@tokenoftrust/storefront-runner 1.3.4-rc.4 → 1.4.1

package/apps/storefront/src/components/admin/AdminPublishTab.astro

@@ -0,0 +1,3562 @@
+---
+/**
+ * Publish tab — the go-live surface (handoffs 2026-08-05-admin-golive-surface
+ * + 2026-08-05-domain-connect-ux). Replaces the terminal runbook for a
+ * permissioned operator:
+ *
+ *   - OPEN CHANGE QUEUE from GET /api/changes ({ current, changes }) with
+ *     per-change reconcile/compliance state, preview link, head sha, and age.
+ *   - ACCEPT TO PREVIEW (POST /api/changes/integrate — b11's accept-to-preview
+ *     split; advances the shared `preview` aggregate, does NOT go live) and
+ *     REJECT (with a note) per change. Going live is the aggregate card's
+ *     exact-digest PUBLISH (POST /api/changes/ship), never a per-change accept.
+ *   - LIVE STATE: the current live version (live-channel pointer) + the
+ *     static-republish dispatch status for static-publish tenants (fired /
+ *     skipped / sink-unbound notice).
+ *   - DOMAIN section (static-publish tenants): apex connect + rollback via the
+ *     www-domain dispatch endpoints — typed-confirmation connect (owner-only),
+ *     always-visible rollback with the captured-records timestamp, in-flight
+ *     run + legible failures.
+ *
+ * PERMISSIONS (server-authoritative; mirrored here for UX only):
+ *   - Ship actions require an owner/admin session (`resolveOwnerSession`'s
+ *     OWNER_CAPABILITIES) — others see the queue read-only with a sign-in note.
+ *   - Non-premium tenants see the go-live control as a PAYWALL UPSELL — never
+ *     hidden, never "coming soon" (recorded product direction). The
+ *     entitlement signal is the existing premium model (D4): a custom-domain
+ *     tenant is premium/pilot; a `<label>.tokenoftrust.store` self-serve store
+ *     is not. TODO(paywall workstream): replace with the real billing
+ *     entitlement when one exists.
+ */
+import { readViewerSession } from "@/lib/auth/route";
+import { withBase } from "@/lib/basePath";
+import { readEnv } from "@/lib/env";
+import { resolveViewerShipCapability } from "@/lib/change";
+import { isHostedStoreDomain, isInternalTestTenant } from "@tot/public-runtime";
+
+const { envelope } = Astro.props;
+const { tenant, basePath, cspNonce } = Astro.locals;
+
+// Viewer capability, mirrored from the same session model the API routes gate
+// on (resolveOwnerSession admits capability owner|admin). UX-only: the server
+// re-authorizes every action.
+const viewerSession = await readViewerSession(Astro);
+// Session capability counts only when the session's resource IS this tenant.
+const sessionCapability =
+  viewerSession?.resource === tenant.appDomain ? viewerSession.capability : undefined;
+const viewerCapability =
+  Astro.locals.viewer?.capability ?? sessionCapability ?? "none";
+// A signed-in DEVELOPER (not owner/admin) may hold an explicit, owner-revocable
+// ship-on-behalf grant. Resolve it LIVE from the MCP subject-capability store —
+// NEVER the coarse role, NEVER a client header — so a ship-granted developer sees
+// the queue + Go-live/Reject/Retire. This MIRRORS the server (resolveShipSession /
+// effectiveShipCapability); the server re-authorizes every action. UX-only.
+let viewerCanShip = viewerCapability === "owner" || viewerCapability === "admin";
+if (!viewerCanShip && Astro.locals.viewer?.email) {
+  const shipGrant = await resolveViewerShipCapability(
+    Astro.locals.viewer.email,
+    tenant.appDomain,
+  );
+  if (shipGrant === "ship-on-behalf") viewerCanShip = true;
+}
+const viewerIsOwner = viewerCapability === "owner";
+// Apex/domain cutover is granted to owner OR admin (decision: apex-cutover =
+// owner+admin). This MIRRORS the server, whose `apexCutover` = `isOwner` over
+// OWNER_CAPABILITIES {owner, admin} (see change/route.ts decideIsOwner +
+// change/shipCapabilities.ts) — this UI gate was wrongly owner-only, stricter
+// than the gate the server actually enforces. UX-only: the server re-authorizes.
+const viewerCanApexCutover = viewerCapability === "owner" || viewerCapability === "admin";
+
+// Entitlement: the existing premium signal (custom-domain tenant = premium).
+// TODO(paywall workstream): swap for the real billing entitlement.
+const goLiveEntitled = !isHostedStoreDomain(tenant.appDomain);
+const internalTestTenant = isInternalTestTenant(tenant);
+
+const staticPublishEnabled = Boolean(
+  tenant.staticPublish && tenant.staticPublish.enabled !== false,
+);
+// Presence-only signal for the T5 dispatch sink (never the value).
+const dispatchConfigured = Boolean((await readEnv("WWW_PUBLISH_DISPATCH_TOKEN"))?.trim());
+
+const changesEndpoint = withBase(basePath || "", "/api/changes");
+// b11 — the branch-integration lifecycle SPLIT of accept from publish:
+//   - integrateEndpoint = b08's "accept = integrate into the protected preview
+//     aggregate" (POST /api/changes/integrate → TenantIntegrationQueue.enqueue).
+//     This is the candidate-queue "Accept to preview" action — it advances the
+//     shared aggregate, it does NOT go live. Returns an IntegrateOutcome
+//     (queueState/runState/statusMessage), never a bare merged:true.
+//   - shipEndpoint = b10's exact-digest go-live (POST /api/changes/ship →
+//     b09 AggregateShipOrchestrator.plan/ship). The aggregate card's "Publish"
+//     action: it ships the reviewed pinned SHA + digest, double-gated
+//     (paywall + human confirm). The read-only plan is served on GET /api/changes
+//     (`plan`), so the confirm surface never has to POST to preview it.
+// If b08/b10's exact paths differ at fold, the integrator reconciles here —
+// these are the agreed contract paths (see the unit brief).
+const integrateEndpoint = withBase(basePath || "", "/api/changes/integrate");
+const shipEndpoint = withBase(basePath || "", "/api/changes/ship");
+// U7 — retire/GC: evict a candidate's ReviewEnvironment + version (rebuildable),
+// DISTINCT from reject (which closes the change). Gated server-side by retireGate.
+const retireEndpoint = withBase(basePath || "", "/api/preview/retire");
+// rux5 — build-on-demand for a synthetic not-built PR row: materialize the PR's
+// hosted preview (INERT — flips no live channel). Gated server-side by buildGate
+// (the ship-on-behalf floor); the endpoint resolves the head sha via forge PR-read
+// when the row supplies only the PR number.
+const buildEndpoint = withBase(basePath || "", "/api/preview/build");
+// dg7 — the ship-operations workspace woven into this tab: versions/promotion
+// history, per-candidate diff, and rollback (through the ONE rollback
+// orchestrator). Read endpoints mirror the change-queue's auth/scope.
+const versionsEndpoint = withBase(basePath || "", "/api/changes/versions");
+const rollbackEndpoint = withBase(basePath || "", "/api/changes/rollback");
+// b17 — branch retention: GET dry-run classification / POST guarded delete.
+// DISTINCT endpoint from retireEndpoint above (branch delete vs artifact evict).
+const branchesEndpoint = withBase(basePath || "", "/api/changes/branches");
+// The client builds `${diffEndpointBase}/<changeId>/diff` per candidate.
+const diffEndpointBase = changesEndpoint;
+// The live store's root on THIS surface (basePath-aware): where the published
+// digest actually serves. Rendered into "already live" copy + the publish
+// ceremony's "View your live store" CTA.
+const liveHref = withBase(basePath || "", "/");
+const domainStatusEndpoint = withBase(basePath || "", "/api/domain/status");
+const domainDispatchEndpoint = withBase(basePath || "", "/api/domain/dispatch");
+// u9: the machine-verifiable apex-cutover readiness gate — the SAME server gate the
+// `tot go-live` CLI reads, so the admin display and the CLI never diverge.
+const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness");
+---
+
+<!-- agent-hook:publish-tab -->
+<section
+  id="publish"
+  class="band publish-tab"
+  aria-labelledby="admin-tab-publish publish-title"
+  data-admin-panel
+  data-agent-scope="publish"
+  role="tabpanel"
+  data-changes-endpoint={changesEndpoint}
+  data-integrate-endpoint={integrateEndpoint}
+  data-ship-endpoint={shipEndpoint}
+  data-retire-endpoint={retireEndpoint}
+  data-build-endpoint={buildEndpoint}
+  data-versions-endpoint={versionsEndpoint}
+  data-rollback-endpoint={rollbackEndpoint}
+  data-branches-endpoint={branchesEndpoint}
+  data-diff-endpoint-base={diffEndpointBase}
+  data-domain-status-endpoint={domainStatusEndpoint}
+  data-domain-dispatch-endpoint={domainDispatchEndpoint}
+  data-domain-readiness-endpoint={domainReadinessEndpoint}
+  data-repo={tenant.appDomain}
+  data-app-domain={tenant.appDomain}
+  data-live-href={liveHref}
+  data-can-ship={viewerCanShip ? "true" : "false"}
+  data-is-owner={viewerIsOwner ? "true" : "false"}
+  data-entitled={goLiveEntitled ? "true" : "false"}
+  data-static-publish={staticPublishEnabled ? "true" : "false"}
+  data-dispatch-configured={dispatchConfigured ? "true" : "false"}
+>
+  <div class="section-title">
+    <div>
+      <h2 id="publish-title">Publish</h2>
+      <p>Accept changes into the preview aggregate, then publish the reviewed build live.</p>
+    </div>
+    <div class="actions">
+      <button class="btn" type="button" data-publish-refresh>
+        <svg><use href="#i-refresh"></use></svg>Refresh
+      </button>
+    </div>
+  </div>
+
+  {internalTestTenant && (
+    <div class="ship-gate amber">
+      <div class="ship-gate-main">
+        <span class="seal"><svg><use href="#i-alert"></use></svg></span>
+        <div>
+          <b>Internal test store</b>
+          <span>This store exists for testing only and is blocked from going live.</span>
+        </div>
+      </div>
+    </div>
+  )}
+
+  {!goLiveEntitled && (
+    <div class="ship-gate amber" data-publish-paywall>
+      <div class="ship-gate-main">
+        <span class="seal"><svg><use href="#i-card"></use></svg></span>
+        <div>
+          <b>Publishing to your live store is part of the paid plan</b>
+          <span>
+            Previewing and reviewing changes stays free. Upgrade to take changes live
+            and publish your public site.
+          </span>
+        </div>
+      </div>
+      <a class="btn primary" href="mailto:success@tokenoftrust.com?subject=Upgrade%20store%20publishing">
+        Upgrade to publish
+      </a>
+    </div>
+  )}
+
+  {goLiveEntitled && !viewerCanShip && (
+    <div class="ship-gate amber">
+      <div class="ship-gate-main">
+        <span class="seal"><svg><use href="#i-shield"></use></svg></span>
+        <div>
+          <b>Read-only view</b>
+          <span>Going live requires an owner or admin sign-in for this store.</span>
+        </div>
+      </div>
+    </div>
+  )}
+
+  <div class="grid cols-3">
+    <div class="metric">
+      <span>Live version</span>
+      <strong data-publish-live-version>—</strong>
+      <small data-publish-live-source>What shoppers see right now</small>
+    </div>
+    <div class="metric">
+      <span>Published</span>
+      <strong data-publish-live-at>—</strong>
+      <small>When the live version last changed</small>
+      <small data-publish-live-shipped-by></small>
+    </div>
+    <div class="metric">
+      <span>Open changes</span>
+      <strong data-publish-queue-count>—</strong>
+      <small>Waiting for review or go-live</small>
+    </div>
+  </div>
+
+  {staticPublishEnabled && !dispatchConfigured && (
+    <div class="risk-alert" data-publish-sink-unbound>
+      <div class="risk-alert-main">
+        <svg><use href="#i-alert"></use></svg>
+        <div>
+          <b>Automatic public-site republish is not yet enabled on this environment</b>
+          <span>
+            Going live updates the hosted store immediately; the public-site republish
+            job is dispatched once publishing is enabled here.
+          </span>
+        </div>
+      </div>
+    </div>
+  )}
+
+  <div class="panel">
+    <div class="panel-head">
+      <h3><svg><use href="#i-export"></use></svg>Candidate queue</h3>
+      <span class="chip" data-publish-queue-chip>Loading</span>
+    </div>
+    <div class="panel-body grid">
+      <p class="note publish-status" data-publish-status role="status" aria-live="polite"></p>
+      <!-- rux1: forge-listing degraded strip. Shown ONLY when GET /api/changes
+           reports `degraded` (the open-PR listing failed) — distinct from the
+           genuine empty queue, so a forge blip never reads as "No open changes". -->
+      <div class="risk-alert" data-publish-degraded hidden role="alert">
+        <div class="risk-alert-main">
+          <svg><use href="#i-alert"></use></svg>
+          <div>
+            <b>Some open changes may not be shown</b>
+            <span>
+              We couldn't reach the pull-request list, so open changes that haven't been
+              built yet may be missing from the queue below. Built candidates are
+              unaffected. Refresh to try again.
+            </span>
+          </div>
+        </div>
+      </div>
+      <p class="note publish-pr-callout" data-publish-pr-callout hidden role="status" aria-live="polite"></p>
+      <div class="table-wrap">
+        <table class="publish-table">
+          <thead>
+            <tr>
+              <th>Change</th>
+              <th>Status</th>
+              <th>Checks</th>
+              <th>Head</th>
+              <th>Updated</th>
+              <th class="action">Actions</th>
+            </tr>
+          </thead>
+          <tbody data-publish-queue-body>
+            <tr data-publish-placeholder>
+              <td colspan="6"><span class="subtle">Loading the change queue…</span></td>
+            </tr>
+          </tbody>
+        </table>
+      </div>
+      {staticPublishEnabled && (
+        <p class="note" data-publish-dispatch-status>
+          {dispatchConfigured
+            ? "Public-site republish: dispatched automatically when a change goes live."
+            : "Public-site republish: not yet enabled on this environment."}
+        </p>
+      )}
+    </div>
+  </div>
+
+  <!-- b11: the AGGREGATE card — the protected `preview` aggregate the accepted
+       candidates integrate into, its combined evidence (the last integration
+       run's honest state), and the exact-digest Publish (b09/b10 ship the
+       reviewed pinned SHA + digest, never a rebuild). -->
+  <div class="panel" data-publish-aggregate>
+    <div class="panel-head">
+      <h3><svg><use href="#i-box"></use></svg>Preview aggregate</h3>
+      <span class="chip" data-aggregate-chip>Loading</span>
+    </div>
+    <div class="panel-body grid">
+      <p class="note publish-status" data-aggregate-status role="status" aria-live="polite"></p>
+
+      <div class="grid cols-3">
+        <div class="field">
+          <label>Aggregate build</label>
+          <strong class="publish-mono" data-aggregate-sha>—</strong>
+          <p data-aggregate-run-link>The current green preview build for this store.</p>
+        </div>
+        <div class="field">
+          <label>Combined evidence</label>
+          <strong data-aggregate-evidence>—</strong>
+          <p data-aggregate-evidence-detail>The last integration run's verdict.</p>
+        </div>
+        <div class="field">
+          <label>Reviewed digest</label>
+          <strong class="publish-mono" data-aggregate-digest>—</strong>
+          <p>The content digest that will be published — exactly what you reviewed.</p>
+        </div>
+      </div>
+
+      <!-- Included PRs — the batch this aggregate composes (b01 includedPrs). -->
+      <div class="aggregate-prs" data-aggregate-prs-wrap hidden>
+        <b>Included changes</b>
+        <ul class="aggregate-prs-list" data-aggregate-prs></ul>
+      </div>
+
+      <!-- The exact-digest Publish plan (b09 plan()): pinned SHA + digest +
+           included PRs + rollback target + paywall verdict + run link. Shown
+           inline (from GET /api/changes `plan`) so the confirm never POSTs to
+           preview. Publish is refused until the plan is `ok`. -->
+      <div class="aggregate-plan" data-aggregate-plan hidden>
+        <div class="aggregate-plan-head">
+          <b>Publish plan</b>
+          <span class="chip" data-aggregate-plan-chip></span>
+        </div>
+        <dl class="aggregate-plan-grid" data-aggregate-plan-grid></dl>
+        <p class="note" data-aggregate-plan-note></p>
+      </div>
+
+      <div class="check-row">
+        <div>
+          <b>Publish the reviewed build to your live store</b>
+          <p data-aggregate-publish-detail>
+            Publishes the exact reviewed digest — no rebuild. Available once the
+            aggregate is green and its integration run passed.
