@reddoorla/maintenance 0.87.0 → 0.88.3

package/dist/{health-mirror-L5JBEJVA.js → health-mirror-GCDN7BJL.js}

@@ -1,7 +1,10 @@
+import {
+  TURSO_IS_AUTHORITATIVE
+} from "./chunk-RUPPWAD6.js";
 import {
   mirrorHealthFields,
   mirrorScheduleFields
-} from "./chunk-HHMMUR4P.js";
+} from "./chunk-GQDDWYU2.js";
 import "./chunk-P6AORG32.js";
 import "./chunk-F3JWOPTG.js";
 import "./chunk-VAD43MOR.js";
@@ -9,26 +12,28 @@ import "./chunk-7NYN2P6I.js";
 import {
   openDb,
   readDbConfig
-} from "./chunk-JHGHLKFS.js";
-import "./chunk-3SF7D4DY.js";
+} from "./chunk-WS6NU475.js";
+import "./chunk-MFHS7IQ2.js";
 import "./chunk-6VAL7XJT.js";
 
 // src/audits/health-mirror.ts
-async function makeHealthMirrorBestEffort(open = () => openDb(readDbConfig())) {
+async function makeHealthMirrorBestEffort(open = () => openDb(readDbConfig()), strict = TURSO_IS_AUTHORITATIVE) {
   let db;
   try {
     db = await open();
   } catch (e) {
+    if (strict) throw new Error(`health-mirror unavailable: ${String(e)}`, { cause: e });
     console.error(`[health-mirror] mirroring disabled: no libSQL (${String(e)})`);
     return null;
   }
   return (siteId, fields) => mirrorHealthFields(db, siteId, fields);
 }
-async function makeScheduleMirrorBestEffort(open = () => openDb(readDbConfig())) {
+async function makeScheduleMirrorBestEffort(open = () => openDb(readDbConfig()), strict = TURSO_IS_AUTHORITATIVE) {
   let db;
   try {
     db = await open();
   } catch (e) {
+    if (strict) throw new Error(`schedule-mirror unavailable: ${String(e)}`, { cause: e });
     console.error(`[schedule-mirror] mirroring disabled: no libSQL (${String(e)})`);
     return null;
   }
@@ -38,4 +43,4 @@ export {
   makeHealthMirrorBestEffort,
   makeScheduleMirrorBestEffort
 };
-//# sourceMappingURL=health-mirror-L5JBEJVA.js.map
+//# sourceMappingURL=health-mirror-GCDN7BJL.js.map

package/dist/health-mirror-GCDN7BJL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/audits/health-mirror.ts"],"sourcesContent":["import { openDb, readDbConfig, type Db } from \"../db/client.js\";\nimport { mirrorHealthFields, mirrorScheduleFields } from \"../db/fleet-state.js\";\nimport { TURSO_IS_AUTHORITATIVE } from \"../db/freeze.js\";\n\n/** One site's just-written Airtable FieldSet, mirrored into site_health.\n *  Resolves true when a site_health row matched; false when the UPDATE touched\n *  0 rows (site created in Airtable after the last hourly import) — callers\n *  count that as mirror_missed, never as mirrored. */\nexport type HealthMirror = (siteId: string, fields: Record<string, unknown>) => Promise<boolean>;\n\n/** The site_schedule twin, for the nightly next-due write-back. Same\n *  matched-row contract as {@link HealthMirror}: false = 0-row UPDATE →\n *  mirror_missed. */\nexport type ScheduleMirror = (\n  siteId: string,\n  fields: Record<string, unknown>,\n  computedAt: string,\n) => Promise<boolean>;\n\n/** Build the Turso write-through for the nightly writers (#539 Phase 3\n *  dual-write), or null when libSQL creds are absent — mirroring NOT attempted\n *  is a different outcome than mirroring failed, and the caller's summary line\n *  reports mirror counts only when a mirror existed. Same contract as\n *  recordFleetEventsBestEffort: the mirror must never fail the sweep that\n *  produced the data (per-site failures are the caller's to count; Airtable\n *  stays authoritative and the hourly sync converges whatever the mirror\n *  missed). `open` is injectable for tests. */\nexport async