@tokenoftrust/storefront-runner 1.4.0 → 1.4.2-rc.0

package/apps/storefront/src/lib/publish/adminPublishTab.ts

@@ -0,0 +1,3519 @@
+/**
+ * Client island for the admin Publish tab (`components/admin/AdminPublishTab.astro`).
+ *
+ * The tab's template exposes every runtime endpoint + capability flag as `data-*`
+ * attributes on `#publish`; this module reads them and wires the queue, aggregate,
+ * versions, branch-retention, and domain panels — the whole go-live surface. It runs
+ * from a PROCESSED `<script>` (Astro bundles + type-checks it), so the pure logic it
+ * used to hand-mirror inline is imported from its tested source of truth instead of
+ * duplicated (see docs/architecture/decisions/0013-client-island-pattern-and-inline-drift-guard.md).
+ */
+import { createKeyedCache, createCoalescer } from "@/lib/publish/panelPolling";
+import { candidatePrUrl } from "@/lib/preview/candidateDashboard";
+import { classifyResolveResponse } from "@/lib/change/resolveConflict";
+
+export function initAdminPublishTab(): void {
+    const root: any = document.getElementById("publish");
+    if (!root) return;
+    const ds = root.dataset;
+    const canShip = ds.canShip === "true";
+    const repo = ds.repo || "";
+    const appDomain = ds.appDomain || "";
+
+    const statusEl = root.querySelector("[data-publish-status]");
+    const queueBody = root.querySelector("[data-publish-queue-body]");
+    const queueChip = root.querySelector("[data-publish-queue-chip]");
+    const queueCount = root.querySelector("[data-publish-queue-count]");
+    const degradedStrip = root.querySelector("[data-publish-degraded]");
+
+    // rux7 — in-flight UI state the auto-refresh poll must preserve across a
+    // re-render. These are the AUTHORITATIVE source of truth (never scraped
+    // back out of the DOM): an action's async closure holds a reference to the
+    // OLD button, so after a poll swaps the row the completion signal lands on a
+    // detached node — reading `disabled`/`data-building` off the fresh DOM would
+    // wedge forever. buildPreview/integrate/reject/retire add on start and
+    // delete in `finally` (before their own loadQueue), so the next render
+    // reflects the true busy set. Open diff panes are the exception: the DOM IS
+    // their source of truth (toggleDiff owns open/close), so renderQueue detaches
+    // and re-attaches the actual pane node — see renderQueue.
+    const inflightBuilds = new Set(); // prNumber currently building
+    const busyChanges = new Set(); // changeId with an in-flight integrate/reject/retire
+    let aggregatePublishing = false; // the aggregate Publish POST is in flight
+    let aggregateRetrying = false; // u15: the aggregate Retry-build POST is in flight
+
+
+    // A fingerprint of the current publish state (candidate head shas + live
+    // version), updated on every /api/changes read. Heavy panels key their
+    // client cache on it: unchanged fingerprint ⇒ no re-fetch. See changesSignature.
+    let currentStateKey: string | null = null;
+
+    // Visibility state, driven by an IntersectionObserver (see Wiring). Panels
+    // don't fetch until first viewed, and the queue poll only runs while the tab
+    // is active — a backgrounded/inactive Publish tab must not fire heavy reads.
+    let tabActive = false;
+    let branchesVisible = false;
+
+    const setStatus = (el?: any, message?: any, state?: any) => {
+      if (!el) return;
+      el.textContent = message || "";
+      if (state) el.dataset.state = state;
+      else delete el.dataset.state;
+    };
+
+    const shortSha = (sha?: any) => (sha ? String(sha).slice(0, 8) : "—");
+
+    // Build a "+N −M" lines-changed node (added green, removed red) as ONE element,
+    // so a meta "·" separator sits before the pair rather than between the numbers.
+    // Either count may be absent.
+    const linesNode = (added?: any, removed?: any) => {
+      const wrap = document.createElement("span");
+      wrap.className = "agg-lines";
+      if (typeof added === "number") {
+        const a = document.createElement("span");
+        a.className = "agg-add";
+        a.textContent = "+" + added;
+        wrap.append(a);
+      }
+      if (typeof removed === "number") {
+        const d = document.createElement("span");
+        d.className = "agg-del";
+        d.textContent = (typeof added === "number" ? " " : "") + "−" + removed;
+        wrap.append(d);
+      }
+      return wrap;
+    };
+
+
+    const age = (iso?: any) => {
+      if (!iso) return "—";
+      const ms = Date.now() - new Date(iso).getTime();
+      if (!Number.isFinite(ms) || ms < 0) return "—";
+      const mins = Math.floor(ms / 60000);
+      if (mins < 1) return "just now";
+      if (mins < 60) return mins + "m ago";
+      const hours = Math.floor(mins / 60);
+      if (hours < 48) return hours + "h ago";
+      return Math.floor(hours / 24) + "d ago";
+    };
+
+    const STATUS_CHIP: Record<string, string> = {
+      queued: "",
+      reconciling: "blue",
+      ready: "green",
+      blocked: "red",
+    };
+
+    const chip = (text?: any, tone?: any) => {
+      const el = document.createElement("span");
+      el.className = "chip" + (tone ? " " + tone : "");
+      el.textContent = text;
+      return el;
+    };
+
+    const cell = (...children: any[]) => {
+      const td = document.createElement("td");
+      for (const child of children) {
+        if (child == null) continue;
+        td.append(typeof child === "string" ? document.createTextNode(child) : child);
+      }
+      return td;
+    };
+
+    const subtle = (text?: any) => {
+      const el = document.createElement("span");
+      el.className = "subtle";
+      el.textContent = text;
+      return el;
+    };
+
+    // One included-change line item (PR # + human title, a one-line description of
+    // what it does, and meta: sha / files / lines). Shared by the aggregate plan's
+    // "Included changes" and the published-versions "what shipped" list, so both
+    // read the same way. Every enrichment field is optional — a row degrades to
+    // just "PR #N · <sha>" when candidate_summary didn't cover it.
+    const changeSummaryItem = (ch?: any) => {
+      const li = document.createElement("li");
+      li.className = "agg-included-item";
+
+      const top = document.createElement("div");
+      top.className = "agg-included-top";
+      const prEl = document.createElement("span");
+      prEl.className = "agg-included-pr";
+      prEl.textContent = ch.prNumber != null ? "PR #" + ch.prNumber : ch.changeId;
+      top.append(prEl);
+      if (ch.title) {
+        const t = document.createElement("span");
+        t.className = "agg-included-title";
+        t.textContent = ch.title;
+        top.append(t);
+      }
+      li.append(top);
+
+      const description = ch.description || ch.summary;
+      if (description) {
+        const desc = document.createElement("p");
+        desc.className = "agg-included-desc";
+        desc.textContent = description;
+        li.append(desc);
+      }
+
+      const meta = document.createElement("div");
+      meta.className = "agg-included-meta";
+      if (ch.headSha) {
+        const sha = document.createElement("span");
+        sha.className = "publish-mono sha-token";
+        sha.textContent = shortSha(ch.headSha);
+        meta.append(sha);
+      }
+      const fileCount = ch.fileCount != null ? ch.fileCount : ch.filesChanged;
+      if (fileCount != null) {
+        const f = document.createElement("span");
+        f.textContent = fileCount + (fileCount === 1 ? " file" : " files");
+        meta.append(f);
+      }
+      if (typeof ch.linesAdded === "number" || typeof ch.linesRemoved === "number") {
+        meta.append(linesNode(ch.linesAdded, ch.linesRemoved));
+      }
+      if (meta.childNodes.length) li.append(meta);
+      return li;
+    };
+
+    // ---- ?pr=N deep link ---------------------------------------------------
+    // A deep link like /admin#publish?pr=42 asks us to surface a specific PR's
+    // row once the queue has loaded. The param rides in the hash fragment
+    // (after the tab anchor) because that's how the admin shell routes tabs;
+    // fall back to a real query string too. Resolve exactly once — so the
+    // scroll/highlight never re-fires on the reloads that follow every ship
+    // action — and until it resolves, keep an honest "not in the queue yet"
+    // callout up rather than silently doing nothing.
+
+    const readRequestedPr = () => {
+      const hash = window.location.hash || "";
+      const q = hash.indexOf("?");
+      let raw = new URLSearchParams(q >= 0 ? hash.slice(q + 1) : "").get("pr");
+      if (raw == null) raw = new URLSearchParams(window.location.search).get("pr");
+      if (raw == null) return null;
+      const n = Number.parseInt(raw, 10);
+      return Number.isInteger(n) && n > 0 ? n : null;
+    };
+
+    const requestedPr = readRequestedPr();
+    let prDeeplinkResolved = false;
+
+    const applyPrDeeplink = () => {
+      if (requestedPr == null || prDeeplinkResolved) return;
+      const callout = root.querySelector("[data-publish-pr-callout]");
+      const row = queueBody.querySelector('tr[data-pr-number="' + requestedPr + '"]');
+      if (!row) {
+        if (callout) {
+          callout.hidden = false;
+          callout.textContent = "PR #" + requestedPr + " isn't in the queue yet.";
+        }
+        return;
+      }
+      prDeeplinkResolved = true;
+      if (callout) {
+        callout.hidden = true;
+        callout.textContent = "";
+      }
+      row.scrollIntoView({ block: "center", behavior: "smooth" });
+      row.classList.remove("publish-row-highlight");
+      void row.offsetWidth; // restart the flash animation if re-applied
+      row.classList.add("publish-row-highlight");
+      window.setTimeout(() => row.classList.remove("publish-row-highlight"), 2600);
+    };
+
+    // ---- Open change queue -------------------------------------------------
+
+    const renderQueue = (payload?: any) => {
+      const changes = Array.isArray(payload.changes) ? payload.changes : [];
+      // rux1: surface a forge-listing failure as a visible strip — never let a
+      // degraded (short) list read as a genuine empty queue.
+      if (degradedStrip) degradedStrip.hidden = payload.degraded !== true;
+      queueBody.textContent = "";
+      if (queueCount) queueCount.textContent = String(changes.length);
+      if (queueChip) {
+        queueChip.textContent = changes.length === 1 ? "1 open" : changes.length + " open";
+        queueChip.className = "chip" + (changes.length ? " blue" : "");
+      }
+
+      if (!changes.length) {
+        const tr = document.createElement("tr");
+        const td = cell(
+          subtle(
+            "No open changes. New store changes appear here when a developer submits them for review.",
+          ),
+        );
+        td.colSpan = 6;
+        tr.append(td);
+        queueBody.append(tr);
+        return;
+      }
+
+      for (const change of changes) {
+        const tr = document.createElement("tr");
+        if (change.prNumber != null) tr.dataset.prNumber = String(change.prNumber);
+
+        // Change id + branch / PR + preview link.
+        const idCell = document.createElement("td");
+        const idStrong = document.createElement("strong");
+        idStrong.textContent = change.changeId || "—";
+        idCell.append(idStrong);
+        const meta = [];
+        if (change.branch) meta.push(change.branch);
+        if (change.prNumber != null) meta.push("PR #" + change.prNumber);
+        if (meta.length) idCell.append(subtle(meta.join(" · ")));
+        // Owner-facing "who did this" — accept takes priority over build (a
+        // candidate that's been accepted-to-preview is more meaningfully
+        // "acted on" than merely built). Reject never shows here: a rejected
+        // candidate is closed and has already left the open queue.
+        const actorRecord = change.actors && (change.actors.accept || change.actors.build);
+        if (actorRecord) {
+          const label = change.actors.accept ? "Accepted by " : "Built by ";
+          idCell.append(subtle(label + (actorRecord.name || actorRecord.email)));
+        }
+        // Prefer the synthesized friendly per-PR route (handles every state);
+        // fall back to any server-provided previewUrl for change-first rows
+        // that have no PR number yet.
+        const previewUrl = candidatePrUrl(appDomain, change.prNumber) || change.previewUrl;
+        if (previewUrl) {
+          const preview = document.createElement("a");
+          preview.href = previewUrl;
+          preview.target = "_blank";
+          preview.rel = "noopener";
+          preview.textContent = "Open preview";
+          const wrap = document.createElement("span");
+          wrap.className = "subtle";
+          wrap.append(preview);
+          idCell.append(wrap);
+        }
+        tr.append(idCell);
+
+        // Reconcile status. u13 DISPLAY HONESTY: when the server could not confirm
+        // this row's live state against the forge (liveStateConfirmed === false — the
+        // forge listing failed), its stored label may be stale (e.g. a merged PR still
+        // reads "ready"). Render "State unknown" instead of asserting the stale label
+        // as current fact; keep the last-known label as a subtle, clearly-hedged note.
+        let statusCell;
+        if (change.liveStateConfirmed === false) {
+          statusCell = cell(chip("State unknown", "amber"));
+          statusCell.append(
+            subtle("Forge unreachable — last known: " + (change.status || "unknown")),
+          );
+        } else {
+          statusCell = cell(chip(change.status || "unknown", STATUS_CHIP[change.status] ?? "amber"));
+          if (change.lastError) statusCell.append(subtle(change.lastError));
+        }
+        tr.append(statusCell);
+
+        // Evidence / compliance verdict.
+        const checks = (change.evidence && change.evidence.checks) || [];
+        const failing = checks.filter((c: any) => c.status === "fail");
+        const promotable = Boolean(change.evidence && change.evidence.promotable);
+        const checksCell = cell(
+          promotable ? chip("Checks passed", "green") : chip("Checks blocked", "amber"),
+        );
+        if (failing.length) {
+          checksCell.append(subtle("Failing: " + failing.map((c: any) => c.label || c.id).join(", ")));
+        } else if (!checks.length) {
+          checksCell.append(subtle("No checks reported yet"));
+        }
+        tr.append(checksCell);
+
+        // Head sha + age.
+        const headCell = cell(shortSha(change.headSha));
+        headCell.classList.add("publish-mono");
+        tr.append(headCell);
+        tr.append(cell(age(change.updatedAt)));
+
+        // Actions.
+        const actions = document.createElement("td");
+        actions.className = "action publish-actions";
+
+        // rux5 — a synthetic not-built forge PR row (built:false / status
+        // "not-built") has NO built candidate: changeId is null, so the built-only
+        // actions below (Diff/Accept/Reject/Retire, all keyed on changeId) do not
+        // apply. Its one action is Build preview — materialize the PR's hosted
+        // preview on demand. Capability-gated: the button is SHOWN only to a
+        // ship-capable operator, and the server (buildGate) re-authorizes — the UI
+        // check is UX, not the real gate.
+        if (change.built === false || change.status === "not-built") {
+          if (canShip) {
+            const build = document.createElement("button");
+            build.type = "button";
+            build.className = "btn primary";
+            build.title = "Materialize this PR's hosted preview on demand (does not go live)";
+            // rux7: if a build for this PR is mid-flight, a poll re-render must
+            // reflect the spinner/disabled state (not a fresh clickable button
+            // that would let the operator double-submit). The in-flight closure
+            // re-renders on completion, clearing this.
+            if (change.prNumber != null && inflightBuilds.has(change.prNumber)) {
+              build.textContent = "Building…";
+              build.disabled = true;
+              build.dataset.building = "true";
+            } else {
+              build.textContent = "Build preview";
+            }
+            build.addEventListener("click", () => buildPreview(change, build));
+            actions.append(build);
+          } else {
+            actions.append(subtle("Owner/admin sign-in required to build"));
+          }
+          tr.append(actions);
+          queueBody.append(tr);
+          continue;
+        }
+
+        // rux7: while an integrate/reject/retire for this change is in flight,
+        // keep its mutating actions disabled across a poll re-render so the
+        // operator can't double-submit against a freshly-minted button.
+        const changeBusy = busyChanges.has(change.changeId);
+
+        // rux6 Review: expand the row into a single "review moment" pane —
+        // preview iframe + evidence chips + diff + Accept/Reject — so a reviewer
+        // never leaves the queue. Supersedes the standalone Diff button (the dg7
+        // diff now lives inside the pane, reusing renderDiff). The row's own
+        // Accept/Reject/Retire buttons below are unchanged.
+        const reviewBtn = document.createElement("button");
+        reviewBtn.type = "button";
+        reviewBtn.className = "btn";
+        reviewBtn.textContent = "Review";
+        reviewBtn.setAttribute("aria-expanded", "false");
+        reviewBtn.title = "Open one pane to preview, diff, and act on this change";
+        reviewBtn.addEventListener("click", () => toggleReview(change, reviewBtn, tr));
+        actions.append(reviewBtn);
+        // b11 SPLIT: the candidate-queue primary action is now ACCEPT TO PREVIEW
+        // (b08 integrate = advance the shared preview aggregate), NOT go-live.
+        // Integrate flips NO live channel, so it has NO paywall (entitled) gate —
+        // it holds only the ship-on-behalf capability floor. Going live is the
+        // aggregate card's Publish action, once the aggregate is green.
+        const accept = document.createElement("button");
+        accept.type = "button";
+        accept.className = "btn primary";
+        // A ready candidate with passed evidence but `mergeable:false` is a
+        // forge-settled conflict with the current preview tip. Make the existing
+        // automatic rebuild/re-integrate recovery reachable from the queue rather
+        // than presenting a generic, disabled "not ready" action. Other false
+        // mergeability states remain disabled: a rebuild cannot fix an incomplete
+        // reconcile or failed evidence.
+        const needsPreviewUpdate =
+          change.status === "ready" && promotable && change.mergeable === false;
+        accept.textContent = needsPreviewUpdate ? "Update change" : "Accept to preview";
+        accept.disabled = !canShip || (!needsPreviewUpdate && !change.mergeable) || changeBusy;
+        accept.title = !canShip
+          ? "Requires a ship-on-behalf grant on your account — ask the store owner"
+          : needsPreviewUpdate
+            ? "Preview changed while you worked — update this change, then integrate it"
+            : !change.mergeable
+              ? "This change is not ready to integrate"
+              : "Integrate this change into the preview aggregate (does not go live)";
+        accept.addEventListener("click", () =>
+          needsPreviewUpdate ? openConflictRecovery(change, accept) : integrateCandidate(change, accept),
+        );
+        actions.append(accept);
+        const reject = document.createElement("button");
+        reject.type = "button";
+        reject.className = "btn";
+        reject.textContent = "Reject";
+        reject.disabled = !canShip || changeBusy;
+        reject.title = canShip
+          ? "Close this change without publishing"
+          : "Requires a ship-on-behalf grant on your account — ask the store owner";
+        reject.addEventListener("click", () => rejectChange(change, reject));
+        actions.append(reject);
+
+        // U7 Retire/GC: evict this candidate's preview environment + version to
+        // reclaim space. DISTINCT from Reject — retire is reversible-by-rebuild
+        // (U1 build-on-demand + the U2 fallback page rematerialize it), so a
+        // retired PR degrades to "not built yet", not a dead 404.