+          </p>
+        </div>
+        <button class="btn primary" type="button" data-aggregate-publish disabled>
+          <svg><use href="#i-export"></use></svg>Publish live
+        </button>
+      </div>
+    </div>
+  </div>
+
+  <!-- dg7: published versions + promotion history + rollback (u2/u3 promotion_status,
+       u5 immutable /rev links, u8 rollback through the one orchestrator). -->
+  <div class="panel" data-publish-versions>
+    <div class="panel-head">
+      <h3><svg><use href="#i-refresh"></use></svg>Published versions</h3>
+      <span class="chip" data-versions-chip>Loading</span>
+    </div>
+    <div class="panel-body grid">
+      <p class="note publish-status" data-versions-status role="status" aria-live="polite"></p>
+      <p class="note" data-versions-rollback-note hidden></p>
+      <div class="table-wrap">
+        <table class="publish-table versions-table">
+          <thead>
+            <tr>
+              <th>Version</th>
+              <th>Digest</th>
+              <th>Promoted</th>
+              <th>Preview</th>
+              <th>State</th>
+              <th class="action">Actions</th>
+            </tr>
+          </thead>
+          <tbody data-versions-body>
+            <tr data-versions-placeholder>
+              <td colspan="6"><span class="subtle">Loading published versions…</span></td>
+            </tr>
+          </tbody>
+        </table>
+      </div>
+    </div>
+  </div>
+
+  <!-- b17: branch retention — Admin visibility into the branch-lifecycle
+       contract's "Candidate branch retirement" table (P1 items 8/9/11). Reads
+       the guarded `candidate_list` classification (protected/active-open/
+       stale-open/integrated/closed-or-rejected/orphan) and, for a branch that
+       classifies as ready, runs the guarded `candidate_delete` — which
+       re-classifies fresh server-side and refuses anything not integrated or
+       closed-or-rejected, no matter what this panel last rendered. DISTINCT
+       from the "Retire" action in the candidate queue above: retire evicts a
+       hosted PREVIEW ARTIFACT (rebuildable); this panel deletes a Git BRANCH
+       (transport only, never the durable record — see the note below). An
+       orphan is always shown quarantined for review, never one-click deletable. -->
+  <div class="panel" data-publish-branches>
+    <div class="panel-head">
+      <h3><svg><use href="#i-workflows"></use></svg>Branch retention</h3>
+      <span class="chip" data-branches-chip>Loading</span>
+    </div>
+    <div class="panel-body grid">
+      <p class="note">
+        Cleans up candidate <b>branches</b> once their pull request is merged or
+        closed — a different action on a different object than <b>Retire</b> in
+        the queue above, which only evicts a hosted preview build (rebuildable
+        on demand, never a branch). Every classification below is a fresh
+        dry-run; deleting always re-checks eligibility on the server and asks
+        you to confirm before removing anything. Orphan branches (no PR record
+        at all) are quarantined for your review, never deleted automatically.
+      </p>
+      <p class="note publish-status" data-branches-status role="status" aria-live="polite"></p>
+      <div class="table-wrap">
+        <table class="publish-table">
+          <thead>
+            <tr>
+              <th>Branch</th>
+              <th>Classification</th>
+              <th>PR</th>
+              <th>Tip commit</th>
+              <th>Age</th>
+              <th>Evidence</th>
+              <th class="action">Actions</th>
+            </tr>
+          </thead>
+          <tbody data-branches-body>
+            <tr data-branches-placeholder>
+              <td colspan="7"><span class="subtle">Loading branch classification…</span></td>
+            </tr>
+          </tbody>
+        </table>
+      </div>
+    </div>
+  </div>
+
+  {staticPublishEnabled && (
+    <div class="panel" data-publish-domain>
+      <div class="panel-head">
+        <h3><svg><use href="#i-shield"></use></svg>Public domain</h3>
+        <span class="chip" data-domain-state-chip>Loading</span>
+      </div>
+      <div class="panel-body grid">
+        <div class="grid cols-3">
+          <div class="field">
+            <label>Serving from</label>
+            <strong data-domain-state>—</strong>
+            <p data-domain-since>Current host for {tenant.appDomain}</p>
+          </div>
+          <div class="field">
+            <label>Rollback records</label>
+            <strong data-domain-capture>None captured</strong>
+            <p>DNS records captured before connect — rollback restores these.</p>
+          </div>
+          <div class="field">
+            <label>Last run</label>
+            <strong data-domain-run>None</strong>
+            <p data-domain-run-detail>Connect and rollback runs appear here.</p>
+          </div>
+        </div>
+
+        <p class="note publish-status" data-domain-status role="status" aria-live="polite"></p>
+
+        <!-- u9: apex-cutover readiness — the itemized preconditions the server gate
+             requires before a connect is permitted. Populated from
+             /api/domain/readiness (the SAME gate `tot go-live` reads). -->
+        <div class="domain-readiness" data-domain-readiness hidden>
+          <div class="domain-readiness-head">
+            <b>Cutover readiness</b>
+            <span class="chip" data-domain-readiness-chip>Checking…</span>
+          </div>
+          <ul class="domain-readiness-list" data-domain-readiness-list></ul>
+          <p class="note" data-domain-readiness-note></p>
+        </div>
+
+        <div class="check-row">
+          <div>
+            <b>Connect {tenant.appDomain} to the storefront</b>
+            <p>
+              Updates two DNS names — <code>{tenant.appDomain}</code> and <code>www.{tenant.appDomain}</code> —
+              to serve the published site. Takes effect in about a minute. Type the
+              domain to confirm.
+            </p>
+            {!viewerCanApexCutover && (
+              <p><span class="chip amber">Owner/admin only</span> Connecting the domain requires an owner or admin sign-in.</p>
+            )}
+          </div>
+          <div class="domain-connect-controls">
+            <input
+              type="text"
+              placeholder={tenant.appDomain}
+              autocomplete="off"
+              spellcheck="false"
+              aria-label="Type the domain to confirm"
+              data-domain-confirm
+              disabled={!viewerCanApexCutover}
+            />
+            <label class="domain-rehearsal">
+              <input type="checkbox" data-domain-rehearsal disabled={!viewerCanApexCutover} />
+              Rehearsal (dry run, no DNS change)
+            </label>
+            <button
+              class="btn primary"
+              type="button"
+              data-domain-connect
+              data-owner-locked={!viewerCanApexCutover ? "true" : undefined}
+              disabled={!viewerCanApexCutover}
+            >
+              <svg><use href="#i-check"></use></svg>Connect domain
+            </button>
+          </div>
+        </div>
+
+        <div class="check-row">
+          <div>
+            <b>Roll back to the previous host</b>
+            <p data-domain-rollback-detail>
+              Restores the DNS records captured before connect. Available once records
+              have been captured.
+            </p>
+          </div>
+          <button class="btn" type="button" data-domain-rollback disabled={!viewerCanShip}>
+            <svg><use href="#i-refresh"></use></svg>Roll back
+          </button>
+        </div>
+      </div>
+    </div>
+  )}
+
+  <!-- Accept-to-preview LIFTOFF — the plan confirm + live integration flight +
+       outcome ceremony. One dialog, three phases (plan → flight → outcome).
+       The flight's stage rail advances ONLY on real signals (the in-flight POST
+       plus GET /api/changes polling — includedPrs / activeRun / aggregateSha);
+       nothing is simulated. Replaces the old window.confirm() plan popup. -->
+  <div class="liftoff-backdrop" data-liftoff hidden>
+    <div class="liftoff-card" role="dialog" aria-modal="true" aria-labelledby="liftoff-title" tabindex="-1">
+      <div class="liftoff-phase" data-liftoff-plan>
+        <p class="liftoff-kicker">Accept to preview</p>
+        <h3 class="liftoff-title" id="liftoff-title" data-liftoff-title>Integrate into preview</h3>
+        <dl class="liftoff-grid" data-liftoff-grid></dl>
+        <p class="note">
+          Integrates this candidate into the protected <code>preview</code> aggregate, then
+          rebuilds it and re-runs its combined evidence. <b>Nothing goes live</b> —
+          publishing the reviewed build stays a separate, explicit step.
+        </p>
+        <div class="liftoff-actions">
+          <button class="btn" type="button" data-liftoff-cancel>Cancel</button>
+          <button class="btn primary" type="button" data-liftoff-proceed>
+            <svg><use href="#i-check"></use></svg>Integrate into preview
+          </button>
+        </div>
+      </div>
+
+      <div class="liftoff-phase" data-liftoff-flight hidden>
+        <p class="liftoff-kicker">Integration in flight</p>
+        <h3 class="liftoff-title" data-liftoff-flight-title>Integrating…</h3>
+        <ol class="liftoff-stages">
+          <li data-liftoff-stage="merge">
+            <span class="liftoff-dot"></span>
+            <div><b>Merge</b><span>squash-merge the candidate into <code>preview</code></span></div>
+          </li>
+          <li data-liftoff-stage="build">
+            <span class="liftoff-dot"></span>
+            <div><b>Rebuild</b><span>build the combined preview aggregate</span></div>
+          </li>
+          <li data-liftoff-stage="evidence">
+            <span class="liftoff-dot"></span>
+            <div><b>Evidence</b><span>re-run the aggregate's combined checks</span></div>
+          </li>
+          <li data-liftoff-stage="green">
+            <span class="liftoff-dot"></span>
+            <div><b>Green</b><span>the aggregate becomes the reviewable, shippable build</span></div>
+          </li>
+        </ol>
+        <p class="liftoff-live" data-liftoff-live role="status" aria-live="polite">Working…</p>
+        <div class="liftoff-meta">
+          <span class="publish-mono" data-liftoff-elapsed>0:00</span>
+          <button class="btn" type="button" data-liftoff-hide>Continue in background</button>
+        </div>
+      </div>
+
+      <div class="liftoff-phase liftoff-outcome-phase" data-liftoff-outcome hidden>
+        <div class="liftoff-seal" data-liftoff-seal aria-hidden="true"></div>
+        <h3 class="liftoff-title" data-liftoff-outcome-title></h3>
+        <p class="note" data-liftoff-outcome-detail></p>
+        <div class="liftoff-actions">
+          <a class="btn" data-liftoff-review target="_blank" rel="noopener" hidden>Review the preview build</a>
+          <button class="btn primary" type="button" data-liftoff-done>Done</button>
+        </div>
+      </div>
+
+      <div class="liftoff-confetti" data-liftoff-confetti aria-hidden="true"></div>
+    </div>
+  </div>
+
+  <!-- Publish-live ceremony — the go-live counterpart of the accept liftoff
+       (same shell/styles). Plan states the exact digest + no-rebuild contract;
+       flight is a single honest in-flight state (one POST, no staged theater);
+       outcome celebrates with a real "View your live store" link. Replaces the
+       raw window.confirm() publish popup. -->
+  <div class="liftoff-backdrop" data-shipoff hidden>
+    <div class="liftoff-card" role="dialog" aria-modal="true" aria-labelledby="shipoff-title" tabindex="-1">
+      <div class="liftoff-phase" data-shipoff-plan>
+        <p class="liftoff-kicker">Publish live</p>
+        <h3 class="liftoff-title" id="shipoff-title">Publish the reviewed build to your live store</h3>
+        <dl class="liftoff-grid" data-shipoff-grid></dl>
+        <p class="note">
+          Publishes this <b>exact reviewed digest</b> — no rebuild, nothing rides along.
+          Your live store updates in about a second; rolling back re-publishes the prior
+          version from the archive.
+        </p>
+        <div class="liftoff-actions">
+          <button class="btn" type="button" data-shipoff-cancel>Cancel</button>
+          <button class="btn primary" type="button" data-shipoff-proceed>
+            <svg><use href="#i-export"></use></svg>Publish live
+          </button>
+        </div>
+      </div>
+
+      <div class="liftoff-phase" data-shipoff-flight hidden>
+        <p class="liftoff-kicker">Publishing</p>
+        <h3 class="liftoff-title">Promoting the reviewed digest…</h3>
+        <p class="liftoff-live" data-shipoff-live role="status" aria-live="polite">
+          Pinning the exact reviewed build to your live channel…
+        </p>
+        <div class="liftoff-meta">
+          <span class="publish-mono" data-shipoff-elapsed>0:00</span>
+        </div>
+      </div>
+
+      <div class="liftoff-phase liftoff-outcome-phase" data-shipoff-outcome hidden>
+        <div class="liftoff-seal" data-shipoff-seal aria-hidden="true"></div>
+        <h3 class="liftoff-title" data-shipoff-outcome-title></h3>
+        <p class="note" data-shipoff-outcome-detail></p>
+        <div class="liftoff-actions">
+          <a class="btn primary" data-shipoff-view target="_blank" rel="noopener" hidden>View your live store</a>
+          <button class="btn" type="button" data-shipoff-done>Done</button>
+        </div>
+      </div>
+
+      <div class="liftoff-confetti" data-shipoff-confetti aria-hidden="true"></div>
+    </div>
+  </div>
+</section>
+
+<script is:inline nonce={cspNonce}>
+  (() => {
+    const root = document.getElementById("publish");
+    if (!root) return;
+    const ds = root.dataset;
+    const canShip = ds.canShip === "true";
+    const repo = ds.repo || "";
+    const appDomain = ds.appDomain || "";
+
+    const statusEl = root.querySelector("[data-publish-status]");
+    const queueBody = root.querySelector("[data-publish-queue-body]");
+    const queueChip = root.querySelector("[data-publish-queue-chip]");
+    const queueCount = root.querySelector("[data-publish-queue-count]");
+    const degradedStrip = root.querySelector("[data-publish-degraded]");
+
+    // rux7 — in-flight UI state the auto-refresh poll must preserve across a
+    // re-render. These are the AUTHORITATIVE source of truth (never scraped
+    // back out of the DOM): an action's async closure holds a reference to the
+    // OLD button, so after a poll swaps the row the completion signal lands on a
+    // detached node — reading `disabled`/`data-building` off the fresh DOM would
+    // wedge forever. buildPreview/integrate/reject/retire add on start and
+    // delete in `finally` (before their own loadQueue), so the next render
+    // reflects the true busy set. Open diff panes are the exception: the DOM IS
+    // their source of truth (toggleDiff owns open/close), so renderQueue detaches
+    // and re-attaches the actual pane node — see renderQueue.
+    const inflightBuilds = new Set(); // prNumber currently building
+    const busyChanges = new Set(); // changeId with an in-flight integrate/reject/retire
+    let aggregatePublishing = false; // the aggregate Publish POST is in flight
+
+    const setStatus = (el, message, state) => {
+      if (!el) return;
+      el.textContent = message || "";
+      if (state) el.dataset.state = state;
+      else delete el.dataset.state;
+    };
+
+    const shortSha = (sha) => (sha ? String(sha).slice(0, 8) : "—");
+
+    // Inline mirror of `candidatePrUrl` (lib/preview/candidateDashboard.ts) — an
+    // is:inline script can't import a module, so the pure URL shape is mirrored
+    // here (same pattern as `shortSha`). The friendly `/preview/<tenant>/pr/<N>`
+    // route handles every state (ready, not-built, …), so a row with a PR number
+    // always has a working preview link even when `previewUrl` is still null.
+    const candidatePrUrl = (prNumber) =>
+      prNumber != null ? "/preview/" + encodeURIComponent(appDomain) + "/pr/" + prNumber : null;
+
+    const age = (iso) => {
+      if (!iso) return "—";
+      const ms = Date.now() - new Date(iso).getTime();
+      if (!Number.isFinite(ms) || ms < 0) return "—";
+      const mins = Math.floor(ms / 60000);
+      if (mins < 1) return "just now";
+      if (mins < 60) return mins + "m ago";
+      const hours = Math.floor(mins / 60);
+      if (hours < 48) return hours + "h ago";
+      return Math.floor(hours / 24) + "d ago";
+    };
+
+    const STATUS_CHIP = {
+      queued: "",
+      reconciling: "blue",
+      ready: "green",
+      blocked: "red",
+    };
+
+    const chip = (text, tone) => {
+      const el = document.createElement("span");
+      el.className = "chip" + (tone ? " " + tone : "");
+      el.textContent = text;
+      return el;
+    };
+
+    const cell = (...children) => {
+      const td = document.createElement("td");
+      for (const child of children) {
+        if (child == null) continue;
+        td.append(typeof child === "string" ? document.createTextNode(child) : child);
+      }
+      return td;
+    };
+
+    const subtle = (text) => {
+      const el = document.createElement("span");
+      el.className = "subtle";
+      el.textContent = text;
+      return el;
+    };
+
+    // ---- ?pr=N deep link ---------------------------------------------------
+    // A deep link like /admin#publish?pr=42 asks us to surface a specific PR's
+    // row once the queue has loaded. The param rides in the hash fragment
+    // (after the tab anchor) because that's how the admin shell routes tabs;
+    // fall back to a real query string too. Resolve exactly once — so the
+    // scroll/highlight never re-fires on the reloads that follow every ship
+    // action — and until it resolves, keep an honest "not in the queue yet"
+    // callout up rather than silently doing nothing.
+
+    const readRequestedPr = () => {
+      const hash = window.location.hash || "";
+      const q = hash.indexOf("?");
+      let raw = new URLSearchParams(q >= 0 ? hash.slice(q + 1) : "").get("pr");
+      if (raw == null) raw = new URLSearchParams(window.location.search).get("pr");
+      if (raw == null) return null;
+      const n = Number.parseInt(raw, 10);
+      return Number.isInteger(n) && n > 0 ? n : null;
+    };
+
+    const requestedPr = readRequestedPr();
+    let prDeeplinkResolved = false;
+
+    const applyPrDeeplink = () => {
+      if (requestedPr == null || prDeeplinkResolved) return;
+      const callout = root.querySelector("[data-publish-pr-callout]");
+      const row = queueBody.querySelector('tr[data-pr-number="' + requestedPr + '"]');
+      if (!row) {
+        if (callout) {
+          callout.hidden = false;
+          callout.textContent = "PR #" + requestedPr + " isn't in the queue yet.";
+        }
+        return;
+      }
+      prDeeplinkResolved = true;
+      if (callout) {
+        callout.hidden = true;
+        callout.textContent = "";
+      }
+      row.scrollIntoView({ block: "center", behavior: "smooth" });
+      row.classList.remove("publish-row-highlight");
+      void row.offsetWidth; // restart the flash animation if re-applied
+      row.classList.add("publish-row-highlight");
+      window.setTimeout(() => row.classList.remove("publish-row-highlight"), 2600);
+    };
+
+    // ---- Open change queue -------------------------------------------------
+
+    const renderQueue = (payload) => {
+      const changes = Array.isArray(payload.changes) ? payload.changes : [];
+      // rux1: surface a forge-listing failure as a visible strip — never let a
+      // degraded (short) list read as a genuine empty queue.