function makeHealthMirrorBestEffort(\n  open: () => Promise<Db> = () => openDb(readDbConfig()),\n  /** #612. `true` = Turso is the only store, so \"mirroring disabled\" is no\n   *  longer a survivable state: returning null would discard every write in the\n   *  sweep with nothing to converge it. Throws instead. Injected by tests so\n   *  both sides stay proven. */\n  strict: boolean = TURSO_IS_AUTHORITATIVE,\n): Promise<HealthMirror | null> {\n  let db: Db;\n  try {\n    db = await open();\n  } catch (e) {\n    if (strict) throw new Error(`health-mirror unavailable: ${String(e)}`, { cause: e });\n    console.error(`[health-mirror] mirroring disabled: no libSQL (${String(e)})`);\n    return null;\n  }\n  return (siteId, fields) => mirrorHealthFields(db, siteId, fields);\n}\n\n/** {@link makeHealthMirrorBestEffort}'s schedule twin — same null-without-creds\n *  contract, for `writeNextDueDates`' site_schedule write-through. */\nexport async function makeScheduleMirrorBestEffort(\n  open: () => Promise<Db> = () => openDb(readDbConfig()),\n  /** #612 — same contract as {@link makeHealthMirrorBestEffort}'s. */\n  strict: boolean = TURSO_IS_AUTHORITATIVE,\n): Promise<ScheduleMirror | null> {\n  let db: Db;\n  try {\n    db = await open();\n  } catch (e) {\n    if (strict) throw new Error(`schedule-mirror unavailable: ${String(e)}`, { cause: e });\n    console.error(`[schedule-mirror] mirroring disabled: no libSQL (${String(e)})`);\n    return null;\n  }\n  return (siteId, fields, computedAt) => mirrorScheduleFields(db, siteId, fields, computedAt);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA2BA,eAAsB,2BACpB,OAA0B,MAAM,OAAO,aAAa,CAAC,GAKrD,SAAkB,wBACY;AAC9B,MAAI;AACJ,MAAI;AACF,SAAK,MAAM,KAAK;AAAA,EAClB,SAAS,GAAG;AACV,QAAI,OAAQ,OAAM,IAAI,MAAM,8BAA8B,OAAO,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;AACnF,YAAQ,MAAM,kDAAkD,OAAO,CAAC,CAAC,GAAG;AAC5E,WAAO;AAAA,EACT;AACA,SAAO,CAAC,QAAQ,WAAW,mBAAmB,IAAI,QAAQ,MAAM;AAClE;AAIA,eAAsB,6BACpB,OAA0B,MAAM,OAAO,aAAa,CAAC,GAErD,SAAkB,wBACc;AAChC,MAAI;AACJ,MAAI;AACF,SAAK,MAAM,KAAK;AAAA,EAClB,SAAS,GAAG;AACV,QAAI,OAAQ,OAAM,IAAI,MAAM,gCAAgC,OAAO,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;AACrF,YAAQ,MAAM,oDAAoD,OAAO,CAAC,CAAC,GAAG;AAC9E,WAAO;AAAA,EACT;AACA,SAAO,CAAC,QAAQ,QAAQ,eAAe,qBAAqB,IAAI,QAAQ,QAAQ,UAAU;AAC5F;","names":[]}

package/dist/index.d.ts

@@ -1500,9 +1500,12 @@ type CockpitModel = {
     /** NEW submissions across the fleet, newest-first (optional for back-compat). */
     submissions?: SubmissionEntry[];
     /** Fleet spam totals over the window (optional; populated by buildCockpitModel). */
+    /** `computedAt` present ⇒ these came from the nightly roll-up and are up to
+     *  24h old; the strip labels them so a stale number is never read as live. */
     spam?: {
         caught: number;
         through: number;
+        computedAt?: string;
     } | null;
     /** Recent fleet-activity events for the "Recently" lane (optional for back-compat). */
     recent?: RecentEntry[];

package/dist/index.js

@@ -1,19 +1,18 @@
 import "./chunk-2SLED3NB.js";
-import "./chunk-NCMZMLY7.js";
 import {
   draftReportForSite
-} from "./chunk-BBUSGEES.js";
-import {
-  approveBlockers
-} from "./chunk-SDDPUAWH.js";
-import {
-  findDueReports
-} from "./chunk-PZR4EBPY.js";
+} from "./chunk-J3WEZGIN.js";
 import {
   DEFAULT_INIT_STEPS,
   a11yFixturesPage,
   init
-} from "./chunk-TD2NNXLZ.js";
+} from "./chunk-XSOINOPY.js";
+import {
+  convertToPnpm
+} from "./chunk-XIDUYLSR.js";
+import {