+        const retire = document.createElement("button");
+        retire.type = "button";
+        retire.className = "btn";
+        retire.textContent = "Retire";
+        retire.disabled = !canShip || changeBusy;
+        retire.title = canShip
+          ? "Evict this preview to reclaim space — rebuildable on demand (not the same as Reject)"
+          : "Requires an owner or admin sign-in";
+        retire.addEventListener("click", () => retireChange(change, retire));
+        actions.append(retire);
+        tr.append(actions);
+
+        queueBody.append(tr);
+
+      }
+    };
+
+    const renderCurrent = (current?: any, shippedBy?: any) => {
+      const versionEl = root.querySelector("[data-publish-live-version]");
+      const sourceEl = root.querySelector("[data-publish-live-source]");
+      const atEl = root.querySelector("[data-publish-live-at]");
+      const shippedByEl = root.querySelector("[data-publish-live-shipped-by]");
+      if (current && current.versionId) {
+        if (versionEl) versionEl.textContent = shortSha(current.versionId);
+        if (sourceEl) {
+          sourceEl.textContent =
+            (current.source === "commit" ? "Published from a change" : "Published version") +
+            (current.artifactCount != null ? " · " + current.artifactCount + " files" : "");
+        }
+        if (atEl) atEl.textContent = current.createdAt ? age(current.createdAt) : "—";
+        // Owner-facing "who did this" — see changeActorAttribution.ts. Absent for
+        // any version published before this attribution existed, which is honest,
+        // not a bug.
+        if (shippedByEl) {
+          shippedByEl.textContent = shippedBy ? "Shipped by " + (shippedBy.name || shippedBy.email) : "";
+        }
+      } else {
+        if (versionEl) versionEl.textContent = "Not live yet";
+        if (sourceEl) sourceEl.textContent = "Nothing has been published for this store";
+        if (atEl) atEl.textContent = "—";
+        if (shippedByEl) shippedByEl.textContent = "";
+      }
+    };
+
+    // ---- rux7: auto-refresh (poll GET /api/changes) ------------------------
+    // Keep the queue + aggregate live without a manual reload: poll on an
+    // interval that BACKS OFF while nothing changes (grow the delay up to a cap)
+    // and SNAPS BACK to the base the moment something does. Pause entirely while
+    // the tab is hidden (document.hidden) — a backgrounded admin tab must not
+    // hammer the endpoint — and refresh promptly on return. A poll re-render
+    // reuses renderQueue/renderAggregate, which already preserve open diff panes
+    // and in-flight actions (inflightBuilds / busyChanges / aggregatePublishing),
+    // and applyPrDeeplink stays a one-time effect (prDeeplinkResolved), so the
+    // ?pr scroll never re-fires on a tick.
+    const POLL_BASE_MS = 8000;
+    const POLL_MAX_MS = 60000;
+    const POLL_GROWTH = 1.6;
+    let pollDelay = POLL_BASE_MS;
+    let pollTimer: any = null;
+    let pollBusy = false;
+    let lastChangesSignature: string | null = null;
+
+    // A compact projection of everything the queue/aggregate render VISIBLY off,
+    // so a no-op poll (identical data) neither re-renders nor interrupts a text
+    // selection — it just backs off. Relative ages are intentionally excluded;
+    // they drift at most one backoff interval and refresh on any real change.
+    const changesSignature = (data?: any) => {
+      const cur = data.current || {};
+      const agg = data.aggregate || {};
+      const run = agg.activeRun || agg.lastRun || {};
+      const plan = data.plan || {};
+      const rows = (Array.isArray(data.changes) ? data.changes : []).map((c: any) => [
+        c.changeId,
+        c.prNumber,
+        c.status,
+        c.headSha,
+        c.mergeable,
+        c.built,
+        c.lastError || null,
+        !!(c.evidence && c.evidence.promotable),
+        c.actors ? Object.keys(c.actors).sort().join(",") : "",
+      ]);
+      const summary = data.releaseSummary || (agg.releaseSummary) || null;
+      return JSON.stringify({
+        degraded: data.degraded === true,
+        current: [cur.versionId || null, cur.createdAt || null, cur.artifactCount ?? null],
+        shippedBy: (data.shippedBy && data.shippedBy.email) || null,
+        aggregate: [
+          agg.queueState || null,
+          agg.aggregateSha || null,
+          run.state || null,
+          run.finishedAt || null,
+          // include per-PR identity + title + stats so enrichment (a title/scope
+          // arriving) re-renders
+          (agg.includedPrs || []).map((p: any) => [
+            p.prNumber ?? p.changeId ?? null, p.headSha || null, p.title || null,
+            p.fileCount ?? null, p.linesAdded ?? null, p.linesRemoved ?? null,
+            Array.isArray(p.diff) ? p.diff.length : 0,
+          ]),
+        ],
+        summary: summary ? [summary.lead || summary.text || null, (summary.highlights || []).length] : null,
+        scope: data.stagedScope
+          ? [data.stagedScope.files, data.stagedScope.added, data.stagedScope.removed]
+          : null,
+        plan: [plan.ok === true, plan.pinnedSha || null, plan.artifactDigest || null, plan.alreadyShipped === true],
+        rows,
+      });
+    };
+
+    const clearPoll = () => {
+      if (pollTimer) {
+        clearTimeout(pollTimer);
+        pollTimer = null;
+      }
+    };
+
+    const schedulePoll = () => {
+      clearPoll();
+      // Paused while the browser tab is hidden (visibilitychange resumes) OR
+      // while the Publish admin-tab is not the active one (the IntersectionObserver
+      // resumes it on activation) — an inactive tab must not poll heavy reads.
+      if (document.hidden || !tabActive) return;
+      pollTimer = setTimeout(runPoll, pollDelay);
+    };
+
+    // One poll tick: fetch, and only re-render when the projection actually
+    // changed. Returns an outcome the caller uses to size the next interval.
+    const pollChanges = async () => {
+      let res;
+      try {
+        res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
+      } catch {
+        return "error"; // network blip — keep the last good view, just back off
+      }
+      if (res.status === 401 || res.status === 403) return "auth"; // session gone
+      const data = await res.json().catch(() => null);
+      if (!res.ok || !data) return "error";
+      const sig = changesSignature(data);
+      currentStateKey = sig; // heavy panels cache against this fingerprint
+      if (sig === lastChangesSignature) return "unchanged";
+      lastChangesSignature = sig;
+      renderCurrent(data.current, data.shippedBy);
+      renderQueue(data);
+      applyPrDeeplink();
+      renderAggregate(data);
+      return "changed";
+    };
+
+    const runPoll = async () => {
+      pollTimer = null;
+      if (document.hidden || !tabActive || pollBusy) {
+        schedulePoll();
+        return;
+      }
+      pollBusy = true;
+      let outcome;
+      try {
+        outcome = await pollChanges();
+      } finally {
+        pollBusy = false;
+      }
+      if (outcome === "auth") {
+        clearPoll(); // stop polling — a sign-in is required; a manual refresh retries
+        return;
+      }
+      // Branch retention rides the SAME cadence as the queue so its rows reflect
+      // live forge state, not a frozen page-load snapshot (b1: a stale "PR #11
+      // open / Keep" 30+ min after the PR closed) — but ONLY while the branches
+      // panel is actually on screen (lazy: don't fetch a panel the operator
+      // isn't looking at). loadBranches coalesces overlapping ticks and owns its
+      // own no-change guard and unreachable fallback.
+      if (branchesVisible) loadBranches();
+      pollDelay =
+        outcome === "changed"
+          ? POLL_BASE_MS
+          : Math.min(POLL_MAX_MS, Math.round(pollDelay * POLL_GROWTH));
+      schedulePoll();
+    };
+
+    const loadQueue = async () => {
+      try {
+        const res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
+        if (res.status === 401 || res.status === 403) {
+          if (queueChip) queueChip.textContent = "Sign-in required";
+          if (degradedStrip) degradedStrip.hidden = true;
+          queueBody.textContent = "";
+          const tr = document.createElement("tr");
+          const td = cell(subtle("Sign in as a store owner or admin to view the publish queue."));
+          td.colSpan = 6;
+          tr.append(td);
+          queueBody.append(tr);
+          return;
+        }
+        const data = await res.json();
+        if (!res.ok) {
+          setStatus(statusEl, data.error || "Could not load the change queue (" + res.status + ")", "err");
+          return;
+        }
+        renderCurrent(data.current, data.shippedBy);
+        renderQueue(data);
+        applyPrDeeplink();
+        renderAggregate(data);
+        // rux7: this is fresh authoritative data — resync the poll clock so the
+        // next tick dedupes against it, and reset the cadence to responsive
+        // (a manual refresh / a just-completed action likely means more coming).
+        lastChangesSignature = changesSignature(data);
+        currentStateKey = lastChangesSignature; // heavy panels cache against this
+        pollDelay = POLL_BASE_MS;
+        schedulePoll();
+      } catch {
+        setStatus(statusEl, "Could not load the change queue — network error", "err");
+      }
+    };
+
+    // ---- b11: the aggregate card + exact-digest Publish ---------------------
+    // Reads the aggregate/runs/plan projection GET /api/changes now returns
+    // (AggregateCardView + AggregateShipPlanView, built by aggregateView.ts):
+    //   - the aggregate's queueState + build sha + reviewed digest,
+    //   - the COMBINED EVIDENCE = the last integration run's honest state +
+    //     statusMessage (never re-derived),
+    //   - the included-PR batch,
+    //   - the b09 ship PLAN (pinned SHA/digest/PRs/rollback/paywall + run link),
+    //     shown inline so the confirm never has to POST to preview it.
+
+    const aggPanel = root.querySelector("[data-publish-aggregate]");
+    const AGG_STATE_CHIP: Record<string, string> = {
+      empty: "",
+      queued: "amber",
+      integrating: "blue",
+      green: "green",
+      red: "red",
+      shipped: "green",
+    };
+    // The plan we last rendered — the exact-digest guard the Publish POST sends
+    // back so a stale plan (queue moved / artifact changed) is refused, never
+    // shipped blind.
+    let currentPlan: any = null;
+
+    const runLink = (revHref?: any, label?: any) => {
+      if (!revHref) return null;
+      const a = document.createElement("a");
+      a.href = revHref;
+      a.target = "_blank";
+      a.rel = "noopener";
+      a.textContent = label || "Open build";
+      return a;
+    };
+
+    const renderAggregate = (data?: any) => {
+      if (!aggPanel) return;
+      const agg = data.aggregate || null;
+      const plan = data.plan || null;
+      currentPlan = plan && plan.ok ? plan : null;
+
+      // AI-assembled release summary — plain-language "what am I publishing?".
+      // OPTIONAL server enrichment: data.releaseSummary { lead|text, highlights?:
+      // [{title, detail}] }. Absent → the whole card stays hidden and the panel
+      // degrades to the technical chain below (graceful fallback, never a stub).
+      const summaryWrap = aggPanel.querySelector("[data-aggregate-summary]");
+      if (summaryWrap) {
+        const summary = data.releaseSummary || (agg && agg.releaseSummary) || null;
+        const lead = summary && (summary.lead || summary.text);
+        if (!lead) {
+          summaryWrap.hidden = true;
+        } else {
+          summaryWrap.hidden = false;
+          const leadEl = summaryWrap.querySelector("[data-aggregate-summary-lead]");
+          const pointsEl = summaryWrap.querySelector("[data-aggregate-summary-points]");
+          if (leadEl) leadEl.textContent = lead;
+          if (pointsEl) {
+            pointsEl.textContent = "";
+            const points = Array.isArray(summary.highlights) ? summary.highlights : [];
+            for (const pt of points) {
+              const li = document.createElement("li");
+              const tick = document.createElement("span");
+              tick.className = "agg-tick";
+              tick.setAttribute("aria-hidden", "true");
+              const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+              const use = document.createElementNS("http://www.w3.org/2000/svg", "use");
+              use.setAttribute("href", "#i-check");
+              svg.append(use);
+              tick.append(svg);
+              const text = document.createElement("span");
+              if (pt && typeof pt === "object" && pt.title) {
+                const b = document.createElement("b");
+                b.textContent = pt.title;
+                text.append(b);
+                if (pt.detail) text.append(document.createTextNode(" — " + pt.detail));
+              } else {
+                text.textContent = typeof pt === "string" ? pt : (pt && pt.detail) || "";
+              }
+              li.append(tick, text);
+              pointsEl.append(li);
+            }
+            pointsEl.hidden = points.length === 0;
+          }
+        }
+      }
+
+      const chipEl = aggPanel.querySelector("[data-aggregate-chip]");
+      const shaEl = aggPanel.querySelector("[data-aggregate-sha]");
+      const runLinkEl = aggPanel.querySelector("[data-aggregate-run-link]");
+      const evEl = aggPanel.querySelector("[data-aggregate-evidence]");
+      const evDetailEl = aggPanel.querySelector("[data-aggregate-evidence-detail]");
+      const digestEl = aggPanel.querySelector("[data-aggregate-digest]");
+      const prsWrap = aggPanel.querySelector("[data-aggregate-prs-wrap]");
+      const prsTitle = aggPanel.querySelector("[data-aggregate-prs-title]");
+      const deltaNote = aggPanel.querySelector("[data-aggregate-delta-note]");
+      const scopeEl = aggPanel.querySelector("[data-aggregate-scope]");
+      const prsList = aggPanel.querySelector("[data-aggregate-prs]");
+      const publishBtn = aggPanel.querySelector("[data-aggregate-publish]");
+      const publishDetail = aggPanel.querySelector("[data-aggregate-publish-detail]");
+      const retryRow = aggPanel.querySelector("[data-aggregate-retry-row]");
+      const retryBtn = aggPanel.querySelector("[data-aggregate-retry-build]");
+
+      const state = (agg && agg.queueState) || "empty";
+      // u15 — only offer a retry while the aggregate is actually red; a poll
+      // refresh landing mid-retry must not re-enable a button whose click is
+      // already in flight (rux7's own guard, mirrored here).
+      if (retryRow) retryRow.hidden = state !== "red";
+      if (retryBtn) retryBtn.disabled = aggregateRetrying;
+      if (chipEl) {
+        chipEl.textContent = state;
+        chipEl.className = "chip " + (AGG_STATE_CHIP[state] || "");
+      }
+      if (shaEl) shaEl.textContent = agg && agg.aggregateSha ? shortSha(agg.aggregateSha) : "—";
+      if (runLinkEl) {
+        runLinkEl.textContent = "";
+        const link = agg && runLink(agg.revHref, "Open build");
+        if (link) runLinkEl.append(link);
+        else runLinkEl.append(document.createTextNode("The current green preview build for this store."));
+      }
+
+      // Combined evidence = the last (or in-flight) integration run's honest state.
+      const lastRun = agg && (agg.activeRun || agg.lastRun);
+      if (evEl) {
+        if (!lastRun) {
+          evEl.textContent = "No runs yet";
+          evEl.dataset.state = "none";
+        } else if (lastRun.state === "passed") {
+          evEl.textContent = "Passed";
+          evEl.dataset.state = "passed";
+        } else if (lastRun.state === "failed") {
+          evEl.textContent = "Failed";
+          evEl.dataset.state = "failed";
+        } else {
+          evEl.textContent = "Integrating…";
+          evEl.dataset.state = "running";
+        }
+      }
+      if (evDetailEl) {
+        evDetailEl.textContent = "";
+        if (lastRun) {
+          const parts = [];
+          if (lastRun.statusMessage) parts.push(lastRun.statusMessage);
+          else if (lastRun.state === "passed") parts.push("Combined evidence passed.");
+          else if (lastRun.state === "failed") parts.push("Combined evidence did not pass.");
+          if (lastRun.finishedAt) parts.push(age(lastRun.finishedAt));
+          evDetailEl.append(document.createTextNode(parts.join(" · ")));
+          const rl = runLink(lastRun.revHref, "Run build");
+          if (rl) {
+            evDetailEl.append(document.createTextNode(" · "));
+            evDetailEl.append(rl);
+          }
+        } else {
+          evDetailEl.append(document.createTextNode("The last integration run's verdict."));
+        }
+      }
+
+      // Reviewed digest: only known once the plan pins it (b09). Never fabricated.
+      if (digestEl) {
+        digestEl.textContent = currentPlan ? shortSha(currentPlan.artifactDigest.replace(/^sha256:/, "")) : "—";
+      }
+
+      // u14 — the STAGED delta vs live. The included-PR batch is the "missing
+      // middle": what's in the staged preview but NOT yet on the live site.
+      // `includedPrs` never clears on ship (a shipped aggregate still lists its
+      // PRs), so "ahead of live" MUST key on the shas — staged aggregateSha vs the
+      // live version id — not on the list length alone.
+      const prs = (agg && agg.includedPrs) || [];
+      const stagedSha = agg && agg.aggregateSha;
+      const liveId = data.current && data.current.versionId;
+      const matchesLive = Boolean(stagedSha && liveId && stagedSha === liveId);
+      const aheadCount = prs.length;
+
+      if (prsWrap) prsWrap.hidden = prs.length === 0;
+      if (prsTitle) {
+        prsTitle.textContent =
+          aheadCount && !matchesLive
+            ? "Staged changes — " + aheadCount + " ahead of live"
+            : "Included changes";
+      }
+      if (deltaNote) {
+        let msg = "";
+        if (matchesLive) {
+          msg = "This staged build is exactly what's live — nothing is waiting to publish.";
+        } else if (!liveId) {
+          msg = "Nothing is live yet — publishing makes this staged build your first version.";
+        } else if (aheadCount) {
+          msg =
+            "In the staged preview (" + shortSha(stagedSha) + ") but not on your live site (" +
+            shortSha(liveId) + ") until you publish.";
+        }
+        deltaNote.textContent = msg;
+        deltaNote.hidden = !msg;
+      }
+
+      // Staged → live delta strip: the staged aggregate sha ahead of the live
+      // pointer. Shown only when there IS a delta (ahead of a real live version).
+      const deltaStrip = aggPanel.querySelector("[data-aggregate-delta-strip]");
+      if (deltaStrip) {
+        const showStrip = Boolean(aheadCount && !matchesLive && stagedSha && liveId);
+        deltaStrip.hidden = !showStrip;
+        if (showStrip) {
+          const stagedEl = deltaStrip.querySelector("[data-agg-delta-staged]");
+          const liveEl = deltaStrip.querySelector("[data-agg-delta-live]");
+          const countEl = deltaStrip.querySelector("[data-agg-delta-count]");
+          if (stagedEl) stagedEl.textContent = shortSha(stagedSha);
+          if (liveEl) liveEl.textContent = shortSha(liveId);
+          if (countEl) countEl.textContent = aheadCount + " ahead";
+        }
+      }
+
+      // Top-level scope-of-change: "Scope · N files · +A −R" across the staged batch.
+      // A risk-at-a-glance measure; hidden when no staged change carries size stats.
+      if (scopeEl) {
+        const scope = data.stagedScope;
+        const hasScope = Boolean(scope && (scope.files > 0 || scope.added > 0 || scope.removed > 0));
+        scopeEl.textContent = "";
+        scopeEl.hidden = !hasScope;
+        if (hasScope) {
+          const label = document.createElement("span");
+          label.className = "agg-scope-label";
+          label.textContent = "Scope";
+          scopeEl.append(label);
+          const files = document.createElement("span");
+          files.textContent = scope.files + (scope.files === 1 ? " file" : " files");
+          scopeEl.append(files);
+          if (scope.added || scope.removed) {
+            scopeEl.append(linesNode(scope.added || 0, scope.removed || 0));
+          }
+          if (scope.partial) {
+            const partial = document.createElement("span");
+            partial.className = "agg-scope-partial";
+            partial.textContent = "partial";
+            partial.title = "Some staged changes had no size stats — the totals cover the rest.";
+            scopeEl.append(partial);
+          }
+        }
+      }
+
+      if (prsList) {
+        prsList.textContent = "";
+        for (const pr of prs) {
+          const li = document.createElement("li");
+          li.className = "agg-change";
+
+          const main = document.createElement("div");
+          main.className = "agg-change-main";
+
+          // Line 1: PR label + optional human title (what the change actually is).
