@tokenoftrust/storefront-runner 1.4.0 → 1.4.2-rc.0

package/apps/storefront/src/components/admin/AdminPublishTab.astro

@@ -6,9 +6,10 @@
  *
  *   - OPEN CHANGE QUEUE from GET /api/changes ({ current, changes }) with
  *     per-change reconcile/compliance state, preview link, head sha, and age.
- *   - GO LIVE (POST /api/changes/accept with expectedHeadSha — the stale-head
- *     "superseded" refusal and the audit record are surfaced legibly) and
- *     REJECT (with a note) per change.
+ *   - ACCEPT TO PREVIEW (POST /api/changes/integrate — b11's accept-to-preview
+ *     split; advances the shared `preview` aggregate, does NOT go live) and
+ *     REJECT (with a note) per change. Going live is the aggregate card's
+ *     exact-digest PUBLISH (POST /api/changes/ship), never a per-change accept.
  *   - LIVE STATE: the current live version (live-channel pointer) + the
  *     static-republish dispatch status for static-publish tenants (fired /
  *     skipped / sink-unbound notice).
@@ -31,10 +32,12 @@ import { readViewerSession } from "@/lib/auth/route";
 import { withBase } from "@/lib/basePath";
 import { readEnv } from "@/lib/env";
 import { resolveViewerShipCapability } from "@/lib/change";
+import { resolveLiveVersion } from "@/lib/change/liveVersion";
+import { isPublicSiteCurrent } from "@/lib/change/liveDigest";
 import { isHostedStoreDomain, isInternalTestTenant } from "@tot/public-runtime";
 
 const { envelope } = Astro.props;
-const { tenant, basePath, cspNonce } = Astro.locals;
+const { tenant, basePath } = Astro.locals;
 
 // Viewer capability, mirrored from the same session model the API routes gate
 // on (resolveOwnerSession admits capability owner|admin). UX-only: the server
@@ -77,8 +80,36 @@ const staticPublishEnabled = Boolean(
 // Presence-only signal for the T5 dispatch sink (never the value).
 const dispatchConfigured = Boolean((await readEnv("WWW_PUBLISH_DISPATCH_TOKEN"))?.trim());
 
+// "What does the public site actually serve right now?" — the read-back half of
+// the static-publish seam (resolveLiveVersion's staticLiveDigest), computed here
+// so it's ALWAYS visible rather than only living in GET /api/changes JSON. This is
+// the exact gap that let tokenoftrust.com's public site (preview.tokenoftrust.com)
+// sit two days stale behind several accepted-but-unpublished changes with nothing
+// in the console calling it out — going live and staying live for the PUBLIC
+// static target are two different facts, and this card makes the second one
+// honest instead of assumed. Best-effort: resolveLiveVersion never throws.
+// BUDGETED: resolveLiveVersion chains several TENANT_CACHE reads (resolvePreviewTenant,
+// resolveChannelVersion, readSiteVersion) that are pathologically slow + variable on the
+// preview worker (measured 2-10s EACH, spiking together — a KV/storage-latency issue, not
+// this code). It runs in blocking SSR frontmatter, so it gated the whole admin document
+// stream. It's best-effort display chrome ("what does live/ serve right now"), and the
+// client-side GET /api/changes already returns `current`, so cap it: on timeout the card
+// renders from the client fetch instead of blocking first paint.
+const liveVersion = staticPublishEnabled
+  ? await Promise.race([
+      resolveLiveVersion(tenant.appDomain),
+      new Promise<null>((resolve) => setTimeout(() => resolve(null), 1500)),
+    ])
+  : null;
+const publicSiteDigest = liveVersion?.staticLiveDigest ?? null;
+// The actual verdict: does the public target's manifest sha match what was last
+// promoted to "live" here? Both are real tenant Gitea shas (dg5) — a direct,
+// honest comparison, not a heuristic. See liveDigest.ts's isPublicSiteCurrent.
+const publicSiteVerdict = publicSiteDigest
+  ? isPublicSiteCurrent(liveVersion?.versionId ?? null, publicSiteDigest)
+  : null;
+
 const changesEndpoint = withBase(basePath || "", "/api/changes");
-const acceptEndpoint = withBase(basePath || "", "/api/changes/accept");
 // b11 — the branch-integration lifecycle SPLIT of accept from publish:
 //   - integrateEndpoint = b08's "accept = integrate into the protected preview
 //     aggregate" (POST /api/changes/integrate → TenantIntegrationQueue.enqueue).
@@ -97,13 +128,25 @@ const shipEndpoint = withBase(basePath || "", "/api/changes/ship");
 // U7 — retire/GC: evict a candidate's ReviewEnvironment + version (rebuildable),
 // DISTINCT from reject (which closes the change). Gated server-side by retireGate.
 const retireEndpoint = withBase(basePath || "", "/api/preview/retire");
+// rux5 — build-on-demand for a synthetic not-built PR row: materialize the PR's
+// hosted preview (INERT — flips no live channel). Gated server-side by buildGate
+// (the ship-on-behalf floor); the endpoint resolves the head sha via forge PR-read
+// when the row supplies only the PR number.
+const buildEndpoint = withBase(basePath || "", "/api/preview/build");
 // dg7 — the ship-operations workspace woven into this tab: versions/promotion
 // history, per-candidate diff, and rollback (through the ONE rollback
 // orchestrator). Read endpoints mirror the change-queue's auth/scope.
 const versionsEndpoint = withBase(basePath || "", "/api/changes/versions");
 const rollbackEndpoint = withBase(basePath || "", "/api/changes/rollback");
+// b17 — branch retention: GET dry-run classification / POST guarded delete.
+// DISTINCT endpoint from retireEndpoint above (branch delete vs artifact evict).
+const branchesEndpoint = withBase(basePath || "", "/api/changes/branches");
 // The client builds `${diffEndpointBase}/<changeId>/diff` per candidate.
 const diffEndpointBase = changesEndpoint;
+// The live store's root on THIS surface (basePath-aware): where the published
+// digest actually serves. Rendered into "already live" copy + the publish
+// ceremony's "View your live store" CTA.
+const liveHref = withBase(basePath || "", "/");
 const domainStatusEndpoint = withBase(basePath || "", "/api/domain/status");
 const domainDispatchEndpoint = withBase(basePath || "", "/api/domain/dispatch");
 // u9: the machine-verifiable apex-cutover readiness gate — the SAME server gate the
@@ -120,18 +163,20 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
   data-agent-scope="publish"
   role="tabpanel"
   data-changes-endpoint={changesEndpoint}
-  data-accept-endpoint={acceptEndpoint}
   data-integrate-endpoint={integrateEndpoint}
   data-ship-endpoint={shipEndpoint}
   data-retire-endpoint={retireEndpoint}
+  data-build-endpoint={buildEndpoint}
   data-versions-endpoint={versionsEndpoint}
   data-rollback-endpoint={rollbackEndpoint}
+  data-branches-endpoint={branchesEndpoint}
   data-diff-endpoint-base={diffEndpointBase}
   data-domain-status-endpoint={domainStatusEndpoint}
   data-domain-dispatch-endpoint={domainDispatchEndpoint}
   data-domain-readiness-endpoint={domainReadinessEndpoint}
   data-repo={tenant.appDomain}
   data-app-domain={tenant.appDomain}
+  data-live-href={liveHref}
   data-can-ship={viewerCanShip ? "true" : "false"}
   data-is-owner={viewerIsOwner ? "true" : "false"}
   data-entitled={goLiveEntitled ? "true" : "false"}
@@ -202,6 +247,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
       <span>Published</span>
       <strong data-publish-live-at>—</strong>
       <small>When the live version last changed</small>
+      <small data-publish-live-shipped-by></small>
     </div>
     <div class="metric">
       <span>Open changes</span>
@@ -225,6 +271,59 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     </div>
   )}
 
+  <!-- Public-site status — the READ-BACK half of the static-publish seam
+       (resolveLiveVersion's staticLiveDigest), made visible instead of only
+       existing in API JSON. Distinct from "Live version" above: that's the
+       CONTROL-PLANE record of what was promoted; this is what the external
+       target (CloudFront/S3) is HONESTLY observed serving right now — the two
+       can diverge (a stale/failed republish job) with nothing else in this
+       console able to tell you. Answers "did going live actually reach the
+       public site?" without a manual curl. -->
+  {staticPublishEnabled && publicSiteDigest && publicSiteVerdict && (
+    <div
+      class={`risk-alert ${publicSiteVerdict.status === "current" ? "public-site-ok" : "amber"}`}
+      data-publish-public-site
+    >
+      <div class="risk-alert-main">
+        <svg><use href={publicSiteVerdict.status === "current" ? "#i-check" : "#i-alert"}></use></svg>
+        <div>
+          {publicSiteVerdict.status === "current" ? (
+            <>
+              <b>Public site is up to date</b>
+              <span>
+                <code>{tenant.appDomain}</code>'s public target is serving the same commit
+                (<code class="publish-mono">{liveVersion?.versionId?.slice(0, 12)}</code>)
+                as the hosted store's live pointer. Publishing live above
+                republishes it automatically — usually within a few minutes.
+              </span>
+            </>
+          ) : publicSiteVerdict.status === "behind" ? (
+            <>
+              <b>Public site is behind the hosted store's live pointer</b>
+              <span>
+                <code>{tenant.appDomain}</code>'s public target is still serving{" "}
+                <code class="publish-mono">{publicSiteVerdict.publishedSha.slice(0, 12)}</code>, but
+                the hosted store's live pointer has since moved to{" "}
+                <code class="publish-mono">{publicSiteVerdict.livePointerSha.slice(0, 12)}</code>.
+                The republish job hasn't caught up yet (or a go-live happened before it was enabled) —
+                check the workflow run, or trigger a fresh go-live to re-dispatch it.
+              </span>
+            </>
+          ) : (
+            <>
+              <b>Couldn't verify the public site is current</b>
+              <span>
+                Checked <code class="publish-mono">{publicSiteDigest.url}</code>: {publicSiteVerdict.reason}.
+                This does NOT mean the hosted store's own "Live version" above is wrong, only that the
+                separate public static target couldn't be confirmed current.
+              </span>
+            </>
+          )}
+        </div>
+      </div>
+    </div>
+  )}
+
   <div class="panel">
     <div class="panel-head">
       <h3><svg><use href="#i-export"></use></svg>Candidate queue</h3>
@@ -232,6 +331,23 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     </div>
     <div class="panel-body grid">
       <p class="note publish-status" data-publish-status role="status" aria-live="polite"></p>
+      <!-- rux1: forge-listing degraded strip. Shown ONLY when GET /api/changes
+           reports `degraded` (the open-PR listing failed) — distinct from the
+           genuine empty queue, so a forge blip never reads as "No open changes". -->
+      <div class="risk-alert" data-publish-degraded hidden role="alert">
+        <div class="risk-alert-main">
+          <svg><use href="#i-alert"></use></svg>
+          <div>
+            <b>Some open changes may not be shown</b>
+            <span>
+              We couldn't reach the pull-request list, so open changes that haven't been
+              built yet may be missing from the queue below. Built candidates are
+              unaffected. Refresh to try again.
+            </span>
+          </div>
+        </div>
+      </div>
+      <p class="note publish-pr-callout" data-publish-pr-callout hidden role="status" aria-live="polite"></p>
       <div class="table-wrap">
         <table class="publish-table">
           <thead>
@@ -265,7 +381,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
        candidates integrate into, its combined evidence (the last integration
        run's honest state), and the exact-digest Publish (b09/b10 ship the
        reviewed pinned SHA + digest, never a rebuild). -->
-  <div class="panel" data-publish-aggregate>
+  <div class="panel agg-console" data-publish-aggregate>
     <div class="panel-head">
       <h3><svg><use href="#i-box"></use></svg>Preview aggregate</h3>
       <span class="chip" data-aggregate-chip>Loading</span>
@@ -273,44 +389,137 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     <div class="panel-body grid">
       <p class="note publish-status" data-aggregate-status role="status" aria-live="polite"></p>
 
-      <div class="grid cols-3">
-        <div class="field">
-          <label>Aggregate build</label>
-          <strong class="publish-mono" data-aggregate-sha>—</strong>
-          <p data-aggregate-run-link>The current green preview build for this store.</p>
+      <!-- AI-assembled release summary — a plain-language "what am I about to
+           publish?" ahead of the technical trust chain. Rendered ONLY when the
+           server supplies data.releaseSummary; otherwise it stays hidden and the
+           panel degrades to today's behavior (graceful fallback). -->
+      <div class="agg-summary" data-aggregate-summary hidden>
+        <div class="agg-summary-head">
+          <span class="agg-summary-glyph" aria-hidden="true">
+            <svg viewBox="0 0 24 24" fill="currentColor"><path d="M12 2l1.9 4.7L18.5 8.6l-4.6 1.9L12 15.2l-1.9-4.7L5.5 8.6l4.6-1.9L12 2z"></path><path d="M18.5 14l.9 2.2 2.3.9-2.3.9-.9 2.2-.9-2.2-2.3-.9 2.3-.9.9-2.2z"></path></svg>
+          </span>
+          <span class="agg-summary-label">What&rsquo;s in this release</span>
+          <span class="agg-ai-chip">
+            <svg viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M12 2l1.9 4.7L18.5 8.6l-4.6 1.9L12 15.2l-1.9-4.7L5.5 8.6l4.6-1.9L12 2z"></path></svg>
+            AI summary
+          </span>
+        </div>
+        <p class="agg-summary-lead" data-aggregate-summary-lead></p>
+        <ul class="agg-summary-points" data-aggregate-summary-points></ul>
+      </div>
+
+      <!-- Chain of custody: the build that was verified → its combined evidence →
+           the digest that ships. The reviewed digest wears an accented token so
+           the eye can track that exactly what was reviewed is what goes live. The
+           three values keep their original data hooks (sha / evidence / digest). -->
+      <div class="agg-chain">
+        <div class="agg-stop">
+          <span class="agg-stop-label">Aggregate build</span>
+          <span class="agg-stop-val"><strong class="publish-mono" data-aggregate-sha>—</strong></span>
+          <p class="agg-stop-cap" data-aggregate-run-link>The current green preview build for this store.</p>
+        </div>
+        <div class="agg-link" aria-hidden="true">
+          <span class="agg-flowlabel">verified by</span>
+          <span class="agg-arrow"><svg viewBox="0 0 34 10" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M1 5h29m0 0-4-4m4 4-4 4"></path></svg></span>
         </div>
-        <div class="field">
-          <label>Combined evidence</label>
-          <strong data-aggregate-evidence>—</strong>
-          <p data-aggregate-evidence-detail>The last integration run's verdict.</p>
+        <div class="agg-stop">
+          <span class="agg-stop-label">Combined evidence</span>
+          <span class="agg-stop-val"><strong data-aggregate-evidence>—</strong></span>
+          <p class="agg-stop-cap" data-aggregate-evidence-detail>The last integration run's verdict.</p>
         </div>
-        <div class="field">
-          <label>Reviewed digest</label>
-          <strong class="publish-mono" data-aggregate-digest>—</strong>
-          <p>The content digest that will be published — exactly what you reviewed.</p>
+        <div class="agg-link" aria-hidden="true">
+          <span class="agg-flowlabel">produces</span>
+          <span class="agg-arrow"><svg viewBox="0 0 34 10" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M1 5h29m0 0-4-4m4 4-4 4"></path></svg></span>
+        </div>
+        <div class="agg-stop">
+          <span class="agg-stop-label">Reviewed digest</span>
+          <span class="agg-stop-val"><strong class="publish-mono agg-digest" data-aggregate-digest>—</strong></span>
+          <p class="agg-stop-cap">The content digest that will be published — exactly what you reviewed.</p>
         </div>
       </div>
 