+      if (degradedStrip) degradedStrip.hidden = payload.degraded !== true;
+      // rux7: capture any open diff panes BEFORE wiping so a poll re-render
+      // re-attaches the exact node (with its already-fetched content) under the
+      // matching new row, instead of blowing the expanded pane away. Keyed by
+      // changeId (== the diff row's data-publish-diff-row). Wiping detaches them
+      // from the DOM but the Map keeps them alive for re-attachment.
+      const openDiffNodes = new Map();
+      queueBody.querySelectorAll("tr[data-publish-diff-row]").forEach((node) => {
+        openDiffNodes.set(node.dataset.publishDiffRow, node);
+      });
+      queueBody.textContent = "";
+      if (queueCount) queueCount.textContent = String(changes.length);
+      if (queueChip) {
+        queueChip.textContent = changes.length === 1 ? "1 open" : changes.length + " open";
+        queueChip.className = "chip" + (changes.length ? " blue" : "");
+      }
+
+      if (!changes.length) {
+        const tr = document.createElement("tr");
+        const td = cell(
+          subtle(
+            "No open changes. New store changes appear here when a developer submits them for review.",
+          ),
+        );
+        td.colSpan = 6;
+        tr.append(td);
+        queueBody.append(tr);
+        return;
+      }
+
+      for (const change of changes) {
+        const tr = document.createElement("tr");
+        if (change.prNumber != null) tr.dataset.prNumber = String(change.prNumber);
+
+        // Change id + branch / PR + preview link.
+        const idCell = document.createElement("td");
+        const idStrong = document.createElement("strong");
+        idStrong.textContent = change.changeId || "—";
+        idCell.append(idStrong);
+        const meta = [];
+        if (change.branch) meta.push(change.branch);
+        if (change.prNumber != null) meta.push("PR #" + change.prNumber);
+        if (meta.length) idCell.append(subtle(meta.join(" · ")));
+        // Owner-facing "who did this" — accept takes priority over build (a
+        // candidate that's been accepted-to-preview is more meaningfully
+        // "acted on" than merely built). Reject never shows here: a rejected
+        // candidate is closed and has already left the open queue.
+        const actorRecord = change.actors && (change.actors.accept || change.actors.build);
+        if (actorRecord) {
+          const label = change.actors.accept ? "Accepted by " : "Built by ";
+          idCell.append(subtle(label + (actorRecord.name || actorRecord.email)));
+        }
+        // Prefer the synthesized friendly per-PR route (handles every state);
+        // fall back to any server-provided previewUrl for change-first rows
+        // that have no PR number yet.
+        const previewUrl = candidatePrUrl(change.prNumber) || change.previewUrl;
+        if (previewUrl) {
+          const preview = document.createElement("a");
+          preview.href = previewUrl;
+          preview.target = "_blank";
+          preview.rel = "noopener";
+          preview.textContent = "Open preview";
+          const wrap = document.createElement("span");
+          wrap.className = "subtle";
+          wrap.append(preview);
+          idCell.append(wrap);
+        }
+        tr.append(idCell);
+
+        // Reconcile status.
+        const statusCell = cell(
+          chip(change.status || "unknown", STATUS_CHIP[change.status] ?? "amber"),
+        );
+        if (change.lastError) statusCell.append(subtle(change.lastError));
+        tr.append(statusCell);
+
+        // Evidence / compliance verdict.
+        const checks = (change.evidence && change.evidence.checks) || [];
+        const failing = checks.filter((c) => c.status === "fail");
+        const promotable = Boolean(change.evidence && change.evidence.promotable);
+        const checksCell = cell(
+          promotable ? chip("Checks passed", "green") : chip("Checks blocked", "amber"),
+        );
+        if (failing.length) {
+          checksCell.append(subtle("Failing: " + failing.map((c) => c.label || c.id).join(", ")));
+        } else if (!checks.length) {
+          checksCell.append(subtle("No checks reported yet"));
+        }
+        tr.append(checksCell);
+
+        // Head sha + age.
+        const headCell = cell(shortSha(change.headSha));
+        headCell.classList.add("publish-mono");
+        tr.append(headCell);
+        tr.append(cell(age(change.updatedAt)));
+
+        // Actions.
+        const actions = document.createElement("td");
+        actions.className = "action publish-actions";
+
+        // rux5 — a synthetic not-built forge PR row (built:false / status
+        // "not-built") has NO built candidate: changeId is null, so the built-only
+        // actions below (Diff/Accept/Reject/Retire, all keyed on changeId) do not
+        // apply. Its one action is Build preview — materialize the PR's hosted
+        // preview on demand. Capability-gated: the button is SHOWN only to a
+        // ship-capable operator, and the server (buildGate) re-authorizes — the UI
+        // check is UX, not the real gate.
+        if (change.built === false || change.status === "not-built") {
+          if (canShip) {
+            const build = document.createElement("button");
+            build.type = "button";
+            build.className = "btn primary";
+            build.title = "Materialize this PR's hosted preview on demand (does not go live)";
+            // rux7: if a build for this PR is mid-flight, a poll re-render must
+            // reflect the spinner/disabled state (not a fresh clickable button
+            // that would let the operator double-submit). The in-flight closure
+            // re-renders on completion, clearing this.
+            if (change.prNumber != null && inflightBuilds.has(change.prNumber)) {
+              build.textContent = "Building…";
+              build.disabled = true;
+              build.dataset.building = "true";
+            } else {
+              build.textContent = "Build preview";
+            }
+            build.addEventListener("click", () => buildPreview(change, build));
+            actions.append(build);
+          } else {
+            actions.append(subtle("Owner/admin sign-in required to build"));
+          }
+          tr.append(actions);
+          queueBody.append(tr);
+          continue;
+        }
+
+        // rux7: while an integrate/reject/retire for this change is in flight,
+        // keep its mutating actions disabled across a poll re-render so the
+        // operator can't double-submit against a freshly-minted button.
+        const changeBusy = busyChanges.has(change.changeId);
+
+        // rux6 Review: expand the row into a single "review moment" pane —
+        // preview iframe + evidence chips + diff + Accept/Reject — so a reviewer
+        // never leaves the queue. Supersedes the standalone Diff button (the dg7
+        // diff now lives inside the pane, reusing renderDiff). The row's own
+        // Accept/Reject/Retire buttons below are unchanged.
+        const reviewBtn = document.createElement("button");
+        reviewBtn.type = "button";
+        reviewBtn.className = "btn";
+        reviewBtn.textContent = "Review";
+        reviewBtn.setAttribute("aria-expanded", "false");
+        reviewBtn.title = "Open one pane to preview, diff, and act on this change";
+        reviewBtn.addEventListener("click", () => toggleReview(change, reviewBtn, tr));
+        actions.append(reviewBtn);
+        // b11 SPLIT: the candidate-queue primary action is now ACCEPT TO PREVIEW
+        // (b08 integrate = advance the shared preview aggregate), NOT go-live.
+        // Integrate flips NO live channel, so it has NO paywall (entitled) gate —
+        // it holds only the ship-on-behalf capability floor. Going live is the
+        // aggregate card's Publish action, once the aggregate is green.
+        const accept = document.createElement("button");
+        accept.type = "button";
+        accept.className = "btn primary";
+        accept.textContent = "Accept to preview";
+        accept.disabled = !canShip || !change.mergeable || changeBusy;
+        accept.title = !canShip
+          ? "Requires an owner or admin sign-in"
+          : !change.mergeable
+            ? "This change is not ready to integrate"
+            : "Integrate this change into the preview aggregate (does not go live)";
+        accept.addEventListener("click", () => integrateCandidate(change, accept));
+        actions.append(accept);
+        const reject = document.createElement("button");
+        reject.type = "button";
+        reject.className = "btn";
+        reject.textContent = "Reject";
+        reject.disabled = !canShip || changeBusy;
+        reject.title = canShip ? "Close this change without publishing" : "Requires an owner or admin sign-in";
+        reject.addEventListener("click", () => rejectChange(change, reject));
+        actions.append(reject);
+
+        // U7 Retire/GC: evict this candidate's preview environment + version to
+        // reclaim space. DISTINCT from Reject — retire is reversible-by-rebuild
+        // (U1 build-on-demand + the U2 fallback page rematerialize it), so a
+        // retired PR degrades to "not built yet", not a dead 404.
+        const retire = document.createElement("button");
+        retire.type = "button";
+        retire.className = "btn";
+        retire.textContent = "Retire";
+        retire.disabled = !canShip || changeBusy;
+        retire.title = canShip
+          ? "Evict this preview to reclaim space — rebuildable on demand (not the same as Reject)"
+          : "Requires an owner or admin sign-in";
+        retire.addEventListener("click", () => retireChange(change, retire));
+        actions.append(retire);
+        tr.append(actions);
+
+        queueBody.append(tr);
+
+        // rux7: re-attach a diff pane that was open before this re-render. The
+        // pane node carries its already-fetched content; restore the expanded
+        // state + the "Hide diff" toggle affordance so a poll never collapses it.
+        const openDiff = openDiffNodes.get(change.changeId);
+        if (openDiff) {
+          tr.dataset.changeRowId = change.changeId;
+          diffBtn.textContent = "Hide diff";
+          tr.after(openDiff);
+        }
+      }
+    };
+
+    const renderCurrent = (current, shippedBy) => {
+      const versionEl = root.querySelector("[data-publish-live-version]");
+      const sourceEl = root.querySelector("[data-publish-live-source]");
+      const atEl = root.querySelector("[data-publish-live-at]");
+      const shippedByEl = root.querySelector("[data-publish-live-shipped-by]");
+      if (current && current.versionId) {
+        if (versionEl) versionEl.textContent = shortSha(current.versionId);
+        if (sourceEl) {
+          sourceEl.textContent =
+            (current.source === "commit" ? "Published from a change" : "Published version") +
+            (current.artifactCount != null ? " · " + current.artifactCount + " files" : "");
+        }
+        if (atEl) atEl.textContent = current.createdAt ? age(current.createdAt) : "—";
+        // Owner-facing "who did this" — see changeActorAttribution.ts. Absent for
+        // any version published before this attribution existed, which is honest,
+        // not a bug.
+        if (shippedByEl) {
+          shippedByEl.textContent = shippedBy ? "Shipped by " + (shippedBy.name || shippedBy.email) : "";
+        }
+      } else {
+        if (versionEl) versionEl.textContent = "Not live yet";
+        if (sourceEl) sourceEl.textContent = "Nothing has been published for this store";
+        if (atEl) atEl.textContent = "—";
+        if (shippedByEl) shippedByEl.textContent = "";
+      }
+    };
+
+    // ---- rux7: auto-refresh (poll GET /api/changes) ------------------------
+    // Keep the queue + aggregate live without a manual reload: poll on an
+    // interval that BACKS OFF while nothing changes (grow the delay up to a cap)
+    // and SNAPS BACK to the base the moment something does. Pause entirely while
+    // the tab is hidden (document.hidden) — a backgrounded admin tab must not
+    // hammer the endpoint — and refresh promptly on return. A poll re-render
+    // reuses renderQueue/renderAggregate, which already preserve open diff panes
+    // and in-flight actions (inflightBuilds / busyChanges / aggregatePublishing),
+    // and applyPrDeeplink stays a one-time effect (prDeeplinkResolved), so the
+    // ?pr scroll never re-fires on a tick.
+    const POLL_BASE_MS = 8000;
+    const POLL_MAX_MS = 60000;
+    const POLL_GROWTH = 1.6;
+    let pollDelay = POLL_BASE_MS;
+    let pollTimer = null;
+    let pollBusy = false;
+    let lastChangesSignature = null;
+
+    // A compact projection of everything the queue/aggregate render VISIBLY off,
+    // so a no-op poll (identical data) neither re-renders nor interrupts a text
+    // selection — it just backs off. Relative ages are intentionally excluded;
+    // they drift at most one backoff interval and refresh on any real change.
+    const changesSignature = (data) => {
+      const cur = data.current || {};
+      const agg = data.aggregate || {};
+      const run = agg.activeRun || agg.lastRun || {};
+      const plan = data.plan || {};
+      const rows = (Array.isArray(data.changes) ? data.changes : []).map((c) => [
+        c.changeId,
+        c.prNumber,
+        c.status,
+        c.headSha,
+        c.mergeable,
+        c.built,
+        c.lastError || null,
+        !!(c.evidence && c.evidence.promotable),
+        c.actors ? Object.keys(c.actors).sort().join(",") : "",
+      ]);
+      return JSON.stringify({
+        degraded: data.degraded === true,
+        current: [cur.versionId || null, cur.createdAt || null, cur.artifactCount ?? null],
+        shippedBy: (data.shippedBy && data.shippedBy.email) || null,
+        aggregate: [
+          agg.queueState || null,
+          agg.aggregateSha || null,
+          run.state || null,
+          run.finishedAt || null,
+          (agg.includedPrs || []).length,
+        ],
+        plan: [plan.ok === true, plan.pinnedSha || null, plan.artifactDigest || null, plan.alreadyShipped === true],
+        rows,
+      });
+    };
+
+    const clearPoll = () => {
+      if (pollTimer) {
+        clearTimeout(pollTimer);
+        pollTimer = null;
+      }
+    };
+
+    const schedulePoll = () => {
+      clearPoll();
+      if (document.hidden) return; // paused while hidden; visibilitychange resumes
+      pollTimer = setTimeout(runPoll, pollDelay);
+    };
+
+    // One poll tick: fetch, and only re-render when the projection actually
+    // changed. Returns an outcome the caller uses to size the next interval.
+    const pollChanges = async () => {
+      let res;
+      try {
+        res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
+      } catch {
+        return "error"; // network blip — keep the last good view, just back off
+      }
+      if (res.status === 401 || res.status === 403) return "auth"; // session gone
+      const data = await res.json().catch(() => null);
+      if (!res.ok || !data) return "error";
+      const sig = changesSignature(data);
+      if (sig === lastChangesSignature) return "unchanged";
+      lastChangesSignature = sig;
+      renderCurrent(data.current, data.shippedBy);
+      renderQueue(data);
+      applyPrDeeplink();
+      renderAggregate(data);
+      return "changed";
+    };
+
+    const runPoll = async () => {
+      pollTimer = null;
+      if (document.hidden || pollBusy) {
+        schedulePoll();
+        return;
+      }
+      pollBusy = true;
+      let outcome;
+      try {
+        outcome = await pollChanges();
+      } finally {
+        pollBusy = false;
+      }
+      if (outcome === "auth") {
+        clearPoll(); // stop polling — a sign-in is required; a manual refresh retries
+        return;
+      }
+      pollDelay =
+        outcome === "changed"
+          ? POLL_BASE_MS
+          : Math.min(POLL_MAX_MS, Math.round(pollDelay * POLL_GROWTH));
+      schedulePoll();
+    };
+
+    const loadQueue = async () => {
+      try {
+        const res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
+        if (res.status === 401 || res.status === 403) {
+          if (queueChip) queueChip.textContent = "Sign-in required";
+          if (degradedStrip) degradedStrip.hidden = true;
+          queueBody.textContent = "";
+          const tr = document.createElement("tr");
+          const td = cell(subtle("Sign in as a store owner or admin to view the publish queue."));
+          td.colSpan = 6;
+          tr.append(td);
+          queueBody.append(tr);
+          return;
+        }
+        const data = await res.json();
+        if (!res.ok) {
+          setStatus(statusEl, data.error || "Could not load the change queue (" + res.status + ")", "err");
+          return;
+        }
+        renderCurrent(data.current, data.shippedBy);
+        renderQueue(data);
+        applyPrDeeplink();
+        renderAggregate(data);
+        // rux7: this is fresh authoritative data — resync the poll clock so the
+        // next tick dedupes against it, and reset the cadence to responsive
+        // (a manual refresh / a just-completed action likely means more coming).
+        lastChangesSignature = changesSignature(data);
+        pollDelay = POLL_BASE_MS;
+        schedulePoll();
+      } catch {
+        setStatus(statusEl, "Could not load the change queue — network error", "err");
+      }
+    };
+
+    // ---- b11: the aggregate card + exact-digest Publish ---------------------
+    // Reads the aggregate/runs/plan projection GET /api/changes now returns
+    // (AggregateCardView + AggregateShipPlanView, built by aggregateView.ts):
+    //   - the aggregate's queueState + build sha + reviewed digest,
+    //   - the COMBINED EVIDENCE = the last integration run's honest state +
+    //     statusMessage (never re-derived),
+    //   - the included-PR batch,
+    //   - the b09 ship PLAN (pinned SHA/digest/PRs/rollback/paywall + run link),
+    //     shown inline so the confirm never has to POST to preview it.
