@tokenoftrust/storefront-runner 1.4.1 → 1.4.2-rc.0

package/apps/storefront/src/components/admin/AdminPublishTab.astro

@@ -32,10 +32,12 @@ import { readViewerSession } from "@/lib/auth/route";
 import { withBase } from "@/lib/basePath";
 import { readEnv } from "@/lib/env";
 import { resolveViewerShipCapability } from "@/lib/change";
+import { resolveLiveVersion } from "@/lib/change/liveVersion";
+import { isPublicSiteCurrent } from "@/lib/change/liveDigest";
 import { isHostedStoreDomain, isInternalTestTenant } from "@tot/public-runtime";
 
 const { envelope } = Astro.props;
-const { tenant, basePath, cspNonce } = Astro.locals;
+const { tenant, basePath } = Astro.locals;
 
 // Viewer capability, mirrored from the same session model the API routes gate
 // on (resolveOwnerSession admits capability owner|admin). UX-only: the server
@@ -78,6 +80,35 @@ const staticPublishEnabled = Boolean(
 // Presence-only signal for the T5 dispatch sink (never the value).
 const dispatchConfigured = Boolean((await readEnv("WWW_PUBLISH_DISPATCH_TOKEN"))?.trim());
 
+// "What does the public site actually serve right now?" — the read-back half of
+// the static-publish seam (resolveLiveVersion's staticLiveDigest), computed here
+// so it's ALWAYS visible rather than only living in GET /api/changes JSON. This is
+// the exact gap that let tokenoftrust.com's public site (preview.tokenoftrust.com)
+// sit two days stale behind several accepted-but-unpublished changes with nothing
+// in the console calling it out — going live and staying live for the PUBLIC
+// static target are two different facts, and this card makes the second one
+// honest instead of assumed. Best-effort: resolveLiveVersion never throws.
+// BUDGETED: resolveLiveVersion chains several TENANT_CACHE reads (resolvePreviewTenant,
+// resolveChannelVersion, readSiteVersion) that are pathologically slow + variable on the
+// preview worker (measured 2-10s EACH, spiking together — a KV/storage-latency issue, not
+// this code). It runs in blocking SSR frontmatter, so it gated the whole admin document
+// stream. It's best-effort display chrome ("what does live/ serve right now"), and the
+// client-side GET /api/changes already returns `current`, so cap it: on timeout the card
+// renders from the client fetch instead of blocking first paint.
+const liveVersion = staticPublishEnabled
+  ? await Promise.race([
+      resolveLiveVersion(tenant.appDomain),
+      new Promise<null>((resolve) => setTimeout(() => resolve(null), 1500)),
+    ])
+  : null;
+const publicSiteDigest = liveVersion?.staticLiveDigest ?? null;
+// The actual verdict: does the public target's manifest sha match what was last
+// promoted to "live" here? Both are real tenant Gitea shas (dg5) — a direct,
+// honest comparison, not a heuristic. See liveDigest.ts's isPublicSiteCurrent.
+const publicSiteVerdict = publicSiteDigest
+  ? isPublicSiteCurrent(liveVersion?.versionId ?? null, publicSiteDigest)
+  : null;
+
 const changesEndpoint = withBase(basePath || "", "/api/changes");
 // b11 — the branch-integration lifecycle SPLIT of accept from publish:
 //   - integrateEndpoint = b08's "accept = integrate into the protected preview
@@ -240,6 +271,59 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     </div>
   )}
 
+  <!-- Public-site status — the READ-BACK half of the static-publish seam
+       (resolveLiveVersion's staticLiveDigest), made visible instead of only
+       existing in API JSON. Distinct from "Live version" above: that's the
+       CONTROL-PLANE record of what was promoted; this is what the external
+       target (CloudFront/S3) is HONESTLY observed serving right now — the two
+       can diverge (a stale/failed republish job) with nothing else in this
+       console able to tell you. Answers "did going live actually reach the
+       public site?" without a manual curl. -->
+  {staticPublishEnabled && publicSiteDigest && publicSiteVerdict && (
+    <div
+      class={`risk-alert ${publicSiteVerdict.status === "current" ? "public-site-ok" : "amber"}`}
+      data-publish-public-site
+    >
+      <div class="risk-alert-main">
+        <svg><use href={publicSiteVerdict.status === "current" ? "#i-check" : "#i-alert"}></use></svg>
+        <div>
+          {publicSiteVerdict.status === "current" ? (
+            <>
+              <b>Public site is up to date</b>
+              <span>
+                <code>{tenant.appDomain}</code>'s public target is serving the same commit
+                (<code class="publish-mono">{liveVersion?.versionId?.slice(0, 12)}</code>)
+                as the hosted store's live pointer. Publishing live above
+                republishes it automatically — usually within a few minutes.
