid, cleared: true, ...err?.valkeyMayStillRun === true && step !== null ? { unanswered: step } : {} };
   }
 }
 async function removeQueuedJob({ redis, queue, job, jobId, state: state5 = null, timeoutMs = 2e3, guard = null, touchStore = void 0, touchOutbox = null, now = Date.now, interventionOrigin = "human" }) {
-  const hash2 = await Promise.resolve().then(() => redis.hgetall(jobKey(jobId))).catch(() => null);
+  let holdUnread = null;
+  const hash2 = typeof redis?.hgetall !== "function" ? null : await Promise.resolve().then(() => redis.hgetall(jobKey(jobId))).catch((err) => (holdUnread = err, null));
+  if (holdUnread !== null) {
+    const words = holdUnread?.message ?? String(holdUnread);
+    return { invalid: `could not read whether job ${jobId} is held on a wait condition, so nothing was changed: ${words}`, holdUnread: words, ...noAnswerOf(holdUnread) };
+  }
   if (hash2?.since) {
     const stop3 = await guarded(guard, job);
     if (stop3 !== null) return stop3;
     const res = await removeHeldJob({ redis, queue, jobId, timeoutMs, dropDefer: true, touchStore, touchOutbox, now, interventionOrigin });
-    if (!res.ok) return res.cleared === true ? { invalid: res.invalid, cleared: true } : { invalid: res.invalid };
+    if (!res.ok) return res.cleared === true ? { invalid: res.invalid, cleared: true, ...res.unanswered ? { unanswered: res.unanswered } : {} } : { invalid: res.invalid, ...res.noAnswer !== void 0 ? { noAnswer: res.noAnswer } : {} };
     return { ok: true, held: true, jobId: res.jobId, attemptsMade: res.attemptsMade, ...res.touchWarning ? { touchWarning: res.touchWarning } : {} };
   }
   if (!job) return { notQueued: true, state: "unknown" };
@@ -115020,7 +115080,7 @@ async function dropAttemptOf(redis, queue, jobId, timeoutMs) {
 function dropDeferRecord(redis, jobId, timeoutMs) {
   return dropKey(redis, deferKey(jobId), timeoutMs);
 }
-var isWorkload, CANCEL_REQ_TTL_MS, CANCEL_ACK_TTL_MS, cancelReqKey, cancelAckKey, agentCancelReqKey, agentCancelAckKey, cancelRequestKeyOf, QUEUED_STATES2;
+var isWorkload, CANCEL_REQ_TTL_MS, CANCEL_ACK_TTL_MS, cancelReqKey, cancelAckKey, agentCancelReqKey, agentCancelAckKey, cancelRequestKeyOf, noAnswerOf, QUEUED_STATES2;
 var init_cancel_state = __esm({
   "../worker/src/cancel-state.mjs"() {
     init_touch_state();
@@ -115037,6 +115097,7 @@ var init_cancel_state = __esm({
     agentCancelReqKey = (jobId) => `cancel:agent:req:${jobId}`;
     agentCancelAckKey = (jobId) => `cancel:agent:ack:${jobId}`;
     cancelRequestKeyOf = (jobId, interventionOrigin) => interventionOrigin === "agent" ? agentCancelReqKey(jobId) : cancelReqKey(jobId);
+    noAnswerOf = (err) => noAnswer(err) ? { noAnswer: err?.message ?? String(err) } : {};
     QUEUED_STATES2 = Object.freeze(["delayed", "waiting", "prioritized", "paused"]);
   }
 });
@@ -117398,10 +117459,12 @@ function valkeyClientContext({ env: env2 = process.env, cwd = process.cwd(), pla
   const envPath = join8(cwd, ".env");
   let content = null;
   let error = null;
+  let absent = false;
   try {
     content = readEnv3(envPath);
   } catch (err) {
-    if (err?.code !== "ENOENT") error = `${envPath} could not be read (${err?.code ?? err?.message})`;
+    if (err?.code === "ENOENT") absent = true;
+    else error = `${envPath} could not be read (${err?.code ?? err?.message})`;
   }
   const fileKeys = {};
   if (content !== null) {
@@ -117415,9 +117478,9 @@ function valkeyClientContext({ env: env2 = process.env, cwd = process.cwd(), pla
     if (keys3.error) error ??= keys3.error;
     else for (const k of [VALKEY_SHARED_KEY, VALKEY_PASSWORD_KEY, "VALKEY_URL"]) if (typeof keys3.keys[k] === "string") fileKeys[k] = keys3.keys[k];
   }
-  return valkeyContextFromKeys({ env: env2, envPath, fileKeys, error, platform, rootRefused });
+  return valkeyContextFromKeys({ env: env2, envPath, fileKeys, error, absent, platform, rootRefused });
 }
-function valkeyContextFromKeys({ env: env2 = process.env, envPath = null, fileKeys = {}, error = null, platform = process.platform, rootRefused } = {}) {
+function valkeyContextFromKeys({ env: env2 = process.env, envPath = null, fileKeys = {}, error = null, absent = false, platform = process.platform, rootRefused } = {}) {
   const fileVenue = typeof fileKeys.PI_BACKENDS === "string" ? { PI_BACKENDS: fileKeys.PI_BACKENDS } : {};
   const shared = valkeySharedOn(fileKeys[VALKEY_SHARED_KEY]);
   const filePassword = fileKeys[VALKEY_PASSWORD_KEY] || null;
@@ -117431,7 +117494,7 @@ function valkeyContextFromKeys({ env: env2 = process.env, envPath = null, fileKe
   const engine = typeof env2.PI_OPENSHELL_ENGINE === "string" ? env2.PI_OPENSHELL_ENGINE : fileKeys.PI_OPENSHELL_ENGINE;
   const derived = platform === "linux" && (venues.podmanUsed && !venues.localUsed || openshellSetupOf(venues, { PI_OPENSHELL_ENGINE: engine }).valkeyEngine === "podman");
   const envUrl = typeof env2.VALKEY_URL === "string" ? env2.VALKEY_URL : null;
-  return { envPath, shared, rootRefused: typeof rootRefused === "boolean" ? rootRefused : derived, error, password: { environment: envPassword, file: filePassword }, url: { environment: envUrl, file: fileUrl } };
+  return { envPath, shared, rootRefused: typeof rootRefused === "boolean" ? rootRefused : derived, error, absent: absent === true, password: { environment: envPassword, file: filePassword }, url: { environment: envUrl, file: fileUrl } };
 }
 function valkeyUrlProblem(url) {
   let u;
@@ -117570,6 +117633,11 @@ function scrubValkeyError(err) {
   }
   return err;
 }
+function refusedDatabaseOf(client) {
+  if (!client?.[DB_REFUSED]) return null;
+  const db = client.condition?.select ?? client.options?.db;
+  return { db: Number.isSafeInteger(db) ? db : null };
+}
 function isSelectRangeError(err) {
   return Boolean(err) && typeof err === "object" && String(err.command?.name ?? "").toLowerCase() === "select" && /DB index is out of range|invalid DB index/i.test(String(err.message ?? ""));
 }
@@ -117593,10 +117661,12 @@ function onValkeyError(emitter, what2, write = (line2) => process.stderr.write(l
 function givesUp(connection) {
   return connection?.[JUDGE]?.failFast === true;
 }
-function parseConnection(url, { failFast = false, servername = null, context = null, judge: judge2 = null, withoutPassword = false, freshContext = false } = {}) {
+function parseConnection(url, { failFast = false, servername = null, context = null, judge: judge2 = null, withoutPassword = false, freshContext = false, commandTimeoutMs = null } = {}) {
   const u = new URL(url);
   const dbProblem = valkeyUrlProblem(url);
   if (dbProblem) throw valkeyRefusal(dbProblem);
+  const bounded12 = Number.isSafeInteger(commandTimeoutMs) && commandTimeoutMs > 0;
+  if (bounded12 && !failFast) throw new TypeError("parseConnection: a command bound (commandTimeoutMs) is for a failFast client only, which has no offline queue to send a command that timed out from later");
   const where = context ?? defaultValkeyContext();
   const { password } = valkeyPasswordFor(url, where, { withoutPassword });
   return {
@@ -117605,7 +117675,9 @@ function parseConnection(url, { failFast = false, servername = null, context = n
     // reports. `context` is where the client stands (`valkeyClientContext`), the process's own when not given.
     Connector: JudgedConnector,
     // `judge` is a test seam only: the function asked for the address (judgedEndpoint when not given).
-    [JUDGE]: { url, context: where, ...judge2 ? { judge: judge2 } : {}, ...freshContext && !context ? { freshContext: true } : {}, ...failFast ? { failFast: true } : {} },
+    // `freshPassword` (issue #845): a client that judges by the context as it is at each connect sends the password that
+    // context gives then, unless it was built to send none (`withoutPassword`, a probe of what another account sees).
+    [JUDGE]: { url, context: where, ...judge2 ? { judge: judge2 } : {}, ...freshContext && !context ? { freshContext: true, ...withoutPassword ? {} : { freshPassword: true } } : {}, ...failFast ? { failFast: true } : {}, ...bounded12 ? { commandBound: true } : {} },
     // WHATWG URL keeps an IPv6 literal's brackets in `hostname` (`[::1]`), and net.connect then looks up the name
     // "[::1]", which never resolves, so a `redis://[::1]:6379` VALKEY_URL never connected (issue #464, measured on
     // Fedora 44: ETIMEDOUT). The address is the part inside them.
@@ -117627,7 +117699,10 @@ function parseConnection(url, { failFast = false, servername = null, context = n
       // don't buffer commands while disconnected -- error now
       retryStrategy: (attempts) => attempts > 2 ? null : 200
       // give up after ~2 tries
-    } : {}
+    } : {},
+    // ioredis' resend of what was on a connection that died is off with the bound: the caller was told such a command
+    // failed, and a resend on the next connection would make it run after that.
+    ...bounded12 ? { commandTimeout: commandTimeoutMs, autoResendUnfulfilledCommands: false } : {}
   };
 }
 function makeRedisClient(url, { servername = null, context = null, failFast = false, lazyConnect = false, judge: judge2 = null, withoutPassword = false, disconnectTimeoutMs = null, noOfflineQueue = false, commandTimeoutMs = null, freshContext = false } = {}) {
@@ -117635,6 +117710,30 @@ function makeRedisClient(url, { servername = null, context = null, failFast = fa
   const options = { ...parseConnection(url, { failFast, servername, context, judge: judge2, withoutPassword, freshContext }), ...noOfflineQueue ? { enableOfflineQueue: false, maxRetriesPerRequest: 1 } : {}, ...lazyConnect ? { lazyConnect: true } : {}, ...Number.isSafeInteger(disconnectTimeoutMs) && disconnectTimeoutMs >= 0 ? { disconnectTimeout: disconnectTimeoutMs } : {}, ...bounded12 ? { commandTimeout: commandTimeoutMs, autoResendUnfulfilledCommands: false } : {} };
   return bounded12 ? new BoundedRedis(options) : new Redis(options);
 }
+function sameValkeyServer(a, b) {
+  const x2 = valkeyTarget(a);
+  const y = valkeyTarget(b);
+  return !x2.error && !y.error && x2.host === y.host && x2.port === y.port;
+}
+function freshPasswordVerdict(judge2, context, held) {
+  if (!context || context.error || context.absent === true) return { take: false, declined: null };
+  if ((context.envPath ?? null) !== (judge2?.context?.envPath ?? null)) return { take: false, declined: null };
+  const { password, from } = valkeyPasswordFor(judge2.url, context);
+  const fromFile2 = from !== "VALKEY_URL" && from !== "the environment";
+  if (fromFile2 && !sameValkeyServer(context.url?.file ?? DEFAULT_VALKEY_URL, judge2.url)) return { take: false, declined: (password ?? null) !== (held ?? null) };
+  return { take: true, password: password ?? null };
+}
+function passwordDeclinedOf(client) {
+  const connector = client?.connector;
+  if (connector?.[PASSWORD_DECLINED] !== true) return false;
+  const judge2 = connector.options?.[JUDGE];
+  if (judge2?.freshPassword !== true) return false;
+  try {
+    return freshPasswordVerdict(judge2, defaultValkeyContext(), connector.options.password).declined === true;
+  } catch {
+    return false;
+  }
+}
 function isJudgedConnection(connection) {
   const options = connection?.options ?? connection;
   return options?.Connector === JudgedConnector && Boolean(options?.[JUDGE]);
@@ -117665,7 +117764,7 @@ async function claimValkeyOwner(url, folder2, { context = null, waitMs = 15e3, m
     await sleep5(500);
   }
 }
-var SCRUBS, DB_REFUSED, SELECT_HOOK, VALKEY_ERROR_QUIET_MS, VALKEY_ERRORS_HELD, saidAt, BoundedRedis, JUDGE, JudgedConnector;
+var SCRUBS, DB_REFUSED, SELECT_HOOK, VALKEY_ERROR_QUIET_MS, VALKEY_ERRORS_HELD, saidAt, COMMAND_BOUND_HOOK, BoundedRedis, JUDGE, FRESH_PASSWORD, PASSWORD_DECLINED, JudgedConnector, FRESH_PASSWORD_HOOK;
 var init_connection = __esm({
   "../worker/src/connection.mjs"() {
     init_valkey_auth();
@@ -117717,6 +117816,23 @@ var init_connection = __esm({
     VALKEY_ERROR_QUIET_MS = 6e4;
     VALKEY_ERRORS_HELD = 256;
     saidAt = /* @__PURE__ */ new Map();
+    COMMAND_BOUND_HOOK = /* @__PURE__ */ Symbol.for("pi-dispatch.valkey-command-bound");
+    if (!Redis.prototype[COMMAND_BOUND_HOOK]) {
+      const sendCommand = Redis.prototype.sendCommand;
+      Redis.prototype.sendCommand = function sendCommandWithBound(command3, stream11) {
+        const answer = sendCommand.call(this, command3, stream11);
+        if (this.options?.[JUDGE]?.commandBound !== true) return answer;
+        command3._commandTimeoutTimer?.unref?.();
+        if (this.commandQueue?.peekBack?.()?.command !== command3) return answer;
+        answer?.catch?.((err) => {
+          if (!err || typeof err !== "object" || err.name === "ReplyError" || err.valkeyRefused) return;
+          if (err.message === "Command timed out") err.code ??= "ETIMEDOUT";
+          err.valkeyMayStillRun = true;
+        });
+        return answer;
+      };
+      Redis.prototype[COMMAND_BOUND_HOOK] = true;
+    }
     BoundedRedis = class extends Redis {
       sendCommand(command3, stream11) {
         const answer = super.sendCommand(command3, stream11);
@@ -117737,6 +117853,8 @@ var init_connection = __esm({
       }
     };
     JUDGE = "piDispatchValkeyJudge";
+    FRESH_PASSWORD = /* @__PURE__ */ Symbol.for("pi-dispatch.valkey-fresh-password");
+    PASSWORD_DECLINED = /* @__PURE__ */ Symbol.for("pi-dispatch.valkey-password-declined");
     JudgedConnector = class _JudgedConnector extends AbstractConnector {
       constructor(options) {
         super(options.disconnectTimeout);
@@ -117746,6 +117864,55 @@ var init_connection = __esm({
       check() {
         return !this[DB_REFUSED];
       }
+      /**
+       * Issue #845: a `freshPassword` client's password, as `valkeyPasswordFor` reads it from the context as it is now, put
+       * where ioredis reads it for the connect about to start (the hook below). Here and not in `connect()`: by the time
+       * ioredis asks the connector for a stream it has already built that connect's AUTH from `options.password`. The options
+       * are the client's own object (ioredis hands its `options` to the Connector it constructs), so this is what the client
+       * sends. A password from VALKEY_URL's userinfo comes back as it is, so it stays fixed. The last password is kept by a
+       * context that:
+       *   - throws, or names an `error` (a `.env` that cannot be read, or a line in it the service's loader reads
+       *     differently): it cannot say which password the file holds, and dropping the one that worked would refuse a client
+       *     that is fine;
+       *   - finds no file (`absent`): a `.env` gone, for good or for the moment an editor replaces it, is not a file that
+       *     sets no password, so it does not drop one either (the console says to put the file back before a restart);
+       *   - would answer from the `.env` while that file does not name the Valkey this client dials: a password the file
+       *     gives (or the lack of one) belongs to the Valkey the file's VALKEY_URL names, the default one when it names
+       *     none, and a held client never moves to another Valkey. Review of PR #878, measured with two Valkeys: one
+       *     deployment moving to another Valkey changes both lines together, a symlinked deployment folder repointed reads
+       *     another deployment's file through the same path, and a shell that exports VALKEY_URL keeps the client on its URL
+       *     whatever the file says; in each the new Valkey's password went to the old one, which refused it, and the pages
+       *     lost the old Valkey too. The check is against the URL the client dials, not the context's own choice of URL
+       *     (`valkeyUrlFor`, which prefers this shell's and so never moved), and by the server each names (`sameValkeyServer`:
+       *     `valkeyTarget`'s host and port, so a scheme alias, a database path or a trailing `/` is the same Valkey, while
+       *     `localhost` and `127.0.0.1` stay two names, as `valkeyEndpointTag` keeps them). A rotation keeps the file's URL,
+       *     so it is taken, and so is a password a bad line hid at start once the line is fixed, when the file names the
+       *     client's Valkey. A password declined here that is not the one the client holds is recorded (`PASSWORD_DECLINED`,
+       *     `passwordDeclinedOf`), so the console names VALKEY_PASSWORD as needing a restart rather than going on refused in
+       *     silence (a shell that exports `redis://localhost:6440` over a file's `redis://127.0.0.1:6440`, say);
+       *   - is read from another `.env` path than the one the client was built with: the pi extension's context follows the
+       *     deployment pointer, and that alone says the file is another deployment's.
+       * A password from this process's environment, or from VALKEY_URL's own userinfo, is not the file's, and is taken as it
+       * comes. A context that passes all of these and gives no password drops it, as a restart would.
+       */
+      [FRESH_PASSWORD]() {
+        const judge2 = this.options?.[JUDGE];
+        if (judge2?.freshPassword !== true) return;
+        let context;
+        try {
+          context = defaultValkeyContext();
+        } catch {
+          return;
+        }
+        const verdict2 = freshPasswordVerdict(judge2, context, this.options.password);
+        if (!verdict2.take) {
+          if (verdict2.declined !== null) this[PASSWORD_DECLINED] = verdict2.declined;
+          return;
+        }
+        this[PASSWORD_DECLINED] = false;
+        if (verdict2.password) this.options.password = verdict2.password;
+        else delete this.options.password;
+      }
       connect() {
         const { options } = this;
         if (this[DB_REFUSED]) return Promise.reject(this[DB_REFUSED]);
@@ -117777,6 +117944,18 @@ var init_connection = __esm({
       }
     };
     JudgedConnector.dial = { net: netConnect2, tls: tlsConnect };
+    FRESH_PASSWORD_HOOK = /* @__PURE__ */ Symbol.for("pi-dispatch.valkey-fresh-password-hook");
+    if (!Redis.prototype[FRESH_PASSWORD_HOOK]) {
+      const connect = Redis.prototype.connect;
+      Redis.prototype.connect = function connectWithFreshPassword(...args) {
+        try {
+          this.connector?.[FRESH_PASSWORD]?.();
+        } catch {
+        }
+        return connect.apply(this, args);
+      };
+      Redis.prototype[FRESH_PASSWORD_HOOK] = true;
+    }
   }
 });
 
@@ -118870,6 +119049,10 @@ var init_redact_secrets = __esm({
     NON_SECRET_ENV_KEYS = /* @__PURE__ */ new Set([
       // Issue #693: a memory-derived concurrency count, never a credential; keep it in the structural venue env.
       "PI_CODEMODE_MAX_WORKERS",
+      // Issue #865: the job's size, two integers, never a secret. Listed, or OpenShell would put each in the job's credential
+      // provider and the agent would read a placeholder where a tool's worker count needs the number.