-      <!-- Included PRs — the batch this aggregate composes (b01 includedPrs). -->
-      <div class="aggregate-prs" data-aggregate-prs-wrap hidden>
-        <b>Included changes</b>
-        <ul class="aggregate-prs-list" data-aggregate-prs></ul>
+      <!-- Included PRs — the batch this aggregate composes (b01 includedPrs). u14:
+           the "missing middle" — this is the STAGED delta vs live. The title + note
+           narrate how far ahead of the live site the staged preview is, and each row
+           carries an Undo (per-change revert) to roll the staged preview backward. -->
+      <div class="aggregate-prs agg-staged" data-aggregate-prs-wrap hidden>
+        <div class="agg-staged-head">
+          <b data-aggregate-prs-title>Included changes</b>
+          <!-- Scope-of-change risk measure across the whole staged batch (total
+               files + lines). Populated by renderAggregate from data.stagedScope;
+               hidden when no staged change carries size stats. -->
+          <span class="agg-scope" data-aggregate-scope hidden></span>
+        </div>
+        <!-- Staged → live delta strip: staged aggregate sha ahead of the live
+             pointer. Populated by renderAggregate; hidden when nothing is ahead. -->
+        <div class="agg-delta-strip" data-aggregate-delta-strip hidden>
+          <span class="agg-delta-node">
+            <span class="agg-stop-label">Staged preview</span>
+            <span class="sha-token" data-agg-delta-staged>—</span>
+          </span>
+          <span class="agg-delta-mid" aria-hidden="true">
+            <span class="agg-delta-count" data-agg-delta-count></span>
+            <svg viewBox="0 0 26 10" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M1 5h21m0 0-4-4m4 4-4 4"></path></svg>
+          </span>
+          <span class="agg-delta-node">
+            <span class="agg-stop-label">Live site</span>
+            <span class="sha-token ghost" data-agg-delta-live>—</span>
+          </span>
+        </div>
+        <p class="note" data-aggregate-delta-note hidden></p>
+        <ul class="aggregate-prs-list agg-changes" data-aggregate-prs></ul>
       </div>
 
       <!-- The exact-digest Publish plan (b09 plan()): pinned SHA + digest +
            included PRs + rollback target + paywall verdict + run link. Shown
            inline (from GET /api/changes `plan`) so the confirm never POSTs to
            preview. Publish is refused until the plan is `ok`. -->
-      <div class="aggregate-plan" data-aggregate-plan hidden>
-        <div class="aggregate-plan-head">
-          <b>Publish plan</b>
+      <div class="aggregate-plan agg-manifest" data-aggregate-plan hidden>
+        <div class="aggregate-plan-head agg-manifest-head">
+          <b><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M9 11l3 3L22 4"></path><path d="M21 12v7a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h11"></path></svg>Publish plan</b>
           <span class="chip" data-aggregate-plan-chip></span>
         </div>
         <dl class="aggregate-plan-grid" data-aggregate-plan-grid></dl>
+
+        <!-- Openable "Included changes": each accepted PR as a line item with its
+             human title, a one-line description of what it does, and meta (sha /
+             files / who + when). Populated by renderPlan; degrades to a bare count
+             when per-change titles/descriptions aren't available. The <details>
+             element is static so its open/closed state survives a poll re-render —
+             only the list contents are replaced. -->
+        <div class="agg-included" data-aggregate-plan-included hidden>
+          <details class="agg-included-details">
+            <summary>
+              <span class="agg-included-lead">Included changes</span>
+              <span class="agg-included-badge" data-aggregate-plan-included-count>0</span>
+              <span class="agg-included-hint" data-aggregate-plan-included-hint></span>
+              <span class="agg-chev" aria-hidden="true"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"><path d="M9 6l6 6-6 6"></path></svg></span>
+            </summary>
+            <ul class="agg-included-list" data-aggregate-plan-included-list></ul>
+          </details>
+        </div>
+
         <p class="note" data-aggregate-plan-note></p>
       </div>
 
-      <div class="check-row">
+      <!-- u15 — retry a DEAD rebuild (no new merge). Shown only while the aggregate
+           is red: a candidate's PR already merged into preview, but the
+           build/evidence step that follows died (e.g. a transient MCP error) — this
+           retries ONLY that step, against the sha the forge already carries. -->
+      <div class="check-row" data-aggregate-retry-row hidden>
+        <div>
+          <b>Retry the build</b>
+          <p>
+            The last merge landed on preview, but rebuilding it failed. Retry re-runs
+            the build + evidence check alone — no new merge, no membership change.
+          </p>
+        </div>
+        <button class="btn" type="button" data-aggregate-retry-build>
+          <svg><use href="#i-refresh"></use></svg>Retry build
+        </button>
+      </div>
+
+      <div class="check-row agg-launch">
         <div>
           <b>Publish the reviewed build to your live store</b>
           <p data-aggregate-publish-detail>
@@ -318,7 +527,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
             aggregate is green and its integration run passed.
           </p>
         </div>
-        <button class="btn primary" type="button" data-aggregate-publish disabled>
+        <button class="btn primary agg-publish-btn" type="button" data-aggregate-publish disabled>
           <svg><use href="#i-export"></use></svg>Publish live
         </button>
       </div>
@@ -335,6 +544,11 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     <div class="panel-body grid">
       <p class="note publish-status" data-versions-status role="status" aria-live="polite"></p>
       <p class="note" data-versions-rollback-note hidden></p>
+      <!-- u14: orients the owner between the staged aggregate above and live versions
+           below — "N staged change(s) not yet published; Publish live creates the next
+           version here." Owned by renderAggregate (its own element, so its timing never
+           races renderVersions). -->
+      <p class="note" data-versions-orientation hidden></p>
       <div class="table-wrap">
         <table class="publish-table versions-table">
           <thead>
@@ -357,6 +571,59 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     </div>
   </div>
 
+  <!-- b17: branch retention — Admin visibility into the branch-lifecycle
+       contract's "Candidate branch retirement" table (P1 items 8/9/11). Reads
+       the guarded `candidate_list` classification (protected/active-open/
+       stale-open/integrated/closed-or-rejected/orphan) and, for a branch that
+       classifies as ready, runs the guarded `candidate_delete` — which
+       re-classifies fresh server-side and refuses anything not integrated or
+       closed-or-rejected, no matter what this panel last rendered. DISTINCT
+       from the "Retire" action in the candidate queue above: retire evicts a
+       hosted PREVIEW ARTIFACT (rebuildable); this panel deletes a Git BRANCH
+       (transport only, never the durable record — see the note below). An
+       orphan is always shown quarantined for review, never one-click deletable. -->
+  <div class="panel" data-publish-branches>
+    <div class="panel-head">
+      <h3><svg><use href="#i-workflows"></use></svg>Branch retention</h3>
+      <span class="chip" data-branches-chip>Loading</span>
+    </div>
+    <div class="panel-body grid">
+      <p class="note">
+        Cleans up candidate <b>branches</b> once their pull request is merged or
+        closed — a different action on a different object than <b>Retire</b> in
+        the queue above, which only evicts a hosted preview build (rebuildable
+        on demand, never a branch). Every classification below is a fresh
+        dry-run; <b>Sweep dead branches</b> lists exactly what it will delete and
+        asks once to confirm, then the server re-checks each ref fresh before
+        removing it.
+      </p>
+      <p class="note publish-status" data-branches-status role="status" aria-live="polite"></p>
+      <div class="toolbar" data-branches-actions hidden>
+        <button type="button" class="btn" data-branches-sweep>Sweep dead branches</button>
+      </div>
+      <div class="table-wrap">
+        <table class="publish-table">
+          <thead>
+            <tr>
+              <th>Branch</th>
+              <th>Classification</th>
+              <th>PR</th>
+              <th>Tip commit</th>
+              <th>Age</th>
+              <th>Evidence</th>
+              <th class="action">Actions</th>
+            </tr>
+          </thead>
+          <tbody data-branches-body>
+            <tr data-branches-placeholder>
+              <td colspan="7"><span class="subtle">Loading branch classification…</span></td>
+            </tr>
+          </tbody>
+        </table>
+      </div>
+    </div>
+  </div>
+
   {staticPublishEnabled && (
     <div class="panel" data-publish-domain>
       <div class="panel-head">
@@ -449,1284 +716,194 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
       </div>
     </div>
   )}
+
+  <!-- Accept-to-preview LIFTOFF — the plan confirm + live integration flight +
+       outcome ceremony. One dialog, three phases (plan → flight → outcome).
+       The flight's stage rail advances ONLY on real signals (the in-flight POST
+       plus GET /api/changes polling — includedPrs / activeRun / aggregateSha);
+       nothing is simulated. Replaces the old window.confirm() plan popup. -->
+  <div class="liftoff-backdrop" data-liftoff hidden>
+    <div class="liftoff-card" role="dialog" aria-modal="true" aria-labelledby="liftoff-title" tabindex="-1">
+      <div class="liftoff-phase" data-liftoff-plan>
+        <p class="liftoff-kicker">Accept to preview</p>
+        <h3 class="liftoff-title" id="liftoff-title" data-liftoff-title>Integrate into preview</h3>
+        <dl class="liftoff-grid" data-liftoff-grid></dl>
+        <p class="note">
+          Integrates this candidate into the protected <code>preview</code> aggregate, then
+          rebuilds it and re-runs its combined evidence. <b>Nothing goes live</b> —
+          publishing the reviewed build stays a separate, explicit step.
+        </p>
+        <div class="liftoff-actions">
+          <button class="btn" type="button" data-liftoff-cancel>Cancel</button>
+          <button class="btn primary" type="button" data-liftoff-proceed>
+            <svg><use href="#i-check"></use></svg>Integrate into preview
+          </button>
+        </div>
+      </div>
+
+      <div class="liftoff-phase" data-liftoff-flight hidden>
+        <p class="liftoff-kicker">Integration in flight</p>
+        <h3 class="liftoff-title" data-liftoff-flight-title>Integrating…</h3>
+        <ol class="liftoff-stages">
+          <li data-liftoff-stage="merge">
+            <span class="liftoff-dot"></span>
+            <div><b>Merge</b><span>squash-merge the candidate into <code>preview</code></span></div>
+          </li>
+          <li data-liftoff-stage="build">
+            <span class="liftoff-dot"></span>
+            <div><b>Rebuild</b><span>build the combined preview aggregate</span></div>
+          </li>
+          <li data-liftoff-stage="evidence">
+            <span class="liftoff-dot"></span>
+            <div><b>Evidence</b><span>re-run the aggregate's combined checks</span></div>
+          </li>
+          <li data-liftoff-stage="green">
+            <span class="liftoff-dot"></span>
+            <div><b>Green</b><span>the aggregate becomes the reviewable, shippable build</span></div>
+          </li>
+        </ol>
+        <p class="liftoff-live" data-liftoff-live role="status" aria-live="polite">Working…</p>
+        <div class="liftoff-meta">
+          <span class="publish-mono" data-liftoff-elapsed>0:00</span>
+          <button class="btn" type="button" data-liftoff-hide>Continue in background</button>
+        </div>
+      </div>
+
+      <div class="liftoff-phase liftoff-outcome-phase" data-liftoff-outcome hidden>
+        <div class="liftoff-seal" data-liftoff-seal aria-hidden="true"></div>
+        <h3 class="liftoff-title" data-liftoff-outcome-title></h3>
+        <p class="note" data-liftoff-outcome-detail></p>
+        <!-- Merge-conflict recovery (shown ONLY for reason "merge_failed") — decision
+             `automate-first-conflict-recovery` (u4): the refusal LEADS with one primary
+             action ("Update this change automatically" → /resolve strategy:"merge",
+             then auto-re-integrate). The three option cards appear only when diff3 hits
+             a genuine same-line overlap (RefreshResult.unresolved); the old terminal +
+             AI-agent guidance is demoted VERBATIM into the collapsed "Do it manually
+             instead" expert section (nothing removed). Decision logic lives in the
+             tested `resolveConflict.ts`; this glue mirrors it (verified on preview). -->
+        <div class="liftoff-conflict" data-liftoff-conflict hidden>
+          <p class="note liftoff-conflict-summary" data-conflict-summary hidden></p>
+
+          <!-- PRIMARY ACTION — always first when a candidate is refused not-mergeable. -->
+          <div class="liftoff-conflict-primary" data-conflict-primary>
+            <p class="note" data-conflict-primary-note>
+              We can rebuild your change on top of the store's current version and
+              re-integrate it for you — no terminal, no re-submit.
+            </p>
+            <button class="btn primary" type="button" data-conflict-auto>Update this change automatically</button>
+            <p class="note liftoff-conflict-primary-status" data-conflict-primary-status role="status" aria-live="polite" hidden></p>
+          </div>
+
+          <!-- OPTION CARDS — revealed only on a genuine same-line overlap diff3 can't
+               safely auto-pick. Static nodes mirror CONFLICT_OPTION_CARDS. -->
+          <div class="liftoff-conflict-cards" data-conflict-cards hidden>
+            <p class="note" data-conflict-cards-intro>
+              Some of the same lines were changed on both sides, so there's no single safe
+              answer. Pick how to resolve the overlap:
+            </p>
+            <ul class="liftoff-conflict-files publish-mono" data-conflict-files></ul>
+            <div class="liftoff-conflict-card-grid" role="group" aria-label="Resolve the overlap">
+              <button class="liftoff-option-card" type="button" data-conflict-card data-strategy="merge" data-recommended="1">
+                <b>Combine both</b>
+                <span>Recommended — weave both sets of edits together</span>
+              </button>
+              <button class="liftoff-option-card" type="button" data-conflict-card data-strategy="ours">
+                <b>Keep my change</b>
+                <span>Use your edits on the conflicting lines</span>
+              </button>
+              <button class="liftoff-option-card" type="button" data-conflict-card data-strategy="theirs">
+                <b>Keep the store's current version</b>
+                <span>Use the store's edits on the conflicting lines</span>
+              </button>
+            </div>
+            <p class="note liftoff-conflict-cards-status" data-conflict-cards-status role="status" aria-live="polite" hidden></p>
+          </div>
+
+          <!-- EXPERT FALLBACK — the ORIGINAL terminal + AI-agent guidance, verbatim,
+               collapsed. Nothing deleted; just demoted from primary to fallback. -->
+          <details class="liftoff-conflict-expert" data-conflict-expert>
+            <summary>Do it manually instead</summary>
+            <p class="note" data-conflict-intro>
+              From the store checkout that submitted this change, bring it up to date and
+              re-submit — the open PR updates in place. Once the new build is ready,
+              finish here with <b>Integrate into preview</b>, or from the terminal with
+              <code>tot accept --tenant &lt;store&gt; --pr &lt;N&gt;</code>.
+              Check <code>git status</code> first — abort any half-finished rebase from an
+              earlier attempt. Then <code>tot pr</code>: this change should be marked
+              <code>(active)</code>, proving you're in the right checkout and branch.
+              If git reports an authentication failure, run <code>tot login</code> and retry.
+            </p>
+            <pre class="liftoff-commands publish-mono" data-conflict-commands></pre>
+            <div class="liftoff-conflict-actions">
+              <button class="btn" type="button" data-conflict-copy-prompt>Copy prompt for your AI agent</button>
+              <button class="btn" type="button" data-conflict-copy>Copy commands</button>
+            </div>
+            <p class="liftoff-conflict-raw publish-mono" data-conflict-raw></p>
+          </details>
+        </div>
+        <div class="liftoff-actions">
+          <a class="btn" data-liftoff-review target="_blank" rel="noopener" hidden>Review the preview build</a>
+          <button class="btn primary" type="button" data-liftoff-done>Done</button>
+        </div>
+      </div>
+
+      <div class="liftoff-confetti" data-liftoff-confetti aria-hidden="true"></div>
+    </div>
+  </div>
+
+  <!-- Publish-live ceremony — the go-live counterpart of the accept liftoff
+       (same shell/styles). Plan states the exact digest + no-rebuild contract;
+       flight is a single honest in-flight state (one POST, no staged theater);
+       outcome celebrates with a real "View your live store" link. Replaces the
+       raw window.confirm() publish popup. -->
+  <div class="liftoff-backdrop" data-shipoff hidden>
+    <div class="liftoff-card" role="dialog" aria-modal="true" aria-labelledby="shipoff-title" tabindex="-1">
+      <div class="liftoff-phase" data-shipoff-plan>
+        <p class="liftoff-kicker">Publish live</p>
+        <h3 class="liftoff-title" id="shipoff-title">Publish the reviewed build to your live store</h3>
+        <dl class="liftoff-grid" data-shipoff-grid></dl>
+        <p class="note">
+          Publishes this <b>exact reviewed digest</b> — no rebuild, nothing rides along.
+          Your live store updates in about a second; rolling back re-publishes the prior
+          version from the archive.
+        </p>
+        <div class="liftoff-actions">
+          <button class="btn" type="button" data-shipoff-cancel>Cancel</button>
+          <button class="btn primary" type="button" data-shipoff-proceed>
+            <svg><use href="#i-export"></use></svg>Publish live
+          </button>
+        </div>
+      </div>
+
+      <div class="liftoff-phase" data-shipoff-flight hidden>
+        <p class="liftoff-kicker">Publishing</p>
+        <h3 class="liftoff-title">Promoting the reviewed digest…</h3>
+        <p class="liftoff-live" data-shipoff-live role="status" aria-live="polite">
+          Pinning the exact reviewed build to your live channel…
+        </p>
+        <div class="liftoff-meta">
+          <span class="publish-mono" data-shipoff-elapsed>0:00</span>
+        </div>
+      </div>
+
+      <div class="liftoff-phase liftoff-outcome-phase" data-shipoff-outcome hidden>
+        <div class="liftoff-seal" data-shipoff-seal aria-hidden="true"></div>
+        <h3 class="liftoff-title" data-shipoff-outcome-title></h3>
+        <p class="note" data-shipoff-outcome-detail></p>
+        <div class="liftoff-actions">
+          <a class="btn primary" data-shipoff-view target="_blank" rel="noopener" hidden>View your live store</a>
+          <button class="btn" type="button" data-shipoff-done>Done</button>
+        </div>
+      </div>
+
+      <div class="liftoff-confetti" data-shipoff-confetti aria-hidden="true"></div>
+    </div>
+  </div>
 </section>
 