+
+    const aggPanel = root.querySelector("[data-publish-aggregate]");
+    const AGG_STATE_CHIP = {
+      empty: "",
+      queued: "amber",
+      integrating: "blue",
+      green: "green",
+      red: "red",
+      shipped: "green",
+    };
+    // The plan we last rendered — the exact-digest guard the Publish POST sends
+    // back so a stale plan (queue moved / artifact changed) is refused, never
+    // shipped blind.
+    let currentPlan = null;
+
+    const runLink = (revHref, label) => {
+      if (!revHref) return null;
+      const a = document.createElement("a");
+      a.href = revHref;
+      a.target = "_blank";
+      a.rel = "noopener";
+      a.textContent = label || "Open build";
+      return a;
+    };
+
+    const renderAggregate = (data) => {
+      if (!aggPanel) return;
+      const agg = data.aggregate || null;
+      const plan = data.plan || null;
+      currentPlan = plan && plan.ok ? plan : null;
+
+      const chipEl = aggPanel.querySelector("[data-aggregate-chip]");
+      const shaEl = aggPanel.querySelector("[data-aggregate-sha]");
+      const runLinkEl = aggPanel.querySelector("[data-aggregate-run-link]");
+      const evEl = aggPanel.querySelector("[data-aggregate-evidence]");
+      const evDetailEl = aggPanel.querySelector("[data-aggregate-evidence-detail]");
+      const digestEl = aggPanel.querySelector("[data-aggregate-digest]");
+      const prsWrap = aggPanel.querySelector("[data-aggregate-prs-wrap]");
+      const prsList = aggPanel.querySelector("[data-aggregate-prs]");
+      const publishBtn = aggPanel.querySelector("[data-aggregate-publish]");
+      const publishDetail = aggPanel.querySelector("[data-aggregate-publish-detail]");
+
+      const state = (agg && agg.queueState) || "empty";
+      if (chipEl) {
+        chipEl.textContent = state;
+        chipEl.className = "chip " + (AGG_STATE_CHIP[state] || "");
+      }
+      if (shaEl) shaEl.textContent = agg && agg.aggregateSha ? shortSha(agg.aggregateSha) : "—";
+      if (runLinkEl) {
+        runLinkEl.textContent = "";
+        const link = agg && runLink(agg.revHref, "Open build");
+        if (link) runLinkEl.append(link);
+        else runLinkEl.append(document.createTextNode("The current green preview build for this store."));
+      }
+
+      // Combined evidence = the last (or in-flight) integration run's honest state.
+      const lastRun = agg && (agg.activeRun || agg.lastRun);
+      if (evEl) {
+        if (!lastRun) {
+          evEl.textContent = "No runs yet";
+        } else if (lastRun.state === "passed") {
+          evEl.textContent = "Passed";
+        } else if (lastRun.state === "failed") {
+          evEl.textContent = "Failed";
+        } else {
+          evEl.textContent = "Integrating…";
+        }
+      }
+      if (evDetailEl) {
+        evDetailEl.textContent = "";
+        if (lastRun) {
+          const parts = [];
+          if (lastRun.statusMessage) parts.push(lastRun.statusMessage);
+          else if (lastRun.state === "passed") parts.push("Combined evidence passed.");
+          else if (lastRun.state === "failed") parts.push("Combined evidence did not pass.");
+          if (lastRun.finishedAt) parts.push(age(lastRun.finishedAt));
+          evDetailEl.append(document.createTextNode(parts.join(" · ")));
+          const rl = runLink(lastRun.revHref, "Run build");
+          if (rl) {
+            evDetailEl.append(document.createTextNode(" · "));
+            evDetailEl.append(rl);
+          }
+        } else {
+          evDetailEl.append(document.createTextNode("The last integration run's verdict."));
+        }
+      }
+
+      // Reviewed digest: only known once the plan pins it (b09). Never fabricated.
+      if (digestEl) {
+        digestEl.textContent = currentPlan ? shortSha(currentPlan.artifactDigest.replace(/^sha256:/, "")) : "—";
+      }
+
+      // Included PRs.
+      const prs = (agg && agg.includedPrs) || [];
+      if (prsWrap) prsWrap.hidden = prs.length === 0;
+      if (prsList) {
+        prsList.textContent = "";
+        for (const pr of prs) {
+          const li = document.createElement("li");
+          const label = document.createElement("span");
+          label.textContent = pr.prNumber != null ? "PR #" + pr.prNumber : pr.changeId;
+          const sha = document.createElement("span");
+          sha.className = "publish-mono subtle";
+          sha.textContent = shortSha(pr.headSha);
+          li.append(label, sha);
+          prsList.append(li);
+        }
+      }
+
+      renderPlan(data.plan);
+
+      // The Publish button: enabled only for a shippable, paywall-cleared plan and
+      // a viewer who can ship. A paywalled plan is SHOWN (upsell), never hidden.
+      if (publishBtn) {
+        const shippable = Boolean(currentPlan);
+        const paywalled = currentPlan && currentPlan.paywall && !currentPlan.paywall.allowed;
+        // rux7: never re-enable the Publish button while its POST is in flight —
+        // a poll refresh landing mid-publish must not open a double-submit.
+        publishBtn.disabled =
+          aggregatePublishing || !canShip || !shippable || paywalled || currentPlan.alreadyShipped;
+        publishBtn.title = !canShip
+          ? "Requires an owner or admin sign-in"
+          : !shippable
+            ? "The aggregate is not green / has no passed run to publish yet"
+            : paywalled
+              ? "Publishing to your live store is part of the paid plan"
+              : currentPlan.alreadyShipped
+                ? "This reviewed build is already live"
+                : "Publish the exact reviewed digest to your live store";
+      }
+      if (publishDetail) {
+        if (currentPlan && currentPlan.alreadyShipped) {
+          publishDetail.textContent =
+            "This reviewed build (" + shortSha(currentPlan.pinnedSha) + ") is already live. ";
+          const view = document.createElement("a");
+          view.href = ds.liveHref || "/";
+          view.target = "_blank";
+          view.rel = "noopener";
+          view.textContent = "View your live store →";
+          publishDetail.append(view);
+        } else if (currentPlan) {
+          publishDetail.textContent =
+            "Publishes the exact reviewed digest " + shortSha(currentPlan.artifactDigest.replace(/^sha256:/, "")) +
+            " (build " + shortSha(currentPlan.pinnedSha) + ") — no rebuild.";
+        } else {
+          publishDetail.textContent =
+            "Publishes the exact reviewed digest — no rebuild. Available once the aggregate is green and its integration run passed.";
+        }
+      }
+    };
+
+    const renderPlan = (plan) => {
+      const planBox = aggPanel && aggPanel.querySelector("[data-aggregate-plan]");
+      if (!planBox) return;
+      const chipEl = planBox.querySelector("[data-aggregate-plan-chip]");
+      const grid = planBox.querySelector("[data-aggregate-plan-grid]");
+      const note = planBox.querySelector("[data-aggregate-plan-note]");
+      if (grid) grid.textContent = "";
+
+      // No plan at all (degenerate: no store bound) — hide the box.
+      if (!plan) {
+        planBox.hidden = true;
+        return;
+      }
+      planBox.hidden = false;
+
+      if (!plan.ok) {
+        // An honest refusal — show WHY it isn't shippable, never a fake plan.
+        if (chipEl) {
+          chipEl.textContent = "Not shippable";
+          chipEl.className = "chip amber";
+        }
+        if (note) note.textContent = plan.message || ("Not shippable (" + (plan.reason || "refused") + ").");
+        return;
+      }
+
+      const paywalled = plan.paywall && !plan.paywall.allowed;
+      if (chipEl) {
+        chipEl.textContent = plan.alreadyShipped ? "Already live" : paywalled ? "Upgrade required" : "Ready to publish";
+        chipEl.className = "chip " + (plan.alreadyShipped ? "green" : paywalled ? "amber" : "green");
+      }
+
+      const row = (term, value, mono) => {
+        const dt = document.createElement("dt");
+        dt.textContent = term;
+        const dd = document.createElement("dd");
+        if (value instanceof Node) dd.append(value);
+        else {
+          dd.textContent = value;
+          if (mono) dd.className = "publish-mono";
+        }
+        grid.append(dt, dd);
+      };
+
+      row("Reviewed build", shortSha(plan.pinnedSha), true);
+      row("Reviewed digest", shortSha(plan.artifactDigest.replace(/^sha256:/, "")), true);
+      row("Included changes", String((plan.includedPrs || []).length) + " change" + ((plan.includedPrs || []).length === 1 ? "" : "s"));
+      const runCell = document.createElement("span");
+      runCell.append(document.createTextNode(plan.integrationRunId));
+      const planRunLink = runLink(plan.pinnedRevHref, "Open build");
+      if (planRunLink) {
+        runCell.append(document.createTextNode(" · "));
+        runCell.append(planRunLink);
+      }
+      row("Integration run", runCell);
+      if (plan.rollbackTarget) {
+        row("Rollback to", shortSha(plan.rollbackTarget.aggregateSha), true);
+      } else {
+        row("Rollback to", "None (first publish)");
+      }
+      row("Subscription", plan.paywall && plan.paywall.allowed ? "Enabled" : "Not enabled");
+
+      if (note) {
+        note.textContent = paywalled
+          ? (plan.paywall.message || "Publishing to your live store requires the paid plan.")
+          : plan.alreadyShipped
+            ? "This reviewed build is already live — nothing to publish."
+            : "Publish sends the exact reviewed digest above to your live store. No rebuild.";
+      }
+    };
+
+    // The exact-digest Publish (b10 ship = b09 orchestrator.ship). Confirms the
+    // pinned plan, then POSTs { confirmGoLive, expectedAggregateSha,
+    // expectedArtifactDigest } — the reviewed-digest guard: a stale plan (queue
+    // moved / artifact changed) is refused by the server, never shipped blind.
+    // ── Publish-live ceremony (shipoff) ──────────────────────────────────────
+    // The go-live counterpart of the accept liftoff below (shares its shell,
+    // styles, planRow + celebrate helpers — referenced at runtime, defined a few
+    // sections down). One honest in-flight state: ship is a single POST that
+    // promotes the pinned digest, so no staged theater — just plan → publishing →
+    // outcome with a real "View your live store" link.
+    const shipoff = root.querySelector("[data-shipoff]");
+    const shipoffCard = shipoff && shipoff.querySelector(".liftoff-card");
+    const shipoffEls = shipoff
+      ? {
+          plan: shipoff.querySelector("[data-shipoff-plan]"),
+          flight: shipoff.querySelector("[data-shipoff-flight]"),
+          outcome: shipoff.querySelector("[data-shipoff-outcome]"),
+          grid: shipoff.querySelector("[data-shipoff-grid]"),
+          proceed: shipoff.querySelector("[data-shipoff-proceed]"),
+          cancel: shipoff.querySelector("[data-shipoff-cancel]"),
+          live: shipoff.querySelector("[data-shipoff-live]"),
+          elapsed: shipoff.querySelector("[data-shipoff-elapsed]"),
+          seal: shipoff.querySelector("[data-shipoff-seal]"),
+          outcomeTitle: shipoff.querySelector("[data-shipoff-outcome-title]"),
+          outcomeDetail: shipoff.querySelector("[data-shipoff-outcome-detail]"),
+          view: shipoff.querySelector("[data-shipoff-view]"),
+          done: shipoff.querySelector("[data-shipoff-done]"),
+          confetti: shipoff.querySelector("[data-shipoff-confetti]"),
+        }
+      : null;
+    let shipoffTimer = null;
+    const closeShipoff = () => {
+      if (shipoffTimer) { clearInterval(shipoffTimer); shipoffTimer = null; }
+      if (shipoff) shipoff.hidden = true;
+      if (shipoffEls) shipoffEls.confetti.textContent = "";
+    };
+    const showShipoffPhase = (phase) => {
+      if (!shipoffEls) return;
+      shipoffEls.plan.hidden = phase !== "plan";
+      shipoffEls.flight.hidden = phase !== "flight";
+      shipoffEls.outcome.hidden = phase !== "outcome";
+      if (shipoffCard) shipoffCard.dataset.mode = phase;
+    };
+
+    const buildPublishPlanText = (plan) => {
+      const lines = ["Publish plan (exact reviewed digest — no rebuild):"];
+      lines.push("  tenant:   " + (appDomain || repo));
+      lines.push("  build:    " + shortSha(plan.pinnedSha));
+      lines.push("  digest:   " + plan.artifactDigest);
+      lines.push("  changes:  " + (plan.includedPrs || []).length + " included");
+      if (plan.rollbackTarget) lines.push("  rollback: " + shortSha(plan.rollbackTarget.aggregateSha));
+      lines.push("  effect:   publish this exact digest to your LIVE store.");
+      return lines.join("\n");
+    };
+
+    const shortDigest = (digest) => {
+      const d = String(digest || "").replace(/^sha256:/, "");
+      return d ? "sha256:" + d.slice(0, 12) + "…" : "—";
+    };
+
+    const publishAggregate = (button) => {
+      if (!currentPlan) return;
+      const plan = currentPlan;
+      if (!shipoff || !shipoffEls) {
+        // No-markup fallback only — the ceremony IS the confirm now.
+        if (!window.confirm(buildPublishPlanText(plan) + "\n\nPublish live?")) return;
+        runShip(plan, button);
+        return;
+      }
+      shipoffEls.grid.textContent = "";
+      shipoffEls.grid.append(
+        ...planRow("Store", appDomain || repo),
+        ...planRow("Build", shortSha(plan.pinnedSha), true),
+        ...planRow("Digest", shortDigest(plan.artifactDigest), true),
+        ...planRow("Changes", (plan.includedPrs || []).length + " included"),
+        ...(plan.rollbackTarget
+          ? planRow("Rollback to", shortSha(plan.rollbackTarget.aggregateSha), true)
+          : []),
+      );
+      showShipoffPhase("plan");
+      shipoff.hidden = false;
+      shipoffEls.proceed.focus();
+      shipoffEls.cancel.onclick = () => closeShipoff();
+      shipoffEls.done.onclick = () => closeShipoff();
+      shipoffEls.proceed.onclick = () => runShip(plan, button);
+    };
+
+    const runShip = async (plan, button) => {
+      if (button) button.disabled = true;
+      aggregatePublishing = true; // rux7: hold the button disabled across polls
+      setStatus(aggStatusEl, "Publishing the reviewed build (" + shortSha(plan.pinnedSha) + ") live…");
+      const startedAt = Date.now();
+      if (shipoffEls) {
+        showShipoffPhase("flight");
+        shipoffTimer = setInterval(() => {
+          const s = Math.floor((Date.now() - startedAt) / 1000);
+          shipoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
+        }, 1000);
+      }
+      const outcome = (state, title, detail, showView) => {
+        if (!shipoffEls) return;
+        if (shipoffTimer) { clearInterval(shipoffTimer); shipoffTimer = null; }
+        shipoffEls.seal.dataset.state = state;
+        shipoffEls.outcomeTitle.textContent = title;
+        shipoffEls.outcomeDetail.textContent = detail;
+        shipoffEls.view.hidden = !showView;
+        if (showView) shipoffEls.view.href = ds.liveHref || "/";
+        showShipoffPhase("outcome");
+        shipoffEls.done.focus();
+        if (state === "ok") celebrate(shipoffEls.confetti);
+      };
+      try {
+        const res = await fetch(ds.shipEndpoint, {
+          method: "POST",
+          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
+          body: JSON.stringify({
+            aggregateId: plan.aggregateId,
+            // The HUMAN go-live gate + the reviewed-digest guards (b09 ship input).
+            confirmGoLive: true,
+            expectedAggregateSha: plan.pinnedSha,
+            expectedArtifactDigest: plan.artifactDigest,
+          }),
+        });
+        const data = await res.json().catch(() => ({}));
+        // b09 AggregateShipResult: the ONLY live claim is state === "shipped".
+        if (data.state === "shipped") {
+          setStatus(
+            aggStatusEl,
+            "Published live · build " + shortSha(data.pinnedSha) + " (receipt " + (data.receiptId || "—") + ").",
+            "ok",
+          );
+          outcome(
+            "ok",
+            "Your store is live",
+            "Build " + shortSha(data.pinnedSha) + " — the exact digest you reviewed — is now serving" +
+              (data.receiptId ? " (receipt " + data.receiptId + ")." : "."),
+            true,
+          );
+        } else {
+          let message;
+          if (data.state === "promote_failed" || data.state === "record_failed") {
+            // Honest partial-failure truth — recoverable, never a false "shipped".
+            message = data.message || "Publish did not complete (" + data.state + "). Retry.";
+          } else if (data.reason === "paywall") {
+            message = data.message || "Publishing to your live store is part of the paid plan.";
+          } else {
+            message = data.message || data.error || "Publish refused (" + (data.reason || res.status) + ")";
+          }
+          setStatus(aggStatusEl, message, "err");
+          outcome("err", "Publish did not complete", message + " Your live store is unchanged.", false);
+        }
+      } catch {
+        setStatus(aggStatusEl, "Publish failed — network error", "err");
+        outcome(
+          "err",
+          "Publish did not complete",
+          "Network error mid-publish — refresh to see the honest state; your live store serves the last published version.",
+          false,
+        );
+      } finally {
+        aggregatePublishing = false;
+        if (button) button.disabled = false;
+        loadQueue();
+        loadVersions();
+      }
+    };
+
+    const aggStatusEl = aggPanel && aggPanel.querySelector("[data-aggregate-status]");
+    aggPanel
+      ?.querySelector("[data-aggregate-publish]")
+      ?.addEventListener("click", (event) => publishAggregate(event.currentTarget));
+
+    // ── Accept-to-preview LIFTOFF ─────────────────────────────────────────────
+    // The plan confirm + live integration flight + outcome ceremony (replaces
+    // the old window.confirm plan popup). Same b11 contract as before: accept =
+    // `POST /api/changes/integrate` (b08) → integrate into the protected
+    // `preview` aggregate, rebuild + combined-evidence it (b05). Flips NO live
+    // channel — going live is the aggregate card's Publish.
