@tokenoftrust/storefront-runner 1.4.0 → 1.4.1

package/apps/storefront/src/components/admin/AdminPublishTab.astro

@@ -6,9 +6,10 @@
  *
  *   - OPEN CHANGE QUEUE from GET /api/changes ({ current, changes }) with
  *     per-change reconcile/compliance state, preview link, head sha, and age.
- *   - GO LIVE (POST /api/changes/accept with expectedHeadSha — the stale-head
- *     "superseded" refusal and the audit record are surfaced legibly) and
- *     REJECT (with a note) per change.
+ *   - ACCEPT TO PREVIEW (POST /api/changes/integrate — b11's accept-to-preview
+ *     split; advances the shared `preview` aggregate, does NOT go live) and
+ *     REJECT (with a note) per change. Going live is the aggregate card's
+ *     exact-digest PUBLISH (POST /api/changes/ship), never a per-change accept.
  *   - LIVE STATE: the current live version (live-channel pointer) + the
  *     static-republish dispatch status for static-publish tenants (fired /
  *     skipped / sink-unbound notice).
@@ -78,7 +79,6 @@ const staticPublishEnabled = Boolean(
 const dispatchConfigured = Boolean((await readEnv("WWW_PUBLISH_DISPATCH_TOKEN"))?.trim());
 
 const changesEndpoint = withBase(basePath || "", "/api/changes");
-const acceptEndpoint = withBase(basePath || "", "/api/changes/accept");
 // b11 — the branch-integration lifecycle SPLIT of accept from publish:
 //   - integrateEndpoint = b08's "accept = integrate into the protected preview
 //     aggregate" (POST /api/changes/integrate → TenantIntegrationQueue.enqueue).
@@ -97,13 +97,25 @@ const shipEndpoint = withBase(basePath || "", "/api/changes/ship");
 // U7 — retire/GC: evict a candidate's ReviewEnvironment + version (rebuildable),
 // DISTINCT from reject (which closes the change). Gated server-side by retireGate.
 const retireEndpoint = withBase(basePath || "", "/api/preview/retire");
+// rux5 — build-on-demand for a synthetic not-built PR row: materialize the PR's
+// hosted preview (INERT — flips no live channel). Gated server-side by buildGate
+// (the ship-on-behalf floor); the endpoint resolves the head sha via forge PR-read
+// when the row supplies only the PR number.
+const buildEndpoint = withBase(basePath || "", "/api/preview/build");
 // dg7 — the ship-operations workspace woven into this tab: versions/promotion
 // history, per-candidate diff, and rollback (through the ONE rollback
 // orchestrator). Read endpoints mirror the change-queue's auth/scope.
 const versionsEndpoint = withBase(basePath || "", "/api/changes/versions");
 const rollbackEndpoint = withBase(basePath || "", "/api/changes/rollback");
+// b17 — branch retention: GET dry-run classification / POST guarded delete.
+// DISTINCT endpoint from retireEndpoint above (branch delete vs artifact evict).
+const branchesEndpoint = withBase(basePath || "", "/api/changes/branches");
 // The client builds `${diffEndpointBase}/<changeId>/diff` per candidate.
 const diffEndpointBase = changesEndpoint;
+// The live store's root on THIS surface (basePath-aware): where the published
+// digest actually serves. Rendered into "already live" copy + the publish
+// ceremony's "View your live store" CTA.
+const liveHref = withBase(basePath || "", "/");
 const domainStatusEndpoint = withBase(basePath || "", "/api/domain/status");
 const domainDispatchEndpoint = withBase(basePath || "", "/api/domain/dispatch");
 // u9: the machine-verifiable apex-cutover readiness gate — the SAME server gate the
@@ -120,18 +132,20 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
   data-agent-scope="publish"
   role="tabpanel"
   data-changes-endpoint={changesEndpoint}
-  data-accept-endpoint={acceptEndpoint}
   data-integrate-endpoint={integrateEndpoint}
   data-ship-endpoint={shipEndpoint}
   data-retire-endpoint={retireEndpoint}
+  data-build-endpoint={buildEndpoint}
   data-versions-endpoint={versionsEndpoint}
   data-rollback-endpoint={rollbackEndpoint}
+  data-branches-endpoint={branchesEndpoint}
   data-diff-endpoint-base={diffEndpointBase}
   data-domain-status-endpoint={domainStatusEndpoint}
   data-domain-dispatch-endpoint={domainDispatchEndpoint}
   data-domain-readiness-endpoint={domainReadinessEndpoint}
   data-repo={tenant.appDomain}
   data-app-domain={tenant.appDomain}
+  data-live-href={liveHref}
   data-can-ship={viewerCanShip ? "true" : "false"}
   data-is-owner={viewerIsOwner ? "true" : "false"}
   data-entitled={goLiveEntitled ? "true" : "false"}
@@ -202,6 +216,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
       <span>Published</span>
       <strong data-publish-live-at>—</strong>
       <small>When the live version last changed</small>
+      <small data-publish-live-shipped-by></small>
     </div>
     <div class="metric">
       <span>Open changes</span>
@@ -232,6 +247,23 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     </div>
     <div class="panel-body grid">
       <p class="note publish-status" data-publish-status role="status" aria-live="polite"></p>
+      <!-- rux1: forge-listing degraded strip. Shown ONLY when GET /api/changes
+           reports `degraded` (the open-PR listing failed) — distinct from the
+           genuine empty queue, so a forge blip never reads as "No open changes". -->
+      <div class="risk-alert" data-publish-degraded hidden role="alert">
+        <div class="risk-alert-main">
+          <svg><use href="#i-alert"></use></svg>
+          <div>
+            <b>Some open changes may not be shown</b>
+            <span>
+              We couldn't reach the pull-request list, so open changes that haven't been
+              built yet may be missing from the queue below. Built candidates are
+              unaffected. Refresh to try again.
+            </span>
+          </div>
+        </div>
+      </div>
+      <p class="note publish-pr-callout" data-publish-pr-callout hidden role="status" aria-live="polite"></p>
       <div class="table-wrap">
         <table class="publish-table">
           <thead>
@@ -357,6 +389,56 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     </div>
   </div>
 
+  <!-- b17: branch retention — Admin visibility into the branch-lifecycle
+       contract's "Candidate branch retirement" table (P1 items 8/9/11). Reads
+       the guarded `candidate_list` classification (protected/active-open/
+       stale-open/integrated/closed-or-rejected/orphan) and, for a branch that
+       classifies as ready, runs the guarded `candidate_delete` — which
+       re-classifies fresh server-side and refuses anything not integrated or
+       closed-or-rejected, no matter what this panel last rendered. DISTINCT
+       from the "Retire" action in the candidate queue above: retire evicts a
+       hosted PREVIEW ARTIFACT (rebuildable); this panel deletes a Git BRANCH
+       (transport only, never the durable record — see the note below). An
+       orphan is always shown quarantined for review, never one-click deletable. -->
+  <div class="panel" data-publish-branches>
+    <div class="panel-head">
+      <h3><svg><use href="#i-workflows"></use></svg>Branch retention</h3>
+      <span class="chip" data-branches-chip>Loading</span>
+    </div>
+    <div class="panel-body grid">
+      <p class="note">
+        Cleans up candidate <b>branches</b> once their pull request is merged or
+        closed — a different action on a different object than <b>Retire</b> in
+        the queue above, which only evicts a hosted preview build (rebuildable
+        on demand, never a branch). Every classification below is a fresh
+        dry-run; deleting always re-checks eligibility on the server and asks
+        you to confirm before removing anything. Orphan branches (no PR record
+        at all) are quarantined for your review, never deleted automatically.
+      </p>
+      <p class="note publish-status" data-branches-status role="status" aria-live="polite"></p>
+      <div class="table-wrap">
+        <table class="publish-table">
+          <thead>
+            <tr>
+              <th>Branch</th>
+              <th>Classification</th>
+              <th>PR</th>
+              <th>Tip commit</th>
+              <th>Age</th>
+              <th>Evidence</th>
+              <th class="action">Actions</th>
+            </tr>
+          </thead>
+          <tbody data-branches-body>
+            <tr data-branches-placeholder>
+              <td colspan="7"><span class="subtle">Loading branch classification…</span></td>
+            </tr>
+          </tbody>
+        </table>
+      </div>
+    </div>
+  </div>
+
   {staticPublishEnabled && (
     <div class="panel" data-publish-domain>
       <div class="panel-head">
@@ -449,6 +531,121 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
       </div>
     </div>
   )}
+
+  <!-- Accept-to-preview LIFTOFF — the plan confirm + live integration flight +
+       outcome ceremony. One dialog, three phases (plan → flight → outcome).
+       The flight's stage rail advances ONLY on real signals (the in-flight POST
+       plus GET /api/changes polling — includedPrs / activeRun / aggregateSha);
+       nothing is simulated. Replaces the old window.confirm() plan popup. -->
+  <div class="liftoff-backdrop" data-liftoff hidden>
+    <div class="liftoff-card" role="dialog" aria-modal="true" aria-labelledby="liftoff-title" tabindex="-1">
+      <div class="liftoff-phase" data-liftoff-plan>
+        <p class="liftoff-kicker">Accept to preview</p>
+        <h3 class="liftoff-title" id="liftoff-title" data-liftoff-title>Integrate into preview</h3>
+        <dl class="liftoff-grid" data-liftoff-grid></dl>
+        <p class="note">
+          Integrates this candidate into the protected <code>preview</code> aggregate, then
+          rebuilds it and re-runs its combined evidence. <b>Nothing goes live</b> —
+          publishing the reviewed build stays a separate, explicit step.
+        </p>
+        <div class="liftoff-actions">
+          <button class="btn" type="button" data-liftoff-cancel>Cancel</button>
+          <button class="btn primary" type="button" data-liftoff-proceed>
+            <svg><use href="#i-check"></use></svg>Integrate into preview
+          </button>
+        </div>
+      </div>
+
+      <div class="liftoff-phase" data-liftoff-flight hidden>
+        <p class="liftoff-kicker">Integration in flight</p>
+        <h3 class="liftoff-title" data-liftoff-flight-title>Integrating…</h3>
+        <ol class="liftoff-stages">
+          <li data-liftoff-stage="merge">
+            <span class="liftoff-dot"></span>
+            <div><b>Merge</b><span>squash-merge the candidate into <code>preview</code></span></div>
+          </li>
+          <li data-liftoff-stage="build">
+            <span class="liftoff-dot"></span>
+            <div><b>Rebuild</b><span>build the combined preview aggregate</span></div>
+          </li>
+          <li data-liftoff-stage="evidence">
+            <span class="liftoff-dot"></span>
+            <div><b>Evidence</b><span>re-run the aggregate's combined checks</span></div>
+          </li>
+          <li data-liftoff-stage="green">
+            <span class="liftoff-dot"></span>
+            <div><b>Green</b><span>the aggregate becomes the reviewable, shippable build</span></div>
+          </li>
+        </ol>
+        <p class="liftoff-live" data-liftoff-live role="status" aria-live="polite">Working…</p>
+        <div class="liftoff-meta">
+          <span class="publish-mono" data-liftoff-elapsed>0:00</span>
+          <button class="btn" type="button" data-liftoff-hide>Continue in background</button>
+        </div>
+      </div>
+
+      <div class="liftoff-phase liftoff-outcome-phase" data-liftoff-outcome hidden>
+        <div class="liftoff-seal" data-liftoff-seal aria-hidden="true"></div>
+        <h3 class="liftoff-title" data-liftoff-outcome-title></h3>
+        <p class="note" data-liftoff-outcome-detail></p>
+        <div class="liftoff-actions">
+          <a class="btn" data-liftoff-review target="_blank" rel="noopener" hidden>Review the preview build</a>
+          <button class="btn primary" type="button" data-liftoff-done>Done</button>
+        </div>
+      </div>
+
+      <div class="liftoff-confetti" data-liftoff-confetti aria-hidden="true"></div>
+    </div>
+  </div>
+
+  <!-- Publish-live ceremony — the go-live counterpart of the accept liftoff
+       (same shell/styles). Plan states the exact digest + no-rebuild contract;
+       flight is a single honest in-flight state (one POST, no staged theater);
+       outcome celebrates with a real "View your live store" link. Replaces the
+       raw window.confirm() publish popup. -->
+  <div class="liftoff-backdrop" data-shipoff hidden>
+    <div class="liftoff-card" role="dialog" aria-modal="true" aria-labelledby="shipoff-title" tabindex="-1">
+      <div class="liftoff-phase" data-shipoff-plan>
+        <p class="liftoff-kicker">Publish live</p>
+        <h3 class="liftoff-title" id="shipoff-title">Publish the reviewed build to your live store</h3>
+        <dl class="liftoff-grid" data-shipoff-grid></dl>
+        <p class="note">
+          Publishes this <b>exact reviewed digest</b> — no rebuild, nothing rides along.
+          Your live store updates in about a second; rolling back re-publishes the prior
+          version from the archive.
+        </p>
+        <div class="liftoff-actions">
+          <button class="btn" type="button" data-shipoff-cancel>Cancel</button>
+          <button class="btn primary" type="button" data-shipoff-proceed>
+            <svg><use href="#i-export"></use></svg>Publish live
+          </button>
+        </div>
+      </div>
+
+      <div class="liftoff-phase" data-shipoff-flight hidden>
+        <p class="liftoff-kicker">Publishing</p>
+        <h3 class="liftoff-title">Promoting the reviewed digest…</h3>
+        <p class="liftoff-live" data-shipoff-live role="status" aria-live="polite">
+          Pinning the exact reviewed build to your live channel…
+        </p>
+        <div class="liftoff-meta">
+          <span class="publish-mono" data-shipoff-elapsed>0:00</span>
+        </div>
+      </div>
+
+      <div class="liftoff-phase liftoff-outcome-phase" data-shipoff-outcome hidden>
+        <div class="liftoff-seal" data-shipoff-seal aria-hidden="true"></div>
+        <h3 class="liftoff-title" data-shipoff-outcome-title></h3>
+        <p class="note" data-shipoff-outcome-detail></p>
+        <div class="liftoff-actions">
+          <a class="btn primary" data-shipoff-view target="_blank" rel="noopener" hidden>View your live store</a>
+          <button class="btn" type="button" data-shipoff-done>Done</button>
+        </div>
+      </div>
+
+      <div class="liftoff-confetti" data-shipoff-confetti aria-hidden="true"></div>
+    </div>
+  </div>
 </section>
 