-<script is:inline nonce={cspNonce}>
-  (() => {
-    const root = document.getElementById("publish");
-    if (!root) return;
-    const ds = root.dataset;
-    const canShip = ds.canShip === "true";
-    const repo = ds.repo || "";
-    const appDomain = ds.appDomain || "";
-
-    const statusEl = root.querySelector("[data-publish-status]");
-    const queueBody = root.querySelector("[data-publish-queue-body]");
-    const queueChip = root.querySelector("[data-publish-queue-chip]");
-    const queueCount = root.querySelector("[data-publish-queue-count]");
-
-    const setStatus = (el, message, state) => {
-      if (!el) return;
-      el.textContent = message || "";
-      if (state) el.dataset.state = state;
-      else delete el.dataset.state;
-    };
-
-    const shortSha = (sha) => (sha ? String(sha).slice(0, 8) : "—");
-
-    const age = (iso) => {
-      if (!iso) return "—";
-      const ms = Date.now() - new Date(iso).getTime();
-      if (!Number.isFinite(ms) || ms < 0) return "—";
-      const mins = Math.floor(ms / 60000);
-      if (mins < 1) return "just now";
-      if (mins < 60) return mins + "m ago";
-      const hours = Math.floor(mins / 60);
-      if (hours < 48) return hours + "h ago";
-      return Math.floor(hours / 24) + "d ago";
-    };
-
-    const STATUS_CHIP = {
-      queued: "",
-      reconciling: "blue",
-      ready: "green",
-      blocked: "red",
-    };
-
-    const chip = (text, tone) => {
-      const el = document.createElement("span");
-      el.className = "chip" + (tone ? " " + tone : "");
-      el.textContent = text;
-      return el;
-    };
-
-    const cell = (...children) => {
-      const td = document.createElement("td");
-      for (const child of children) {
-        if (child == null) continue;
-        td.append(typeof child === "string" ? document.createTextNode(child) : child);
-      }
-      return td;
-    };
-
-    const subtle = (text) => {
-      const el = document.createElement("span");
-      el.className = "subtle";
-      el.textContent = text;
-      return el;
-    };
-
-    // ---- Open change queue -------------------------------------------------
-
-    const renderQueue = (payload) => {
-      const changes = Array.isArray(payload.changes) ? payload.changes : [];
-      queueBody.textContent = "";
-      if (queueCount) queueCount.textContent = String(changes.length);
-      if (queueChip) {
-        queueChip.textContent = changes.length === 1 ? "1 open" : changes.length + " open";
-        queueChip.className = "chip" + (changes.length ? " blue" : "");
-      }
-
-      if (!changes.length) {
-        const tr = document.createElement("tr");
-        const td = cell(
-          subtle(
-            "No open changes. New store changes appear here when a developer submits them for review.",
-          ),
-        );
-        td.colSpan = 6;
-        tr.append(td);
-        queueBody.append(tr);
-        return;
-      }
-
-      for (const change of changes) {
-        const tr = document.createElement("tr");
-
-        // Change id + branch / PR + preview link.
-        const idCell = document.createElement("td");
-        const idStrong = document.createElement("strong");
-        idStrong.textContent = change.changeId || "—";
-        idCell.append(idStrong);
-        const meta = [];
-        if (change.branch) meta.push(change.branch);
-        if (change.prNumber != null) meta.push("PR #" + change.prNumber);
-        if (meta.length) idCell.append(subtle(meta.join(" · ")));
-        if (change.previewUrl) {
-          const preview = document.createElement("a");
-          preview.href = change.previewUrl;
-          preview.target = "_blank";
-          preview.rel = "noopener";
-          preview.textContent = "Open preview";
-          const wrap = document.createElement("span");
-          wrap.className = "subtle";
-          wrap.append(preview);
-          idCell.append(wrap);
-        }
-        tr.append(idCell);
-
-        // Reconcile status.
-        const statusCell = cell(
-          chip(change.status || "unknown", STATUS_CHIP[change.status] ?? "amber"),
-        );
-        if (change.lastError) statusCell.append(subtle(change.lastError));
-        tr.append(statusCell);
-
-        // Evidence / compliance verdict.
-        const checks = (change.evidence && change.evidence.checks) || [];
-        const failing = checks.filter((c) => c.status === "fail");
-        const promotable = Boolean(change.evidence && change.evidence.promotable);
-        const checksCell = cell(
-          promotable ? chip("Checks passed", "green") : chip("Checks blocked", "amber"),
-        );
-        if (failing.length) {
-          checksCell.append(subtle("Failing: " + failing.map((c) => c.label || c.id).join(", ")));
-        } else if (!checks.length) {
-          checksCell.append(subtle("No checks reported yet"));
-        }
-        tr.append(checksCell);
-
-        // Head sha + age.
-        const headCell = cell(shortSha(change.headSha));
-        headCell.classList.add("publish-mono");
-        tr.append(headCell);
-        tr.append(cell(age(change.updatedAt)));
-
-        // Actions.
-        const actions = document.createElement("td");
-        actions.className = "action publish-actions";
-        // dg7 Diff: read-only, available to any viewer who can see the queue.
-        const diffBtn = document.createElement("button");
-        diffBtn.type = "button";
-        diffBtn.className = "btn";
-        diffBtn.textContent = "Diff";
-        diffBtn.title = "Show what changed vs the live version";
-        diffBtn.addEventListener("click", () => toggleDiff(change, diffBtn, tr));
-        actions.append(diffBtn);
-        // b11 SPLIT: the candidate-queue primary action is now ACCEPT TO PREVIEW
-        // (b08 integrate = advance the shared preview aggregate), NOT go-live.
-        // Integrate flips NO live channel, so it has NO paywall (entitled) gate —
-        // it holds only the ship-on-behalf capability floor. Going live is the
-        // aggregate card's Publish action, once the aggregate is green.
-        const accept = document.createElement("button");
-        accept.type = "button";
-        accept.className = "btn primary";
-        accept.textContent = "Accept to preview";
-        accept.disabled = !canShip || !change.mergeable;
-        accept.title = !canShip
-          ? "Requires an owner or admin sign-in"
-          : !change.mergeable
-            ? "This change is not ready to integrate"
-            : "Integrate this change into the preview aggregate (does not go live)";
-        accept.addEventListener("click", () => integrateCandidate(change, accept));
-        actions.append(accept);
-        const reject = document.createElement("button");
-        reject.type = "button";
-        reject.className = "btn";
-        reject.textContent = "Reject";
-        reject.disabled = !canShip;
-        reject.title = canShip ? "Close this change without publishing" : "Requires an owner or admin sign-in";
-        reject.addEventListener("click", () => rejectChange(change, reject));
-        actions.append(reject);
-
-        // U7 Retire/GC: evict this candidate's preview environment + version to
-        // reclaim space. DISTINCT from Reject — retire is reversible-by-rebuild
-        // (U1 build-on-demand + the U2 fallback page rematerialize it), so a
-        // retired PR degrades to "not built yet", not a dead 404.
-        const retire = document.createElement("button");
-        retire.type = "button";
-        retire.className = "btn";
-        retire.textContent = "Retire";
-        retire.disabled = !canShip;
-        retire.title = canShip
-          ? "Evict this preview to reclaim space — rebuildable on demand (not the same as Reject)"
-          : "Requires an owner or admin sign-in";
-        retire.addEventListener("click", () => retireChange(change, retire));
-        actions.append(retire);
-        tr.append(actions);
-
-        queueBody.append(tr);
-      }
-    };
-
-    const renderCurrent = (current) => {
-      const versionEl = root.querySelector("[data-publish-live-version]");
-      const sourceEl = root.querySelector("[data-publish-live-source]");
-      const atEl = root.querySelector("[data-publish-live-at]");
-      if (current && current.versionId) {
-        if (versionEl) versionEl.textContent = shortSha(current.versionId);
-        if (sourceEl) {
-          sourceEl.textContent =
-            (current.source === "commit" ? "Published from a change" : "Published version") +
-            (current.artifactCount != null ? " · " + current.artifactCount + " files" : "");
-        }
-        if (atEl) atEl.textContent = current.createdAt ? age(current.createdAt) : "—";
-      } else {
-        if (versionEl) versionEl.textContent = "Not live yet";
-        if (sourceEl) sourceEl.textContent = "Nothing has been published for this store";
-        if (atEl) atEl.textContent = "—";
-      }
-    };
-
-    const loadQueue = async () => {
-      try {
-        const res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
-        if (res.status === 401 || res.status === 403) {
-          if (queueChip) queueChip.textContent = "Sign-in required";
-          queueBody.textContent = "";
-          const tr = document.createElement("tr");
-          const td = cell(subtle("Sign in as a store owner or admin to view the publish queue."));
-          td.colSpan = 6;
-          tr.append(td);
-          queueBody.append(tr);
-          return;
-        }
-        const data = await res.json();
-        if (!res.ok) {
-          setStatus(statusEl, data.error || "Could not load the change queue (" + res.status + ")", "err");
-          return;
-        }
-        renderCurrent(data.current);
-        renderQueue(data);
-        renderAggregate(data);
-      } catch {
-        setStatus(statusEl, "Could not load the change queue — network error", "err");
-      }
-    };
-
-    // ---- b11: the aggregate card + exact-digest Publish ---------------------
-    // Reads the aggregate/runs/plan projection GET /api/changes now returns
-    // (AggregateCardView + AggregateShipPlanView, built by aggregateView.ts):
-    //   - the aggregate's queueState + build sha + reviewed digest,
-    //   - the COMBINED EVIDENCE = the last integration run's honest state +
-    //     statusMessage (never re-derived),
-    //   - the included-PR batch,
-    //   - the b09 ship PLAN (pinned SHA/digest/PRs/rollback/paywall + run link),
-    //     shown inline so the confirm never has to POST to preview it.
-
-    const aggPanel = root.querySelector("[data-publish-aggregate]");
-    const AGG_STATE_CHIP = {
-      empty: "",
-      queued: "amber",
-      integrating: "blue",
-      green: "green",
-      red: "red",
-      shipped: "green",
-    };
-    // The plan we last rendered — the exact-digest guard the Publish POST sends
-    // back so a stale plan (queue moved / artifact changed) is refused, never
-    // shipped blind.
-    let currentPlan = null;
-
-    const runLink = (revHref, label) => {
-      if (!revHref) return null;
-      const a = document.createElement("a");
-      a.href = revHref;
-      a.target = "_blank";
-      a.rel = "noopener";
-      a.textContent = label || "Open build";
-      return a;
-    };
-
-    const renderAggregate = (data) => {
-      if (!aggPanel) return;
-      const agg = data.aggregate || null;
-      const plan = data.plan || null;
-      currentPlan = plan && plan.ok ? plan : null;
-
-      const chipEl = aggPanel.querySelector("[data-aggregate-chip]");
-      const shaEl = aggPanel.querySelector("[data-aggregate-sha]");
-      const runLinkEl = aggPanel.querySelector("[data-aggregate-run-link]");
-      const evEl = aggPanel.querySelector("[data-aggregate-evidence]");
-      const evDetailEl = aggPanel.querySelector("[data-aggregate-evidence-detail]");
-      const digestEl = aggPanel.querySelector("[data-aggregate-digest]");
-      const prsWrap = aggPanel.querySelector("[data-aggregate-prs-wrap]");
-      const prsList = aggPanel.querySelector("[data-aggregate-prs]");
-      const publishBtn = aggPanel.querySelector("[data-aggregate-publish]");
-      const publishDetail = aggPanel.querySelector("[data-aggregate-publish-detail]");
-
-      const state = (agg && agg.queueState) || "empty";
-      if (chipEl) {
-        chipEl.textContent = state;
-        chipEl.className = "chip " + (AGG_STATE_CHIP[state] || "");
-      }
-      if (shaEl) shaEl.textContent = agg && agg.aggregateSha ? shortSha(agg.aggregateSha) : "—";
-      if (runLinkEl) {
-        runLinkEl.textContent = "";
-        const link = agg && runLink(agg.revHref, "Open build");
-        if (link) runLinkEl.append(link);
-        else runLinkEl.append(document.createTextNode("The current green preview build for this store."));
-      }
-
-      // Combined evidence = the last (or in-flight) integration run's honest state.
-      const lastRun = agg && (agg.activeRun || agg.lastRun);
-      if (evEl) {
-        if (!lastRun) {
-          evEl.textContent = "No runs yet";
-        } else if (lastRun.state === "passed") {
-          evEl.textContent = "Passed";
-        } else if (lastRun.state === "failed") {
-          evEl.textContent = "Failed";
-        } else {
-          evEl.textContent = "Integrating…";
-        }
-      }
-      if (evDetailEl) {
-        evDetailEl.textContent = "";
-        if (lastRun) {
-          const parts = [];
-          if (lastRun.statusMessage) parts.push(lastRun.statusMessage);
-          else if (lastRun.state === "passed") parts.push("Combined evidence passed.");
-          else if (lastRun.state === "failed") parts.push("Combined evidence did not pass.");
-          if (lastRun.finishedAt) parts.push(age(lastRun.finishedAt));
-          evDetailEl.append(document.createTextNode(parts.join(" · ")));
-          const rl = runLink(lastRun.revHref, "Run build");
-          if (rl) {
-            evDetailEl.append(document.createTextNode(" · "));
-            evDetailEl.append(rl);
-          }
-        } else {
-          evDetailEl.append(document.createTextNode("The last integration run's verdict."));
-        }
-      }
-
-      // Reviewed digest: only known once the plan pins it (b09). Never fabricated.
-      if (digestEl) {
-        digestEl.textContent = currentPlan ? shortSha(currentPlan.artifactDigest.replace(/^sha256:/, "")) : "—";
-      }
-
-      // Included PRs.
-      const prs = (agg && agg.includedPrs) || [];
-      if (prsWrap) prsWrap.hidden = prs.length === 0;
-      if (prsList) {
-        prsList.textContent = "";
-        for (const pr of prs) {
-          const li = document.createElement("li");
-          const label = document.createElement("span");
-          label.textContent = pr.prNumber != null ? "PR #" + pr.prNumber : pr.changeId;
-          const sha = document.createElement("span");
-          sha.className = "publish-mono subtle";
-          sha.textContent = shortSha(pr.headSha);
-          li.append(label, sha);
-          prsList.append(li);
-        }
-      }
-
-      renderPlan(data.plan);
-
-      // The Publish button: enabled only for a shippable, paywall-cleared plan and
-      // a viewer who can ship. A paywalled plan is SHOWN (upsell), never hidden.
-      if (publishBtn) {
-        const shippable = Boolean(currentPlan);
-        const paywalled = currentPlan && currentPlan.paywall && !currentPlan.paywall.allowed;
-        publishBtn.disabled = !canShip || !shippable || paywalled || currentPlan.alreadyShipped;
-        publishBtn.title = !canShip
-          ? "Requires an owner or admin sign-in"
-          : !shippable
-            ? "The aggregate is not green / has no passed run to publish yet"
-            : paywalled
-              ? "Publishing to your live store is part of the paid plan"
-              : currentPlan.alreadyShipped
-                ? "This reviewed build is already live"
-                : "Publish the exact reviewed digest to your live store";
-      }
-      if (publishDetail) {
-        if (currentPlan && currentPlan.alreadyShipped) {
-          publishDetail.textContent = "This reviewed build (" + shortSha(currentPlan.pinnedSha) + ") is already live.";
-        } else if (currentPlan) {
-          publishDetail.textContent =
-            "Publishes the exact reviewed digest " + shortSha(currentPlan.artifactDigest.replace(/^sha256:/, "")) +
-            " (build " + shortSha(currentPlan.pinnedSha) + ") — no rebuild.";
-        } else {
-          publishDetail.textContent =
-            "Publishes the exact reviewed digest — no rebuild. Available once the aggregate is green and its integration run passed.";
-        }
-      }
-    };
-
-    const renderPlan = (plan) => {
-      const planBox = aggPanel && aggPanel.querySelector("[data-aggregate-plan]");
-      if (!planBox) return;
-      const chipEl = planBox.querySelector("[data-aggregate-plan-chip]");
-      const grid = planBox.querySelector("[data-aggregate-plan-grid]");
-      const note = planBox.querySelector("[data-aggregate-plan-note]");
-      if (grid) grid.textContent = "";
-
-      // No plan at all (degenerate: no store bound) — hide the box.
-      if (!plan) {
-        planBox.hidden = true;
-        return;
-      }
-      planBox.hidden = false;
-
-      if (!plan.ok) {
-        // An honest refusal — show WHY it isn't shippable, never a fake plan.
-        if (chipEl) {
-          chipEl.textContent = "Not shippable";
-          chipEl.className = "chip amber";
-        }
-        if (note) note.textContent = plan.message || ("Not shippable (" + (plan.reason || "refused") + ").");
-        return;
-      }
-
-      const paywalled = plan.paywall && !plan.paywall.allowed;
-      if (chipEl) {
-        chipEl.textContent = plan.alreadyShipped ? "Already live" : paywalled ? "Upgrade required" : "Ready to publish";