+    //
+    // HONESTY RULE for the stage rail: a stage only advances on a REAL signal —
+    // the outcome POST resolving, or GET /api/changes polling showing the
+    // candidate inside `aggregate.includedPrs` (merge landed) / an `activeRun`
+    // (build+evidence running, statusMessage relayed verbatim). No timers ever
+    // fake progress.
+    const liftoff = root.querySelector("[data-liftoff]");
+    const liftoffCard = liftoff && liftoff.querySelector(".liftoff-card");
+    const liftoffEls = liftoff
+      ? {
+          plan: liftoff.querySelector("[data-liftoff-plan]"),
+          flight: liftoff.querySelector("[data-liftoff-flight]"),
+          outcome: liftoff.querySelector("[data-liftoff-outcome]"),
+          title: liftoff.querySelector("[data-liftoff-title]"),
+          grid: liftoff.querySelector("[data-liftoff-grid]"),
+          proceed: liftoff.querySelector("[data-liftoff-proceed]"),
+          cancel: liftoff.querySelector("[data-liftoff-cancel]"),
+          flightTitle: liftoff.querySelector("[data-liftoff-flight-title]"),
+          live: liftoff.querySelector("[data-liftoff-live]"),
+          elapsed: liftoff.querySelector("[data-liftoff-elapsed]"),
+          hide: liftoff.querySelector("[data-liftoff-hide]"),
+          seal: liftoff.querySelector("[data-liftoff-seal]"),
+          outcomeTitle: liftoff.querySelector("[data-liftoff-outcome-title]"),
+          outcomeDetail: liftoff.querySelector("[data-liftoff-outcome-detail]"),
+          review: liftoff.querySelector("[data-liftoff-review]"),
+          done: liftoff.querySelector("[data-liftoff-done]"),
+          confetti: liftoff.querySelector("[data-liftoff-confetti]"),
+        }
+      : null;
+
+    const liftoffStage = (name) =>
+      liftoff && liftoff.querySelector('[data-liftoff-stage="' + name + '"]');
+    const LIFTOFF_STAGES = ["merge", "build", "evidence", "green"];
+    const setStage = (name, state) => {
+      const el = liftoffStage(name);
+      if (el) el.dataset.state = state; // pending | active | done | fail
+    };
+    // Advance the rail so everything before `name` is done and `name` is active.
+    const railTo = (name) => {
+      const idx = LIFTOFF_STAGES.indexOf(name);
+      LIFTOFF_STAGES.forEach((s, i) => {
+        const el = liftoffStage(s);
+        const cur = el && el.dataset.state;
+        if (cur === "fail") return; // never un-fail
+        setStage(s, i < idx ? "done" : i === idx ? "active" : "pending");
+      });
+    };
+
+    let liftoffTimer = null;
+    let liftoffPoll = null;
+    let liftoffOpenedFrom = null;
+    const stopLiftoffLoops = () => {
+      if (liftoffTimer) { clearInterval(liftoffTimer); liftoffTimer = null; }
+      if (liftoffPoll) { clearInterval(liftoffPoll); liftoffPoll = null; }
+    };
+    const closeLiftoff = () => {
+      stopLiftoffLoops();
+      if (liftoff) liftoff.hidden = true;
+      if (liftoffEls) liftoffEls.confetti.textContent = "";
+      if (liftoffOpenedFrom && document.contains(liftoffOpenedFrom)) liftoffOpenedFrom.focus();
+      liftoffOpenedFrom = null;
+    };
+    const showPhase = (phase) => {
+      if (!liftoffEls) return;
+      liftoffEls.plan.hidden = phase !== "plan";
+      liftoffEls.flight.hidden = phase !== "flight";
+      liftoffEls.outcome.hidden = phase !== "outcome";
+      if (liftoffCard) liftoffCard.dataset.mode = phase;
+    };
+
+    const planRow = (dt, dd, mono) => {
+      const t = document.createElement("dt");
+      t.textContent = dt;
+      const d = document.createElement("dd");
+      d.textContent = dd;
+      if (mono) d.className = "publish-mono";
+      return [t, d];
+    };
+
+    const celebrate = (container) => {
+      if (!container) return;
+      if (window.matchMedia && window.matchMedia("(prefers-reduced-motion: reduce)").matches) return;
+      const colors = ["#0f9d8f", "#25b8a8", "#f4b942", "#5b8def", "#e2634f"];
+      for (let i = 0; i < 42; i++) {
+        const p = document.createElement("i");
+        p.style.left = Math.random() * 100 + "%";
+        p.style.background = colors[i % colors.length];
+        p.style.animationDelay = Math.random() * 0.35 + "s";
+        p.style.animationDuration = 0.9 + Math.random() * 0.9 + "s";
+        p.style.setProperty("--liftoff-drift", (Math.random() * 160 - 80).toFixed(0) + "px");
+        p.style.setProperty("--liftoff-spin", (Math.random() * 640 - 320).toFixed(0) + "deg");
+        container.append(p);
+      }
+      setTimeout(() => { container.textContent = ""; }, 2400);
+    };
+
+    // The live poll during flight: reflect the server's REAL progress.
+    const startFlightPoll = (change, preFlightSha) => {
+      let inAggregate = false;
+      liftoffPoll = setInterval(async () => {
+        try {
+          const res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
+          if (!res.ok) return;
+          const data = await res.json();
+          const agg = data.aggregate || {};
+          const included = (agg.includedPrs || []).some((p) => p.changeId === change.changeId);
+          const shaMoved = agg.aggregateSha && agg.aggregateSha !== preFlightSha;
+          const run = agg.activeRun || null;
+          if (!inAggregate && (included || shaMoved)) {
+            inAggregate = true;
+            railTo("build");
+            if (liftoffEls) liftoffEls.live.textContent =
+              "Merged into preview — rebuilding the combined aggregate…";
+          }
+          if (run) {
+            railTo("evidence");
+            if (liftoffEls) liftoffEls.live.textContent =
+              run.statusMessage || "Combined evidence is running…";
+          }
+        } catch { /* polling is best-effort; the POST outcome is authoritative */ }
+      }, 2500);
+    };
+
+    const openLiftoff = (change, button) => {
+      if (!liftoff || !liftoffEls) return false;
+      liftoffOpenedFrom = button || null;
+      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
+      liftoffEls.title.textContent = "Integrate " + target + " into preview";
+      liftoffEls.grid.textContent = "";
+      liftoffEls.grid.append(
+        ...planRow("Store", appDomain || repo),
+        ...(change.prNumber != null ? planRow("Pull request", "#" + change.prNumber) : []),
+        ...planRow("Change", change.changeId, true),
+        ...(change.headSha ? planRow("Head", shortSha(change.headSha), true) : []),
+      );
+      LIFTOFF_STAGES.forEach((s) => setStage(s, "pending"));
+      liftoffEls.live.textContent = "Working…";
+      liftoffEls.elapsed.textContent = "0:00";
+      showPhase("plan");
+      liftoff.hidden = false;
+      liftoffEls.proceed.focus();
+
+      liftoffEls.cancel.onclick = () => closeLiftoff();
+      liftoffEls.done.onclick = () => closeLiftoff();
+      liftoffEls.hide.onclick = () => { liftoff.hidden = true; }; // flight keeps running
+      liftoffEls.proceed.onclick = () => runIntegration(change, button);
+      return true;
+    };
+
+    // Esc: close in plan/outcome; during flight just hide (the POST keeps going).
+    // Handles BOTH ceremonies (accept liftoff + publish shipoff).
+    document.addEventListener("keydown", (ev) => {
+      if (ev.key !== "Escape") return;
+      if (liftoff && !liftoff.hidden) {
+        const mode = liftoffCard && liftoffCard.dataset.mode;
+        if (mode === "flight") liftoff.hidden = true;
+        else closeLiftoff();
+      }
+      if (shipoff && !shipoff.hidden) {
+        const mode = shipoffCard && shipoffCard.dataset.mode;
+        if (mode === "flight") shipoff.hidden = true;
+        else closeShipoff();
+      }
+    });
+
+    // b08 integrate returns an IntegrateOutcome — { ok, queueState, runState,
+    // aggregateSha, pointerMoved, statusMessage, reason? } — NEVER a bare
+    // merged:true. Render it honestly: green advances the aggregate; red left it
+    // exactly where it was and names the failing stage.
+    const runIntegration = async (change, button) => {
+      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
+      if (button) button.disabled = true;
+      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
+      setStatus(statusEl, "Integrating " + change.changeId + " into preview…");
+      const startedAt = Date.now();
+      let preFlightSha = null;
+      if (liftoffEls) {
+        showPhase("flight");
+        liftoffEls.flightTitle.textContent = "Integrating " + target + " into preview";
+        railTo("merge");
+        liftoffEls.live.textContent = "Squash-merging the candidate into preview…";
+        liftoffTimer = setInterval(() => {
+          const s = Math.floor((Date.now() - startedAt) / 1000);
+          liftoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
+        }, 1000);
+      }
+      try {
+        // Snapshot the pre-flight aggregate sha so the poll can detect the merge
+        // landing (sha moved) even before includedPrs reflects it.
+        try {
+          const pre = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
+          if (pre.ok) preFlightSha = ((await pre.json()).aggregate || {}).aggregateSha || null;
+        } catch { /* best-effort */ }
+        startFlightPoll(change, preFlightSha);
+
+        const res = await fetch(ds.integrateEndpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            // Mirror of the server-side capability model (UX): the server
+            // re-derives capability and stays authoritative.
+            "x-tot-capability": "ship-on-behalf",
+          },
+          body: JSON.stringify({
+            repo,
+            changeId: change.changeId,
+            prNumber: change.prNumber ?? undefined,
+            expectedHeadSha: change.headSha || undefined,
+          }),
+        });
+        const data = await res.json().catch(() => ({}));
+        stopLiftoffLoops();
+        if (res.ok && data.ok) {
+          setStatus(
+            statusEl,
+            "Integrated " + change.changeId + " — preview aggregate is green (" +
+              shortSha(data.aggregateSha) + "). Review the aggregate, then Publish to go live.",
+            "ok",
+          );
+          if (liftoffEls) {
+            LIFTOFF_STAGES.forEach((s) => setStage(s, "done"));
+            liftoffEls.seal.dataset.state = "ok";
+            liftoffEls.outcomeTitle.textContent = "The preview aggregate is green";
+            liftoffEls.outcomeDetail.textContent =
+              target + " is in. Aggregate build " + shortSha(data.aggregateSha) +
+              " passed its combined evidence — this exact build is what you review, and what " +
+              "Publish would take live. Nothing is live yet.";
+            if (data.aggregateSha) {
+              liftoffEls.review.href =
+                "/preview/" + encodeURIComponent(appDomain) + "/rev/" + data.aggregateSha + "/";
+              liftoffEls.review.hidden = false;
+            } else {
+              liftoffEls.review.hidden = true;
+            }
+            if (liftoff.hidden) liftoff.hidden = false; // surface the payoff even if backgrounded
+            showPhase("outcome");
+            liftoffEls.done.focus();
+            celebrate(liftoffEls.confetti);
+          }
+        } else {
+          let message;
+          let failStage = "merge";
+          if (res.ok && data.queueState === "red") {
+            // The queue ran but the aggregate did not go green — the candidate did
+            // NOT advance the shippable set. Name the honest failing stage.
+            failStage = "evidence";
+            message =
+              "Integration of " + change.changeId + " failed (" + (data.reason || "red") + "): " +
+              (data.statusMessage || "the aggregate did not pass its combined evidence.") +
+              " The aggregate is unchanged.";
+          } else if (data.reason === "not_preview_base") {
+            message =
+              "Not integrated: " + change.changeId + " does not target the preview branch " +
+              "(base is not \"preview\"). " + (data.statusMessage || "");
+          } else {
+            message = data.statusMessage || data.error || "Integrate failed (" + res.status + ")";
+          }
+          setStatus(statusEl, message, "err");
+          if (liftoffEls) {
+            setStage(failStage, "fail");
+            liftoffEls.seal.dataset.state = "err";
+            liftoffEls.outcomeTitle.textContent = "Integration did not land";
+            liftoffEls.outcomeDetail.textContent = message;
+            liftoffEls.review.hidden = true;
+            if (liftoff.hidden) liftoff.hidden = false;
+            showPhase("outcome");
+            liftoffEls.done.focus();
+          }
+        }
+      } catch {
+        stopLiftoffLoops();
+        setStatus(statusEl, "Integrate failed — network error", "err");
+        if (liftoffEls) {
+          liftoffEls.seal.dataset.state = "err";
+          liftoffEls.outcomeTitle.textContent = "Integration did not land";
+          liftoffEls.outcomeDetail.textContent =
+            "Network error mid-flight — refresh the queue to see the aggregate's honest state.";
+          liftoffEls.review.hidden = true;
+          if (liftoff.hidden) liftoff.hidden = false;
+          showPhase("outcome");
+        }
+      } finally {
+        busyChanges.delete(change.changeId);
+        if (button) button.disabled = false;
+        loadQueue();
+      }
+    };
+
+    const integrateCandidate = (change, button) => {
+      // The liftoff dialog IS the plan confirm now; window.confirm stays only as
+      // the no-dialog fallback (markup missing = fail open to the old popup).
+      if (openLiftoff(change, button)) return;
+      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
+      const plan =
+        "Accept-to-preview plan:\n  tenant:    " + (appDomain || repo) +
+        (change.prNumber != null ? "\n  PR:        #" + change.prNumber : "") +
+        "\n  change id: " + change.changeId +
+        (change.headSha ? "\n  head sha:  " + shortSha(change.headSha) : "") +
+        "\n  effect:    integrate " + target + " into the preview aggregate, then rebuild + " +
+        "re-evidence it. Does NOT go live — publish the reviewed build separately.";
+      if (!window.confirm(plan + "\n\nProceed?")) return;
+      runIntegration(change, button);
+    };
+
+    const rejectChange = async (change, button) => {
+      const reason = window.prompt(
+        "Reject " + change.changeId + " — add a short note for the submitter:",
+      );
+      if (reason == null) return;
+      if (!reason.trim()) {
+        setStatus(statusEl, "A reject note is required.", "err");
+        return;
+      }
+      button.disabled = true;
+      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
+      setStatus(statusEl, "Rejecting " + change.changeId + "…");
+      try {
+        const res = await fetch(
+          ds.changesEndpoint + "/" + encodeURIComponent(change.changeId) + "/reject",
+          {
+            method: "POST",
+            headers: {
+              "content-type": "application/json",
+              "x-tot-capability": "ship-on-behalf",
+            },
+            body: JSON.stringify({ repo, reason: reason.trim() }),
+          },
+        );
+        const data = await res.json().catch(() => ({}));
+        if (res.ok) {
+          setStatus(statusEl, "Change " + change.changeId + " rejected.", "ok");
+        } else {
+          setStatus(statusEl, data.error || "Reject failed (" + res.status + ")", "err");
+        }
+      } catch {
+        setStatus(statusEl, "Reject failed — network error", "err");
+      } finally {
+        busyChanges.delete(change.changeId);
+        button.disabled = false;
+        loadQueue();
+      }
+    };
+
+    // U7 — retire/GC. Mirror of the accept plan affordance (decision
+    // operator-verb-and-hosting-model): state EXACTLY what retire does — evict the
+    // candidate's preview environment + immutable version — and that it is
+    // REBUILDABLE (degrades to "not built yet", not a 404), so an operator can't
+    // confuse it with Reject. Same shape as `tot retire`'s CLI plan for parity.
+    const buildRetirePlan = (change) => {
+      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
+      const lines = ["Retire plan:", "  tenant:    " + (appDomain || repo)];
+      if (change.prNumber != null) lines.push("  PR:        #" + change.prNumber);
+      lines.push("  change id: " + change.changeId);
+      if (change.headSha) lines.push("  head sha:  " + shortSha(change.headSha));
+      lines.push(
+        "  effect:    evict " + target + "'s preview environment + version to reclaim space.",
+      );
+      lines.push(
+        "  rebuild:   REVERSIBLE — rebuild it any time (this is NOT Reject; the change stays open).",
+      );
+      return lines.join("\n");
+    };
+
+    const retireChange = async (change, button) => {
+      if (!window.confirm(buildRetirePlan(change) + "\n\nProceed?")) return;
+      button.disabled = true;
+      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
+      setStatus(statusEl, "Retiring " + change.changeId + "…");
+      try {
+        const res = await fetch(ds.retireEndpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            // Mirror of the server-side capability model (UX); the server
+            // re-derives capability and stays authoritative.
+            "x-tot-capability": "ship-on-behalf",
+          },
+          body: JSON.stringify({
+            changeId: change.changeId,
+            pr: change.prNumber ?? undefined,
+          }),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (res.ok && data.ok) {
+          setStatus(
+            statusEl,
+            data.evicted
+              ? "Retired " + change.changeId + " — the preview was evicted (rebuildable on demand)."