+          const line1 = document.createElement("div");
+          line1.className = "agg-change-line";
+          const label = document.createElement("span");
+          label.className = "agg-change-pr";
+          label.textContent = pr.prNumber != null ? "PR #" + pr.prNumber : pr.changeId;
+          line1.append(label);
+          if (pr.title) {
+            const title = document.createElement("span");
+            title.className = "agg-change-title";
+            title.textContent = pr.title;
+            line1.append(title);
+          }
+          main.append(line1);
+
+          // Line 2: sha token + provenance (server enrichment): WHEN it entered the
+          // staged preview + WHO ran Integrate. Best-effort — absent when unattributed.
+          const line2 = document.createElement("div");
+          line2.className = "agg-change-line agg-change-sub";
+          const sha = document.createElement("span");
+          sha.className = "publish-mono sha-token";
+          sha.textContent = shortSha(pr.headSha);
+          line2.append(sha);
+          if (pr.integratedAt || (pr.integratedBy && pr.integratedBy.email)) {
+            const meta = document.createElement("span");
+            meta.className = "subtle aggregate-pr-meta";
+            const bits = [];
+            if (pr.integratedAt) bits.push("integrated " + age(pr.integratedAt));
+            if (pr.integratedBy && pr.integratedBy.email) bits.push("by " + pr.integratedBy.email);
+            meta.textContent = bits.join(" ");
+            line2.append(meta);
+          }
+          main.append(line2);
+          li.append(main);
+
+          // u14 Undo — per-change revert: roll THIS change OUT of the staged preview
+          // (a revert commit + rebuild); the live site is untouched. Only for a
+          // PR-numbered, still-ahead-of-live change; gated on ship capability.
+          if (canShip && pr.prNumber != null && !matchesLive) {
+            const undo = document.createElement("button");
+            undo.type = "button";
+            undo.className = "btn btn-compact";
+            undo.textContent = "Undo";
+            undo.title =
+              "Revert PR #" + pr.prNumber + " out of the staged preview (your live site is untouched)";
+            undo.addEventListener("click", () => revertStaged(pr, undo));
+            li.append(undo);
+          }
+          prsList.append(li);
+        }
+      }
+
+      renderPlan(data.plan);
+
+      // The Publish button: enabled only for a shippable, paywall-cleared plan and
+      // a viewer who can ship. A paywalled plan is SHOWN (upsell), never hidden.
+      if (publishBtn) {
+        const shippable = Boolean(currentPlan);
+        const paywalled = currentPlan && currentPlan.paywall && !currentPlan.paywall.allowed;
+        // rux7: never re-enable the Publish button while its POST is in flight —
+        // a poll refresh landing mid-publish must not open a double-submit.
+        publishBtn.disabled =
+          aggregatePublishing || !canShip || !shippable || paywalled || currentPlan.alreadyShipped;
+        publishBtn.title = !canShip
+          ? "Requires an owner or admin sign-in"
+          : !shippable
+            ? "The aggregate is not green / has no passed run to publish yet"
+            : paywalled
+              ? "Publishing to your live store is part of the paid plan"
+              : currentPlan.alreadyShipped
+                ? "This reviewed build is already live"
+                : "Publish the exact reviewed digest to your live store";
+      }
+      if (publishDetail) {
+        if (currentPlan && currentPlan.alreadyShipped) {
+          publishDetail.textContent =
+            "This reviewed build (" + shortSha(currentPlan.pinnedSha) + ") is already live. ";
+          const view = document.createElement("a");
+          view.href = ds.liveHref || "/";
+          view.target = "_blank";
+          view.rel = "noopener";
+          view.textContent = "View your live store →";
+          publishDetail.append(view);
+        } else if (currentPlan) {
+          publishDetail.textContent =
+            "Publishes the exact reviewed digest " + shortSha(currentPlan.artifactDigest.replace(/^sha256:/, "")) +
+            " (build " + shortSha(currentPlan.pinnedSha) + ") — no rebuild.";
+        } else {
+          publishDetail.textContent =
+            "Publishes the exact reviewed digest — no rebuild. Available once the aggregate is green and its integration run passed.";
+        }
+      }
+
+      // u14 — orient the owner between the staged aggregate (above) and the live
+      // versions list (below): how many staged changes are still unpublished and
+      // what Publish does to the versions timeline. Owned here (its OWN element) so
+      // this render never races renderVersions' own poll.
+      const versionsOrientation = root.querySelector("[data-versions-orientation]");
+      if (versionsOrientation) {
+        if (aheadCount && !matchesLive) {
+          versionsOrientation.textContent =
+            aheadCount + " staged change" + (aheadCount === 1 ? " is" : "s are") +
+            " not yet published — Publish live creates the next version here, and the current version becomes your rollback target.";
+          versionsOrientation.hidden = false;
+        } else {
+          versionsOrientation.hidden = true;
+        }
+      }
+    };
+
+    // Openable "Included changes" — each accepted PR as a line item with its
+    // human title, a one-line description of what it does, and meta (sha / files /
+    // who + when). title/description/fileCount are OPTIONAL server enrichment: a
+    // row degrades to just "PR #N · <sha>" when they're absent, and the <details>
+    // still lists every included change. The <details> element itself is static
+    // (in the markup) so its open/closed state survives a poll re-render.
+    const renderIncludedChanges = (planBox?: any, prs?: any) => {
+      const wrap = planBox.querySelector("[data-aggregate-plan-included]");
+      if (!wrap) return;
+      if (!prs.length) {
+        wrap.hidden = true;
+        return;
+      }
+      wrap.hidden = false;
+      const countEl = wrap.querySelector("[data-aggregate-plan-included-count]");
+      const hintEl = wrap.querySelector("[data-aggregate-plan-included-hint]");
+      const listEl = wrap.querySelector("[data-aggregate-plan-included-list]");
+      if (countEl) countEl.textContent = String(prs.length);
+      if (hintEl) {
+        hintEl.textContent = prs
+          .map((pr: any) => (pr.prNumber != null ? "PR #" + pr.prNumber : pr.changeId))
+          .filter(Boolean)
+          .join(", ");
+      }
+      if (!listEl) return;
+      listEl.textContent = "";
+      for (const pr of prs) {
+        const li = document.createElement("li");
+        li.className = "agg-included-item";
+
+        const top = document.createElement("div");
+        top.className = "agg-included-top";
+        const prEl = document.createElement("span");
+        prEl.className = "agg-included-pr";
+        prEl.textContent = pr.prNumber != null ? "PR #" + pr.prNumber : pr.changeId;
+        top.append(prEl);
+        if (pr.title) {
+          const t = document.createElement("span");
+          t.className = "agg-included-title";
+          t.textContent = pr.title;
+          top.append(t);
+        }
+        li.append(top);
+
+        const description = pr.description || pr.summary;
+        if (description) {
+          const desc = document.createElement("p");
+          desc.className = "agg-included-desc";
+          desc.textContent = description;
+          li.append(desc);
+        }
+
+        const meta = document.createElement("div");
+        meta.className = "agg-included-meta";
+        const sha = document.createElement("span");
+        sha.className = "publish-mono sha-token";
+        sha.textContent = shortSha(pr.headSha);
+        meta.append(sha);
+        const fileCount = pr.fileCount != null ? pr.fileCount : pr.filesChanged;
+        if (fileCount != null) {
+          const f = document.createElement("span");
+          f.textContent = fileCount + (fileCount === 1 ? " file" : " files");
+          meta.append(f);
+        }
+        // Lines added/removed (green/red) — one meta item so the "·" separator sits
+        // before the pair, not between +N and −M.
+        if (typeof pr.linesAdded === "number" || typeof pr.linesRemoved === "number") {
+          meta.append(linesNode(pr.linesAdded, pr.linesRemoved));
+        }
+        const bits = [];
+        if (pr.integratedAt) bits.push("integrated " + age(pr.integratedAt));
+        if (pr.integratedBy && pr.integratedBy.email) bits.push("by " + pr.integratedBy.email);
+        if (bits.length) {
+          const when = document.createElement("span");
+          when.textContent = bits.join(" ");
+          meta.append(when);
+        }
+        li.append(meta);
+
+        // A trivial change carries its own bounded diff — offer it in a "View diff"
+        // disclosure (for a tiny change the diff IS the summary). Lines are colored
+        // by their leading +/- marker.
+        if (Array.isArray(pr.diff) && pr.diff.length) {
+          const details = document.createElement("details");
+          details.className = "agg-diff";
+          const summaryEl = document.createElement("summary");
+          summaryEl.textContent = "View diff";
+          details.append(summaryEl);
+          for (const file of pr.diff) {
+            const fileEl = document.createElement("div");
+            fileEl.className = "agg-diff-file";
+            const path = document.createElement("div");
+            path.className = "agg-diff-path publish-mono";
+            path.textContent = file.path;
+            fileEl.append(path);
+            if (file.patch) {
+              const pre = document.createElement("pre");
+              pre.className = "agg-diff-patch publish-mono";
+              for (const line of String(file.patch).split("\n")) {
+                const ln = document.createElement("span");
+                ln.className =
+                  line.startsWith("+") && !line.startsWith("+++") ? "agg-diff-add"
+                    : line.startsWith("-") && !line.startsWith("---") ? "agg-diff-del"
+                      : line.startsWith("@@") ? "agg-diff-hunk" : "";
+                ln.textContent = line + "\n";
+                pre.append(ln);
+              }
+              fileEl.append(pre);
+            } else {
+              const binary = document.createElement("div");
+              binary.className = "subtle";
+              binary.textContent = "(no line-level diff available)";
+              fileEl.append(binary);
+            }
+            details.append(fileEl);
+          }
+          li.append(details);
+        }
+
+        listEl.append(li);
+      }
+    };
+
+    const renderPlan = (plan?: any) => {
+      const planBox = aggPanel && aggPanel.querySelector("[data-aggregate-plan]");
+      if (!planBox) return;
+      const includedWrap = planBox.querySelector("[data-aggregate-plan-included]");
+      const chipEl = planBox.querySelector("[data-aggregate-plan-chip]");
+      const grid = planBox.querySelector("[data-aggregate-plan-grid]");
+      const note = planBox.querySelector("[data-aggregate-plan-note]");
+      if (grid) grid.textContent = "";
+
+      // No plan at all (degenerate: no store bound) — hide the box.
+      if (!plan) {
+        planBox.hidden = true;
+        if (includedWrap) includedWrap.hidden = true;
+        return;
+      }
+      planBox.hidden = false;
+
+      if (!plan.ok) {
+        // An honest refusal — show WHY it isn't shippable, never a fake plan.
+        if (chipEl) {
+          chipEl.textContent = "Not shippable";
+          chipEl.className = "chip amber";
+        }
+        if (note) note.textContent = plan.message || ("Not shippable (" + (plan.reason || "refused") + ").");
+        if (includedWrap) includedWrap.hidden = true;
+        return;
+      }
+
+      const paywalled = plan.paywall && !plan.paywall.allowed;
+      if (chipEl) {
+        chipEl.textContent = plan.alreadyShipped ? "Already live" : paywalled ? "Upgrade required" : "Ready to publish";
+        chipEl.className = "chip " + (plan.alreadyShipped ? "green" : paywalled ? "amber" : "green");
+      }
+
+      const row = (term?: any, value?: any, mono?: any) => {
+        const dt = document.createElement("dt");
+        dt.textContent = term;
+        const dd = document.createElement("dd");
+        if (value instanceof Node) dd.append(value);
+        else {
+          dd.textContent = value;
+          if (mono) dd.className = "publish-mono";
+        }
+        grid.append(dt, dd);
+      };
+
+      row("Reviewed build", shortSha(plan.pinnedSha), true);
+      row("Reviewed digest", shortSha(plan.artifactDigest.replace(/^sha256:/, "")), true);
+      const runCell = document.createElement("span");
+      runCell.append(document.createTextNode(plan.integrationRunId));
+      const planRunLink = runLink(plan.pinnedRevHref, "Open build");
+      if (planRunLink) {
+        runCell.append(document.createTextNode(" · "));
+        runCell.append(planRunLink);
+      }
+      row("Integration run", runCell);
+      if (plan.rollbackTarget) {
+        row("Rollback to", shortSha(plan.rollbackTarget.aggregateSha), true);
+      } else {
+        row("Rollback to", "None (first publish)");
+      }
+      row("Subscription", plan.paywall && plan.paywall.allowed ? "Enabled" : "Not enabled");
+
+      // The openable per-PR line items (replaces the bare "Included changes: N" row).
+      renderIncludedChanges(planBox, plan.includedPrs || []);
+
+      if (note) {
+        note.textContent = paywalled
+          ? (plan.paywall.message || "Publishing to your live store requires the paid plan.")
+          : plan.alreadyShipped
+            ? "This reviewed build is already live — nothing to publish."
+            : "Publish sends the exact reviewed digest above to your live store. No rebuild.";
+      }
+    };
+
+    // The exact-digest Publish (b10 ship = b09 orchestrator.ship). Confirms the
+    // pinned plan, then POSTs { confirmGoLive, expectedAggregateSha,
+    // expectedArtifactDigest } — the reviewed-digest guard: a stale plan (queue
+    // moved / artifact changed) is refused by the server, never shipped blind.
+    // ── Publish-live ceremony (shipoff) ──────────────────────────────────────
+    // The go-live counterpart of the accept liftoff below (shares its shell,
+    // styles, planRow + celebrate helpers — referenced at runtime, defined a few
+    // sections down). One honest in-flight state: ship is a single POST that
+    // promotes the pinned digest, so no staged theater — just plan → publishing →
+    // outcome with a real "View your live store" link.
+    const shipoff = root.querySelector("[data-shipoff]");
+    const shipoffCard = shipoff && shipoff.querySelector(".liftoff-card");
+    const shipoffEls: any = shipoff
+      ? {
+          plan: shipoff.querySelector("[data-shipoff-plan]"),
+          flight: shipoff.querySelector("[data-shipoff-flight]"),
+          outcome: shipoff.querySelector("[data-shipoff-outcome]"),
+          grid: shipoff.querySelector("[data-shipoff-grid]"),
+          proceed: shipoff.querySelector("[data-shipoff-proceed]"),
+          cancel: shipoff.querySelector("[data-shipoff-cancel]"),
+          live: shipoff.querySelector("[data-shipoff-live]"),
+          elapsed: shipoff.querySelector("[data-shipoff-elapsed]"),
+          seal: shipoff.querySelector("[data-shipoff-seal]"),
+          outcomeTitle: shipoff.querySelector("[data-shipoff-outcome-title]"),
+          outcomeDetail: shipoff.querySelector("[data-shipoff-outcome-detail]"),
+          view: shipoff.querySelector("[data-shipoff-view]"),
+          done: shipoff.querySelector("[data-shipoff-done]"),
+          confetti: shipoff.querySelector("[data-shipoff-confetti]"),
+        }
+      : null;
+    let shipoffTimer: any = null;
+    const closeShipoff = () => {
+      if (shipoffTimer) { clearInterval(shipoffTimer); shipoffTimer = null; }
+      if (shipoff) shipoff.hidden = true;
+      if (shipoffEls) shipoffEls.confetti.textContent = "";
+    };
+    const showShipoffPhase = (phase?: any) => {
+      if (!shipoffEls) return;
+      shipoffEls.plan.hidden = phase !== "plan";
+      shipoffEls.flight.hidden = phase !== "flight";
+      shipoffEls.outcome.hidden = phase !== "outcome";
+      if (shipoffCard) shipoffCard.dataset.mode = phase;
+    };
+
+    const buildPublishPlanText = (plan?: any) => {
+      const lines = ["Publish plan (exact reviewed digest — no rebuild):"];
+      lines.push("  tenant:   " + (appDomain || repo));
+      lines.push("  build:    " + shortSha(plan.pinnedSha));
+      lines.push("  digest:   " + plan.artifactDigest);
+      lines.push("  changes:  " + (plan.includedPrs || []).length + " included");
+      if (plan.rollbackTarget) lines.push("  rollback: " + shortSha(plan.rollbackTarget.aggregateSha));
+      lines.push("  effect:   publish this exact digest to your LIVE store.");
+      return lines.join("\n");
+    };
+
+    const shortDigest = (digest?: any) => {
+      const d = String(digest || "").replace(/^sha256:/, "");
+      return d ? "sha256:" + d.slice(0, 12) + "…" : "—";
+    };
+
+    const publishAggregate = (button?: any) => {
+      if (!currentPlan) return;
+      const plan = currentPlan;
+      if (!shipoff || !shipoffEls) {
+        // No-markup fallback only — the ceremony IS the confirm now.
+        if (!window.confirm(buildPublishPlanText(plan) + "\n\nPublish live?")) return;
+        runShip(plan, button);
+        return;
+      }
+      shipoffEls.grid.textContent = "";
+      shipoffEls.grid.append(
+        ...planRow("Store", appDomain || repo),
+        ...planRow("Build", shortSha(plan.pinnedSha), true),
+        ...planRow("Digest", shortDigest(plan.artifactDigest), true),
+        ...planRow("Changes", (plan.includedPrs || []).length + " included"),
+        ...(plan.rollbackTarget
+          ? planRow("Rollback to", shortSha(plan.rollbackTarget.aggregateSha), true)
+          : []),
+      );
+      showShipoffPhase("plan");
+      shipoff.hidden = false;
+      shipoffEls.proceed.focus();
+      shipoffEls.cancel.onclick = () => closeShipoff();
+      shipoffEls.done.onclick = () => closeShipoff();
+      shipoffEls.proceed.onclick = () => runShip(plan, button);
+    };
+
+    const runShip = async (plan?: any, button?: any) => {
+      if (button) button.disabled = true;
+      aggregatePublishing = true; // rux7: hold the button disabled across polls
+      setStatus(aggStatusEl, "Publishing the reviewed build (" + shortSha(plan.pinnedSha) + ") live…");
+      const startedAt = Date.now();
+      if (shipoffEls) {
+        showShipoffPhase("flight");
+        shipoffTimer = setInterval(() => {
+          const s = Math.floor((Date.now() - startedAt) / 1000);
+          shipoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
+        }, 1000);
+      }
+      const outcome = (state?: any, title?: any, detail?: any, showView?: any) => {
+        if (!shipoffEls) return;
+        if (shipoffTimer) { clearInterval(shipoffTimer); shipoffTimer = null; }
+        shipoffEls.seal.dataset.state = state;
+        shipoffEls.outcomeTitle.textContent = title;
+        shipoffEls.outcomeDetail.textContent = detail;
+        shipoffEls.view.hidden = !showView;
+        if (showView) shipoffEls.view.href = ds.liveHref || "/";
+        showShipoffPhase("outcome");
+        shipoffEls.done.focus();
+        if (state === "ok") celebrate(shipoffEls.confetti);
+      };
+      try {
+        const res = await fetch(ds.shipEndpoint, {
+          method: "POST",
+          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
+          body: JSON.stringify({
+            aggregateId: plan.aggregateId,
+            // The HUMAN go-live gate + the reviewed-digest guards (b09 ship input).