+  svelteCodemods
+} from "./chunk-IYSEC543.js";
 import "./chunk-BQRFQSGY.js";
 import "./chunk-Y53WOQIJ.js";
 import {
@@ -29,18 +28,20 @@ import "./chunk-R53VL3RI.js";
 import {
   upgradeSvelte4to5
 } from "./chunk-Z3KYFUN6.js";
+import "./chunk-J7SZQUCW.js";
+import "./chunk-WPL5GERE.js";
 import {
-  convertToPnpm
-} from "./chunk-XIDUYLSR.js";
+  approveBlockers
+} from "./chunk-6I6L3CMX.js";
 import {
-  svelteCodemods
-} from "./chunk-IYSEC543.js";
-import "./chunk-J7SZQUCW.js";
+  findDueReports
+} from "./chunk-PZR4EBPY.js";
 import {
   parseAddresses,
   sendApprovedReports,
   withGlobalCc
-} from "./chunk-NDWYJLRF.js";
+} from "./chunk-DGZWFI2G.js";
+import "./chunk-BRYXFH77.js";
 import "./chunk-NYUYNYQL.js";
 import {
   isPendingApproval
@@ -52,28 +53,28 @@ import {
 } from "./chunk-VAD43MOR.js";
 import {
   fromAirtableBase
-} from "./chunk-C6CLRKPV.js";
+} from "./chunk-PR343K7F.js";
 import "./chunk-IY6256GK.js";
 import "./chunk-HN6I2XWI.js";
-import "./chunk-ZGBEIWSC.js";
+import "./chunk-XP5WM2LV.js";
 import "./chunk-GECESMVS.js";
+import {
+  domainFromUrl,
+  generateHeaderImage,
+  loadHeadline,
+  loadPlate
+} from "./chunk-5UINJNAJ.js";
 import {
   BLURRED_CID,
   CHECK_CID,
   loadBundledImages,
   renderReportHtml,
   rendersCommentary
-} from "./chunk-MT2JINSS.js";
+} from "./chunk-KJGKZLCT.js";
 import {
   escapeHtml,
   safeUrl
-} from "./chunk-DJZWYIPP.js";
-import {
-  domainFromUrl,
-  generateHeaderImage,
-  loadHeadline,
-  loadPlate
-} from "./chunk-5UINJNAJ.js";
+} from "./chunk-BGTYPVLT.js";
 import {
   CANONICAL_STATUSES,
   SEVERITY_RANK,
@@ -95,18 +96,18 @@ import {
   runAudits,
   runAuditsAcross,
   securityAudit
-} from "./chunk-3JQ2FO3D.js";
+} from "./chunk-B23FFWU4.js";
 import "./chunk-LKGVSM2O.js";
 import "./chunk-GASBX52O.js";
 import "./chunk-XHHMM5HX.js";
 import {
   fromJsonFile,
   localPath
-} from "./chunk-6TWWY7ZU.js";
-import "./chunk-XUGSZP7Z.js";
-import "./chunk-EVBCK2KC.js";
-import "./chunk-JHGHLKFS.js";
-import "./chunk-3SF7D4DY.js";
+} from "./chunk-Z3JXLULD.js";
+import "./chunk-W45FZEGE.js";
+import "./chunk-RARREDQE.js";
+import "./chunk-WS6NU475.js";
+import "./chunk-MFHS7IQ2.js";
 import "./chunk-A3WDWNN5.js";
 import {
   isLeadFormType
@@ -121,7 +122,7 @@ import "./chunk-LBYOLBW7.js";
 import "./chunk-XXTZBPUY.js";
 import "./chunk-6VAL7XJT.js";
 import "./chunk-NMAWXBJA.js";
-import "./chunk-C6B4RHXR.js";
+import "./chunk-O3GT46R2.js";
 
 // src/recipes/index.ts
 var ALL_RECIPE_NAMES = [
@@ -324,6 +325,7 @@ var WATCH_CONDITION_OPTIONS = [
   "stale repo",
   "no custom domain"
 ];
+var CLEAR_SECRET = "__clear__";
 
 // src/dashboard/render.ts
 var DASH = "\u2014";
@@ -615,8 +617,26 @@ var DETAIL_VALUE_FN = `function detailValue(el) {
       if (el.multiple) return Array.from(el.selectedOptions).map((o) => o.value).join(",");
       return el.value;
     }`;
+var SAVE_DETAIL_FN = `function saveDetail(el, root) {
+      const span = root.querySelector('.detail-saved[data-for="' + el.dataset.detailField + '"]');
+      return fetch(el.dataset.detailsUrl, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ field: el.dataset.detailField, value: detailValue(el) }),
+      })
+        .then((r) => {
+          if (span) span.textContent = r.ok ? " \\u2713" : " \\u2717";
+          if (r.ok && "defaultValue" in el) el.defaultValue = el.value;
+        })
+        .catch(() => {
+          if (span) span.textContent = " \\u2717";
+        });
+    }`;
+function toDateInputValue(value) {