+              : "Retire " + change.changeId + ": nothing to evict (already retired).",
+            "ok",
+          );
+        } else {
+          setStatus(statusEl, data.error || "Retire failed (" + res.status + ")", "err");
+        }
+      } catch {
+        setStatus(statusEl, "Retire failed — network error", "err");
+      } finally {
+        busyChanges.delete(change.changeId);
+        button.disabled = false;
+        loadQueue();
+      }
+    };
+
+    // ---- rux5: build-on-demand for a synthetic not-built PR ------------------
+    // Mirror of the integrate/retire plan affordances: state EXACTLY what build
+    // does — materialize this PR's hosted preview at its forge head — and that it
+    // is INERT (flips no live channel). POSTs { pr, headSha?, baseSha? }; the row
+    // already carries the head sha GET /api/changes resolved via forge PR-read, and
+    // the server re-resolves it authoritatively when the body omits it. Shows an
+    // in-progress state (disabled + "Building…") while the build runs, then reloads
+    // the queue so the freshly-built PR reappears as a built candidate.
+
+    const buildPreviewPlan = (change) => {
+      const lines = ["Build preview plan:", "  tenant:   " + (appDomain || repo)];
+      lines.push("  PR:       #" + change.prNumber);
+      if (change.headSha) lines.push("  head sha: " + shortSha(change.headSha));
+      lines.push(
+        "  effect:   materialize this PR's hosted preview at its head — INERT " +
+          "(does NOT go live).",
+      );
+      return lines.join("\n");
+    };
+
+    const buildPreview = async (change, button) => {
+      const label = "PR #" + change.prNumber;
+      if (!window.confirm(buildPreviewPlan(change) + "\n\nBuild the preview now?")) return;
+      button.disabled = true;
+      const originalText = button.textContent;
+      button.textContent = "Building…";
+      button.dataset.building = "true";
+      // rux7: record the in-flight build so a poll re-render preserves the
+      // spinner/disabled state on the freshly-rendered button (cleared in finally).
+      if (change.prNumber != null) inflightBuilds.add(change.prNumber);
+      setStatus(statusEl, "Building preview for " + label + "…");
+      try {
+        const res = await fetch(ds.buildEndpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            // Mirror of the server-side capability model (UX); the server
+            // re-derives capability (buildGate) and stays authoritative.
+            "x-tot-capability": "ship-on-behalf",
+          },
+          body: JSON.stringify({
+            pr: change.prNumber,
+            headSha: change.headSha || undefined,
+            baseSha: change.baseSha || undefined,
+          }),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (res.ok && data.ok) {
+          setStatus(
+            statusEl,
+            "Built preview for " + label +
+              " — it now appears as a built change in the queue.",
+            "ok",
+          );
+        } else if (data && data.ok === false) {
+          // reconcileCandidate returned a blocked/failed candidate (e.g. a safety
+          // finding with no override) — the honest reason, never a false success.
+          setStatus(
+            statusEl,
+            "Build did not complete for " + label + ": " +
+              ((data.errors && data.errors.join("; ")) || data.error || "blocked"),
+            "err",
+          );
+        } else {
+          setStatus(statusEl, data.error || "Build failed (" + res.status + ")", "err");
+        }
+      } catch {
+        setStatus(statusEl, "Build failed — network error", "err");
+      } finally {
+        if (change.prNumber != null) inflightBuilds.delete(change.prNumber);
+        button.disabled = false;
+        button.textContent = originalText;
+        delete button.dataset.building;
+        loadQueue();
+      }
+    };
+
+    // ---- rux6: unified review pane -----------------------------------------
+    // "One review moment": expanding a candidate row reveals a single pane with
+    // the live preview (iframed SAME-ORIGIN — the /preview/<tenant>/pr/<N> route
+    // serves `frame-ancestors 'self'` + `X-Frame-Options: SAMEORIGIN`, so a
+    // same-origin admin embed is permitted; a cross-origin embed is refused,
+    // which is why the pane also always offers an "Open in new tab" link), the
+    // evidence chips the row already carries (change.evidence), the dg7 diff
+    // (reusing renderDiff below — GET /api/changes/<id>/diff, which never invents
+    // a diff for a non-renderable candidate), and the SAME Accept-to-preview /
+    // Reject actions. The reviewer never leaves the queue to review and act; the
+    // server stays authoritative for every action (this is UI consolidation only).
+
+    const diffBase = ds.diffEndpointBase;
+
+    const reviewRowFor = (tr) => {
+      const next = tr.nextElementSibling;
+      return next && next.dataset && next.dataset.publishReviewRow === tr.dataset.changeRowId
+        ? next
+        : null;
+    };
+
+    const closeReview = (tr, button) => {
+      const existing = reviewRowFor(tr);
+      if (existing) existing.remove();
+      if (button) {
+        button.textContent = "Review";
+        button.setAttribute("aria-expanded", "false");
+      }
+    };
+
+    // Evidence chips from the data the row already carries (change.evidence):
+    // an overall promotable verdict + one chip per reported check.
+    const renderEvidenceChips = (container, change) => {
+      const checks = (change.evidence && change.evidence.checks) || [];
+      const promotable = Boolean(change.evidence && change.evidence.promotable);
+      container.append(
+        promotable ? chip("Checks passed", "green") : chip("Checks blocked", "amber"),
+      );
+      for (const c of checks) {
+        const tone = c.status === "pass" ? "green" : c.status === "fail" ? "red" : "amber";
+        const label = (c.label || c.id || "check") + (c.status && c.status !== "pass" ? " · " + c.status : "");
+        const el = chip(label, tone);
+        if (c.detail) el.title = c.detail;
+        container.append(el);
+      }
+      if (!checks.length) container.append(subtle("No checks reported yet"));
+    };
+
+    // Build the split pane. Returns the pane node + the diff container so the
+    // caller can populate the diff asynchronously (reusing renderDiff).
+    const buildReviewPane = (change) => {
+      const pane = document.createElement("div");
+      pane.className = "review-pane";
+
+      // Preview column — same-origin iframe of the friendly per-PR route (it
+      // handles every state: ready render, or the not-built page). Falls back to
+      // any server-provided previewUrl for a change-first row with no PR number.
+      const previewUrl = candidatePrUrl(change.prNumber) || change.previewUrl;
+      const previewCol = document.createElement("div");
+      previewCol.className = "review-preview";
+      const pHead = document.createElement("div");
+      pHead.className = "review-pane-head";
+      const pTitle = document.createElement("b");
+      pTitle.textContent = "Preview";
+      pHead.append(pTitle);
+      if (previewUrl) {
+        const openLink = document.createElement("a");
+        openLink.href = previewUrl;
+        openLink.target = "_blank";
+        openLink.rel = "noopener";
+        openLink.textContent = "Open in new tab ↗";
+        pHead.append(openLink);
+      }
+      previewCol.append(pHead);
+      if (previewUrl) {
+        const frame = document.createElement("iframe");
+        frame.className = "review-frame";
+        frame.src = previewUrl;
+        frame.loading = "lazy";
+        frame.title =
+          change.prNumber != null
+            ? "Preview of PR #" + change.prNumber
+            : "Preview of " + change.changeId;
+        previewCol.append(frame);
+      } else {
+        previewCol.append(subtle("No preview is available for this change yet."));
+      }
+
+      // Detail column — evidence chips + diff + the same Accept/Reject actions.
+      const detailCol = document.createElement("div");
+      detailCol.className = "review-detail";
+
+      const evSection = document.createElement("div");
+      evSection.className = "review-section";
+      const evTitle = document.createElement("b");
+      evTitle.textContent = "Checks";
+      const evChips = document.createElement("div");
+      evChips.className = "review-chips";
+      renderEvidenceChips(evChips, change);
+      evSection.append(evTitle, evChips);
+      detailCol.append(evSection);
+
+      const diffSection = document.createElement("div");
+      diffSection.className = "review-section";
+      const diffTitle = document.createElement("b");
+      diffTitle.textContent = "Diff";
+      const diffTarget = document.createElement("div");
+      diffTarget.className = "review-diff-target";
+      diffTarget.append(subtle("Loading the diff…"));
+      diffSection.append(diffTitle, diffTarget);
+      detailCol.append(diffSection);
+
+      // The SAME actions as the row — same handlers, same gates. Not a new authz
+      // path: integrateCandidate/rejectChange POST to the same endpoints, and the
+      // server re-authorizes.
+      const actionRow = document.createElement("div");
+      actionRow.className = "review-actions";
+      const accept = document.createElement("button");
+      accept.type = "button";
+      accept.className = "btn primary";
+      accept.textContent = "Accept to preview";
+      accept.disabled = !canShip || !change.mergeable;
+      accept.title = !canShip
+        ? "Requires an owner or admin sign-in"
+        : !change.mergeable
+          ? "This change is not ready to integrate"
+          : "Integrate this change into the preview aggregate (does not go live)";
+      accept.addEventListener("click", () => integrateCandidate(change, accept));
+      const reject = document.createElement("button");
+      reject.type = "button";
+      reject.className = "btn";
+      reject.textContent = "Reject";
+      reject.disabled = !canShip;
+      reject.title = canShip
+        ? "Close this change without publishing"
+        : "Requires an owner or admin sign-in";
+      reject.addEventListener("click", () => rejectChange(change, reject));
+      actionRow.append(accept, reject);
+      detailCol.append(actionRow);
+
+      pane.append(previewCol, detailCol);
+      return { pane, diffTarget };
+    };
+
+    const loadReviewDiff = async (change, diffTarget) => {
+      try {
+        const res = await fetch(diffBase + "/" + encodeURIComponent(change.changeId) + "/diff", {
+          headers: { accept: "application/json" },
+        });
+        const data = await res.json().catch(() => ({}));
+        diffTarget.textContent = "";
+        if (!res.ok) {
+          diffTarget.append(subtle(data.error || "Could not load the diff (" + res.status + ")"));
+        } else {
+          renderDiff(diffTarget, data.diff || {});
+        }
+      } catch {
+        diffTarget.textContent = "";
+        diffTarget.append(subtle("Could not load the diff — network error"));
+      }
+    };
+
+    const toggleReview = (change, button, tr) => {
+      if (!tr.dataset.changeRowId) tr.dataset.changeRowId = change.changeId;
+      if (reviewRowFor(tr)) {
+        closeReview(tr, button);
+        return;
+      }
+      const detailTr = document.createElement("tr");
+      detailTr.dataset.publishReviewRow = tr.dataset.changeRowId;
+      const td = document.createElement("td");
+      td.colSpan = 6;
+      td.className = "publish-review-cell";
+      const { pane, diffTarget } = buildReviewPane(change);
+      td.append(pane);
+      detailTr.append(td);
+      tr.after(detailTr);
+      button.textContent = "Hide review";
+      button.setAttribute("aria-expanded", "true");
+      loadReviewDiff(change, diffTarget);
+    };
+
+    const CHANGE_MARK = { added: "+", changed: "~", removed: "−" };
+
+    const renderDiff = (td, diff) => {
+      td.textContent = "";
+      const head = document.createElement("div");
+      head.className = "publish-diff-head";
+
+      // Authority: honest label of whether the diff describes the exact head.
+      const authority = diff.authority || {};
+      const authChip = chip(
+        authority.authoritative
+          ? "Reviewed at head"
+          : authority.stale
+            ? "Last-good preview (stale vs head)"
+            : authority.missing
+              ? "No evidence yet"
+              : "Head",
+        authority.authoritative ? "green" : authority.stale ? "amber" : "",
+      );
+      head.append(authChip);
+
+      if (diff.headSha) {
+        const sha = document.createElement("span");
+        sha.className = "publish-mono subtle";
+        sha.textContent = "head " + shortSha(diff.headSha);
+        head.append(sha);
+      }
+      if (diff.revHref) {
+        const rev = document.createElement("a");
+        rev.href = diff.revHref;
+        rev.target = "_blank";
+        rev.rel = "noopener";
+        rev.textContent = "Open reviewed revision";
+        head.append(rev);
+      }
+      td.append(head);
+
+      if (!diff.renderable) {
+        // Honest: a candidate that can't render has NO diff — say why (dg3), no fake.
+        const reason = document.createElement("p");
+        reason.className = "note publish-diff-blocked";
+        reason.textContent =
+          diff.blockedReason || "This candidate has no renderable version to diff yet.";
+        td.append(reason);
+        return;
+      }
+
+      const files = Array.isArray(diff.files) ? diff.files : [];
+      if (!files.length) {
+        td.append(subtle("No file changes vs the current live version."));
+        return;
+      }
+      const list = document.createElement("ul");
+      list.className = "publish-diff-list";
+      for (const f of files) {
+        const li = document.createElement("li");
+        li.className = "publish-diff-" + f.change;
+        const mark = document.createElement("span");
+        mark.className = "publish-diff-mark";
+        mark.textContent = CHANGE_MARK[f.change] || "•";
+        const path = document.createElement("code");
+        path.textContent = f.path;
+        li.append(mark, path);
+        list.append(li);
+      }
+      td.append(list);
+    };
+
+    // ---- dg7: versions / promotion history + rollback ----------------------
+    // The promotion history (u2/u3 promotion_status) with the tenant Gitea SHA,
+    // its /rev link (u5), and the current-live marker; a prior version rolls back
+    // THROUGH the one orchestrator (/api/changes/rollback → u8), rendering only the
+    // HONEST terminal state (rolled_back only when verified).
+
+    const versionsPanel = root.querySelector("[data-publish-versions]");
+    const versionsBody = versionsPanel?.querySelector("[data-versions-body]");
+    const versionsChip = versionsPanel?.querySelector("[data-versions-chip]");
+    const versionsStatus = versionsPanel?.querySelector("[data-versions-status]");
+    const versionsRollbackNote = versionsPanel?.querySelector("[data-versions-rollback-note]");
+    let rollbackMode = "control-plane";
+
+    const renderVersions = (view) => {
+      if (!versionsBody) return;
+      const versions = Array.isArray(view.versions) ? view.versions : [];
+      rollbackMode = view.rollbackMode || "control-plane";
+      versionsBody.textContent = "";
+
+      if (versionsChip) {
+        versionsChip.textContent = versions.length === 1 ? "1 version" : versions.length + " versions";
+        versionsChip.className = "chip" + (versions.length ? " blue" : "");
+      }
+
+      // Static tenants (rux13): per-version rollback is an HONEST ONE-DISPATCH.
+      // The console can't enumerate the S3 versions archive digest, so it dispatches
+      // by the tenant version id and CI resolves the digest + re-publishes — it
+      // completes via CI, not instantly (never implied one-click).
+      if (versionsRollbackNote) {
+        if (rollbackMode === "static-archive") {
+          versionsRollbackNote.hidden = false;
+          versionsRollbackNote.textContent =
+            "This store publishes to a static public site. Rolling back DISPATCHES a CI job that " +
+            "re-publishes the prior version from the S3 versions archive — it completes via CI, not " +
+            "instantly. The store keeps serving the current version until the re-publish is verified live.";
+        } else {
+          versionsRollbackNote.hidden = true;
+        }
+      }
+
+      if (!versions.length) {
+        const tr = document.createElement("tr");
+        const td = cell(subtle("No versions have been promoted to live yet."));
+        td.colSpan = 6;
+        tr.append(td);
+        versionsBody.append(tr);
+        return;
+      }
+
+      for (const v of versions) {
+        const tr = document.createElement("tr");
+
+        // Version identity: the tenant Gitea SHA (content authority) + source.
+        const idCell = document.createElement("td");
+        const strong = document.createElement("strong");
+        strong.className = "publish-mono";
+        strong.textContent = shortSha(v.versionId);
+        idCell.append(strong);
+        if (v.source) idCell.append(subtle(v.source === "commit" ? "From a commit" : "Content hash"));
+        tr.append(idCell);
+
+        // Digest (static current only — never fabricated for priors).
+        const digestCell = cell(v.digest ? shortSha(v.digest) : "—");
+        digestCell.classList.add("publish-mono");
+        if (!v.digest) digestCell.classList.add("subtle");
+        tr.append(digestCell);
+
+        tr.append(cell(age(v.promotedAt)));
+
+        // Preview: the u5 immutable /rev/<sha> link.
+        const revCell = document.createElement("td");
+        if (v.revHref) {
+          const a = document.createElement("a");
+          a.href = v.revHref;
+          a.target = "_blank";
+          a.rel = "noopener";
+          a.textContent = "Revision";
+          revCell.append(a);
+        } else {
+          revCell.append(subtle("—"));
+        }
+        tr.append(revCell);
+
+        // State: current live vs prior.
+        tr.append(cell(v.isCurrent ? chip("Current live", "green") : chip("Prior", "")));
+
+        // Action: roll back to a PRIOR version (never the current one).
+        const act = document.createElement("td");
+        act.className = "action publish-actions";
+        if (!v.isCurrent) {
+          const rollbackBtn = document.createElement("button");
+          rollbackBtn.type = "button";
+          rollbackBtn.className = "btn";
+          const isStatic = rollbackMode === "static-archive";
+          // Honest label: a static rollback completes via CI, not instantly (rux13).