+            confirmGoLive: true,
+            expectedAggregateSha: plan.pinnedSha,
+            expectedArtifactDigest: plan.artifactDigest,
+          }),
+        });
+        const data = await res.json().catch(() => ({}));
+        // b09 AggregateShipResult: the ONLY live claim is state === "shipped".
+        if (data.state === "shipped") {
+          setStatus(
+            aggStatusEl,
+            "Published live · build " + shortSha(data.pinnedSha) + " (receipt " + (data.receiptId || "—") + ").",
+            "ok",
+          );
+          outcome(
+            "ok",
+            "Your store is live",
+            "Build " + shortSha(data.pinnedSha) + " — the exact digest you reviewed — is now serving" +
+              (data.receiptId ? " (receipt " + data.receiptId + ")." : "."),
+            true,
+          );
+        } else {
+          let message;
+          if (data.state === "promote_failed" || data.state === "record_failed") {
+            // Honest partial-failure truth — recoverable, never a false "shipped".
+            message = data.message || "Publish did not complete (" + data.state + "). Retry.";
+          } else if (data.reason === "paywall") {
+            message = data.message || "Publishing to your live store is part of the paid plan.";
+          } else {
+            message = data.message || data.error || "Publish refused (" + (data.reason || res.status) + ")";
+          }
+          setStatus(aggStatusEl, message, "err");
+          outcome("err", "Publish did not complete", message + " Your live store is unchanged.", false);
+        }
+      } catch {
+        setStatus(aggStatusEl, "Publish failed — network error", "err");
+        outcome(
+          "err",
+          "Publish did not complete",
+          "Network error mid-publish — refresh to see the honest state; your live store serves the last published version.",
+          false,
+        );
+      } finally {
+        aggregatePublishing = false;
+        if (button) button.disabled = false;
+        loadQueue();
+        loadVersions({ force: true }); // a publish changed the versions list
+      }
+    };
+
+    const aggStatusEl = aggPanel && aggPanel.querySelector("[data-aggregate-status]");
+    aggPanel
+      ?.querySelector("[data-aggregate-publish]")
+      ?.addEventListener("click", (event: any) => publishAggregate(event.currentTarget));
+    aggPanel
+      ?.querySelector("[data-aggregate-retry-build]")
+      ?.addEventListener("click", (event: any) => retryBuild(event.currentTarget));
+
+    // ── Accept-to-preview LIFTOFF ─────────────────────────────────────────────
+    // The plan confirm + live integration flight + outcome ceremony (replaces
+    // the old window.confirm plan popup). Same b11 contract as before: accept =
+    // `POST /api/changes/integrate` (b08) → integrate into the protected
+    // `preview` aggregate, rebuild + combined-evidence it (b05). Flips NO live
+    // channel — going live is the aggregate card's Publish.
+    //
+    // HONESTY RULE for the stage rail: a stage only advances on a REAL signal —
+    // the outcome POST resolving, or GET /api/changes polling showing the
+    // candidate inside `aggregate.includedPrs` (merge landed) / an `activeRun`
+    // (build+evidence running, statusMessage relayed verbatim). No timers ever
+    // fake progress.
+    const liftoff = root.querySelector("[data-liftoff]");
+    const liftoffCard = liftoff && liftoff.querySelector(".liftoff-card");
+    const liftoffEls: any = liftoff
+      ? {
+          plan: liftoff.querySelector("[data-liftoff-plan]"),
+          flight: liftoff.querySelector("[data-liftoff-flight]"),
+          outcome: liftoff.querySelector("[data-liftoff-outcome]"),
+          title: liftoff.querySelector("[data-liftoff-title]"),
+          grid: liftoff.querySelector("[data-liftoff-grid]"),
+          proceed: liftoff.querySelector("[data-liftoff-proceed]"),
+          cancel: liftoff.querySelector("[data-liftoff-cancel]"),
+          flightTitle: liftoff.querySelector("[data-liftoff-flight-title]"),
+          live: liftoff.querySelector("[data-liftoff-live]"),
+          elapsed: liftoff.querySelector("[data-liftoff-elapsed]"),
+          hide: liftoff.querySelector("[data-liftoff-hide]"),
+          seal: liftoff.querySelector("[data-liftoff-seal]"),
+          outcomeTitle: liftoff.querySelector("[data-liftoff-outcome-title]"),
+          outcomeDetail: liftoff.querySelector("[data-liftoff-outcome-detail]"),
+          review: liftoff.querySelector("[data-liftoff-review]"),
+          done: liftoff.querySelector("[data-liftoff-done]"),
+          confetti: liftoff.querySelector("[data-liftoff-confetti]"),
+          conflict: liftoff.querySelector("[data-liftoff-conflict]"),
+          conflictCommands: liftoff.querySelector("[data-conflict-commands]"),
+          conflictCopy: liftoff.querySelector("[data-conflict-copy]"),
+          conflictCopyPrompt: liftoff.querySelector("[data-conflict-copy-prompt]"),
+          conflictRaw: liftoff.querySelector("[data-conflict-raw]"),
+          // u4 — the automate-first recovery surface layered over the expert fallback.
+          conflictSummary: liftoff.querySelector("[data-conflict-summary]"),
+          conflictAuto: liftoff.querySelector("[data-conflict-auto]"),
+          conflictPrimaryStatus: liftoff.querySelector("[data-conflict-primary-status]"),
+          conflictCards: liftoff.querySelector("[data-conflict-cards]"),
+          conflictFiles: liftoff.querySelector("[data-conflict-files]"),
+          conflictCardsStatus: liftoff.querySelector("[data-conflict-cards-status]"),
+          conflictCardButtons: liftoff.querySelectorAll("[data-conflict-card]"),
+          conflictExpert: liftoff.querySelector("[data-conflict-expert]"),
+        }
+      : null;
+
+    // The terminal recovery for a merge-refused candidate: verify the checkout
+    // actually backs THIS change (`tot pr` marks the current checkout's candidate
+    // "(active)" — rebasing the wrong clone/branch is the classic footgun), then
+    // rebase onto the moved preview and re-submit. The open PR updates in place
+    // on re-push. DELIBERATELY comment-free: a live paste-through showed zsh
+    // (no interactivecomments) chokes on `#` lines — every word of guidance
+    // lives in the prose above the block, the block is pure paste-safe commands.
+    const conflictCommandsFor = () => ["tot pr", "git fetch origin", "git rebase origin/preview", "tot preview"].join("\n");
+
+    // The same recovery shaped as a PROMPT for the operator's coding agent
+    // (Claude Code, etc.) — the multi-step, judgment-required version. Every
+    // step below earned its place in a live 2026-08-20 recovery run:
+    // the git-status preflight (an ABANDONED half-rebase with committed
+    // conflict markers was lurking and poisoned the first attempt), the
+    // two-stage auth self-heal (tot login fixes the session, NOT the token
+    // baked into the remote URL — u10 credential-helper removes this), the
+    // conflict-intent framing, and the never-`--new` rule.
+    const conflictPromptFor = (change?: any, rawMessage?: any) => {
+      const tenant = appDomain || repo;
+      const pr = change && change.prNumber != null ? "PR #" + change.prNumber : "my open candidate PR";
+      return [
+        "In my " + tenant + " store checkout on this machine, " + pr + " could not be integrated: " +
+          "the shared `preview` branch changed after my change branched, and the two now conflict. " +
+          "Bring my change up to date and re-submit it.",
+        "",
+        "1. Run `git status` first. If a rebase/merge is already in progress (a previous recovery attempt may have been abandoned), inspect it, then `git rebase --abort` to start clean — and check the tracked files for committed `<<<<<<<` conflict markers while you're there.",
+        "2. Run `tot pr` and confirm " + pr + " is listed and marked (active) for this checkout — if it isn't, stop and tell me before touching anything.",
+        "3. Run `git fetch origin`, then `git rebase origin/preview`. On an authentication failure: `tot login`, retry; if fetch STILL fails, the token embedded in the remote URL has rotated — replace the remote with a freshly minted one: `git remote set-url origin \"$(tot clone " + tenant + " --remote-only --print-remote)\"` (this matches how the checkout was originally configured; ask me first if you're unsure).",
+        "4. Resolve any conflicts git flags, preserving the intent of my change on the lines it edited; keep preview's version everywhere else. Show me the resolution if the same lines were edited on both sides. Never commit a file still containing conflict markers; finish with `git rebase --continue` — a half-done rebase must never be left behind.",
+        "5. Re-submit with `tot preview` (plain — never `--new`, which would fork a separate PR). " + pr + " updates in place.",
+        "6. Confirm the push succeeded and the submit output reports the preview building. Then end by reminding me how to FINISH the merge once the build is ready: back in the store admin's Publish tab (" + adminPublishUrl() + "), " + pr + " → Integrate into preview" +
+          (change && change.prNumber != null
+            ? " — or from this terminal: `tot accept --tenant " + tenant + " --pr " + change.prNumber + "`."
+            : "."),
+        rawMessage ? "\nThe system's refusal, for reference: " + rawMessage : "",
+      ].join("\n");
+    };
+
+    // The Publish tab's own URL — where the operator copying this prompt is
+    // standing right now — so the agent's closing hand-back can name it exactly.
+    const adminPublishUrl = () => window.location.origin + window.location.pathname + "#publish";
+
+    // ── u4: automate-first conflict recovery ──────────────────────────────────
+    // The per-change resolve route (u3): POST /api/changes/<changeId>/resolve.
+    // Derived off changesEndpoint so it inherits the tenant surface's basePath.
+    const resolveEndpointFor = (changeId?: any) =>
+      ds.changesEndpoint + "/" + encodeURIComponent(changeId) + "/resolve";
+
+
+    // Reveal the three option cards, naming the exact files diff3 could not
+    // auto-combine (never a bare list with no next step).
+    const revealConflictCards = (unresolved?: any) => {
+      if (!liftoffEls.conflictCards) return;
+      liftoffEls.conflictCards.hidden = false;
+      if (liftoffEls.conflictFiles) {
+        liftoffEls.conflictFiles.textContent = "";
+        (unresolved || []).forEach((f: any) => {
+          const li = document.createElement("li");
+          li.textContent = f;
+          liftoffEls.conflictFiles.append(li);
+        });
+        liftoffEls.conflictFiles.hidden = (unresolved || []).length === 0;
+      }
+    };
+
+    // Open the collapsed expert/terminal fallback and bring it into view — the
+    // honest destination for a same-line overlap only a human/agent can combine,
+    // and the graceful landing when automation isn't deployed (501).
+    const revealExpertFallback = () => {
+      if (liftoffEls.conflictExpert) {
+        liftoffEls.conflictExpert.open = true;
+        liftoffEls.conflictExpert.scrollIntoView({ block: "nearest" });
+      }
+    };
+
+    const setConflictStatus = (el?: any, message?: any, state?: any) => {
+      if (!el) return;
+      el.hidden = !message;
+      el.textContent = message || "";
+      if (state) el.dataset.state = state;
+      else delete el.dataset.state;
+    };
+
+    // POST /resolve with `strategy`, then act on the classified outcome. From the
+    // primary action `source` is "primary" (a clean rebuild reveals cards on the
+    // rare overlap); from a card it's "card" (a merge card that re-hits the overlap
+    // escalates to the expert fallback rather than looping). A clean rebuild ALWAYS
+    // auto-re-integrates exactly once via the existing runIntegration flow.
+    const resolveThenReintegrate = async (change?: any, strategy?: any, button?: any, source?: any) => {
+      const statusEl2 = source === "card" ? liftoffEls.conflictCardsStatus : liftoffEls.conflictPrimaryStatus;
+      const controls = [liftoffEls.conflictAuto, ...Array.from(liftoffEls.conflictCardButtons || [])].filter(Boolean);
+      controls.forEach((b) => { b.disabled = true; });
+      setConflictStatus(statusEl2, "Updating your change…");
+      try {
+        const res = await fetch(resolveEndpointFor(change.changeId), {
+          method: "POST",
+          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
+          body: JSON.stringify({ repo, strategy }),
+        });
+        const body = await res.json().catch(() => ({}));
+        const action = classifyResolveResponse(change, res.status, body);
+        if (action.kind === "reintegrate") {
+          setConflictStatus(statusEl2, "");
+          // Auto-re-integrate ONCE with the refreshed change (new PR/head).
+          runIntegration(action.change, button);
+        } else if (action.kind === "cards") {
+          if (source === "card") {
+            // A merge card that STILL overlaps — no safe auto-combine exists; hand
+            // the specific files to the expert/terminal path.
+            setConflictStatus(
+              statusEl2,
+              "These files need a hand-merge — see “Do it manually instead” below.",
+              "err",
+            );
+            revealConflictCards(action.unresolved);
+            revealExpertFallback();
+          } else {
+            setConflictStatus(statusEl2, "");
+            revealConflictCards(action.unresolved);
+          }
+        } else if (action.kind === "unavailable") {
+          setConflictStatus(
+            statusEl2,
+            "Automatic update isn't available on this store yet — use the manual steps below.",
+            "err",
+          );
+          revealExpertFallback();
+        } else {
+          setConflictStatus(statusEl2, action.message, "err");
+          revealExpertFallback();
+        }
+      } catch {
+        setConflictStatus(statusEl2, "Couldn't reach the server — try the manual steps below.", "err");
+        revealExpertFallback();
+      } finally {
+        controls.forEach((b) => { b.disabled = false; });
+      }
+    };
+
+    // Show/clear the merge-conflict guidance inside the outcome phase. Every
+    // outcome path calls this — visible ONLY for the merge_failed refusal, so a
+    // conflict block from a previous run can never leak into an unrelated outcome.
+    const setConflictGuidance = (visible?: any, rawMessage?: any, change?: any) => {
+      if (!liftoffEls || !liftoffEls.conflict) return;
+      liftoffEls.conflict.hidden = !visible;
+      if (!visible) return;
+      liftoffEls.conflictCommands.textContent = conflictCommandsFor();
+      // The AI prompt is rebuilt per outcome (change + raw message vary) and
+      // stashed on the element; the one-time click handler reads the stash.
+      liftoffEls.conflict.dataset.prompt = conflictPromptFor(change, rawMessage || "");
+      // The forge's own words, kept small for support/diagnosis — the headline
+      // above already says what happened in product language.
+      liftoffEls.conflictRaw.textContent = rawMessage || "";
+      const wireCopy = (btn?: any, label?: any, getText?: any) => {
+        if (!btn || btn.dataset.wired) return;
+        btn.dataset.wired = "1";
+        btn.addEventListener("click", () => {
+          navigator.clipboard.writeText(getText()).then(
+            () => {
+              btn.textContent = "Copied";
+              setTimeout(() => { btn.textContent = label; }, 1600);
+            },
+            () => { /* clipboard denied — the commands are selectable text */ },
+          );
+        });
+      };
+      wireCopy(liftoffEls.conflictCopy, "Copy commands", () => liftoffEls.conflictCommands.textContent);
+      wireCopy(liftoffEls.conflictCopyPrompt, "Copy prompt for your AI agent", () => liftoffEls.conflict.dataset.prompt || "");
+
+      // u4 — reset the automate-first surface for THIS outcome so a prior run's
+      // cards/status/expanded-expert never leak in, then bind the primary action +
+      // option cards to the current change (`.onclick` overwrites, never stacks).
+      if (liftoffEls.conflictCards) liftoffEls.conflictCards.hidden = true;
+      if (liftoffEls.conflictFiles) liftoffEls.conflictFiles.textContent = "";
+      if (liftoffEls.conflictExpert) liftoffEls.conflictExpert.open = false;
+      setConflictStatus(liftoffEls.conflictPrimaryStatus, "");
+      setConflictStatus(liftoffEls.conflictCardsStatus, "");
+      if (liftoffEls.conflictSummary) {
+        // The only structured collision data that survives to the client is the
+        // forge's refusal text (integrate flattens u2's {files,competing} to a
+        // string) + the diff3 `unresolved` list on the resolve response. Name the
+        // competing PR when the refusal mentions one; else stay generic.
+        const prRef = /pr[ #]*([0-9]+)/i.exec(rawMessage || "");
+        liftoffEls.conflictSummary.textContent = prRef
+          ? "Another change (PR #" + prRef[1] + ") reached the store first and touched the same content."
+          : "";
+        liftoffEls.conflictSummary.hidden = !prRef;
+      }
+      if (liftoffEls.conflictAuto) {
+        liftoffEls.conflictAuto.onclick = () =>
+          resolveThenReintegrate(change, "merge", liftoffEls.conflictAuto, "primary");
+      }
+      (liftoffEls.conflictCardButtons || []).forEach((card: any) => {
+        card.onclick = () =>
+          resolveThenReintegrate(change, card.dataset.strategy, card, "card");
+      });
+    };
+
+    // A settled conflict is visible in the queue before an integration POST.
+    // Open the same recovery surface normally shown after `merge_failed`, without
+    // claiming that an integration was attempted or changing the aggregate.
+    const openConflictRecovery = (change?: any, button?: any) => {
+      if (!liftoff || !liftoffEls) {
+        setStatus(
+          statusEl,
+          "This change needs updating against the latest preview before it can integrate.",
+          "err",
+        );
+        return;
+      }
+      liftoffOpenedFrom = button || null;
+      const target = change.prNumber != null ? "PR #" + change.prNumber : "This change";
+      liftoffEls.seal.dataset.state = "err";
+      liftoffEls.outcomeTitle.textContent = "Preview changed while you worked";
+      liftoffEls.outcomeDetail.textContent =
+        target + " passed its checks, but preview changed after it was created and the two now " +
+        "conflict. Nothing was integrated — update this change automatically, then review the result.";
+      liftoffEls.review.hidden = true;
+      setConflictGuidance(true, "", change);
+      showPhase("outcome");
+      liftoff.hidden = false;
+      if (liftoffEls.conflictAuto) liftoffEls.conflictAuto.focus();
+    };
+
+    const liftoffStage = (name?: any) =>
+      liftoff && liftoff.querySelector('[data-liftoff-stage="' + name + '"]');
+    const LIFTOFF_STAGES = ["merge", "build", "evidence", "green"];
+    const setStage = (name?: any, state?: any) => {
+      const el = liftoffStage(name);
+      if (el) el.dataset.state = state; // pending | active | done | fail
+    };
+    // Advance the rail so everything before `name` is done and `name` is active.