-        chipEl.className = "chip " + (plan.alreadyShipped ? "green" : paywalled ? "amber" : "green");
-      }
-
-      const row = (term, value, mono) => {
-        const dt = document.createElement("dt");
-        dt.textContent = term;
-        const dd = document.createElement("dd");
-        if (value instanceof Node) dd.append(value);
-        else {
-          dd.textContent = value;
-          if (mono) dd.className = "publish-mono";
-        }
-        grid.append(dt, dd);
-      };
-
-      row("Reviewed build", shortSha(plan.pinnedSha), true);
-      row("Reviewed digest", shortSha(plan.artifactDigest.replace(/^sha256:/, "")), true);
-      row("Included changes", String((plan.includedPrs || []).length) + " change" + ((plan.includedPrs || []).length === 1 ? "" : "s"));
-      const runCell = document.createElement("span");
-      runCell.append(document.createTextNode(plan.integrationRunId));
-      const planRunLink = runLink(plan.pinnedRevHref, "Open build");
-      if (planRunLink) {
-        runCell.append(document.createTextNode(" · "));
-        runCell.append(planRunLink);
-      }
-      row("Integration run", runCell);
-      if (plan.rollbackTarget) {
-        row("Rollback to", shortSha(plan.rollbackTarget.aggregateSha), true);
-      } else {
-        row("Rollback to", "None (first publish)");
-      }
-      row("Subscription", plan.paywall && plan.paywall.allowed ? "Enabled" : "Not enabled");
-
-      if (note) {
-        note.textContent = paywalled
-          ? (plan.paywall.message || "Publishing to your live store requires the paid plan.")
-          : plan.alreadyShipped
-            ? "This reviewed build is already live — nothing to publish."
-            : "Publish sends the exact reviewed digest above to your live store. No rebuild.";
-      }
-    };
-
-    // The exact-digest Publish (b10 ship = b09 orchestrator.ship). Confirms the
-    // pinned plan, then POSTs { confirmGoLive, expectedAggregateSha,
-    // expectedArtifactDigest } — the reviewed-digest guard: a stale plan (queue
-    // moved / artifact changed) is refused by the server, never shipped blind.
-    const buildPublishPlanText = (plan) => {
-      const lines = ["Publish plan (exact reviewed digest — no rebuild):"];
-      lines.push("  tenant:   " + (appDomain || repo));
-      lines.push("  build:    " + shortSha(plan.pinnedSha));
-      lines.push("  digest:   " + plan.artifactDigest);
-      lines.push("  changes:  " + (plan.includedPrs || []).length + " included");
-      if (plan.rollbackTarget) lines.push("  rollback: " + shortSha(plan.rollbackTarget.aggregateSha));
-      lines.push("  effect:   publish this exact digest to your LIVE store.");
-      return lines.join("\n");
-    };
-
-    const publishAggregate = async (button) => {
-      if (!currentPlan) return;
-      const plan = currentPlan;
-      if (!window.confirm(buildPublishPlanText(plan) + "\n\nPublish live?")) return;
-      button.disabled = true;
-      setStatus(aggStatusEl, "Publishing the reviewed build (" + shortSha(plan.pinnedSha) + ") live…");
-      try {
-        const res = await fetch(ds.shipEndpoint, {
-          method: "POST",
-          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
-          body: JSON.stringify({
-            aggregateId: plan.aggregateId,
-            // The HUMAN go-live gate + the reviewed-digest guards (b09 ship input).
-            confirmGoLive: true,
-            expectedAggregateSha: plan.pinnedSha,
-            expectedArtifactDigest: plan.artifactDigest,
-          }),
-        });
-        const data = await res.json().catch(() => ({}));
-        // b09 AggregateShipResult: the ONLY live claim is state === "shipped".
-        if (data.state === "shipped") {
-          setStatus(
-            aggStatusEl,
-            "Published live · build " + shortSha(data.pinnedSha) + " (receipt " + (data.receiptId || "—") + ").",
-            "ok",
-          );
-        } else if (data.state === "promote_failed" || data.state === "record_failed") {
-          // Honest partial-failure truth — recoverable, never a false "shipped".
-          setStatus(aggStatusEl, data.message || "Publish did not complete (" + data.state + "). Retry.", "err");
-        } else if (data.reason === "paywall") {
-          setStatus(aggStatusEl, data.message || "Publishing to your live store is part of the paid plan.", "err");
-        } else {
-          setStatus(
-            aggStatusEl,
-            data.message || data.error || "Publish refused (" + (data.reason || res.status) + ")",
-            "err",
-          );
-        }
-      } catch {
-        setStatus(aggStatusEl, "Publish failed — network error", "err");
-      } finally {
-        button.disabled = false;
-        loadQueue();
-        loadVersions();
-      }
-    };
-
-    const aggStatusEl = aggPanel && aggPanel.querySelector("[data-aggregate-status]");
-    aggPanel
-      ?.querySelector("[data-aggregate-publish]")
-      ?.addEventListener("click", (event) => publishAggregate(event.currentTarget));
-
-    // b11 — the ACCEPT-TO-PREVIEW plan affordance (decision
-    // operator-verb-and-hosting-model): state EXACTLY what accept does now.
-    // `POST /api/changes/integrate` (b08) = integrate this candidate into the
-    // protected `preview` aggregate (b07's TenantIntegrationQueue.enqueue), then
-    // rebuild + combined-evidence the aggregate (b05). It flips NO live channel —
-    // going live is the aggregate card's Publish. So the plan says "integrate into
-    // preview", never "merge into main / deploy live".
-    const buildIntegratePlan = (change) => {
-      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
-      const lines = ["Accept-to-preview plan:", "  tenant:    " + (appDomain || repo)];
-      if (change.prNumber != null) lines.push("  PR:        #" + change.prNumber);
-      lines.push("  change id: " + change.changeId);
-      if (change.headSha) lines.push("  head sha:  " + shortSha(change.headSha));
-      lines.push(
-        "  effect:    integrate " + target + " into the preview aggregate, then rebuild + " +
-          "re-evidence it. Does NOT go live — publish the reviewed build separately.",
-      );
-      return lines.join("\n");
-    };
-
-    // b08 integrate returns an IntegrateOutcome — { ok, queueState, runState,
-    // aggregateSha, pointerMoved, statusMessage, reason? } — NEVER a bare
-    // merged:true. Render it honestly: green advances the aggregate; red left it
-    // exactly where it was and names the failing stage.
-    const integrateCandidate = async (change, button) => {
-      if (!window.confirm(buildIntegratePlan(change) + "\n\nProceed?")) return;
-      button.disabled = true;
-      setStatus(statusEl, "Integrating " + change.changeId + " into preview…");
-      try {
-        const res = await fetch(ds.integrateEndpoint, {
-          method: "POST",
-          headers: {
-            "content-type": "application/json",
-            // Mirror of the server-side capability model (UX): the server
-            // re-derives capability and stays authoritative.
-            "x-tot-capability": "ship-on-behalf",
-          },
-          body: JSON.stringify({
-            repo,
-            changeId: change.changeId,
-            prNumber: change.prNumber ?? undefined,
-            expectedHeadSha: change.headSha || undefined,
-          }),
-        });
-        const data = await res.json().catch(() => ({}));
-        if (res.ok && data.ok) {
-          setStatus(
-            statusEl,
-            "Integrated " + change.changeId + " — preview aggregate is green (" +
-              shortSha(data.aggregateSha) + "). Review the aggregate, then Publish to go live.",
-            "ok",
-          );
-        } else if (res.ok && data.queueState === "red") {
-          // The queue ran but the aggregate did not go green — the candidate did
-          // NOT advance the shippable set. Name the honest failing stage.
-          setStatus(
-            statusEl,
-            "Integration of " + change.changeId + " failed (" + (data.reason || "red") + "): " +
-              (data.statusMessage || "the aggregate did not pass its combined evidence.") +
-              " The aggregate is unchanged.",
-            "err",
-          );
-        } else if (data.reason === "not_preview_base") {
-          setStatus(
-            statusEl,
-            "Not integrated: " + change.changeId + " does not target the preview branch " +
-              "(base is not \"preview\"). " + (data.statusMessage || ""),
-            "err",
-          );
-        } else {
-          setStatus(
-            statusEl,
-            data.statusMessage || data.error || "Integrate failed (" + res.status + ")",
-            "err",
-          );
-        }
-      } catch {
-        setStatus(statusEl, "Integrate failed — network error", "err");
-      } finally {
-        button.disabled = false;
-        loadQueue();
-      }
-    };
-
-    const rejectChange = async (change, button) => {
-      const reason = window.prompt(
-        "Reject " + change.changeId + " — add a short note for the submitter:",
-      );
-      if (reason == null) return;
-      if (!reason.trim()) {
-        setStatus(statusEl, "A reject note is required.", "err");
-        return;
-      }
-      button.disabled = true;
-      setStatus(statusEl, "Rejecting " + change.changeId + "…");
-      try {
-        const res = await fetch(
-          ds.changesEndpoint + "/" + encodeURIComponent(change.changeId) + "/reject",
-          {
-            method: "POST",
-            headers: {
-              "content-type": "application/json",
-              "x-tot-capability": "ship-on-behalf",
-            },
-            body: JSON.stringify({ repo, reason: reason.trim() }),
-          },
-        );
-        const data = await res.json().catch(() => ({}));
-        if (res.ok) {
-          setStatus(statusEl, "Change " + change.changeId + " rejected.", "ok");
-        } else {
-          setStatus(statusEl, data.error || "Reject failed (" + res.status + ")", "err");
-        }
-      } catch {
-        setStatus(statusEl, "Reject failed — network error", "err");
-      } finally {
-        button.disabled = false;
-        loadQueue();
-      }
-    };
-
-    // U7 — retire/GC. Mirror of the accept plan affordance (decision
-    // operator-verb-and-hosting-model): state EXACTLY what retire does — evict the
-    // candidate's preview environment + immutable version — and that it is
-    // REBUILDABLE (degrades to "not built yet", not a 404), so an operator can't
-    // confuse it with Reject. Same shape as `tot retire`'s CLI plan for parity.
-    const buildRetirePlan = (change) => {
-      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
-      const lines = ["Retire plan:", "  tenant:    " + (appDomain || repo)];
-      if (change.prNumber != null) lines.push("  PR:        #" + change.prNumber);
-      lines.push("  change id: " + change.changeId);
-      if (change.headSha) lines.push("  head sha:  " + shortSha(change.headSha));
-      lines.push(
-        "  effect:    evict " + target + "'s preview environment + version to reclaim space.",
-      );
-      lines.push(
-        "  rebuild:   REVERSIBLE — rebuild it any time (this is NOT Reject; the change stays open).",
-      );
-      return lines.join("\n");
-    };
-
-    const retireChange = async (change, button) => {
-      if (!window.confirm(buildRetirePlan(change) + "\n\nProceed?")) return;
-      button.disabled = true;
-      setStatus(statusEl, "Retiring " + change.changeId + "…");
-      try {
-        const res = await fetch(ds.retireEndpoint, {
-          method: "POST",
-          headers: {
-            "content-type": "application/json",
-            // Mirror of the server-side capability model (UX); the server
-            // re-derives capability and stays authoritative.
-            "x-tot-capability": "ship-on-behalf",
-          },
-          body: JSON.stringify({
-            changeId: change.changeId,
-            pr: change.prNumber ?? undefined,
-          }),
-        });
-        const data = await res.json().catch(() => ({}));
-        if (res.ok && data.ok) {
-          setStatus(
-            statusEl,
-            data.evicted
-              ? "Retired " + change.changeId + " — the preview was evicted (rebuildable on demand)."
-              : "Retire " + change.changeId + ": nothing to evict (already retired).",
-            "ok",
-          );
-        } else {
-          setStatus(statusEl, data.error || "Retire failed (" + res.status + ")", "err");
-        }
-      } catch {
-        setStatus(statusEl, "Retire failed — network error", "err");
-      } finally {
-        button.disabled = false;
-        loadQueue();
-      }
-    };
-
-    // ---- dg7: diff view ----------------------------------------------------
-    // For a pending candidate, show what changed vs the current live version,
-    // tied to the exact tenant Gitea head SHA, with the u5 immutable /rev link
-    // and the dg3 evidence AUTHORITY (authoritative / stale / missing). Reads
-    // GET /api/changes/<id>/diff; never invents a diff for a non-renderable
-    // candidate — it shows the honest blocked reason.
-
-    const diffBase = ds.diffEndpointBase;
-
-    const diffRowFor = (tr) => {
-      const next = tr.nextElementSibling;
-      return next && next.dataset && next.dataset.publishDiffRow === tr.dataset.changeRowId
-        ? next
-        : null;
-    };
-
-    const closeDiff = (tr, button) => {
-      const existing = diffRowFor(tr);
-      if (existing) existing.remove();
-      if (button) button.textContent = "Diff";
-    };
-
-    const toggleDiff = async (change, button, tr) => {
-      if (!tr.dataset.changeRowId) tr.dataset.changeRowId = change.changeId;
-      if (diffRowFor(tr)) {
-        closeDiff(tr, button);
-        return;
-      }
-      button.disabled = true;
-      button.textContent = "Loading…";
-      const detailTr = document.createElement("tr");
-      detailTr.dataset.publishDiffRow = tr.dataset.changeRowId;
-      const td = document.createElement("td");
-      td.colSpan = 6;
-      td.className = "publish-diff-cell";
-      detailTr.append(td);
-      tr.after(detailTr);
-      try {
-        const res = await fetch(diffBase + "/" + encodeURIComponent(change.changeId) + "/diff", {
-          headers: { accept: "application/json" },
-        });
-        const data = await res.json().catch(() => ({}));
-        if (!res.ok) {
-          td.append(subtle(data.error || "Could not load the diff (" + res.status + ")"));
-        } else {
-          renderDiff(td, data.diff || {});
-        }
-        button.textContent = "Hide diff";
-      } catch {
-        td.append(subtle("Could not load the diff — network error"));
-        button.textContent = "Hide diff";
-      } finally {
-        button.disabled = false;
-      }
-    };
-
-    const CHANGE_MARK = { added: "+", changed: "~", removed: "−" };
-
-    const renderDiff = (td, diff) => {
-      td.textContent = "";
-      const head = document.createElement("div");
-      head.className = "publish-diff-head";
-
-      // Authority: honest label of whether the diff describes the exact head.
-      const authority = diff.authority || {};
-      const authChip = chip(
-        authority.authoritative
-          ? "Reviewed at head"
-          : authority.stale
-            ? "Last-good preview (stale vs head)"
-            : authority.missing
-              ? "No evidence yet"
-              : "Head",
-        authority.authoritative ? "green" : authority.stale ? "amber" : "",
-      );
-      head.append(authChip);
-
-      if (diff.headSha) {
-        const sha = document.createElement("span");
-        sha.className = "publish-mono subtle";
-        sha.textContent = "head " + shortSha(diff.headSha);
-        head.append(sha);
-      }
-      if (diff.revHref) {
-        const rev = document.createElement("a");
-        rev.href = diff.revHref;
-        rev.target = "_blank";
-        rev.rel = "noopener";
-        rev.textContent = "Open reviewed revision";
-        head.append(rev);
-      }
-      td.append(head);
-
-      if (!diff.renderable) {
-        // Honest: a candidate that can't render has NO diff — say why (dg3), no fake.
-        const reason = document.createElement("p");
-        reason.className = "note publish-diff-blocked";
-        reason.textContent =
-          diff.blockedReason || "This candidate has no renderable version to diff yet.";
-        td.append(reason);
-        return;
-      }
-
-      const files = Array.isArray(diff.files) ? diff.files : [];
-      if (!files.length) {
-        td.append(subtle("No file changes vs the current live version."));
-        return;
-      }
-      const list = document.createElement("ul");
-      list.className = "publish-diff-list";
-      for (const f of files) {
-        const li = document.createElement("li");
-        li.className = "publish-diff-" + f.change;
-        const mark = document.createElement("span");
-        mark.className = "publish-diff-mark";
-        mark.textContent = CHANGE_MARK[f.change] || "•";
-        const path = document.createElement("code");
-        path.textContent = f.path;
-        li.append(mark, path);
-        list.append(li);
-      }
-      td.append(list);
-    };
-
-    // ---- dg7: versions / promotion history + rollback ----------------------
-    // The promotion history (u2/u3 promotion_status) with the tenant Gitea SHA,
-    // its /rev link (u5), and the current-live marker; a prior version rolls back
-    // THROUGH the one orchestrator (/api/changes/rollback → u8), rendering only the
-    // HONEST terminal state (rolled_back only when verified).
-
-    const versionsPanel = root.querySelector("[data-publish-versions]");
-    const versionsBody = versionsPanel?.querySelector("[data-versions-body]");