+          rollbackBtn.textContent = isStatic ? "Roll back via CI" : "Roll back";
+          rollbackBtn.disabled = !canShip;
+          rollbackBtn.title = !canShip
+            ? "Requires an owner or ship-on-behalf sign-in"
+            : isStatic
+              ? "Dispatch a rollback to this version — completes via CI (not instant)"
+              : "Roll the live site back to this version";
+          rollbackBtn.addEventListener("click", () => rollbackVersion(v, rollbackBtn));
+          act.append(rollbackBtn);
+        }
+        tr.append(act);
+
+        versionsBody.append(tr);
+      }
+    };
+
+    const loadVersions = async () => {
+      if (!versionsBody) return;
+      try {
+        const res = await fetch(ds.versionsEndpoint, { headers: { accept: "application/json" } });
+        if (res.status === 401 || res.status === 403) {
+          if (versionsChip) versionsChip.textContent = "Sign-in required";
+          versionsBody.textContent = "";
+          const tr = document.createElement("tr");
+          const td = cell(subtle("Sign in as a store owner or admin to view published versions."));
+          td.colSpan = 6;
+          tr.append(td);
+          versionsBody.append(tr);
+          return;
+        }
+        const data = await res.json().catch(() => ({}));
+        if (!res.ok) {
+          setStatus(versionsStatus, data.error || "Could not load versions (" + res.status + ")", "err");
+          return;
+        }
+        renderVersions(data.view || {});
+      } catch {
+        setStatus(versionsStatus, "Could not load versions — network error", "err");
+      }
+    };
+
+    // Interpret the rollback response into ONE honest terminal state (mirrors the
+    // pure lib/publish/shipWorkspace `interpretRollbackResponse`; duplicated in
+    // plain JS because is:inline scripts can't import modules). `rolledBack` is
+    // true ONLY for a verified `rolled_back` — a `publish_pending` is NEVER a
+    // rolled-back claim.
+    const interpretRollback = (httpOk, body) => {
+      const toVersionId = typeof body.toVersionId === "string" ? body.toVersionId : null;
+      if (typeof body.state === "string") {
+        const state = ["rolled_back", "publish_pending", "publish_failed", "blocked"].includes(body.state)
+          ? body.state
+          : "error";
+        return {
+          state,
+          rolledBack: state === "rolled_back",
+          message: body.message || body.error || "Rollback returned state " + state + ".",
+        };
+      }
+      if (httpOk && body.rolledBack === true) {
+        return {
+          state: "rolled_back",
+          rolledBack: true,
+          message: toVersionId ? "Rolled back live to " + shortSha(toVersionId) + "." : "Rolled back live.",
+        };
+      }
+      return {
+        state: "blocked",
+        rolledBack: false,
+        message: (body.error || "Rollback failed") + (body.reason ? " (" + body.reason + ")" : ""),
+      };
+    };
+
+    const rollbackVersion = async (version, button) => {
+      // Static rollback (rux13) is an honest one-DISPATCH — completes via CI, not
+      // instantly; the confirm/status copy must never imply an instant flip.
+      const isStatic = rollbackMode === "static-archive";
+      const confirmMsg = isStatic
+        ? "Roll the static public site back to version " + shortSha(version.versionId) +
+            "? This DISPATCHES a rollback that completes via CI (not instantly) — the store keeps " +
+            "serving the current version until CI re-publishes the prior one."
+        : "Roll the live store back to version " + shortSha(version.versionId) +
+            "? This publishes that prior version to the live site.";
+      if (!window.confirm(confirmMsg)) return;
+      button.disabled = true;
+      setStatus(
+        versionsStatus,
+        isStatic
+          ? "Dispatching rollback to " + shortSha(version.versionId) + " (completes via CI)…"
+          : "Rolling back to " + shortSha(version.versionId) + "…",
+      );
+      try {
+        // The console dispatches by version id only; a static prior version's
+        // archive digest lives only in S3 (CI resolves it). Pass a digest ONLY when
+        // we honestly have one (never for a static prior — its digest is always null).
+        const payload = { targetVersionId: version.versionId };
+        if (version.digest) payload.targetDigest = version.digest;
+        const res = await fetch(ds.rollbackEndpoint, {
+          method: "POST",
+          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
+          body: JSON.stringify(payload),
+        });
+        const data = await res.json().catch(() => ({}));
+        const outcome = interpretRollback(res.ok, data);
+        setStatus(versionsStatus, outcome.message, outcome.rolledBack ? "ok" : outcome.state === "publish_pending" ? "ok" : "err");
+      } catch {
+        setStatus(versionsStatus, "Rollback failed — network error", "err");
+      } finally {
+        button.disabled = false;
+        loadVersions();
+        loadQueue();
+      }
+    };
+
+    // ---- Domain section ----------------------------------------------------
+
+    const domainPanel = root.querySelector("[data-publish-domain]");
+    let domainPollTimer = null;
+
+    const renderDomain = (payload) => {
+      if (!domainPanel) return;
+      const domain = payload.domain || {};
+      const stateEl = domainPanel.querySelector("[data-domain-state]");
+      const stateChip = domainPanel.querySelector("[data-domain-state-chip]");
+      const sinceEl = domainPanel.querySelector("[data-domain-since]");
+      const captureEl = domainPanel.querySelector("[data-domain-capture]");
+      const runEl = domainPanel.querySelector("[data-domain-run]");
+      const runDetailEl = domainPanel.querySelector("[data-domain-run-detail]");
+      const rollbackBtn = domainPanel.querySelector("[data-domain-rollback]");
+      const rollbackDetail = domainPanel.querySelector("[data-domain-rollback-detail]");
+      const connected = domain.state === "cloudfront";
+
+      if (stateEl) {
+        stateEl.textContent = connected
+          ? "Storefront CDN (cloudfront)"
+          : "Previous host (pantheon)";
+      }
+      if (stateChip) {
+        stateChip.textContent = connected ? "Connected" : "Not connected";
+        stateChip.className = "chip " + (connected ? "green" : "amber");
+      }
+      if (sinceEl) {
+        sinceEl.textContent = domain.since
+          ? "Since " + new Date(domain.since).toLocaleString()
+          : "Current host for " + (payload.appDomain || ds.appDomain);
+      }
+      if (captureEl) {
+        captureEl.textContent = domain.priorCapturedAt
+          ? "Captured " + new Date(domain.priorCapturedAt).toLocaleString()
+          : "None captured";
+      }
+
+      const run = domain.lastRun;
+      // "dispatched" = awaiting the CI completion callback (terminal-only wire).
+      const inFlight = run && run.status === "dispatched";
+      if (runEl) {
+        runEl.textContent = run
+          ? run.action + (run.rehearsal ? " (rehearsal)" : "") + " · " + run.status
+          : "None";
+      }
+      if (runDetailEl) {
+        runDetailEl.textContent = "";
+        if (run) {
+          const parts = [];
+          if (run.actor) parts.push("by " + run.actor);
+          if (run.startedAt) parts.push(age(run.startedAt));
+          runDetailEl.append(document.createTextNode(parts.join(" · ")));
+          if (run.runUrl) {
+            const link = document.createElement("a");
+            link.href = run.runUrl;
+            link.target = "_blank";
+            link.rel = "noopener";
+            link.textContent = "View run";
+            runDetailEl.append(document.createTextNode(" · "));
+            runDetailEl.append(link);
+          }
+          if (run.status === "failed" && run.error) {
+            const err = document.createElement("span");
+            err.className = "publish-error-detail";
+            err.textContent = run.error;
+            runDetailEl.append(document.createElement("br"));
+            runDetailEl.append(err);
+          }
+        } else {
+          runDetailEl.textContent = "Connect and rollback runs appear here.";
+        }
+      }
+      if (rollbackBtn) {
+        rollbackBtn.disabled =
+          !canShip || inFlight || !domain.priorRecordsKey;
+      }
+      if (rollbackDetail && domain.priorCapturedAt) {
+        rollbackDetail.textContent =
+          "Restores the DNS records captured " +
+          new Date(domain.priorCapturedAt).toLocaleString() + ".";
+      }
+
+      // Poll while a run is in flight so completion lands without a manual refresh.
+      if (domainPollTimer) {
+        clearTimeout(domainPollTimer);
+        domainPollTimer = null;
+      }
+      if (inFlight) domainPollTimer = setTimeout(loadDomain, 15000);
+    };
+
+    const loadDomain = async () => {
+      if (!domainPanel) return;
+      try {
+        const res = await fetch(ds.domainStatusEndpoint, {
+          headers: { accept: "application/json" },
+        });
+        if (!res.ok) return;
+        renderDomain(await res.json());
+      } catch {
+        /* leave the last rendered state */
+      }
+      // u9: refresh the readiness itemization alongside the status.
+      loadReadiness();
+    };
+
+    // ---- Cutover readiness (u9) --------------------------------------------
+    // Reads the SAME server gate `tot go-live` reads (/api/domain/readiness) and
+    // itemizes the preconditions. The Connect button additionally requires the
+    // server to report ready — the display and the enforcement can't diverge.
+    const readinessBox = domainPanel?.querySelector("[data-domain-readiness]");
+    const connectBtn = domainPanel?.querySelector("[data-domain-connect]");
+    let domainReady = false;
+
+    const renderReadiness = (payload) => {
+      if (!readinessBox) return;
+      const readiness = (payload && payload.readiness) || {};
+      const checks = Array.isArray(readiness.checks) ? readiness.checks : [];
+      domainReady = readiness.ready === true;
+      readinessBox.hidden = false;
+
+      const chip = readinessBox.querySelector("[data-domain-readiness-chip]");
+      if (chip) {
+        chip.textContent = domainReady ? "Ready" : "Not ready";
+        chip.className = "chip " + (domainReady ? "green" : "amber");
+      }
+      const list = readinessBox.querySelector("[data-domain-readiness-list]");
+      if (list) {
+        list.textContent = "";
+        for (const c of checks) {
+          const li = document.createElement("li");
+          li.className = c.ok ? "ok" : "blocked";
+          const mark = document.createElement("span");
+          mark.className = "domain-readiness-mark";
+          mark.textContent = c.ok ? "✓" : "✗";
+          const label = document.createElement("b");
+          label.textContent = c.label || c.id || "";
+          li.append(mark, label);
+          if (c.detail) {
+            const detail = document.createElement("span");
+            detail.className = "domain-readiness-detail";
+            detail.textContent = c.detail;
+            li.append(detail);
+          }
+          list.append(li);
+        }
+      }
+      const note = readinessBox.querySelector("[data-domain-readiness-note]");
+      if (note) {
+        note.textContent = payload && payload.ownerCapable === false
+          ? "Apex cutover is owner-only — sign in as the store owner to connect the domain."
+          : domainReady
+            ? "All preconditions are green — the cutover is permitted."
+            : "Clear the failing preconditions above before connecting the apex.";
+      }
+      // Gate the Connect button on server readiness in ADDITION to owner (the
+      // markup already disables it for non-owners); never enable it when blocked.
+      if (connectBtn && !connectBtn.dataset.ownerLocked) {
+        connectBtn.disabled = !domainReady;
+      }
+    };
+
+    const loadReadiness = async () => {
+      if (!readinessBox || !ds.domainReadinessEndpoint) return;
+      try {
+        const res = await fetch(ds.domainReadinessEndpoint, {
+          headers: { accept: "application/json", "x-tot-capability": "ship-on-behalf" },
+        });
+        if (!res.ok) return;
+        renderReadiness(await res.json());
+      } catch {
+        /* leave the last rendered readiness */
+      }
+    };
+
+    const domainStatusEl = domainPanel?.querySelector("[data-domain-status]");
+
+    const domainAction = async (body, button) => {
+      button.disabled = true;
+      setStatus(domainStatusEl, (body.action === "connect" ? "Connecting" : "Rolling back") + "…");
+      try {
+        const res = await fetch(ds.domainDispatchEndpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            "x-tot-capability": "ship-on-behalf",
+          },
+          body: JSON.stringify(body),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (res.ok && data.dispatched) {
+          setStatus(
+            domainStatusEl,
+            (body.action === "connect" ? "Connect" : "Rollback") +
+              (body.rehearsal ? " rehearsal" : "") +
+              " dispatched — the run status updates below as it progresses.",
+            "ok",
+          );
+        } else {
+          setStatus(domainStatusEl, data.error || "Request failed (" + res.status + ")", "err");
+        }
+      } catch {
+        setStatus(domainStatusEl, "Request failed — network error", "err");
+      } finally {
+        button.disabled = false;
+        loadDomain();
+      }
+    };
+
+    domainPanel?.querySelector("[data-domain-connect]")?.addEventListener("click", (event) => {
+      const confirmInput = domainPanel.querySelector("[data-domain-confirm]");
+      const rehearsal = Boolean(domainPanel.querySelector("[data-domain-rehearsal]")?.checked);
+      domainAction(
+        {
+          action: "connect",
+          confirmDomain: (confirmInput?.value || "").trim(),
+          rehearsal,
+        },
+        event.currentTarget,
+      );
+    });
+
+    domainPanel?.querySelector("[data-domain-rollback]")?.addEventListener("click", (event) => {
+      if (
+        !window.confirm(
+          "Roll back " + ds.appDomain + " to the previous host? DNS returns to the captured records in about a minute.",
+        )
+      ) {
+        return;
+      }
+      domainAction({ action: "rollback" }, event.currentTarget);
+    });
+
+    // ---- b17: branch retention ----------------------------------------------
+    // Renders the GET /api/changes/branches dry-run classification (already
+    // projected server-side by branchRetentionView.ts — this script only
+    // paints it, same division of labor as renderQueue/renderVersions above)
+    // and drives the guarded delete. The server (candidate_delete, b13)
+    // re-classifies fresh on every delete, so the confirm below is the HUMAN
+    // gate, not the safety guarantee — the safety guarantee is server-side.
+
+    const branchesPanel = root.querySelector("[data-publish-branches]");
+    const branchesBody = branchesPanel?.querySelector("[data-branches-body]");
+    const branchesChip = branchesPanel?.querySelector("[data-branches-chip]");
+    const branchesStatus = branchesPanel?.querySelector("[data-branches-status]");
+
+    const BRANCH_TONE = {
+      protected: "",
+      "active-open": "green",
+      "stale-open": "amber",
+      integrated: "blue",
+      "closed-or-rejected": "blue",
+      orphan: "red",
+    };
+
+    const buildCleanupPlan = (row) => {
+      return [
+        "Delete branch plan:",
+        "  repo:           " + (appDomain || repo),
+        "  branch:         " + row.ref,
+        "  tip sha:        " + row.shortSha,
+        "  classification: " + row.classificationLabel,
+        "  reason:         " + row.reason,
+        "",
+        "This deletes the Git BRANCH only — it never evicts a hosted preview build",
+        "(that is Retire, a separate action above). The server re-classifies this",
+        "branch fresh before deleting; a moved tip or a branch that is no longer",
+        "integrated/closed-or-rejected is refused, not silently skipped.",
+      ].join("\n");
+    };
+
+    const cleanupBranch = async (row, button) => {
+      if (!window.confirm(buildCleanupPlan(row) + "\n\nDelete this branch?")) return;
+      button.disabled = true;
+      setStatus(branchesStatus, "Deleting " + row.shortRef + "…");
+      try {
+        const res = await fetch(ds.branchesEndpoint, {
+          method: "POST",
+          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
+          body: JSON.stringify({ ref: row.ref, expectedSha: row.sha }),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (res.ok && data.ok) {
+          setStatus(
+            branchesStatus,
+            data.alreadyAbsent
+              ? row.shortRef + " was already gone (nothing to delete)."
+              : "Deleted " + row.shortRef + ".",
+            "ok",
+          );
+        } else {
+          setStatus(branchesStatus, data.error || "Delete refused (" + res.status + ")", "err");
+        }
+      } catch {
+        setStatus(branchesStatus, "Delete failed — network error", "err");
+      } finally {
+        button.disabled = false;
+        loadBranches();
+      }
+    };
+
+    const renderBranches = (view) => {
+      if (!branchesBody) return;
+      const rows = Array.isArray(view.rows) ? view.rows : [];
+      if (branchesChip) {
+        const needsReview = rows.filter((r) => r.quarantine || r.eligibleForDelete).length;
+        branchesChip.textContent = needsReview
+          ? needsReview + " to review"
+          : rows.length
+            ? rows.length + " branches"
+            : "0 branches";
+        branchesChip.className = "chip" + (needsReview ? " amber" : "");
+      }
+      branchesBody.textContent = "";
+      if (!rows.length) {
+        const tr = document.createElement("tr");
+        const td = cell(subtle("No candidate branches found for this repo."));
+        td.colSpan = 7;
+        tr.append(td);
+        branchesBody.append(tr);
+        return;
+      }
+
+      for (const row of rows) {
+        const tr = document.createElement("tr");
+
+        const branchCell = document.createElement("td");
+        const branchStrong = document.createElement("strong");
+        branchStrong.textContent = row.shortRef;
+        branchCell.append(branchStrong, subtle(row.ref + " @ " + row.shortSha));
+        tr.append(branchCell);
+
+        tr.append(cell(chip(row.classificationLabel, BRANCH_TONE[row.classification] || "")));
+
+        const prCell = document.createElement("td");
+        if (row.prNumber != null) {
+          // Link to the INTERNAL friendly PR route (/preview/<tenant>/pr/<N>), never
+          // the server-provided `row.prUrl` — that is the raw Gitea forge html_url the
+          // MCP candidate_list projection emits (<forge-host>/<org>/<repo>/pulls/N),
+          // and surfacing a raw forge link to an owner is exactly the boundary
+          // noGiteaLinks.test.ts guards (the source scan can't catch a host that
+          // arrives in data, so we refuse it here at render). Mirrors the candidate
+          // queue, which already builds its preview link this way.