+              </span>
+            </>
+          ) : publicSiteVerdict.status === "behind" ? (
+            <>
+              <b>Public site is behind the hosted store's live pointer</b>
+              <span>
+                <code>{tenant.appDomain}</code>'s public target is still serving{" "}
+                <code class="publish-mono">{publicSiteVerdict.publishedSha.slice(0, 12)}</code>, but
+                the hosted store's live pointer has since moved to{" "}
+                <code class="publish-mono">{publicSiteVerdict.livePointerSha.slice(0, 12)}</code>.
+                The republish job hasn't caught up yet (or a go-live happened before it was enabled) —
+                check the workflow run, or trigger a fresh go-live to re-dispatch it.
+              </span>
+            </>
+          ) : (
+            <>
+              <b>Couldn't verify the public site is current</b>
+              <span>
+                Checked <code class="publish-mono">{publicSiteDigest.url}</code>: {publicSiteVerdict.reason}.
+                This does NOT mean the hosted store's own "Live version" above is wrong, only that the
+                separate public static target couldn't be confirmed current.
+              </span>
+            </>
+          )}
+        </div>
+      </div>
+    </div>
+  )}
+
   <div class="panel">
     <div class="panel-head">
       <h3><svg><use href="#i-export"></use></svg>Candidate queue</h3>
@@ -297,7 +381,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
        candidates integrate into, its combined evidence (the last integration
        run's honest state), and the exact-digest Publish (b09/b10 ship the
        reviewed pinned SHA + digest, never a rebuild). -->
-  <div class="panel" data-publish-aggregate>
+  <div class="panel agg-console" data-publish-aggregate>
     <div class="panel-head">
       <h3><svg><use href="#i-box"></use></svg>Preview aggregate</h3>
       <span class="chip" data-aggregate-chip>Loading</span>
@@ -305,44 +389,137 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     <div class="panel-body grid">
       <p class="note publish-status" data-aggregate-status role="status" aria-live="polite"></p>
 
-      <div class="grid cols-3">
-        <div class="field">
-          <label>Aggregate build</label>
-          <strong class="publish-mono" data-aggregate-sha>—</strong>
-          <p data-aggregate-run-link>The current green preview build for this store.</p>
+      <!-- AI-assembled release summary — a plain-language "what am I about to
+           publish?" ahead of the technical trust chain. Rendered ONLY when the
+           server supplies data.releaseSummary; otherwise it stays hidden and the
+           panel degrades to today's behavior (graceful fallback). -->
+      <div class="agg-summary" data-aggregate-summary hidden>
+        <div class="agg-summary-head">
+          <span class="agg-summary-glyph" aria-hidden="true">
+            <svg viewBox="0 0 24 24" fill="currentColor"><path d="M12 2l1.9 4.7L18.5 8.6l-4.6 1.9L12 15.2l-1.9-4.7L5.5 8.6l4.6-1.9L12 2z"></path><path d="M18.5 14l.9 2.2 2.3.9-2.3.9-.9 2.2-.9-2.2-2.3-.9 2.3-.9.9-2.2z"></path></svg>
+          </span>
+          <span class="agg-summary-label">What&rsquo;s in this release</span>
+          <span class="agg-ai-chip">
+            <svg viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M12 2l1.9 4.7L18.5 8.6l-4.6 1.9L12 15.2l-1.9-4.7L5.5 8.6l4.6-1.9L12 2z"></path></svg>
+            AI summary
+          </span>
+        </div>
+        <p class="agg-summary-lead" data-aggregate-summary-lead></p>
+        <ul class="agg-summary-points" data-aggregate-summary-points></ul>
+      </div>
+
+      <!-- Chain of custody: the build that was verified → its combined evidence →
+           the digest that ships. The reviewed digest wears an accented token so