+      "PI_JOB_SIZE_CPUS",
+      "PI_JOB_SIZE_MEMORY_MIB",
       "PI_PROVIDER",
       "PI_MODEL",
       "PI_FORK_ENTRY",
@@ -121668,7 +121851,7 @@ function hostsAgree(rows3) {
   const [first, ...others] = rows3.map(loadsFingerprint);
   return others.every((other) => other === first);
 }
-var HOST_LOADS_CAPS, HOST_LOADS_MAX_BYTES, FIT_ORDER, HOST_LOADS_PARTS, HOST_LOADS_MORE, HOST_LOADS_LISTS, LOADS_EXTENSION_KINDS, LOADS_TRANSPORTS, LOADS_FLOW_TIERS, LOADS_REPO_STATES, isObject4, LOADS_IGNORE_FILES;
+var HOST_LOADS_CAPS, HOST_LOADS_MAX_BYTES, FIT_ORDER, HOST_LOADS_PARTS, HOST_LOADS_MORE, HOST_LOADS_LISTS, LOADS_EXTENSION_KINDS, LOADS_TRANSPORTS, LOADS_FLOW_TIERS, LOADS_REPO_STATES, isObject4, FLOW_INPUT_FIELDS, FLOW_BASIS_HEX, FLOW_BASIS_RE, LOADS_IGNORE_FILES;
 var init_host_loads = __esm({
   "../worker/src/host-loads.mjs"() {
     init_doctor_results();
@@ -121688,6 +121871,9 @@ var init_host_loads = __esm({
     LOADS_FLOW_TIERS = Object.freeze(["repository", "trigger", "overlay", "package", "none", "unknown"]);
     LOADS_REPO_STATES = Object.freeze(["present", "absent", "unknown"]);
     isObject4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+    FLOW_INPUT_FIELDS = Object.freeze(["flow", "folder", "skillsDir", "packages", "excludeExtensions"]);
+    FLOW_BASIS_HEX = 8;
+    FLOW_BASIS_RE = new RegExp(`^[0-9a-f]{${FLOW_BASIS_HEX}}$`);
     LOADS_IGNORE_FILES = Object.freeze([".gitignore", ".ignore", ".fdignore"]);
   }
 });
@@ -121881,7 +122067,7 @@ var init_mcp_preflight = __esm({
       "mcp-list-invalid": "the list this job carries is not one the triggers file's loader writes (a service in this deployment may be at another version)",
       "mcp-config-invalid": "this deployment's list of MCP servers (mcp.json in the overlay) cannot be used",
       "mcp-server-unknown": "this deployment does not offer that server",
-      "mcp-secret-reserved": "that server would be handed a credential this deployment keeps for the job itself",
+      "mcp-secret-reserved": "that server would be handed a variable this deployment keeps for the job itself",
       "mcp-secret-unmapped": "a credential that server needs is not passed by this trigger",
       "mcp-excluded": "this trigger's run.excludeTools removes every way the job could reach that server",
       "mcp-egress-unreachable": "the egress policy does not let a job reach that server",
@@ -122136,7 +122322,7 @@ var init_reason_catalog = __esm({
       ["mcp-config-invalid", "Refused: the list of MCP servers could not be used: the overlay `mcp.json` before the job started, or the list the worker wrote for the job inside its container. Not run.", "Fix the overlay `mcp.json` (`pi-dispatch doctor` checks it), and run a worker and a job image of the same release."],
       ["mcp-server-unknown", mcpRefusalComment("mcp-server-unknown", null), "Declare the server in the overlay `mcp.json`, or fix the name in `run.mcp`."],
       ["mcp-secret-unmapped", mcpRefusalComment("mcp-secret-unmapped", null), "Pass the credential the server needs in the trigger's `run.secrets`."],
-      ["mcp-secret-reserved", mcpRefusalComment("mcp-secret-reserved", null), "Give the server's credential a variable of its own."],
+      ["mcp-secret-reserved", mcpRefusalComment("mcp-secret-reserved", null), "Give the server a variable of its own, not one the job keeps."],
       ["mcp-excluded", mcpRefusalComment("mcp-excluded", null), "Remove the server from `run.mcp`, or keep a tool that reaches it out of `run.excludeTools`."],
       ["mcp-egress-unreachable", mcpRefusalComment("mcp-egress-unreachable", null), "Add the server's host to the egress allowlist, or drop the server from `run.mcp`."],
       ["mcp-package-runner", mcpRefusalComment("mcp-package-runner", null), "Allow the package registry in the egress allowlist, or install the server in the job image."],
@@ -122801,7 +122987,7 @@ function triggerLastRun(records, hostLoads = null) {
     ...sourcesOf(loaded, "package").filter((row2) => row2.toolNames?.length > 0).map((row2) => ({ kind: "package", from: row2.name ?? "a staged package", names: [...row2.toolNames] })),
     ...(overlay?.namedTools ?? []).map((row2) => ({ kind: "overlay", from: row2.name, names: [...row2.tools] }))
   ];
-  const sources = [...sourcesOf(loaded, "package"), ...(overlay?.names ?? []).map((name2) => ({ name: name2, version: null, tools: overlay.namedTools?.find((row2) => row2.name === name2)?.tools.length ?? 0, skills: 0, prompts: 0 }))];
+  const sources = [...sourcesOf(loaded, "package").map((row2) => ({ ...row2, kind: "package" })), ...(overlay?.names ?? []).map((name2) => ({ name: name2, version: null, kind: "overlay", tools: overlay.namedTools?.find((row2) => row2.name === name2)?.tools.length ?? 0, skills: 0, prompts: 0 }))];
   return {
     newest,
     quoted: { id: runIdOf2(record3), host: facts7.host, record: record3, rows: Object.fromEntries(loadedRows(record3, { past: true }).map((row2) => [row2.label, row2])), problems, sources, tools, notes: [...cutWords(loaded), ...wentOn(record3) && loaded.at !== "ready" ? [LOADED_WORDS.notedEarly] : []] }
@@ -122829,12 +123015,12 @@ function hostLoadsRow(hostLoads, name2) {
   const row2 = Array.isArray(hostLoads?.hosts) ? hostLoads.hosts.find((entry3) => entry3?.name === name2) : null;
   return row2 ?? { name: name2, state: "unknown", why: hostLoads?.unreachable ? "unreachable" : "absent" };
 }
-function sandboxFreshLine({ hostLoads, host, triggerIndex, withholdsPackages = false, excludes = [], image = null }) {
+function sandboxFreshLine({ hostLoads, host, triggerIndex, withholdsPackages = false, excludes = [], image = null, mcp = null }) {
   const row2 = hostLoadsRow(hostLoads, host);
   const first = noOverlay(hostPiFor(row2, image));
   const unknown3 = (why) => [`${first} What a job of trigger ${triggerIndex + 1} would load on this host is unknown: ${why}.`];
   if (row2.state === "unknown") return unknown3(row2.why === "unreachable" ? "the hosts\u2019 doctor runs could not be read" : row2.why === "unreadable" ? "its last doctor run could not be read" : "it has published no doctor run");
-  const unread2 = (row2.unread ?? []).filter((part) => (part !== "packages" || !withholdsPackages) && (part !== "extensions" || row2.overlayExtensionsAllowed));
+  const unread2 = (row2.unread ?? []).filter((part) => (part !== "packages" || !withholdsPackages) && (part !== "extensions" || row2.overlayExtensionsAllowed) && (part !== "mcp" || !Array.isArray(mcp) || mcp.length > 0));
   if (unread2.length > 0) return unknown3(`its last doctor run could not read ${listed(unread2.map((part) => UNREAD_PART_WORDS[part] ?? "part of what it publishes"))}`);
   const packages = withholdsPackages ? [] : (row2.packages ?? []).filter((entry3) => !excludes.includes(entry3.name)).map((entry3) => `${entry3.name} ${entry3.version}`);
   const extensions = row2.overlayExtensionsAllowed ? (row2.extensions ?? []).map((entry3) => entry3.name).filter((name2) => !excludes.some((excluded) => overlayEntryNamed(excluded, name2))) : [];
@@ -123824,11 +124010,11 @@ function readDeploymentEnv({ dir, fs: fs9, uid = process.geteuid?.(), names: nam
   }
 }
 function deploymentServiceEnv({ env: env2, dir, keys: keys3, platform = process.platform, fs: fs9, uid = process.geteuid?.() }) {
-  const { path: path6, bytes, unreadable: unreadable3, untrusted } = readDeploymentEnv({ dir, fs: fs9, uid });
+  const { path: path6, bytes, absent, unreadable: unreadable3, untrusted } = readDeploymentEnv({ dir, fs: fs9, uid });
   const raw = untrusted ? null : bytes;
   const file = raw === null ? null : serviceEnvFileOf(raw, path6, serviceEnvLoader(platform));
   const shellRunsLine = file?.loader === "shell" && file.hazard !== null && file.hazard.shape !== "shell-crlf-comment" ? file.hazard.line : null;
-  return { ...resolveServiceEnv({ env: env2, file, keys: keys3 }), path: path6, unreadable: unreadable3, untrusted, hazard: file?.hazard ?? null, shellRunsLine };
+  return { ...resolveServiceEnv({ env: env2, file, keys: keys3 }), path: path6, absent, unreadable: unreadable3, untrusted, hazard: file?.hazard ?? null, shellRunsLine };
 }
 var init_service_env = __esm({
   "../worker/src/service-env.mjs"() {
@@ -125087,6 +125273,8 @@ async function enqueueTriggerFire(plan, options = {}) {
     const canary = options.packageCanary ?? null;
     const id7 = (canary ? manualCanaryJobId : manualTriggerJobId)({ triggerId: current.schedulerId, now: instant7 });
     redis = redisFn(url);
+    redis.on?.("error", () => {
+    });
     if (await redis.set(`trigger-fire:${current.queue}:${id7}`, "1", "EX", 120, "NX") !== "OK") return { refusal: "This cron trigger was already fired this minute. Nothing was queued.", deduplicated: true };
     queue = queueFn(parseConnectionFn(url, { failFast: true }), { name: current.queue });
     const schedule = canary ? { ...current.schedule, data: withJobDataVersion({ ...current.schedule.data, packageCanary: canary }) } : current.schedule;
@@ -127148,6 +127336,7 @@ __export(read_model_exports, {
   liveAbsentCause: () => liveAbsentCause,
   liveJobsOfRun: () => liveJobsOfRun,
   loaderRefuses: () => loaderRefuses,
+  loaderTriggers: () => loaderTriggers,
   makeLocalRunIndex: () => makeLocalRunIndex,
   mapSchedulers: () => mapSchedulers,
   mergedDollarProblem: () => mergedDollarProblem,
@@ -127294,7 +127483,7 @@ import { execFileSync as execFileSync3 } from "node:child_process";
 import { homedir as homedir3 } from "node:os";
 function resolvePaths(env2 = process.env) {
   return {
-    valkeyUrl: env2.VALKEY_URL ?? "redis://127.0.0.1:6379",
+    valkeyUrl: env2.VALKEY_URL ?? DEFAULT_VALKEY_URL,
     logsDir: logsDirPath(env2),
     settingsFile: settingsFilePath(env2),
     // Cwd defaults match what `pi-dispatch init` scaffolds (and, since issue #80, what the receiver
@@ -127454,7 +127643,7 @@ function panelValkeyContext({ env: env2 = process.env, pointerDir = null, owned
   if (pointerDir === null) return valkeyContextFromKeys({ env: own2, platform });
   const res = deploymentServiceEnv({ env: {}, dir: pointerDir, keys: VALKEY_CONTEXT_KEYS, platform, fs: fs9, uid });
   const error = res.untrusted ? `${res.path} ${res.untrusted}` : res.unreadable ? `${res.path} could not be read (${res.unreadable})` : res.hazardSkipped.length > 0 ? `${res.path} line ${res.hazard.line} ${res.hazard.what}` : res.unread.length > 0 ? `${res.path} assigns ${res.unread.map((u) => `${u.key} (line ${u.line})`).join(", ")} in a form the service's loader may read differently` : null;
-  return valkeyContextFromKeys({ env: own2, envPath: res.path, fileKeys: res.fromFile, error, platform });
+  return valkeyContextFromKeys({ env: own2, envPath: res.path, fileKeys: res.fromFile, error, absent: res.absent === true, platform });
 }
 function installPanelValkeyContext({ env: env2 = process.env } = {}) {
   useValkeyContext(() => {
@@ -127581,6 +127770,8 @@ async function checkDispatchRun({
     let redis;
     try {
       redis = redisFn(valkeyUrl);
+      redis.on?.("error", () => {
+      });
       const key2 = hourKey(now());
       const count7 = Number(consumeRate ? await redis.incr(key2) : await redis.get(key2) ?? 0);
       if (consumeRate && count7 === 1) await redis.expire(key2, DISPATCH_RUN_TTL_SECONDS);
@@ -128454,6 +128645,8 @@ async function readHosts({ url, redisFn = makeRedisClient, timeoutMs = 2500, now
   try {
     parseConnection(url, { failFast: true });
     redis = redisFn(url);
+    redis.on?.("error", () => {
+    });
     const res = await withTimeout2(readLiveHosts(redis, { now, timeoutMs: Math.max(250, Math.floor(timeoutMs / 2)) }), timeoutMs, { unreachable: "timed out reaching the registry" });
     if (res.unreachable) return { unreachable: res.unreachable };
     return { hosts: res.hosts };
@@ -128477,6 +128670,8 @@ async function readHeldJobs({ url, limit: limit3 = 20, redisFn = makeRedisClient
   try {
     parseConnection(url, { failFast: true });
     redis = redisFn(url);
+    redis.on?.("error", () => {
+    });
     const settled = (async () => {
       const ids = await redis.smembers(HELD_SET);
       const hydrated = await Promise.all(
@@ -128545,6 +128740,8 @@ async function cancelHeldJob({ url, jobId, redisFn = makeRedisClient, queueFn =
   try {
     parseConnection(url, { failFast: true });
     redis = redisFn(url);
+    redis.on?.("error", () => {
+    });
     settled = (async () => {
       const { names: names2 } = await readFleetQueues({ url, redisFn, timeoutMs: Math.max(250, Math.floor(timeoutMs / 2)) });
       let owner2 = null;
@@ -128677,6 +128874,8 @@ async function readBudget({ url, redisFn = makeRedisClient, timeoutMs = 2500, no
   try {
     parseConnection(url, { failFast: true });
     redis = redisFn(url);
+    redis.on?.("error", () => {
+    });
     const settled = Promise.all([redis.get(dayKey(now)), redis.get(weekKey(now)), redis.get(monthKey(now)), redis.get(tokenDayKey(now))]).then(
       ([day2, week, month, tokens]) => ({ day: Number(day2 ?? 0), week: Number(week ?? 0), month: Number(month ?? 0), tokensToday: Number(tokens ?? 0) }),
       (err) => ({ unreachable: err?.message ?? String(err) })
@@ -128854,11 +129053,13 @@ function readTriggers({ triggersPath, fs: fs9 = nodeFs11 }) {
   return { triggers: triggers2, count: entries.length, ...bundles !== null && { secretBundles: bundles }, ...loaderRefuses(text4, triggersPath) && { doesNotLoad: true } };
 }
 function loaderRefuses(text4, path6) {
+  return loaderTriggers(text4, path6) === null;
+}
+function loaderTriggers(text4, path6) {
   try {
-    parseTriggers(text4, path6);
-    return false;
+    return parseTriggers(text4, path6);
   } catch {
-    return true;
+    return null;
   }
 }
 function configLocationsOf({ paths = {}, deploymentDir = null, home = homedir3() } = {}) {
@@ -130598,6 +130799,21 @@ function createFleetReader(paths, {
     async sandboxEnd(request2) {
       return requestSandboxEndFn({ redis, ...request2, now: nowFn });
     },
+    /**
+     * Issue #845: the database this reader's held client was refused (`refusedDatabaseOf`: `{ db }`, or null when it holds
+     * no refusal). The queues are rebuilt and try again; the held client never does, so its reads stay refused until the
+     * process is restarted, and the console says that rather than only that Valkey could not be read. Reads no Valkey.
+     */
+    refusedDatabase() {
+      return refusedDatabaseOf(redis);
+    },
+    /**
+     * Issue #845, review of PR #878: whether this reader's held client last declined a VALKEY_PASSWORD the `.env` now
+     * gives, because the file does not name the Valkey it dials as it dials it (`passwordDeclinedOf`). Reads no Valkey.
+     */
+    passwordDeclined() {
+      return passwordDeclinedOf(redis);
+    },
     async dispose() {
       disposed = true;
       for (const q of sandboxQueues.values()) {
@@ -138104,7 +138320,10 @@ async function readConnections({ deploymentDir, env: env2 = {}, paths = {}, snap
     if (redis) return redis;
     if (owned) return owned;
     if (injectedRead && typeof paths.valkeyUrl !== "string") return null;
-    return owned = redisFn(paths.valkeyUrl);
+    owned = redisFn(paths.valkeyUrl);
+    owned.on?.("error", () => {
+    });
+    return owned;
   };
   const endpointFleetDeclared = endpointFleetDeclaration(file, environmentUnknown);
   let endpointStatus = { state: "unknown", hosts: [], more: 0, partial: true };
@@ -150359,9 +150578,15 @@ function buildSandboxRunArgs({ venue = DEFAULT_BACKEND, image, name: name2, work
       TMOUT: idleSeconds > 0 ? String(idleSeconds) : void 0,
       // Beside `--user` only (issue #341). Not a credential either.
       HOME: user !== null ? home : void 0,
+      // Issue #865: the size this shell is built at (`size`: the manifest's, the run's own or, for a prepared
+      // sandbox, its trigger's), by the job env's own function (`jobSizeEnv`), so a flow command copied in here
+      // (`jest --maxWorkers=$PI_JOB_SIZE_CPUS`) sizes its pool as a job of that size would instead of expanding to
+      // nothing. A run retained before this release never had the variables; its shell gets them for its recorded
+      // size all the same. Two integers, not a credential.
+      ...jobSizeEnv(size),
       // Still NO CREDENTIALS, and that clause is untouched: a proxy URL is not a credential, and
       // buildContainerEnv is still not reused here. The env is two variables about the terminal, HOME
-      // beside `--user`, and, when a policy is armed, four about the network.
+      // beside `--user`, two about the run's size and, when a policy is armed, four about the network.
       ...proxyEnv
     },
     // Ahead of the env and the mounts, and well ahead of the image, which the builder keeps as
@@ -153083,7 +153308,7 @@ function sizingLines(sizing, id7, iw, styler) {
   if (verdicts.length > 0) push(wrapColumns(verdicts.join("; "), sub2, styler), tone);
   if (typeof s2.call === "string") out.push(...callLines(cellOf(s2.call), iw, styler, indent.length));
   if (over) push(wrapColumns(`no live host admits it (${cellOf(s2.words?.refusal ?? "")}): a job of it would wait for a host that never comes`, sub2, styler), "error");
-  for (const fact of [s2.words?.memoryFact, s2.words?.cpuFact]) if (typeof fact === "string" && fact !== "") push(wrapColumns(cellOf(fact), sub2, styler), "dim");
+  for (const fact of [s2.words?.memoryFact, s2.words?.cpuFact, s2.words?.memoryCeiling]) if (typeof fact === "string" && fact !== "") push(wrapColumns(cellOf(fact), sub2, styler), "dim");
   return out;
 }
 function projectRows(snapshot, info = null) {
@@ -161477,362 +161702,6 @@ var init_models_view = __esm({
   }
 });
 
-// src/console/panels/sandboxes.mjs
-function state2(v) {
-  const s2 = report(v)?.request;
-  if (!s2) return null;
-  const success = s2.state === "ready";
-  return banner({ status: success ? "ok" : ["refused", "failed"].includes(s2.state) ? "attention" : "running", title: success ? `Sandbox ${s2.result?.id ?? s2.id} is ready` : `Sandbox request ${s2.state}`, body: html`<span class="code">${s2.id}</span> on ${s2.host ?? "its host"}. ${s2.message ?? s2.reason ?? (success ? "No container has started. Open it from your terminal." : "Reload to read the worker's result.")}`, actions: success && s2.result ? links(v, { ...s2.result, id: s2.result.id, host: s2.result.host ?? s2.host }, "open", true) : btn({ href: `/runs/sandboxes?${new URLSearchParams({ request: s2.id, host: s2.host ?? selected3(v).host ?? "" })}`, label: "Refresh request" }) });
-}
-function sandboxFromRun(v) {
-  if (!allowed3(v) || v.query?.gatewaySelect) return null;
-  const all = rows(v);
-  const id7 = v.query?.id;
-  const picked = all.find((r2) => rowId2(r2) === id7 && (!v.query?.host || r2.host === v.query.host));
-  const pickerHost = v.query?.host ?? selected3(v).host ?? all[0]?.host ?? "";
-  const picker = html`<form method="get" action="/runs/sandboxes" data-live-hold class="sx-picker">${field2({ label: "Workspace host", id: "sb-workspace-host", control: select({ id: "sb-workspace-host", name: "host", value: pickerHost, options: [{ value: "", label: "Choose a host" }, ...(report(v)?.hosts ?? []).map((h2) => ({ value: h2.name, label: h2.name }))] }) })}${field2({ label: "Kept workspace", id: "sb-workspace", control: select({ id: "sb-workspace", name: "id", value: id7 ?? "", options: [{ value: "", label: "Choose a workspace" }, ...all.filter((r2) => !pickerHost || r2.host === pickerHost).map((r2) => ({ value: rowId2(r2), label: `${rowId2(r2)} on ${r2.host}${r2.prepared ? " (prepared)" : ""}` }))] }) })}${btn({ type: "submit", label: "Show workspace" })}</form>`;
-  if (!report(v)) return card3("From a run", html`<p role="status">${SANDBOX_WORDS.unavailable}</p>`);
-  if (!picked) return card3("From a run", html`${state2(v)}${v.data?.sandboxHostsProblem ? html`<p role="status">${v.data.sandboxHostsProblem}</p>` : null}${picker}<p class="card__sub">${all.length ? "Choose a kept workspace, or open Sandboxes from a run page." : SANDBOX_WORDS.empty}</p>`, "the image, workspace and isolation the run kept");
-  const workspace = picked.kind === "local" ? "Its original host folder" : isForgeKind(picked.kind) ? "Its retained clone" : "The workspace recorded in its kept manifest";
-  const piVersion = hostPiFor(hostLoadsRow(v.data?.hostLoads, picked.host), picked.image);
-  const loads = picked.prepared ? sandboxPreparedLine(piVersion) : sandboxRunLine(v.data?.sandboxRun ?? null, rowId2(picked), { pi: piVersion, unread: v.data?.sandboxRunUnread === true });
-  const what2 = facts([["Image", picked.image ?? "As recorded in its kept manifest"], ["/workspace", workspace], ["/job", "Read only, with the retained job inputs"], ["pi and what it loads", wordsHtml(loads)], ["Processes", "None until you start them"], ["Credentials", "None, on purpose"], ["Network", "The host's current job egress policy"]], { cols: 1 });
-  return card3("From a run", html`${state2(v)}${v.data?.sandboxHostsProblem ? html`<p role="status">${v.data.sandboxHostsProblem}</p>` : null}${picker}<div class="sx-run">${tile("ok", { icon: "box" })}<div><p class="sx-run__t"><span class="code">${rowId2(picked)}</span>${picked.project ? ptag(picked.project) : null}${picked.prepared ? chip("Without a run") : null}</p><p class="sx-run__s">${picked.host} ${vtag(picked.v ?? picked.backend)}. ${retention(picked, v.now)}</p></div></div><h3 class="sx-h3">What opens</h3>${what2}<p class="sx-small">${icon("info", { size: "sm" })}<span>${LOADED_WORDS.sandboxFoot}</span></p><h3 class="sx-h3">How it opens</h3>${canOpen(picked) ? html`<div class="sx-ch sx-ch--on"><div class="sx-ch__h">${icon("terminal", { size: "sm" })}<b>In your terminal</b><span class="sx-rec sandbox-opener">recommended</span></div><p class="sx-ch__s">Your terminal opens with the command typed in and waits for Enter. The link holds no secret. On a phone, copy the command.</p>${links(v, picked)}</div><div class="sx-foot"><p>${icon("info", { size: "sm" })}<span>The shell uses a job's isolation and network. A published host port is refused while egress is on. Pinning uses this host's configured pin window.</span></p>${pinForm(v, picked)}</div>` : html`<p>This venue has no sandbox shell. Its workspace cannot be reopened here.</p>`}`, "the same image, workspace and isolation as the run");
-}
-function sandboxNew(v) {
-  if (!allowed3(v) || v.query?.gatewaySelect) return null;
-  const s2 = selected3(v), data5 = report(v), options = data5?.options ?? [];
-  const repositories = [...new Set(options.map((o) => o.repo).filter(Boolean))];
-  const triggers2 = options;
-  const hostOptions = (data5?.hosts ?? []).filter((h2) => !h2.unreadable && !h2.stale && h2.settings && (!data5?.eligibleHosts || data5.eligibleHosts.includes(h2.name))).map((h2) => ({ value: h2.name, label: `${h2.name}, ${h2.settings.defaultBackend ?? "venue not published"}` }));
-  const fields3 = [
-    field2({ label: "Repository", id: "sb-repo", control: input({ id: "sb-repo", name: "repo", value: s2.repo ?? "", placeholder: "owner/repository", required: true, autocomplete: "off", spellcheck: false }) }),
-    field2({ label: "As the jobs of", id: "sb-trigger", control: select({ id: "sb-trigger", name: "index", value: s2.index === void 0 ? "" : String(s2.index), options: [{ value: "", label: "Choose a trigger" }, ...triggers2.map((o) => ({ value: String(o.index), label: o.label }))] }), hint: "Its image, size and egress are shown below, rather than chosen here." }),
-    field2({ label: "Start from", id: "sb-ref", control: input({ id: "sb-ref", name: "ref", value: s2.ref ?? "HEAD", code: true, required: true, autocomplete: "off", spellcheck: false }), hint: "HEAD means the default branch. Enter a branch, tag, full commit SHA, or pr:42 for a pull request." }),
-    field2({ label: "Host", id: "sb-host", control: select({ id: "sb-host", name: "host", value: s2.host ?? "", options: [{ value: "", label: "Choose a host" }, ...hostOptions] }), hint: "The worker checks the trigger and its own policy again before cloning." }),
-    field2({ label: "Keep it", id: "sb-pin", control: select({ id: "sb-pin", name: "pin", value: s2.pin ? "1" : "0", options: [{ value: "0", label: "Host's retention window" }, { value: "1", label: "Host's pin window" }] }) })
-  ];
-  const plan = data5?.plan;
-  const source2 = data5?.fromRun ? html`<p class="sx-p">Preparing from <a class="link" href="${`/run?${new URLSearchParams({ id: data5.fromRun })}`}">${data5.fromRun}</a>. The ref starts at HEAD because the record holds no created pull request. ${data5.sourceRun?.historicalIndex !== null && data5.sourceRun?.historicalIndex !== void 0 ? `Its historical trigger row was ${data5.sourceRun.historicalIndex + 1}; that does not prove the current row's identity.` : "Its original trigger identity is unavailable."} Choose the current trigger explicitly.${String(data5.sourceRun?.backend).startsWith("openshell") ? " Its original OpenShell venue cannot prepare a sandbox; deliberately choose a compatible local or podman trigger." : ""}</p>` : null;
-  const form = html`${source2}<form method="get" action="/runs/sandboxes" data-live-hold>${data5?.fromRun ? html`<input type="hidden" name="fromRun" value="${data5.fromRun}">` : null}<div class="sx-form">${fields3}</div><div class="sx-form-end">${btn({ type: "submit", label: "Review settings" })}</div></form>`;
-  const fresh = plan ? html`${facts([[`On ${plan.host}`, wordsHtml(sandboxFreshLine({ hostLoads: v.data?.hostLoads, host: plan.host, triggerIndex: s2.index, withholdsPackages: data5?.withholdsPackages === true, excludes: data5?.excludes ?? [], image: plan.image }))]], { cols: 1 })}<p class="sx-small">${icon("info", { size: "sm" })}<span>${LOADED_WORDS.freshFoot}</span></p>` : null;
-  const preparation = plan ? html`<h3 class="sx-h3">Given by the trigger, not chosen here</h3>${facts5(plan)}${fresh}<p class="sx-p">${plan.pin ? `Pinned for ${plan.pinDays} days` : `Kept for ${plan.retentionHours} hours`}, on ${plan.host}. The worker clones on that host with a credential for this repository, then drops it. No container starts, no model runs, no dollars are spent and no run slot is taken.</p>${acts2(v) ? actForm({ action: "sandbox-prepare", hidden: [["repo", s2.repo], ["index", s2.index, "int"], ["ref", s2.ref], ["host", s2.host], ["pin", Boolean(s2.pin), "json"]], label: "Preview preparation", kind: ["primary"], icon: "plus" }) : html`<p class="card__sub">This console is read-only. Prepare from the host's terminal.</p>`}${cmd(["pi-dispatch", "sandbox", "--new", s2.repo, "--ref", s2.ref, "--as", String(s2.index), ...s2.pin ? ["--pin"] : []])}<p class="card__sub">The CLI’s --as takes a zero-based file index: trigger row ${s2.index + 1} is index ${s2.index}.</p>` : html`<p class="sx-p" role="status">${data5?.refusal ?? "Choose a repository, its trigger, a ref and a host, then review their settings."}</p>`;
-  return card3("Without a run", html`${form}${preparation}<noscript><p class="card__sub">${SANDBOX_WORDS.noScript}</p></noscript>`, "a fresh clone with a trigger's image and a job's isolation");
-}
-function sandboxOpen(v) {
-  if (!allowed3(v)) return null;
-  const data5 = report(v), sessions = (data5?.sessions ?? []).filter((s2) => !v.query?.gatewaySelect || s2.host === v.query.host);
-  const incomplete = !data5 || data5.sessionsUnavailable || data5.sessionsMore > 0 || data5.sessionsUnreadable > 0;
-  const notices = (data5?.notices ?? []).filter((n3) => !v.query?.gatewaySelect || n3.host === v.query.host).map((n3) => html`<p class="sx-p" role="status">${icon("attention", { size: "sm" })} ${n3.host}, ${n3.id}: ${{ "network-kept": "The sandbox network was kept because cleanup could not be confirmed. Inspect this host\u2019s runtime and network before removing either.", "network-cleanup-failed": "Sandbox network cleanup failed. Inspect this host\u2019s runtime and egress network before retrying cleanup.", "runtime-unreadable": "The runtime could not be read. An expired shell registration does not prove the container stopped. Inspect this host before reopening or cleaning it." }[n3.reason] ?? "Sandbox cleanup needs inspection on this host."} <a class="link" href="${`/fleet/host?${new URLSearchParams({ name: n3.host })}`}">Inspect host</a>.</p>`);
-  if (v.query?.gatewaySelect && !v.data?.browserGateways?.enabledHosts?.includes(v.query.host)) return card3("Open now", html`<p role="status">The browser gateway is not enabled for ${v.query.host}, so there is no shell to choose here. <a class="link" href="/runs/sandboxes">Return to Sandboxes</a>.</p>`);
-  return card3("Open now", html`${v.query?.gatewaySelect ? html`<p class="sx-p">Choose an already-open shell on ${v.query.host}. Each browser opening needs your current operator token. <a class="link" href="/runs/sandboxes">Return to Sandboxes</a>.</p>` : null}${notices}${data5?.noticesUnavailable ? html`<p role="status">Some sandbox cleanup notices could not be read. Inspect the host if a terminal ended unexpectedly.</p>` : null}${data5?.sessionsMore > 0 || data5?.sessionsUnreadable > 0 ? html`<p role="status">The registered shell list is incomplete: at least ${data5.sessionsMore ?? 0} more and ${data5.sessionsUnreadable ?? 0} unreadable registrations.</p>` : null}${data5?.sessionsUnavailable ? html`<p role="status">Open shells could not be read. Reload to try again.</p>` : sessions.length ? html`<ul class="sx-opens">${sessions.map((s2) => html`<li class="sx-open"><span class="dot tone-running"></span><div class="sx-open__b"><p class="sx-open__t"><span class="code">${s2.id}</span>${vtag(s2.venue)}</p><p class="sx-open__s">${s2.host}, opened by ${s2.by ?? "the terminal operator"}. Open since ${stamp(s2.since)}.</p>${sandboxDriverLine(v, s2)}<div class="sx-open__a">${links(v, s2, "attach", true)}${sandboxBrowserLink(v, s2)}${acts2(v) && !v.query?.gatewaySelect ? actForm({ action: "sandbox-end", hidden: [["host", s2.host], ["id", s2.id], ["nonce", s2.nonce], ["containerId", s2.containerId]], label: "Preview End", kind: ["sm", "danger"], icon: "cancel" }) : null}</div></div></li>`)}</ul>` : html`<p>${data5?.sessionsMore > 0 || data5?.sessionsUnreadable > 0 ? "No readable shell is in this bounded view. The incomplete registrations above prevent an exact empty count." : SANDBOX_WORDS.noShells}</p>`}<p class="sx-small">${icon("info", { size: "sm" })}<span>One shell per workspace at a time. End asks the terminal that opened it to close the shell and keeps the workspace. What you type is not recorded.</span></p>`, null, badge(incomplete ? "attention" : "running", `${sessions.length} ${incomplete ? "shown" : "open"}`));
-}
-function sandboxKept(v) {
-  if (!allowed3(v) || v.query?.gatewaySelect) return null;
-  const data5 = report(v), all = rows(v);
-  return card3("Kept workspaces", html`${data5?.more > 0 ? html`<p role="status">At least ${data5.more} more hosts have inventory beyond this bounded view. Inspect the fleet before treating this list as complete.</p>` : null}${!data5 ? html`<p role="status">${SANDBOX_WORDS.unavailable}</p>` : html`${(data5.hosts ?? []).filter((h2) => h2.stale || h2.unreadable).map((h2) => html`<p class="sx-p" role="status">${h2.name}: ${h2.unreadable ? "publication unreadable" : "publication stale; inspect this host before opening"}. Its list is incomplete.</p>`)}${all.length ? html`<ul class="sx-kepts">${all.map((r2) => html`<li class="sx-kept${canOpen(r2) ? "" : " sx-kept--no"}"><p class="sx-kept__t"><a class="code" href="${`/runs/sandboxes?${new URLSearchParams({ id: rowId2(r2), host: r2.host })}`}">${rowId2(r2)}</a>${r2.project ? ptag(r2.project) : null}${r2.prepared ? chip("Without a run") : null}</p><p class="sx-kept__s">${r2.host} ${vtag(r2.v ?? r2.backend)}. ${retention(r2, v.now)}${!canOpen(r2) ? ". This venue has no sandbox shell." : null}</p>${canOpen(r2) ? html`<div class="sx-kept__actions">${links(v, r2, "open", true)}${pinForm(v, r2)}</div>` : null}</li>`)}</ul>` : html`<p>${SANDBOX_WORDS.empty}</p>`}${(data5.hosts ?? []).filter((h2) => h2.more > 0).map((h2) => html`<p class="sx-p">${h2.name} has at least ${h2.more} more retained workspaces. Inspect its full list with pi-dispatch sandbox --list.</p>`)}`}`, "what each host still keeps");
-}
-function sandboxBrowser(v) {
-  if (!allowed3(v) || v.query?.gatewaySelect) return null;
-  const gateway = v.data?.browserGateways;
-  const count7 = gateway?.enabledHosts?.length ?? 0;
-  return card3("In this browser", html`<p class="sx-p">${SANDBOX_WORDS.browser}</p>${gateway?.problem ? html`<p class="sx-p" role="status">${gateway.problem}</p>` : html`<p class="sx-p">${count7 ? `${count7} ${count7 === 1 ? "host is" : "hosts are"} enrolled.` : "No host is enrolled in this console. Ask the host operator to configure the optional gateway."}${count7 ? html`<span class="sandbox-opener"> Choose Open in browser beside a registered shell in Open now.</span>` : null}</p>`}<p class="sx-p">Each opening needs your current operator token again. Only one browser window attaches at a time. Closing it keeps the original sandbox; what you type is not recorded.</p><p class="sx-p">First open a kept or prepared workspace in your own terminal. The browser never starts a container.</p><p class="sx-p">Browser terminals require a window wider than 760 pixels. On a phone, copy the command for your own terminal.</p>${v.readOnly ? html`<p class="sx-p">This console is read-only, so browser attachment is unavailable.</p>` : null}`, "optional, separate gateway", chip(count7 ? "Enabled per host" : "Off by default", { status: count7 ? "ok" : "idle", icon: "shield" }));
-}
-var SANDBOX_WORDS, report, allowed3, acts2, rows, card3, stamp, rowId2, canOpen, selected3, facts5, links, retention, pinForm, SANDBOX_PANELS;
-var init_sandboxes = __esm({
-  "src/console/panels/sandboxes.mjs"() {
-    init_html();
-    init_kit();
-    init_forges();
-    init_sandbox_links();
-    init_common();
-    init_loaded_words();
-    init_loaded_parts();
-    SANDBOX_WORDS = Object.freeze({
-      unavailable: "Sandbox information could not be read. Reload to try again; an unread host is not an empty host.",
-      empty: "No kept workspace was published. A worker publishes its retained workspaces while it is running.",
-      noShells: "No live sandbox shell was registered. A shell whose terminal stopped answering disappears when its short lease expires. An expired registration is not proof the container stopped; inspect its host if the terminal ended unexpectedly.",
-      browser: "A separate gateway can attach to an already-open sandbox. It is off by default and enabled by hand per host. Open in Terminal and copy-command support remain available.",
-      noScript: "Preparing, pinning, ending a shell and saving terminal targets require JavaScript for Preview and Confirm. Commands remain selectable and the settings form works without JavaScript."