+          const prHref = candidatePrUrl(row.prNumber);
+          if (prHref) {
+            const a = document.createElement("a");
+            a.href = prHref;
+            a.target = "_blank";
+            a.rel = "noopener";
+            a.textContent = "PR #" + row.prNumber;
+            prCell.append(a);
+          } else {
+            prCell.append(document.createTextNode("PR #" + row.prNumber));
+          }
+          prCell.append(subtle((row.prState || "") + (row.integratedIntoAggregate ? " · in aggregate" : "")));
+        } else {
+          prCell.append(subtle("No PR record"));
+        }
+        tr.append(prCell);
+
+        tr.append(cell(row.commitTimestampDisplay));
+        tr.append(cell(row.ageLabel));
+        tr.append(cell(row.evidenceSummary));
+
+        const actionsCell = document.createElement("td");
+        actionsCell.className = "action";
+        if (row.quarantine) {
+          actionsCell.append(chip("Needs owner review", "red"));
+        } else if (row.eligibleForDelete) {
+          const btn = document.createElement("button");
+          btn.type = "button";
+          btn.className = "btn";
+          btn.disabled = !canShip;
+          btn.title = canShip ? "" : "Requires an owner/admin sign-in.";
+          btn.textContent = "Clean up";
+          btn.addEventListener("click", () => cleanupBranch(row, btn));
+          actionsCell.append(btn);
+        } else {
+          actionsCell.append(subtle("Keep"));
+        }
+        tr.append(actionsCell);
+
+        branchesBody.append(tr);
+      }
+    };
+
+    const loadBranches = async () => {
+      if (!branchesBody) return;
+      try {
+        const res = await fetch(ds.branchesEndpoint, { headers: { accept: "application/json" } });
+        if (res.status === 401 || res.status === 403) {
+          if (branchesChip) branchesChip.textContent = "Sign-in required";
+          branchesBody.textContent = "";
+          const tr = document.createElement("tr");
+          const td = cell(subtle("Sign in as a store owner or admin to view branch retention."));
+          td.colSpan = 7;
+          tr.append(td);
+          branchesBody.append(tr);
+          return;
+        }
+        const data = await res.json().catch(() => ({}));
+        if (!res.ok) {
+          setStatus(branchesStatus, data.error || "Could not load branch classification (" + res.status + ")", "err");
+          return;
+        }
+        renderBranches(data.report || {});
+      } catch {
+        setStatus(branchesStatus, "Could not load branch classification — network error", "err");
+      }
+    };
+
+    // ---- Wiring ------------------------------------------------------------
+
+    root.querySelector("[data-publish-refresh]")?.addEventListener("click", () => {
+      setStatus(statusEl, "");
+      loadQueue();
+      loadVersions();
+      loadDomain();
+      loadBranches();
+    });
+
+    // rux7: pause polling while hidden; on return, refresh immediately (loadQueue
+    // re-renders + resyncs the poll clock) rather than waiting out the interval.
+    document.addEventListener("visibilitychange", () => {
+      if (document.hidden) {
+        clearPoll();
+      } else {
+        loadQueue();
+      }
+    });
+
+    // loadQueue starts the poll cadence via its tail (schedulePoll).
+    loadQueue();
+    loadVersions();
+    loadDomain();
+    loadBranches();
+  })();
+</script>
+
+<style>
+  .publish-table {
+    min-width: 900px;
+  }
+
+  .publish-mono {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 12px;
+  }
+
+  .publish-actions {
+    white-space: nowrap;
+  }
+
+  .publish-actions .btn {
+    margin-left: 6px;
+  }
+
+  .publish-status {
+    min-height: 0;
+  }
+
+  .publish-status:empty {
+    display: none;
+  }
+
+  .publish-status[data-state="ok"] {
+    color: var(--admin-green);
+  }
+
+  .publish-status[data-state="err"] {
+    color: var(--admin-red);
+  }
+
+  /* ?pr=N deep link: "not in the queue" callout + row flash */
+  .publish-pr-callout {
+    border: 1px solid var(--admin-line-strong);
+    border-left: 3px solid var(--admin-amber);
+    background: var(--admin-surface-soft);
+    padding: 8px 12px;
+    border-radius: var(--admin-radius-sm);
+    color: var(--admin-ink);
+  }
+
+  @keyframes publish-row-flash {
+    0%,
+    25% {
+      background-color: var(--admin-teal-soft);
+    }
+    100% {
+      background-color: transparent;
+    }
+  }
+
+  .publish-row-highlight > td {
+    animation: publish-row-flash 2.4s ease-out;
+  }
+
+  @media (prefers-reduced-motion: reduce) {
+    .publish-row-highlight > td {
+      animation: none;
+      background-color: var(--admin-teal-soft);
+    }
+  }
+
+  .publish-error-detail {
+    color: var(--admin-red);
+    font-size: 12px;
+  }
+
+  /* ── Accept-to-preview LIFTOFF ─────────────────────────────────────────── */
+  .liftoff-backdrop {
+    position: fixed;
+    inset: 0;
+    z-index: 60;
+    display: grid;
+    place-items: center;
+    padding: 24px;
+    background: color-mix(in srgb, var(--admin-ink) 32%, transparent);
+    backdrop-filter: blur(6px);
+    -webkit-backdrop-filter: blur(6px);
+  }
+
+  /* `display: grid` above beats the UA's [hidden] rule — restate it, or the
+     invisible backdrop click-blocks the entire page (caught by live test). */
+  .liftoff-backdrop[hidden] {
+    display: none;
+  }
+
+  .liftoff-card {
+    position: relative;
+    width: min(520px, 100%);
+    max-height: min(84vh, 640px);
+    overflow: auto;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius, 12px);
+    background: var(--admin-surface);
+    box-shadow: 0 24px 80px rgba(8, 32, 30, 0.35);
+    padding: 24px 26px;
+    animation: liftoff-in 0.22s ease-out;
+  }
+
+  @keyframes liftoff-in {
+    from { transform: translateY(10px) scale(0.985); opacity: 0; }
+    to { transform: none; opacity: 1; }
+  }
+
+  /* In-flight shimmer: a live gradient beam along the card's top edge. */
+  .liftoff-card::before {
+    content: "";
+    position: absolute;
+    inset: 0 0 auto 0;
+    height: 3px;
+    border-radius: inherit;
+    opacity: 0;
+    background: linear-gradient(90deg, transparent, var(--admin-teal, #0f9d8f), #f4b942, var(--admin-teal, #0f9d8f), transparent);
+    background-size: 220% 100%;
+    transition: opacity 0.3s ease;
+  }
+
+  .liftoff-card[data-mode="flight"]::before {
+    opacity: 1;
+    animation: liftoff-beam 1.6s linear infinite;
+  }
+
+  @keyframes liftoff-beam {
+    from { background-position: 200% 0; }
+    to { background-position: -20% 0; }
+  }
+
+  .liftoff-kicker {
+    margin: 0 0 2px;
+    font-size: 11px;
+    font-weight: 700;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--admin-teal, #0f9d8f);
+  }
+
+  .liftoff-title {
+    margin: 0 0 14px;
+    font-size: 19px;
+    line-height: 1.25;
+  }
+
+  .liftoff-grid {
+    display: grid;
+    grid-template-columns: auto 1fr;
+    gap: 6px 16px;
+    margin: 0 0 12px;
+    padding: 12px 14px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+  }
+
+  .liftoff-grid dt {
+    color: var(--admin-muted);
+    font-size: 12px;
+  }
+
+  .liftoff-grid dd {
+    margin: 0;
+    font-size: 13px;
+  }
+
+  .liftoff-actions {
+    display: flex;
+    justify-content: flex-end;
+    gap: 8px;
+    margin-top: 16px;
+  }
+
+  .liftoff-stages {
+    list-style: none;
+    margin: 6px 0 4px;
+    padding: 0;
+    display: grid;
+    gap: 0;
+  }
+
+  .liftoff-stages li {
+    position: relative;
+    display: flex;
+    gap: 12px;
+    align-items: flex-start;
+    padding: 9px 0;
+  }
+
+  /* Connecting rail between the dots. */
+  .liftoff-stages li + li::before {
+    content: "";
+    position: absolute;
+    left: 10px;
+    top: -8px;
+    height: 16px;
+    width: 2px;
+    background: var(--admin-line-strong);
+  }
+
+  .liftoff-stages li > div {
+    display: grid;
+    gap: 1px;
+  }
+
+  .liftoff-stages b {
+    font-size: 13px;
+  }
+
+  .liftoff-stages span:not(.liftoff-dot) {
+    font-size: 12px;
+    color: var(--admin-muted);
+  }
+
+  .liftoff-dot {
+    flex: none;
+    width: 21px;
+    height: 21px;
+    margin-top: 1px;
+    border-radius: 50%;
+    border: 2px solid var(--admin-line-strong);
+    display: grid;
+    place-items: center;
+    font-size: 12px;
+    font-weight: 700;
+    color: #fff;
+    background: transparent;
+    transition: all 0.25s ease;
+  }
+
+  .liftoff-stages li[data-state="active"] .liftoff-dot {
+    border-color: var(--admin-teal, #0f9d8f);
+    box-shadow: 0 0 0 0 color-mix(in srgb, var(--admin-teal, #0f9d8f) 45%, transparent);
+    animation: liftoff-pulse 1.3s ease-out infinite;
+  }
+
+  .liftoff-stages li[data-state="active"] b {
+    color: var(--admin-teal, #0f9d8f);
+  }
+
+  @keyframes liftoff-pulse {
+    from { box-shadow: 0 0 0 0 color-mix(in srgb, var(--admin-teal, #0f9d8f) 45%, transparent); }
+    to { box-shadow: 0 0 0 10px transparent; }
+  }
+
+  .liftoff-stages li[data-state="done"] .liftoff-dot {
+    border-color: var(--admin-green);
+    background: var(--admin-green);
+  }
+
+  .liftoff-stages li[data-state="done"] .liftoff-dot::after {
+    content: "✓";
+  }
+
+  .liftoff-stages li[data-state="fail"] .liftoff-dot {
+    border-color: var(--admin-red);
+    background: var(--admin-red);
+  }
+
+  .liftoff-stages li[data-state="fail"] .liftoff-dot::after {
+    content: "✕";
+  }
+
+  .liftoff-live {
+    margin: 8px 0 0;
+    min-height: 18px;
+    font-size: 13px;
+    color: var(--admin-ink);
+  }
+
+  .liftoff-meta {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    margin-top: 14px;
+    color: var(--admin-muted);
+  }
+
+  .liftoff-outcome-phase {
+    text-align: center;
+    padding-top: 6px;
+  }
+
+  .liftoff-outcome-phase .liftoff-actions {
+    justify-content: center;
+  }
+
+  .liftoff-seal {
+    width: 56px;
+    height: 56px;
+    margin: 4px auto 12px;
+    border-radius: 50%;
+    display: grid;
+    place-items: center;
+    font-size: 28px;
+    font-weight: 700;
+    color: #fff;
+  }
+
+  .liftoff-seal[data-state="ok"] {
+    background: var(--admin-green);
+    animation: liftoff-seal-pop 0.45s cubic-bezier(0.2, 1.6, 0.4, 1);
+  }
+
+  .liftoff-seal[data-state="ok"]::after {
+    content: "✓";
+  }
+
+  .liftoff-seal[data-state="err"] {
+    background: var(--admin-red);
+  }
+
+  .liftoff-seal[data-state="err"]::after {
+    content: "✕";
+  }
+
+  @keyframes liftoff-seal-pop {
+    from { transform: scale(0.4); opacity: 0; }
+    60% { transform: scale(1.12); }
+    to { transform: none; opacity: 1; }
+  }
+
+  .liftoff-confetti {
+    pointer-events: none;
+    position: absolute;
+    inset: 0;
+    overflow: hidden;
+    border-radius: inherit;
+  }
+
+  .liftoff-confetti i {
+    position: absolute;
+    top: -12px;
+    width: 7px;
+    height: 11px;
+    border-radius: 2px;
+    opacity: 0;
+    animation-name: liftoff-confetti-fall;
+    animation-timing-function: ease-in;
+    animation-fill-mode: forwards;
+  }
+
+  @keyframes liftoff-confetti-fall {
+    0% { opacity: 1; transform: translate(0, 0) rotate(0deg); }
+    100% {
+      opacity: 0.9;
+      transform: translate(var(--liftoff-drift, 0px), 660px) rotate(var(--liftoff-spin, 240deg));
+    }
+  }
+
+  @media (prefers-reduced-motion: reduce) {
+    .liftoff-card,
+    .liftoff-card[data-mode="flight"]::before,
+    .liftoff-stages li[data-state="active"] .liftoff-dot,
+    .liftoff-seal[data-state="ok"] {
+      animation: none;
+    }
+  }
+
+  .domain-connect-controls {
+    display: grid;
+    gap: 8px;
+    justify-items: end;
+    min-width: 220px;
+  }
+
+  .domain-connect-controls input[type="text"] {
+    width: 100%;
+    min-height: 36px;
+    padding: 0 10px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface);
+    color: var(--admin-ink);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 12px;
+  }
+
+  .domain-rehearsal {
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+    color: var(--admin-muted);
+    font-size: 12px;
+  }
+
+  @media (max-width: 720px) {
+    .domain-connect-controls {
+      justify-items: stretch;
+      min-width: 0;
+      width: 100%;
+    }
+  }
+
+  /* u9: apex-cutover readiness itemization */
+  .domain-readiness {
+    margin: 0.75rem 0;
+    padding: 0.75rem 1rem;
+    border: 1px solid var(--hairline, rgba(0, 0, 0, 0.12));
+    border-radius: 0.5rem;
+  }
+  .domain-readiness-head {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    margin-bottom: 0.5rem;
+  }
+  .domain-readiness-list {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+    display: grid;
+    gap: 0.25rem;
+  }
+  .domain-readiness-list li {
+    display: flex;
+    align-items: baseline;
+    gap: 0.4rem;
+    font-size: 0.9em;
+  }
+  .domain-readiness-mark {
+    font-weight: 700;
+    width: 1em;
+  }
+  .domain-readiness-list li.ok .domain-readiness-mark {
+    color: var(--good, #1a7f37);
+  }
+  .domain-readiness-list li.blocked .domain-readiness-mark {
+    color: var(--bad, #b42318);
+  }
+  .domain-readiness-detail {
+    opacity: 0.75;
+  }
+
+  /* b11: aggregate card + ship plan */
+  .aggregate-prs {
+    display: grid;
+    gap: 6px;
+  }
+
+  .aggregate-prs-list {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+    display: grid;
+    gap: 4px;
+  }
+
+  .aggregate-prs-list li {
+    display: flex;
+    align-items: baseline;
+    gap: 10px;
+    font-size: 13px;
+  }
+
+  .aggregate-plan {
+    padding: 0.75rem 1rem;
+    border: 1px solid var(--hairline, rgba(0, 0, 0, 0.12));
+    border-radius: 0.5rem;
+    display: grid;
+    gap: 8px;
+  }
+
+  .aggregate-plan-head {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+  }
+
+  .aggregate-plan-grid {
+    display: grid;
+    grid-template-columns: max-content 1fr;
+    gap: 4px 16px;
+    margin: 0;
+  }
+
+  .aggregate-plan-grid dt {
+    color: var(--admin-muted);
+    font-size: 12px;
+  }
+
+  .aggregate-plan-grid dd {
+    margin: 0;
+    font-size: 13px;
+    overflow-wrap: anywhere;
+  }
+
+  /* dg7: versions + diff */
+  .versions-table {
+    min-width: 780px;
+  }
+
+  /* rux6: unified review pane */
+  .publish-review-cell {
+    padding: 12px 14px;
+    background: var(--admin-surface-soft);
+  }
+
+  .review-pane {
+    display: grid;
+    grid-template-columns: minmax(0, 1.3fr) minmax(0, 1fr);
+    gap: 16px;
+    align-items: start;
+  }
+
+  @media (max-width: 900px) {
+    .review-pane {
+      grid-template-columns: 1fr;
+    }
+  }
+
+  .review-preview {
+    display: grid;
+    gap: 8px;
+    min-width: 0;
+  }
+
+  .review-pane-head {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 10px;
+  }
+
+  .review-frame {
+    width: 100%;
+    height: 420px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface);
+  }
+
+  .review-detail {
+    display: grid;
+    gap: 14px;
+    min-width: 0;
+  }
+
+  .review-section {
+    display: grid;
+    gap: 6px;
+  }
+
+  .review-chips {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 6px;
+  }
+
+  .review-actions {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px;
+  }
+
+  .publish-diff-head {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 10px;
+    margin-bottom: 8px;
+  }
+
+  .publish-diff-blocked {
+    color: var(--admin-amber);
+  }
+
+  .publish-diff-list {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+    display: grid;
+    gap: 3px;
+  }
+
+  .publish-diff-list li {
+    display: flex;
+    align-items: baseline;
+    gap: 8px;
+    font-size: 12px;
+  }
+
+  .publish-diff-mark {
+    width: 1em;
+    font-weight: 700;
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  }
+
+  .publish-diff-added .publish-diff-mark {
+    color: var(--admin-green);
+  }
+
+  .publish-diff-changed .publish-diff-mark {
+    color: var(--admin-blue);
+  }
+
+  .publish-diff-removed .publish-diff-mark {
+    color: var(--admin-red);
+  }
+
+  .publish-diff-list code {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 12px;
+    overflow-wrap: anywhere;
+  }
+</style>