-    const versionsChip = versionsPanel?.querySelector("[data-versions-chip]");
-    const versionsStatus = versionsPanel?.querySelector("[data-versions-status]");
-    const versionsRollbackNote = versionsPanel?.querySelector("[data-versions-rollback-note]");
-    let rollbackMode = "control-plane";
-
-    const renderVersions = (view) => {
-      if (!versionsBody) return;
-      const versions = Array.isArray(view.versions) ? view.versions : [];
-      rollbackMode = view.rollbackMode || "control-plane";
-      versionsBody.textContent = "";
-
-      if (versionsChip) {
-        versionsChip.textContent = versions.length === 1 ? "1 version" : versions.length + " versions";
-        versionsChip.className = "chip" + (versions.length ? " blue" : "");
-      }
-
-      // Static tenants: per-version rollback is honestly deferred (the console
-      // can't enumerate the S3 versions archive digest /api/changes/rollback needs).
-      if (versionsRollbackNote) {
-        if (rollbackMode === "static-archive") {
-          versionsRollbackNote.hidden = false;
-          versionsRollbackNote.textContent =
-            "This store publishes to a static public site. Rolling back to a prior version " +
-            "resolves the target from the versions archive — run the ship CLI (tot rollback), " +
-            "which enumerates it; the console can't list archived object digests.";
-        } else {
-          versionsRollbackNote.hidden = true;
-        }
-      }
-
-      if (!versions.length) {
-        const tr = document.createElement("tr");
-        const td = cell(subtle("No versions have been promoted to live yet."));
-        td.colSpan = 6;
-        tr.append(td);
-        versionsBody.append(tr);
-        return;
-      }
-
-      for (const v of versions) {
-        const tr = document.createElement("tr");
-
-        // Version identity: the tenant Gitea SHA (content authority) + source.
-        const idCell = document.createElement("td");
-        const strong = document.createElement("strong");
-        strong.className = "publish-mono";
-        strong.textContent = shortSha(v.versionId);
-        idCell.append(strong);
-        if (v.source) idCell.append(subtle(v.source === "commit" ? "From a commit" : "Content hash"));
-        tr.append(idCell);
-
-        // Digest (static current only — never fabricated for priors).
-        const digestCell = cell(v.digest ? shortSha(v.digest) : "—");
-        digestCell.classList.add("publish-mono");
-        if (!v.digest) digestCell.classList.add("subtle");
-        tr.append(digestCell);
-
-        tr.append(cell(age(v.promotedAt)));
-
-        // Preview: the u5 immutable /rev/<sha> link.
-        const revCell = document.createElement("td");
-        if (v.revHref) {
-          const a = document.createElement("a");
-          a.href = v.revHref;
-          a.target = "_blank";
-          a.rel = "noopener";
-          a.textContent = "Revision";
-          revCell.append(a);
-        } else {
-          revCell.append(subtle("—"));
-        }
-        tr.append(revCell);
-
-        // State: current live vs prior.
-        tr.append(cell(v.isCurrent ? chip("Current live", "green") : chip("Prior", "")));
-
-        // Action: roll back to a PRIOR version (never the current one).
-        const act = document.createElement("td");
-        act.className = "action publish-actions";
-        if (!v.isCurrent) {
-          const rollbackBtn = document.createElement("button");
-          rollbackBtn.type = "button";
-          rollbackBtn.className = "btn";
-          rollbackBtn.textContent = "Roll back";
-          const staticDeferred = rollbackMode === "static-archive";
-          rollbackBtn.disabled = !canShip || staticDeferred;
-          rollbackBtn.title = !canShip
-            ? "Requires an owner or ship-on-behalf sign-in"
-            : staticDeferred
-              ? "Static rollback runs through the versions archive — use the ship CLI (tot rollback)"
-              : "Roll the live site back to this version";
-          rollbackBtn.addEventListener("click", () => rollbackVersion(v, rollbackBtn));
-          act.append(rollbackBtn);
-        }
-        tr.append(act);
-
-        versionsBody.append(tr);
-      }
-    };
-
-    const loadVersions = async () => {
-      if (!versionsBody) return;
-      try {
-        const res = await fetch(ds.versionsEndpoint, { headers: { accept: "application/json" } });
-        if (res.status === 401 || res.status === 403) {
-          if (versionsChip) versionsChip.textContent = "Sign-in required";
-          versionsBody.textContent = "";
-          const tr = document.createElement("tr");
-          const td = cell(subtle("Sign in as a store owner or admin to view published versions."));
-          td.colSpan = 6;
-          tr.append(td);
-          versionsBody.append(tr);
-          return;
-        }
-        const data = await res.json().catch(() => ({}));
-        if (!res.ok) {
-          setStatus(versionsStatus, data.error || "Could not load versions (" + res.status + ")", "err");
-          return;
-        }
-        renderVersions(data.view || {});
-      } catch {
-        setStatus(versionsStatus, "Could not load versions — network error", "err");
-      }
-    };
-
-    // Interpret the rollback response into ONE honest terminal state (mirrors the
-    // pure lib/publish/shipWorkspace `interpretRollbackResponse`; duplicated in
-    // plain JS because is:inline scripts can't import modules). `rolledBack` is
-    // true ONLY for a verified `rolled_back` — a `publish_pending` is NEVER a
-    // rolled-back claim.
-    const interpretRollback = (httpOk, body) => {
-      const toVersionId = typeof body.toVersionId === "string" ? body.toVersionId : null;
-      if (typeof body.state === "string") {
-        const state = ["rolled_back", "publish_pending", "publish_failed", "blocked"].includes(body.state)
-          ? body.state
-          : "error";
-        return {
-          state,
-          rolledBack: state === "rolled_back",
-          message: body.message || body.error || "Rollback returned state " + state + ".",
-        };
-      }
-      if (httpOk && body.rolledBack === true) {
-        return {
-          state: "rolled_back",
-          rolledBack: true,
-          message: toVersionId ? "Rolled back live to " + shortSha(toVersionId) + "." : "Rolled back live.",
-        };
-      }
-      return {
-        state: "blocked",
-        rolledBack: false,
-        message: (body.error || "Rollback failed") + (body.reason ? " (" + body.reason + ")" : ""),
-      };
-    };
-
-    const rollbackVersion = async (version, button) => {
-      if (
-        !window.confirm(
-          "Roll the live store back to version " + shortSha(version.versionId) +
-            "? This publishes that prior version to the live site.",
-        )
-      ) {
-        return;
-      }
-      button.disabled = true;
-      setStatus(versionsStatus, "Rolling back to " + shortSha(version.versionId) + "…");
-      try {
-        const payload = { targetVersionId: version.versionId };
-        // A static tenant additionally needs the archive digest — the button is
-        // disabled in that mode, but pass it through when we honestly have it.
-        if (version.digest) payload.targetDigest = version.digest;
-        const res = await fetch(ds.rollbackEndpoint, {
-          method: "POST",
-          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
-          body: JSON.stringify(payload),
-        });
-        const data = await res.json().catch(() => ({}));
-        const outcome = interpretRollback(res.ok, data);
-        setStatus(versionsStatus, outcome.message, outcome.rolledBack ? "ok" : outcome.state === "publish_pending" ? "ok" : "err");
-      } catch {
-        setStatus(versionsStatus, "Rollback failed — network error", "err");
-      } finally {
-        button.disabled = false;
-        loadVersions();
-        loadQueue();
-      }
-    };
-
-    // ---- Domain section ----------------------------------------------------
-
-    const domainPanel = root.querySelector("[data-publish-domain]");
-    let domainPollTimer = null;
-
-    const renderDomain = (payload) => {
-      if (!domainPanel) return;
-      const domain = payload.domain || {};
-      const stateEl = domainPanel.querySelector("[data-domain-state]");
-      const stateChip = domainPanel.querySelector("[data-domain-state-chip]");
-      const sinceEl = domainPanel.querySelector("[data-domain-since]");
-      const captureEl = domainPanel.querySelector("[data-domain-capture]");
-      const runEl = domainPanel.querySelector("[data-domain-run]");
-      const runDetailEl = domainPanel.querySelector("[data-domain-run-detail]");
-      const rollbackBtn = domainPanel.querySelector("[data-domain-rollback]");
-      const rollbackDetail = domainPanel.querySelector("[data-domain-rollback-detail]");
-      const connected = domain.state === "cloudfront";
-
-      if (stateEl) {
-        stateEl.textContent = connected
-          ? "Storefront CDN (cloudfront)"
-          : "Previous host (pantheon)";
-      }
-      if (stateChip) {
-        stateChip.textContent = connected ? "Connected" : "Not connected";
-        stateChip.className = "chip " + (connected ? "green" : "amber");
-      }
-      if (sinceEl) {
-        sinceEl.textContent = domain.since
-          ? "Since " + new Date(domain.since).toLocaleString()
-          : "Current host for " + (payload.appDomain || ds.appDomain);
-      }
-      if (captureEl) {
-        captureEl.textContent = domain.priorCapturedAt
-          ? "Captured " + new Date(domain.priorCapturedAt).toLocaleString()
-          : "None captured";
-      }
-
-      const run = domain.lastRun;
-      // "dispatched" = awaiting the CI completion callback (terminal-only wire).
-      const inFlight = run && run.status === "dispatched";
-      if (runEl) {
-        runEl.textContent = run
-          ? run.action + (run.rehearsal ? " (rehearsal)" : "") + " · " + run.status
-          : "None";
-      }
-      if (runDetailEl) {
-        runDetailEl.textContent = "";
-        if (run) {
-          const parts = [];
-          if (run.actor) parts.push("by " + run.actor);
-          if (run.startedAt) parts.push(age(run.startedAt));
-          runDetailEl.append(document.createTextNode(parts.join(" · ")));
-          if (run.runUrl) {
-            const link = document.createElement("a");
-            link.href = run.runUrl;
-            link.target = "_blank";
-            link.rel = "noopener";
-            link.textContent = "View run";
-            runDetailEl.append(document.createTextNode(" · "));
-            runDetailEl.append(link);
-          }
-          if (run.status === "failed" && run.error) {
-            const err = document.createElement("span");
-            err.className = "publish-error-detail";
-            err.textContent = run.error;
-            runDetailEl.append(document.createElement("br"));
-            runDetailEl.append(err);
-          }
-        } else {
-          runDetailEl.textContent = "Connect and rollback runs appear here.";
-        }
-      }
-      if (rollbackBtn) {
-        rollbackBtn.disabled =
-          !canShip || inFlight || !domain.priorRecordsKey;
-      }
-      if (rollbackDetail && domain.priorCapturedAt) {
-        rollbackDetail.textContent =
-          "Restores the DNS records captured " +
-          new Date(domain.priorCapturedAt).toLocaleString() + ".";
-      }
-
-      // Poll while a run is in flight so completion lands without a manual refresh.
-      if (domainPollTimer) {
-        clearTimeout(domainPollTimer);
-        domainPollTimer = null;
-      }
-      if (inFlight) domainPollTimer = setTimeout(loadDomain, 15000);
-    };
-
-    const loadDomain = async () => {
-      if (!domainPanel) return;
-      try {
-        const res = await fetch(ds.domainStatusEndpoint, {
-          headers: { accept: "application/json" },
-        });
-        if (!res.ok) return;
-        renderDomain(await res.json());
-      } catch {
-        /* leave the last rendered state */
-      }
-      // u9: refresh the readiness itemization alongside the status.
-      loadReadiness();
-    };
-
-    // ---- Cutover readiness (u9) --------------------------------------------
-    // Reads the SAME server gate `tot go-live` reads (/api/domain/readiness) and
-    // itemizes the preconditions. The Connect button additionally requires the
-    // server to report ready — the display and the enforcement can't diverge.
-    const readinessBox = domainPanel?.querySelector("[data-domain-readiness]");
-    const connectBtn = domainPanel?.querySelector("[data-domain-connect]");
-    let domainReady = false;
-
-    const renderReadiness = (payload) => {
-      if (!readinessBox) return;
-      const readiness = (payload && payload.readiness) || {};
-      const checks = Array.isArray(readiness.checks) ? readiness.checks : [];
-      domainReady = readiness.ready === true;
-      readinessBox.hidden = false;
-
-      const chip = readinessBox.querySelector("[data-domain-readiness-chip]");
-      if (chip) {
-        chip.textContent = domainReady ? "Ready" : "Not ready";
-        chip.className = "chip " + (domainReady ? "green" : "amber");
-      }
-      const list = readinessBox.querySelector("[data-domain-readiness-list]");
-      if (list) {
-        list.textContent = "";
-        for (const c of checks) {
-          const li = document.createElement("li");
-          li.className = c.ok ? "ok" : "blocked";
-          const mark = document.createElement("span");
-          mark.className = "domain-readiness-mark";
-          mark.textContent = c.ok ? "✓" : "✗";
-          const label = document.createElement("b");
-          label.textContent = c.label || c.id || "";
-          li.append(mark, label);
-          if (c.detail) {
-            const detail = document.createElement("span");
-            detail.className = "domain-readiness-detail";
-            detail.textContent = c.detail;
-            li.append(detail);
-          }
-          list.append(li);
-        }
-      }
-      const note = readinessBox.querySelector("[data-domain-readiness-note]");
-      if (note) {
-        note.textContent = payload && payload.ownerCapable === false
-          ? "Apex cutover is owner-only — sign in as the store owner to connect the domain."
-          : domainReady
-            ? "All preconditions are green — the cutover is permitted."
-            : "Clear the failing preconditions above before connecting the apex.";
-      }
-      // Gate the Connect button on server readiness in ADDITION to owner (the
-      // markup already disables it for non-owners); never enable it when blocked.
-      if (connectBtn && !connectBtn.dataset.ownerLocked) {
-        connectBtn.disabled = !domainReady;
-      }
-    };
-
-    const loadReadiness = async () => {
-      if (!readinessBox || !ds.domainReadinessEndpoint) return;
-      try {
-        const res = await fetch(ds.domainReadinessEndpoint, {
-          headers: { accept: "application/json", "x-tot-capability": "ship-on-behalf" },
-        });
-        if (!res.ok) return;
-        renderReadiness(await res.json());
-      } catch {
-        /* leave the last rendered readiness */
-      }
-    };
-
-    const domainStatusEl = domainPanel?.querySelector("[data-domain-status]");
-
-    const domainAction = async (body, button) => {
-      button.disabled = true;
-      setStatus(domainStatusEl, (body.action === "connect" ? "Connecting" : "Rolling back") + "…");
-      try {
-        const res = await fetch(ds.domainDispatchEndpoint, {
-          method: "POST",
-          headers: {
-            "content-type": "application/json",
-            "x-tot-capability": "ship-on-behalf",
-          },
-          body: JSON.stringify(body),
-        });
-        const data = await res.json().catch(() => ({}));
-        if (res.ok && data.dispatched) {
-          setStatus(
-            domainStatusEl,
-            (body.action === "connect" ? "Connect" : "Rollback") +
-              (body.rehearsal ? " rehearsal" : "") +
-              " dispatched — the run status updates below as it progresses.",
-            "ok",
-          );
-        } else {
-          setStatus(domainStatusEl, data.error || "Request failed (" + res.status + ")", "err");
-        }
-      } catch {
-        setStatus(domainStatusEl, "Request failed — network error", "err");
-      } finally {
-        button.disabled = false;
-        loadDomain();
-      }
-    };
-
-    domainPanel?.querySelector("[data-domain-connect]")?.addEventListener("click", (event) => {
-      const confirmInput = domainPanel.querySelector("[data-domain-confirm]");
-      const rehearsal = Boolean(domainPanel.querySelector("[data-domain-rehearsal]")?.checked);
-      domainAction(
-        {
-          action: "connect",
-          confirmDomain: (confirmInput?.value || "").trim(),
-          rehearsal,
-        },
-        event.currentTarget,
-      );
-    });
-
-    domainPanel?.querySelector("[data-domain-rollback]")?.addEventListener("click", (event) => {
-      if (
-        !window.confirm(
-          "Roll back " + ds.appDomain + " to the previous host? DNS returns to the captured records in about a minute.",
-        )
-      ) {
-        return;
-      }
-      domainAction({ action: "rollback" }, event.currentTarget);
-    });
-
-    // ---- Wiring ------------------------------------------------------------
-
-    root.querySelector("[data-publish-refresh]")?.addEventListener("click", () => {
-      setStatus(statusEl, "");
-      loadQueue();
-      loadVersions();
-      loadDomain();
-    });
-
-    loadQueue();
-    loadVersions();
-    loadDomain();
-  })();
+<script>
+  import { initAdminPublishTab } from "@/lib/publish/adminPublishTab";
+  initAdminPublishTab();
 </script>
 