-    });
-    report = (v) => v.data?.sandboxes;
-    allowed3 = (v) => v.role === "operator";
-    acts2 = (v) => allowed3(v) && !v.readOnly;
-    rows = (v) => (report(v)?.hosts ?? []).flatMap((h2) => (h2.rows ?? []).map((r2) => ({ ...r2, host: h2.name, hostStale: h2.stale, retentionHours: h2.retentionHours })));
-    card3 = (title2, body, sub2 = null, end = null) => card({ title: title2, sub: sub2, body, end });
-    stamp = (ms3) => Number.isFinite(ms3) ? timeHtml(ms3) : "not published";
-    rowId2 = (r2) => r2.id ?? r2.jobId;
-    canOpen = (r2) => !String(rowId2(r2)).startsWith("sha256:") && r2.canOpen !== false && ["local", "podman"].includes(r2.v ?? r2.backend);
-    selected3 = (v) => report(v)?.selected ?? {};
-    facts5 = (plan) => facts([
-      ["Image", plan.image ?? "not published"],
-      ["Size", plan.size ? `${plan.size.memMiB} MiB, ${plan.size.cpuCenti / 100} CPU` : "not published"],
-      ["Network", plan.egress?.armed ? "The host's job allowlist through its egress proxy" : "Open bridge, egress policy off"],
-      ["Credentials", "None in the shell"]
-    ]);
-    links = (v, r2, verb = "open", compact2 = false) => sandboxLinks({ id: rowId2(r2), host: r2.host, verb, compact: compact2, config: v.data?.sandboxHosts });
-    retention = (r2, now) => html`${r2.pin ? "Pinned" : "Kept"}${Number.isFinite(r2.until) ? html` until ${stamp(r2.until)}${r2.until <= now ? " (past its window; pin before opening)" : html`, ${ageText(r2.until - now)} left`}` : ": deadline not published"}`;
-    pinForm = (v, r2) => acts2(v) && canOpen(r2) ? actForm({ action: "sandbox-pin", hidden: [["host", r2.host], ["id", rowId2(r2)]], label: "Preview pin", icon: "clock" }) : null;
-    SANDBOX_PANELS = Object.freeze([["p-sb-run", sandboxFromRun], ["p-sb-new", sandboxNew], ["p-sb-open", sandboxOpen], ["p-sb-kept", sandboxKept], ["p-sb-browser", sandboxBrowser]]);
-  }
-});
-
-// src/zero-touch-view.mjs
-function breakdown(row2, repository = false) {
-  const out = { project: text3(row2?.project ?? row2?.id, 64), scopeId: scope(row2?.scopeId), name: text3(row2?.name ?? row2?.target ?? row2?.project ?? row2?.id) ?? "Unassigned", target: text3(row2?.target), runs: count5(row2?.runs), touched: count5(row2?.touched), rate: number3(row2?.rate), deltaPoints: Number.isFinite(row2?.deltaPoints) ? row2.deltaPoints : null, previousRate: number3(row2?.previousRate), streakDays: row2?.waitingPartial === true ? null : number3(row2?.streakDays), zeroTouch: row2?.zeroTouch === true && row2?.waitingPartial !== true, waitingNow: row2?.waitingPartial === true ? null : count5(row2?.waitingNow ?? row2?.waiting), waitingPartial: row2?.waitingPartial === true, topCause: CAUSES.includes(row2?.topCause) ? row2.topCause : null, causes: causes(row2?.causes), touchedRunIds: runIds(row2?.touchedRunIds) };
-  if (!repository) out.repositories = Array.isArray(row2?.repositories) ? row2.repositories.map((r2) => breakdown(r2, true)) : [];
-  return out;
-}
-function zeroTouchView(raw, { role = "viewer", windowDays = 30, nowMs: nowMs2 = 0 } = {}) {
-  const observed = raw?.coverage ?? raw?.window;
-  const unobserved2 = Array.isArray(observed?.reasons) && observed.reasons.includes("touch-index-unavailable") || observed?.partial === true && number3(observed.fromMs) !== null && observed.fromMs >= (number3(raw?.nowMs) ?? nowMs2);
-  if (!raw || typeof raw !== "object" || raw.state === "unavailable" || unobserved2) return { state: "unavailable", nowMs: nowMs2, windowDays, coverage: { partial: true, reasons: [] }, totals: {}, projects: [], causes: causes([]), trend: [], groups: [], fixes: [], fixesPartial: true, touchedRunIds: [], waitingRuns: [], ungroupedRunIds: [], grouping: { enabled: false, pending: 0, unassigned: 0, state: "disabled", sources: [] } };
-  const totals = raw.totals ?? raw.summary ?? {};
-  const coverage2 = raw.coverage ?? raw.window ?? {};
-  const out = {
-    state: "ready",
-    nowMs: number3(raw.nowMs) ?? nowMs2,
-    windowDays: [7, 30, 90].includes(raw.windowDays ?? raw.days) ? raw.windowDays ?? raw.days : windowDays,
-    coverage: { requestedFromMs: number3(coverage2.requestedFromMs), fromMs: number3(coverage2.fromMs), partial: coverage2.partial === true || coverage2.complete === false, reasons: Array.isArray(coverage2.reasons) ? coverage2.reasons.map((v) => text3(v)).filter(Boolean) : [] },
-    totals: { runs: count5(totals.runs), touched: count5(totals.touched), rate: number3(totals.rate), previousRate: number3(totals.previousRate), stopped: count5(totals.stopped), stoppedUnattributed: count5(totals.stoppedUnattributed), waitingHours: totals.waitingPartial === true ? null : number3(totals.waitingHours), waitingPartial: totals.waitingPartial === true, waitingUnknown: count5(totals.waitingUnknown), medianWaitMs: totals.waitingPartial === true ? null : number3(totals.medianWaitMs) ?? (number3(totals.medianWaitHours) === null ? null : totals.medianWaitHours * 36e5), pending: totals.waitingPartial === true ? null : count5(totals.pending ?? totals.waitingNow), draftAnswers: count5(totals.draftAnswers), deltaPoints: Number.isFinite(totals.deltaPoints) ? totals.deltaPoints : null },
-    projects: Array.isArray(raw.projects) ? raw.projects.map((r2) => breakdown(r2)) : [],
-    causes: causes(raw.causes),
-    trend: Array.isArray(raw.trend) ? raw.trend.slice(-8).map((r2) => ({ atMs: number3(r2?.atMs ?? r2?.at), rate: number3(r2?.rate), runs: count5(r2?.runs), touched: count5(r2?.touched), partial: r2?.partial === true })) : [],
-    waitingRuns: Array.isArray(raw.waitingRuns ?? totals.waitingNow) ? (raw.waitingRuns ?? totals.waitingNow).map((r2) => ({ runId: id5(r2?.runId ?? r2?.jobId), parkedAt: number3(r2?.parkedAt) })).filter((r2) => r2.runId && r2.parkedAt !== null) : [],
-    touchedRunIds: runIds(raw.touchedRunIds),
-    ungroupedRunIds: role === "operator" ? runIds(raw.ungroupedRunIds) : [],
-    groups: [],
-    fixes: [],
-    fixesPartial: raw.fixesPartial === true,
-    grouping: { enabled: raw.grouping?.enabled === true, partial: raw.grouping?.partial === true, pending: count5(raw.grouping?.pending), unassigned: count5(raw.grouping?.unassigned), state: ["ready", "ok", "disabled", "pending", "partial", "failed", "configuration-unavailable", "unavailable"].includes(raw.grouping?.state) ? raw.grouping.state : "disabled", sources: role === "operator" && Array.isArray(raw.grouping?.sources ?? raw.groupingStatuses) ? (raw.grouping?.sources ?? raw.groupingStatuses).map((r2) => ({ runId: id5(r2?.runId), status: ["unassigned", "pending", "assigned", "source-expired", "source-unavailable", "source-oversize", "candidates-expired", "group-limit", "stale", "refused", "failed"].includes(r2?.status) ? r2.status : "source-unavailable" })).filter((r2) => r2.runId) : [] }
-  };
-  out.fixes = Array.isArray(raw.fixes) ? raw.fixes.map((f3) => ({ id: id5(f3?.id), at: number3(f3?.at), undoneAt: number3(f3?.undoneAt), kind: ["instructions", "config"].includes(f3?.kind) ? f3.kind : "config", groupId: id5(f3?.groupId), reason: typeof f3?.reason === "string" && /^[a-z][a-z0-9-]{0,79}$/.test(f3.reason) ? f3.reason : null, triggerIndex: Number.isSafeInteger(f3?.triggerIndex) && f3.triggerIndex >= 0 ? f3.triggerIndex : null, beforeCount: number3(f3?.beforeCount), afterCount: number3(f3?.afterCount), spanMs: number3(f3?.spanMs), partial: f3?.partial !== false, subsequentRuns: count5(f3?.subsequentRuns), status: ["observing", "improved", "unchanged", "worse"].includes(f3?.status) ? f3.status : "observing" })).filter((f3) => f3.id) : [];
-  if (role === "operator") out.groups = Array.isArray(raw.groups) ? raw.groups.map((g) => ({ id: id5(g?.id), name: text3(g?.name, 120), scopeId: scope(g?.scopeId), repo: text3(g?.repo), project: text3(g?.project, 64), count: count5(g?.count), runIds: runIds(g?.runIds), status: ["open", "fixed", "unassigned"].includes(g?.status) ? g.status : "open", fixedAt: number3(g?.fixedAt), triggerIndex: Number.isSafeInteger(g?.triggerIndex) && g.triggerIndex >= 0 ? g.triggerIndex : null })).filter((g) => g.id) : [];
-  return out;
-}
-var CAUSES, id5, number3, count5, text3, scope, causes, runIds;
-var init_zero_touch_view = __esm({
-  "src/zero-touch-view.mjs"() {
-    CAUSES = Object.freeze(["question-answer", "approval-decision", "rerun", "config-fix", "steer", "cancel"]);
-    id5 = (v) => typeof v === "string" && /^[A-Za-z0-9._:-]{1,200}$/.test(v) ? v : null;
-    number3 = (v) => Number.isFinite(v) && v >= 0 ? v : null;
-    count5 = (v) => Number.isSafeInteger(v) && v >= 0 ? v : 0;
-    text3 = (v, max = 200) => typeof v === "string" && [...v].length <= max && !/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/.test(v) ? v : null;
-    scope = (v) => typeof v === "string" && /^[a-f0-9]{32,64}$/.test(v) ? v : null;
-    causes = (v) => CAUSES.map((cause) => ({ cause, count: count5(Array.isArray(v) ? v.find((row2) => row2?.cause === cause)?.count : v?.[cause]) }));
-    runIds = (v) => Array.isArray(v) ? [...new Set(v.map(id5).filter(Boolean))].slice(0, 5e3) : [];
-  }
-});
-
-// src/console/panels/zero-touch.mjs
-function delta(n3, previousRate = null) {
-  if (!Number.isFinite(n3)) return html`<span class="zt-tr">Previous interval not covered</span>`;
-  return html`<span class="${`zt-tr${n3 < 0 ? " tone-ok" : n3 > 0 ? " tone-attention" : ""}`}">${icon(n3 < 0 ? "chev" : n3 > 0 ? "chev-r" : "info", { size: "sm" })}<b>${n3 === 0 ? "no change" : `${n3 < 0 ? "down" : "up"} ${amount3(Math.abs(n3))} points`}</b>${previousRate === null ? null : html`<small>from ${pct2(previousRate)}</small>`}</span>`;
-}
-function coverage(m2) {
-  return html`<p class="zt-coverage" role="status">${m2.coverage.partial ? html`<b>Partial ${m2.windowDays}-day window.</b> Covered from ${date(m2.coverage.fromMs)} UTC. Older unknown runs are not counted as untouched.` : html`Whole ${m2.windowDays}-day window.`}${m2.coverage.reasons.length ? html` ${m2.coverage.reasons.join("; ")}.` : null}</p>`;
-}
-function spark(m2) {
-  const rows3 = m2.trend;
-  if (!rows3.some((r2) => Number.isFinite(r2.rate) && !r2.partial)) return html`<p class="zt-kps">Weekly trend is not covered yet.</p>`;
-  const top = Math.max(32, ...rows3.map((r2) => r2.rate ?? 0));
-  const x2 = (i2) => rows3.length === 1 ? 200 : i2 * 200 / (rows3.length - 1);
-  const y = (n3) => 56 - n3 / top * 56;
-  const segments = [];
-  let points = [];
-  for (const [i2, row2] of rows3.entries()) {
-    if (row2.rate === null || row2.partial) {
-      if (points.length) segments.push(points);
-      points = [];
-    } else points.push(`${svgNum(x2(i2), 0, 200)},${svgNum(y(row2.rate), 0, 56)}`);
-  }
-  if (points.length) segments.push(points);
-  const last = rows3[rows3.length - 1];
-  const label3 = `Rolling ${m2.windowDays}-day touch rate at weekly intervals: ${rows3.map((r2) => r2.partial || r2.rate === null ? "not covered" : pct2(r2.rate)).join(", ")}. Goal under 5 percent.`;
-  return html`<svg class="zt-spark" viewBox="-4 -4 208 64" preserveAspectRatio="none" role="img" aria-label="${label3}"><line class="zt-spark__goal" x1="0" x2="200" y1="${svgNum(y(5), 0, 56)}" y2="${svgNum(y(5), 0, 56)}"/>${segments.map((p) => html`<polyline class="zt-spark__l" points="${p.join(" ")}"/>`)}${last?.rate !== null && !last?.partial ? html`<circle class="zt-spark__d" cx="200" cy="${svgNum(y(last.rate), 0, 56)}" r="3.5"/>` : null}</svg><p class="zt-spark__ax"><span>${date(rows3[0]?.atMs)}</span><span>goal, dashed</span><span>now</span></p><p class="sr">${label3}</p>`;
-}
-function longest(m2) {
-  return [...m2.projects].filter((p) => p.streakDays !== null && !p.waitingNow).sort((a, b) => b.streakDays - a.streakDays)[0] ?? null;
-}
-function waitingHistory(m2) {
-  return m2.totals.waitingPartial ? html`<p class="zt-note" role="status">Waiting history is incomplete. An older park predates retained answer history; its current state and wait time are not known.</p>` : null;
-}
-function compact(m2) {
-  const best = longest(m2);
-  return html`<ul class="ztp-now"><li><span>${icon("flag", { size: "sm" })}Longest streak</span><b>${best ? `${best.name}, ${amount3(best.streakDays)} ${best.streakDays === 1 ? "day" : "days"}` : "Not enough history"}</b></li><li><span>${icon("clock", { size: "sm" })}Waited on a person</span><b>${m2.totals.waitingPartial ? "Not known" : `${amount3(m2.totals.waitingHours)}h, median ${span(m2.totals.medianWaitMs)}`}</b></li><li><span>${icon("edit", { size: "sm" })}Answered from a draft</span><b>${m2.totals.draftAnswers} ${m2.totals.draftAnswers === 1 ? "run" : "runs"}</b><span>${ZERO_TOUCH_WORDS.drafts}${m2.coverage.partial ? html` ${ZERO_TOUCH_WORDS.draftsPartial}` : null}</span></li><li><span>${icon("parked", { size: "sm" })}Waiting now</span><b>${m2.totals.waitingPartial ? "Not known" : `${m2.totals.pending} ${m2.totals.pending === 1 ? "run" : "runs"}`}</b>${m2.waitingRuns.slice(0, 3).map((r2) => html`<span>${link(r2.runId)}, ${span(m2.nowMs - r2.parkedAt)}</span>`)}</li></ul>${waitingHistory(m2)}`;
-}
-function zeroTouchRate(view) {
-  const m2 = model5(view);
-  return card({ title: `Touch rate, ${m2.windowDays} days`, body: html`${fail5(m2)}${m2.state === "ready" ? html`${kpi(m2.totals.runs ? pct2(m2.totals.rate) : "No runs", `${m2.totals.touched} of ${m2.totals.runs} runs needed a person`)}${spark(m2)}<p class="zt-kp"><span class="zt-kt">${icon("flag", { size: "sm" })}goal under 5%</span>${delta(m2.totals.deltaPoints, m2.totals.previousRate)}</p>${coverage(m2)}<p class="zt-kps">${m2.totals.stopped} stopped before they ran, outside the rate.${m2.totals.stoppedUnattributed > 0 ? html` ${m2.totals.stoppedUnattributed} stops have no recorded project or scope, so this selection may have more.` : null}</p><div class="zt-phone-summary">${compact(m2)}</div>` : null}` });
-}
-function zeroTouchStreak(view) {
-  const m2 = model5(view), best = longest(m2);
-  return card({ title: "Zero-touch streak", body: html`${fail5(m2)}${kpi(best ? `${amount3(best.streakDays)} ${best.streakDays === 1 ? "day" : "days"}` : "Not enough history", best ? `${best.name}, the longest now` : "30 days of observed activity establish a zero-touch project")}<p class="zt-kp">${m2.projects.filter((p) => p !== best).sort((a, b) => (b.streakDays ?? -1) - (a.streakDays ?? -1)).map((p) => p.waitingNow ? chip(`${p.name} waiting now`, { status: "parked", icon: "parked" }) : html`<span class="zt-kt">${p.name} ${p.streakDays === null ? "not known" : `${amount3(p.streakDays)} ${p.streakDays === 1 ? "day" : "days"}`}</span>`)}</p>` });
-}
-function zeroTouchWait(view) {
-  const m2 = model5(view);
-  if (m2.state !== "ready") return card({ title: "Waiting for a person", body: fail5(m2) });
-  return card({ title: "Waiting for a person", body: html`${fail5(m2)}${kpi(m2.totals.waitingPartial ? "Not known" : `${amount3(m2.totals.waitingHours)}h`, `runs waited on a person in ${m2.windowDays} days`)}<p class="zt-kps">Median wait for an answer <b>${span(m2.totals.medianWaitMs)}</b></p>${waitingHistory(m2)}<p class="zt-kp">${chip(m2.totals.waitingPartial ? "Pending count not known" : `${m2.totals.pending} waiting now`, { status: "parked", icon: "parked" })}${m2.waitingRuns.slice(0, 3).map((r2) => html`<span>${link(r2.runId)}, ${span(m2.nowMs - r2.parkedAt)}</span>`)}</p>` });
-}
-function zeroTouchHandled(view) {
-  const m2 = model5(view);
-  return card({ title: "Answered from a draft", body: m2.state !== "ready" ? fail5(m2) : html`${kpi(m2.totals.draftAnswers, "runs answered in the covered interval")}<p class="zt-kps">${ZERO_TOUCH_WORDS.drafts}</p>${m2.coverage.partial ? html`<p class="zt-kps" role="status">${ZERO_TOUCH_WORDS.draftsPartial}</p>` : null}` });
-}
-function meter3(row2) {
-  if (row2.rate === null) return html`<span class="zt-m">Not enough history</span>`;
-  const tone = row2.rate < 5 ? "ok" : row2.rate < 30 ? "attention" : "failed";
-  const word3 = row2.rate < 5 ? "Under goal" : row2.rate < 30 ? "Above goal" : "High";
-  return html`<span class="zt-m"><svg class="${`pbar tone-${tone}`}" height="10" role="meter" aria-valuenow="${svgNum(row2.rate, 0, 100)}" aria-valuemin="0" aria-valuemax="100" aria-label="${`${row2.name}: ${pct2(row2.rate)} of runs needed a person, goal under 5 percent; meter scale 40 percent`}"><rect class="pbar__bed" width="100%" height="10" rx="5"/><rect class="pbar__fill" width="${`${svgNum(row2.rate / 40 * 100, 0, 100)}%`}" height="10" rx="5"/><line class="zt-goal" x1="12.5%" x2="12.5%" y1="-4" y2="14"/></svg><span class="zt-mv"><b>${pct2(row2.rate)}</b><span class="${`zt-lv tone-${tone}`}">${icon(tone === "ok" ? "done" : "attention", { size: "sm" })}${word3}</span></span></span>`;
-}
-function rowContent(row2, sub2 = false) {
-  const c = causesByKey.get(row2.topCause);
-  return html`<span class="zt-chev">${sub2 ? null : icon("chev-r", { size: "sm" })}</span><span class="zt-name"><b>${row2.name}</b><small>${sub2 ? `${row2.runs} runs` : row2.repositories.map((r2) => r2.name).join(" and ")}</small></span>${meter3(row2)}${delta(row2.deltaPoints, row2.previousRate)}<span class="zt-n"><b>${row2.touched}</b> of ${row2.runs} runs</span><span class="${`zt-st${row2.waitingNow ? " tone-parked" : ""}`}">${icon(row2.waitingNow ? "parked" : "flag", { size: "sm" })}${row2.waitingPartial ? "waiting history incomplete" : row2.waitingNow ? "waiting now" : row2.zeroTouch ? "zero touch, 30+ days" : row2.streakDays === null ? "not enough history" : `${amount3(row2.streakDays)} ${row2.streakDays === 1 ? "day" : "days"}`}</span><span class="zt-c">${c ? html`<span class="${`zt-cause tone-${c.tone}`}">${icon(c.icon, { size: "sm" })}${c.short}</span>` : "No touches"}</span>`;
-}
-function phoneProjects(m2, view) {
-  const item2 = (row2, repository = false) => {
-    const c = causesByKey.get(row2.topCause), tone = row2.rate === null ? "idle" : row2.rate < 5 ? "ok" : row2.rate < 30 ? "attention" : "failed";
-    const word3 = row2.rate === null ? "Not known" : row2.rate < 5 ? "Under goal" : row2.rate < 30 ? "Above goal" : "High";
-    const query = new URLSearchParams({ days: String(m2.windowDays), ...row2.project ? { project: row2.project } : {}, ...repository && row2.scopeId ? { scope: row2.scopeId } : {} });
-    return html`<li><a class="ztp-p" href="${`/runs/zero-touch?${query}`}" aria-label="${`${row2.name}: ${pct2(row2.rate)}, open ${repository ? "repository" : "project"}`}"${repository ? html` data-repository` : null}><span class="ztp-p__n"><b>${row2.name}</b><small>${row2.touched} of ${row2.runs} runs</small></span><span class="ztp-p__r"><b>${pct2(row2.rate)}</b><span class="${`zt-lv tone-${tone}`}">${icon(tone === "ok" ? "done" : "attention", { size: "sm" })}${word3}</span></span><span class="ztp-p__c">${c ? html`<span class="${`zt-cause tone-${c.tone}`}">${icon(c.icon, { size: "sm" })}${c.short}</span>` : html`<span>No touches</span>`}${delta(row2.deltaPoints, row2.previousRate)}</span><span class="ztp-p__go">${icon("chev-r", { size: "sm" })}</span></a></li>`;