+  return (value ?? "").slice(0, 10);
+}
 function dateRow(label, field, value, url) {
-  return `<div class="detail"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><input type="date" id="detail-${field}" data-detail-field="${field}" data-details-url="${url}" value="${escapeHtml(value ?? "")}" />${savedSpan(field)}</dd></div>`;
+  return `<div class="detail"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><input type="date" id="detail-${field}" data-detail-field="${field}" data-details-url="${url}" value="${escapeHtml(toDateInputValue(value))}" />${savedSpan(field)}</dd></div>`;
 }
 function checkboxRow(label, field, checked, url) {
   return `<div class="detail"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><input type="checkbox" id="detail-${field}" data-detail-field="${field}" data-details-url="${url}"${checked ? " checked" : ""} />${savedSpan(field)}</dd></div>`;
@@ -629,7 +649,7 @@ function multiSelectRow(label, field, options, selected, url) {
   return `<div class="detail wide"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><select multiple id="detail-${field}" data-detail-field="${field}" data-details-url="${url}">${opts}</select>${savedSpan(field)}</dd></div>`;
 }
 function secretRow(label, field, isSet, url) {
-  const ph = isSet ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022 (set \u2014 type to replace)" : "not set";
+  const ph = isSet ? `\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022 (type to replace, or ${CLEAR_SECRET} to erase)` : "not set";
   return `<div class="detail"><dt><label for="detail-${field}">${escapeHtml(label)}</label></dt><dd><input type="password" autocomplete="off" id="detail-${field}" data-detail-field="${field}" data-details-url="${url}" placeholder="${escapeHtml(ph)}" />${savedSpan(field)}</dd></div>`;
 }
 function textareaRow(label, field, value, url) {
@@ -899,9 +919,18 @@ function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = n
   ${spamScreenSection(spamTotals, submissions, now)}
   ${submissionsSection(submissions, site)}
   <script>
+    // The SAME pending report is rendered twice \u2014 once in the pending list, once
+    // in the reports history \u2014 so one report id owns two Approve buttons. Every
+    // state change has to reach both, or the two places you look disagree: one
+    // says "Approved", the other still says "Approve" and (with the gate clear)
+    // is still enabled.
+    function approveButtonsFor(id) {
+      return Array.from(document.querySelectorAll('button.approve[data-report-id="' + id + '"]'));
+    }
     document.querySelectorAll("button.approve").forEach((b) => {
       b.addEventListener("click", async () => {
-        b.disabled = true;
+        const twins = approveButtonsFor(b.dataset.reportId);
+        twins.forEach((t) => { t.disabled = true; });
         // is-loading swaps the label for a spinner; aria-busy is the same news for a
         // screen reader, which cannot see it. Both are cleared in the finally below so
         // no exit path can strand the button spinning forever.
@@ -910,30 +939,41 @@ function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = n
         try {
           const res = await fetch(b.dataset.approveUrl, { method: "POST" });
           if (res.ok) {
-            b.textContent = "Approved";
-            // Terminal success: darker green, and it stays disabled (approving twice is
-            // a no-op server-side, but the button should not invite the second click).