 <style>
@@ -1747,6 +924,19 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     margin-left: 6px;
   }
 
+  /* The per-row orphan "Delete this branch" action — a deliberate, destructive,
+     one-at-a-time HUMAN delete, styled distinct from the neutral "Clean up" and the
+     bulk "Sweep dead branches" so it never reads as a routine cleanup. */
+  .btn.branch-delete-orphan {
+    border-color: var(--admin-danger, #b3261e);
+    color: var(--admin-danger, #b3261e);
+  }
+
+  .btn.branch-delete-orphan:not(:disabled):hover {
+    background: var(--admin-danger, #b3261e);
+    color: #fff;
+  }
+
   .publish-status {
     min-height: 0;
   }
@@ -1763,126 +953,606 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     color: var(--admin-red);
   }
 
+  /* Public-site status card, verified-current tone — .risk-alert defaults to an
+     amber/warning look (admin.astro), wrong for "this is fine, confirmed fresh". */
+  .risk-alert.public-site-ok {
+    border-color: var(--admin-green);
+    background: var(--admin-green-soft);
+  }
+
+  .risk-alert.public-site-ok svg {
+    color: var(--admin-green);
+  }
+
+  /* ?pr=N deep link: "not in the queue" callout + row flash */
+  .publish-pr-callout {
+    border: 1px solid var(--admin-line-strong);
+    border-left: 3px solid var(--admin-amber);
+    background: var(--admin-surface-soft);
+    padding: 8px 12px;
+    border-radius: var(--admin-radius-sm);
+    color: var(--admin-ink);
+  }
+
+  @keyframes publish-row-flash {
+    0%,
+    25% {
+      background-color: var(--admin-teal-soft);
+    }
+    100% {
+      background-color: transparent;
+    }
+  }
+
+  .publish-row-highlight > td {
+    animation: publish-row-flash 2.4s ease-out;
+  }
+
+  @media (prefers-reduced-motion: reduce) {
+    .publish-row-highlight > td {
+      animation: none;
+      background-color: var(--admin-teal-soft);
+    }
+  }
+
   .publish-error-detail {
     color: var(--admin-red);
     font-size: 12px;
   }
 
-  .domain-connect-controls {
+  /* ── Accept-to-preview LIFTOFF ─────────────────────────────────────────── */
+  .liftoff-backdrop {
+    position: fixed;
+    inset: 0;
+    z-index: 60;
     display: grid;
-    gap: 8px;
-    justify-items: end;
-    min-width: 220px;
+    place-items: center;
+    padding: 24px;
+    background: color-mix(in srgb, var(--admin-ink) 32%, transparent);
+    backdrop-filter: blur(6px);
+    -webkit-backdrop-filter: blur(6px);
   }
 
-  .domain-connect-controls input[type="text"] {
-    width: 100%;
-    min-height: 36px;
-    padding: 0 10px;
+  /* `display: grid` above beats the UA's [hidden] rule — restate it, or the
+     invisible backdrop click-blocks the entire page (caught by live test). */
+  .liftoff-backdrop[hidden] {
+    display: none;
+  }
+
+  .liftoff-card {
+    position: relative;
+    width: min(520px, 100%);
+    max-height: min(84vh, 640px);
+    overflow: auto;
     border: 1px solid var(--admin-line-strong);
-    border-radius: var(--admin-radius-sm);
+    border-radius: var(--admin-radius, 12px);
     background: var(--admin-surface);
-    color: var(--admin-ink);
-    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-    font-size: 12px;
+    box-shadow: 0 24px 80px rgba(8, 32, 30, 0.35);
+    padding: 24px 26px;
+    animation: liftoff-in 0.22s ease-out;
   }
 
-  .domain-rehearsal {
-    display: inline-flex;
-    align-items: center;
-    gap: 6px;
+  @keyframes liftoff-in {
+    from { transform: translateY(10px) scale(0.985); opacity: 0; }
+    to { transform: none; opacity: 1; }
+  }
+
+  /* In-flight shimmer: a live gradient beam along the card's top edge. */
+  .liftoff-card::before {
+    content: "";
+    position: absolute;
+    inset: 0 0 auto 0;
+    height: 3px;
+    border-radius: inherit;
+    opacity: 0;
+    background: linear-gradient(90deg, transparent, var(--admin-teal, #0f9d8f), #f4b942, var(--admin-teal, #0f9d8f), transparent);
+    background-size: 220% 100%;
+    transition: opacity 0.3s ease;
+  }
+
+  .liftoff-card[data-mode="flight"]::before {
+    opacity: 1;
+    animation: liftoff-beam 1.6s linear infinite;
+  }
+
+  @keyframes liftoff-beam {
+    from { background-position: 200% 0; }
+    to { background-position: -20% 0; }
+  }
+
+  .liftoff-kicker {
+    margin: 0 0 2px;
+    font-size: 11px;
+    font-weight: 700;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--admin-teal, #0f9d8f);
+  }
+
+  .liftoff-title {
+    margin: 0 0 14px;
+    font-size: 19px;
+    line-height: 1.25;
+  }
+
+  .liftoff-grid {
+    display: grid;
+    grid-template-columns: auto 1fr;
+    gap: 6px 16px;
+    margin: 0 0 12px;
+    padding: 12px 14px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+  }
+
+  .liftoff-grid dt {
     color: var(--admin-muted);
     font-size: 12px;
   }
 
-  @media (max-width: 720px) {
-    .domain-connect-controls {
-      justify-items: stretch;
-      min-width: 0;
-      width: 100%;
-    }
+  .liftoff-grid dd {
+    margin: 0;
+    font-size: 13px;
   }
 