-  };
-  return html`<ul class="ztp-ps zt-phone-projects">${m2.projects.map((p) => html`${item2(p)}${view?.query?.project === p.project ? p.repositories.map((r2) => item2(r2, true)) : null}`)}</ul>`;
-}
-function zeroTouchProjects(view) {
-  const m2 = model5(view);
-  if (m2.state !== "ready") return card({ title: "By project", body: fail5(m2) });
-  const head = html`<div class="zt-row zt-row--head" aria-hidden="true"><span></span><span>Project</span><span>Touch rate, goal tick at 5%</span><span>Against the previous interval</span><span>Needed a person</span><span>Since the last touch</span><span>Most often</span></div>`;
-  const rows3 = m2.projects.map((p) => html`<li><details class="zt-p"${view?.query?.project === p.project ? html` open` : null}><summary class="zt-row" aria-label="${`${p.name}: ${pct2(p.rate)}, show its repositories or folders`}">${rowContent(p)}</summary><ul class="zt-subs">${p.repositories.map((r2) => html`<li class="zt-row zt-row--sub">${rowContent(r2, true)}</li>`)}</ul>${acts3(view) && p.touchedRunIds.length ? html`<p class="zt-foot"><a class="link" href="${`/runs?${new URLSearchParams({ project: p.project ?? "", touched: "1", days: String(m2.windowDays) })}`}">Open touched runs</a></p>` : null}</details></li>`);
-  return card({ title: "By project", sub: `${m2.totals.touched} of ${m2.totals.runs} runs needed a person`, flush: true, body: html`${fail5(m2)}${m2.projects.length ? html`<div class="zt-tbl zt-desktop-projects">${head}<ul class="zt-list">${rows3}</ul></div>${phoneProjects(m2, view)}<p class="zt-foot">${icon("info", { size: "sm" })}<span>A row opens to its repositories or folders. A run counts once, however many interventions it received.</span></p>` : html`<p class="zt-note">${ZERO_TOUCH_WORDS.empty}</p>`}` });
-}
-function causeCounts(values) {
-  return ZERO_TOUCH_CAUSES.map((c) => ({ ...c, count: values.find((v) => v.cause === c.cause)?.count ?? 0 }));
-}
-function causeBar(values, max, name2) {
-  const rows3 = causeCounts(values);
-  let at2 = 0;
-  max = Math.max(1, max, rows3.reduce((sum, row2) => sum + row2.count, 0));
-  const all = rows3.filter((r2) => r2.count > 0);
-  const label3 = `${name2}: ${all.map((r2) => `${r2.label} ${r2.count}`).join(", ") || "no touches"}; full scale ${max} touched runs`;
-  return html`<svg class="zt-cause-svg" width="100%" height="28" role="img" aria-label="${label3}">${all.map((r2) => {
-    const x2 = at2 / Math.max(1, max) * 500, w = r2.count / Math.max(1, max) * 500;
-    at2 += r2.count;
-    return html`<g class="${`tone-${r2.tone}`}"><rect class="zt-cause-rect" x="${`${svgNum(x2 / 5, 0, 100)}%`}" y="0" width="${`${svgNum(w / 5, 0, 100)}%`}" height="28" rx="5"/>${w >= 22 ? html`<text class="zt-cause-label" x="${`${svgNum((x2 + w / 2) / 5, 0, 100)}%`}" y="18" text-anchor="middle">${r2.count}</text>` : null}</g>`;
-  })}</svg>`;
-}
-function zeroTouchCauses(view) {
-  const m2 = model5(view), max = Math.max(1, ...m2.projects.map((p) => Math.max(p.touched, causeCounts(p.causes).reduce((sum, row2) => sum + row2.count, 0))));
-  if (m2.state !== "ready") return card({ title: "What needed a person", body: fail5(m2) });
-  const bars = m2.projects.map((p) => html`<li class="zt-cb"><span class="zt-cb__n"><b>${p.name}</b><small>${p.touched} of ${p.runs}</small></span>${causeBar(p.causes, max, p.name)}<p class="zt-cb__t">${causeCounts(p.causes).filter((c) => c.count).map((c) => `${c.short} ${c.count}`).join(" \xB7 ") || "No touches"}</p></li>`);
-  const scopeLabel = view?.query?.scope ? "selected repository" : view?.query?.project ? "selected project" : "all projects";
-  return card({ title: "What needed a person", sub: html`<span class="zt-desktop-label">last ${m2.windowDays} days, by project</span><span class="zt-phone-label">${m2.windowDays} days, ${scopeLabel}</span>`, body: html`${fail5(m2)}<ul class="zt-bars zt-desktop-causes">${bars}</ul><div class="zt-phone-causes">${causeBar(m2.causes, Math.max(1, m2.totals.touched), scopeLabel === "all projects" ? "All projects" : scopeLabel)}</div><ul class="zt-whys">${causeCounts(m2.causes).map((c) => html`<li class="zt-why">${tile(c.tone === "running" ? "running" : c.tone === "idle" ? "idle" : c.tone, { icon: c.icon, sm: true })}<span><b>${c.label}</b><small>${c.detail}</small></span><span class="zt-why__n">${c.count}</span></li>`)}<li class="zt-why zt-why--sum"><span></span><span><b>Runs that needed a person</b></span><span class="zt-why__n">${m2.totals.touched}</span></li></ul><p class="zt-merge">${icon("pr", { size: "sm" })}<span>Merging is never a touch. <a class="link" href="#zt-counting">How touches are counted</a></span></p><details class="zt-counting" id="zt-counting"><summary>How touches are counted</summary><p class="zt-kps">The rate counts workload runs with a retained record that ended in the covered interval. Each run counts once. Bars assign it to its first successful human intervention; later interventions remain in history. Jobs stopped before starting are separate. Reads, sandbox opens, automatic starts and internal grouping jobs do not enter the touch count.</p></details>` });
-}
-function guardedForm(action2, { hidden: hidden2 = [], fields: fields3 = null, label: label3, kind = ["sm"] } = {}) {
-  return html`<form class="act zt-action" data-action="${action2}" autocomplete="off"><fieldset data-config-controls disabled>${hidden2.map(([name2, value, type]) => html`<input type="hidden" name="${name2}" value="${value}"${type ? html` data-type="${type}"` : null}>`)}${fields3}${btn({ type: "submit", kind, label: label3 })}</fieldset><noscript><p class="zt-kps">${ZERO_TOUCH_NO_SCRIPT}</p></noscript><p class="field__err" data-form-error hidden role="alert"></p></form>`;
-}
-function nameForm(g, index2) {
-  const key2 = `zt-name-${index2}`;
-  return html`<details class="zt-editor"><summary class="link">${g.name ? "Rename this group" : "Name this group"}</summary>${guardedForm("zero-touch-name", { hidden: [["groupId", g.id]], fields: field2({ label: "Group name", id: key2, control: input({ id: key2, name: "name", value: g.name, required: true }), hint: "Write your own name, up to 120 characters. Question text is read only on its run page." }), label: "Preview name" })}</details>`;
-}
-function instructionForm(g, index2) {
-  if (!g.runIds[0] || g.triggerIndex === null) return html`<p class="zt-kps">Add to instructions is unavailable: a retained run and a current non-cron trigger are required.</p>`;
-  const key2 = `zt-sentence-${index2}`;
-  return html`<details class="zt-editor"><summary class="link">Add to instructions</summary>${guardedForm("zero-touch-instruction", { hidden: [["runId", g.runIds[0]], ["groupId", g.id], ["index", g.triggerIndex, "int"]], fields: field2({ label: "Sentence to add", id: key2, control: textarea({ id: key2, name: "sentence", required: true, rows: 3, maxlength: 2e3 }), hint: "Preview the exact diff, then Confirm. The trigger's existing instructions count toward the 2,000-character limit." }), label: `Preview trigger ${g.triggerIndex + 1}`, kind: ["sm", "primary"] })}</details>`;
-}
-function zeroTouchQuestions(view) {
-  if (view?.role !== "operator") return collapsed({ icon: "parked", title: "Questions it keeps asking", body: "are for operators. Rates, causes, streaks and fixes are shown here." });
-  const m2 = model5(view);
-  if (m2.state !== "ready") return card({ title: "Questions it keeps asking", body: fail5(m2) });
-  const rows3 = m2.groups.map((g, index2) => html`<li class="zt-q"><div class="zt-q__h"><span class="zt-q__n" aria-label="${`asked ${g.count} times`}">${g.count}×</span><div><p class="${`zt-q__t${g.name ? "" : " zt-q__t--un"}`}">${g.name ?? `${g.count} similar questions, not named yet`}</p><p class="zt-q__s"><span class="code">${g.repo ?? g.project ?? "Repository not known"}</span>${g.status === "fixed" && g.fixedAt !== null ? html` · fixed ${date(g.fixedAt)} UTC` : null}${g.status === "fixed" && m2.fixes.some((f3) => f3.groupId === g.id && f3.afterCount === 0 && f3.subsequentRuns > 0 && !f3.partial && f3.undoneAt === null) ? html` · none since` : null}</p></div><span class="zt-q__st">${chip(g.status === "fixed" ? "Fixed" : g.status === "unassigned" ? "Unassigned" : "Open", { status: g.status === "fixed" ? "ok" : "parked", icon: g.status === "fixed" ? "done" : "parked" })}</span></div><p class="zt-said">${icon("runs", { size: "sm" })}<span>Asked in ${g.runIds.slice(0, 8).map((id7, at2) => html`${at2 ? ", " : ""}${link(id7)}`)}${g.runIds.length > 8 ? ` and ${g.runIds.length - 8} more` : null}.</span></p>${acts3(view) ? html`<div class="zt-q__act">${nameForm(g, index2)}${g.status !== "fixed" ? instructionForm(g, index2) : html`<a class="link" href="#p-zt-fixes">See the fix</a>`}</div>` : null}</li>`);
-  const phoneRows = m2.groups.map((g, index2) => html`<li class="ztp-q"><span class="zt-q__n" aria-label="${`asked ${g.count} times`}">${g.count}×</span><span class="ztp-q__t"><b>${g.runIds[0] ? html`<a class="zt-group-link" href="${`/run?id=${encodeURIComponent(g.runIds[0])}`}">${g.name ?? `${g.count} similar, not named yet`}</a>` : g.name ?? `${g.count} similar, not named yet`}</b><small>${g.repo ?? g.project ?? "Repository not known"}</small></span><span class="ztp-q__st">${chip(g.status === "fixed" ? "Fixed" : g.status === "unassigned" ? "Unassigned" : "Open", { status: g.status === "fixed" ? "ok" : "parked", icon: g.status === "fixed" ? "done" : "parked" })}</span><span class="ztp-q__a">${acts3(view) ? g.status === "fixed" ? html`<a class="link" href="#p-zt-fixes">See the fix</a>` : g.name ? instructionForm(g, `phone-${index2}`) : nameForm(g, `phone-${index2}`) : null}</span></li>`);
-  const sources = m2.grouping.sources.length ? m2.grouping.sources : m2.ungroupedRunIds.map((runId2) => ({ runId: runId2, status: "unassigned" }));
-  return card({ title: "Questions it keeps asking", sub: "operator only", body: html`<p class="zt-intro">Grouped by meaning. You name each group; read the questions on their run pages.</p>${fail5(m2)}${m2.grouping.partial ? html`<p class="zt-note" role="status">Question grouping is partial. Missing or unclassified sources are not evidence that a question stopped recurring.</p>` : null}${["unavailable", "configuration-unavailable"].includes(m2.grouping.state) ? html`<p class="zt-note" role="status">${m2.grouping.state === "configuration-unavailable" ? "Grouping configuration could not be read. Check the reviewed triggers file before starting a grouping job." : "Question groups could not be read. Reload to retry; missing assignments are not an empty group list."}</p>` : null}${rows3.length ? html`<ol class="zt-qs zt-desktop-questions">${rows3}</ol><ol class="ztp-qs zt-phone-questions">${phoneRows}</ol>` : html`<p class="zt-kps">${["unavailable", "configuration-unavailable"].includes(m2.grouping?.state) ? "Grouping coverage is not known. Reload after the source is available." : ZERO_TOUCH_WORDS.noGroups}</p>`}${sources.length ? html`<ul class="zt-ungrouped">${sources.slice(0, 20).map((source2) => html`<li data-group-status="${source2.status}">${link(source2.runId)}<span>${ZERO_TOUCH_SOURCE_WORDS[source2.status]}</span>${acts3(view) && ["unassigned", "stale", "refused", "failed"].includes(source2.status) ? guardedForm("zero-touch-group", { hidden: [["runId", source2.runId]], label: "Group question", kind: ["sm", "paid"] }) : null}</li>`)}</ul>` : null}<p class="zt-foot zt-foot--in">${icon("info", { size: "sm" })}<span>${m2.grouping.enabled ? `${plural5(m2.grouping.pending, "grouping job")} pending; ${plural5(m2.grouping.unassigned, "question")} unassigned. Expired or unavailable context stays ungrouped.` : "Private capture and a capped classifier must be enabled in the reviewed zeroTouch configuration before questions can be grouped."}</span></p>` });
-}
-function fixTone(f3) {
-  if (f3.partial || f3.subsequentRuns === 0 || f3.undoneAt !== null || f3.status === "observing") return "idle";
-  return f3.status === "improved" ? "ok" : f3.status === "worse" ? "failed" : "idle";
-}
-function fixObservation(f3) {
-  if (f3.undoneAt !== null) return "Reverted: this observation does not establish current effectiveness.";
-  if (f3.partial) return "Partial observation: effectiveness is not established.";
-  if (f3.subsequentRuns === 0) return "No subsequent runs yet: effectiveness is not established.";
-  return f3.status === "improved" ? "Fewer occurrences over equal observed spans." : f3.status === "worse" ? "More occurrences over equal observed spans." : f3.status === "unchanged" ? "The same number of occurrences over equal observed spans." : "Still observing the targeted cause.";
-}
-function beforeAfter(label3, value, max, tone = "attention") {
-  return html`<p class="zt-ba"><span>${label3}</span><svg class="${`pbar tone-${tone}`}" height="8" role="img" aria-label="${`${label3}: ${value === null ? "not known" : value}`}"><rect class="pbar__bed" width="100%" height="8" rx="4"/>${value ? html`<rect class="pbar__fill" width="${`${svgNum(value / max * 100, 0, 100)}%`}" height="8" rx="4"/>` : null}</svg><b>${value ?? "?"}</b></p>`;
-}
-function zeroTouchFixes(view) {
-  const m2 = model5(view);
-  const evidence = html`${m2.fixesPartial ? html`<p class="zt-note" role="status">Fix history is incomplete. Reload to retry; missing changes are not evidence that no fix was made.</p>` : null}${m2.fixes.length ? html`<ol class="zt-fxs">${m2.fixes.map((f3) => html`<li class="zt-fx"><p class="zt-fx__d">${date(f3.at)} UTC${f3.undoneAt === null ? null : html` · Reverted ${date(f3.undoneAt)} UTC`}</p><p class="zt-fx__w">${f3.kind === "instructions" ? `Trigger ${f3.triggerIndex === null ? "not known" : f3.triggerIndex + 1}'s instructions gained a sentence` : "Configuration changed to address a refusal"}</p><p class="zt-fx__m">${f3.reason ? `${f3.reason} refusals` : "Questions in the targeted group"}, equal ${span(f3.spanMs)} spans before and after; ${f3.subsequentRuns} workload runs after the fix.</p>${beforeAfter("Before", f3.beforeCount, Math.max(f3.beforeCount ?? 0, f3.afterCount ?? 0, 1))}${beforeAfter("After", f3.afterCount, Math.max(f3.beforeCount ?? 0, f3.afterCount ?? 0, 1), fixTone(f3))}<p class="zt-kps">${fixObservation(f3)}</p>${acts3(view) && f3.kind === "instructions" && f3.undoneAt === null ? guardedForm("zero-touch-undo", { hidden: [["fixId", f3.id]], label: "Preview removing the sentence", kind: ["sm", "ghost"] }) : null}</li>`)}</ol>` : html`<p class="zt-kps">${m2.fixesPartial ? "Fix history is not known. Reload after the source is available." : ZERO_TOUCH_WORDS.noFixes}</p>`}`;
-  const brief = m2.fixes.map((f3) => `${f3.reason ?? "grouped questions"}: ${f3.beforeCount ?? "?"} to ${f3.afterCount ?? "?"}`).join("; ");
-  return card({ title: "Fixes that worked", sub: "what changed, and what it did", body: html`<div class="zt-desktop-fixes">${evidence}</div><details class="zt-phone-fixes"><summary>${icon("done", { size: "sm" })}<span><b>${m2.fixesPartial ? "Fix history incomplete" : `${m2.fixes.length} fixes recorded`}</b>${brief ? `: ${brief}. ` : ". "}<span class="link">Open observations</span></span></summary><div class="zt-fix-observations">${evidence}</div></details>` });
-}
-var ZERO_TOUCH_WORDS, ZERO_TOUCH_CAUSES, ZERO_TOUCH_SOURCE_WORDS, causesByKey, model5, acts3, pct2, amount3, date, span, link, fail5, ZERO_TOUCH_NO_SCRIPT, ZERO_TOUCH_PANELS;
-var init_zero_touch = __esm({
-  "src/console/panels/zero-touch.mjs"() {
-    init_common();
-    init_html();
-    init_kit();
-    init_zero_touch_view();
-    ZERO_TOUCH_WORDS = Object.freeze({ unavailable: "Zero touch could not be read. Reload to try again; missing history is never counted as zero touches.", empty: "No workload runs ended in the covered interval.", drafts: "Sent by a person, edited or as drafted. Each run still counts as a touch.", draftsPartial: "Partial history; this counts retained runs only.", viewer: "Questions it keeps asking are for operators. Rates, causes, streaks and fixes are shown here.", noGroups: "No question groups yet. Group retained questions with a capped decision job; name each group yourself.", noFixes: "No cause-linked fixes recorded yet. Start a change from a refusal or a question group to measure it here." });
-    ZERO_TOUCH_CAUSES = Object.freeze([
-      { cause: "question-answer", label: "Questions", short: "Questions", icon: "parked", tone: "parked", detail: "A person answered a parked question and the source session resumed." },
-      { cause: "approval-decision", label: "Approvals", short: "Approvals", icon: "shield", tone: "attention", detail: "A person approved or declined a request. System expiry is excluded." },
-      { cause: "rerun", label: "Failed or refused, then re-run", short: "Re-run", icon: "failed", tone: "failed", detail: "A person started a failed or refused run again." },
-      { cause: "config-fix", label: "Refused until config was fixed", short: "Config fixed", icon: "refused", tone: "refused", detail: "A confirmed configuration change explicitly targeted the refusal." },
-      { cause: "steer", label: "Steered", short: "Steered", icon: "steer", tone: "running", detail: "A person's steering message was delivered to the run." },
-      { cause: "cancel", label: "Cancelled", short: "Cancelled", icon: "cancel", tone: "idle", detail: "A person cancelled the run while it was active." }
-    ]);
-    ZERO_TOUCH_SOURCE_WORDS = Object.freeze({
-      unassigned: "Not grouped yet.",
-      pending: "A grouping job is pending.",
-      assigned: "Assigned to a question group.",
-      "source-expired": "The retained question context expired. Open the run to read what remains; a new grouping job cannot restore it.",
-      "source-unavailable": "The worker could not retain safe question context. Check transcript capture on the source host.",
-      "source-oversize": "The private question context exceeds its byte limit. It remains ungrouped rather than being cut.",
-      "candidates-expired": "A group's representative context expired. Review the groups before trying again.",
-      "group-limit": "The repository reached the bounded group limit. Review existing groups before trying again.",
-      stale: "The group revision changed during classification. Preview a fresh grouping job.",
-      refused: "The grouping job was refused. Open its run to see the policy reason.",
-      failed: "The grouping job failed. Open its run and review the failure before trying again."