-            b.classList.add("is-approved");
+            // Terminal success: darker green, and they stay disabled (approving twice
+            // is a no-op server-side, but the button should not invite the second
+            // click). Applied to every twin, not just the one that was clicked.
+            twins.forEach((t) => {
+              t.textContent = "Approved";
+              t.classList.add("is-approved");
+            });
           } else {
             // A 409 carries { reason, blockers } \u2014 surface WHY instead of a bare
             // "Failed" next to a possibly-stale green chip. textContent/title
             // assignment only (no innerHTML), so server strings stay inert.
             const data = await res.json().catch(() => null);
-            b.textContent = data && data.reason === "send-blocked" ? "Blocked" : "Failed";
+            const label = data && data.reason === "send-blocked" ? "Blocked" : "Failed";
             // Double-backslash, NOT single: this whole block lives inside the renderer's
             // template literal, so a single-backslash escape is consumed HERE at build
             // time and emits a real newline into the served HTML \u2014 an unterminated string
             // literal that kills the parse of the entire script element, taking every
             // handler on the page with it (exactly how approve/override/renovate went
             // dead). Note this comment must also avoid backticks for the same reason.
-            if (data && Array.isArray(data.blockers)) b.title = data.blockers.join("\\n");
-            b.disabled = false;
+            const title = data && Array.isArray(data.blockers) ? data.blockers.join("\\n") : null;
+            // Re-enable EVERY twin, not just the clicked one \u2014 leaving the other
+            // disabled would strand it reading "Approve" and unusable.
+            twins.forEach((t) => {
+              t.textContent = label;
+              if (title !== null) t.title = title;
+              t.disabled = false;
+            });
           }
         } catch {
           // Network rejection (offline, DNS, abort): mirror the !res.ok path so
-          // the button doesn't sit permanently disabled reading "Approve".
-          b.textContent = "Failed";
-          b.disabled = false;
+          // the buttons don't sit permanently disabled reading "Approve".
+          twins.forEach((t) => {
+            t.textContent = "Failed";
+            t.disabled = false;
+          });
         } finally {
           b.classList.remove("is-loading");
           b.removeAttribute("aria-busy");
@@ -946,7 +986,12 @@ function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = n
     // refused client-side AND server-side).
     document.querySelectorAll("button.override-toggle").forEach((b) => {
       b.addEventListener("click", () => {
-        const form = b.nextElementSibling;
+        // Scoped lookup, not nextElementSibling: adjacency is a markup accident,
+        // and anything inserted between the toggle and its form would kill "Send
+        // anyway\u2026" silently. The submit handler six lines down already uses
+        // closest(); this is the same contract from the other end.
+        const wrap = b.closest(".override");
+        const form = wrap ? wrap.querySelector(".override-form") : null;
         if (form) form.hidden = !form.hidden;
       });
     });
@@ -971,13 +1016,14 @@ function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = n
           if (res.ok) {
             if (status) status.textContent = "Overridden \u2713";
             if (input) input.disabled = true;
-            // Reflect the send-anyway state on the row's own Approve button too \u2014
-            // it stays server-gated disabled, but the label should stop implying
-            // "waiting on you" once an override has gone through.
-            const approveBtn = document.querySelector(
-              'button.approve[data-report-id="' + b.dataset.reportId + '"]',
-            );
-            if (approveBtn) approveBtn.textContent = "Overridden";
+            // Reflect the send-anyway state on the row's own Approve buttons too \u2014
+            // they stay server-gated disabled, but the label should stop implying
+            // "waiting on you" once an override has gone through. ALL of them: the
+            // same report is rendered in both the pending list and the history, so
+            // a singular querySelector updated the first and left the second lying.
+            approveButtonsFor(b.dataset.reportId).forEach((t) => {
+              t.textContent = "Overridden";
+            });
           } else {
             // A 409 carries { reason, blockers } \u2014 surface WHY (textContent only,
             // never innerHTML, so server strings stay inert).
@@ -1016,32 +1062,27 @@ function renderSiteDashboardHtml(site, reports, submissions = [], spamTotals = n
     // Site-details editor: save on change (selects) / blur (inputs+textareas, only
     // when the value actually changed). The per-field span shows \u2713 / \u2717.