+    const railTo = (name?: any) => {
+      const idx = LIFTOFF_STAGES.indexOf(name);
+      LIFTOFF_STAGES.forEach((s, i) => {
+        const el = liftoffStage(s);
+        const cur = el && el.dataset.state;
+        if (cur === "fail") return; // never un-fail
+        setStage(s, i < idx ? "done" : i === idx ? "active" : "pending");
+      });
+    };
+
+    let liftoffTimer: any = null;
+    let liftoffPoll: any = null;
+    let liftoffOpenedFrom: any = null;
+    const stopLiftoffLoops = () => {
+      if (liftoffTimer) { clearInterval(liftoffTimer); liftoffTimer = null; }
+      if (liftoffPoll) { clearInterval(liftoffPoll); liftoffPoll = null; }
+    };
+    const closeLiftoff = () => {
+      stopLiftoffLoops();
+      if (liftoff) liftoff.hidden = true;
+      if (liftoffEls) liftoffEls.confetti.textContent = "";
+      if (liftoffOpenedFrom && document.contains(liftoffOpenedFrom)) liftoffOpenedFrom.focus();
+      liftoffOpenedFrom = null;
+    };
+    const showPhase = (phase?: any) => {
+      if (!liftoffEls) return;
+      liftoffEls.plan.hidden = phase !== "plan";
+      liftoffEls.flight.hidden = phase !== "flight";
+      liftoffEls.outcome.hidden = phase !== "outcome";
+      if (liftoffCard) liftoffCard.dataset.mode = phase;
+    };
+
+    const planRow = (dt?: any, dd?: any, mono?: any) => {
+      const t = document.createElement("dt");
+      t.textContent = dt;
+      const d = document.createElement("dd");
+      d.textContent = dd;
+      if (mono) d.className = "publish-mono";
+      return [t, d];
+    };
+
+    const celebrate = (container?: any) => {
+      if (!container) return;
+      if (window.matchMedia && window.matchMedia("(prefers-reduced-motion: reduce)").matches) return;
+      const colors = ["#0f9d8f", "#25b8a8", "#f4b942", "#5b8def", "#e2634f"];
+      for (let i = 0; i < 42; i++) {
+        const p = document.createElement("i");
+        p.style.left = Math.random() * 100 + "%";
+        p.style.background = colors[i % colors.length]!;
+        p.style.animationDelay = Math.random() * 0.35 + "s";
+        p.style.animationDuration = 0.9 + Math.random() * 0.9 + "s";
+        p.style.setProperty("--liftoff-drift", (Math.random() * 160 - 80).toFixed(0) + "px");
+        p.style.setProperty("--liftoff-spin", (Math.random() * 640 - 320).toFixed(0) + "deg");
+        container.append(p);
+      }
+      setTimeout(() => { container.textContent = ""; }, 2400);
+    };
+
+    // The live poll during flight: reflect the server's REAL progress.
+    const startFlightPoll = (change?: any, preFlightSha?: any) => {
+      let inAggregate = false;
+      liftoffPoll = setInterval(async () => {
+        try {
+          const res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
+          if (!res.ok) return;
+          const data = await res.json();
+          const agg = data.aggregate || {};
+          const included = (agg.includedPrs || []).some((p: any) => p.changeId === change.changeId);
+          const shaMoved = agg.aggregateSha && agg.aggregateSha !== preFlightSha;
+          const run = agg.activeRun || null;
+          if (!inAggregate && (included || shaMoved)) {
+            inAggregate = true;
+            railTo("build");
+            if (liftoffEls) liftoffEls.live.textContent =
+              "Merged into preview — rebuilding the combined aggregate…";
+          }
+          if (run) {
+            railTo("evidence");
+            if (liftoffEls) liftoffEls.live.textContent =
+              run.statusMessage || "Combined evidence is running…";
+          }
+        } catch { /* polling is best-effort; the POST outcome is authoritative */ }
+      }, 2500);
+    };
+
+    const openLiftoff = (change?: any, button?: any) => {
+      if (!liftoff || !liftoffEls) return false;
+      liftoffOpenedFrom = button || null;
+      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
+      liftoffEls.title.textContent = "Integrate " + target + " into preview";
+      liftoffEls.grid.textContent = "";
+      liftoffEls.grid.append(
+        ...planRow("Store", appDomain || repo),
+        ...(change.prNumber != null ? planRow("Pull request", "#" + change.prNumber) : []),
+        ...planRow("Change", change.changeId, true),
+        ...(change.headSha ? planRow("Head", shortSha(change.headSha), true) : []),
+      );
+      LIFTOFF_STAGES.forEach((s) => setStage(s, "pending"));
+      liftoffEls.live.textContent = "Working…";
+      liftoffEls.elapsed.textContent = "0:00";
+      showPhase("plan");
+      liftoff.hidden = false;
+      liftoffEls.proceed.focus();
+
+      liftoffEls.cancel.onclick = () => closeLiftoff();
+      liftoffEls.done.onclick = () => closeLiftoff();
+      liftoffEls.hide.onclick = () => { liftoff.hidden = true; }; // flight keeps running
+      liftoffEls.proceed.onclick = () => runIntegration(change, button);
+      return true;
+    };
+
+    // Esc: close in plan/outcome; during flight just hide (the POST keeps going).
+    // Handles BOTH ceremonies (accept liftoff + publish shipoff).
+    document.addEventListener("keydown", (ev) => {
+      if (ev.key !== "Escape") return;
+      if (liftoff && !liftoff.hidden) {
+        const mode = liftoffCard && liftoffCard.dataset.mode;
+        if (mode === "flight") liftoff.hidden = true;
+        else closeLiftoff();
+      }
+      if (shipoff && !shipoff.hidden) {
+        const mode = shipoffCard && shipoffCard.dataset.mode;
+        if (mode === "flight") shipoff.hidden = true;
+        else closeShipoff();
+      }
+    });
+
+    // b08 integrate returns an IntegrateOutcome — { ok, queueState, runState,
+    // aggregateSha, pointerMoved, statusMessage, reason? } — NEVER a bare
+    // merged:true. Render it honestly: green advances the aggregate; red left it
+    // exactly where it was and names the failing stage.
+    const runIntegration = async (change?: any, button?: any) => {
+      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
+      if (button) button.disabled = true;
+      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
+      setStatus(statusEl, "Integrating " + change.changeId + " into preview…");
+      const startedAt = Date.now();
+      let preFlightSha: any = null;
+      if (liftoffEls) {
+        showPhase("flight");
+        liftoffEls.flightTitle.textContent = "Integrating " + target + " into preview";
+        railTo("merge");
+        liftoffEls.live.textContent = "Squash-merging the candidate into preview…";
+        liftoffTimer = setInterval(() => {
+          const s = Math.floor((Date.now() - startedAt) / 1000);
+          liftoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
+        }, 1000);
+      }
+      try {
+        // Snapshot the pre-flight aggregate sha so the poll can detect the merge
+        // landing (sha moved) even before includedPrs reflects it.
+        try {
+          const pre = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
+          if (pre.ok) preFlightSha = ((await pre.json()).aggregate || {}).aggregateSha || null;
+        } catch { /* best-effort */ }
+        startFlightPoll(change, preFlightSha);
+
+        const res = await fetch(ds.integrateEndpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            // Mirror of the server-side capability model (UX): the server
+            // re-derives capability and stays authoritative.
+            "x-tot-capability": "ship-on-behalf",
+          },
+          body: JSON.stringify({
+            repo,
+            changeId: change.changeId,
+            prNumber: change.prNumber ?? undefined,
+            expectedHeadSha: change.headSha || undefined,
+          }),
+        });
+        const data = await res.json().catch(() => ({}));
+        stopLiftoffLoops();
+        if (res.ok && data.ok) {
+          setStatus(
+            statusEl,
+            "Integrated " + change.changeId + " — preview aggregate is green (" +
+              shortSha(data.aggregateSha) + "). Review the aggregate, then Publish to go live.",
+            "ok",
+          );
+          if (liftoffEls) {
+            LIFTOFF_STAGES.forEach((s) => setStage(s, "done"));
+            liftoffEls.seal.dataset.state = "ok";
+            liftoffEls.outcomeTitle.textContent = "The preview aggregate is green";
+            liftoffEls.outcomeDetail.textContent =
+              target + " is in. Aggregate build " + shortSha(data.aggregateSha) +
+              " passed its combined evidence — this exact build is what you review, and what " +
+              "Publish would take live. Nothing is live yet.";
+            if (data.aggregateSha) {
+              liftoffEls.review.href =
+                "/" + encodeURIComponent(appDomain) + "/preview/rev/" + data.aggregateSha + "/";
+              liftoffEls.review.hidden = false;
+            } else {
+              liftoffEls.review.hidden = true;
+            }
+            setConflictGuidance(false);
+            if (liftoff.hidden) liftoff.hidden = false; // surface the payoff even if backgrounded
+            showPhase("outcome");
+            liftoffEls.done.focus();
+            celebrate(liftoffEls.confetti);
+          }
+        } else if (data.reason === "candidate_not_open") {
+          // "No open candidate" = the PR already merged before this attempt —
+          // usually a second click on a just-integrated candidate whose row went
+          // stale (DZ, 2026-08-20). That is a SUCCESS the operator is re-hearing,
+          // not a failure: green seal, happy copy, no fail stage, never conflict
+          // guidance. The queue read now drops merged rows, so the row is gone on
+          // the next refresh; the durable KV closeout is u12.
+          const target = change.prNumber != null ? "PR #" + change.prNumber : "This change";
+          setStatus(statusEl, target + " was already integrated — it's in the preview build.", "ok");
+          if (liftoffEls) {
+            LIFTOFF_STAGES.forEach((s) => setStage(s, "done"));
+            liftoffEls.seal.dataset.state = "ok";
+            liftoffEls.outcomeTitle.textContent = "Already integrated";
+            liftoffEls.outcomeDetail.textContent =
+              target + " landed in the preview build earlier — this attempt found " +
+              "nothing left to do. It will drop off the queue on the next refresh; " +
+              "the integration is recorded in the history below.";
+            setConflictGuidance(false);
+            liftoffEls.review.hidden = true;
+            if (liftoff.hidden) liftoff.hidden = false;
+            showPhase("outcome");
+            liftoffEls.done.focus();
+          }
+        } else {
+          let message;
+          let failStage = "merge";
+          // The merge-refused conflict is a FORK, not a failure of the change:
+          // preview moved after the candidate branched and both edit the same
+          // content. Render it as directions (rebase + re-submit), never as the
+          // raw forge refusal — that dead-ended real operators (2026-08-20).
+          const isMergeConflict = data.reason === "merge_failed";
+          if (res.ok && data.queueState === "red") {
+            // The queue ran but the aggregate did not go green — the candidate did
+            // NOT advance the shippable set. Name the honest failing stage.
+            failStage = "evidence";
+            message =
+              "Integration of " + change.changeId + " failed (" + (data.reason || "red") + "): " +
+              (data.statusMessage || "the aggregate did not pass its combined evidence.") +
+              " The aggregate is unchanged.";
+          } else if (data.reason === "not_preview_base") {
+            message =
+              "Not integrated: " + change.changeId + " does not target the preview branch " +
+              "(base is not \"preview\"). " + (data.statusMessage || "");
+          } else {
+            message = data.statusMessage || data.error || "Integrate failed (" + res.status + ")";
+          }
+          setStatus(statusEl, message, "err");
+          if (liftoffEls) {
+            setStage(failStage, "fail");
+            liftoffEls.seal.dataset.state = "err";
+            if (isMergeConflict) {
+              const target = change.prNumber != null ? "PR #" + change.prNumber : "This change";
+              liftoffEls.outcomeTitle.textContent = "Preview changed while you worked";
+              liftoffEls.outcomeDetail.textContent =
+                target + " edits content that also changed on preview after it was " +
+                "created, so it couldn't merge as-is. Nothing was integrated — preview " +
+                "is exactly as it was. You can update this change automatically below.";
+              setConflictGuidance(true, data.statusMessage || "", change);
+            } else {
+              liftoffEls.outcomeTitle.textContent = "Integration did not land";
+              liftoffEls.outcomeDetail.textContent = message;
+              setConflictGuidance(false);
+            }
+            liftoffEls.review.hidden = true;
+            if (liftoff.hidden) liftoff.hidden = false;
+            showPhase("outcome");
+            liftoffEls.done.focus();
+          }
+        }
+      } catch {
+        stopLiftoffLoops();
+        setStatus(statusEl, "Integrate failed — network error", "err");
+        if (liftoffEls) {
+          liftoffEls.seal.dataset.state = "err";
+          liftoffEls.outcomeTitle.textContent = "Integration did not land";
+          liftoffEls.outcomeDetail.textContent =
+            "Network error mid-flight — refresh the queue to see the aggregate's honest state.";
+          setConflictGuidance(false);
+          liftoffEls.review.hidden = true;
+          if (liftoff.hidden) liftoff.hidden = false;
+          showPhase("outcome");
+        }
+      } finally {
+        busyChanges.delete(change.changeId);
+        if (button) button.disabled = false;
+        loadQueue();
+      }
+    };
+
+    const integrateCandidate = (change?: any, button?: any) => {
+      // The liftoff dialog IS the plan confirm now; window.confirm stays only as
+      // the no-dialog fallback (markup missing = fail open to the old popup).
+      if (openLiftoff(change, button)) return;
+      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
+      const plan =
+        "Accept-to-preview plan:\n  tenant:    " + (appDomain || repo) +
+        (change.prNumber != null ? "\n  PR:        #" + change.prNumber : "") +
+        "\n  change id: " + change.changeId +
+        (change.headSha ? "\n  head sha:  " + shortSha(change.headSha) : "") +
+        "\n  effect:    integrate " + target + " into the preview aggregate, then rebuild + " +
+        "re-evidence it. Does NOT go live — publish the reviewed build separately.";
+      if (!window.confirm(plan + "\n\nProceed?")) return;
+      runIntegration(change, button);
+    };
+
+    const rejectChange = async (change?: any, button?: any) => {
+      const reason = window.prompt(
+        "Reject " + change.changeId + " — add a short note for the submitter:",
+      );
+      if (reason == null) return;
+      if (!reason.trim()) {
+        setStatus(statusEl, "A reject note is required.", "err");
+        return;
+      }
+      button.disabled = true;
+      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
+      setStatus(statusEl, "Rejecting " + change.changeId + "…");
+      try {
+        const res = await fetch(
+          ds.changesEndpoint + "/" + encodeURIComponent(change.changeId) + "/reject",
+          {
+            method: "POST",
+            headers: {
+              "content-type": "application/json",
+              "x-tot-capability": "ship-on-behalf",
+            },
+            body: JSON.stringify({ repo, reason: reason.trim() }),
+          },
+        );
+        const data = await res.json().catch(() => ({}));
+        if (res.ok) {
+          setStatus(statusEl, "Change " + change.changeId + " rejected.", "ok");
+        } else {
+          setStatus(statusEl, data.error || "Reject failed (" + res.status + ")", "err");
+        }
+      } catch {
+        setStatus(statusEl, "Reject failed — network error", "err");
+      } finally {
+        busyChanges.delete(change.changeId);
+        button.disabled = false;
+        loadQueue();
+      }
+    };
+
+    // u14 — per-change REVERT (Undo): roll ONE change OUT of the shared staged
+    // preview. Appends a revert commit + rebuilds the `preview` aggregate; it NEVER
+    // touches the live channel (no paywall, `/api/changes/revert`). The outcome is
+    // rendered HONESTLY per the queue's reason — `already_reverted` / `target_not_found`
+    // are calm informational states (the change is simply already out of staging), not
+    // errors, so they never flash red.
+    const revertStaged = async (pr?: any, button?: any) => {
+      const target = pr.prNumber != null ? "PR #" + pr.prNumber : pr.changeId;
+      const plan =
+        "Undo " + target + " from the staged preview?\n\n" +
+        "  tenant:  " + (appDomain || repo) + "\n" +
+        "  target:  " + target + "\n" +
+        "  effect:  append a revert commit to the staged preview and rebuild — the change\n" +
+        "           comes OUT of staging. Your live site is untouched.\n\n" +
+        "Proceed?";
+      if (!window.confirm(plan)) return;
+      button.disabled = true;
+      setStatus(statusEl, "Reverting " + target + " out of the staged preview…");
+      try {
+        const res = await fetch(ds.changesEndpoint + "/revert", {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            "x-tot-capability": "ship-on-behalf",
+          },
+          body: JSON.stringify({ repo, prNumber: pr.prNumber }),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (res.ok && data.ok) {
+          setStatus(statusEl, "Reverted " + target + " — the staged preview is rebuilding.", "ok");
+        } else if (res.ok && (data.reason === "already_reverted" || data.reason === "target_not_found")) {
+          // Not an error: the change is already out of staging (or was never in it).
+          setStatus(
+            statusEl,
+            data.reason === "already_reverted"
+              ? target + " was already removed from the staged preview."
+              : target + " isn't in the staged preview — nothing to undo.",
+          );
+        } else {
+          setStatus(statusEl, data.error || data.statusMessage || "Undo failed (" + res.status + ")", "err");
+        }
+      } catch {
+        setStatus(statusEl, "Undo failed — network error", "err");
+      } finally {
+        button.disabled = false;
+        loadQueue();
+      }
+    };
+
+    // u15 — retry a DEAD aggregate rebuild, no new merge: the last candidate's
+    // PR already merged into preview, but the build/evidence step that follows
+    // died (e.g. a transient MCP error). `POST /api/changes/rebuild` re-runs
+    // ONLY that step against the sha the forge already carries — never a
+    // second merge attempt, never a membership change.
+    const retryBuild = async (button?: any) => {
+      if (!window.confirm(
+        "Retry the build for " + (appDomain || repo) + "?\n\n" +
+          "  effect:  re-run the build + evidence check against the last merged\n" +
+          "           commit — no new merge, no membership change.\n\n" +
+          "Proceed?",
+      )) return;
+      button.disabled = true;
+      aggregateRetrying = true; // rux7-style: hold disabled across a poll landing mid-retry
+      setStatus(aggStatusEl, "Retrying the build…");
+      try {
+        const res = await fetch(ds.changesEndpoint + "/rebuild", {
+          method: "POST",
+          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
+          body: JSON.stringify({ repo }),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (res.ok && data.ok) {
+          setStatus(aggStatusEl, "Build retry passed — the aggregate is green.", "ok");
+        } else if (res.ok && data.reason === "nothing_to_rebuild") {
+          setStatus(aggStatusEl, "Nothing to rebuild — no prior integration attempt exists yet.");
+        } else if (res.ok) {
+          setStatus(
+            aggStatusEl,
+            "Build retry did not pass" +
+              (data.statusMessage ? ": " + data.statusMessage : " (" + (data.reason || data.queueState) + ")"),
+            "err",
+          );
+        } else {
+          setStatus(aggStatusEl, data.error || "Retry failed (" + res.status + ")", "err");
+        }
+      } catch {
+        setStatus(aggStatusEl, "Retry failed — network error", "err");
+      } finally {
+        aggregateRetrying = false;
+        button.disabled = false;
+        loadQueue();
+      }
+    };
+
+    // U7 — retire/GC. Mirror of the accept plan affordance (decision
+    // operator-verb-and-hosting-model): state EXACTLY what retire does — evict the
+    // candidate's preview environment + immutable version — and that it is
+    // REBUILDABLE (degrades to "not built yet", not a 404), so an operator can't
+    // confuse it with Reject. Same shape as `tot retire`'s CLI plan for parity.