+           the eye can track that exactly what was reviewed is what goes live. The
+           three values keep their original data hooks (sha / evidence / digest). -->
+      <div class="agg-chain">
+        <div class="agg-stop">
+          <span class="agg-stop-label">Aggregate build</span>
+          <span class="agg-stop-val"><strong class="publish-mono" data-aggregate-sha>—</strong></span>
+          <p class="agg-stop-cap" data-aggregate-run-link>The current green preview build for this store.</p>
+        </div>
+        <div class="agg-link" aria-hidden="true">
+          <span class="agg-flowlabel">verified by</span>
+          <span class="agg-arrow"><svg viewBox="0 0 34 10" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M1 5h29m0 0-4-4m4 4-4 4"></path></svg></span>
         </div>
-        <div class="field">
-          <label>Combined evidence</label>
-          <strong data-aggregate-evidence>—</strong>
-          <p data-aggregate-evidence-detail>The last integration run's verdict.</p>
+        <div class="agg-stop">
+          <span class="agg-stop-label">Combined evidence</span>
+          <span class="agg-stop-val"><strong data-aggregate-evidence>—</strong></span>
+          <p class="agg-stop-cap" data-aggregate-evidence-detail>The last integration run's verdict.</p>
         </div>
-        <div class="field">
-          <label>Reviewed digest</label>
-          <strong class="publish-mono" data-aggregate-digest>—</strong>
-          <p>The content digest that will be published — exactly what you reviewed.</p>
+        <div class="agg-link" aria-hidden="true">
+          <span class="agg-flowlabel">produces</span>
+          <span class="agg-arrow"><svg viewBox="0 0 34 10" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M1 5h29m0 0-4-4m4 4-4 4"></path></svg></span>
+        </div>
+        <div class="agg-stop">
+          <span class="agg-stop-label">Reviewed digest</span>
+          <span class="agg-stop-val"><strong class="publish-mono agg-digest" data-aggregate-digest>—</strong></span>
+          <p class="agg-stop-cap">The content digest that will be published — exactly what you reviewed.</p>
         </div>
       </div>
 
-      <!-- Included PRs — the batch this aggregate composes (b01 includedPrs). -->
-      <div class="aggregate-prs" data-aggregate-prs-wrap hidden>
-        <b>Included changes</b>
-        <ul class="aggregate-prs-list" data-aggregate-prs></ul>
+      <!-- Included PRs — the batch this aggregate composes (b01 includedPrs). u14:
+           the "missing middle" — this is the STAGED delta vs live. The title + note
+           narrate how far ahead of the live site the staged preview is, and each row
+           carries an Undo (per-change revert) to roll the staged preview backward. -->
+      <div class="aggregate-prs agg-staged" data-aggregate-prs-wrap hidden>
+        <div class="agg-staged-head">
+          <b data-aggregate-prs-title>Included changes</b>
+          <!-- Scope-of-change risk measure across the whole staged batch (total
+               files + lines). Populated by renderAggregate from data.stagedScope;
+               hidden when no staged change carries size stats. -->
+          <span class="agg-scope" data-aggregate-scope hidden></span>
+        </div>
+        <!-- Staged → live delta strip: staged aggregate sha ahead of the live
+             pointer. Populated by renderAggregate; hidden when nothing is ahead. -->
+        <div class="agg-delta-strip" data-aggregate-delta-strip hidden>
+          <span class="agg-delta-node">
+            <span class="agg-stop-label">Staged preview</span>
+            <span class="sha-token" data-agg-delta-staged>—</span>
+          </span>
+          <span class="agg-delta-mid" aria-hidden="true">
+            <span class="agg-delta-count" data-agg-delta-count></span>