     ${DETAIL_VALUE_FN}
-    function saveDetail(el) {
-      const span = document.querySelector('.detail-saved[data-for="' + el.dataset.detailField + '"]');
-      fetch(el.dataset.detailsUrl, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ field: el.dataset.detailField, value: detailValue(el) }),
-      })
-        .then((r) => {
-          if (span) span.textContent = r.ok ? " \u2713" : " \u2717";
-        })
-        .catch(() => {
-          if (span) span.textContent = " \u2717";
-        });
-    }
+    ${SAVE_DETAIL_FN}
     document.querySelectorAll("select[data-detail-field]").forEach((s) => {
-      s.addEventListener("change", () => saveDetail(s));
+      s.addEventListener("change", () => saveDetail(s, document));
     });
     // Checkboxes save on CHANGE. They cannot use the blur path below: that path
     // only fires when \`value !== defaultValue\`, and for a checkbox both are the
     // "on" content attribute, so it would never save at all.
     document.querySelectorAll("input[type=checkbox][data-detail-field]").forEach((c) => {
-      c.addEventListener("change", () => saveDetail(c));
+      c.addEventListener("change", () => saveDetail(c, document));
     });
     document.querySelectorAll("input:not([type=checkbox])[data-detail-field], textarea[data-detail-field]").forEach((i) => {
+      // A save needs BOTH a real edit gesture and a changed value. \`value !==
+      // defaultValue\` alone is not evidence of an edit: the browser rewrites
+      // \`.value\` on its own when a control is handed a value it cannot represent
+      // (an ISO datetime in a date input sanitizes to ""), and the blur that
+      // follows an untouched tab-through then posts that empty string as if the
+      // operator had cleared the field. Requiring an \`input\` event first means
+      // only a human keystroke or picker choice can arm the save.
+      i.addEventListener("input", () => { i.dataset.edited = "1"; });
       i.addEventListener("blur", () => {
-        if (i.value !== i.defaultValue) saveDetail(i);
+        if (i.dataset.edited === "1" && i.value !== i.defaultValue) saveDetail(i, document);
       });
     });
     // Refresh preview: dispatch the re-render workflow, then tell the operator to
@@ -1609,7 +1650,8 @@ function renderInboxLane(model) {
   }).join("");
   const overflow = subs.length - shown.length;
   const more = overflow > 0 ? `<div class="approve-row subm-more muted"><a href="/submissions">+${overflow} more \u2014 view all submissions</a></div>` : `<div class="approve-row subm-more muted"><a href="/submissions">View all submissions \u2192</a></div>`;
-  const spamLine = hasSpam ? `<div class="spam-rollup muted">\u{1F6E1} Spam (30d) \u2014 caught ${spam.caught} \xB7 through ${spam.through}</div>` : "";
+  const spamAsOf = spam?.computedAt !== void 0 ? ` \xB7 as of ${escapeHtml(spam.computedAt.slice(0, 16).replace("T", " "))} UTC` : "";
+  const spamLine = hasSpam ? `<div class="spam-rollup muted">\u{1F6E1} Spam (30d) \u2014 caught ${spam.caught} \xB7 through ${spam.through}${spamAsOf}</div>` : "";
   const spamInSummary = hasSpam ? " \xB7 \u{1F6E1} Spam (30d)" : "";
   const autoFilteredLine = hasAutoFiltered ? `<div class="spam-rollup muted">\u{1F6AB} ${autoFiltered} auto-filtered this week \u2014 <a href="/submissions?status=spam_auto">review</a></div>` : "";
   const leads = subs.filter((s) => isLeadFormType(s.formType)).length;
@@ -1634,41 +1676,38 @@ var AUDIT_SCRIPT = `<script>
   function rfStop(){ try { localStorage.removeItem(RF_KEY); } catch(e){} }
   // Per-workflow ETA hint (the lighthouse fleet sweep runs ~48 min; security ~1-2 min).
   function rfEta(label){ return label === 'lighthouse' ? '~48m' : label === 'security' ? '~2m' : ''; }
-  // Map a raw GitHub step name to a coarse human phase. Order matters (the audit step
-  // name also contains 'browser'; 'playwright install' also contains 'install').