 <script is:inline nonce={cspNonce}>
@@ -464,6 +661,21 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     const queueBody = root.querySelector("[data-publish-queue-body]");
     const queueChip = root.querySelector("[data-publish-queue-chip]");
     const queueCount = root.querySelector("[data-publish-queue-count]");
+    const degradedStrip = root.querySelector("[data-publish-degraded]");
+
+    // rux7 — in-flight UI state the auto-refresh poll must preserve across a
+    // re-render. These are the AUTHORITATIVE source of truth (never scraped
+    // back out of the DOM): an action's async closure holds a reference to the
+    // OLD button, so after a poll swaps the row the completion signal lands on a
+    // detached node — reading `disabled`/`data-building` off the fresh DOM would
+    // wedge forever. buildPreview/integrate/reject/retire add on start and
+    // delete in `finally` (before their own loadQueue), so the next render
+    // reflects the true busy set. Open diff panes are the exception: the DOM IS
+    // their source of truth (toggleDiff owns open/close), so renderQueue detaches
+    // and re-attaches the actual pane node — see renderQueue.
+    const inflightBuilds = new Set(); // prNumber currently building
+    const busyChanges = new Set(); // changeId with an in-flight integrate/reject/retire
+    let aggregatePublishing = false; // the aggregate Publish POST is in flight
 
     const setStatus = (el, message, state) => {
       if (!el) return;
@@ -474,6 +686,14 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
 
     const shortSha = (sha) => (sha ? String(sha).slice(0, 8) : "—");
 
+    // Inline mirror of `candidatePrUrl` (lib/preview/candidateDashboard.ts) — an
+    // is:inline script can't import a module, so the pure URL shape is mirrored
+    // here (same pattern as `shortSha`). The friendly `/preview/<tenant>/pr/<N>`
+    // route handles every state (ready, not-built, …), so a row with a PR number
+    // always has a working preview link even when `previewUrl` is still null.
+    const candidatePrUrl = (prNumber) =>
+      prNumber != null ? "/preview/" + encodeURIComponent(appDomain) + "/pr/" + prNumber : null;
+
     const age = (iso) => {
       if (!iso) return "—";
       const ms = Date.now() - new Date(iso).getTime();
@@ -516,10 +736,67 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
       return el;
     };
 
+    // ---- ?pr=N deep link ---------------------------------------------------
+    // A deep link like /admin#publish?pr=42 asks us to surface a specific PR's
+    // row once the queue has loaded. The param rides in the hash fragment
+    // (after the tab anchor) because that's how the admin shell routes tabs;
+    // fall back to a real query string too. Resolve exactly once — so the
+    // scroll/highlight never re-fires on the reloads that follow every ship
+    // action — and until it resolves, keep an honest "not in the queue yet"
+    // callout up rather than silently doing nothing.
+
+    const readRequestedPr = () => {
+      const hash = window.location.hash || "";
+      const q = hash.indexOf("?");
+      let raw = new URLSearchParams(q >= 0 ? hash.slice(q + 1) : "").get("pr");
+      if (raw == null) raw = new URLSearchParams(window.location.search).get("pr");
+      if (raw == null) return null;
+      const n = Number.parseInt(raw, 10);
+      return Number.isInteger(n) && n > 0 ? n : null;
+    };
+
+    const requestedPr = readRequestedPr();
+    let prDeeplinkResolved = false;
+
+    const applyPrDeeplink = () => {
+      if (requestedPr == null || prDeeplinkResolved) return;
+      const callout = root.querySelector("[data-publish-pr-callout]");
+      const row = queueBody.querySelector('tr[data-pr-number="' + requestedPr + '"]');
+      if (!row) {
+        if (callout) {
+          callout.hidden = false;
+          callout.textContent = "PR #" + requestedPr + " isn't in the queue yet.";
+        }
+        return;
+      }
+      prDeeplinkResolved = true;
+      if (callout) {
+        callout.hidden = true;
+        callout.textContent = "";
+      }
+      row.scrollIntoView({ block: "center", behavior: "smooth" });
+      row.classList.remove("publish-row-highlight");
+      void row.offsetWidth; // restart the flash animation if re-applied
+      row.classList.add("publish-row-highlight");
+      window.setTimeout(() => row.classList.remove("publish-row-highlight"), 2600);
+    };
+
     // ---- Open change queue -------------------------------------------------
 
     const renderQueue = (payload) => {
       const changes = Array.isArray(payload.changes) ? payload.changes : [];
+      // rux1: surface a forge-listing failure as a visible strip — never let a
+      // degraded (short) list read as a genuine empty queue.
+      if (degradedStrip) degradedStrip.hidden = payload.degraded !== true;
+      // rux7: capture any open diff panes BEFORE wiping so a poll re-render
+      // re-attaches the exact node (with its already-fetched content) under the
+      // matching new row, instead of blowing the expanded pane away. Keyed by
+      // changeId (== the diff row's data-publish-diff-row). Wiping detaches them
+      // from the DOM but the Map keeps them alive for re-attachment.
+      const openDiffNodes = new Map();
+      queueBody.querySelectorAll("tr[data-publish-diff-row]").forEach((node) => {
+        openDiffNodes.set(node.dataset.publishDiffRow, node);
+      });
       queueBody.textContent = "";
       if (queueCount) queueCount.textContent = String(changes.length);
       if (queueChip) {
@@ -542,6 +819,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
 
       for (const change of changes) {
         const tr = document.createElement("tr");
+        if (change.prNumber != null) tr.dataset.prNumber = String(change.prNumber);
 
         // Change id + branch / PR + preview link.
         const idCell = document.createElement("td");
@@ -552,9 +830,22 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         if (change.branch) meta.push(change.branch);
         if (change.prNumber != null) meta.push("PR #" + change.prNumber);
         if (meta.length) idCell.append(subtle(meta.join(" · ")));
-        if (change.previewUrl) {
+        // Owner-facing "who did this" — accept takes priority over build (a
+        // candidate that's been accepted-to-preview is more meaningfully
+        // "acted on" than merely built). Reject never shows here: a rejected
+        // candidate is closed and has already left the open queue.
+        const actorRecord = change.actors && (change.actors.accept || change.actors.build);
+        if (actorRecord) {
+          const label = change.actors.accept ? "Accepted by " : "Built by ";
+          idCell.append(subtle(label + (actorRecord.name || actorRecord.email)));
+        }
+        // Prefer the synthesized friendly per-PR route (handles every state);
+        // fall back to any server-provided previewUrl for change-first rows
+        // that have no PR number yet.
+        const previewUrl = candidatePrUrl(change.prNumber) || change.previewUrl;
+        if (previewUrl) {
           const preview = document.createElement("a");
-          preview.href = change.previewUrl;
+          preview.href = previewUrl;
           preview.target = "_blank";
           preview.rel = "noopener";
           preview.textContent = "Open preview";
@@ -595,14 +886,59 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         // Actions.
         const actions = document.createElement("td");
         actions.className = "action publish-actions";
-        // dg7 Diff: read-only, available to any viewer who can see the queue.
-        const diffBtn = document.createElement("button");
-        diffBtn.type = "button";
-        diffBtn.className = "btn";
-        diffBtn.textContent = "Diff";
-        diffBtn.title = "Show what changed vs the live version";
-        diffBtn.addEventListener("click", () => toggleDiff(change, diffBtn, tr));
-        actions.append(diffBtn);
+
+        // rux5 — a synthetic not-built forge PR row (built:false / status
+        // "not-built") has NO built candidate: changeId is null, so the built-only
+        // actions below (Diff/Accept/Reject/Retire, all keyed on changeId) do not
+        // apply. Its one action is Build preview — materialize the PR's hosted
+        // preview on demand. Capability-gated: the button is SHOWN only to a
+        // ship-capable operator, and the server (buildGate) re-authorizes — the UI
+        // check is UX, not the real gate.
+        if (change.built === false || change.status === "not-built") {
+          if (canShip) {
+            const build = document.createElement("button");
+            build.type = "button";
+            build.className = "btn primary";
+            build.title = "Materialize this PR's hosted preview on demand (does not go live)";
+            // rux7: if a build for this PR is mid-flight, a poll re-render must
+            // reflect the spinner/disabled state (not a fresh clickable button
+            // that would let the operator double-submit). The in-flight closure
+            // re-renders on completion, clearing this.
+            if (change.prNumber != null && inflightBuilds.has(change.prNumber)) {
+              build.textContent = "Building…";
+              build.disabled = true;
+              build.dataset.building = "true";
+            } else {
+              build.textContent = "Build preview";
+            }
+            build.addEventListener("click", () => buildPreview(change, build));
+            actions.append(build);
+          } else {
+            actions.append(subtle("Owner/admin sign-in required to build"));
+          }
+          tr.append(actions);
+          queueBody.append(tr);
+          continue;
+        }
+
+        // rux7: while an integrate/reject/retire for this change is in flight,
+        // keep its mutating actions disabled across a poll re-render so the
+        // operator can't double-submit against a freshly-minted button.
+        const changeBusy = busyChanges.has(change.changeId);
+
+        // rux6 Review: expand the row into a single "review moment" pane —
+        // preview iframe + evidence chips + diff + Accept/Reject — so a reviewer
+        // never leaves the queue. Supersedes the standalone Diff button (the dg7
+        // diff now lives inside the pane, reusing renderDiff). The row's own
+        // Accept/Reject/Retire buttons below are unchanged.
+        const reviewBtn = document.createElement("button");
+        reviewBtn.type = "button";
+        reviewBtn.className = "btn";
+        reviewBtn.textContent = "Review";
+        reviewBtn.setAttribute("aria-expanded", "false");
+        reviewBtn.title = "Open one pane to preview, diff, and act on this change";
+        reviewBtn.addEventListener("click", () => toggleReview(change, reviewBtn, tr));
+        actions.append(reviewBtn);
         // b11 SPLIT: the candidate-queue primary action is now ACCEPT TO PREVIEW
         // (b08 integrate = advance the shared preview aggregate), NOT go-live.
         // Integrate flips NO live channel, so it has NO paywall (entitled) gate —
@@ -612,7 +948,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         accept.type = "button";
         accept.className = "btn primary";
         accept.textContent = "Accept to preview";
-        accept.disabled = !canShip || !change.mergeable;
+        accept.disabled = !canShip || !change.mergeable || changeBusy;
         accept.title = !canShip
           ? "Requires an owner or admin sign-in"
           : !change.mergeable
@@ -624,7 +960,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         reject.type = "button";
         reject.className = "btn";
         reject.textContent = "Reject";
-        reject.disabled = !canShip;
+        reject.disabled = !canShip || changeBusy;
         reject.title = canShip ? "Close this change without publishing" : "Requires an owner or admin sign-in";
         reject.addEventListener("click", () => rejectChange(change, reject));
         actions.append(reject);
@@ -637,7 +973,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         retire.type = "button";
         retire.className = "btn";
         retire.textContent = "Retire";
-        retire.disabled = !canShip;
+        retire.disabled = !canShip || changeBusy;
         retire.title = canShip
           ? "Evict this preview to reclaim space — rebuildable on demand (not the same as Reject)"
           : "Requires an owner or admin sign-in";
@@ -646,13 +982,24 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         tr.append(actions);
 