-    });
-    causesByKey = new Map(ZERO_TOUCH_CAUSES.map((c) => [c.cause, c]));
-    model5 = (v) => zeroTouchView(v?.data?.zeroTouch, { role: v?.role, windowDays: v?.query?.days ?? 30, nowMs: v?.now ?? 0 });
-    acts3 = (v) => v?.role === "operator" && !v?.readOnly;
-    pct2 = (n3) => Number.isFinite(n3) ? `${Math.round(n3)}%` : "Not known";
-    amount3 = (n3) => Number.isFinite(n3) ? new Intl.NumberFormat("en-US", { maximumFractionDigits: 1 }).format(n3) : "Not known";
-    date = (n3) => Number.isFinite(n3) && n3 >= 0 && n3 <= 864e13 ? new Date(n3).toISOString().slice(0, 10) : "not known";
-    span = (ms3) => ms3 === null ? "not known" : ms3 >= 36e5 ? `${amount3(ms3 / 36e5)}h` : `${amount3(ms3 / 6e4)}m`;
-    link = (id7) => html`<a class="link code" href="${`/run?id=${encodeURIComponent(id7)}`}">${id7}</a>`;
-    fail5 = (m2) => m2.state === "unavailable" ? html`<p class="zt-note" role="status">${ZERO_TOUCH_WORDS.unavailable}</p>` : null;
-    ZERO_TOUCH_NO_SCRIPT = "Enable JavaScript to preview and confirm a change. Reading and navigation work without it.";
-    ZERO_TOUCH_PANELS = Object.freeze([["p-zt-rate", zeroTouchRate], ["p-zt-streak", zeroTouchStreak], ["p-zt-wait", zeroTouchWait], ["p-zt-handled", zeroTouchHandled], ["p-zt-projects", zeroTouchProjects], ["p-zt-causes", zeroTouchCauses], ["p-zt-questions", zeroTouchQuestions], ["p-zt-fixes", zeroTouchFixes]]);
-  }
-});
-
-// src/trigger-policy.mjs
-function triggerWhoMayFire(trigger2) {
-  const on = trigger2.on ?? trigger2;
-  const forge = trigger2.run?.kind ?? trigger2.forge;
-  const kind = on.type;
-  if (kind === "cron") return "This deployment's scheduler starts it on its schedule; an operator may fire it by hand.";
-  if (forge === "gitlab") return "The actor must be a GitLab project member with Developer access (30) or higher, including inherited membership.";
-  if (forge === "forgejo") return "The actor must have Forgejo repository owner, admin or write permission.";
-  if (forge === "azure") return "The actor must be an Azure DevOps project member admitted by the receiver's membership check.";
-  if (kind === "label") return "A collaborator applies the matching issue label; the label event supplies the approval.";
-  if (kind === "comment") return "The commenter's GitHub association must be OWNER, MEMBER or COLLABORATOR; the service's own comments are refused.";
-  const actions = Array.isArray(on.action) ? on.action : [];
-  const gates = [];
-  if (kind === "issue" || actions.includes("closed")) gates.push("The closer must have repository write access");
-  if (actions.includes("labeled")) gates.push("A collaborator-applied matching label supplies approval");
-  if (actions.includes("review_submitted")) gates.push("The reviewer's association must be OWNER, MEMBER or COLLABORATOR, regardless of the pull request author's association");
-  if (actions.some((a) => ["opened", "synchronize", "reopened"].includes(a))) gates.push("The pull request author's association must be OWNER, MEMBER or COLLABORATOR");
-  return `${gates.join(". ") || "The receiver checks the actor's authority for the configured event"}.`;
-}
-var init_trigger_policy = __esm({
-  "src/trigger-policy.mjs"() {
-  }
-});
-
 // src/trigger-gets-view.mjs
 function cannotSay(row2, trigger2, fileVersion) {
   if (fileVersion > 1) {
@@ -161868,17 +161737,28 @@ function agreeRow2(row2, trigger2) {
     skills: row2.skills ?? [],
     mcp: (row2.mcp ?? []).filter((server) => named2.includes(server.name) && server.enabled === true),
     packages: packagesLoaded(row2, trigger2),
-    flows: (row2.flows ?? []).filter((entry3) => entry3.trigger === trigger2.index && entry3.flow === trigger2.flow)
+    // Its answer for the file as it is, without the basis: two hosts that answer for it hold the same one, and a host on a release before
+    // #869 holds none, which would otherwise be a difference no job meets.
+    flows: [flowRowFor(row2, trigger2)?.row].filter(Boolean).map((found) => ({ trigger: found.trigger, flow: found.flow, tier: found.tier, package: found.package, repo: found.repo }))
   };
 }
+function flowRowFor(row2, trigger2) {
+  if (typeof trigger2.flow !== "string") return null;
+  const here = (row2.flows ?? []).filter((entry3) => entry3.trigger === trigger2.index);
+  const found = here.find((entry3) => entry3.flow === trigger2.flow);
+  if (!found) return here.some((entry3) => typeof entry3.basis === "string" && entry3.basis !== trigger2.flowBasis) ? { stale: true } : null;
+  if (typeof found.basis === "string") return found.basis === trigger2.flowBasis ? { row: found } : { stale: true };
+  if (found.tier === "package" && (trigger2.excludeExtensions ?? []).includes(found.package)) return null;
+  if (found.tier === "package" && trigger2.packages === false) return null;
+  return { row: found };
+}
 function flowAnswer(row2, trigger2) {
-  const found = (row2.flows ?? []).find((entry3) => entry3.trigger === trigger2.index && entry3.flow === trigger2.flow);
+  const found = flowRowFor(row2, trigger2)?.row;
   if (!found) return null;
-  if (found.tier === "package" && (trigger2.excludeExtensions ?? []).includes(found.package)) return null;
   return found.tier === "package" ? `from ${found.package ?? "a staged package"}` : FLOW_TIER_WORDS[found.tier] ?? null;
 }
 function lacksFlow(row2, trigger2) {
-  const found = trigger2.flow === null ? null : (row2.flows ?? []).find((entry3) => entry3.trigger === trigger2.index && entry3.flow === trigger2.flow);
+  const found = flowRowFor(row2, trigger2)?.row;
   return found?.tier === "none" && found.repo === "absent";
 }
 function hostPills(rows3, trigger2, liveList, fileVersion) {
@@ -161971,8 +161851,13 @@ function flowRow({ trigger: trigger2, rows: rows3, editor: editor3 }) {
   const choices = offered.filter((entry3) => !seen.has(entry3.name) && seen.add(entry3.name)).slice(0, FLOW_CHOICES_MAX);
   const groups = /* @__PURE__ */ new Map();
   const silent = [];
+  const stale = [];
   for (const row2 of rows3) {
     if (trigger2.flow === null || row2.state !== "current") continue;
+    if (flowRowFor(row2, trigger2)?.stale === true) {
+      stale.push(row2.name);
+      continue;
+    }
     const word3 = flowAnswer(row2, trigger2);
     if (word3 === null) silent.push(row2.name);
     else groups.set(word3, [...groups.get(word3) ?? [], row2.name]);
@@ -161981,7 +161866,11 @@ function flowRow({ trigger: trigger2, rows: rows3, editor: editor3 }) {
   const lacking = rows3.filter((row2) => row2.state === "current" && lacksFlow(row2, trigger2)).map((row2) => row2.name);
   const said = [
     ...[...groups].map(([word3, names2]) => `${listed(names2)} ${names2.length === 1 ? "finds" : "find"} ${trigger2.flow} ${word3}`),
-    silent.length > 0 ? `${listed(silent)} ${silent.length === 1 ? "has" : "have"} no answer for it yet` : null,
+    // Issue #869: an answer judged before a change to what the flow is found by. One sentence for one host or many, so it reads alike,
+    // and none promises a later answer: a spent one-shot, a file the loaders refuse or a host whose own triggers file differs gets none.
+    stale.length > 0 ? `${listed(stale)} ${TRIGGER_GETS_WORDS.flowStale}` : null,
+    // No "yet": a flow that fails the skill charset, or a spent one-shot, never gets one.
+    silent.length > 0 ? `${listed(silent)} ${silent.length === 1 ? "has" : "have"} no answer for it` : null,
     unknown3.length > 0 ? `${listed(unknown3)} ${unknown3.length === 1 ? "has" : "have"} no answer to read` : null
   ].filter(Boolean);
   return {
@@ -162014,7 +161903,7 @@ function overlayStem(segment) {
   for (let end = 1; end < segment.length; end += 1) if (overlayEntryNamed(segment.slice(0, end), segment)) return segment.slice(0, end);
   return segment;
 }
-function extensionsRow2({ trigger: trigger2, rows: rows3, last }) {
+function extensionsRow2({ trigger: trigger2, rows: rows3, last, records = [], historyUnread = false, hostLoads = null }) {
   const known2 = rows3.filter((row2) => row2.state === "current");
   const inFile = trigger2.excludeExtensions ?? [];
   const withheld = trigger2.packages === false;
@@ -162030,10 +161919,13 @@ function extensionsRow2({ trigger: trigger2, rows: rows3, last }) {
     for (const value of naming.length > 0 ? naming : [overlayStem(segment)]) groupOf(value).segments.add(segment);
   }
   for (const name2 of inFile) groupOf(name2);
-  const brought = (name2, version = null) => {
-    const row2 = (last?.sources ?? []).find((source2) => source2.name === name2 && (version === null || source2.version === version));
-    const words = broughtWords(row2);
-    return words === null ? null : `${words}, as ${last.id} loaded it`;
+  const said = (Array.isArray(records) ? records : []).map((record3) => triggerLastRun([record3], hostLoads).quoted).filter(Boolean);
+  const brought = (name2, { kind, version = null }) => {
+    for (const run3 of [last, ...said].filter(Boolean)) {
+      const row2 = (run3.sources ?? []).find((source2) => source2.kind === kind && source2.name === name2 && (version === null || source2.version === version));
+      if (row2) return `${broughtWords(row2) ?? "no tool, skill or prompt template"}, as ${run3.id} loaded it`;
+    }
+    return null;
   };
   const items = [...groups.values()].map(({ value, versions: versions2, segments }) => {
     const on = !inFile.includes(value);
@@ -162045,12 +161937,13 @@ function extensionsRow2({ trigger: trigger2, rows: rows3, last }) {
     const off = known2.filter((row2) => holdsEntry(row2) && row2.overlayExtensionsAllowed !== true).map((row2) => row2.name);
     const hostsOn = (version) => known2.filter((row2) => (row2.packages ?? []).some((entry3) => entry3.name === value && entry3.version === version)).map((row2) => row2.name);
     const stagedWhere = staged.length === 0 ? null : whereWords(rows3, "packages", holdsPackage, "staged", staged.length === 1 ? null : staged.map((version) => `${version} on ${listed(hostsOn(version))}`).join(", "));
+    const fromEntries = () => entries.map((segment) => brought(segment, { kind: "overlay" })).find((words) => words !== null) ?? null;
     const quoted = (() => {
-      if (!on || withheld && entries.length === 0) return null;
-      if (staged.length === 0) return brought(entries[0]);
-      const running = staged.find((version) => brought(value, version) !== null);
-      if (running === void 0) return entries.length > 0 ? brought(entries[0]) : null;
-      return `${staged.length > 1 ? `${running}: ` : ""}${brought(value, running)}`;
+      if (withheld && entries.length === 0) return null;
+      if (staged.length === 0 || withheld) return fromEntries();
+      const running = staged.find((version) => brought(value, { kind: "package", version }) !== null);
+      if (running === void 0) return fromEntries();
+      return `${staged.length > 1 ? `${running}: ` : ""}${brought(value, { kind: "package", version: running })}`;
     })();
     const also = inFile.includes(value) ? alsoNaming(inFile, value) : [];
     const named2 = staged.length > 0 ? `${value} ${listed(staged)}` : entries.length > 0 && also.length === 0 ? entries.join(", ") : value;
@@ -162060,7 +161953,9 @@ function extensionsRow2({ trigger: trigger2, rows: rows3, last }) {
       entries.length > 0 ? whereWords(rows3, "extensions", holdsEntry, "in the overlay") : null,
       off.length > 0 ? `its overlay extensions off on ${listed(off)}` : null,
       also.length > 0 ? `the file also names ${listed(also)}` : null,
-      quoted
+      quoted,
+      // Not said where the history could not be read: the card says so once, and a failed read is not "no run".
+      quoted === null && !historyUnread && !(withheld && entries.length === 0) && (staged.length > 0 || entries.length > 0) ? staged.length > 0 && !withheld ? TRIGGER_GETS_WORDS.bringsUnknown : TRIGGER_GETS_WORDS.overlayBringsUnknown : null
     ].filter(Boolean).join(" \xB7 ");
     return { value, name: named2, on, moot, sub: sub2, backOn: also.length > 0 ? `${value} off the list` : `${value} back on` };
   });
@@ -162163,14 +162058,69 @@ function triggerGetsOf({ trigger: trigger2, records = [], historyUnread = false,
     last: { Model: under("Model"), Skills: under("Skills"), Extensions: under("Extensions"), MCP: under("MCP"), Tools: under("Tools"), pi: under("pi") },
     model: modelRow2({ trigger: trigger2, defaults: defaults4, modelChoices }),
     flow: { ...flowRow({ trigger: trigger2, rows: rows3, editor: editor3 }), ...watch ? { doctor: null, lacking: null } : {} },
-    extensions: extensionsRow2({ trigger: trigger2, rows: rows3, last: quoted }),
+    extensions: extensionsRow2({ trigger: trigger2, rows: rows3, last: quoted, records, historyUnread, hostLoads }),
     mcp: mcpRow2({ trigger: trigger2, rows: rows3, overlayServers }),
     tools: toolsRow2({ trigger: trigger2, last: quoted }),
     image: imageRow({ trigger: trigger2, rows: rows3 }),
     secrets: { profile: trigger2.secretsProfile ?? null, count: trigger2.secrets ?? 0, optedOut: trigger2.secretBundle === false }
   };
 }
-var TRIGGER_GETS_WORDS, code4, run2, time2, unique, overlayServersOf, packagesLoaded, overlayLoaded, serverDefinition, FLOW_TIER_WORDS, MODEL_CHOICES_MAX, PROVIDER_CHOICES_MAX, FLOW_CHOICES_MAX, listsWhole, plural7, alsoNaming;
+function freshFlowWords(row2, trigger2) {
+  if (trigger2.flow === null) return SANDBOX_FRESH_WORDS.noFlow;
+  const who = `a job of trigger ${trigger2.index + 1} on this host`;
+  const at2 = flowRowFor(row2, trigger2);
+  if (at2?.stale === true) return `Whether ${who} would find ${trigger2.flow} is unknown: ${SANDBOX_FRESH_WORDS.flowStale}.`;
+  const word3 = flowAnswer(row2, trigger2);
+  if (word3 === null) return `Whether ${who} would find ${trigger2.flow} is unknown: its last doctor run has no answer for it.`;
+  const tier = at2.row.tier;
+  if (tier === "none" || tier === "unknown") return `Whether ${who} would find ${trigger2.flow} is unknown: doctor found it ${word3}, and the repository, which is on no host, may hold it.`;
+  if (tier === "repository") return `${who.charAt(0).toUpperCase()}${who.slice(1)} would find ${trigger2.flow} ${word3}.`;
+  return `${who.charAt(0).toUpperCase()}${who.slice(1)} would find ${trigger2.flow} ${word3}, unless the repository holds it at its base commit, which comes first.`;
+}
+function freshMcpWords(row2, named2) {
+  if (!Array.isArray(named2) || named2.length === 0) return null;
+  const on = [];
+  const off = [];
+  const lacking = [];
+  const unknown3 = [];
+  let forge = false;
+  for (const name2 of named2) {
+    if (name2 === FORGE_MCP_SERVER_NAME) {
+      forge = true;
+      continue;
+    }
+    const server = (row2.mcp ?? []).find((entry3) => entry3.name === name2);
+    if (server) (server.enabled === true ? on : off).push(name2);
+    else (freshListsWhole(row2, "mcp") ? lacking : unknown3).push(name2);
+  }
+  const refused3 = [off.length > 0 ? `${listed(off)} switched off here` : null, lacking.length > 0 ? `${listed(lacking)} not on this host` : null].filter(Boolean);
+  const said = [
+    on.length > 0 ? `${listed(on)} on this host` : null,
+    // The reason is not named: a host with no mcp.json publishes the same empty list, and its jobs are refused as
+    // mcp-config-invalid rather than mcp-server-unknown (`serverRefused`). Either way, before it spends.
+    refused3.length > 0 ? `${refused3.join(" and ")}, so a job there is refused before it spends` : null,
+    unknown3.length > 0 ? `${listed(unknown3)} unknown here` : null,
+    forge ? `${FORGE_MCP_SERVER_NAME}: ${TRIGGER_GETS_WORDS.forgeServer}` : null
+  ].filter(Boolean);
+  return `${said.join("; ")}.`;
+}
+function sandboxFreshRows({ hostLoads, host, triggerIndex, flow = null, flowBasis = null, mcp = [], withholdsPackages = false, excludes = [], image = null }) {
+  const rows3 = [[`On ${host}`, sandboxFreshLine({ hostLoads, host, triggerIndex, withholdsPackages, excludes, image, mcp })]];
+  const row2 = hostLoadsRow(hostLoads, host);
+  if (row2.state === "unknown") return rows3;
+  const named2 = typeof flow === "string" && flow !== "" ? flow : null;
+  if (row2.state !== "current") {
+    rows3.push([SANDBOX_FRESH_WORDS.flowLabel, [named2 === null ? SANDBOX_FRESH_WORDS.noFlow : `Whether a job of trigger ${triggerIndex + 1} on this host would find ${named2} is unknown: its last doctor run is old.`]]);
+    const listedNames = (mcp ?? []).filter((name2) => typeof name2 === "string");
+    if (listedNames.length > 0) rows3.push([SANDBOX_FRESH_WORDS.mcpLabel, [`${listed(listedNames)} unknown here: its last doctor run is old.`]]);
+    return rows3;
+  }
+  rows3.push([SANDBOX_FRESH_WORDS.flowLabel, [freshFlowWords(row2, { index: triggerIndex, flow: named2, excludeExtensions: excludes, packages: withholdsPackages ? false : void 0, flowBasis })]]);
+  const mcpWords = freshMcpWords(row2, mcp);
+  if (mcpWords !== null) rows3.push([SANDBOX_FRESH_WORDS.mcpLabel, [mcpWords]]);
+  return rows3;
+}
+var TRIGGER_GETS_WORDS, code4, run2, time2, unique, overlayServersOf, packagesLoaded, overlayLoaded, serverDefinition, FLOW_TIER_WORDS, MODEL_CHOICES_MAX, PROVIDER_CHOICES_MAX, FLOW_CHOICES_MAX, listsWhole, plural7, alsoNaming, SANDBOX_FRESH_WORDS, freshListsWhole;
 var init_trigger_gets_view = __esm({
   "src/trigger-gets-view.mjs"() {
     init_mcp_config();
@@ -162206,6 +162156,8 @@ var init_trigger_gets_view = __esm({
       noExtensions: "The hosts that can say name no staged package or overlay extension.",
       noExtensionsKnown: "No host\u2019s doctor run can say which extensions it has.",
       forgeServer: "the job\u2019s own forge, with its own token; in no overlay",
+      bringsUnknown: "what it brings is known once a run has loaded it",
+      overlayBringsUnknown: "an overlay entry has no manifest, so what it brings is known once a run has loaded it",
       noServers: "The hosts that can say name no MCP server, and this trigger names none.",
       noServersKnown: "No host\u2019s doctor run can say which MCP servers it has, and this trigger names none.",
       serverRefused: "A job on a host without a server it names, or with it off, is refused as mcp-server-unknown, before it spends; a host with no overlay or no mcp.json refuses it as mcp-config-invalid. A key a server uses must reach the job, through run.secrets in the file or a host\u2019s PI_FORWARD_ENV, or the job is refused as mcp-secret-unmapped.",
@@ -162220,6 +162172,7 @@ var init_trigger_gets_view = __esm({
       viewer: "An operator changes these on this page, with one preview and one Confirm.",
       noTool: "No tool reaches this action; dispatch_trigger_edit keeps today\u2019s scope.",
       flowPicker: "It leaves out what is in a skills folder, or in a repository not on this host, and any other name can be typed.",
+      flowStale: "answered for another version of the triggers file, so it is unknown there",
       reloadDrops: "A Confirm elsewhere on this page reloads it, and drops any change not yet written in What its jobs get.",
       othersUnread: "This page read the triggers file, and its other reads failed: the run history, the hosts and the jobs in line are unknown.",
       pillOrder: "differs in the order or kind of what it loads",
@@ -162251,6 +162204,370 @@ var init_trigger_gets_view = __esm({
     listsWhole = (row2, part) => row2.state === "current" && !(row2.unread ?? []).includes(part) && !((row2.more?.[part] ?? 0) > 0);
     plural7 = (n3, one, many = `${one}s`) => `${n3} ${n3 === 1 ? one : many}`;
     alsoNaming = (list5, name2) => list5.filter((other) => other !== name2 && (overlayEntryNamed(other, name2) || overlayEntryNamed(name2, other)));
+    SANDBOX_FRESH_WORDS = Object.freeze({
+      noFlow: "This trigger names no flow.",
+      flowStale: "its last doctor run answered for another version of the triggers file",
+      flowLabel: "Flow",
+      mcpLabel: "MCP servers"
+    });
+    freshListsWhole = (row2, part) => !(row2.unread ?? []).includes(part) && !((row2.more?.[part] ?? 0) > 0);
+  }
+});
+
+// src/console/panels/sandboxes.mjs
+function state2(v) {
+  const s2 = report(v)?.request;
+  if (!s2) return null;
+  const success = s2.state === "ready";
+  return banner({ status: success ? "ok" : ["refused", "failed"].includes(s2.state) ? "attention" : "running", title: success ? `Sandbox ${s2.result?.id ?? s2.id} is ready` : `Sandbox request ${s2.state}`, body: html`<span class="code">${s2.id}</span> on ${s2.host ?? "its host"}. ${s2.message ?? s2.reason ?? (success ? "No container has started. Open it from your terminal." : "Reload to read the worker's result.")}`, actions: success && s2.result ? links(v, { ...s2.result, id: s2.result.id, host: s2.result.host ?? s2.host }, "open", true) : btn({ href: `/runs/sandboxes?${new URLSearchParams({ request: s2.id, host: s2.host ?? selected3(v).host ?? "" })}`, label: "Refresh request" }) });
+}
+function sandboxFromRun(v) {
+  if (!allowed3(v) || v.query?.gatewaySelect) return null;
+  const all = rows(v);
+  const id7 = v.query?.id;
+  const picked = all.find((r2) => rowId2(r2) === id7 && (!v.query?.host || r2.host === v.query.host));
+  const pickerHost = v.query?.host ?? selected3(v).host ?? all[0]?.host ?? "";
+  const picker = html`<form method="get" action="/runs/sandboxes" data-live-hold class="sx-picker">${field2({ label: "Workspace host", id: "sb-workspace-host", control: select({ id: "sb-workspace-host", name: "host", value: pickerHost, options: [{ value: "", label: "Choose a host" }, ...(report(v)?.hosts ?? []).map((h2) => ({ value: h2.name, label: h2.name }))] }) })}${field2({ label: "Kept workspace", id: "sb-workspace", control: select({ id: "sb-workspace", name: "id", value: id7 ?? "", options: [{ value: "", label: "Choose a workspace" }, ...all.filter((r2) => !pickerHost || r2.host === pickerHost).map((r2) => ({ value: rowId2(r2), label: `${rowId2(r2)} on ${r2.host}${r2.prepared ? " (prepared)" : ""}` }))] }) })}${btn({ type: "submit", label: "Show workspace" })}</form>`;
+  if (!report(v)) return card3("From a run", html`<p role="status">${SANDBOX_WORDS.unavailable}</p>`);
+  if (!picked) return card3("From a run", html`${state2(v)}${v.data?.sandboxHostsProblem ? html`<p role="status">${v.data.sandboxHostsProblem}</p>` : null}${picker}<p class="card__sub">${all.length ? "Choose a kept workspace, or open Sandboxes from a run page." : SANDBOX_WORDS.empty}</p>`, "the image, workspace and isolation the run kept");
+  const workspace = picked.kind === "local" ? "Its original host folder" : isForgeKind(picked.kind) ? "Its retained clone" : "The workspace recorded in its kept manifest";
+  const piVersion = hostPiFor(hostLoadsRow(v.data?.hostLoads, picked.host), picked.image);
+  const loads = picked.prepared ? sandboxPreparedLine(piVersion) : sandboxRunLine(v.data?.sandboxRun ?? null, rowId2(picked), { pi: piVersion, unread: v.data?.sandboxRunUnread === true });
+  const what2 = facts([["Image", picked.image ?? "As recorded in its kept manifest"], ["/workspace", workspace], ["/job", "Read only, with the retained job inputs"], ["pi and what it loads", wordsHtml(loads)], ["Processes", "None until you start them"], ["Credentials", "None, on purpose"], ["Network", "The host's current job egress policy"]], { cols: 1 });
+  return card3("From a run", html`${state2(v)}${v.data?.sandboxHostsProblem ? html`<p role="status">${v.data.sandboxHostsProblem}</p>` : null}${picker}<div class="sx-run">${tile("ok", { icon: "box" })}<div><p class="sx-run__t"><span class="code">${rowId2(picked)}</span>${picked.project ? ptag(picked.project) : null}${picked.prepared ? chip("Without a run") : null}</p><p class="sx-run__s">${picked.host} ${vtag(picked.v ?? picked.backend)}. ${retention(picked, v.now)}</p></div></div><h3 class="sx-h3">What opens</h3>${what2}<p class="sx-small">${icon("info", { size: "sm" })}<span>${LOADED_WORDS.sandboxFoot}</span></p><h3 class="sx-h3">How it opens</h3>${canOpen(picked) ? html`<div class="sx-ch sx-ch--on"><div class="sx-ch__h">${icon("terminal", { size: "sm" })}<b>In your terminal</b><span class="sx-rec sandbox-opener">recommended</span></div><p class="sx-ch__s">Your terminal opens with the command typed in and waits for Enter. The link holds no secret. On a phone, copy the command.</p>${links(v, picked)}</div><div class="sx-foot"><p>${icon("info", { size: "sm" })}<span>The shell uses a job's isolation and network. A published host port is refused while egress is on. Pinning uses this host's configured pin window.</span></p>${pinForm(v, picked)}</div>` : html`<p>This venue has no sandbox shell. Its workspace cannot be reopened here.</p>`}`, "the same image, workspace and isolation as the run");
+}
+function sandboxNew(v) {
+  if (!allowed3(v) || v.query?.gatewaySelect) return null;
+  const s2 = selected3(v), data5 = report(v), options = data5?.options ?? [];