-  function rfPhase(step){
-    if (!step) return '';
-    var s = step.toLowerCase();
-    if (s.indexOf('audit') !== -1 || s.indexOf('lighthouse') !== -1) return 'auditing the fleet\u2026';
-    if (s.indexOf('build') !== -1) return 'building\u2026';
-    if (s.indexOf('playwright') !== -1 || s.indexOf('browser') !== -1) return 'installing browsers\u2026';
-    if (s.indexOf('install') !== -1 || s.indexOf('depend') !== -1) return 'installing dependencies\u2026';
-    if (s.indexOf('set up') !== -1 || s.indexOf('checkout') !== -1) return 'setting up\u2026';
-    return step;
+  // Escape before interpolating. The values here are server-side enums and a
+  // GitHub html_url today, but this builds HTML from a REMOTE API response, and
+  // the house rule everywhere else on these pages is that no server string ever
+  // reaches the browser as markup. Cheaper to escape than to keep re-deciding.
+  function rfEsc(v){
+    return String(v == null ? '' : v)
+      .replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;')
+      .replace(/"/g,'&quot;').replace(/'/g,'&#39;');
+  }
+  // A run link must be a GitHub run URL. Anything else is dropped rather than
+  // rendered, so a compromised or unexpected API response cannot place an
+  // arbitrary href (javascript:, data:, an attacker's host) in the panel.
+  function rfRunUrl(u){
+    return typeof u === 'string' && u.indexOf('https://github.com/') === 0 ? rfEsc(u) : '';
   }
-  // Safe to build raw HTML: workflow/state/step are server-fixed (enums + GitHub step
-  // names) and url is GitHub's own html_url for our central repo \u2014 none are
-  // user-supplied. Don't interpolate untrusted fields here without escaping.
   function rfRender(status, startedAt){
     var failed = function(s){ return s === 'failure' || s === 'cancelled' || s === 'timed_out'; };
     var mins = Math.floor((Date.now() - startedAt) / 60000);
     var elapsed = mins < 1 ? '<1m' : mins + 'm';
     return status.perWorkflow.map(function(w){
-      var label = w.workflow.replace('.yml','').replace('fleet-','');
+      var label = String(w.workflow || '').replace('.yml','').replace('fleet-','');
       var done = w.state === 'success';
       var isFailed = failed(w.state);
       var icon = done ? '\u2713' : isFailed ? '\u2717' : '<span class="rf-spin"></span>';
-      var line = icon + ' ' + label + ' \u2014 ' + w.state.replace('_',' ');
+      var line = icon + ' ' + rfEsc(label) + ' \u2014 ' + rfEsc(String(w.state || '').replace('_',' '));
+      var url = rfRunUrl(w.url);
       if (!done && !isFailed){
-        var phase = rfPhase(w.step);
         var eta = rfEta(label);
-        var detail = [];
-        if (phase) detail.push(phase);
-        detail.push(elapsed + (eta ? ' / ' + eta : ''));
-        var link = w.url ? ' \xB7 <a href="'+w.url+'" target="_blank" rel="noopener">view run \u2197</a>' : '';
-        line += '<div class="rf-sub">' + detail.join(' \xB7 ') + link + '</div>';
-      } else if (isFailed && w.url){
-        line += ' <a href="'+w.url+'" target="_blank" rel="noopener">run</a>';
+        var link = url ? ' \xB7 <a href="'+url+'" target="_blank" rel="noopener">view run \u2197</a>' : '';
+        line += '<div class="rf-sub">' + elapsed + (eta ? ' / ' + eta : '') + link + '</div>';
+      } else if (isFailed && url){
+        line += ' <a href="'+url+'" target="_blank" rel="noopener">run</a>';
       }
       return '<div class="rf-row">' + line + '</div>';
     }).join('');
@@ -1797,6 +1836,8 @@ var SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
 
 // src/dashboard/prospect-audit-trigger.ts
 var PROSPECT_AUDIT_DUPLICATE_WINDOW_MS = 10 * 60 * 1e3;
+var PROSPECT_AUDIT_DAILY_CAP = 25;
+var DAILY_CAP_LOOKBACK = PROSPECT_AUDIT_DAILY_CAP * 2;
 export {
   ALL_AUDIT_NAMES,
   ALL_RECIPE_NAMES,