         queueBody.append(tr);
+
+        // rux7: re-attach a diff pane that was open before this re-render. The
+        // pane node carries its already-fetched content; restore the expanded
+        // state + the "Hide diff" toggle affordance so a poll never collapses it.
+        const openDiff = openDiffNodes.get(change.changeId);
+        if (openDiff) {
+          tr.dataset.changeRowId = change.changeId;
+          diffBtn.textContent = "Hide diff";
+          tr.after(openDiff);
+        }
       }
     };
 
-    const renderCurrent = (current) => {
+    const renderCurrent = (current, shippedBy) => {
       const versionEl = root.querySelector("[data-publish-live-version]");
       const sourceEl = root.querySelector("[data-publish-live-source]");
       const atEl = root.querySelector("[data-publish-live-at]");
+      const shippedByEl = root.querySelector("[data-publish-live-shipped-by]");
       if (current && current.versionId) {
         if (versionEl) versionEl.textContent = shortSha(current.versionId);
         if (sourceEl) {
@@ -661,11 +1008,131 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
             (current.artifactCount != null ? " · " + current.artifactCount + " files" : "");
         }
         if (atEl) atEl.textContent = current.createdAt ? age(current.createdAt) : "—";
+        // Owner-facing "who did this" — see changeActorAttribution.ts. Absent for
+        // any version published before this attribution existed, which is honest,
+        // not a bug.
+        if (shippedByEl) {
+          shippedByEl.textContent = shippedBy ? "Shipped by " + (shippedBy.name || shippedBy.email) : "";
+        }
       } else {
         if (versionEl) versionEl.textContent = "Not live yet";
         if (sourceEl) sourceEl.textContent = "Nothing has been published for this store";
         if (atEl) atEl.textContent = "—";
+        if (shippedByEl) shippedByEl.textContent = "";
+      }
+    };
+
+    // ---- rux7: auto-refresh (poll GET /api/changes) ------------------------
+    // Keep the queue + aggregate live without a manual reload: poll on an
+    // interval that BACKS OFF while nothing changes (grow the delay up to a cap)
+    // and SNAPS BACK to the base the moment something does. Pause entirely while
+    // the tab is hidden (document.hidden) — a backgrounded admin tab must not
+    // hammer the endpoint — and refresh promptly on return. A poll re-render
+    // reuses renderQueue/renderAggregate, which already preserve open diff panes
+    // and in-flight actions (inflightBuilds / busyChanges / aggregatePublishing),
+    // and applyPrDeeplink stays a one-time effect (prDeeplinkResolved), so the
+    // ?pr scroll never re-fires on a tick.
+    const POLL_BASE_MS = 8000;
+    const POLL_MAX_MS = 60000;
+    const POLL_GROWTH = 1.6;
+    let pollDelay = POLL_BASE_MS;
+    let pollTimer = null;
+    let pollBusy = false;
+    let lastChangesSignature = null;
+
+    // A compact projection of everything the queue/aggregate render VISIBLY off,
+    // so a no-op poll (identical data) neither re-renders nor interrupts a text
+    // selection — it just backs off. Relative ages are intentionally excluded;
+    // they drift at most one backoff interval and refresh on any real change.
+    const changesSignature = (data) => {
+      const cur = data.current || {};
+      const agg = data.aggregate || {};
+      const run = agg.activeRun || agg.lastRun || {};
+      const plan = data.plan || {};
+      const rows = (Array.isArray(data.changes) ? data.changes : []).map((c) => [
+        c.changeId,
+        c.prNumber,
+        c.status,
+        c.headSha,
+        c.mergeable,
+        c.built,
+        c.lastError || null,
+        !!(c.evidence && c.evidence.promotable),
+        c.actors ? Object.keys(c.actors).sort().join(",") : "",
+      ]);
+      return JSON.stringify({
+        degraded: data.degraded === true,
+        current: [cur.versionId || null, cur.createdAt || null, cur.artifactCount ?? null],
+        shippedBy: (data.shippedBy && data.shippedBy.email) || null,
+        aggregate: [
+          agg.queueState || null,
+          agg.aggregateSha || null,
+          run.state || null,
+          run.finishedAt || null,
+          (agg.includedPrs || []).length,
+        ],
+        plan: [plan.ok === true, plan.pinnedSha || null, plan.artifactDigest || null, plan.alreadyShipped === true],
+        rows,
+      });
+    };
+
+    const clearPoll = () => {
+      if (pollTimer) {
+        clearTimeout(pollTimer);
+        pollTimer = null;
+      }
+    };
+
+    const schedulePoll = () => {
+      clearPoll();
+      if (document.hidden) return; // paused while hidden; visibilitychange resumes
+      pollTimer = setTimeout(runPoll, pollDelay);
+    };
+
+    // One poll tick: fetch, and only re-render when the projection actually
+    // changed. Returns an outcome the caller uses to size the next interval.
+    const pollChanges = async () => {
+      let res;
+      try {
+        res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
+      } catch {
+        return "error"; // network blip — keep the last good view, just back off
+      }
+      if (res.status === 401 || res.status === 403) return "auth"; // session gone
+      const data = await res.json().catch(() => null);
+      if (!res.ok || !data) return "error";
+      const sig = changesSignature(data);
+      if (sig === lastChangesSignature) return "unchanged";
+      lastChangesSignature = sig;
+      renderCurrent(data.current, data.shippedBy);
+      renderQueue(data);
+      applyPrDeeplink();
+      renderAggregate(data);
+      return "changed";
+    };
+
+    const runPoll = async () => {
+      pollTimer = null;
+      if (document.hidden || pollBusy) {
+        schedulePoll();
+        return;
+      }
+      pollBusy = true;
+      let outcome;
+      try {
+        outcome = await pollChanges();
+      } finally {
+        pollBusy = false;
+      }
+      if (outcome === "auth") {
+        clearPoll(); // stop polling — a sign-in is required; a manual refresh retries
+        return;
       }
+      pollDelay =
+        outcome === "changed"
+          ? POLL_BASE_MS
+          : Math.min(POLL_MAX_MS, Math.round(pollDelay * POLL_GROWTH));
+      schedulePoll();
     };
 
     const loadQueue = async () => {
@@ -673,6 +1140,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         const res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
         if (res.status === 401 || res.status === 403) {
           if (queueChip) queueChip.textContent = "Sign-in required";
+          if (degradedStrip) degradedStrip.hidden = true;
           queueBody.textContent = "";
           const tr = document.createElement("tr");
           const td = cell(subtle("Sign in as a store owner or admin to view the publish queue."));
@@ -686,9 +1154,16 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
           setStatus(statusEl, data.error || "Could not load the change queue (" + res.status + ")", "err");
           return;
         }
-        renderCurrent(data.current);
+        renderCurrent(data.current, data.shippedBy);
         renderQueue(data);
+        applyPrDeeplink();
         renderAggregate(data);
+        // rux7: this is fresh authoritative data — resync the poll clock so the
+        // next tick dedupes against it, and reset the cadence to responsive
+        // (a manual refresh / a just-completed action likely means more coming).
+        lastChangesSignature = changesSignature(data);
+        pollDelay = POLL_BASE_MS;
+        schedulePoll();
       } catch {
         setStatus(statusEl, "Could not load the change queue — network error", "err");
       }
@@ -819,7 +1294,10 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
       if (publishBtn) {
         const shippable = Boolean(currentPlan);
         const paywalled = currentPlan && currentPlan.paywall && !currentPlan.paywall.allowed;
-        publishBtn.disabled = !canShip || !shippable || paywalled || currentPlan.alreadyShipped;
+        // rux7: never re-enable the Publish button while its POST is in flight —
+        // a poll refresh landing mid-publish must not open a double-submit.
+        publishBtn.disabled =
+          aggregatePublishing || !canShip || !shippable || paywalled || currentPlan.alreadyShipped;
         publishBtn.title = !canShip
           ? "Requires an owner or admin sign-in"
           : !shippable
@@ -832,7 +1310,14 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
       }
       if (publishDetail) {
         if (currentPlan && currentPlan.alreadyShipped) {
-          publishDetail.textContent = "This reviewed build (" + shortSha(currentPlan.pinnedSha) + ") is already live.";
+          publishDetail.textContent =
+            "This reviewed build (" + shortSha(currentPlan.pinnedSha) + ") is already live. ";
+          const view = document.createElement("a");
+          view.href = ds.liveHref || "/";
+          view.target = "_blank";
+          view.rel = "noopener";
+          view.textContent = "View your live store →";
+          publishDetail.append(view);
         } else if (currentPlan) {
           publishDetail.textContent =
             "Publishes the exact reviewed digest " + shortSha(currentPlan.artifactDigest.replace(/^sha256:/, "")) +
@@ -918,6 +1403,46 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     // pinned plan, then POSTs { confirmGoLive, expectedAggregateSha,
     // expectedArtifactDigest } — the reviewed-digest guard: a stale plan (queue
     // moved / artifact changed) is refused by the server, never shipped blind.
+    // ── Publish-live ceremony (shipoff) ──────────────────────────────────────
+    // The go-live counterpart of the accept liftoff below (shares its shell,
+    // styles, planRow + celebrate helpers — referenced at runtime, defined a few
+    // sections down). One honest in-flight state: ship is a single POST that
+    // promotes the pinned digest, so no staged theater — just plan → publishing →
+    // outcome with a real "View your live store" link.
+    const shipoff = root.querySelector("[data-shipoff]");
+    const shipoffCard = shipoff && shipoff.querySelector(".liftoff-card");
+    const shipoffEls = shipoff
+      ? {
+          plan: shipoff.querySelector("[data-shipoff-plan]"),
+          flight: shipoff.querySelector("[data-shipoff-flight]"),
+          outcome: shipoff.querySelector("[data-shipoff-outcome]"),
+          grid: shipoff.querySelector("[data-shipoff-grid]"),
+          proceed: shipoff.querySelector("[data-shipoff-proceed]"),
+          cancel: shipoff.querySelector("[data-shipoff-cancel]"),
+          live: shipoff.querySelector("[data-shipoff-live]"),
+          elapsed: shipoff.querySelector("[data-shipoff-elapsed]"),
+          seal: shipoff.querySelector("[data-shipoff-seal]"),
+          outcomeTitle: shipoff.querySelector("[data-shipoff-outcome-title]"),
+          outcomeDetail: shipoff.querySelector("[data-shipoff-outcome-detail]"),
+          view: shipoff.querySelector("[data-shipoff-view]"),
+          done: shipoff.querySelector("[data-shipoff-done]"),
+          confetti: shipoff.querySelector("[data-shipoff-confetti]"),
+        }
+      : null;
+    let shipoffTimer = null;
+    const closeShipoff = () => {
+      if (shipoffTimer) { clearInterval(shipoffTimer); shipoffTimer = null; }
+      if (shipoff) shipoff.hidden = true;
+      if (shipoffEls) shipoffEls.confetti.textContent = "";
+    };
+    const showShipoffPhase = (phase) => {
+      if (!shipoffEls) return;
+      shipoffEls.plan.hidden = phase !== "plan";
+      shipoffEls.flight.hidden = phase !== "flight";
+      shipoffEls.outcome.hidden = phase !== "outcome";
+      if (shipoffCard) shipoffCard.dataset.mode = phase;
+    };
+
     const buildPublishPlanText = (plan) => {
       const lines = ["Publish plan (exact reviewed digest — no rebuild):"];
       lines.push("  tenant:   " + (appDomain || repo));
@@ -929,12 +1454,62 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
       return lines.join("\n");
     };
 