+  const repositories = [...new Set(options.map((o) => o.repo).filter(Boolean))];
+  const triggers2 = options;
+  const hostOptions = (data5?.hosts ?? []).filter((h2) => !h2.unreadable && !h2.stale && h2.settings && (!data5?.eligibleHosts || data5.eligibleHosts.includes(h2.name))).map((h2) => ({ value: h2.name, label: `${h2.name}, ${h2.settings.defaultBackend ?? "venue not published"}` }));
+  const fields3 = [
+    field2({ label: "Repository", id: "sb-repo", control: input({ id: "sb-repo", name: "repo", value: s2.repo ?? "", placeholder: "owner/repository", required: true, autocomplete: "off", spellcheck: false }) }),
+    field2({ label: "As the jobs of", id: "sb-trigger", control: select({ id: "sb-trigger", name: "index", value: s2.index === void 0 ? "" : String(s2.index), options: [{ value: "", label: "Choose a trigger" }, ...triggers2.map((o) => ({ value: String(o.index), label: o.label }))] }), hint: "Its image, size and egress are shown below, rather than chosen here." }),
+    field2({ label: "Start from", id: "sb-ref", control: input({ id: "sb-ref", name: "ref", value: s2.ref ?? "HEAD", code: true, required: true, autocomplete: "off", spellcheck: false }), hint: "HEAD means the default branch. Enter a branch, tag, full commit SHA, or pr:42 for a pull request." }),
+    field2({ label: "Host", id: "sb-host", control: select({ id: "sb-host", name: "host", value: s2.host ?? "", options: [{ value: "", label: "Choose a host" }, ...hostOptions] }), hint: "The worker checks the trigger and its own policy again before cloning." }),
+    field2({ label: "Keep it", id: "sb-pin", control: select({ id: "sb-pin", name: "pin", value: s2.pin ? "1" : "0", options: [{ value: "0", label: "Host's retention window" }, { value: "1", label: "Host's pin window" }] }) })
+  ];
+  const plan = data5?.plan;
+  const source2 = data5?.fromRun ? html`<p class="sx-p">Preparing from <a class="link" href="${`/run?${new URLSearchParams({ id: data5.fromRun })}`}">${data5.fromRun}</a>. The ref starts at HEAD because the record holds no created pull request. ${data5.sourceRun?.historicalIndex !== null && data5.sourceRun?.historicalIndex !== void 0 ? `Its historical trigger row was ${data5.sourceRun.historicalIndex + 1}; that does not prove the current row's identity.` : "Its original trigger identity is unavailable."} Choose the current trigger explicitly.${String(data5.sourceRun?.backend).startsWith("openshell") ? " Its original OpenShell venue cannot prepare a sandbox; deliberately choose a compatible local or podman trigger." : ""}</p>` : null;
+  const form = html`${source2}<form method="get" action="/runs/sandboxes" data-live-hold>${data5?.fromRun ? html`<input type="hidden" name="fromRun" value="${data5.fromRun}">` : null}<div class="sx-form">${fields3}</div><div class="sx-form-end">${btn({ type: "submit", label: "Review settings" })}</div></form>`;
+  const fresh = plan ? html`${facts(sandboxFreshRows({ hostLoads: v.data?.hostLoads, host: plan.host, triggerIndex: s2.index, flow: data5?.flow ?? null, flowBasis: data5?.flowBasis ?? null, mcp: data5?.mcp ?? [], withholdsPackages: data5?.withholdsPackages === true, excludes: data5?.excludes ?? [], image: plan.image }).map(([label3, parts2]) => [label3, wordsHtml(parts2)]), { cols: 1 })}<p class="sx-small">${icon("info", { size: "sm" })}<span>${LOADED_WORDS.freshFoot}</span></p>` : null;
+  const preparation = plan ? html`<h3 class="sx-h3">Given by the trigger, not chosen here</h3>${facts5(plan)}${fresh}<p class="sx-p">${plan.pin ? `Pinned for ${plan.pinDays} days` : `Kept for ${plan.retentionHours} hours`}, on ${plan.host}. The worker clones on that host with a credential for this repository, then drops it. No container starts, no model runs, no dollars are spent and no run slot is taken.</p>${acts2(v) ? actForm({ action: "sandbox-prepare", hidden: [["repo", s2.repo], ["index", s2.index, "int"], ["ref", s2.ref], ["host", s2.host], ["pin", Boolean(s2.pin), "json"]], label: "Preview preparation", kind: ["primary"], icon: "plus" }) : html`<p class="card__sub">This console is read-only. Prepare from the host's terminal.</p>`}${cmd(["pi-dispatch", "sandbox", "--new", s2.repo, "--ref", s2.ref, "--as", String(s2.index), ...s2.pin ? ["--pin"] : []])}<p class="card__sub">The CLI’s --as takes a zero-based file index: trigger row ${s2.index + 1} is index ${s2.index}.</p>` : html`<p class="sx-p" role="status">${data5?.refusal ?? "Choose a repository, its trigger, a ref and a host, then review their settings."}</p>`;
+  return card3("Without a run", html`${form}${preparation}<noscript><p class="card__sub">${SANDBOX_WORDS.noScript}</p></noscript>`, "a fresh clone with a trigger's image and a job's isolation");
+}
+function sandboxOpen(v) {
+  if (!allowed3(v)) return null;
+  const data5 = report(v), sessions = (data5?.sessions ?? []).filter((s2) => !v.query?.gatewaySelect || s2.host === v.query.host);
+  const incomplete = !data5 || data5.sessionsUnavailable || data5.sessionsMore > 0 || data5.sessionsUnreadable > 0;
+  const notices = (data5?.notices ?? []).filter((n3) => !v.query?.gatewaySelect || n3.host === v.query.host).map((n3) => html`<p class="sx-p" role="status">${icon("attention", { size: "sm" })} ${n3.host}, ${n3.id}: ${{ "network-kept": "The sandbox network was kept because cleanup could not be confirmed. Inspect this host\u2019s runtime and network before removing either.", "network-cleanup-failed": "Sandbox network cleanup failed. Inspect this host\u2019s runtime and egress network before retrying cleanup.", "runtime-unreadable": "The runtime could not be read. An expired shell registration does not prove the container stopped. Inspect this host before reopening or cleaning it." }[n3.reason] ?? "Sandbox cleanup needs inspection on this host."} <a class="link" href="${`/fleet/host?${new URLSearchParams({ name: n3.host })}`}">Inspect host</a>.</p>`);
+  if (v.query?.gatewaySelect && !v.data?.browserGateways?.enabledHosts?.includes(v.query.host)) return card3("Open now", html`<p role="status">The browser gateway is not enabled for ${v.query.host}, so there is no shell to choose here. <a class="link" href="/runs/sandboxes">Return to Sandboxes</a>.</p>`);
+  return card3("Open now", html`${v.query?.gatewaySelect ? html`<p class="sx-p">Choose an already-open shell on ${v.query.host}. Each browser opening needs your current operator token. <a class="link" href="/runs/sandboxes">Return to Sandboxes</a>.</p>` : null}${notices}${data5?.noticesUnavailable ? html`<p role="status">Some sandbox cleanup notices could not be read. Inspect the host if a terminal ended unexpectedly.</p>` : null}${data5?.sessionsMore > 0 || data5?.sessionsUnreadable > 0 ? html`<p role="status">The registered shell list is incomplete: at least ${data5.sessionsMore ?? 0} more and ${data5.sessionsUnreadable ?? 0} unreadable registrations.</p>` : null}${data5?.sessionsUnavailable ? html`<p role="status">Open shells could not be read. Reload to try again.</p>` : sessions.length ? html`<ul class="sx-opens">${sessions.map((s2) => html`<li class="sx-open"><span class="dot tone-running"></span><div class="sx-open__b"><p class="sx-open__t"><span class="code">${s2.id}</span>${vtag(s2.venue)}</p><p class="sx-open__s">${s2.host}, opened by ${s2.by ?? "the terminal operator"}. Open since ${stamp(s2.since)}.</p>${sandboxDriverLine(v, s2)}<div class="sx-open__a">${links(v, s2, "attach", true)}${sandboxBrowserLink(v, s2)}${acts2(v) && !v.query?.gatewaySelect ? actForm({ action: "sandbox-end", hidden: [["host", s2.host], ["id", s2.id], ["nonce", s2.nonce], ["containerId", s2.containerId]], label: "Preview End", kind: ["sm", "danger"], icon: "cancel" }) : null}</div></div></li>`)}</ul>` : html`<p>${data5?.sessionsMore > 0 || data5?.sessionsUnreadable > 0 ? "No readable shell is in this bounded view. The incomplete registrations above prevent an exact empty count." : SANDBOX_WORDS.noShells}</p>`}<p class="sx-small">${icon("info", { size: "sm" })}<span>One shell per workspace at a time. End asks the terminal that opened it to close the shell and keeps the workspace. What you type is not recorded.</span></p>`, null, badge(incomplete ? "attention" : "running", `${sessions.length} ${incomplete ? "shown" : "open"}`));
+}
+function sandboxKept(v) {
+  if (!allowed3(v) || v.query?.gatewaySelect) return null;
+  const data5 = report(v), all = rows(v);
+  return card3("Kept workspaces", html`${data5?.more > 0 ? html`<p role="status">At least ${data5.more} more hosts have inventory beyond this bounded view. Inspect the fleet before treating this list as complete.</p>` : null}${!data5 ? html`<p role="status">${SANDBOX_WORDS.unavailable}</p>` : html`${(data5.hosts ?? []).filter((h2) => h2.stale || h2.unreadable).map((h2) => html`<p class="sx-p" role="status">${h2.name}: ${h2.unreadable ? "publication unreadable" : "publication stale; inspect this host before opening"}. Its list is incomplete.</p>`)}${all.length ? html`<ul class="sx-kepts">${all.map((r2) => html`<li class="sx-kept${canOpen(r2) ? "" : " sx-kept--no"}"><p class="sx-kept__t"><a class="code" href="${`/runs/sandboxes?${new URLSearchParams({ id: rowId2(r2), host: r2.host })}`}">${rowId2(r2)}</a>${r2.project ? ptag(r2.project) : null}${r2.prepared ? chip("Without a run") : null}</p><p class="sx-kept__s">${r2.host} ${vtag(r2.v ?? r2.backend)}. ${retention(r2, v.now)}${!canOpen(r2) ? ". This venue has no sandbox shell." : null}</p>${canOpen(r2) ? html`<div class="sx-kept__actions">${links(v, r2, "open", true)}${pinForm(v, r2)}</div>` : null}</li>`)}</ul>` : html`<p>${SANDBOX_WORDS.empty}</p>`}${(data5.hosts ?? []).filter((h2) => h2.more > 0).map((h2) => html`<p class="sx-p">${h2.name} has at least ${h2.more} more retained workspaces. Inspect its full list with pi-dispatch sandbox --list.</p>`)}`}`, "what each host still keeps");
+}
+function sandboxBrowser(v) {
+  if (!allowed3(v) || v.query?.gatewaySelect) return null;
+  const gateway = v.data?.browserGateways;
+  const count7 = gateway?.enabledHosts?.length ?? 0;
+  return card3("In this browser", html`<p class="sx-p">${SANDBOX_WORDS.browser}</p>${gateway?.problem ? html`<p class="sx-p" role="status">${gateway.problem}</p>` : html`<p class="sx-p">${count7 ? `${count7} ${count7 === 1 ? "host is" : "hosts are"} enrolled.` : "No host is enrolled in this console. Ask the host operator to configure the optional gateway."}${count7 ? html`<span class="sandbox-opener"> Choose Open in browser beside a registered shell in Open now.</span>` : null}</p>`}<p class="sx-p">Each opening needs your current operator token again. Only one browser window attaches at a time. Closing it keeps the original sandbox; what you type is not recorded.</p><p class="sx-p">First open a kept or prepared workspace in your own terminal. The browser never starts a container.</p><p class="sx-p">Browser terminals require a window wider than 760 pixels. On a phone, copy the command for your own terminal.</p>${v.readOnly ? html`<p class="sx-p">This console is read-only, so browser attachment is unavailable.</p>` : null}`, "optional, separate gateway", chip(count7 ? "Enabled per host" : "Off by default", { status: count7 ? "ok" : "idle", icon: "shield" }));
+}
+var SANDBOX_WORDS, report, allowed3, acts2, rows, card3, stamp, rowId2, canOpen, selected3, facts5, links, retention, pinForm, SANDBOX_PANELS;
+var init_sandboxes = __esm({
+  "src/console/panels/sandboxes.mjs"() {
+    init_html();
+    init_kit();
+    init_forges();
+    init_sandbox_links();
+    init_common();
+    init_loaded_words();
+    init_loaded_parts();
+    init_trigger_gets_view();
+    SANDBOX_WORDS = Object.freeze({
+      unavailable: "Sandbox information could not be read. Reload to try again; an unread host is not an empty host.",
+      empty: "No kept workspace was published. A worker publishes its retained workspaces while it is running.",
+      noShells: "No live sandbox shell was registered. A shell whose terminal stopped answering disappears when its short lease expires. An expired registration is not proof the container stopped; inspect its host if the terminal ended unexpectedly.",
+      browser: "A separate gateway can attach to an already-open sandbox. It is off by default and enabled by hand per host. Open in Terminal and copy-command support remain available.",
+      noScript: "Preparing, pinning, ending a shell and saving terminal targets require JavaScript for Preview and Confirm. Commands remain selectable and the settings form works without JavaScript."
+    });
+    report = (v) => v.data?.sandboxes;
+    allowed3 = (v) => v.role === "operator";
+    acts2 = (v) => allowed3(v) && !v.readOnly;
+    rows = (v) => (report(v)?.hosts ?? []).flatMap((h2) => (h2.rows ?? []).map((r2) => ({ ...r2, host: h2.name, hostStale: h2.stale, retentionHours: h2.retentionHours })));
+    card3 = (title2, body, sub2 = null, end = null) => card({ title: title2, sub: sub2, body, end });
+    stamp = (ms3) => Number.isFinite(ms3) ? timeHtml(ms3) : "not published";
+    rowId2 = (r2) => r2.id ?? r2.jobId;
+    canOpen = (r2) => !String(rowId2(r2)).startsWith("sha256:") && r2.canOpen !== false && ["local", "podman"].includes(r2.v ?? r2.backend);
+    selected3 = (v) => report(v)?.selected ?? {};
+    facts5 = (plan) => facts([
+      ["Image", plan.image ?? "not published"],
+      ["Size", plan.size ? `${plan.size.memMiB} MiB, ${plan.size.cpuCenti / 100} CPU` : "not published"],
+      ["Network", plan.egress?.armed ? "The host's job allowlist through its egress proxy" : "Open bridge, egress policy off"],
+      ["Credentials", "None in the shell"]
+    ]);
+    links = (v, r2, verb = "open", compact2 = false) => sandboxLinks({ id: rowId2(r2), host: r2.host, verb, compact: compact2, config: v.data?.sandboxHosts });
+    retention = (r2, now) => html`${r2.pin ? "Pinned" : "Kept"}${Number.isFinite(r2.until) ? html` until ${stamp(r2.until)}${r2.until <= now ? " (past its window; pin before opening)" : html`, ${ageText(r2.until - now)} left`}` : ": deadline not published"}`;
+    pinForm = (v, r2) => acts2(v) && canOpen(r2) ? actForm({ action: "sandbox-pin", hidden: [["host", r2.host], ["id", rowId2(r2)]], label: "Preview pin", icon: "clock" }) : null;
+    SANDBOX_PANELS = Object.freeze([["p-sb-run", sandboxFromRun], ["p-sb-new", sandboxNew], ["p-sb-open", sandboxOpen], ["p-sb-kept", sandboxKept], ["p-sb-browser", sandboxBrowser]]);
+  }
+});
+
+// src/zero-touch-view.mjs
+function breakdown(row2, repository = false) {
+  const out = { project: text3(row2?.project ?? row2?.id, 64), scopeId: scope(row2?.scopeId), name: text3(row2?.name ?? row2?.target ?? row2?.project ?? row2?.id) ?? "Unassigned", target: text3(row2?.target), runs: count5(row2?.runs), touched: count5(row2?.touched), rate: number3(row2?.rate), deltaPoints: Number.isFinite(row2?.deltaPoints) ? row2.deltaPoints : null, previousRate: number3(row2?.previousRate), streakDays: row2?.waitingPartial === true ? null : number3(row2?.streakDays), zeroTouch: row2?.zeroTouch === true && row2?.waitingPartial !== true, waitingNow: row2?.waitingPartial === true ? null : count5(row2?.waitingNow ?? row2?.waiting), waitingPartial: row2?.waitingPartial === true, topCause: CAUSES.includes(row2?.topCause) ? row2.topCause : null, causes: causes(row2?.causes), touchedRunIds: runIds(row2?.touchedRunIds) };
+  if (!repository) out.repositories = Array.isArray(row2?.repositories) ? row2.repositories.map((r2) => breakdown(r2, true)) : [];
+  return out;
+}
+function zeroTouchView(raw, { role = "viewer", windowDays = 30, nowMs: nowMs2 = 0 } = {}) {
+  const observed = raw?.coverage ?? raw?.window;
+  const unobserved2 = Array.isArray(observed?.reasons) && observed.reasons.includes("touch-index-unavailable") || observed?.partial === true && number3(observed.fromMs) !== null && observed.fromMs >= (number3(raw?.nowMs) ?? nowMs2);
+  if (!raw || typeof raw !== "object" || raw.state === "unavailable" || unobserved2) return { state: "unavailable", nowMs: nowMs2, windowDays, coverage: { partial: true, reasons: [] }, totals: {}, projects: [], causes: causes([]), trend: [], groups: [], fixes: [], fixesPartial: true, touchedRunIds: [], waitingRuns: [], ungroupedRunIds: [], grouping: { enabled: false, pending: 0, unassigned: 0, state: "disabled", sources: [] } };
+  const totals = raw.totals ?? raw.summary ?? {};
+  const coverage2 = raw.coverage ?? raw.window ?? {};
+  const out = {
+    state: "ready",
+    nowMs: number3(raw.nowMs) ?? nowMs2,
+    windowDays: [7, 30, 90].includes(raw.windowDays ?? raw.days) ? raw.windowDays ?? raw.days : windowDays,
+    coverage: { requestedFromMs: number3(coverage2.requestedFromMs), fromMs: number3(coverage2.fromMs), partial: coverage2.partial === true || coverage2.complete === false, reasons: Array.isArray(coverage2.reasons) ? coverage2.reasons.map((v) => text3(v)).filter(Boolean) : [] },
+    totals: { runs: count5(totals.runs), touched: count5(totals.touched), rate: number3(totals.rate), previousRate: number3(totals.previousRate), stopped: count5(totals.stopped), stoppedUnattributed: count5(totals.stoppedUnattributed), waitingHours: totals.waitingPartial === true ? null : number3(totals.waitingHours), waitingPartial: totals.waitingPartial === true, waitingUnknown: count5(totals.waitingUnknown), medianWaitMs: totals.waitingPartial === true ? null : number3(totals.medianWaitMs) ?? (number3(totals.medianWaitHours) === null ? null : totals.medianWaitHours * 36e5), pending: totals.waitingPartial === true ? null : count5(totals.pending ?? totals.waitingNow), draftAnswers: count5(totals.draftAnswers), deltaPoints: Number.isFinite(totals.deltaPoints) ? totals.deltaPoints : null },
+    projects: Array.isArray(raw.projects) ? raw.projects.map((r2) => breakdown(r2)) : [],
+    causes: causes(raw.causes),
+    trend: Array.isArray(raw.trend) ? raw.trend.slice(-8).map((r2) => ({ atMs: number3(r2?.atMs ?? r2?.at), rate: number3(r2?.rate), runs: count5(r2?.runs), touched: count5(r2?.touched), partial: r2?.partial === true })) : [],
+    waitingRuns: Array.isArray(raw.waitingRuns ?? totals.waitingNow) ? (raw.waitingRuns ?? totals.waitingNow).map((r2) => ({ runId: id5(r2?.runId ?? r2?.jobId), parkedAt: number3(r2?.parkedAt) })).filter((r2) => r2.runId && r2.parkedAt !== null) : [],
+    touchedRunIds: runIds(raw.touchedRunIds),
+    ungroupedRunIds: role === "operator" ? runIds(raw.ungroupedRunIds) : [],
+    groups: [],
+    fixes: [],
+    fixesPartial: raw.fixesPartial === true,
+    grouping: { enabled: raw.grouping?.enabled === true, partial: raw.grouping?.partial === true, pending: count5(raw.grouping?.pending), unassigned: count5(raw.grouping?.unassigned), state: ["ready", "ok", "disabled", "pending", "partial", "failed", "configuration-unavailable", "unavailable"].includes(raw.grouping?.state) ? raw.grouping.state : "disabled", sources: role === "operator" && Array.isArray(raw.grouping?.sources ?? raw.groupingStatuses) ? (raw.grouping?.sources ?? raw.groupingStatuses).map((r2) => ({ runId: id5(r2?.runId), status: ["unassigned", "pending", "assigned", "source-expired", "source-unavailable", "source-oversize", "candidates-expired", "group-limit", "stale", "refused", "failed"].includes(r2?.status) ? r2.status : "source-unavailable" })).filter((r2) => r2.runId) : [] }
+  };
+  out.fixes = Array.isArray(raw.fixes) ? raw.fixes.map((f3) => ({ id: id5(f3?.id), at: number3(f3?.at), undoneAt: number3(f3?.undoneAt), kind: ["instructions", "config"].includes(f3?.kind) ? f3.kind : "config", groupId: id5(f3?.groupId), reason: typeof f3?.reason === "string" && /^[a-z][a-z0-9-]{0,79}$/.test(f3.reason) ? f3.reason : null, triggerIndex: Number.isSafeInteger(f3?.triggerIndex) && f3.triggerIndex >= 0 ? f3.triggerIndex : null, beforeCount: number3(f3?.beforeCount), afterCount: number3(f3?.afterCount), spanMs: number3(f3?.spanMs), partial: f3?.partial !== false, subsequentRuns: count5(f3?.subsequentRuns), status: ["observing", "improved", "unchanged", "worse"].includes(f3?.status) ? f3.status : "observing" })).filter((f3) => f3.id) : [];
+  if (role === "operator") out.groups = Array.isArray(raw.groups) ? raw.groups.map((g) => ({ id: id5(g?.id), name: text3(g?.name, 120), scopeId: scope(g?.scopeId), repo: text3(g?.repo), project: text3(g?.project, 64), count: count5(g?.count), runIds: runIds(g?.runIds), status: ["open", "fixed", "unassigned"].includes(g?.status) ? g.status : "open", fixedAt: number3(g?.fixedAt), triggerIndex: Number.isSafeInteger(g?.triggerIndex) && g.triggerIndex >= 0 ? g.triggerIndex : null })).filter((g) => g.id) : [];
+  return out;
+}
+var CAUSES, id5, number3, count5, text3, scope, causes, runIds;
+var init_zero_touch_view = __esm({
+  "src/zero-touch-view.mjs"() {
+    CAUSES = Object.freeze(["question-answer", "approval-decision", "rerun", "config-fix", "steer", "cancel"]);
+    id5 = (v) => typeof v === "string" && /^[A-Za-z0-9._:-]{1,200}$/.test(v) ? v : null;
+    number3 = (v) => Number.isFinite(v) && v >= 0 ? v : null;
+    count5 = (v) => Number.isSafeInteger(v) && v >= 0 ? v : 0;
+    text3 = (v, max = 200) => typeof v === "string" && [...v].length <= max && !/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/.test(v) ? v : null;
+    scope = (v) => typeof v === "string" && /^[a-f0-9]{32,64}$/.test(v) ? v : null;
+    causes = (v) => CAUSES.map((cause) => ({ cause, count: count5(Array.isArray(v) ? v.find((row2) => row2?.cause === cause)?.count : v?.[cause]) }));
+    runIds = (v) => Array.isArray(v) ? [...new Set(v.map(id5).filter(Boolean))].slice(0, 5e3) : [];
+  }
+});
+
+// src/console/panels/zero-touch.mjs
+function delta(n3, previousRate = null) {
+  if (!Number.isFinite(n3)) return html`<span class="zt-tr">Previous interval not covered</span>`;
+  return html`<span class="${`zt-tr${n3 < 0 ? " tone-ok" : n3 > 0 ? " tone-attention" : ""}`}">${icon(n3 < 0 ? "chev" : n3 > 0 ? "chev-r" : "info", { size: "sm" })}<b>${n3 === 0 ? "no change" : `${n3 < 0 ? "down" : "up"} ${amount3(Math.abs(n3))} points`}</b>${previousRate === null ? null : html`<small>from ${pct2(previousRate)}</small>`}</span>`;
+}
+function coverage(m2) {
+  return html`<p class="zt-coverage" role="status">${m2.coverage.partial ? html`<b>Partial ${m2.windowDays}-day window.</b> Covered from ${date(m2.coverage.fromMs)} UTC. Older unknown runs are not counted as untouched.` : html`Whole ${m2.windowDays}-day window.`}${m2.coverage.reasons.length ? html` ${m2.coverage.reasons.join("; ")}.` : null}</p>`;
+}
+function spark(m2) {
+  const rows3 = m2.trend;
+  if (!rows3.some((r2) => Number.isFinite(r2.rate) && !r2.partial)) return html`<p class="zt-kps">Weekly trend is not covered yet.</p>`;
+  const top = Math.max(32, ...rows3.map((r2) => r2.rate ?? 0));
+  const x2 = (i2) => rows3.length === 1 ? 200 : i2 * 200 / (rows3.length - 1);
+  const y = (n3) => 56 - n3 / top * 56;
+  const segments = [];
+  let points = [];
+  for (const [i2, row2] of rows3.entries()) {
+    if (row2.rate === null || row2.partial) {
+      if (points.length) segments.push(points);
+      points = [];
+    } else points.push(`${svgNum(x2(i2), 0, 200)},${svgNum(y(row2.rate), 0, 56)}`);
+  }
+  if (points.length) segments.push(points);
+  const last = rows3[rows3.length - 1];
+  const label3 = `Rolling ${m2.windowDays}-day touch rate at weekly intervals: ${rows3.map((r2) => r2.partial || r2.rate === null ? "not covered" : pct2(r2.rate)).join(", ")}. Goal under 5 percent.`;
+  return html`<svg class="zt-spark" viewBox="-4 -4 208 64" preserveAspectRatio="none" role="img" aria-label="${label3}"><line class="zt-spark__goal" x1="0" x2="200" y1="${svgNum(y(5), 0, 56)}" y2="${svgNum(y(5), 0, 56)}"/>${segments.map((p) => html`<polyline class="zt-spark__l" points="${p.join(" ")}"/>`)}${last?.rate !== null && !last?.partial ? html`<circle class="zt-spark__d" cx="200" cy="${svgNum(y(last.rate), 0, 56)}" r="3.5"/>` : null}</svg><p class="zt-spark__ax"><span>${date(rows3[0]?.atMs)}</span><span>goal, dashed</span><span>now</span></p><p class="sr">${label3}</p>`;
+}
+function longest(m2) {
+  return [...m2.projects].filter((p) => p.streakDays !== null && !p.waitingNow).sort((a, b) => b.streakDays - a.streakDays)[0] ?? null;
+}
+function waitingHistory(m2) {
+  return m2.totals.waitingPartial ? html`<p class="zt-note" role="status">Waiting history is incomplete. An older park predates retained answer history; its current state and wait time are not known.</p>` : null;
+}
+function compact(m2) {
+  const best = longest(m2);