+            <svg viewBox="0 0 26 10" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M1 5h21m0 0-4-4m4 4-4 4"></path></svg>
+          </span>
+          <span class="agg-delta-node">
+            <span class="agg-stop-label">Live site</span>
+            <span class="sha-token ghost" data-agg-delta-live>—</span>
+          </span>
+        </div>
+        <p class="note" data-aggregate-delta-note hidden></p>
+        <ul class="aggregate-prs-list agg-changes" data-aggregate-prs></ul>
       </div>
 
       <!-- The exact-digest Publish plan (b09 plan()): pinned SHA + digest +
            included PRs + rollback target + paywall verdict + run link. Shown
            inline (from GET /api/changes `plan`) so the confirm never POSTs to
            preview. Publish is refused until the plan is `ok`. -->
-      <div class="aggregate-plan" data-aggregate-plan hidden>
-        <div class="aggregate-plan-head">
-          <b>Publish plan</b>
+      <div class="aggregate-plan agg-manifest" data-aggregate-plan hidden>
+        <div class="aggregate-plan-head agg-manifest-head">
+          <b><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M9 11l3 3L22 4"></path><path d="M21 12v7a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h11"></path></svg>Publish plan</b>
           <span class="chip" data-aggregate-plan-chip></span>
         </div>
         <dl class="aggregate-plan-grid" data-aggregate-plan-grid></dl>
+
+        <!-- Openable "Included changes": each accepted PR as a line item with its
+             human title, a one-line description of what it does, and meta (sha /
+             files / who + when). Populated by renderPlan; degrades to a bare count
+             when per-change titles/descriptions aren't available. The <details>
+             element is static so its open/closed state survives a poll re-render —
+             only the list contents are replaced. -->
+        <div class="agg-included" data-aggregate-plan-included hidden>
+          <details class="agg-included-details">
+            <summary>
+              <span class="agg-included-lead">Included changes</span>
+              <span class="agg-included-badge" data-aggregate-plan-included-count>0</span>
+              <span class="agg-included-hint" data-aggregate-plan-included-hint></span>
+              <span class="agg-chev" aria-hidden="true"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"><path d="M9 6l6 6-6 6"></path></svg></span>
+            </summary>
+            <ul class="agg-included-list" data-aggregate-plan-included-list></ul>
+          </details>
+        </div>
+
         <p class="note" data-aggregate-plan-note></p>
       </div>
 
-      <div class="check-row">
+      <!-- u15 — retry a DEAD rebuild (no new merge). Shown only while the aggregate
+           is red: a candidate's PR already merged into preview, but the
+           build/evidence step that follows died (e.g. a transient MCP error) — this
+           retries ONLY that step, against the sha the forge already carries. -->
+      <div class="check-row" data-aggregate-retry-row hidden>
+        <div>
+          <b>Retry the build</b>
+          <p>
+            The last merge landed on preview, but rebuilding it failed. Retry re-runs
+            the build + evidence check alone — no new merge, no membership change.
+          </p>
+        </div>
+        <button class="btn" type="button" data-aggregate-retry-build>
+          <svg><use href="#i-refresh"></use></svg>Retry build
+        </button>
+      </div>
+
+      <div class="check-row agg-launch">
         <div>
           <b>Publish the reviewed build to your live store</b>
           <p data-aggregate-publish-detail>
@@ -350,7 +527,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
             aggregate is green and its integration run passed.