+    const buildRetirePlan = (change?: any) => {
+      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
+      const lines = ["Retire plan:", "  tenant:    " + (appDomain || repo)];
+      if (change.prNumber != null) lines.push("  PR:        #" + change.prNumber);
+      lines.push("  change id: " + change.changeId);
+      if (change.headSha) lines.push("  head sha:  " + shortSha(change.headSha));
+      lines.push(
+        "  effect:    evict " + target + "'s preview environment + version to reclaim space.",
+      );
+      lines.push(
+        "  rebuild:   REVERSIBLE — rebuild it any time (this is NOT Reject; the change stays open).",
+      );
+      return lines.join("\n");
+    };
+
+    const retireChange = async (change?: any, button?: any) => {
+      if (!window.confirm(buildRetirePlan(change) + "\n\nProceed?")) return;
+      button.disabled = true;
+      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
+      setStatus(statusEl, "Retiring " + change.changeId + "…");
+      try {
+        const res = await fetch(ds.retireEndpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            // Mirror of the server-side capability model (UX); the server
+            // re-derives capability and stays authoritative.
+            "x-tot-capability": "ship-on-behalf",
+          },
+          body: JSON.stringify({
+            changeId: change.changeId,
+            pr: change.prNumber ?? undefined,
+          }),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (res.ok && data.ok) {
+          setStatus(
+            statusEl,
+            data.evicted
+              ? "Retired " + change.changeId + " — the preview was evicted (rebuildable on demand)."
+              : "Retire " + change.changeId + ": nothing to evict (already retired).",
+            "ok",
+          );
+        } else {
+          setStatus(statusEl, data.error || "Retire failed (" + res.status + ")", "err");
+        }
+      } catch {
+        setStatus(statusEl, "Retire failed — network error", "err");
+      } finally {
+        busyChanges.delete(change.changeId);
+        button.disabled = false;
+        loadQueue();
+      }
+    };
+
+    // ---- rux5: build-on-demand for a synthetic not-built PR ------------------
+    // Mirror of the integrate/retire plan affordances: state EXACTLY what build
+    // does — materialize this PR's hosted preview at its forge head — and that it
+    // is INERT (flips no live channel). POSTs { pr, headSha?, baseSha? }; the row
+    // already carries the head sha GET /api/changes resolved via forge PR-read, and
+    // the server re-resolves it authoritatively when the body omits it. Shows an
+    // in-progress state (disabled + "Building…") while the build runs, then reloads
+    // the queue so the freshly-built PR reappears as a built candidate.
+
+    const buildPreviewPlan = (change?: any) => {
+      const lines = ["Build preview plan:", "  tenant:   " + (appDomain || repo)];
+      lines.push("  PR:       #" + change.prNumber);
+      if (change.headSha) lines.push("  head sha: " + shortSha(change.headSha));
+      lines.push(
+        "  effect:   materialize this PR's hosted preview at its head — INERT " +
+          "(does NOT go live).",
+      );
+      return lines.join("\n");
+    };
+
+    const buildPreview = async (change?: any, button?: any) => {
+      const label = "PR #" + change.prNumber;
+      if (!window.confirm(buildPreviewPlan(change) + "\n\nBuild the preview now?")) return;
+      button.disabled = true;
+      const originalText = button.textContent;
+      button.textContent = "Building…";
+      button.dataset.building = "true";
+      // rux7: record the in-flight build so a poll re-render preserves the
+      // spinner/disabled state on the freshly-rendered button (cleared in finally).
+      if (change.prNumber != null) inflightBuilds.add(change.prNumber);
+      setStatus(statusEl, "Building preview for " + label + "…");
+      try {
+        const res = await fetch(ds.buildEndpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            // Mirror of the server-side capability model (UX); the server
+            // re-derives capability (buildGate) and stays authoritative.
+            "x-tot-capability": "ship-on-behalf",
+          },
+          body: JSON.stringify({
+            pr: change.prNumber,
+            headSha: change.headSha || undefined,
+            baseSha: change.baseSha || undefined,
+          }),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (res.ok && data.ok) {
+          setStatus(
+            statusEl,
+            "Built preview for " + label +
+              " — it now appears as a built change in the queue.",
+            "ok",
+          );
+        } else if (data && data.ok === false) {
+          // reconcileCandidate returned a blocked/failed candidate (e.g. a safety
+          // finding with no override) — the honest reason, never a false success.
+          setStatus(
+            statusEl,
+            "Build did not complete for " + label + ": " +
+              ((data.errors && data.errors.join("; ")) || data.error || "blocked"),
+            "err",
+          );
+        } else {
+          setStatus(statusEl, data.error || "Build failed (" + res.status + ")", "err");
+        }
+      } catch {
+        setStatus(statusEl, "Build failed — network error", "err");
+      } finally {
+        if (change.prNumber != null) inflightBuilds.delete(change.prNumber);
+        button.disabled = false;
+        button.textContent = originalText;
+        delete button.dataset.building;
+        loadQueue();
+      }
+    };
+
+    // ---- rux6: unified review pane -----------------------------------------
+    // "One review moment": expanding a candidate row reveals a single pane with
+    // the live preview (iframed SAME-ORIGIN — the /<tenant>/preview/pr/<N> route
+    // serves `frame-ancestors 'self'` + `X-Frame-Options: SAMEORIGIN`, so a
+    // same-origin admin embed is permitted; a cross-origin embed is refused,
+    // which is why the pane also always offers an "Open in new tab" link), the
+    // evidence chips the row already carries (change.evidence), the dg7 diff
+    // (reusing renderDiff below — GET /api/changes/<id>/diff, which never invents
+    // a diff for a non-renderable candidate), and the SAME Accept-to-preview /
+    // Reject actions. The reviewer never leaves the queue to review and act; the
+    // server stays authoritative for every action (this is UI consolidation only).
+
+    const diffBase = ds.diffEndpointBase;
+
+    const reviewRowFor = (tr?: any) => {
+      const next = tr.nextElementSibling;
+      return next && next.dataset && next.dataset.publishReviewRow === tr.dataset.changeRowId
+        ? next
+        : null;
+    };
+
+    const closeReview = (tr?: any, button?: any) => {
+      const existing = reviewRowFor(tr);
+      if (existing) existing.remove();
+      if (button) {
+        button.textContent = "Review";
+        button.setAttribute("aria-expanded", "false");
+      }
+    };
+
+    // Evidence chips from the data the row already carries (change.evidence):
+    // an overall promotable verdict + one chip per reported check.
+    const renderEvidenceChips = (container?: any, change?: any) => {
+      const checks = (change.evidence && change.evidence.checks) || [];
+      const promotable = Boolean(change.evidence && change.evidence.promotable);
+      container.append(
+        promotable ? chip("Checks passed", "green") : chip("Checks blocked", "amber"),
+      );
+      for (const c of checks) {
+        const tone = c.status === "pass" ? "green" : c.status === "fail" ? "red" : "amber";
+        const label = (c.label || c.id || "check") + (c.status && c.status !== "pass" ? " · " + c.status : "");
+        const el = chip(label, tone);
+        if (c.detail) el.title = c.detail;
+        container.append(el);
+      }
+      if (!checks.length) container.append(subtle("No checks reported yet"));
+    };
+
+    // Build the split pane. Returns the pane node + the diff container so the
+    // caller can populate the diff asynchronously (reusing renderDiff).
+    const buildReviewPane = (change?: any) => {
+      const pane = document.createElement("div");
+      pane.className = "review-pane";
+
+      // Preview column — same-origin iframe of the friendly per-PR route (it
+      // handles every state: ready render, or the not-built page). Falls back to
+      // any server-provided previewUrl for a change-first row with no PR number.
+      const previewUrl = candidatePrUrl(appDomain, change.prNumber) || change.previewUrl;
+      const previewCol = document.createElement("div");
+      previewCol.className = "review-preview";
+      const pHead = document.createElement("div");
+      pHead.className = "review-pane-head";
+      const pTitle = document.createElement("b");
+      pTitle.textContent = "Preview";
+      pHead.append(pTitle);
+      if (previewUrl) {
+        const openLink = document.createElement("a");
+        openLink.href = previewUrl;
+        openLink.target = "_blank";
+        openLink.rel = "noopener";
+        openLink.textContent = "Open in new tab ↗";
+        pHead.append(openLink);
+      }
+      previewCol.append(pHead);
+      if (previewUrl) {
+        const frame = document.createElement("iframe");
+        frame.className = "review-frame";
+        frame.src = previewUrl;
+        frame.loading = "lazy";
+        frame.title =
+          change.prNumber != null
+            ? "Preview of PR #" + change.prNumber
+            : "Preview of " + change.changeId;
+        previewCol.append(frame);
+      } else {
+        previewCol.append(subtle("No preview is available for this change yet."));
+      }
+
+      // Detail column — evidence chips + diff + the same Accept/Reject actions.
+      const detailCol = document.createElement("div");
+      detailCol.className = "review-detail";
+
+      const evSection = document.createElement("div");
+      evSection.className = "review-section";
+      const evTitle = document.createElement("b");
+      evTitle.textContent = "Checks";
+      const evChips = document.createElement("div");
+      evChips.className = "review-chips";
+      renderEvidenceChips(evChips, change);
+      evSection.append(evTitle, evChips);
+      detailCol.append(evSection);
+
+      const diffSection = document.createElement("div");
+      diffSection.className = "review-section";
+      const diffTitle = document.createElement("b");
+      diffTitle.textContent = "Diff";
+      const diffTarget = document.createElement("div");
+      diffTarget.className = "review-diff-target";
+      diffTarget.append(subtle("Loading the diff…"));
+      diffSection.append(diffTitle, diffTarget);
+      detailCol.append(diffSection);
+
+      // The SAME actions as the row — same handlers, same gates. Not a new authz
+      // path: integrateCandidate/rejectChange POST to the same endpoints, and the
+      // server re-authorizes.
+      const actionRow = document.createElement("div");
+      actionRow.className = "review-actions";
+      const accept = document.createElement("button");
+      accept.type = "button";
+      accept.className = "btn primary";
+      const needsPreviewUpdate =
+        change.status === "ready" &&
+        Boolean(change.evidence && change.evidence.promotable) &&
+        change.mergeable === false;
+      accept.textContent = needsPreviewUpdate ? "Update change" : "Accept to preview";
+      accept.disabled = !canShip || (!needsPreviewUpdate && !change.mergeable);
+      accept.title = !canShip
+        ? "Requires a ship-on-behalf grant on your account — ask the store owner"
+        : needsPreviewUpdate
+          ? "Preview changed while you worked — update this change, then integrate it"
+          : !change.mergeable
+            ? "This change is not ready to integrate"
+            : "Integrate this change into the preview aggregate (does not go live)";
+      accept.addEventListener("click", () =>
+        needsPreviewUpdate ? openConflictRecovery(change, accept) : integrateCandidate(change, accept),
+      );
+      const reject = document.createElement("button");
+      reject.type = "button";
+      reject.className = "btn";
+      reject.textContent = "Reject";
+      reject.disabled = !canShip;
+      reject.title = canShip
+        ? "Close this change without publishing"
+        : "Requires an owner or admin sign-in";
+      reject.addEventListener("click", () => rejectChange(change, reject));
+      actionRow.append(accept, reject);
+      detailCol.append(actionRow);
+
+      pane.append(previewCol, detailCol);
+      return { pane, diffTarget };
+    };
+
+    // A candidate's diff at a fixed head sha is immutable, so re-opening a review
+    // pane for the same changeId@headSha serves from cache without re-fetching.
+    const diffCache = createKeyedCache();
+    const loadReviewDiff = async (change?: any, diffTarget?: any) => {
+      const cacheKey = change.changeId + "@" + (change.headSha || "");
+      const cached = diffCache.get(cacheKey);
+      if (cached) {
+        diffTarget.textContent = "";
+        renderDiff(diffTarget, cached);
+        return;
+      }
+      try {
+        const res = await fetch(diffBase + "/" + encodeURIComponent(change.changeId) + "/diff", {
+          headers: { accept: "application/json" },
+        });
+        const data = await res.json().catch(() => ({}));
+        diffTarget.textContent = "";
+        if (!res.ok) {
+          diffTarget.append(subtle(data.error || "Could not load the diff (" + res.status + ")"));
+        } else {
+          const diff = data.diff || {};
+          diffCache.set(cacheKey, diff);
+          renderDiff(diffTarget, diff);
+        }
+      } catch {
+        diffTarget.textContent = "";
+        diffTarget.append(subtle("Could not load the diff — network error"));
+      }
+    };
+
+    const toggleReview = (change?: any, button?: any, tr?: any) => {
+      if (!tr.dataset.changeRowId) tr.dataset.changeRowId = change.changeId;
+      if (reviewRowFor(tr)) {
+        closeReview(tr, button);
+        return;
+      }
+      const detailTr = document.createElement("tr");
+      detailTr.dataset.publishReviewRow = tr.dataset.changeRowId;
+      const td = document.createElement("td");
+      td.colSpan = 6;
+      td.className = "publish-review-cell";
+      const { pane, diffTarget } = buildReviewPane(change);
+      td.append(pane);
+      detailTr.append(td);
+      tr.after(detailTr);
+      button.textContent = "Hide review";
+      button.setAttribute("aria-expanded", "true");
+      loadReviewDiff(change, diffTarget);
+    };
+
+    const CHANGE_MARK: Record<string, string> = { added: "+", changed: "~", removed: "−" };
+
+    const renderDiff = (td?: any, diff?: any) => {
+      td.textContent = "";
+      const head = document.createElement("div");
+      head.className = "publish-diff-head";
+
+      // Authority: honest label of whether the diff describes the exact head.
+      const authority = diff.authority || {};
+      const authChip = chip(
+        authority.authoritative
+          ? "Reviewed at head"
+          : authority.stale
+            ? "Last-good preview (stale vs head)"
+            : authority.missing
+              ? "No evidence yet"
+              : "Head",
+        authority.authoritative ? "green" : authority.stale ? "amber" : "",
+      );
+      head.append(authChip);
+
+      if (diff.headSha) {
+        const sha = document.createElement("span");
+        sha.className = "publish-mono subtle";
+        sha.textContent = "head " + shortSha(diff.headSha);
+        head.append(sha);
+      }
+      if (diff.revHref) {
+        const rev = document.createElement("a");
+        rev.href = diff.revHref;
+        rev.target = "_blank";
+        rev.rel = "noopener";
+        rev.textContent = "Open reviewed revision";
+        head.append(rev);
+      }
+      td.append(head);
+
+      if (!diff.renderable) {
+        // Honest: a candidate that can't render has NO diff — say why (dg3), no fake.
+        const reason = document.createElement("p");
+        reason.className = "note publish-diff-blocked";
+        reason.textContent =
+          diff.blockedReason || "This candidate has no renderable version to diff yet.";
+        td.append(reason);
+        return;
+      }
+
+      const files = Array.isArray(diff.files) ? diff.files : [];
+      if (!files.length) {
+        td.append(subtle("No file changes vs the current live version."));
+        return;
+      }
+      const list = document.createElement("ul");
+      list.className = "publish-diff-list";
+      for (const f of files) {
+        const li = document.createElement("li");
+        li.className = "publish-diff-" + f.change;
+        const mark = document.createElement("span");
+        mark.className = "publish-diff-mark";
+        mark.textContent = CHANGE_MARK[f.change] || "•";
+        const path = document.createElement("code");
+        path.textContent = f.path;
+        li.append(mark, path);
+        list.append(li);
+      }
+      td.append(list);
+    };
+
+    // ---- dg7: versions / promotion history + rollback ----------------------
+    // The promotion history (u2/u3 promotion_status) with the tenant Gitea SHA,
+    // its /rev link (u5), and the current-live marker; a prior version rolls back
+    // THROUGH the one orchestrator (/api/changes/rollback → u8), rendering only the
+    // HONEST terminal state (rolled_back only when verified).
+
+    const versionsPanel = root.querySelector("[data-publish-versions]");
+    const versionsBody = versionsPanel?.querySelector("[data-versions-body]");
+    const versionsChip = versionsPanel?.querySelector("[data-versions-chip]");
+    const versionsStatus = versionsPanel?.querySelector("[data-versions-status]");
+    const versionsRollbackNote = versionsPanel?.querySelector("[data-versions-rollback-note]");
+    // Hosted and static-publish stores both render the same instant "Roll back" UX
+    // below — every rollback is an instant KV pointer flip.
+
+    const renderVersions = (view?: any) => {
+      if (!versionsBody) return;
+      const versions = Array.isArray(view.versions) ? view.versions : [];
+      versionsBody.textContent = "";
+
+      if (versionsChip) {
+        versionsChip.textContent = versions.length === 1 ? "1 version" : versions.length + " versions";
+        versionsChip.className = "chip" + (versions.length ? " blue" : "");
+      }
+
+      // u14 — orient a store with exactly ONE live version: rollback needs a PRIOR
+      // target, which only exists once a SECOND version is published. Only fill the
+      // status line if nothing else has claimed it (an action/error message wins).
+      if (versionsStatus && versions.length === 1 && !versionsStatus.textContent) {
+        versionsStatus.textContent = "Rollback targets appear here once a second version is published.";
+      }
+
+      // Every rollback is an instant KV pointer flip, so there is no CI-latency
+      // note to show.
+      if (versionsRollbackNote) versionsRollbackNote.hidden = true;
+
+      if (!versions.length) {
+        const tr = document.createElement("tr");
+        const td = cell(subtle("No versions have been promoted to live yet."));
+        td.colSpan = 6;
+        tr.append(td);
+        versionsBody.append(tr);
+        return;
+      }
+
+      for (const v of versions) {
+        const tr = document.createElement("tr");
+
+        // Version identity: the tenant Gitea SHA (content authority) + source.
+        const idCell = document.createElement("td");
+        const strong = document.createElement("strong");
+        strong.className = "publish-mono";
+        strong.textContent = shortSha(v.versionId);
+        idCell.append(strong);
+        if (v.source) idCell.append(subtle(v.source === "commit" ? "From a commit" : "Content hash"));
+
+        // "What shipped" — the SAME human summary the staged Publish console shows,
+        // now describing the RELEASE: a plain-language lead + an openable list of the
+        // PRs this version shipped (from its release receipt). OPTIONAL server
+        // enrichment: absent (an older version with no linked receipt) → the cell
+        // stays just the sha + source, exactly as before (graceful fallback).
+        const summary = v.releaseSummary || null;
+        if (summary && (summary.lead || summary.text)) {
+          const lead = document.createElement("p");
+          lead.className = "ver-summary";
+          lead.textContent = summary.lead || summary.text;
+          idCell.append(lead);
+        }
+        const changes = Array.isArray(v.changes) ? v.changes : [];
+        if (changes.length) {
+          const details = document.createElement("details");
+          details.className = "agg-included-details ver-changes";
+          const sm = document.createElement("summary");
+          const smLead = document.createElement("span");
+          smLead.className = "agg-included-lead";
+          smLead.textContent = "What shipped";
+          const badge = document.createElement("span");
+          badge.className = "agg-included-badge";
+          badge.textContent = String(changes.length);
+          const chev = document.createElement("span");
+          chev.className = "agg-chev";
+          chev.setAttribute("aria-hidden", "true");
+          const chevSvg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+          const chevPath = document.createElementNS("http://www.w3.org/2000/svg", "path");
+          chevPath.setAttribute("d", "M9 6l6 6-6 6");
+          chevSvg.setAttribute("viewBox", "0 0 24 24");
+          chevSvg.setAttribute("fill", "none");
+          chevSvg.setAttribute("stroke", "currentColor");
+          chevSvg.setAttribute("stroke-width", "2.2");
+          chevSvg.append(chevPath);
+          chev.append(chevSvg);
+          sm.append(smLead, badge, chev);
+          details.append(sm);
+          const ul = document.createElement("ul");
+          ul.className = "agg-included-list";
+          for (const ch of changes) ul.append(changeSummaryItem(ch));
+          details.append(ul);
+          idCell.append(details);
+        }
+        tr.append(idCell);
+
+        // Digest (static current only — never fabricated for priors).