-  /* u9: apex-cutover readiness itemization */
-  .domain-readiness {
-    margin: 0.75rem 0;
-    padding: 0.75rem 1rem;
-    border: 1px solid var(--hairline, rgba(0, 0, 0, 0.12));
-    border-radius: 0.5rem;
+  .liftoff-actions {
+    display: flex;
+    justify-content: flex-end;
+    gap: 8px;
+    margin-top: 16px;
   }
-  .domain-readiness-head {
+
+  /* Merge-conflict guidance (outcome phase, reason "merge_failed" only) —
+     directions, not mood: the terminal recovery front and center, the forge's
+     raw refusal kept small underneath for support/diagnosis. Left-aligned
+     inside the centered outcome phase: commands and prose read as
+     instructions, not ceremony. */
+  .liftoff-conflict {
+    margin-top: 10px;
+    text-align: left;
+  }
+
+  .liftoff-commands {
+    margin: 10px 0 8px;
+    padding: 10px 12px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+    font-size: 12px;
+    line-height: 1.55;
+    overflow-x: auto;
+    white-space: pre;
+  }
+
+  .liftoff-conflict-actions {
     display: flex;
-    align-items: center;
-    gap: 0.5rem;
-    margin-bottom: 0.5rem;
+    justify-content: flex-end;
+    gap: 8px;
+    flex-wrap: wrap;
   }
-  .domain-readiness-list {
+
+  .liftoff-conflict-raw {
+    margin: 10px 0 0;
+    font-size: 11px;
+    color: var(--admin-muted);
+    overflow-wrap: anywhere;
+  }
+
+  /* u4 — automate-first recovery: the primary action leads, option cards appear
+     only on a genuine overlap, the terminal guidance is a collapsed fallback. */
+  .liftoff-conflict-summary {
+    margin: 0 0 10px;
+  }
+  .liftoff-conflict-primary {
+    display: flex;
+    flex-direction: column;
+    align-items: flex-start;
+    gap: 8px;
+    margin-bottom: 12px;
+  }
+  .liftoff-conflict-primary .btn.primary {
+    align-self: flex-start;
+  }
+  .liftoff-conflict-primary-status[data-state="err"],
+  .liftoff-conflict-cards-status[data-state="err"] {
+    color: var(--admin-danger, #b3261e);
+  }
+  .liftoff-conflict-cards {
+    margin: 4px 0 12px;
+    padding: 12px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+  }
+  .liftoff-conflict-files {
     list-style: none;
-    margin: 0;
-    padding: 0;
+    margin: 8px 0 12px;
+    padding: 8px 10px;
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface, #fff);
+    font-size: 12px;
+    line-height: 1.6;
+    overflow-x: auto;
+  }
+  .liftoff-conflict-card-grid {
     display: grid;
-    gap: 0.25rem;
+    grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+    gap: 8px;
   }
-  .domain-readiness-list li {
+  .liftoff-option-card {
     display: flex;
-    align-items: baseline;
-    gap: 0.4rem;
-    font-size: 0.9em;
+    flex-direction: column;
+    gap: 4px;
+    text-align: left;
+    padding: 12px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface, #fff);
+    cursor: pointer;
+    font: inherit;
+    color: inherit;
   }
-  .domain-readiness-mark {
-    font-weight: 700;
-    width: 1em;
+  .liftoff-option-card:hover:not(:disabled) {
+    border-color: var(--admin-accent, #0f9d8f);
   }
-  .domain-readiness-list li.ok .domain-readiness-mark {
-    color: var(--good, #1a7f37);
+  .liftoff-option-card:disabled {
+    opacity: 0.55;
+    cursor: default;
   }
-  .domain-readiness-list li.blocked .domain-readiness-mark {
-    color: var(--bad, #b42318);
+  .liftoff-option-card[data-recommended="1"] {
+    border-color: var(--admin-accent, #0f9d8f);
+    box-shadow: inset 0 0 0 1px var(--admin-accent, #0f9d8f);
   }
-  .domain-readiness-detail {
-    opacity: 0.75;
+  .liftoff-option-card b {
+    font-size: 13px;
   }
-
-  /* b11: aggregate card + ship plan */
-  .aggregate-prs {
-    display: grid;
-    gap: 6px;
+  .liftoff-option-card span {
+    font-size: 11px;
+    color: var(--admin-muted);
+  }
+  .liftoff-conflict-expert {
+    margin-top: 10px;
+    border-top: 1px solid var(--admin-line, #e5e5e5);
+    padding-top: 8px;
+  }
+  .liftoff-conflict-expert > summary {
+    cursor: pointer;
+    font-size: 12px;
+    color: var(--admin-muted);
+    user-select: none;
   }
 
-  .aggregate-prs-list {
+  .liftoff-stages {
     list-style: none;
-    margin: 0;
+    margin: 6px 0 4px;
     padding: 0;
     display: grid;
-    gap: 4px;
+    gap: 0;
   }
 
-  .aggregate-prs-list li {
+  .liftoff-stages li {
+    position: relative;
     display: flex;
-    align-items: baseline;
-    gap: 10px;
-    font-size: 13px;
+    gap: 12px;
+    align-items: flex-start;
+    padding: 9px 0;
   }
 
-  .aggregate-plan {
-    padding: 0.75rem 1rem;
-    border: 1px solid var(--hairline, rgba(0, 0, 0, 0.12));
-    border-radius: 0.5rem;
-    display: grid;
-    gap: 8px;
+  /* Connecting rail between the dots. */
+  .liftoff-stages li + li::before {
+    content: "";
+    position: absolute;
+    left: 10px;
+    top: -8px;
+    height: 16px;
+    width: 2px;
+    background: var(--admin-line-strong);
   }
 
-  .aggregate-plan-head {
-    display: flex;
-    align-items: center;
-    gap: 0.5rem;
+  .liftoff-stages li > div {
+    display: grid;
+    gap: 1px;
   }
 
-  .aggregate-plan-grid {
-    display: grid;
-    grid-template-columns: max-content 1fr;
-    gap: 4px 16px;
-    margin: 0;
+  .liftoff-stages b {
+    font-size: 13px;
+  }
+
+  .liftoff-stages span:not(.liftoff-dot) {
+    font-size: 12px;
+    color: var(--admin-muted);
+  }
+
+  .liftoff-dot {
+    flex: none;
+    width: 21px;
+    height: 21px;
+    margin-top: 1px;
+    border-radius: 50%;
+    border: 2px solid var(--admin-line-strong);
+    display: grid;
+    place-items: center;
+    font-size: 12px;
+    font-weight: 700;
+    color: #fff;
+    background: transparent;
+    transition: all 0.25s ease;
+  }
+
+  .liftoff-stages li[data-state="active"] .liftoff-dot {
+    border-color: var(--admin-teal, #0f9d8f);
+    box-shadow: 0 0 0 0 color-mix(in srgb, var(--admin-teal, #0f9d8f) 45%, transparent);
+    animation: liftoff-pulse 1.3s ease-out infinite;
+  }
+
+  .liftoff-stages li[data-state="active"] b {
+    color: var(--admin-teal, #0f9d8f);
+  }
+
+  @keyframes liftoff-pulse {
+    from { box-shadow: 0 0 0 0 color-mix(in srgb, var(--admin-teal, #0f9d8f) 45%, transparent); }
+    to { box-shadow: 0 0 0 10px transparent; }
+  }
+
+  .liftoff-stages li[data-state="done"] .liftoff-dot {
+    border-color: var(--admin-green);
+    background: var(--admin-green);
+  }
+
+  .liftoff-stages li[data-state="done"] .liftoff-dot::after {
+    content: "✓";
+  }
+
+  .liftoff-stages li[data-state="fail"] .liftoff-dot {
+    border-color: var(--admin-red);
+    background: var(--admin-red);
+  }
+
+  .liftoff-stages li[data-state="fail"] .liftoff-dot::after {
+    content: "✕";
+  }
+
+  .liftoff-live {
+    margin: 8px 0 0;
+    min-height: 18px;
+    font-size: 13px;
+    color: var(--admin-ink);
+  }
+
+  .liftoff-meta {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    margin-top: 14px;
+    color: var(--admin-muted);
+  }
+
+  .liftoff-outcome-phase {
+    text-align: center;
+    padding-top: 6px;
+  }
+
+  .liftoff-outcome-phase .liftoff-actions {
+    justify-content: center;
+  }
+
+  .liftoff-seal {
+    width: 56px;
+    height: 56px;
+    margin: 4px auto 12px;
+    border-radius: 50%;
+    display: grid;
+    place-items: center;
+    font-size: 28px;
+    font-weight: 700;
+    color: #fff;
+  }
+
+  .liftoff-seal[data-state="ok"] {
+    background: var(--admin-green);
+    animation: liftoff-seal-pop 0.45s cubic-bezier(0.2, 1.6, 0.4, 1);
+  }
+
+  .liftoff-seal[data-state="ok"]::after {
+    content: "✓";
+  }
+
+  .liftoff-seal[data-state="err"] {
+    background: var(--admin-red);
+  }
+
+  .liftoff-seal[data-state="err"]::after {
+    content: "✕";
+  }
+
+  @keyframes liftoff-seal-pop {
+    from { transform: scale(0.4); opacity: 0; }
+    60% { transform: scale(1.12); }
+    to { transform: none; opacity: 1; }
+  }
+
+  .liftoff-confetti {
+    pointer-events: none;
+    position: absolute;
+    inset: 0;
+    overflow: hidden;
+    border-radius: inherit;
+  }
+
+  .liftoff-confetti i {
+    position: absolute;
+    top: -12px;
+    width: 7px;
+    height: 11px;
+    border-radius: 2px;
+    opacity: 0;
+    animation-name: liftoff-confetti-fall;
+    animation-timing-function: ease-in;
+    animation-fill-mode: forwards;
+  }
+
+  @keyframes liftoff-confetti-fall {
+    0% { opacity: 1; transform: translate(0, 0) rotate(0deg); }
+    100% {
+      opacity: 0.9;
+      transform: translate(var(--liftoff-drift, 0px), 660px) rotate(var(--liftoff-spin, 240deg));
+    }
+  }
+
+  @media (prefers-reduced-motion: reduce) {
+    .liftoff-card,
+    .liftoff-card[data-mode="flight"]::before,
+    .liftoff-stages li[data-state="active"] .liftoff-dot,
+    .liftoff-seal[data-state="ok"] {
+      animation: none;
+    }
+  }
+
+  .domain-connect-controls {
+    display: grid;
+    gap: 8px;
+    justify-items: end;
+    min-width: 220px;
+  }
+
+  .domain-connect-controls input[type="text"] {
+    width: 100%;
+    min-height: 36px;
+    padding: 0 10px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface);
+    color: var(--admin-ink);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 12px;
+  }
+
+  .domain-rehearsal {
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+    color: var(--admin-muted);
+    font-size: 12px;
+  }
+
+  @media (max-width: 720px) {
+    .domain-connect-controls {
+      justify-items: stretch;
+      min-width: 0;
+      width: 100%;
+    }
+  }
+
+  /* u9: apex-cutover readiness itemization */
+  .domain-readiness {
+    margin: 0.75rem 0;
+    padding: 0.75rem 1rem;
+    border: 1px solid var(--hairline, rgba(0, 0, 0, 0.12));
+    border-radius: 0.5rem;
+  }
+  .domain-readiness-head {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    margin-bottom: 0.5rem;
+  }
+  .domain-readiness-list {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+    display: grid;
+    gap: 0.25rem;
+  }
+  .domain-readiness-list li {
+    display: grid;
+    gap: 0.1rem;
+    font-size: 0.9em;
+  }
+  .domain-readiness-item-head {
+    display: flex;
+    align-items: baseline;
+    gap: 0.4rem;
+  }
+  .domain-readiness-mark {
+    font-weight: 700;
+    width: 1em;
+    flex: 0 0 auto;
+  }
+  .domain-readiness-list li.ok .domain-readiness-mark {
+    color: var(--good, #1a7f37);
+  }
+  .domain-readiness-list li.blocked .domain-readiness-mark {
+    color: var(--bad, #b42318);
+  }
+  /* detail + remedy sit on their OWN lines, indented under the label (past the
+     mark) so neither runs together with the bold label above it. */
+  .domain-readiness-detail,
+  .domain-readiness-remedy {
+    margin: 0;
+    padding-left: 1.4em;
+  }
+  .domain-readiness-detail {
+    opacity: 0.75;
+  }
+  .domain-readiness-remedy {
+    color: var(--accent, #0b6bcb);
+    opacity: 0.95;
+  }
+
+  /* b11: aggregate card + ship plan */
+  .aggregate-prs {
+    display: grid;
+    gap: 6px;
+  }
+
+  .aggregate-prs-list {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+    display: grid;
+    gap: 4px;
+  }
+
+  .aggregate-prs-list li {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    font-size: 13px;
+  }
+
+  /* u14 — provenance ("integrated <age> by <email>") sits after the sha, subtle. */
+  .aggregate-pr-meta {
+    font-size: 12px;
+  }
+
+  /* u14 — the per-change Undo (revert) button is pushed to the row's trailing edge
+     and kept compact so the batch reads as a list, not a stack of buttons. */
+  .aggregate-prs-list .btn-compact {
+    margin-left: auto;
+    padding: 2px 10px;
+    font-size: 12px;
+  }
+
+  .aggregate-plan {
+    padding: 0.75rem 1rem;
+    border: 1px solid var(--hairline, rgba(0, 0, 0, 0.12));
+    border-radius: 0.5rem;
+    display: grid;
+    gap: 8px;
+  }
+
+  .aggregate-plan-head {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+  }
+
+  .aggregate-plan-grid {
+    display: grid;
+    grid-template-columns: max-content 1fr;
+    gap: 4px 16px;
+    margin: 0;
   }
 
   .aggregate-plan-grid dt {
@@ -1896,16 +1566,720 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     overflow-wrap: anywhere;
   }
 