           </p>
         </div>
-        <button class="btn primary" type="button" data-aggregate-publish disabled>
+        <button class="btn primary agg-publish-btn" type="button" data-aggregate-publish disabled>
           <svg><use href="#i-export"></use></svg>Publish live
         </button>
       </div>
@@ -367,6 +544,11 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     <div class="panel-body grid">
       <p class="note publish-status" data-versions-status role="status" aria-live="polite"></p>
       <p class="note" data-versions-rollback-note hidden></p>
+      <!-- u14: orients the owner between the staged aggregate above and live versions
+           below — "N staged change(s) not yet published; Publish live creates the next
+           version here." Owned by renderAggregate (its own element, so its timing never
+           races renderVersions). -->
+      <p class="note" data-versions-orientation hidden></p>
       <div class="table-wrap">
         <table class="publish-table versions-table">
           <thead>
@@ -411,11 +593,14 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         closed — a different action on a different object than <b>Retire</b> in
         the queue above, which only evicts a hosted preview build (rebuildable
         on demand, never a branch). Every classification below is a fresh
-        dry-run; deleting always re-checks eligibility on the server and asks
-        you to confirm before removing anything. Orphan branches (no PR record
-        at all) are quarantined for your review, never deleted automatically.
+        dry-run; <b>Sweep dead branches</b> lists exactly what it will delete and
+        asks once to confirm, then the server re-checks each ref fresh before
+        removing it.
       </p>
       <p class="note publish-status" data-branches-status role="status" aria-live="polite"></p>
+      <div class="toolbar" data-branches-actions hidden>
+        <button type="button" class="btn" data-branches-sweep>Sweep dead branches</button>
+      </div>
       <div class="table-wrap">
         <table class="publish-table">
           <thead>
@@ -588,6 +773,74 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         <div class="liftoff-seal" data-liftoff-seal aria-hidden="true"></div>
         <h3 class="liftoff-title" data-liftoff-outcome-title></h3>
         <p class="note" data-liftoff-outcome-detail></p>
+        <!-- Merge-conflict recovery (shown ONLY for reason "merge_failed") — decision
+             `automate-first-conflict-recovery` (u4): the refusal LEADS with one primary
+             action ("Update this change automatically" → /resolve strategy:"merge",
+             then auto-re-integrate). The three option cards appear only when diff3 hits
+             a genuine same-line overlap (RefreshResult.unresolved); the old terminal +
+             AI-agent guidance is demoted VERBATIM into the collapsed "Do it manually
+             instead" expert section (nothing removed). Decision logic lives in the
+             tested `resolveConflict.ts`; this glue mirrors it (verified on preview). -->
+        <div class="liftoff-conflict" data-liftoff-conflict hidden>
+          <p class="note liftoff-conflict-summary" data-conflict-summary hidden></p>
+
+          <!-- PRIMARY ACTION — always first when a candidate is refused not-mergeable. -->
+          <div class="liftoff-conflict-primary" data-conflict-primary>
+            <p class="note" data-conflict-primary-note>
+              We can rebuild your change on top of the store's current version and
+              re-integrate it for you — no terminal, no re-submit.