-    const publishAggregate = async (button) => {
+    const shortDigest = (digest) => {
+      const d = String(digest || "").replace(/^sha256:/, "");
+      return d ? "sha256:" + d.slice(0, 12) + "…" : "—";
+    };
+
+    const publishAggregate = (button) => {
       if (!currentPlan) return;
       const plan = currentPlan;
-      if (!window.confirm(buildPublishPlanText(plan) + "\n\nPublish live?")) return;
-      button.disabled = true;
+      if (!shipoff || !shipoffEls) {
+        // No-markup fallback only — the ceremony IS the confirm now.
+        if (!window.confirm(buildPublishPlanText(plan) + "\n\nPublish live?")) return;
+        runShip(plan, button);
+        return;
+      }
+      shipoffEls.grid.textContent = "";
+      shipoffEls.grid.append(
+        ...planRow("Store", appDomain || repo),
+        ...planRow("Build", shortSha(plan.pinnedSha), true),
+        ...planRow("Digest", shortDigest(plan.artifactDigest), true),
+        ...planRow("Changes", (plan.includedPrs || []).length + " included"),
+        ...(plan.rollbackTarget
+          ? planRow("Rollback to", shortSha(plan.rollbackTarget.aggregateSha), true)
+          : []),
+      );
+      showShipoffPhase("plan");
+      shipoff.hidden = false;
+      shipoffEls.proceed.focus();
+      shipoffEls.cancel.onclick = () => closeShipoff();
+      shipoffEls.done.onclick = () => closeShipoff();
+      shipoffEls.proceed.onclick = () => runShip(plan, button);
+    };
+
+    const runShip = async (plan, button) => {
+      if (button) button.disabled = true;
+      aggregatePublishing = true; // rux7: hold the button disabled across polls
       setStatus(aggStatusEl, "Publishing the reviewed build (" + shortSha(plan.pinnedSha) + ") live…");
+      const startedAt = Date.now();
+      if (shipoffEls) {
+        showShipoffPhase("flight");
+        shipoffTimer = setInterval(() => {
+          const s = Math.floor((Date.now() - startedAt) / 1000);
+          shipoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
+        }, 1000);
+      }
+      const outcome = (state, title, detail, showView) => {
+        if (!shipoffEls) return;
+        if (shipoffTimer) { clearInterval(shipoffTimer); shipoffTimer = null; }
+        shipoffEls.seal.dataset.state = state;
+        shipoffEls.outcomeTitle.textContent = title;
+        shipoffEls.outcomeDetail.textContent = detail;
+        shipoffEls.view.hidden = !showView;
+        if (showView) shipoffEls.view.href = ds.liveHref || "/";
+        showShipoffPhase("outcome");
+        shipoffEls.done.focus();
+        if (state === "ok") celebrate(shipoffEls.confetti);
+      };
       try {
         const res = await fetch(ds.shipEndpoint, {
           method: "POST",
@@ -955,22 +1530,37 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
             "Published live · build " + shortSha(data.pinnedSha) + " (receipt " + (data.receiptId || "—") + ").",
             "ok",
           );
-        } else if (data.state === "promote_failed" || data.state === "record_failed") {
-          // Honest partial-failure truth — recoverable, never a false "shipped".
-          setStatus(aggStatusEl, data.message || "Publish did not complete (" + data.state + "). Retry.", "err");
-        } else if (data.reason === "paywall") {
-          setStatus(aggStatusEl, data.message || "Publishing to your live store is part of the paid plan.", "err");
-        } else {
-          setStatus(
-            aggStatusEl,
-            data.message || data.error || "Publish refused (" + (data.reason || res.status) + ")",
-            "err",
+          outcome(
+            "ok",
+            "Your store is live",
+            "Build " + shortSha(data.pinnedSha) + " — the exact digest you reviewed — is now serving" +
+              (data.receiptId ? " (receipt " + data.receiptId + ")." : "."),
+            true,
           );
+        } else {
+          let message;
+          if (data.state === "promote_failed" || data.state === "record_failed") {
+            // Honest partial-failure truth — recoverable, never a false "shipped".
+            message = data.message || "Publish did not complete (" + data.state + "). Retry.";
+          } else if (data.reason === "paywall") {
+            message = data.message || "Publishing to your live store is part of the paid plan.";
+          } else {
+            message = data.message || data.error || "Publish refused (" + (data.reason || res.status) + ")";
+          }
+          setStatus(aggStatusEl, message, "err");
+          outcome("err", "Publish did not complete", message + " Your live store is unchanged.", false);
         }
       } catch {
         setStatus(aggStatusEl, "Publish failed — network error", "err");
+        outcome(
+          "err",
+          "Publish did not complete",
+          "Network error mid-publish — refresh to see the honest state; your live store serves the last published version.",
+          false,
+        );
       } finally {
-        button.disabled = false;
+        aggregatePublishing = false;
+        if (button) button.disabled = false;
         loadQueue();
         loadVersions();
       }
@@ -981,35 +1571,207 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
       ?.querySelector("[data-aggregate-publish]")
       ?.addEventListener("click", (event) => publishAggregate(event.currentTarget));
 
-    // b11 — the ACCEPT-TO-PREVIEW plan affordance (decision
-    // operator-verb-and-hosting-model): state EXACTLY what accept does now.
-    // `POST /api/changes/integrate` (b08) = integrate this candidate into the
-    // protected `preview` aggregate (b07's TenantIntegrationQueue.enqueue), then
-    // rebuild + combined-evidence the aggregate (b05). It flips NO live channel —
-    // going live is the aggregate card's Publish. So the plan says "integrate into
-    // preview", never "merge into main / deploy live".
-    const buildIntegratePlan = (change) => {
+    // ── Accept-to-preview LIFTOFF ─────────────────────────────────────────────
+    // The plan confirm + live integration flight + outcome ceremony (replaces
+    // the old window.confirm plan popup). Same b11 contract as before: accept =
+    // `POST /api/changes/integrate` (b08) → integrate into the protected
+    // `preview` aggregate, rebuild + combined-evidence it (b05). Flips NO live
+    // channel — going live is the aggregate card's Publish.
+    //
+    // HONESTY RULE for the stage rail: a stage only advances on a REAL signal —
+    // the outcome POST resolving, or GET /api/changes polling showing the
+    // candidate inside `aggregate.includedPrs` (merge landed) / an `activeRun`
+    // (build+evidence running, statusMessage relayed verbatim). No timers ever
+    // fake progress.
+    const liftoff = root.querySelector("[data-liftoff]");
+    const liftoffCard = liftoff && liftoff.querySelector(".liftoff-card");
+    const liftoffEls = liftoff
+      ? {
+          plan: liftoff.querySelector("[data-liftoff-plan]"),
+          flight: liftoff.querySelector("[data-liftoff-flight]"),
+          outcome: liftoff.querySelector("[data-liftoff-outcome]"),
+          title: liftoff.querySelector("[data-liftoff-title]"),
+          grid: liftoff.querySelector("[data-liftoff-grid]"),
+          proceed: liftoff.querySelector("[data-liftoff-proceed]"),
+          cancel: liftoff.querySelector("[data-liftoff-cancel]"),
+          flightTitle: liftoff.querySelector("[data-liftoff-flight-title]"),
+          live: liftoff.querySelector("[data-liftoff-live]"),
+          elapsed: liftoff.querySelector("[data-liftoff-elapsed]"),
+          hide: liftoff.querySelector("[data-liftoff-hide]"),
+          seal: liftoff.querySelector("[data-liftoff-seal]"),
+          outcomeTitle: liftoff.querySelector("[data-liftoff-outcome-title]"),
+          outcomeDetail: liftoff.querySelector("[data-liftoff-outcome-detail]"),
+          review: liftoff.querySelector("[data-liftoff-review]"),
+          done: liftoff.querySelector("[data-liftoff-done]"),
+          confetti: liftoff.querySelector("[data-liftoff-confetti]"),
+        }
+      : null;
+
+    const liftoffStage = (name) =>
+      liftoff && liftoff.querySelector('[data-liftoff-stage="' + name + '"]');
+    const LIFTOFF_STAGES = ["merge", "build", "evidence", "green"];
+    const setStage = (name, state) => {
+      const el = liftoffStage(name);
+      if (el) el.dataset.state = state; // pending | active | done | fail
+    };
+    // Advance the rail so everything before `name` is done and `name` is active.
+    const railTo = (name) => {
+      const idx = LIFTOFF_STAGES.indexOf(name);
+      LIFTOFF_STAGES.forEach((s, i) => {
+        const el = liftoffStage(s);
+        const cur = el && el.dataset.state;
+        if (cur === "fail") return; // never un-fail
+        setStage(s, i < idx ? "done" : i === idx ? "active" : "pending");
+      });
+    };
+
+    let liftoffTimer = null;
+    let liftoffPoll = null;
+    let liftoffOpenedFrom = null;
+    const stopLiftoffLoops = () => {
+      if (liftoffTimer) { clearInterval(liftoffTimer); liftoffTimer = null; }
+      if (liftoffPoll) { clearInterval(liftoffPoll); liftoffPoll = null; }
+    };
+    const closeLiftoff = () => {
+      stopLiftoffLoops();
+      if (liftoff) liftoff.hidden = true;
+      if (liftoffEls) liftoffEls.confetti.textContent = "";
+      if (liftoffOpenedFrom && document.contains(liftoffOpenedFrom)) liftoffOpenedFrom.focus();
+      liftoffOpenedFrom = null;
+    };
+    const showPhase = (phase) => {
+      if (!liftoffEls) return;
+      liftoffEls.plan.hidden = phase !== "plan";
+      liftoffEls.flight.hidden = phase !== "flight";
+      liftoffEls.outcome.hidden = phase !== "outcome";
+      if (liftoffCard) liftoffCard.dataset.mode = phase;
+    };
+
+    const planRow = (dt, dd, mono) => {
+      const t = document.createElement("dt");
+      t.textContent = dt;
+      const d = document.createElement("dd");
+      d.textContent = dd;
+      if (mono) d.className = "publish-mono";
+      return [t, d];
+    };
+
+    const celebrate = (container) => {
+      if (!container) return;
+      if (window.matchMedia && window.matchMedia("(prefers-reduced-motion: reduce)").matches) return;
+      const colors = ["#0f9d8f", "#25b8a8", "#f4b942", "#5b8def", "#e2634f"];
+      for (let i = 0; i < 42; i++) {
+        const p = document.createElement("i");
+        p.style.left = Math.random() * 100 + "%";
+        p.style.background = colors[i % colors.length];
+        p.style.animationDelay = Math.random() * 0.35 + "s";
+        p.style.animationDuration = 0.9 + Math.random() * 0.9 + "s";
+        p.style.setProperty("--liftoff-drift", (Math.random() * 160 - 80).toFixed(0) + "px");
+        p.style.setProperty("--liftoff-spin", (Math.random() * 640 - 320).toFixed(0) + "deg");
+        container.append(p);
+      }
+      setTimeout(() => { container.textContent = ""; }, 2400);
+    };
+
+    // The live poll during flight: reflect the server's REAL progress.
+    const startFlightPoll = (change, preFlightSha) => {
+      let inAggregate = false;
+      liftoffPoll = setInterval(async () => {
+        try {
+          const res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
+          if (!res.ok) return;
+          const data = await res.json();
+          const agg = data.aggregate || {};
+          const included = (agg.includedPrs || []).some((p) => p.changeId === change.changeId);
+          const shaMoved = agg.aggregateSha && agg.aggregateSha !== preFlightSha;
+          const run = agg.activeRun || null;
+          if (!inAggregate && (included || shaMoved)) {
+            inAggregate = true;
+            railTo("build");
+            if (liftoffEls) liftoffEls.live.textContent =
+              "Merged into preview — rebuilding the combined aggregate…";
+          }
+          if (run) {
+            railTo("evidence");
+            if (liftoffEls) liftoffEls.live.textContent =
+              run.statusMessage || "Combined evidence is running…";
+          }
+        } catch { /* polling is best-effort; the POST outcome is authoritative */ }
+      }, 2500);
+    };
+
+    const openLiftoff = (change, button) => {
+      if (!liftoff || !liftoffEls) return false;
+      liftoffOpenedFrom = button || null;
       const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
-      const lines = ["Accept-to-preview plan:", "  tenant:    " + (appDomain || repo)];
-      if (change.prNumber != null) lines.push("  PR:        #" + change.prNumber);
-      lines.push("  change id: " + change.changeId);
-      if (change.headSha) lines.push("  head sha:  " + shortSha(change.headSha));
-      lines.push(
-        "  effect:    integrate " + target + " into the preview aggregate, then rebuild + " +
-          "re-evidence it. Does NOT go live — publish the reviewed build separately.",
+      liftoffEls.title.textContent = "Integrate " + target + " into preview";
+      liftoffEls.grid.textContent = "";
+      liftoffEls.grid.append(
+        ...planRow("Store", appDomain || repo),
+        ...(change.prNumber != null ? planRow("Pull request", "#" + change.prNumber) : []),
+        ...planRow("Change", change.changeId, true),
+        ...(change.headSha ? planRow("Head", shortSha(change.headSha), true) : []),
       );
-      return lines.join("\n");
+      LIFTOFF_STAGES.forEach((s) => setStage(s, "pending"));
+      liftoffEls.live.textContent = "Working…";
+      liftoffEls.elapsed.textContent = "0:00";
+      showPhase("plan");
+      liftoff.hidden = false;
+      liftoffEls.proceed.focus();
+
+      liftoffEls.cancel.onclick = () => closeLiftoff();
+      liftoffEls.done.onclick = () => closeLiftoff();
+      liftoffEls.hide.onclick = () => { liftoff.hidden = true; }; // flight keeps running
+      liftoffEls.proceed.onclick = () => runIntegration(change, button);
+      return true;
     };
 