+  /* ── Preview-aggregate console — the go-live surface ─────────────────────
+     Everything here is scoped under [data-publish-aggregate] / .agg-* so it
+     never leaks into the other panels (candidate queue, versions, branches)
+     that share .panel / .field / .check-row / .chip. */
+  .agg-console .panel-body {
+    gap: 16px;
+  }
+
+  [data-publish-aggregate] .sha-token {
+    display: inline-flex;
+    align-items: center;
+    padding: 2px 8px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: 5px;
+    background: var(--admin-surface-soft);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 12.5px;
+    color: var(--admin-ink);
+  }
+  [data-publish-aggregate] .sha-token.ghost {
+    background: transparent;
+    color: var(--admin-muted);
+    border-style: dashed;
+  }
+
+  /* AI-assembled release summary */
+  .agg-summary {
+    display: grid;
+    gap: 11px;
+    padding: 15px 16px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius);
+    background:
+      linear-gradient(180deg, var(--admin-teal-soft), transparent 62%),
+      var(--admin-surface);
+  }
+  .agg-summary[hidden] {
+    display: none;
+  }
+  .agg-summary-head {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+  }
+  .agg-summary-glyph {
+    flex: none;
+    width: 26px;
+    height: 26px;
+    display: grid;
+    place-items: center;
+    border-radius: 7px;
+    background: var(--admin-surface);
+    color: var(--admin-teal-dark);
+    border: 1px solid color-mix(in srgb, var(--admin-teal) 30%, transparent);
+  }
+  /* The sparkle glyphs are filled shapes; opt out of the global stroked-svg rule. */
+  .agg-summary-glyph svg,
+  .agg-ai-chip svg {
+    fill: currentColor;
+    stroke: none;
+  }
+  .agg-summary-glyph svg {
+    width: 15px;
+    height: 15px;
+  }
+  .agg-summary-label {
+    flex: 1;
+    font-size: 11px;
+    font-weight: 760;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--admin-muted);
+  }
+  .agg-ai-chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 5px;
+    padding: 3px 9px;
+    border-radius: 999px;
+    background: var(--admin-teal-soft);
+    color: #007973;
+    font-size: 10px;
+    font-weight: 760;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+  }
+  .agg-ai-chip svg {
+    width: 10px;
+    height: 10px;
+  }
+  .agg-summary-lead {
+    margin: 0;
+    font-size: 15px;
+    line-height: 1.55;
+    color: var(--admin-ink);
+    max-width: 68ch;
+  }
+  .agg-summary-points {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+    display: grid;
+    gap: 7px;
+  }
+  .agg-summary-points[hidden] {
+    display: none;
+  }
+  .agg-summary-points li {
+    display: flex;
+    align-items: flex-start;
+    gap: 9px;
+    font-size: 13px;
+    color: var(--admin-muted);
+    line-height: 1.45;
+  }
+  .agg-summary-points .agg-tick {
+    flex: none;
+    margin-top: 1px;
+    width: 16px;
+    height: 16px;
+    border-radius: 50%;
+    display: grid;
+    place-items: center;
+    background: var(--admin-green-soft);
+    color: var(--admin-green);
+  }
+  .agg-summary-points .agg-tick svg {
+    width: 10px;
+    height: 10px;
+  }
+  .agg-summary-points b {
+    color: var(--admin-ink);
+    font-weight: 640;
+  }
+
+  /* Chain of custody: build → evidence → digest */
+  .agg-chain {
+    display: grid;
+    grid-template-columns: 1fr auto 1fr auto 1fr;
+    align-items: stretch;
+    padding: 16px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius);
+    background: var(--admin-surface-soft);
+  }
+  .agg-stop {
+    display: flex;
+    flex-direction: column;
+    gap: 7px;
+    padding: 2px 12px;
+    min-width: 0;
+  }
+  .agg-stop:first-child {
+    padding-left: 2px;
+  }
+  .agg-stop:last-child {
+    padding-right: 2px;
+  }
+  .agg-stop-label {
+    font-size: 10.5px;
+    font-weight: 760;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--admin-muted);
+  }
+  .agg-stop-val {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    font-size: 15px;
+    font-weight: 680;
+  }
+  .agg-stop-val strong {
+    font-size: 15px;
+  }
+  .agg-stop-cap {
+    margin: 0;
+    font-size: 12px;
+    color: var(--admin-muted);
+    line-height: 1.45;
+  }
+  .agg-stop-cap a {
+    white-space: nowrap;
+  }
+  .agg-digest {
+    padding: 2px 8px;
+    border: 1px solid color-mix(in srgb, var(--admin-teal) 55%, var(--admin-line-strong));
+    border-radius: 5px;
+    background: var(--admin-teal-soft);
+    color: #007973;
+  }
+  [data-publish-aggregate] [data-aggregate-evidence][data-state="passed"] {
+    color: var(--admin-green);
+  }
+  [data-publish-aggregate] [data-aggregate-evidence][data-state="failed"] {
+    color: var(--admin-red);
+  }
+  .agg-link {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    gap: 6px;
+    padding: 0 2px;
+    align-self: center;
+  }
+  .agg-flowlabel {
+    font-size: 9px;
+    font-weight: 720;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+    color: var(--admin-muted-2);
+  }
+  .agg-arrow {
+    display: grid;
+    place-items: center;
+    color: var(--admin-teal);
+  }
+  .agg-arrow svg {
+    width: 32px;
+    height: 10px;
+  }
+
+  /* Staged → live delta strip */
+  .agg-delta-strip {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    flex-wrap: wrap;
+    padding: 10px 13px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+  }
+  .agg-delta-strip[hidden] {
+    display: none;
+  }
+  .agg-delta-node {
+    display: flex;
+    flex-direction: column;
+    gap: 3px;
+  }
+  .agg-delta-mid {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    color: var(--admin-teal);
+  }
+  .agg-delta-mid svg {
+    width: 24px;
+    height: 10px;
+  }
+  .agg-delta-count {
+    padding: 2px 9px;
+    border-radius: 999px;
+    background: var(--admin-teal-soft);
+    color: #007973;
+    font-size: 11.5px;
+    font-weight: 720;
+  }
+
+  /* Staged change rows (richer than the plain PR list) */
+  .agg-changes li.agg-change {
+    display: grid;
+    grid-template-columns: 1fr auto;
+    align-items: center;
+    gap: 12px;
+    padding: 10px 12px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface);
+  }
+  .agg-change-main {
+    display: grid;
+    gap: 4px;
+    min-width: 0;
+  }
+  .agg-change-line {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    flex-wrap: wrap;
+  }
+  .agg-change-pr {
+    font-weight: 720;
+    font-size: 13px;
+  }
+  .agg-change-title {
+    font-weight: 600;
+    font-size: 13.5px;
+  }
+  .agg-change-sub {
+    color: var(--admin-muted);
+    font-size: 12px;
+  }
+
+  /* Publish plan → launch manifest */
+  [data-publish-aggregate] .agg-manifest {
+    display: block;
+    padding: 0;
+    overflow: hidden;
+    background:
+      linear-gradient(180deg, var(--admin-surface-tint), transparent 46px),
+      var(--admin-surface);
+  }
+  .agg-manifest-head {
+    padding: 12px 15px;
+    border-bottom: 1px dashed var(--admin-line-strong);
+  }
+  .agg-manifest-head b {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    font-size: 13px;
+  }
+  .agg-manifest-head b svg {
+    width: 15px;
+    height: 15px;
+    color: var(--admin-teal);
+  }
+  [data-publish-aggregate] .agg-manifest .aggregate-plan-grid {
+    padding: 8px 15px 12px;
+  }
+  [data-publish-aggregate] .agg-manifest > .note {
+    margin: 0;
+    padding: 11px 15px;
+    border-top: 1px dashed var(--admin-line-strong);
+    background: var(--admin-surface-soft);
+  }
+
+  /* Openable "Included changes" */
+  .agg-included {
+    border-top: 1px dashed var(--admin-line-strong);
+  }
+  .agg-included[hidden] {
+    display: none;
+  }
+  .agg-included-details > summary {
+    list-style: none;
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    padding: 11px 15px;
+    font-size: 12px;
+    color: var(--admin-muted);
+  }
+  .agg-included-details > summary::-webkit-details-marker {
+    display: none;
+  }
+  .agg-included-details > summary::marker {
+    content: "";
+  }
+  .agg-included-details > summary:focus-visible {
+    outline: 2px solid var(--admin-teal);
+    outline-offset: -2px;
+  }
+  .agg-included-lead {
+    font-size: 11px;
+    font-weight: 740;
+    letter-spacing: 0.03em;
+    text-transform: uppercase;
+    color: var(--admin-ink);
+  }
+  .agg-included-badge {
+    padding: 1px 8px;
+    border-radius: 999px;
+    background: var(--admin-surface-tint);
+    color: #3f4d49;
+    font-size: 11.5px;
+    font-weight: 720;
+  }
+  .agg-included-hint {
+    color: var(--admin-muted-2);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 11.5px;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+  .agg-chev {
+    margin-left: auto;
+    display: inline-flex;
+    color: var(--admin-muted-2);
+    transition: transform 0.18s ease;
+  }
+  .agg-chev svg {
+    width: 14px;
+    height: 14px;
+  }
+  .agg-included-details[open] > summary .agg-chev {
+    transform: rotate(90deg);
+  }
+  @media (prefers-reduced-motion: reduce) {
+    .agg-chev {
+      transition: none;
+    }
+  }
+  .agg-included-list {
+    list-style: none;
+    margin: 0;
+    padding: 0 15px 14px;
+    display: grid;
+    gap: 8px;
+  }
+  .agg-included-item {
+    display: grid;
+    gap: 5px;
+    padding: 11px 12px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+  }
+  .agg-included-top {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    flex-wrap: wrap;
+  }
+  .agg-included-pr {
+    font-weight: 720;
+    font-size: 13px;
+  }
+  .agg-included-title {
+    font-weight: 600;
+    font-size: 13.5px;
+  }
+  .agg-included-desc {
+    margin: 0;
+    color: var(--admin-muted);
+    font-size: 12.5px;
+    line-height: 1.5;
+  }
+  .agg-included-meta {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    flex-wrap: wrap;
+    color: var(--admin-muted-2);
+    font-size: 11.5px;
+  }
+  .agg-included-meta > span + span::before {
+    content: "·";
+    padding-right: 6px;
+    color: var(--admin-line-strong);
+  }
+  .agg-included-meta .sha-token {
+    font-size: 11px;
+    padding: 1px 6px;
+  }
+
+  /* Published-versions "what shipped": the release summary lead + openable
+     per-change list, inline in the Version cell. Reuses the .agg-included-*
+     item markup; only the container chrome is retuned for a table cell. */
+  .ver-summary {
+    margin: 6px 0 0;
+    color: var(--admin-muted);
+    font-size: 12.5px;
+    line-height: 1.5;
+    max-width: 48ch;
+  }
+  .ver-changes {
+    margin-top: 8px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+  }
+  .ver-changes > summary {
+    padding: 8px 10px;
+  }
+  .ver-changes .agg-included-list {
+    padding: 0 10px 10px;
+  }
+
+  /* Branch-retention "what this branch changes": the PR title + one-line
+     description + scope meta, inline under the branch ref. */
+  .branch-pr-title {
+    margin: 6px 0 0;
+    font-weight: 600;
+    font-size: 13px;
+    color: var(--admin-ink);
+    max-width: 46ch;
+  }
+  .branch-pr-desc {
+    margin: 3px 0 0;
+    color: var(--admin-muted);
+    font-size: 12.5px;
+    line-height: 1.5;
+    max-width: 46ch;
+  }
+  .branch-pr-meta {
+    margin-top: 5px;
+  }
+  .branch-pr-ai {
+    color: var(--admin-teal-dark);
+    font-weight: 640;
+  }
+
+  /* Scope-of-change: lines added/removed (green/red), + the top-level readout */
+  .agg-lines {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-variant-numeric: tabular-nums;
+    white-space: nowrap;
+  }
+  .agg-add {
+    color: var(--admin-green);
+  }
+  .agg-del {
+    color: var(--admin-red);
+  }
+
+  /* "View diff" disclosure for a trivial change (the diff IS its summary). */
+  .agg-diff {
+    margin-top: 2px;
+  }
+  .agg-diff > summary {
+    cursor: pointer;
+    font-size: 11.5px;
+    font-weight: 640;
+    color: var(--admin-teal-dark);
+    width: max-content;
+  }
+  .agg-diff[open] > summary {
+    margin-bottom: 6px;
+  }
+  .agg-diff-file {
+    margin-top: 6px;
+  }
+  .agg-diff-path {
+    font-size: 11px;
+    color: var(--admin-muted);
+    margin-bottom: 3px;
+  }
+  .agg-diff-patch {
+    margin: 0;
+    padding: 8px 10px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface);
+    font-size: 11.5px;
+    line-height: 1.5;
+    overflow-x: auto;
+    white-space: pre;
+  }
+  .agg-diff-add {
+    color: var(--admin-green);
+    background: var(--admin-green-soft);
+  }
+  .agg-diff-del {
+    color: var(--admin-red);
+    background: var(--admin-red-soft);
+  }
+  .agg-diff-hunk {
+    color: var(--admin-muted-2);
+  }
+
+  .agg-staged-head {
+    display: flex;
+    align-items: baseline;
+    justify-content: space-between;
+    gap: 12px;
+    flex-wrap: wrap;
+  }
+  .agg-scope {
+    display: inline-flex;
+    align-items: center;
+    gap: 8px;
+    padding: 3px 10px;
+    border: 1px solid var(--admin-line);
+    border-radius: 999px;
+    background: var(--admin-surface-soft);
+    font-size: 11.5px;
+    color: var(--admin-ink);
+  }
+  .agg-scope[hidden] {
+    display: none;
+  }
+  .agg-scope > span + span::before {
+    content: "·";
+    padding-right: 8px;
+    color: var(--admin-line-strong);
+  }
+  .agg-scope-label {
+    font-size: 10px;
+    font-weight: 760;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--admin-muted);
+  }
+  .agg-scope-partial {
+    color: var(--admin-muted-2);
+    font-style: italic;
+    cursor: help;
+  }
+
+  /* Publish action — stack the copy above a full-width, weighted CTA */
+  [data-publish-aggregate] .agg-launch {
+    display: grid;
+    grid-template-columns: 1fr;
+    gap: 12px;
+    padding: 14px 0 2px;
+  }
+  /* Extra selector weight so the gradient/shadow beat the .btn.primary base. */
+  [data-publish-aggregate] .btn.agg-publish-btn {
+    width: 100%;
+    justify-content: center;
+    min-height: 50px;
+    gap: 9px;
+    font-size: 15px;
+    border-radius: var(--admin-radius-sm);
+    background: linear-gradient(178deg, var(--admin-teal), var(--admin-teal-dark));
+    box-shadow: 0 8px 22px color-mix(in srgb, var(--admin-teal) 26%, transparent);
+  }
+  .agg-publish-btn svg {
+    width: 18px;
+    height: 18px;
+  }
+  [data-publish-aggregate] .btn.agg-publish-btn:not(:disabled):hover {
+    filter: brightness(1.05);
+  }
+  [data-publish-aggregate] .btn.agg-publish-btn:disabled {
+    background: var(--admin-surface-tint);
+    border-color: var(--admin-line-strong);
+    color: var(--admin-muted);
+    box-shadow: none;
+    cursor: not-allowed;
+  }
+
+  @media (max-width: 760px) {
+    .agg-chain {
+      grid-template-columns: 1fr;
+      gap: 4px;
+    }
+    .agg-link {
+      flex-direction: row;
+      gap: 10px;
+      padding: 4px 12px;
+    }
+    .agg-link .agg-arrow svg {
+      transform: rotate(90deg);
+    }
+    .agg-stop {
+      padding: 8px 2px;
+    }
+  }
+
   /* dg7: versions + diff */
   .versions-table {
     min-width: 780px;
   }
 
-  .publish-diff-cell {
+  /* rux6: unified review pane */
+  .publish-review-cell {
     padding: 12px 14px;
     background: var(--admin-surface-soft);
   }
 
+  .review-pane {
+    display: grid;
+    grid-template-columns: minmax(0, 1.3fr) minmax(0, 1fr);
+    gap: 16px;
+    align-items: start;
+  }
+
+  @media (max-width: 900px) {
+    .review-pane {
+      grid-template-columns: 1fr;
+    }
+  }
+
+  .review-preview {
+    display: grid;
+    gap: 8px;
+    min-width: 0;
+  }
+
+  .review-pane-head {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 10px;
+  }
+
+  .review-frame {
+    width: 100%;
+    height: 420px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface);
+  }
+
+  .review-detail {
+    display: grid;
+    gap: 14px;
+    min-width: 0;
+  }
+
+  .review-section {
+    display: grid;
+    gap: 6px;
+  }
+
+  .review-chips {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 6px;
+  }
+
+  .review-actions {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px;
+  }
+
   .publish-diff-head {
     display: flex;
     flex-wrap: wrap;