+            </p>
+            <button class="btn primary" type="button" data-conflict-auto>Update this change automatically</button>
+            <p class="note liftoff-conflict-primary-status" data-conflict-primary-status role="status" aria-live="polite" hidden></p>
+          </div>
+
+          <!-- OPTION CARDS — revealed only on a genuine same-line overlap diff3 can't
+               safely auto-pick. Static nodes mirror CONFLICT_OPTION_CARDS. -->
+          <div class="liftoff-conflict-cards" data-conflict-cards hidden>
+            <p class="note" data-conflict-cards-intro>
+              Some of the same lines were changed on both sides, so there's no single safe
+              answer. Pick how to resolve the overlap:
+            </p>
+            <ul class="liftoff-conflict-files publish-mono" data-conflict-files></ul>
+            <div class="liftoff-conflict-card-grid" role="group" aria-label="Resolve the overlap">
+              <button class="liftoff-option-card" type="button" data-conflict-card data-strategy="merge" data-recommended="1">
+                <b>Combine both</b>
+                <span>Recommended — weave both sets of edits together</span>
+              </button>
+              <button class="liftoff-option-card" type="button" data-conflict-card data-strategy="ours">
+                <b>Keep my change</b>
+                <span>Use your edits on the conflicting lines</span>
+              </button>
+              <button class="liftoff-option-card" type="button" data-conflict-card data-strategy="theirs">
+                <b>Keep the store's current version</b>
+                <span>Use the store's edits on the conflicting lines</span>
+              </button>
+            </div>
+            <p class="note liftoff-conflict-cards-status" data-conflict-cards-status role="status" aria-live="polite" hidden></p>
+          </div>
+
+          <!-- EXPERT FALLBACK — the ORIGINAL terminal + AI-agent guidance, verbatim,
+               collapsed. Nothing deleted; just demoted from primary to fallback. -->
+          <details class="liftoff-conflict-expert" data-conflict-expert>
+            <summary>Do it manually instead</summary>
+            <p class="note" data-conflict-intro>
+              From the store checkout that submitted this change, bring it up to date and
+              re-submit — the open PR updates in place. Once the new build is ready,
+              finish here with <b>Integrate into preview</b>, or from the terminal with
+              <code>tot accept --tenant &lt;store&gt; --pr &lt;N&gt;</code>.
+              Check <code>git status</code> first — abort any half-finished rebase from an
+              earlier attempt. Then <code>tot pr</code>: this change should be marked
+              <code>(active)</code>, proving you're in the right checkout and branch.
+              If git reports an authentication failure, run <code>tot login</code> and retry.
+            </p>
+            <pre class="liftoff-commands publish-mono" data-conflict-commands></pre>
+            <div class="liftoff-conflict-actions">
+              <button class="btn" type="button" data-conflict-copy-prompt>Copy prompt for your AI agent</button>
+              <button class="btn" type="button" data-conflict-copy>Copy commands</button>
+            </div>
+            <p class="liftoff-conflict-raw publish-mono" data-conflict-raw></p>
+          </details>
+        </div>
         <div class="liftoff-actions">
           <a class="btn" data-liftoff-review target="_blank" rel="noopener" hidden>Review the preview build</a>
           <button class="btn primary" type="button" data-liftoff-done>Done</button>
@@ -648,2310 +901,9 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
   </div>
 </section>
 
-<script is:inline nonce={cspNonce}>
-  (() => {
-    const root = document.getElementById("publish");
-    if (!root) return;
-    const ds = root.dataset;
-    const canShip = ds.canShip === "true";
-    const repo = ds.repo || "";
-    const appDomain = ds.appDomain || "";
-
-    const statusEl = root.querySelector("[data-publish-status]");
-    const queueBody = root.querySelector("[data-publish-queue-body]");
-    const queueChip = root.querySelector("[data-publish-queue-chip]");
-    const queueCount = root.querySelector("[data-publish-queue-count]");
-    const degradedStrip = root.querySelector("[data-publish-degraded]");
-
-    // rux7 — in-flight UI state the auto-refresh poll must preserve across a
-    // re-render. These are the AUTHORITATIVE source of truth (never scraped
-    // back out of the DOM): an action's async closure holds a reference to the
-    // OLD button, so after a poll swaps the row the completion signal lands on a
-    // detached node — reading `disabled`/`data-building` off the fresh DOM would
-    // wedge forever. buildPreview/integrate/reject/retire add on start and
-    // delete in `finally` (before their own loadQueue), so the next render
-    // reflects the true busy set. Open diff panes are the exception: the DOM IS
-    // their source of truth (toggleDiff owns open/close), so renderQueue detaches
-    // and re-attaches the actual pane node — see renderQueue.