+    // Esc: close in plan/outcome; during flight just hide (the POST keeps going).
+    // Handles BOTH ceremonies (accept liftoff + publish shipoff).
+    document.addEventListener("keydown", (ev) => {
+      if (ev.key !== "Escape") return;
+      if (liftoff && !liftoff.hidden) {
+        const mode = liftoffCard && liftoffCard.dataset.mode;
+        if (mode === "flight") liftoff.hidden = true;
+        else closeLiftoff();
+      }
+      if (shipoff && !shipoff.hidden) {
+        const mode = shipoffCard && shipoffCard.dataset.mode;
+        if (mode === "flight") shipoff.hidden = true;
+        else closeShipoff();
+      }
+    });
+
     // b08 integrate returns an IntegrateOutcome — { ok, queueState, runState,
     // aggregateSha, pointerMoved, statusMessage, reason? } — NEVER a bare
     // merged:true. Render it honestly: green advances the aggregate; red left it
     // exactly where it was and names the failing stage.
-    const integrateCandidate = async (change, button) => {
-      if (!window.confirm(buildIntegratePlan(change) + "\n\nProceed?")) return;
-      button.disabled = true;
+    const runIntegration = async (change, button) => {
+      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
+      if (button) button.disabled = true;
+      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
       setStatus(statusEl, "Integrating " + change.changeId + " into preview…");
+      const startedAt = Date.now();
+      let preFlightSha = null;
+      if (liftoffEls) {
+        showPhase("flight");
+        liftoffEls.flightTitle.textContent = "Integrating " + target + " into preview";
+        railTo("merge");
+        liftoffEls.live.textContent = "Squash-merging the candidate into preview…";
+        liftoffTimer = setInterval(() => {
+          const s = Math.floor((Date.now() - startedAt) / 1000);
+          liftoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
+        }, 1000);
+      }
       try {
+        // Snapshot the pre-flight aggregate sha so the poll can detect the merge
+        // landing (sha moved) even before includedPrs reflects it.
+        try {
+          const pre = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
+          if (pre.ok) preFlightSha = ((await pre.json()).aggregate || {}).aggregateSha || null;
+        } catch { /* best-effort */ }
+        startFlightPoll(change, preFlightSha);
+
         const res = await fetch(ds.integrateEndpoint, {
           method: "POST",
           headers: {
@@ -1026,6 +1788,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
           }),
         });
         const data = await res.json().catch(() => ({}));
+        stopLiftoffLoops();
         if (res.ok && data.ok) {
           setStatus(
             statusEl,
@@ -1033,38 +1796,91 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
               shortSha(data.aggregateSha) + "). Review the aggregate, then Publish to go live.",
             "ok",
           );
-        } else if (res.ok && data.queueState === "red") {
-          // The queue ran but the aggregate did not go green — the candidate did
-          // NOT advance the shippable set. Name the honest failing stage.
-          setStatus(
-            statusEl,
-            "Integration of " + change.changeId + " failed (" + (data.reason || "red") + "): " +
-              (data.statusMessage || "the aggregate did not pass its combined evidence.") +
-              " The aggregate is unchanged.",
-            "err",
-          );
-        } else if (data.reason === "not_preview_base") {
-          setStatus(
-            statusEl,
-            "Not integrated: " + change.changeId + " does not target the preview branch " +
-              "(base is not \"preview\"). " + (data.statusMessage || ""),
-            "err",
-          );
+          if (liftoffEls) {
+            LIFTOFF_STAGES.forEach((s) => setStage(s, "done"));
+            liftoffEls.seal.dataset.state = "ok";
+            liftoffEls.outcomeTitle.textContent = "The preview aggregate is green";
+            liftoffEls.outcomeDetail.textContent =
+              target + " is in. Aggregate build " + shortSha(data.aggregateSha) +
+              " passed its combined evidence — this exact build is what you review, and what " +
+              "Publish would take live. Nothing is live yet.";
+            if (data.aggregateSha) {
+              liftoffEls.review.href =
+                "/preview/" + encodeURIComponent(appDomain) + "/rev/" + data.aggregateSha + "/";
+              liftoffEls.review.hidden = false;
+            } else {
+              liftoffEls.review.hidden = true;
+            }
+            if (liftoff.hidden) liftoff.hidden = false; // surface the payoff even if backgrounded
+            showPhase("outcome");
+            liftoffEls.done.focus();
+            celebrate(liftoffEls.confetti);
+          }
         } else {
-          setStatus(
-            statusEl,
-            data.statusMessage || data.error || "Integrate failed (" + res.status + ")",
-            "err",
-          );
+          let message;
+          let failStage = "merge";
+          if (res.ok && data.queueState === "red") {
+            // The queue ran but the aggregate did not go green — the candidate did
+            // NOT advance the shippable set. Name the honest failing stage.
+            failStage = "evidence";
+            message =
+              "Integration of " + change.changeId + " failed (" + (data.reason || "red") + "): " +
+              (data.statusMessage || "the aggregate did not pass its combined evidence.") +
+              " The aggregate is unchanged.";
+          } else if (data.reason === "not_preview_base") {
+            message =
+              "Not integrated: " + change.changeId + " does not target the preview branch " +
+              "(base is not \"preview\"). " + (data.statusMessage || "");
+          } else {
+            message = data.statusMessage || data.error || "Integrate failed (" + res.status + ")";
+          }
+          setStatus(statusEl, message, "err");
+          if (liftoffEls) {
+            setStage(failStage, "fail");
+            liftoffEls.seal.dataset.state = "err";
+            liftoffEls.outcomeTitle.textContent = "Integration did not land";
+            liftoffEls.outcomeDetail.textContent = message;
+            liftoffEls.review.hidden = true;
+            if (liftoff.hidden) liftoff.hidden = false;
+            showPhase("outcome");
+            liftoffEls.done.focus();
+          }
         }
       } catch {
+        stopLiftoffLoops();
         setStatus(statusEl, "Integrate failed — network error", "err");
+        if (liftoffEls) {
+          liftoffEls.seal.dataset.state = "err";
+          liftoffEls.outcomeTitle.textContent = "Integration did not land";
+          liftoffEls.outcomeDetail.textContent =
+            "Network error mid-flight — refresh the queue to see the aggregate's honest state.";
+          liftoffEls.review.hidden = true;
+          if (liftoff.hidden) liftoff.hidden = false;
+          showPhase("outcome");
+        }
       } finally {
-        button.disabled = false;
+        busyChanges.delete(change.changeId);
+        if (button) button.disabled = false;
         loadQueue();
       }
     };
 