+        const digestCell = cell(v.digest ? shortSha(v.digest) : "—");
+        digestCell.classList.add("publish-mono");
+        if (!v.digest) digestCell.classList.add("subtle");
+        tr.append(digestCell);
+
+        tr.append(cell(age(v.promotedAt)));
+
+        // Preview: the u5 immutable /rev/<sha> link.
+        const revCell = document.createElement("td");
+        if (v.revHref) {
+          const a = document.createElement("a");
+          a.href = v.revHref;
+          a.target = "_blank";
+          a.rel = "noopener";
+          a.textContent = "Revision";
+          revCell.append(a);
+        } else {
+          revCell.append(subtle("—"));
+        }
+        tr.append(revCell);
+
+        // State: current live vs prior.
+        tr.append(cell(v.isCurrent ? chip("Current live", "green") : chip("Prior", "")));
+
+        // Action: roll back to a PRIOR version (never the current one).
+        const act = document.createElement("td");
+        act.className = "action publish-actions";
+        if (!v.isCurrent) {
+          const rollbackBtn = document.createElement("button");
+          rollbackBtn.type = "button";
+          rollbackBtn.className = "btn";
+          rollbackBtn.textContent = "Roll back";
+          rollbackBtn.disabled = !canShip;
+          rollbackBtn.title = !canShip
+            ? "Requires an owner or ship-on-behalf sign-in"
+            : "Roll the live site back to this version";
+          rollbackBtn.addEventListener("click", () => rollbackVersion(v, rollbackBtn));
+          act.append(rollbackBtn);
+        }
+        tr.append(act);
+
+        versionsBody.append(tr);
+      }
+    };
+
+    // Published versions only change when something is published, which moves the
+    // change-queue fingerprint (currentStateKey). Cache the view against that key
+    // so re-viewing the panel or a re-render doesn't re-fire the read; refetch
+    // only when the fingerprint changes or on an explicit refresh (force).
+    const versionsCache = createKeyedCache();
+    const loadVersionsImpl = async () => {
+      if (!versionsBody) return;
+      const key = currentStateKey;
+      if (key != null && versionsCache.has(key)) {
+        renderVersions(versionsCache.get(key));
+        return;
+      }
+      try {
+        const res = await fetch(ds.versionsEndpoint, { headers: { accept: "application/json" } });
+        if (res.status === 401 || res.status === 403) {
+          if (versionsChip) versionsChip.textContent = "Sign-in required";
+          versionsBody.textContent = "";
+          const tr = document.createElement("tr");
+          const td = cell(subtle("Sign in as a store owner or admin to view published versions."));
+          td.colSpan = 6;
+          tr.append(td);
+          versionsBody.append(tr);
+          return;
+        }
+        const data = await res.json().catch(() => ({}));
+        if (!res.ok) {
+          setStatus(versionsStatus, data.error || "Could not load versions (" + res.status + ")", "err");
+          return;
+        }
+        const view = data.view || {};
+        if (key != null) versionsCache.set(key, view);
+        renderVersions(view);
+      } catch {
+        setStatus(versionsStatus, "Could not load versions — network error", "err");
+      }
+    };
+    const versionsCoalescer = createCoalescer(loadVersionsImpl);
+    const loadVersions = (opts?: any) => {
+      // force (explicit refresh / post-action) drops the cached entry so the
+      // next run re-fetches even if the fingerprint hasn't caught up yet.
+      if (opts && opts.force && currentStateKey != null) versionsCache.delete(currentStateKey);
+      return versionsCoalescer.trigger();
+    };
+
+    // Interpret the rollback response into ONE honest terminal state. Kept local
+    // (NOT imported from lib/publish/shipWorkspace's interpretRollbackResponse):
+    // that module pulls lib/preview value dependencies, which must not be dragged
+    // into this client bundle. `rolledBack` is
+    // true ONLY for a verified `rolled_back` — a `publish_pending` is NEVER a
+    // rolled-back claim.
+    const interpretRollback = (httpOk?: any, body?: any) => {
+      const toVersionId = typeof body.toVersionId === "string" ? body.toVersionId : null;
+      if (typeof body.state === "string") {
+        const state = ["rolled_back", "publish_pending", "publish_failed", "blocked"].includes(body.state)
+          ? body.state
+          : "error";
+        return {
+          state,
+          rolledBack: state === "rolled_back",
+          message: body.message || body.error || "Rollback returned state " + state + ".",
+        };
+      }
+      if (httpOk && body.rolledBack === true) {
+        return {
+          state: "rolled_back",
+          rolledBack: true,
+          message: toVersionId ? "Rolled back live to " + shortSha(toVersionId) + "." : "Rolled back live.",
+        };
+      }
+      return {
+        state: "blocked",
+        rolledBack: false,
+        message: (body.error || "Rollback failed") + (body.reason ? " (" + body.reason + ")" : ""),
+      };
+    };
+
+    const rollbackVersion = async (version?: any, button?: any) => {
+      // Every rollback is an instant KV pointer flip — the confirm/status copy is
+      // the same for a hosted and a static-publish store.
+      const confirmMsg =
+        "Roll the live store back to version " + shortSha(version.versionId) +
+        "? This publishes that prior version to the live site.";
+      if (!window.confirm(confirmMsg)) return;
+      button.disabled = true;
+      setStatus(versionsStatus, "Rolling back to " + shortSha(version.versionId) + "…");
+      try {
+        // The console dispatches by version id only; a static prior version's
+        // archive digest lives only in S3 (CI resolves it). Pass a digest ONLY when
+        // we honestly have one (never for a static prior — its digest is always null).
+        const payload: any = { targetVersionId: version.versionId };
+        if (version.digest) payload.targetDigest = version.digest;
+        const res = await fetch(ds.rollbackEndpoint, {
+          method: "POST",
+          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
+          body: JSON.stringify(payload),
+        });
+        const data = await res.json().catch(() => ({}));
+        const outcome = interpretRollback(res.ok, data);
+        setStatus(versionsStatus, outcome.message, outcome.rolledBack ? "ok" : outcome.state === "publish_pending" ? "ok" : "err");
+      } catch {
+        setStatus(versionsStatus, "Rollback failed — network error", "err");
+      } finally {
+        button.disabled = false;
+        loadVersions({ force: true }); // a rollback changed the live version
+        loadQueue();
+      }
+    };
+
+    // ---- Domain section ----------------------------------------------------
+
+    const domainPanel = root.querySelector("[data-publish-domain]");
+    let domainPollTimer: any = null;
+
+    const renderDomain = (payload?: any) => {
+      if (!domainPanel) return;
+      const domain = payload.domain || {};
+      const stateEl = domainPanel.querySelector("[data-domain-state]");
+      const stateChip = domainPanel.querySelector("[data-domain-state-chip]");
+      const sinceEl = domainPanel.querySelector("[data-domain-since]");
+      const captureEl = domainPanel.querySelector("[data-domain-capture]");
+      const runEl = domainPanel.querySelector("[data-domain-run]");
+      const runDetailEl = domainPanel.querySelector("[data-domain-run-detail]");
+      const rollbackBtn = domainPanel.querySelector("[data-domain-rollback]");
+      const rollbackDetail = domainPanel.querySelector("[data-domain-rollback-detail]");
+      const connected = domain.state === "cloudfront";
+
+      if (stateEl) {
+        stateEl.textContent = connected
+          ? "Storefront CDN (cloudfront)"
+          : "Previous host (pantheon)";
+      }
+      if (stateChip) {
+        stateChip.textContent = connected ? "Connected" : "Not connected";
+        stateChip.className = "chip " + (connected ? "green" : "amber");
+      }
+      if (sinceEl) {
+        sinceEl.textContent = domain.since
+          ? "Since " + new Date(domain.since).toLocaleString()
+          : "Current host for " + (payload.appDomain || ds.appDomain);
+      }
+      if (captureEl) {
+        captureEl.textContent = domain.priorCapturedAt
+          ? "Captured " + new Date(domain.priorCapturedAt).toLocaleString()
+          : "None captured";
+      }
+
+      const run = domain.lastRun;
+      // "dispatched" = awaiting the CI completion callback (terminal-only wire).
+      const inFlight = run && run.status === "dispatched";
+      if (runEl) {
+        runEl.textContent = run
+          ? run.action + (run.rehearsal ? " (rehearsal)" : "") + " · " + run.status
+          : "None";
+      }
+      if (runDetailEl) {
+        runDetailEl.textContent = "";
+        if (run) {
+          const parts = [];
+          if (run.actor) parts.push("by " + run.actor);
+          if (run.startedAt) parts.push(age(run.startedAt));
+          runDetailEl.append(document.createTextNode(parts.join(" · ")));
+          if (run.runUrl) {
+            const link = document.createElement("a");
+            link.href = run.runUrl;
+            link.target = "_blank";
+            link.rel = "noopener";
+            link.textContent = "View run";
+            runDetailEl.append(document.createTextNode(" · "));
+            runDetailEl.append(link);
+          }
+          if (run.status === "failed" && run.error) {
+            const err = document.createElement("span");
+            err.className = "publish-error-detail";
+            err.textContent = run.error;
+            runDetailEl.append(document.createElement("br"));
+            runDetailEl.append(err);
+          }
+        } else {
+          runDetailEl.textContent = "Connect and rollback runs appear here.";
+        }
+      }
+      if (rollbackBtn) {
+        rollbackBtn.disabled =
+          !canShip || inFlight || !domain.priorRecordsKey;
+      }
+      if (rollbackDetail && domain.priorCapturedAt) {
+        rollbackDetail.textContent =
+          "Restores the DNS records captured " +
+          new Date(domain.priorCapturedAt).toLocaleString() + ".";
+      }
+
+      // Poll while a run is in flight so completion lands without a manual refresh.
+      if (domainPollTimer) {
+        clearTimeout(domainPollTimer);
+        domainPollTimer = null;
+      }
+      if (inFlight) domainPollTimer = setTimeout(loadDomain, 15000);
+    };
+
+    const loadDomain = async () => {
+      if (!domainPanel) return;
+      try {
+        const res = await fetch(ds.domainStatusEndpoint, {
+          headers: { accept: "application/json" },
+        });
+        if (!res.ok) return;
+        renderDomain(await res.json());
+      } catch {
+        /* leave the last rendered state */
+      }
+      // u9: refresh the readiness itemization alongside the status.
+      loadReadiness();
+    };
+
+    // ---- Cutover readiness (u9) --------------------------------------------
+    // Reads the SAME server gate `tot go-live` reads (/api/domain/readiness) and
+    // itemizes the preconditions. The Connect button additionally requires the
+    // server to report ready — the display and the enforcement can't diverge.
+    const readinessBox = domainPanel?.querySelector("[data-domain-readiness]");
+    const connectBtn = domainPanel?.querySelector("[data-domain-connect]");
+    let domainReady = false;
+
+    const renderReadiness = (payload?: any) => {
+      if (!readinessBox) return;
+      const readiness = (payload && payload.readiness) || {};
+      const checks = Array.isArray(readiness.checks) ? readiness.checks : [];
+      domainReady = readiness.ready === true;
+      readinessBox.hidden = false;
+
+      const chip = readinessBox.querySelector("[data-domain-readiness-chip]");
+      if (chip) {
+        chip.textContent = domainReady ? "Ready" : "Not ready";
+        chip.className = "chip " + (domainReady ? "green" : "amber");
+      }
+      const list = readinessBox.querySelector("[data-domain-readiness-list]");
+      if (list) {
+        list.textContent = "";
+        for (const c of checks) {
+          const li = document.createElement("li");
+          li.className = c.ok ? "ok" : "blocked";
+          // Header row: mark + bold label. The detail and remedy render on their
+          // OWN lines below (not as inline siblings of the label) so the label and
+          // its description never run together as one string.
+          const head = document.createElement("div");
+          head.className = "domain-readiness-item-head";
+          const mark = document.createElement("span");
+          mark.className = "domain-readiness-mark";
+          mark.textContent = c.ok ? "✓" : "✗";
+          const label = document.createElement("b");
+          label.textContent = c.label || c.id || "";
+          head.append(mark, label);
+          li.append(head);
+          if (c.detail) {
+            const detail = document.createElement("p");
+            detail.className = "domain-readiness-detail";
+            detail.textContent = c.detail;
+            li.append(detail);
+          }
+          // Blocked checks carry a "how to clear this" remedy from the SAME gate
+          // `tot go-live` reads — the guide lives with the enforcement, never a
+          // divergent side note.
+          if (!c.ok && c.remedy) {
+            const remedy = document.createElement("p");
+            remedy.className = "domain-readiness-remedy";
+            remedy.textContent = "→ " + c.remedy;
+            li.append(remedy);
+          }
+          list.append(li);
+        }
+      }
+      const note = readinessBox.querySelector("[data-domain-readiness-note]");
+      if (note) {
+        note.textContent = payload && payload.ownerCapable === false
+          ? "Apex cutover is owner-only — sign in as the store owner to connect the domain."
+          : domainReady
+            ? "All preconditions are green — the cutover is permitted."
+            : "Clear the failing preconditions above before connecting the apex.";
+      }
+      // Gate the Connect button on server readiness in ADDITION to owner (the
+      // markup already disables it for non-owners); never enable it when blocked.
+      if (connectBtn && !connectBtn.dataset.ownerLocked) {
+        connectBtn.disabled = !domainReady;
+      }
+    };
+
+    const loadReadiness = async () => {
+      if (!readinessBox || !ds.domainReadinessEndpoint) return;
+      try {
+        const res = await fetch(ds.domainReadinessEndpoint, {
+          headers: { accept: "application/json", "x-tot-capability": "ship-on-behalf" },
+        });
+        if (!res.ok) return;
+        renderReadiness(await res.json());
+      } catch {
+        /* leave the last rendered readiness */
+      }
+    };
+
+    const domainStatusEl = domainPanel?.querySelector("[data-domain-status]");
+
+    const domainAction = async (body?: any, button?: any) => {
+      button.disabled = true;
+      setStatus(domainStatusEl, (body.action === "connect" ? "Connecting" : "Rolling back") + "…");
+      try {
+        const res = await fetch(ds.domainDispatchEndpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            "x-tot-capability": "ship-on-behalf",
+          },
+          body: JSON.stringify(body),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (res.ok && data.dispatched) {
+          setStatus(
+            domainStatusEl,
+            (body.action === "connect" ? "Connect" : "Rollback") +
+              (body.rehearsal ? " rehearsal" : "") +
+              " dispatched — the run status updates below as it progresses.",
+            "ok",
+          );
+        } else {
+          setStatus(domainStatusEl, data.error || "Request failed (" + res.status + ")", "err");
+        }
+      } catch {
+        setStatus(domainStatusEl, "Request failed — network error", "err");
+      } finally {
+        button.disabled = false;
+        loadDomain();
+      }
+    };
+
+    domainPanel?.querySelector("[data-domain-connect]")?.addEventListener("click", (event: any) => {
+      const confirmInput = domainPanel.querySelector("[data-domain-confirm]");
+      const rehearsal = Boolean(domainPanel.querySelector("[data-domain-rehearsal]")?.checked);
+      domainAction(
+        {
+          action: "connect",
+          confirmDomain: (confirmInput?.value || "").trim(),
+          rehearsal,
+        },
+        event.currentTarget,
+      );
+    });
+
+    domainPanel?.querySelector("[data-domain-rollback]")?.addEventListener("click", (event: any) => {
+      if (
+        !window.confirm(
+          "Roll back " + ds.appDomain + " to the previous host? DNS returns to the captured records in about a minute.",
+        )
+      ) {
+        return;
+      }
+      domainAction({ action: "rollback" }, event.currentTarget);
+    });
+
+    // ---- b17: branch retention ----------------------------------------------
+    // Renders the GET /api/changes/branches dry-run classification (already
+    // projected server-side by branchRetentionView.ts — this script only
+    // paints it, same division of labor as renderQueue/renderVersions above)
+    // and drives the guarded delete. The server (candidate_delete, b13)
+    // re-classifies fresh on every delete, so the confirm below is the HUMAN
+    // gate, not the safety guarantee — the safety guarantee is server-side.
+
+    const branchesPanel = root.querySelector("[data-publish-branches]");
+    const branchesBody = branchesPanel?.querySelector("[data-branches-body]");
+    const branchesChip = branchesPanel?.querySelector("[data-branches-chip]");
+    const branchesStatus = branchesPanel?.querySelector("[data-branches-status]");
+    const branchesActions = branchesPanel?.querySelector("[data-branches-actions]");
+    const branchesSweepBtn = branchesPanel?.querySelector("[data-branches-sweep]");
+
+    // Kept local (NOT imported from branchRetentionView): that module pulls a
+    // lib/forge value dependency, which must not be dragged into this client bundle.
+    // Shown when a live classification fetch fails — the table must NEVER keep the
+    // last-known chips (a confident stale label is exactly the b1 bug).
+    const FORGE_UNREACHABLE_LABEL = "State unknown (forge unreachable)";
+
+    // The last classification the panel rendered from a SUCCESSFUL fetch. Kept so a
+    // later fetch failure can re-stamp those same branches as "state unknown" (never
+    // leave the stale confident chips), and so an unchanged poll can skip re-render.
+    let lastBranchesRows: any[] = [];
+    let lastBranchesSignature: string | null = null;
+    // Refs the "Sweep dead branches" action deletes, as pre-computed server-side
+    // (view.sweepableRefs): Dead + delete-eligible + reachable. The UI never re-derives
+    // the delete set — it confirms these, then loops the guarded delete.
+    let lastSweepableRefs: any[] = [];
+
+    const buildCleanupPlan = (row?: any) => {
+      return [
+        "Delete branch plan:",
+        "  repo:           " + (appDomain || repo),
+        "  branch:         " + row.ref,
+        "  tip sha:        " + row.shortSha,
+        "  classification: " + row.classificationLabel,
+        "  reason:         " + row.reason,
+        "",
+        "This deletes the Git BRANCH only — it never evicts a hosted preview build",
+        "(that is Retire, a separate action above). The server re-classifies this",
+        "branch fresh before deleting; a moved tip or a branch that is no longer",
+        "integrated/closed-or-rejected is refused, not silently skipped.",
+      ].join("\n");
+    };
+
+    // One guarded delete round-trip. Shared by the per-row "Clean up", the bulk
+    // "Sweep dead branches", and the per-row orphan "Delete this branch" — the server
+    // re-checks eligibility fresh on every ref. `opts` opts into the explicit HUMAN
+    // delete (explicitConfirm + expectedClassification) for an orphan the default
+    // eligibility path refuses; omitted, this is the default guarded delete.