+  return html`<ul class="ztp-now"><li><span>${icon("flag", { size: "sm" })}Longest streak</span><b>${best ? `${best.name}, ${amount3(best.streakDays)} ${best.streakDays === 1 ? "day" : "days"}` : "Not enough history"}</b></li><li><span>${icon("clock", { size: "sm" })}Waited on a person</span><b>${m2.totals.waitingPartial ? "Not known" : `${amount3(m2.totals.waitingHours)}h, median ${span(m2.totals.medianWaitMs)}`}</b></li><li><span>${icon("edit", { size: "sm" })}Answered from a draft</span><b>${m2.totals.draftAnswers} ${m2.totals.draftAnswers === 1 ? "run" : "runs"}</b><span>${ZERO_TOUCH_WORDS.drafts}${m2.coverage.partial ? html` ${ZERO_TOUCH_WORDS.draftsPartial}` : null}</span></li><li><span>${icon("parked", { size: "sm" })}Waiting now</span><b>${m2.totals.waitingPartial ? "Not known" : `${m2.totals.pending} ${m2.totals.pending === 1 ? "run" : "runs"}`}</b>${m2.waitingRuns.slice(0, 3).map((r2) => html`<span>${link(r2.runId)}, ${span(m2.nowMs - r2.parkedAt)}</span>`)}</li></ul>${waitingHistory(m2)}`;
+}
+function zeroTouchRate(view) {
+  const m2 = model5(view);
+  return card({ title: `Touch rate, ${m2.windowDays} days`, body: html`${fail5(m2)}${m2.state === "ready" ? html`${kpi(m2.totals.runs ? pct2(m2.totals.rate) : "No runs", `${m2.totals.touched} of ${m2.totals.runs} runs needed a person`)}${spark(m2)}<p class="zt-kp"><span class="zt-kt">${icon("flag", { size: "sm" })}goal under 5%</span>${delta(m2.totals.deltaPoints, m2.totals.previousRate)}</p>${coverage(m2)}<p class="zt-kps">${m2.totals.stopped} stopped before they ran, outside the rate.${m2.totals.stoppedUnattributed > 0 ? html` ${m2.totals.stoppedUnattributed} stops have no recorded project or scope, so this selection may have more.` : null}</p><div class="zt-phone-summary">${compact(m2)}</div>` : null}` });
+}
+function zeroTouchStreak(view) {
+  const m2 = model5(view), best = longest(m2);
+  return card({ title: "Zero-touch streak", body: html`${fail5(m2)}${kpi(best ? `${amount3(best.streakDays)} ${best.streakDays === 1 ? "day" : "days"}` : "Not enough history", best ? `${best.name}, the longest now` : "30 days of observed activity establish a zero-touch project")}<p class="zt-kp">${m2.projects.filter((p) => p !== best).sort((a, b) => (b.streakDays ?? -1) - (a.streakDays ?? -1)).map((p) => p.waitingNow ? chip(`${p.name} waiting now`, { status: "parked", icon: "parked" }) : html`<span class="zt-kt">${p.name} ${p.streakDays === null ? "not known" : `${amount3(p.streakDays)} ${p.streakDays === 1 ? "day" : "days"}`}</span>`)}</p>` });
+}
+function zeroTouchWait(view) {
+  const m2 = model5(view);
+  if (m2.state !== "ready") return card({ title: "Waiting for a person", body: fail5(m2) });
+  return card({ title: "Waiting for a person", body: html`${fail5(m2)}${kpi(m2.totals.waitingPartial ? "Not known" : `${amount3(m2.totals.waitingHours)}h`, `runs waited on a person in ${m2.windowDays} days`)}<p class="zt-kps">Median wait for an answer <b>${span(m2.totals.medianWaitMs)}</b></p>${waitingHistory(m2)}<p class="zt-kp">${chip(m2.totals.waitingPartial ? "Pending count not known" : `${m2.totals.pending} waiting now`, { status: "parked", icon: "parked" })}${m2.waitingRuns.slice(0, 3).map((r2) => html`<span>${link(r2.runId)}, ${span(m2.nowMs - r2.parkedAt)}</span>`)}</p>` });
+}
+function zeroTouchHandled(view) {
+  const m2 = model5(view);
+  return card({ title: "Answered from a draft", body: m2.state !== "ready" ? fail5(m2) : html`${kpi(m2.totals.draftAnswers, "runs answered in the covered interval")}<p class="zt-kps">${ZERO_TOUCH_WORDS.drafts}</p>${m2.coverage.partial ? html`<p class="zt-kps" role="status">${ZERO_TOUCH_WORDS.draftsPartial}</p>` : null}` });
+}
+function meter3(row2) {
+  if (row2.rate === null) return html`<span class="zt-m">Not enough history</span>`;
+  const tone = row2.rate < 5 ? "ok" : row2.rate < 30 ? "attention" : "failed";
+  const word3 = row2.rate < 5 ? "Under goal" : row2.rate < 30 ? "Above goal" : "High";
+  return html`<span class="zt-m"><svg class="${`pbar tone-${tone}`}" height="10" role="meter" aria-valuenow="${svgNum(row2.rate, 0, 100)}" aria-valuemin="0" aria-valuemax="100" aria-label="${`${row2.name}: ${pct2(row2.rate)} of runs needed a person, goal under 5 percent; meter scale 40 percent`}"><rect class="pbar__bed" width="100%" height="10" rx="5"/><rect class="pbar__fill" width="${`${svgNum(row2.rate / 40 * 100, 0, 100)}%`}" height="10" rx="5"/><line class="zt-goal" x1="12.5%" x2="12.5%" y1="-4" y2="14"/></svg><span class="zt-mv"><b>${pct2(row2.rate)}</b><span class="${`zt-lv tone-${tone}`}">${icon(tone === "ok" ? "done" : "attention", { size: "sm" })}${word3}</span></span></span>`;
+}
+function rowContent(row2, sub2 = false) {
+  const c = causesByKey.get(row2.topCause);
+  return html`<span class="zt-chev">${sub2 ? null : icon("chev-r", { size: "sm" })}</span><span class="zt-name"><b>${row2.name}</b><small>${sub2 ? `${row2.runs} runs` : row2.repositories.map((r2) => r2.name).join(" and ")}</small></span>${meter3(row2)}${delta(row2.deltaPoints, row2.previousRate)}<span class="zt-n"><b>${row2.touched}</b> of ${row2.runs} runs</span><span class="${`zt-st${row2.waitingNow ? " tone-parked" : ""}`}">${icon(row2.waitingNow ? "parked" : "flag", { size: "sm" })}${row2.waitingPartial ? "waiting history incomplete" : row2.waitingNow ? "waiting now" : row2.zeroTouch ? "zero touch, 30+ days" : row2.streakDays === null ? "not enough history" : `${amount3(row2.streakDays)} ${row2.streakDays === 1 ? "day" : "days"}`}</span><span class="zt-c">${c ? html`<span class="${`zt-cause tone-${c.tone}`}">${icon(c.icon, { size: "sm" })}${c.short}</span>` : "No touches"}</span>`;
+}
+function phoneProjects(m2, view) {
+  const item2 = (row2, repository = false) => {
+    const c = causesByKey.get(row2.topCause), tone = row2.rate === null ? "idle" : row2.rate < 5 ? "ok" : row2.rate < 30 ? "attention" : "failed";
+    const word3 = row2.rate === null ? "Not known" : row2.rate < 5 ? "Under goal" : row2.rate < 30 ? "Above goal" : "High";
+    const query = new URLSearchParams({ days: String(m2.windowDays), ...row2.project ? { project: row2.project } : {}, ...repository && row2.scopeId ? { scope: row2.scopeId } : {} });
+    return html`<li><a class="ztp-p" href="${`/runs/zero-touch?${query}`}" aria-label="${`${row2.name}: ${pct2(row2.rate)}, open ${repository ? "repository" : "project"}`}"${repository ? html` data-repository` : null}><span class="ztp-p__n"><b>${row2.name}</b><small>${row2.touched} of ${row2.runs} runs</small></span><span class="ztp-p__r"><b>${pct2(row2.rate)}</b><span class="${`zt-lv tone-${tone}`}">${icon(tone === "ok" ? "done" : "attention", { size: "sm" })}${word3}</span></span><span class="ztp-p__c">${c ? html`<span class="${`zt-cause tone-${c.tone}`}">${icon(c.icon, { size: "sm" })}${c.short}</span>` : html`<span>No touches</span>`}${delta(row2.deltaPoints, row2.previousRate)}</span><span class="ztp-p__go">${icon("chev-r", { size: "sm" })}</span></a></li>`;
+  };
+  return html`<ul class="ztp-ps zt-phone-projects">${m2.projects.map((p) => html`${item2(p)}${view?.query?.project === p.project ? p.repositories.map((r2) => item2(r2, true)) : null}`)}</ul>`;
+}
+function zeroTouchProjects(view) {
+  const m2 = model5(view);
+  if (m2.state !== "ready") return card({ title: "By project", body: fail5(m2) });
+  const head = html`<div class="zt-row zt-row--head" aria-hidden="true"><span></span><span>Project</span><span>Touch rate, goal tick at 5%</span><span>Against the previous interval</span><span>Needed a person</span><span>Since the last touch</span><span>Most often</span></div>`;
+  const rows3 = m2.projects.map((p) => html`<li><details class="zt-p"${view?.query?.project === p.project ? html` open` : null}><summary class="zt-row" aria-label="${`${p.name}: ${pct2(p.rate)}, show its repositories or folders`}">${rowContent(p)}</summary><ul class="zt-subs">${p.repositories.map((r2) => html`<li class="zt-row zt-row--sub">${rowContent(r2, true)}</li>`)}</ul>${acts3(view) && p.touchedRunIds.length ? html`<p class="zt-foot"><a class="link" href="${`/runs?${new URLSearchParams({ project: p.project ?? "", touched: "1", days: String(m2.windowDays) })}`}">Open touched runs</a></p>` : null}</details></li>`);
+  return card({ title: "By project", sub: `${m2.totals.touched} of ${m2.totals.runs} runs needed a person`, flush: true, body: html`${fail5(m2)}${m2.projects.length ? html`<div class="zt-tbl zt-desktop-projects">${head}<ul class="zt-list">${rows3}</ul></div>${phoneProjects(m2, view)}<p class="zt-foot">${icon("info", { size: "sm" })}<span>A row opens to its repositories or folders. A run counts once, however many interventions it received.</span></p>` : html`<p class="zt-note">${ZERO_TOUCH_WORDS.empty}</p>`}` });
+}
+function causeCounts(values) {
+  return ZERO_TOUCH_CAUSES.map((c) => ({ ...c, count: values.find((v) => v.cause === c.cause)?.count ?? 0 }));
+}
+function causeBar(values, max, name2) {
+  const rows3 = causeCounts(values);
+  let at2 = 0;
+  max = Math.max(1, max, rows3.reduce((sum, row2) => sum + row2.count, 0));
+  const all = rows3.filter((r2) => r2.count > 0);
+  const label3 = `${name2}: ${all.map((r2) => `${r2.label} ${r2.count}`).join(", ") || "no touches"}; full scale ${max} touched runs`;
+  return html`<svg class="zt-cause-svg" width="100%" height="28" role="img" aria-label="${label3}">${all.map((r2) => {
+    const x2 = at2 / Math.max(1, max) * 500, w = r2.count / Math.max(1, max) * 500;
+    at2 += r2.count;
+    return html`<g class="${`tone-${r2.tone}`}"><rect class="zt-cause-rect" x="${`${svgNum(x2 / 5, 0, 100)}%`}" y="0" width="${`${svgNum(w / 5, 0, 100)}%`}" height="28" rx="5"/>${w >= 22 ? html`<text class="zt-cause-label" x="${`${svgNum((x2 + w / 2) / 5, 0, 100)}%`}" y="18" text-anchor="middle">${r2.count}</text>` : null}</g>`;
+  })}</svg>`;
+}
+function zeroTouchCauses(view) {
+  const m2 = model5(view), max = Math.max(1, ...m2.projects.map((p) => Math.max(p.touched, causeCounts(p.causes).reduce((sum, row2) => sum + row2.count, 0))));
+  if (m2.state !== "ready") return card({ title: "What needed a person", body: fail5(m2) });
+  const bars = m2.projects.map((p) => html`<li class="zt-cb"><span class="zt-cb__n"><b>${p.name}</b><small>${p.touched} of ${p.runs}</small></span>${causeBar(p.causes, max, p.name)}<p class="zt-cb__t">${causeCounts(p.causes).filter((c) => c.count).map((c) => `${c.short} ${c.count}`).join(" \xB7 ") || "No touches"}</p></li>`);
+  const scopeLabel = view?.query?.scope ? "selected repository" : view?.query?.project ? "selected project" : "all projects";
+  return card({ title: "What needed a person", sub: html`<span class="zt-desktop-label">last ${m2.windowDays} days, by project</span><span class="zt-phone-label">${m2.windowDays} days, ${scopeLabel}</span>`, body: html`${fail5(m2)}<ul class="zt-bars zt-desktop-causes">${bars}</ul><div class="zt-phone-causes">${causeBar(m2.causes, Math.max(1, m2.totals.touched), scopeLabel === "all projects" ? "All projects" : scopeLabel)}</div><ul class="zt-whys">${causeCounts(m2.causes).map((c) => html`<li class="zt-why">${tile(c.tone === "running" ? "running" : c.tone === "idle" ? "idle" : c.tone, { icon: c.icon, sm: true })}<span><b>${c.label}</b><small>${c.detail}</small></span><span class="zt-why__n">${c.count}</span></li>`)}<li class="zt-why zt-why--sum"><span></span><span><b>Runs that needed a person</b></span><span class="zt-why__n">${m2.totals.touched}</span></li></ul><p class="zt-merge">${icon("pr", { size: "sm" })}<span>Merging is never a touch. <a class="link" href="#zt-counting">How touches are counted</a></span></p><details class="zt-counting" id="zt-counting"><summary>How touches are counted</summary><p class="zt-kps">The rate counts workload runs with a retained record that ended in the covered interval. Each run counts once. Bars assign it to its first successful human intervention; later interventions remain in history. Jobs stopped before starting are separate. Reads, sandbox opens, automatic starts and internal grouping jobs do not enter the touch count.</p></details>` });
+}
+function guardedForm(action2, { hidden: hidden2 = [], fields: fields3 = null, label: label3, kind = ["sm"] } = {}) {
+  return html`<form class="act zt-action" data-action="${action2}" autocomplete="off"><fieldset data-config-controls disabled>${hidden2.map(([name2, value, type]) => html`<input type="hidden" name="${name2}" value="${value}"${type ? html` data-type="${type}"` : null}>`)}${fields3}${btn({ type: "submit", kind, label: label3 })}</fieldset><noscript><p class="zt-kps">${ZERO_TOUCH_NO_SCRIPT}</p></noscript><p class="field__err" data-form-error hidden role="alert"></p></form>`;
+}
+function nameForm(g, index2) {
+  const key2 = `zt-name-${index2}`;
+  return html`<details class="zt-editor"><summary class="link">${g.name ? "Rename this group" : "Name this group"}</summary>${guardedForm("zero-touch-name", { hidden: [["groupId", g.id]], fields: field2({ label: "Group name", id: key2, control: input({ id: key2, name: "name", value: g.name, required: true }), hint: "Write your own name, up to 120 characters. Question text is read only on its run page." }), label: "Preview name" })}</details>`;
+}
+function instructionForm(g, index2) {
+  if (!g.runIds[0] || g.triggerIndex === null) return html`<p class="zt-kps">Add to instructions is unavailable: a retained run and a current non-cron trigger are required.</p>`;
+  const key2 = `zt-sentence-${index2}`;
+  return html`<details class="zt-editor"><summary class="link">Add to instructions</summary>${guardedForm("zero-touch-instruction", { hidden: [["runId", g.runIds[0]], ["groupId", g.id], ["index", g.triggerIndex, "int"]], fields: field2({ label: "Sentence to add", id: key2, control: textarea({ id: key2, name: "sentence", required: true, rows: 3, maxlength: 2e3 }), hint: "Preview the exact diff, then Confirm. The trigger's existing instructions count toward the 2,000-character limit." }), label: `Preview trigger ${g.triggerIndex + 1}`, kind: ["sm", "primary"] })}</details>`;
+}
+function zeroTouchQuestions(view) {
+  if (view?.role !== "operator") return collapsed({ icon: "parked", title: "Questions it keeps asking", body: "are for operators. Rates, causes, streaks and fixes are shown here." });
+  const m2 = model5(view);
+  if (m2.state !== "ready") return card({ title: "Questions it keeps asking", body: fail5(m2) });
+  const rows3 = m2.groups.map((g, index2) => html`<li class="zt-q"><div class="zt-q__h"><span class="zt-q__n" aria-label="${`asked ${g.count} times`}">${g.count}×</span><div><p class="${`zt-q__t${g.name ? "" : " zt-q__t--un"}`}">${g.name ?? `${g.count} similar questions, not named yet`}</p><p class="zt-q__s"><span class="code">${g.repo ?? g.project ?? "Repository not known"}</span>${g.status === "fixed" && g.fixedAt !== null ? html` · fixed ${date(g.fixedAt)} UTC` : null}${g.status === "fixed" && m2.fixes.some((f3) => f3.groupId === g.id && f3.afterCount === 0 && f3.subsequentRuns > 0 && !f3.partial && f3.undoneAt === null) ? html` · none since` : null}</p></div><span class="zt-q__st">${chip(g.status === "fixed" ? "Fixed" : g.status === "unassigned" ? "Unassigned" : "Open", { status: g.status === "fixed" ? "ok" : "parked", icon: g.status === "fixed" ? "done" : "parked" })}</span></div><p class="zt-said">${icon("runs", { size: "sm" })}<span>Asked in ${g.runIds.slice(0, 8).map((id7, at2) => html`${at2 ? ", " : ""}${link(id7)}`)}${g.runIds.length > 8 ? ` and ${g.runIds.length - 8} more` : null}.</span></p>${acts3(view) ? html`<div class="zt-q__act">${nameForm(g, index2)}${g.status !== "fixed" ? instructionForm(g, index2) : html`<a class="link" href="#p-zt-fixes">See the fix</a>`}</div>` : null}</li>`);
+  const phoneRows = m2.groups.map((g, index2) => html`<li class="ztp-q"><span class="zt-q__n" aria-label="${`asked ${g.count} times`}">${g.count}×</span><span class="ztp-q__t"><b>${g.runIds[0] ? html`<a class="zt-group-link" href="${`/run?id=${encodeURIComponent(g.runIds[0])}`}">${g.name ?? `${g.count} similar, not named yet`}</a>` : g.name ?? `${g.count} similar, not named yet`}</b><small>${g.repo ?? g.project ?? "Repository not known"}</small></span><span class="ztp-q__st">${chip(g.status === "fixed" ? "Fixed" : g.status === "unassigned" ? "Unassigned" : "Open", { status: g.status === "fixed" ? "ok" : "parked", icon: g.status === "fixed" ? "done" : "parked" })}</span><span class="ztp-q__a">${acts3(view) ? g.status === "fixed" ? html`<a class="link" href="#p-zt-fixes">See the fix</a>` : g.name ? instructionForm(g, `phone-${index2}`) : nameForm(g, `phone-${index2}`) : null}</span></li>`);
+  const sources = m2.grouping.sources.length ? m2.grouping.sources : m2.ungroupedRunIds.map((runId2) => ({ runId: runId2, status: "unassigned" }));
+  return card({ title: "Questions it keeps asking", sub: "operator only", body: html`<p class="zt-intro">Grouped by meaning. You name each group; read the questions on their run pages.</p>${fail5(m2)}${m2.grouping.partial ? html`<p class="zt-note" role="status">Question grouping is partial. Missing or unclassified sources are not evidence that a question stopped recurring.</p>` : null}${["unavailable", "configuration-unavailable"].includes(m2.grouping.state) ? html`<p class="zt-note" role="status">${m2.grouping.state === "configuration-unavailable" ? "Grouping configuration could not be read. Check the reviewed triggers file before starting a grouping job." : "Question groups could not be read. Reload to retry; missing assignments are not an empty group list."}</p>` : null}${rows3.length ? html`<ol class="zt-qs zt-desktop-questions">${rows3}</ol><ol class="ztp-qs zt-phone-questions">${phoneRows}</ol>` : html`<p class="zt-kps">${["unavailable", "configuration-unavailable"].includes(m2.grouping?.state) ? "Grouping coverage is not known. Reload after the source is available." : ZERO_TOUCH_WORDS.noGroups}</p>`}${sources.length ? html`<ul class="zt-ungrouped">${sources.slice(0, 20).map((source2) => html`<li data-group-status="${source2.status}">${link(source2.runId)}<span>${ZERO_TOUCH_SOURCE_WORDS[source2.status]}</span>${acts3(view) && ["unassigned", "stale", "refused", "failed"].includes(source2.status) ? guardedForm("zero-touch-group", { hidden: [["runId", source2.runId]], label: "Group question", kind: ["sm", "paid"] }) : null}</li>`)}</ul>` : null}<p class="zt-foot zt-foot--in">${icon("info", { size: "sm" })}<span>${m2.grouping.enabled ? `${plural5(m2.grouping.pending, "grouping job")} pending; ${plural5(m2.grouping.unassigned, "question")} unassigned. Expired or unavailable context stays ungrouped.` : "Private capture and a capped classifier must be enabled in the reviewed zeroTouch configuration before questions can be grouped."}</span></p>` });
+}
+function fixTone(f3) {
+  if (f3.partial || f3.subsequentRuns === 0 || f3.undoneAt !== null || f3.status === "observing") return "idle";
+  return f3.status === "improved" ? "ok" : f3.status === "worse" ? "failed" : "idle";
+}
+function fixObservation(f3) {
+  if (f3.undoneAt !== null) return "Reverted: this observation does not establish current effectiveness.";
+  if (f3.partial) return "Partial observation: effectiveness is not established.";
+  if (f3.subsequentRuns === 0) return "No subsequent runs yet: effectiveness is not established.";
+  return f3.status === "improved" ? "Fewer occurrences over equal observed spans." : f3.status === "worse" ? "More occurrences over equal observed spans." : f3.status === "unchanged" ? "The same number of occurrences over equal observed spans." : "Still observing the targeted cause.";
+}
+function beforeAfter(label3, value, max, tone = "attention") {
+  return html`<p class="zt-ba"><span>${label3}</span><svg class="${`pbar tone-${tone}`}" height="8" role="img" aria-label="${`${label3}: ${value === null ? "not known" : value}`}"><rect class="pbar__bed" width="100%" height="8" rx="4"/>${value ? html`<rect class="pbar__fill" width="${`${svgNum(value / max * 100, 0, 100)}%`}" height="8" rx="4"/>` : null}</svg><b>${value ?? "?"}</b></p>`;
+}
+function zeroTouchFixes(view) {
+  const m2 = model5(view);
+  const evidence = html`${m2.fixesPartial ? html`<p class="zt-note" role="status">Fix history is incomplete. Reload to retry; missing changes are not evidence that no fix was made.</p>` : null}${m2.fixes.length ? html`<ol class="zt-fxs">${m2.fixes.map((f3) => html`<li class="zt-fx"><p class="zt-fx__d">${date(f3.at)} UTC${f3.undoneAt === null ? null : html` · Reverted ${date(f3.undoneAt)} UTC`}</p><p class="zt-fx__w">${f3.kind === "instructions" ? `Trigger ${f3.triggerIndex === null ? "not known" : f3.triggerIndex + 1}'s instructions gained a sentence` : "Configuration changed to address a refusal"}</p><p class="zt-fx__m">${f3.reason ? `${f3.reason} refusals` : "Questions in the targeted group"}, equal ${span(f3.spanMs)} spans before and after; ${f3.subsequentRuns} workload runs after the fix.</p>${beforeAfter("Before", f3.beforeCount, Math.max(f3.beforeCount ?? 0, f3.afterCount ?? 0, 1))}${beforeAfter("After", f3.afterCount, Math.max(f3.beforeCount ?? 0, f3.afterCount ?? 0, 1), fixTone(f3))}<p class="zt-kps">${fixObservation(f3)}</p>${acts3(view) && f3.kind === "instructions" && f3.undoneAt === null ? guardedForm("zero-touch-undo", { hidden: [["fixId", f3.id]], label: "Preview removing the sentence", kind: ["sm", "ghost"] }) : null}</li>`)}</ol>` : html`<p class="zt-kps">${m2.fixesPartial ? "Fix history is not known. Reload after the source is available." : ZERO_TOUCH_WORDS.noFixes}</p>`}`;
+  const brief = m2.fixes.map((f3) => `${f3.reason ?? "grouped questions"}: ${f3.beforeCount ?? "?"} to ${f3.afterCount ?? "?"}`).join("; ");
+  return card({ title: "Fixes that worked", sub: "what changed, and what it did", body: html`<div class="zt-desktop-fixes">${evidence}</div><details class="zt-phone-fixes"><summary>${icon("done", { size: "sm" })}<span><b>${m2.fixesPartial ? "Fix history incomplete" : `${m2.fixes.length} fixes recorded`}</b>${brief ? `: ${brief}. ` : ". "}<span class="link">Open observations</span></span></summary><div class="zt-fix-observations">${evidence}</div></details>` });
+}
+var ZERO_TOUCH_WORDS, ZERO_TOUCH_CAUSES, ZERO_TOUCH_SOURCE_WORDS, causesByKey, model5, acts3, pct2, amount3, date, span, link, fail5, ZERO_TOUCH_NO_SCRIPT, ZERO_TOUCH_PANELS;
+var init_zero_touch = __esm({
+  "src/console/panels/zero-touch.mjs"() {
+    init_common();
+    init_html();
+    init_kit();
+    init_zero_touch_view();
+    ZERO_TOUCH_WORDS = Object.freeze({ unavailable: "Zero touch could not be read. Reload to try again; missing history is never counted as zero touches.", empty: "No workload runs ended in the covered interval.", drafts: "Sent by a person, edited or as drafted. Each run still counts as a touch.", draftsPartial: "Partial history; this counts retained runs only.", viewer: "Questions it keeps asking are for operators. Rates, causes, streaks and fixes are shown here.", noGroups: "No question groups yet. Group retained questions with a capped decision job; name each group yourself.", noFixes: "No cause-linked fixes recorded yet. Start a change from a refusal or a question group to measure it here." });
+    ZERO_TOUCH_CAUSES = Object.freeze([
+      { cause: "question-answer", label: "Questions", short: "Questions", icon: "parked", tone: "parked", detail: "A person answered a parked question and the source session resumed." },
+      { cause: "approval-decision", label: "Approvals", short: "Approvals", icon: "shield", tone: "attention", detail: "A person approved or declined a request. System expiry is excluded." },
+      { cause: "rerun", label: "Failed or refused, then re-run", short: "Re-run", icon: "failed", tone: "failed", detail: "A person started a failed or refused run again." },
+      { cause: "config-fix", label: "Refused until config was fixed", short: "Config fixed", icon: "refused", tone: "refused", detail: "A confirmed configuration change explicitly targeted the refusal." },
+      { cause: "steer", label: "Steered", short: "Steered", icon: "steer", tone: "running", detail: "A person's steering message was delivered to the run." },
+      { cause: "cancel", label: "Cancelled", short: "Cancelled", icon: "cancel", tone: "idle", detail: "A person cancelled the run while it was active." }
+    ]);
+    ZERO_TOUCH_SOURCE_WORDS = Object.freeze({
+      unassigned: "Not grouped yet.",
+      pending: "A grouping job is pending.",
+      assigned: "Assigned to a question group.",
+      "source-expired": "The retained question context expired. Open the run to read what remains; a new grouping job cannot restore it.",
+      "source-unavailable": "The worker could not retain safe question context. Check transcript capture on the source host.",
+      "source-oversize": "The private question context exceeds its byte limit. It remains ungrouped rather than being cut.",
+      "candidates-expired": "A group's representative context expired. Review the groups before trying again.",
+      "group-limit": "The repository reached the bounded group limit. Review existing groups before trying again.",
+      stale: "The group revision changed during classification. Preview a fresh grouping job.",
+      refused: "The grouping job was refused. Open its run to see the policy reason.",
+      failed: "The grouping job failed. Open its run and review the failure before trying again."