+    const integrateCandidate = (change, button) => {
+      // The liftoff dialog IS the plan confirm now; window.confirm stays only as
+      // the no-dialog fallback (markup missing = fail open to the old popup).
+      if (openLiftoff(change, button)) return;
+      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
+      const plan =
+        "Accept-to-preview plan:\n  tenant:    " + (appDomain || repo) +
+        (change.prNumber != null ? "\n  PR:        #" + change.prNumber : "") +
+        "\n  change id: " + change.changeId +
+        (change.headSha ? "\n  head sha:  " + shortSha(change.headSha) : "") +
+        "\n  effect:    integrate " + target + " into the preview aggregate, then rebuild + " +
+        "re-evidence it. Does NOT go live — publish the reviewed build separately.";
+      if (!window.confirm(plan + "\n\nProceed?")) return;
+      runIntegration(change, button);
+    };
+
     const rejectChange = async (change, button) => {
       const reason = window.prompt(
         "Reject " + change.changeId + " — add a short note for the submitter:",
@@ -1075,6 +1891,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         return;
       }
       button.disabled = true;
+      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
       setStatus(statusEl, "Rejecting " + change.changeId + "…");
       try {
         const res = await fetch(
@@ -1097,6 +1914,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
       } catch {
         setStatus(statusEl, "Reject failed — network error", "err");
       } finally {
+        busyChanges.delete(change.changeId);
         button.disabled = false;
         loadQueue();
       }
@@ -1125,6 +1943,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     const retireChange = async (change, button) => {
       if (!window.confirm(buildRetirePlan(change) + "\n\nProceed?")) return;
       button.disabled = true;
+      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
       setStatus(statusEl, "Retiring " + change.changeId + "…");
       try {
         const res = await fetch(ds.retireEndpoint, {
@@ -1155,67 +1974,271 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
       } catch {
         setStatus(statusEl, "Retire failed — network error", "err");
       } finally {
+        busyChanges.delete(change.changeId);
+        button.disabled = false;
+        loadQueue();
+      }
+    };
+
+    // ---- rux5: build-on-demand for a synthetic not-built PR ------------------
+    // Mirror of the integrate/retire plan affordances: state EXACTLY what build
+    // does — materialize this PR's hosted preview at its forge head — and that it
+    // is INERT (flips no live channel). POSTs { pr, headSha?, baseSha? }; the row
+    // already carries the head sha GET /api/changes resolved via forge PR-read, and
+    // the server re-resolves it authoritatively when the body omits it. Shows an
+    // in-progress state (disabled + "Building…") while the build runs, then reloads
+    // the queue so the freshly-built PR reappears as a built candidate.
+
+    const buildPreviewPlan = (change) => {
+      const lines = ["Build preview plan:", "  tenant:   " + (appDomain || repo)];
+      lines.push("  PR:       #" + change.prNumber);
+      if (change.headSha) lines.push("  head sha: " + shortSha(change.headSha));
+      lines.push(
+        "  effect:   materialize this PR's hosted preview at its head — INERT " +
+          "(does NOT go live).",
+      );
+      return lines.join("\n");
+    };
+
+    const buildPreview = async (change, button) => {
+      const label = "PR #" + change.prNumber;
+      if (!window.confirm(buildPreviewPlan(change) + "\n\nBuild the preview now?")) return;
+      button.disabled = true;
+      const originalText = button.textContent;
+      button.textContent = "Building…";
+      button.dataset.building = "true";
+      // rux7: record the in-flight build so a poll re-render preserves the
+      // spinner/disabled state on the freshly-rendered button (cleared in finally).
+      if (change.prNumber != null) inflightBuilds.add(change.prNumber);
+      setStatus(statusEl, "Building preview for " + label + "…");
+      try {
+        const res = await fetch(ds.buildEndpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            // Mirror of the server-side capability model (UX); the server
+            // re-derives capability (buildGate) and stays authoritative.
+            "x-tot-capability": "ship-on-behalf",
+          },
+          body: JSON.stringify({
+            pr: change.prNumber,
+            headSha: change.headSha || undefined,
+            baseSha: change.baseSha || undefined,
+          }),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (res.ok && data.ok) {
+          setStatus(
+            statusEl,
+            "Built preview for " + label +
+              " — it now appears as a built change in the queue.",
+            "ok",
+          );
+        } else if (data && data.ok === false) {
+          // reconcileCandidate returned a blocked/failed candidate (e.g. a safety
+          // finding with no override) — the honest reason, never a false success.
+          setStatus(
+            statusEl,
+            "Build did not complete for " + label + ": " +
+              ((data.errors && data.errors.join("; ")) || data.error || "blocked"),
+            "err",
+          );
+        } else {
+          setStatus(statusEl, data.error || "Build failed (" + res.status + ")", "err");
+        }
+      } catch {
+        setStatus(statusEl, "Build failed — network error", "err");
+      } finally {
+        if (change.prNumber != null) inflightBuilds.delete(change.prNumber);
         button.disabled = false;
+        button.textContent = originalText;
+        delete button.dataset.building;
         loadQueue();
       }
     };
 
-    // ---- dg7: diff view ----------------------------------------------------
-    // For a pending candidate, show what changed vs the current live version,
-    // tied to the exact tenant Gitea head SHA, with the u5 immutable /rev link
-    // and the dg3 evidence AUTHORITY (authoritative / stale / missing). Reads
-    // GET /api/changes/<id>/diff; never invents a diff for a non-renderable
-    // candidate — it shows the honest blocked reason.
+    // ---- rux6: unified review pane -----------------------------------------
+    // "One review moment": expanding a candidate row reveals a single pane with
+    // the live preview (iframed SAME-ORIGIN — the /preview/<tenant>/pr/<N> route
+    // serves `frame-ancestors 'self'` + `X-Frame-Options: SAMEORIGIN`, so a
+    // same-origin admin embed is permitted; a cross-origin embed is refused,
+    // which is why the pane also always offers an "Open in new tab" link), the
+    // evidence chips the row already carries (change.evidence), the dg7 diff
+    // (reusing renderDiff below — GET /api/changes/<id>/diff, which never invents
+    // a diff for a non-renderable candidate), and the SAME Accept-to-preview /
+    // Reject actions. The reviewer never leaves the queue to review and act; the
+    // server stays authoritative for every action (this is UI consolidation only).
 
     const diffBase = ds.diffEndpointBase;
 
-    const diffRowFor = (tr) => {
+    const reviewRowFor = (tr) => {
       const next = tr.nextElementSibling;
-      return next && next.dataset && next.dataset.publishDiffRow === tr.dataset.changeRowId
+      return next && next.dataset && next.dataset.publishReviewRow === tr.dataset.changeRowId
         ? next
         : null;
     };
 
-    const closeDiff = (tr, button) => {
-      const existing = diffRowFor(tr);
+    const closeReview = (tr, button) => {
+      const existing = reviewRowFor(tr);
       if (existing) existing.remove();
-      if (button) button.textContent = "Diff";
+      if (button) {
+        button.textContent = "Review";
+        button.setAttribute("aria-expanded", "false");
+      }
     };
 
-    const toggleDiff = async (change, button, tr) => {
-      if (!tr.dataset.changeRowId) tr.dataset.changeRowId = change.changeId;
-      if (diffRowFor(tr)) {
-        closeDiff(tr, button);
-        return;
+    // Evidence chips from the data the row already carries (change.evidence):
+    // an overall promotable verdict + one chip per reported check.
+    const renderEvidenceChips = (container, change) => {
+      const checks = (change.evidence && change.evidence.checks) || [];
+      const promotable = Boolean(change.evidence && change.evidence.promotable);
+      container.append(
+        promotable ? chip("Checks passed", "green") : chip("Checks blocked", "amber"),
+      );
+      for (const c of checks) {
+        const tone = c.status === "pass" ? "green" : c.status === "fail" ? "red" : "amber";
+        const label = (c.label || c.id || "check") + (c.status && c.status !== "pass" ? " · " + c.status : "");
+        const el = chip(label, tone);
+        if (c.detail) el.title = c.detail;
+        container.append(el);
       }
-      button.disabled = true;
-      button.textContent = "Loading…";
-      const detailTr = document.createElement("tr");
-      detailTr.dataset.publishDiffRow = tr.dataset.changeRowId;
-      const td = document.createElement("td");
-      td.colSpan = 6;
-      td.className = "publish-diff-cell";
-      detailTr.append(td);
-      tr.after(detailTr);
+      if (!checks.length) container.append(subtle("No checks reported yet"));
+    };
+
+    // Build the split pane. Returns the pane node + the diff container so the
+    // caller can populate the diff asynchronously (reusing renderDiff).
+    const buildReviewPane = (change) => {
+      const pane = document.createElement("div");
+      pane.className = "review-pane";
+
+      // Preview column — same-origin iframe of the friendly per-PR route (it
+      // handles every state: ready render, or the not-built page). Falls back to
+      // any server-provided previewUrl for a change-first row with no PR number.
+      const previewUrl = candidatePrUrl(change.prNumber) || change.previewUrl;
+      const previewCol = document.createElement("div");
+      previewCol.className = "review-preview";
+      const pHead = document.createElement("div");
+      pHead.className = "review-pane-head";
+      const pTitle = document.createElement("b");
+      pTitle.textContent = "Preview";
+      pHead.append(pTitle);
+      if (previewUrl) {
+        const openLink = document.createElement("a");
+        openLink.href = previewUrl;
+        openLink.target = "_blank";
+        openLink.rel = "noopener";
+        openLink.textContent = "Open in new tab ↗";
+        pHead.append(openLink);
+      }
+      previewCol.append(pHead);
+      if (previewUrl) {
+        const frame = document.createElement("iframe");
+        frame.className = "review-frame";
+        frame.src = previewUrl;
+        frame.loading = "lazy";
+        frame.title =
+          change.prNumber != null
+            ? "Preview of PR #" + change.prNumber
+            : "Preview of " + change.changeId;
+        previewCol.append(frame);
+      } else {
+        previewCol.append(subtle("No preview is available for this change yet."));
+      }
+
+      // Detail column — evidence chips + diff + the same Accept/Reject actions.
+      const detailCol = document.createElement("div");
+      detailCol.className = "review-detail";
+
+      const evSection = document.createElement("div");
+      evSection.className = "review-section";
+      const evTitle = document.createElement("b");
+      evTitle.textContent = "Checks";
+      const evChips = document.createElement("div");
+      evChips.className = "review-chips";
+      renderEvidenceChips(evChips, change);
+      evSection.append(evTitle, evChips);
+      detailCol.append(evSection);
+
+      const diffSection = document.createElement("div");
+      diffSection.className = "review-section";
+      const diffTitle = document.createElement("b");
+      diffTitle.textContent = "Diff";
+      const diffTarget = document.createElement("div");
+      diffTarget.className = "review-diff-target";
+      diffTarget.append(subtle("Loading the diff…"));
+      diffSection.append(diffTitle, diffTarget);
+      detailCol.append(diffSection);
+
+      // The SAME actions as the row — same handlers, same gates. Not a new authz
+      // path: integrateCandidate/rejectChange POST to the same endpoints, and the
+      // server re-authorizes.
+      const actionRow = document.createElement("div");
+      actionRow.className = "review-actions";
+      const accept = document.createElement("button");
+      accept.type = "button";
+      accept.className = "btn primary";
+      accept.textContent = "Accept to preview";
+      accept.disabled = !canShip || !change.mergeable;
+      accept.title = !canShip
+        ? "Requires an owner or admin sign-in"
+        : !change.mergeable
+          ? "This change is not ready to integrate"
+          : "Integrate this change into the preview aggregate (does not go live)";
+      accept.addEventListener("click", () => integrateCandidate(change, accept));
+      const reject = document.createElement("button");
+      reject.type = "button";
+      reject.className = "btn";
+      reject.textContent = "Reject";
+      reject.disabled = !canShip;
+      reject.title = canShip
+        ? "Close this change without publishing"
+        : "Requires an owner or admin sign-in";
+      reject.addEventListener("click", () => rejectChange(change, reject));
+      actionRow.append(accept, reject);
+      detailCol.append(actionRow);
+
+      pane.append(previewCol, detailCol);
+      return { pane, diffTarget };
+    };
+
+    const loadReviewDiff = async (change, diffTarget) => {
       try {
         const res = await fetch(diffBase + "/" + encodeURIComponent(change.changeId) + "/diff", {
           headers: { accept: "application/json" },
         });
         const data = await res.json().catch(() => ({}));
+        diffTarget.textContent = "";
         if (!res.ok) {
-          td.append(subtle(data.error || "Could not load the diff (" + res.status + ")"));
+          diffTarget.append(subtle(data.error || "Could not load the diff (" + res.status + ")"));
         } else {
-          renderDiff(td, data.diff || {});
+          renderDiff(diffTarget, data.diff || {});
         }
-        button.textContent = "Hide diff";
       } catch {
-        td.append(subtle("Could not load the diff — network error"));
-        button.textContent = "Hide diff";
-      } finally {
-        button.disabled = false;
+        diffTarget.textContent = "";
+        diffTarget.append(subtle("Could not load the diff — network error"));
       }
     };
 