-    const inflightBuilds = new Set(); // prNumber currently building
-    const busyChanges = new Set(); // changeId with an in-flight integrate/reject/retire
-    let aggregatePublishing = false; // the aggregate Publish POST is in flight
-
-    const setStatus = (el, message, state) => {
-      if (!el) return;
-      el.textContent = message || "";
-      if (state) el.dataset.state = state;
-      else delete el.dataset.state;
-    };
-
-    const shortSha = (sha) => (sha ? String(sha).slice(0, 8) : "—");
-
-    // Inline mirror of `candidatePrUrl` (lib/preview/candidateDashboard.ts) — an
-    // is:inline script can't import a module, so the pure URL shape is mirrored
-    // here (same pattern as `shortSha`). The friendly `/preview/<tenant>/pr/<N>`
-    // route handles every state (ready, not-built, …), so a row with a PR number
-    // always has a working preview link even when `previewUrl` is still null.
-    const candidatePrUrl = (prNumber) =>
-      prNumber != null ? "/preview/" + encodeURIComponent(appDomain) + "/pr/" + prNumber : null;
-
-    const age = (iso) => {
-      if (!iso) return "—";
-      const ms = Date.now() - new Date(iso).getTime();
-      if (!Number.isFinite(ms) || ms < 0) return "—";
-      const mins = Math.floor(ms / 60000);
-      if (mins < 1) return "just now";
-      if (mins < 60) return mins + "m ago";
-      const hours = Math.floor(mins / 60);
-      if (hours < 48) return hours + "h ago";
-      return Math.floor(hours / 24) + "d ago";
-    };
-
-    const STATUS_CHIP = {
-      queued: "",
-      reconciling: "blue",
-      ready: "green",
-      blocked: "red",
-    };
-
-    const chip = (text, tone) => {
-      const el = document.createElement("span");
-      el.className = "chip" + (tone ? " " + tone : "");
-      el.textContent = text;
-      return el;
-    };
-
-    const cell = (...children) => {
-      const td = document.createElement("td");
-      for (const child of children) {
-        if (child == null) continue;
-        td.append(typeof child === "string" ? document.createTextNode(child) : child);
-      }
-      return td;
-    };
-
-    const subtle = (text) => {
-      const el = document.createElement("span");
-      el.className = "subtle";
-      el.textContent = text;
-      return el;
-    };
-
-    // ---- ?pr=N deep link ---------------------------------------------------
-    // A deep link like /admin#publish?pr=42 asks us to surface a specific PR's
-    // row once the queue has loaded. The param rides in the hash fragment
-    // (after the tab anchor) because that's how the admin shell routes tabs;
-    // fall back to a real query string too. Resolve exactly once — so the
-    // scroll/highlight never re-fires on the reloads that follow every ship
-    // action — and until it resolves, keep an honest "not in the queue yet"
-    // callout up rather than silently doing nothing.
-
-    const readRequestedPr = () => {
-      const hash = window.location.hash || "";
-      const q = hash.indexOf("?");
-      let raw = new URLSearchParams(q >= 0 ? hash.slice(q + 1) : "").get("pr");
-      if (raw == null) raw = new URLSearchParams(window.location.search).get("pr");
-      if (raw == null) return null;
-      const n = Number.parseInt(raw, 10);
-      return Number.isInteger(n) && n > 0 ? n : null;
-    };
-
-    const requestedPr = readRequestedPr();
-    let prDeeplinkResolved = false;
-
-    const applyPrDeeplink = () => {
-      if (requestedPr == null || prDeeplinkResolved) return;
-      const callout = root.querySelector("[data-publish-pr-callout]");
-      const row = queueBody.querySelector('tr[data-pr-number="' + requestedPr + '"]');
-      if (!row) {
-        if (callout) {
-          callout.hidden = false;
-          callout.textContent = "PR #" + requestedPr + " isn't in the queue yet.";
-        }
-        return;
-      }
-      prDeeplinkResolved = true;
-      if (callout) {
-        callout.hidden = true;
-        callout.textContent = "";
-      }
-      row.scrollIntoView({ block: "center", behavior: "smooth" });
-      row.classList.remove("publish-row-highlight");
-      void row.offsetWidth; // restart the flash animation if re-applied
-      row.classList.add("publish-row-highlight");
-      window.setTimeout(() => row.classList.remove("publish-row-highlight"), 2600);
-    };
-
-    // ---- Open change queue -------------------------------------------------
-
-    const renderQueue = (payload) => {
-      const changes = Array.isArray(payload.changes) ? payload.changes : [];
-      // rux1: surface a forge-listing failure as a visible strip — never let a
-      // degraded (short) list read as a genuine empty queue.