+    });
+    causesByKey = new Map(ZERO_TOUCH_CAUSES.map((c) => [c.cause, c]));
+    model5 = (v) => zeroTouchView(v?.data?.zeroTouch, { role: v?.role, windowDays: v?.query?.days ?? 30, nowMs: v?.now ?? 0 });
+    acts3 = (v) => v?.role === "operator" && !v?.readOnly;
+    pct2 = (n3) => Number.isFinite(n3) ? `${Math.round(n3)}%` : "Not known";
+    amount3 = (n3) => Number.isFinite(n3) ? new Intl.NumberFormat("en-US", { maximumFractionDigits: 1 }).format(n3) : "Not known";
+    date = (n3) => Number.isFinite(n3) && n3 >= 0 && n3 <= 864e13 ? new Date(n3).toISOString().slice(0, 10) : "not known";
+    span = (ms3) => ms3 === null ? "not known" : ms3 >= 36e5 ? `${amount3(ms3 / 36e5)}h` : `${amount3(ms3 / 6e4)}m`;
+    link = (id7) => html`<a class="link code" href="${`/run?id=${encodeURIComponent(id7)}`}">${id7}</a>`;
+    fail5 = (m2) => m2.state === "unavailable" ? html`<p class="zt-note" role="status">${ZERO_TOUCH_WORDS.unavailable}</p>` : null;
+    ZERO_TOUCH_NO_SCRIPT = "Enable JavaScript to preview and confirm a change. Reading and navigation work without it.";
+    ZERO_TOUCH_PANELS = Object.freeze([["p-zt-rate", zeroTouchRate], ["p-zt-streak", zeroTouchStreak], ["p-zt-wait", zeroTouchWait], ["p-zt-handled", zeroTouchHandled], ["p-zt-projects", zeroTouchProjects], ["p-zt-causes", zeroTouchCauses], ["p-zt-questions", zeroTouchQuestions], ["p-zt-fixes", zeroTouchFixes]]);
+  }
+});
+
+// src/trigger-policy.mjs
+function triggerWhoMayFire(trigger2) {
+  const on = trigger2.on ?? trigger2;
+  const forge = trigger2.run?.kind ?? trigger2.forge;
+  const kind = on.type;
+  if (kind === "cron") return "This deployment's scheduler starts it on its schedule; an operator may fire it by hand.";
+  if (forge === "gitlab") return "The actor must be a GitLab project member with Developer access (30) or higher, including inherited membership.";
+  if (forge === "forgejo") return "The actor must have Forgejo repository owner, admin or write permission.";
+  if (forge === "azure") return "The actor must be an Azure DevOps project member admitted by the receiver's membership check.";
+  if (kind === "label") return "A collaborator applies the matching issue label; the label event supplies the approval.";
+  if (kind === "comment") return "The commenter's GitHub association must be OWNER, MEMBER or COLLABORATOR; the service's own comments are refused.";
+  const actions = Array.isArray(on.action) ? on.action : [];
+  const gates = [];
+  if (kind === "issue" || actions.includes("closed")) gates.push("The closer must have repository write access");
+  if (actions.includes("labeled")) gates.push("A collaborator-applied matching label supplies approval");
+  if (actions.includes("review_submitted")) gates.push("The reviewer's association must be OWNER, MEMBER or COLLABORATOR, regardless of the pull request author's association");
+  if (actions.some((a) => ["opened", "synchronize", "reopened"].includes(a))) gates.push("The pull request author's association must be OWNER, MEMBER or COLLABORATOR");
+  return `${gates.join(". ") || "The receiver checks the actor's authority for the configured event"}.`;
+}
+var init_trigger_policy = __esm({
+  "src/trigger-policy.mjs"() {
   }
 });
 
@@ -163425,7 +163742,7 @@ function projectSizing2(v) {
   const s2 = p.sizing;
   const dim = (label3, d, words) => html`<p class="proj-verdict"><b>${label3}: ${d?.suggested ? `suggest ${label3 === "Memory" ? gibText(d.suggested) : formatCpus(d.suggested) + " CPUs"}` : d?.reason === "not-enough-runs" ? "not enough runs" : d?.reason ?? "unknown"}.</b> ${(label3 === "Memory" ? memoryWords(words) : words) ?? "No suggestion could be read."}</p>`;
   const action2 = s2?.action;
-  return card6("Job size", html`${projectSizingChart(p)}${s2 ? html`${dim("Memory", s2.memory, s2.words?.memory)}${dim("CPUs", s2.cpu, s2.words?.cpu)}${[memoryWords(s2.words?.memoryHeld), s2.words?.memoryFact, s2.words?.cpuFact, memoryWords(s2.words?.refusal)].filter(Boolean).map(note2)}` : note2("No size suggestion could be read.")}${p.sizingUnreadable ? note2("The measurements or scoped limits could not be read completely.") : null}${note2("Measured inside the jobs, so advisory.")}${s2?.call && canAct(v) ? html`<p class="proj-sub">The exact call</p><div class="cmd"><code>${s2.call}</code><button class="btn btn--sm" type="button" data-copy hidden>Copy</button></div>${action2 ? note2(action2.row === null ? `Adds a scoped-limits row for project:${p.id}.` : `Applies to scoped-limits row ${action2.row}, project:${p.id}.`) : null}${canAct(v) && action2 ? actForm3(action2.action, { hidden: [...action2.index === void 0 ? [] : [["index", action2.index, "int"]], ["limit", JSON.stringify(action2.limit), "json"]], label: "Preview this size" }) : null}` : null}`, "peak memory per run, last 30 days");
+  return card6("Job size", html`${projectSizingChart(p)}${s2 ? html`${dim("Memory", s2.memory, s2.words?.memory)}${dim("CPUs", s2.cpu, s2.words?.cpu)}${[memoryWords(s2.words?.memoryHeld), s2.words?.memoryFact, s2.words?.cpuFact, memoryWords(s2.words?.refusal), s2.words?.memoryCeiling].filter(Boolean).map(note2)}` : note2("No size suggestion could be read.")}${p.sizingUnreadable ? note2("The measurements or scoped limits could not be read completely.") : null}${note2("Measured inside the jobs, so advisory.")}${s2?.call && canAct(v) ? html`<p class="proj-sub">The exact call</p><div class="cmd"><code>${s2.call}</code><button class="btn btn--sm" type="button" data-copy hidden>Copy</button></div>${action2 ? note2(action2.row === null ? `Adds a scoped-limits row for project:${p.id}.` : `Applies to scoped-limits row ${action2.row}, project:${p.id}.`) : null}${canAct(v) && action2 ? actForm3(action2.action, { hidden: [...action2.index === void 0 ? [] : [["index", action2.index, "int"]], ["limit", JSON.stringify(action2.limit), "json"]], label: "Preview this size" }) : null}` : null}`, "peak memory per run, last 30 days");
 }
 function projectRecent(v) {
   if (!ready(v)) return null;
@@ -172194,6 +172511,14 @@ var init_watch = __esm({
   }
 });
 
+// src/console/restart-notice.mjs
+var init_restart_notice = __esm({
+  "src/console/restart-notice.mjs"() {
+    init_kit();
+    init_html();
+  }
+});
+
 // src/console/session-ends.mjs
 function streamEndOf(v) {
   return typeof v === "string" && STREAM_ENDS.includes(v) ? v : null;
@@ -172260,6 +172585,7 @@ var init_shell = __esm({
     init_html();
     init_kit();
     init_pages();
+    init_restart_notice();
     init_pulse_icons();
     init_signin();
     init_theme();
@@ -174616,6 +174942,15 @@ import { createHash as createHash28 } from "node:crypto";
 function changesHtml(changes) {
   return (Array.isArray(changes) ? changes : []).map(([key2, before, after], i2) => html`${i2 > 0 ? ", " : null}${key2}: <b>${before}</b> to <b>${after}</b>`);
 }
+function plainBody(value, depth = 0) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+  if (typeof value === "number") return Number.isFinite(value);
+  if (depth >= BODY_DEPTH_MAX || typeof value !== "object") return false;
+  if (Array.isArray(value)) return value.length <= 256 && value.every((v) => plainBody(v, depth + 1));
+  const keys3 = Object.keys(value);
+  if (keys3.length > BODY_KEYS_MAX) return false;
+  return keys3.every((k) => plainBody(value[k], depth + 1));
+}
 function str4(body, key2, { required = false, max = 512 } = {}) {
   const v = body?.[key2];
   if (v === void 0 || v === null || v === "") {
@@ -175245,11 +175580,37 @@ function settingDone(out) {
   const sayable = typeof old === "string" && old.trim() !== "" || typeof old === "number" && Number.isFinite(old);
   return sayable ? `Changed ${key2} from ${String(old)} to ${value}` : `Changed ${key2} to ${value}`;
 }
+function pauseListShapeRefusal(windows) {
+  for (const [i2, w] of windows.entries()) {
+    const at2 = atIndex("pause window", i2);
+    if (w === null || typeof w !== "object" || Array.isArray(w)) return `${at2} is not an object`;
+    for (const [k, value] of Object.entries(w)) {
+      if (!PAUSE_WINDOW_FIELDS.includes(k)) return `${at2} has a field this file does not take (${PAUSE_WINDOW_FIELDS.join(", ")} only)`;
+      const plain = typeof value === "string" || k === "days" && Array.isArray(value) && value.every((d) => typeof d === "string");
+      if (!plain) return `${at2}: ${k} must be ${k === "days" ? "a list of weekday names" : "a string"}`;
+    }
+  }
+  return null;
+}
 function pauseListBack(out) {
   const unread2 = typeof out.beforeText === "string" && !Array.isArray(jsonOf(out.beforeText)?.windows);
   if (unread2) return { undo: twice(UNDO_SENTENCES.tooBig, UNDO_SENTENCES.tooBigAfter), inverse: null };
+  if (!pauseListGoesBack(out)) return { undo: twice(UNDO_SENTENCES.refusedList, UNDO_SENTENCES.refusedListAfter), inverse: null };
   return { undo: "Put the previous pause windows back", inverse: { action: "pause-windows", body: { windows: out.extra.before } } };
 }
+function pauseListGoesBack(out) {
+  const before = out.extra?.before;
+  if (!Array.isArray(before) || !plainBody({ windows: before }) || pauseListShapeRefusal(before) !== null) return false;
+  if (typeof out.beforeText !== "string") return true;
+  const held = heldPauseWindows(out.beforeText, out.target ?? "pause-windows.json");
+  if (held.problem) return false;
+  try {
+    parsePauseWindows(pauseWindowsText(held.doc, before), out.target ?? "pause-windows.json");
+    return true;
+  } catch {
+    return false;
+  }
+}
 function triggerEditBack(out) {
   const p = out.plan ?? {};
   const n3 = atIndex("trigger", p.index);
@@ -175344,7 +175705,7 @@ function adoptable(facts7, { name: name2, version }) {
 function actionNamed(name2) {
   return ACTIONS3.find((a) => a.name === name2) ?? null;
 }
-var BULK_MAX2, CANCEL_TIMEOUT_SENTENCE, JOB_ID_RE2, sha2563, digestOf, codeOf4, AGENT_POLICY_TITLES, rerunAuthorityDigest, atIndex, BadRequest, UNCHANGED, reserveTail, SNAPSHOT_TIMEOUT_MS, SNAPSHOT_TIMEOUT_SENTENCE, SWITCH_READ, SNAPSHOT_UNREAD_SENTENCE, SNAPSHOT_LATE, FILE_NEEDS, JOB_NEEDS, FLEET_NEEDS, TRIGGER_FORM, settingBar, pausePath, shownDir, pauseWindowsWhole, writePause, writeTriggersOf, writeSettingsOf, writeLimitsOf, writeProjectsOf, configActions, failedLine2, drawable, CANCEL_QUEUED_LINE, jobActions, SWITCH_QUEUES_NAMED, SWITCH_SHORT_LINES, queueUnreadRefusal, RESUME_WAITING_UNKNOWN, fleetActions, UNDO_SENTENCES, twice, DELETED, resumeManyUndo, listBefore, byHand, say, none, confirmWord, rerunCancel, replacedOne, whereOf2, bulkDone, PAUSE_FIELDS, WRITE_RULES, PAUSE_EDIT, LIMIT_EDIT, RULE_FNS, zeroTouchActions, modelRoleActions, triggerEnvironmentActions, sandboxActions, deviceActions, boardActions, stagedRow, packageActions, CONFIG_FIX_ACTIONS, ACTIONS3;
+var BULK_MAX2, CANCEL_TIMEOUT_SENTENCE, JOB_ID_RE2, BODY_DEPTH_MAX, BODY_KEYS_MAX, sha2563, digestOf, codeOf4, AGENT_POLICY_TITLES, rerunAuthorityDigest, atIndex, BadRequest, UNCHANGED, reserveTail, SNAPSHOT_TIMEOUT_MS, SNAPSHOT_TIMEOUT_SENTENCE, SWITCH_READ, SNAPSHOT_UNREAD_SENTENCE, SNAPSHOT_LATE, FILE_NEEDS, JOB_NEEDS, FLEET_NEEDS, TRIGGER_FORM, settingBar, pausePath, shownDir, pauseWindowsWhole, writePause, writeTriggersOf, writeSettingsOf, writeLimitsOf, writeProjectsOf, configActions, failedLine2, drawable, CANCEL_QUEUED_LINE, jobActions, SWITCH_QUEUES_NAMED, SWITCH_SHORT_LINES, queueUnreadRefusal, RESUME_WAITING_UNKNOWN, fleetActions, UNDO_SENTENCES, twice, DELETED, resumeManyUndo, listBefore, byHand, say, none, confirmWord, rerunCancel, replacedOne, whereOf2, bulkDone, PAUSE_FIELDS, WRITE_RULES, PAUSE_EDIT, LIMIT_EDIT, RULE_FNS, zeroTouchActions, modelRoleActions, triggerEnvironmentActions, sandboxActions, deviceActions, boardActions, stagedRow, packageActions, CONFIG_FIX_ACTIONS, ACTIONS3;
 var init_actions = __esm({
   "src/console/actions.mjs"() {
     init_package_canary_record();
@@ -175381,6 +175742,8 @@ var init_actions = __esm({
     BULK_MAX2 = 100;
     CANCEL_TIMEOUT_SENTENCE = "no worker acknowledged: the job may have just finished, gone back to the queue (cancel it again to remove it), or its host is unreachable; nothing was changed";
     JOB_ID_RE2 = /^[A-Za-z0-9._:-]{1,200}$/;
+    BODY_DEPTH_MAX = 8;
+    BODY_KEYS_MAX = 64;
     sha2563 = (text4) => createHash28("sha256").update(text4).digest("hex");
     digestOf = (text4) => text4 === null || text4 === void 0 ? null : sha2563(text4);
     codeOf4 = (e2) => typeof e2?.code === "string" && /^[A-Z0-9_]{1,40}$/.test(e2.code) ? e2.code : "error";
@@ -175411,15 +175774,8 @@ var init_actions = __esm({
       needs: [],
       async preview(body, ctx) {
         if (!Array.isArray(body.windows)) return { refusal: 'send {"windows": [...]} with the whole new list of pause windows' };
-        for (const [i2, w] of body.windows.entries()) {
-          const at2 = atIndex("pause window", i2);
-          if (w === null || typeof w !== "object" || Array.isArray(w)) return { refusal: `${at2} is not an object; nothing was changed` };
-          for (const [k, value] of Object.entries(w)) {
-            if (!PAUSE_WINDOW_FIELDS.includes(k)) return { refusal: `${at2} has a field this file does not take (${PAUSE_WINDOW_FIELDS.join(", ")} only); nothing was changed` };
-            const plain = typeof value === "string" || k === "days" && Array.isArray(value) && value.every((d) => typeof d === "string");
-            if (!plain) return { refusal: `${at2}: ${k} must be ${k === "days" ? "a list of weekday names" : "a string"}; nothing was changed` };
-          }
-        }
+        const shape2 = pauseListShapeRefusal(body.windows);
+        if (shape2) return { refusal: `${shape2}; nothing was changed` };
         const path6 = ctx.config.pauseWindowsPath;
         const snap = readNow(ctx.fs, path6);
         if (snap.refusal) return snap;
@@ -176097,6 +176453,8 @@ var init_actions = __esm({
       envelopeAfter: "Set it back with the envelope form: the console kept no copy of the old values.",
       tooBig: "Put the previous list back by hand: this preview showed it; the console keeps no copy.",
       tooBigAfter: "Put the previous list back by hand: the console kept no copy of it.",
+      refusedList: "Put the previous list back by hand: the console would refuse it as an Undo (a window it does not take, or more than 256 windows or days); this preview showed it, and the console keeps no copy.",
+      refusedListAfter: "Put the previous list back by hand: the console would refuse it as an Undo (a window it does not take, or more than 256 windows or days), and kept no copy of it.",
       resumeUnread: "Pause the queues that were paused again by hand: the fleet was not read before the resume, so which they were is not known.",
       resumeShort: "Pause the queues that were paused again by hand: not every queue was read before the resume, so which they were is not fully known."
     });
@@ -178059,8 +178417,8 @@ var init_setup_wizard = __esm({
     init_connection();
     init_service_env();
     init_index();
-    RUNTIME_VERSION = "5.1.0";
-    RECEIVER_VERSION = "5.1.0";
+    RUNTIME_VERSION = "5.2.1";
+    RECEIVER_VERSION = "5.2.1";
     RUNTIME_PKG = "@edgehero/pi-dispatch";
     RECEIVER_PKG = "@edgehero/pi-dispatch-receiver";
     NUDGE_MARKER_BASENAME = "pi-dispatch-setup.nudged";
@@ -179940,7 +180298,7 @@ The project's runs could not be read (${sizing.unreachable}).`;
     if (dim.held === "largest") return `no larger size (${dim.reason}: ${words})`;
     return dim.reason === "not-enough-runs" ? notEnoughRunsText(dim, shown3 === formatCpus ? cpusText : shown3) : "fits";
   };
-  const facts7 = [s2.words.memoryFact, s2.words.cpuFact].filter(Boolean);
+  const facts7 = [s2.words.memoryFact, s2.words.cpuFact, s2.words.memoryCeiling].filter(Boolean);
   return `
 Project ${id7}'s runs (the last ${SUGGEST_WINDOW_DAYS} days, measured inside the jobs, so advisory): size now ${formatMemory(m2.current)}, ${cpusText(c.current)}; ${peaks}. They suggest memory ${said(m2, s2.words.memory, formatMemory)}, CPUs ${said(c, s2.words.cpu, formatCpus)}.${facts7.length > 0 ? ` ${facts7.map((f3) => `${f3[0].toUpperCase()}${f3.slice(1)}.`).join(" ")}` : ""}`;
 }