+    const toggleReview = (change, button, tr) => {
+      if (!tr.dataset.changeRowId) tr.dataset.changeRowId = change.changeId;
+      if (reviewRowFor(tr)) {
+        closeReview(tr, button);
+        return;
+      }
+      const detailTr = document.createElement("tr");
+      detailTr.dataset.publishReviewRow = tr.dataset.changeRowId;
+      const td = document.createElement("td");
+      td.colSpan = 6;
+      td.className = "publish-review-cell";
+      const { pane, diffTarget } = buildReviewPane(change);
+      td.append(pane);
+      detailTr.append(td);
+      tr.after(detailTr);
+      button.textContent = "Hide review";
+      button.setAttribute("aria-expanded", "true");
+      loadReviewDiff(change, diffTarget);
+    };
+
     const CHANGE_MARK = { added: "+", changed: "~", removed: "−" };
 
     const renderDiff = (td, diff) => {
@@ -1308,15 +2331,17 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         versionsChip.className = "chip" + (versions.length ? " blue" : "");
       }
 
-      // Static tenants: per-version rollback is honestly deferred (the console
-      // can't enumerate the S3 versions archive digest /api/changes/rollback needs).
+      // Static tenants (rux13): per-version rollback is an HONEST ONE-DISPATCH.
+      // The console can't enumerate the S3 versions archive digest, so it dispatches
+      // by the tenant version id and CI resolves the digest + re-publishes — it
+      // completes via CI, not instantly (never implied one-click).
       if (versionsRollbackNote) {
         if (rollbackMode === "static-archive") {
           versionsRollbackNote.hidden = false;
           versionsRollbackNote.textContent =
-            "This store publishes to a static public site. Rolling back to a prior version " +
-            "resolves the target from the versions archive — run the ship CLI (tot rollback), " +
-            "which enumerates it; the console can't list archived object digests.";
+            "This store publishes to a static public site. Rolling back DISPATCHES a CI job that " +
+            "re-publishes the prior version from the S3 versions archive — it completes via CI, not " +
+            "instantly. The store keeps serving the current version until the re-publish is verified live.";
         } else {
           versionsRollbackNote.hidden = true;
         }
@@ -1375,13 +2400,14 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
           const rollbackBtn = document.createElement("button");
           rollbackBtn.type = "button";
           rollbackBtn.className = "btn";
-          rollbackBtn.textContent = "Roll back";
-          const staticDeferred = rollbackMode === "static-archive";
-          rollbackBtn.disabled = !canShip || staticDeferred;
+          const isStatic = rollbackMode === "static-archive";
+          // Honest label: a static rollback completes via CI, not instantly (rux13).
+          rollbackBtn.textContent = isStatic ? "Roll back via CI" : "Roll back";
+          rollbackBtn.disabled = !canShip;
           rollbackBtn.title = !canShip
             ? "Requires an owner or ship-on-behalf sign-in"
-            : staticDeferred
-              ? "Static rollback runs through the versions archive — use the ship CLI (tot rollback)"
+            : isStatic
+              ? "Dispatch a rollback to this version — completes via CI (not instant)"
               : "Roll the live site back to this version";
           rollbackBtn.addEventListener("click", () => rollbackVersion(v, rollbackBtn));
           act.append(rollbackBtn);
@@ -1449,20 +2475,28 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     };
 
     const rollbackVersion = async (version, button) => {
-      if (
-        !window.confirm(
-          "Roll the live store back to version " + shortSha(version.versionId) +
-            "? This publishes that prior version to the live site.",
-        )
-      ) {
-        return;
-      }
+      // Static rollback (rux13) is an honest one-DISPATCH — completes via CI, not
+      // instantly; the confirm/status copy must never imply an instant flip.
+      const isStatic = rollbackMode === "static-archive";
+      const confirmMsg = isStatic
+        ? "Roll the static public site back to version " + shortSha(version.versionId) +
+            "? This DISPATCHES a rollback that completes via CI (not instantly) — the store keeps " +
+            "serving the current version until CI re-publishes the prior one."
+        : "Roll the live store back to version " + shortSha(version.versionId) +
+            "? This publishes that prior version to the live site.";
+      if (!window.confirm(confirmMsg)) return;
       button.disabled = true;
-      setStatus(versionsStatus, "Rolling back to " + shortSha(version.versionId) + "…");
+      setStatus(
+        versionsStatus,
+        isStatic
+          ? "Dispatching rollback to " + shortSha(version.versionId) + " (completes via CI)…"
+          : "Rolling back to " + shortSha(version.versionId) + "…",
+      );
       try {
+        // The console dispatches by version id only; a static prior version's
+        // archive digest lives only in S3 (CI resolves it). Pass a digest ONLY when
+        // we honestly have one (never for a static prior — its digest is always null).
         const payload = { targetVersionId: version.versionId };
-        // A static tenant additionally needs the archive digest — the button is
-        // disabled in that mode, but pass it through when we honestly have it.
         if (version.digest) payload.targetDigest = version.digest;
         const res = await fetch(ds.rollbackEndpoint, {
           method: "POST",
@@ -1714,6 +2748,184 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
       domainAction({ action: "rollback" }, event.currentTarget);
     });
 
+    // ---- b17: branch retention ----------------------------------------------
+    // Renders the GET /api/changes/branches dry-run classification (already
+    // projected server-side by branchRetentionView.ts — this script only
+    // paints it, same division of labor as renderQueue/renderVersions above)
+    // and drives the guarded delete. The server (candidate_delete, b13)
+    // re-classifies fresh on every delete, so the confirm below is the HUMAN
+    // gate, not the safety guarantee — the safety guarantee is server-side.
+
+    const branchesPanel = root.querySelector("[data-publish-branches]");
+    const branchesBody = branchesPanel?.querySelector("[data-branches-body]");
+    const branchesChip = branchesPanel?.querySelector("[data-branches-chip]");
+    const branchesStatus = branchesPanel?.querySelector("[data-branches-status]");
+
+    const BRANCH_TONE = {
+      protected: "",
+      "active-open": "green",
+      "stale-open": "amber",
+      integrated: "blue",
+      "closed-or-rejected": "blue",
+      orphan: "red",
+    };
+
+    const buildCleanupPlan = (row) => {
+      return [
+        "Delete branch plan:",
+        "  repo:           " + (appDomain || repo),
+        "  branch:         " + row.ref,
+        "  tip sha:        " + row.shortSha,
+        "  classification: " + row.classificationLabel,
+        "  reason:         " + row.reason,
+        "",
+        "This deletes the Git BRANCH only — it never evicts a hosted preview build",
+        "(that is Retire, a separate action above). The server re-classifies this",
+        "branch fresh before deleting; a moved tip or a branch that is no longer",
+        "integrated/closed-or-rejected is refused, not silently skipped.",
+      ].join("\n");
+    };
+
+    const cleanupBranch = async (row, button) => {
+      if (!window.confirm(buildCleanupPlan(row) + "\n\nDelete this branch?")) return;
+      button.disabled = true;
+      setStatus(branchesStatus, "Deleting " + row.shortRef + "…");
+      try {
+        const res = await fetch(ds.branchesEndpoint, {
+          method: "POST",
+          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
+          body: JSON.stringify({ ref: row.ref, expectedSha: row.sha }),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (res.ok && data.ok) {
+          setStatus(
+            branchesStatus,
+            data.alreadyAbsent
+              ? row.shortRef + " was already gone (nothing to delete)."
+              : "Deleted " + row.shortRef + ".",
+            "ok",
+          );
+        } else {
+          setStatus(branchesStatus, data.error || "Delete refused (" + res.status + ")", "err");
+        }
+      } catch {
+        setStatus(branchesStatus, "Delete failed — network error", "err");
+      } finally {
+        button.disabled = false;
+        loadBranches();
+      }
+    };
+
+    const renderBranches = (view) => {
+      if (!branchesBody) return;
+      const rows = Array.isArray(view.rows) ? view.rows : [];
+      if (branchesChip) {
+        const needsReview = rows.filter((r) => r.quarantine || r.eligibleForDelete).length;
+        branchesChip.textContent = needsReview
+          ? needsReview + " to review"
+          : rows.length
+            ? rows.length + " branches"
+            : "0 branches";
+        branchesChip.className = "chip" + (needsReview ? " amber" : "");
+      }
+      branchesBody.textContent = "";
+      if (!rows.length) {
+        const tr = document.createElement("tr");
+        const td = cell(subtle("No candidate branches found for this repo."));
+        td.colSpan = 7;
+        tr.append(td);
+        branchesBody.append(tr);
+        return;
+      }
+
+      for (const row of rows) {
+        const tr = document.createElement("tr");
+
+        const branchCell = document.createElement("td");
+        const branchStrong = document.createElement("strong");
+        branchStrong.textContent = row.shortRef;
+        branchCell.append(branchStrong, subtle(row.ref + " @ " + row.shortSha));
+        tr.append(branchCell);
+
+        tr.append(cell(chip(row.classificationLabel, BRANCH_TONE[row.classification] || "")));
+
+        const prCell = document.createElement("td");
+        if (row.prNumber != null) {
+          // Link to the INTERNAL friendly PR route (/preview/<tenant>/pr/<N>), never
+          // the server-provided `row.prUrl` — that is the raw Gitea forge html_url the
+          // MCP candidate_list projection emits (<forge-host>/<org>/<repo>/pulls/N),
+          // and surfacing a raw forge link to an owner is exactly the boundary
+          // noGiteaLinks.test.ts guards (the source scan can't catch a host that
+          // arrives in data, so we refuse it here at render). Mirrors the candidate
+          // queue, which already builds its preview link this way.
+          const prHref = candidatePrUrl(row.prNumber);
+          if (prHref) {
+            const a = document.createElement("a");
+            a.href = prHref;
+            a.target = "_blank";
+            a.rel = "noopener";
+            a.textContent = "PR #" + row.prNumber;
+            prCell.append(a);
+          } else {
+            prCell.append(document.createTextNode("PR #" + row.prNumber));
+          }
+          prCell.append(subtle((row.prState || "") + (row.integratedIntoAggregate ? " · in aggregate" : "")));
+        } else {
+          prCell.append(subtle("No PR record"));
+        }
+        tr.append(prCell);
+
+        tr.append(cell(row.commitTimestampDisplay));
+        tr.append(cell(row.ageLabel));
+        tr.append(cell(row.evidenceSummary));
+
+        const actionsCell = document.createElement("td");
+        actionsCell.className = "action";
+        if (row.quarantine) {
+          actionsCell.append(chip("Needs owner review", "red"));
+        } else if (row.eligibleForDelete) {
+          const btn = document.createElement("button");
+          btn.type = "button";
+          btn.className = "btn";
+          btn.disabled = !canShip;
+          btn.title = canShip ? "" : "Requires an owner/admin sign-in.";
+          btn.textContent = "Clean up";
+          btn.addEventListener("click", () => cleanupBranch(row, btn));
+          actionsCell.append(btn);
+        } else {
+          actionsCell.append(subtle("Keep"));
+        }
+        tr.append(actionsCell);
+
+        branchesBody.append(tr);
+      }
+    };
+
+    const loadBranches = async () => {
+      if (!branchesBody) return;
+      try {
+        const res = await fetch(ds.branchesEndpoint, { headers: { accept: "application/json" } });
+        if (res.status === 401 || res.status === 403) {
+          if (branchesChip) branchesChip.textContent = "Sign-in required";
+          branchesBody.textContent = "";
+          const tr = document.createElement("tr");
+          const td = cell(subtle("Sign in as a store owner or admin to view branch retention."));
+          td.colSpan = 7;
+          tr.append(td);
+          branchesBody.append(tr);
+          return;
+        }
+        const data = await res.json().catch(() => ({}));
+        if (!res.ok) {
+          setStatus(branchesStatus, data.error || "Could not load branch classification (" + res.status + ")", "err");
+          return;
+        }
+        renderBranches(data.report || {});
+      } catch {
+        setStatus(branchesStatus, "Could not load branch classification — network error", "err");
+      }
+    };
+
     // ---- Wiring ------------------------------------------------------------
 
     root.querySelector("[data-publish-refresh]")?.addEventListener("click", () => {
@@ -1721,11 +2933,24 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
       loadQueue();
       loadVersions();
       loadDomain();
+      loadBranches();
     });
 