+    const postDeleteRef = async (ref?: any, expectedSha?: any, opts: any = {}) => {
+      const body: any = { ref, expectedSha };
+      if (opts.explicitConfirm) body.explicitConfirm = true;
+      if (opts.expectedClassification) body.expectedClassification = opts.expectedClassification;
+      const res = await fetch(ds.branchesEndpoint, {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
+        body: JSON.stringify(body),
+      });
+      const data = await res.json().catch(() => ({}));
+      return { ok: res.ok && data.ok, status: res.status, data };
+    };
+
+    const cleanupBranch = async (row?: any, button?: any) => {
+      if (!window.confirm(buildCleanupPlan(row) + "\n\nDelete this branch?")) return;
+      button.disabled = true;
+      setStatus(branchesStatus, "Deleting " + row.shortRef + "…");
+      try {
+        const { ok, status, data } = await postDeleteRef(row.ref, row.sha);
+        if (ok) {
+          setStatus(
+            branchesStatus,
+            data.alreadyAbsent
+              ? row.shortRef + " was already gone (nothing to delete)."
+              : "Deleted " + row.shortRef + ".",
+            "ok",
+          );
+        } else {
+          setStatus(branchesStatus, data.error || "Delete refused (" + status + ")", "err");
+        }
+      } catch {
+        setStatus(branchesStatus, "Delete failed — network error", "err");
+      } finally {
+        button.disabled = false;
+        loadBranches();
+      }
+    };
+
+    // Per-row "Delete this branch": the deliberate, one-at-a-time HUMAN delete of an
+    // ORPHAN — a branch the auto/bulk "Sweep" and one-click "Clean up" both refuse
+    // (it is quarantined out of the sweep, and never eligibleForDelete). This is the
+    // ONLY path that removes one. It routes through candidate_delete's guarded explicit
+    // path (explicitConfirm + expectedClassification), which re-verifies the ref is
+    // still an orphan at the same tip server-side and refuses (classification_changed /
+    // sha_mismatch) if it drifted since this row was read — so the confirm below is the
+    // human gate, the server re-check is the safety guarantee.
+    const buildOrphanDeletePlan = (row?: any) => {
+      return [
+        "Delete ORPHANED branch:",
+        "  repo:           " + (appDomain || repo),
+        "  branch:         " + row.ref,
+        "  tip sha:        " + row.shortSha,
+        "  classification: orphan",
+        "  reason:         " + row.reason,
+        "",
+        "An orphan has no open PR and no integration record — nothing else will ever",
+        "clean it up (the scheduled sweep and one-click cleanup both skip it). This",
+        "deletes the Git BRANCH only — it never evicts a hosted preview build. The",
+        "server re-checks this branch fresh before deleting; if it is no longer an",
+        "orphan, or its tip has moved, the delete is refused — not silently skipped.",
+      ].join("\n");
+    };
+
+    const deleteOrphanBranch = async (row?: any, button?: any) => {
+      if (!window.confirm(buildOrphanDeletePlan(row) + "\n\nPermanently delete this orphaned branch?")) return;
+      button.disabled = true;
+      setStatus(branchesStatus, "Deleting orphan " + row.shortRef + "…");
+      try {
+        const { ok, status, data } = await postDeleteRef(row.ref, row.sha, {
+          explicitConfirm: true,
+          expectedClassification: row.classification,
+        });
+        if (ok) {
+          setStatus(
+            branchesStatus,
+            data.alreadyAbsent
+              ? row.shortRef + " was already gone (nothing to delete)."
+              : "Deleted orphaned branch " + row.shortRef + ".",
+            "ok",
+          );
+        } else {
+          setStatus(branchesStatus, data.error || "Delete refused (" + status + ")", "err");
+        }
+      } catch {
+        setStatus(branchesStatus, "Delete failed — network error", "err");
+      } finally {
+        button.disabled = false;
+        loadBranches();
+      }
+    };
+
+    // Bulk "Sweep dead branches": one confirm showing EXACTLY the refs it will delete,
+    // then a guarded delete per ref (each re-checked fresh server-side — a ref that has
+    // moved or is no longer eligible is refused, never silently skipped).
+    const sweepDeadBranches = async () => {
+      const rowsByRef = new Map<string, any>(lastBranchesRows.map((r: any): [string, any] => [r.ref, r]));
+      const targets = lastSweepableRefs.map((ref) => rowsByRef.get(ref)).filter(Boolean);
+      if (!targets.length) return;
+      const preview = [
+        "Sweep dead branches — this deletes " + targets.length + " branch(es):",
+        "",
+        ...targets.map((r: any) => "  • " + r.ref + " @ " + r.shortSha + "  (" + r.classificationLabel + ")"),
+        "",
+        "Each deletes the Git BRANCH only (never a hosted preview build). The server",
+        "re-checks every ref fresh before deleting; anything no longer eligible is",
+        "refused, not silently skipped.",
+      ].join("\n");
+      if (!window.confirm(preview + "\n\nDelete these branches?")) return;
+      branchesSweepBtn.disabled = true;
+      let deleted = 0;
+      let refused = 0;
+      for (const r of targets) {
+        setStatus(branchesStatus, "Sweeping " + r.shortRef + "…");
+        try {
+          const { ok } = await postDeleteRef(r.ref, r.sha);
+          if (ok) deleted++;
+          else refused++;
+        } catch {
+          refused++;
+        }
+      }
+      setStatus(
+        branchesStatus,
+        "Swept " + deleted + " branch(es)" + (refused ? ", " + refused + " refused" : "") + ".",
+        refused ? "err" : "ok",
+      );
+      branchesSweepBtn.disabled = false;
+      loadBranches();
+    };
+
+    // Show/enable the sweep button only when there is a Dead+eligible set to sweep.
+    const updateSweepButton = () => {
+      if (!branchesActions || !branchesSweepBtn) return;
+      const n = lastSweepableRefs.length;
+      branchesActions.hidden = n === 0;
+      branchesSweepBtn.disabled = !canShip || n === 0;
+      branchesSweepBtn.title = canShip ? "" : "Requires an owner/admin sign-in.";
+      branchesSweepBtn.textContent = n ? "Sweep dead branches (" + n + ")" : "Sweep dead branches";
+    };
+    branchesSweepBtn?.addEventListener("click", sweepDeadBranches);
+
+    // Paint the table body from a set of rows. `unreachable` re-stamps every row
+    // as "state unknown" and withdraws its action — used when a live fetch fails,
+    // so the operator never sees a confident classification the forge can no
+    // longer confirm (the b1 bug: a stale "PR #11 open / Keep" long after close).
+    const renderBranchRows = (rows?: any, { unreachable = false }: any = {}) => {
+      branchesBody.textContent = "";
+      if (!rows.length) {
+        const tr = document.createElement("tr");
+        const td = cell(
+          subtle(
+            unreachable
+              ? "Branch state unknown — the forge could not be reached."
+              : "No candidate branches found for this repo.",
+          ),
+        );
+        td.colSpan = 7;
+        tr.append(td);
+        branchesBody.append(tr);
+        return;
+      }
+
+      for (const row of rows) {
+        const rowUnknown = unreachable || row.forgeUnreachable === true;
+        const tr = document.createElement("tr");
+
+        const branchCell = document.createElement("td");
+        const branchStrong = document.createElement("strong");
+        branchStrong.textContent = row.shortRef;
+        branchCell.append(branchStrong, subtle(row.ref + " @ " + row.shortSha));
+
+        // Describe the branch by WHAT it changes — the SAME candidate_summary the
+        // staged Publish console + versions list read. OPTIONAL server enrichment:
+        // absent (no PR, or the summary read missed it) → the cell stays just the
+        // ref, exactly as before (graceful fallback). Never shown on an unreachable
+        // row: its classification is precisely what couldn't be confirmed.
+        if (!rowUnknown && (row.prTitle || row.prDescription)) {
+          if (row.prTitle) {
+            const t = document.createElement("p");
+            t.className = "branch-pr-title";
+            t.textContent = row.prTitle;
+            branchCell.append(t);
+          }
+          if (row.prDescription) {
+            const d = document.createElement("p");
+            d.className = "branch-pr-desc";
+            d.textContent = row.prDescription;
+            branchCell.append(d);
+          }
+          const fileCount = typeof row.fileCount === "number" ? row.fileCount : null;
+          const hasLines = typeof row.linesAdded === "number" || typeof row.linesRemoved === "number";
+          if (fileCount != null || hasLines || row.aiDrafted) {
+            const meta = document.createElement("div");
+            meta.className = "agg-included-meta branch-pr-meta";
+            if (fileCount != null) {
+              const f = document.createElement("span");
+              f.textContent = fileCount + (fileCount === 1 ? " file" : " files");
+              meta.append(f);
+            }
+            if (hasLines) meta.append(linesNode(row.linesAdded, row.linesRemoved));
+            if (row.aiDrafted) {
+              const ai = document.createElement("span");
+              ai.className = "branch-pr-ai";
+              ai.textContent = "AI summary";
+              meta.append(ai);
+            }
+            branchCell.append(meta);
+          }
+        }
+        tr.append(branchCell);
+
+        // Protected rows collapse to one line — branch + classification + a single
+        // status. Nobody acts on them, so the PR/tip/age/evidence detail is just noise.
+        if (row.compact && !rowUnknown) {
+          tr.append(cell(chip(row.classificationLabel, row.tone || "")));
+          const statusTd = cell(subtle(row.reason || "Protected — permanent"));
+          statusTd.colSpan = 5;
+          tr.append(statusTd);
+          branchesBody.append(tr);
+          continue;
+        }
+
+        tr.append(
+          cell(
+            rowUnknown
+              ? chip(FORGE_UNREACHABLE_LABEL, "amber")
+              : chip(row.classificationLabel, row.tone || ""),
+          ),
+        );
+
+        const prCell = document.createElement("td");
+        if (row.prNumber != null) {
+          // Link to the INTERNAL friendly PR route (/<tenant>/preview/pr/<N>), never
+          // the server-provided `row.prUrl` — that is the raw Gitea forge html_url the
+          // MCP candidate_list projection emits (<forge-host>/<org>/<repo>/pulls/N),
+          // and surfacing a raw forge link to an owner is exactly the boundary
+          // noGiteaLinks.test.ts guards (the source scan can't catch a host that
+          // arrives in data, so we refuse it here at render). Mirrors the candidate
+          // queue, which already builds its preview link this way.
+          const prHref = candidatePrUrl(appDomain, row.prNumber);
+          if (prHref) {
+            const a = document.createElement("a");
+            a.href = prHref;
+            a.target = "_blank";
+            a.rel = "noopener";
+            a.textContent = "PR #" + row.prNumber;
+            prCell.append(a);
+          } else {
+            prCell.append(document.createTextNode("PR #" + row.prNumber));
+          }
+          prCell.append(subtle((row.prState || "") + (row.integratedIntoAggregate ? " · in aggregate" : "")));
+        } else {
+          prCell.append(subtle("No PR record"));
+        }
+        tr.append(prCell);
+
+        tr.append(cell(row.commitTimestampDisplay));
+        tr.append(cell(row.ageLabel));
+        // Evidence cell shows a summary only when the row actually HAS evidence —
+        // never a "no evidence reported" placeholder in an otherwise empty column.
+        tr.append(row.hasEvidence ? cell(row.evidenceSummary) : cell());
+
+        const actionsCell = document.createElement("td");
+        actionsCell.className = "action";
+        if (rowUnknown) {
+          // No trustworthy classification → offer no delete; the row's own eligibility
+          // is exactly what we could not confirm. A cleanup still re-checks server-side,
+          // but we must not INVITE one off a state we know we could not read.
+          actionsCell.append(subtle("—"));
+        } else if (row.classification === "orphan") {
+          // Orphan (human quarantined OR machine "Dead"): the sweep and one-click "Clean
+          // up" both refuse it, so this deliberate per-row HUMAN delete is its only path
+          // out. Distinct from "Clean up" (styled danger) and re-verified fresh server-side.
+          const btn = document.createElement("button");
+          btn.type = "button";
+          btn.className = "btn branch-delete-orphan";
+          btn.dataset.deleteOrphan = "1";
+          btn.disabled = !canShip;
+          btn.title = canShip ? "" : "Requires an owner/admin sign-in.";
+          btn.textContent = "Delete this branch";
+          btn.addEventListener("click", () => deleteOrphanBranch(row, btn));
+          actionsCell.append(btn);
+        } else if (row.eligibleForDelete) {
+          const btn = document.createElement("button");
+          btn.type = "button";
+          btn.className = "btn";
+          btn.disabled = !canShip;
+          btn.title = canShip ? "" : "Requires an owner/admin sign-in.";
+          btn.textContent = "Clean up";
+          btn.addEventListener("click", () => cleanupBranch(row, btn));
+          actionsCell.append(btn);
+        } else {
+          actionsCell.append(subtle("Keep"));
+        }
+        tr.append(actionsCell);
+
+        branchesBody.append(tr);
+      }
+    };
+
+    // Render a SUCCESSFUL live fetch: cache the rows (so a later failure can stamp
+    // them unknown), skip re-render when nothing changed, and set the summary chip.
+    const renderBranches = (view?: any) => {
+      if (!branchesBody) return;
+      const rows = Array.isArray(view.rows) ? view.rows : [];
+      const sig = JSON.stringify(rows);
+      lastBranchesRows = rows;
+      lastSweepableRefs = Array.isArray(view.sweepableRefs) ? view.sweepableRefs : [];
+      updateSweepButton();
+      if (sig === lastBranchesSignature) return; // no visible change — don't churn the DOM
+      lastBranchesSignature = sig;
+      if (branchesChip) {
+        const needsReview = rows.filter((r: any) => r.quarantine || r.eligibleForDelete).length;
+        branchesChip.textContent = needsReview
+          ? needsReview + " to review"
+          : rows.length
+            ? rows.length + " branches"
+            : "0 branches";
+        branchesChip.className = "chip" + (needsReview ? " amber" : "");
+      }
+      renderBranchRows(rows);
+    };
+
+    // Render the forge-unreachable state: re-stamp the last-known branches as
+    // "state unknown" (or a single notice if none were ever loaded), never leaving
+    // the stale confident chips a fetch failure would otherwise freeze on screen.
+    const renderBranchesUnreachable = () => {
+      if (!branchesBody) return;
+      lastBranchesSignature = null; // force a real re-render when the forge returns
+      lastSweepableRefs = []; // can't confirm eligibility → nothing is sweepable
+      updateSweepButton();
+      if (branchesChip) {
+        branchesChip.textContent = "State unknown";
+        branchesChip.className = "chip amber";
+      }
+      renderBranchRows(lastBranchesRows, { unreachable: true });
+    };
+
+    const loadBranchesImpl = async () => {
+      if (!branchesBody) return;
+      try {
+        const res = await fetch(ds.branchesEndpoint, { headers: { accept: "application/json" } });
+        if (res.status === 401 || res.status === 403) {
+          if (branchesChip) branchesChip.textContent = "Sign-in required";
+          lastSweepableRefs = [];
+          updateSweepButton();
+          branchesBody.textContent = "";
+          const tr = document.createElement("tr");
+          const td = cell(subtle("Sign in as a store owner or admin to view branch retention."));
+          td.colSpan = 7;
+          tr.append(td);
+          branchesBody.append(tr);
+          return;
+        }
+        const data = await res.json().catch(() => ({}));
+        if (!res.ok) {
+          // A non-2xx means the live classification is UNKNOWN — never keep the last
+          // chips on screen (they may now be lies). Stamp the branches "state unknown".
+          setStatus(branchesStatus, data.error || "Could not load branch classification (" + res.status + ")", "err");
+          renderBranchesUnreachable();
+          return;
+        }
+        renderBranches(data.report || {});
+      } catch {
+        setStatus(branchesStatus, "Could not load branch classification — network error", "err");
+        renderBranchesUnreachable();
+      }
+    };
+    // Coalesce overlapping branch reads: a poll tick, a reveal, and a post-action
+    // refresh can all fire at once — only one runs, with at most one trailing run.
+    const branchesCoalescer = createCoalescer(loadBranchesImpl);
+    const loadBranches = () => branchesCoalescer.trigger();
+
+    // ---- Wiring ------------------------------------------------------------
+
+    // Progressive + lazy: the tab shell is already server-rendered; each heavy
+    // panel fires its first read only when it (or the tab) actually becomes
+    // visible, and the queue poll only runs while the tab is active. An
+    // IntersectionObserver is the single visibility signal — a panel inside a
+    // hidden admin-tab (display:none) never intersects, so nothing fetches until
+    // the operator opens the Publish tab and scrolls the panel into view.
+    const revealDomainOnce = (() => {
+      let done = false;
+      return () => {
+        if (done) return;
+        done = true;
+        loadDomain();
+      };
+    })();
+
+    const onTabActivate = () => {
+      if (tabActive) return;
+      tabActive = true;
+      // loadQueue renders + resyncs the poll clock + (re)starts the cadence.
+      loadQueue();
+    };
+    const onTabDeactivate = () => {
+      if (!tabActive) return;
+      tabActive = false;
+      clearPoll(); // an inactive tab must not keep polling heavy reads
+    };
+
+    const observeVisibility = () => {
+      if (typeof IntersectionObserver !== "function") {
+        // No IO (very old/headless env): fall back to eager load — correctness
+        // over efficiency. Behaves like the pre-progressive-render tab.
+        tabActive = true;
+        branchesVisible = true;
+        loadQueue();
+        loadVersions();
+        revealDomainOnce();
+        loadBranches();
+        return;
+      }
+      const io = new IntersectionObserver(
+        (entries) => {
+          for (const e of entries) {
+            const visible = e.isIntersecting;
+            if (e.target === root) {
+              if (visible) onTabActivate();
+              else onTabDeactivate();
+            } else if (e.target === versionsPanel) {
+              if (visible) loadVersions();
+            } else if (e.target === branchesPanel) {
+              branchesVisible = visible;
+              if (visible) loadBranches();
+            } else if (e.target === domainPanel) {
+              if (visible) revealDomainOnce();
+            }
+          }
+        },
+        { rootMargin: "200px" },
+      );
+      io.observe(root);
+      if (versionsPanel) io.observe(versionsPanel);
+      if (branchesPanel) io.observe(branchesPanel);
+      if (domainPanel) io.observe(domainPanel);
+    };
+
+    root.querySelector("[data-publish-refresh]")?.addEventListener("click", () => {
+      setStatus(statusEl, "");
+      // Explicit refresh: force past every client cache and re-read what's on screen.
+      diffCache.clear();
+      versionsCache.clear();
+      loadQueue();
+      loadVersions({ force: true });
+      loadDomain();
+      loadBranches();
+    });
+
+    // rux7: pause polling while hidden; on return, refresh immediately (loadQueue
+    // re-renders + resyncs the poll clock) rather than waiting out the interval.
+    document.addEventListener("visibilitychange", () => {
+      if (document.hidden) {
+        clearPoll();
+      } else if (tabActive) {
+        // Only resume when the Publish tab is the active one — a background
+        // browser-tab return must not wake a Publish tab the operator left.
+        loadQueue();
+        if (branchesVisible) loadBranches(); // refresh branch truth on return
+      }
+    });
+
+    observeVisibility();
+}