+    // rux7: pause polling while hidden; on return, refresh immediately (loadQueue
+    // re-renders + resyncs the poll clock) rather than waiting out the interval.
+    document.addEventListener("visibilitychange", () => {
+      if (document.hidden) {
+        clearPoll();
+      } else {
+        loadQueue();
+      }
+    });
+
+    // loadQueue starts the poll cadence via its tail (schedulePoll).
     loadQueue();
     loadVersions();
     loadDomain();
+    loadBranches();
   })();
 </script>
 
@@ -1763,11 +2988,331 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     color: var(--admin-red);
   }
 
+  /* ?pr=N deep link: "not in the queue" callout + row flash */
+  .publish-pr-callout {
+    border: 1px solid var(--admin-line-strong);
+    border-left: 3px solid var(--admin-amber);
+    background: var(--admin-surface-soft);
+    padding: 8px 12px;
+    border-radius: var(--admin-radius-sm);
+    color: var(--admin-ink);
+  }
+
+  @keyframes publish-row-flash {
+    0%,
+    25% {
+      background-color: var(--admin-teal-soft);
+    }
+    100% {
+      background-color: transparent;
+    }
+  }
+
+  .publish-row-highlight > td {
+    animation: publish-row-flash 2.4s ease-out;
+  }
+
+  @media (prefers-reduced-motion: reduce) {
+    .publish-row-highlight > td {
+      animation: none;
+      background-color: var(--admin-teal-soft);
+    }
+  }
+
   .publish-error-detail {
     color: var(--admin-red);
     font-size: 12px;
   }
 
+  /* ── Accept-to-preview LIFTOFF ─────────────────────────────────────────── */
+  .liftoff-backdrop {
+    position: fixed;
+    inset: 0;
+    z-index: 60;
+    display: grid;
+    place-items: center;
+    padding: 24px;
+    background: color-mix(in srgb, var(--admin-ink) 32%, transparent);
+    backdrop-filter: blur(6px);
+    -webkit-backdrop-filter: blur(6px);
+  }
+
+  /* `display: grid` above beats the UA's [hidden] rule — restate it, or the
+     invisible backdrop click-blocks the entire page (caught by live test). */
+  .liftoff-backdrop[hidden] {
+    display: none;
+  }
+
+  .liftoff-card {
+    position: relative;
+    width: min(520px, 100%);
+    max-height: min(84vh, 640px);
+    overflow: auto;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius, 12px);
+    background: var(--admin-surface);
+    box-shadow: 0 24px 80px rgba(8, 32, 30, 0.35);
+    padding: 24px 26px;
+    animation: liftoff-in 0.22s ease-out;
+  }
+
+  @keyframes liftoff-in {
+    from { transform: translateY(10px) scale(0.985); opacity: 0; }
+    to { transform: none; opacity: 1; }
+  }
+
+  /* In-flight shimmer: a live gradient beam along the card's top edge. */
+  .liftoff-card::before {
+    content: "";
+    position: absolute;
+    inset: 0 0 auto 0;
+    height: 3px;
+    border-radius: inherit;
+    opacity: 0;
+    background: linear-gradient(90deg, transparent, var(--admin-teal, #0f9d8f), #f4b942, var(--admin-teal, #0f9d8f), transparent);
+    background-size: 220% 100%;
+    transition: opacity 0.3s ease;
+  }
+
+  .liftoff-card[data-mode="flight"]::before {
+    opacity: 1;
+    animation: liftoff-beam 1.6s linear infinite;
+  }
+
+  @keyframes liftoff-beam {
+    from { background-position: 200% 0; }
+    to { background-position: -20% 0; }
+  }
+
+  .liftoff-kicker {
+    margin: 0 0 2px;
+    font-size: 11px;
+    font-weight: 700;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--admin-teal, #0f9d8f);
+  }
+
+  .liftoff-title {
+    margin: 0 0 14px;
+    font-size: 19px;
+    line-height: 1.25;
+  }
+
+  .liftoff-grid {
+    display: grid;
+    grid-template-columns: auto 1fr;
+    gap: 6px 16px;
+    margin: 0 0 12px;
+    padding: 12px 14px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+  }
+
+  .liftoff-grid dt {
+    color: var(--admin-muted);
+    font-size: 12px;
+  }
+
+  .liftoff-grid dd {
+    margin: 0;
+    font-size: 13px;
+  }
+
+  .liftoff-actions {
+    display: flex;
+    justify-content: flex-end;
+    gap: 8px;
+    margin-top: 16px;
+  }
+
+  .liftoff-stages {
+    list-style: none;
+    margin: 6px 0 4px;
+    padding: 0;
+    display: grid;
+    gap: 0;
+  }
+
+  .liftoff-stages li {
+    position: relative;
+    display: flex;
+    gap: 12px;
+    align-items: flex-start;
+    padding: 9px 0;
+  }
+
+  /* Connecting rail between the dots. */
+  .liftoff-stages li + li::before {
+    content: "";
+    position: absolute;
+    left: 10px;
+    top: -8px;
+    height: 16px;
+    width: 2px;
+    background: var(--admin-line-strong);
+  }
+
+  .liftoff-stages li > div {
+    display: grid;
+    gap: 1px;
+  }
+
+  .liftoff-stages b {
+    font-size: 13px;
+  }
+
+  .liftoff-stages span:not(.liftoff-dot) {
+    font-size: 12px;
+    color: var(--admin-muted);
+  }
+
+  .liftoff-dot {
+    flex: none;
+    width: 21px;
+    height: 21px;
+    margin-top: 1px;
+    border-radius: 50%;
+    border: 2px solid var(--admin-line-strong);
+    display: grid;
+    place-items: center;
+    font-size: 12px;
+    font-weight: 700;
+    color: #fff;
+    background: transparent;
+    transition: all 0.25s ease;
+  }
+
+  .liftoff-stages li[data-state="active"] .liftoff-dot {
+    border-color: var(--admin-teal, #0f9d8f);
+    box-shadow: 0 0 0 0 color-mix(in srgb, var(--admin-teal, #0f9d8f) 45%, transparent);
+    animation: liftoff-pulse 1.3s ease-out infinite;
+  }
+
+  .liftoff-stages li[data-state="active"] b {
+    color: var(--admin-teal, #0f9d8f);
+  }
+
+  @keyframes liftoff-pulse {
+    from { box-shadow: 0 0 0 0 color-mix(in srgb, var(--admin-teal, #0f9d8f) 45%, transparent); }
+    to { box-shadow: 0 0 0 10px transparent; }
+  }
+
+  .liftoff-stages li[data-state="done"] .liftoff-dot {
+    border-color: var(--admin-green);
+    background: var(--admin-green);
+  }
+
+  .liftoff-stages li[data-state="done"] .liftoff-dot::after {
+    content: "✓";
+  }
+
+  .liftoff-stages li[data-state="fail"] .liftoff-dot {
+    border-color: var(--admin-red);
+    background: var(--admin-red);
+  }
+
+  .liftoff-stages li[data-state="fail"] .liftoff-dot::after {
+    content: "✕";
+  }
+
+  .liftoff-live {
+    margin: 8px 0 0;
+    min-height: 18px;
+    font-size: 13px;
+    color: var(--admin-ink);
+  }
+
+  .liftoff-meta {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    margin-top: 14px;
+    color: var(--admin-muted);
+  }
+
+  .liftoff-outcome-phase {
+    text-align: center;
+    padding-top: 6px;
+  }
+
+  .liftoff-outcome-phase .liftoff-actions {
+    justify-content: center;
+  }
+
+  .liftoff-seal {
+    width: 56px;
+    height: 56px;
+    margin: 4px auto 12px;
+    border-radius: 50%;
+    display: grid;
+    place-items: center;
+    font-size: 28px;
+    font-weight: 700;
+    color: #fff;
+  }
+
+  .liftoff-seal[data-state="ok"] {
+    background: var(--admin-green);
+    animation: liftoff-seal-pop 0.45s cubic-bezier(0.2, 1.6, 0.4, 1);
+  }
+
+  .liftoff-seal[data-state="ok"]::after {
+    content: "✓";
+  }
+
+  .liftoff-seal[data-state="err"] {
+    background: var(--admin-red);
+  }
+
+  .liftoff-seal[data-state="err"]::after {
+    content: "✕";
+  }
+
+  @keyframes liftoff-seal-pop {
+    from { transform: scale(0.4); opacity: 0; }
+    60% { transform: scale(1.12); }
+    to { transform: none; opacity: 1; }
+  }
+
+  .liftoff-confetti {
+    pointer-events: none;
+    position: absolute;
+    inset: 0;
+    overflow: hidden;
+    border-radius: inherit;
+  }
+
+  .liftoff-confetti i {
+    position: absolute;
+    top: -12px;
+    width: 7px;
+    height: 11px;
+    border-radius: 2px;
+    opacity: 0;
+    animation-name: liftoff-confetti-fall;
+    animation-timing-function: ease-in;
+    animation-fill-mode: forwards;
+  }
+
+  @keyframes liftoff-confetti-fall {
+    0% { opacity: 1; transform: translate(0, 0) rotate(0deg); }
+    100% {
+      opacity: 0.9;
+      transform: translate(var(--liftoff-drift, 0px), 660px) rotate(var(--liftoff-spin, 240deg));
+    }
+  }
+
+  @media (prefers-reduced-motion: reduce) {
+    .liftoff-card,
+    .liftoff-card[data-mode="flight"]::before,
+    .liftoff-stages li[data-state="active"] .liftoff-dot,
+    .liftoff-seal[data-state="ok"] {
+      animation: none;
+    }
+  }
+
   .domain-connect-controls {
     display: grid;
     gap: 8px;
@@ -1901,11 +3446,69 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     min-width: 780px;
   }
 
-  .publish-diff-cell {
+  /* rux6: unified review pane */
+  .publish-review-cell {
     padding: 12px 14px;
     background: var(--admin-surface-soft);
   }
 
+  .review-pane {
+    display: grid;
+    grid-template-columns: minmax(0, 1.3fr) minmax(0, 1fr);
+    gap: 16px;
+    align-items: start;
+  }
+
+  @media (max-width: 900px) {
+    .review-pane {
+      grid-template-columns: 1fr;
+    }
+  }
+
+  .review-preview {
+    display: grid;
+    gap: 8px;
+    min-width: 0;
+  }
+
+  .review-pane-head {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 10px;
+  }
+
+  .review-frame {
+    width: 100%;
+    height: 420px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface);
+  }
+
+  .review-detail {
+    display: grid;
+    gap: 14px;
+    min-width: 0;
+  }
+
+  .review-section {
+    display: grid;
+    gap: 6px;
+  }
+
+  .review-chips {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 6px;
+  }
+
+  .review-actions {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px;
+  }
+
   .publish-diff-head {
     display: flex;
     flex-wrap: wrap;