-      if (degradedStrip) degradedStrip.hidden = payload.degraded !== true;
-      // rux7: capture any open diff panes BEFORE wiping so a poll re-render
-      // re-attaches the exact node (with its already-fetched content) under the
-      // matching new row, instead of blowing the expanded pane away. Keyed by
-      // changeId (== the diff row's data-publish-diff-row). Wiping detaches them
-      // from the DOM but the Map keeps them alive for re-attachment.
-      const openDiffNodes = new Map();
-      queueBody.querySelectorAll("tr[data-publish-diff-row]").forEach((node) => {
-        openDiffNodes.set(node.dataset.publishDiffRow, node);
-      });
-      queueBody.textContent = "";
-      if (queueCount) queueCount.textContent = String(changes.length);
-      if (queueChip) {
-        queueChip.textContent = changes.length === 1 ? "1 open" : changes.length + " open";
-        queueChip.className = "chip" + (changes.length ? " blue" : "");
-      }
-
-      if (!changes.length) {
-        const tr = document.createElement("tr");
-        const td = cell(
-          subtle(
-            "No open changes. New store changes appear here when a developer submits them for review.",
-          ),
-        );
-        td.colSpan = 6;
-        tr.append(td);
-        queueBody.append(tr);
-        return;
-      }
-
-      for (const change of changes) {
-        const tr = document.createElement("tr");
-        if (change.prNumber != null) tr.dataset.prNumber = String(change.prNumber);
-
-        // Change id + branch / PR + preview link.
-        const idCell = document.createElement("td");
-        const idStrong = document.createElement("strong");
-        idStrong.textContent = change.changeId || "—";
-        idCell.append(idStrong);
-        const meta = [];
-        if (change.branch) meta.push(change.branch);
-        if (change.prNumber != null) meta.push("PR #" + change.prNumber);
-        if (meta.length) idCell.append(subtle(meta.join(" · ")));
-        // Owner-facing "who did this" — accept takes priority over build (a
-        // candidate that's been accepted-to-preview is more meaningfully
-        // "acted on" than merely built). Reject never shows here: a rejected
-        // candidate is closed and has already left the open queue.
-        const actorRecord = change.actors && (change.actors.accept || change.actors.build);
-        if (actorRecord) {
-          const label = change.actors.accept ? "Accepted by " : "Built by ";
-          idCell.append(subtle(label + (actorRecord.name || actorRecord.email)));
-        }
-        // Prefer the synthesized friendly per-PR route (handles every state);
-        // fall back to any server-provided previewUrl for change-first rows
-        // that have no PR number yet.
-        const previewUrl = candidatePrUrl(change.prNumber) || change.previewUrl;
-        if (previewUrl) {
-          const preview = document.createElement("a");
-          preview.href = previewUrl;
-          preview.target = "_blank";
-          preview.rel = "noopener";
-          preview.textContent = "Open preview";
-          const wrap = document.createElement("span");
-          wrap.className = "subtle";
-          wrap.append(preview);
-          idCell.append(wrap);
-        }
-        tr.append(idCell);
-
-        // Reconcile status.
-        const statusCell = cell(
-          chip(change.status || "unknown", STATUS_CHIP[change.status] ?? "amber"),
-        );
-        if (change.lastError) statusCell.append(subtle(change.lastError));
-        tr.append(statusCell);
-
-        // Evidence / compliance verdict.
-        const checks = (change.evidence && change.evidence.checks) || [];
-        const failing = checks.filter((c) => c.status === "fail");
-        const promotable = Boolean(change.evidence && change.evidence.promotable);
-        const checksCell = cell(
-          promotable ? chip("Checks passed", "green") : chip("Checks blocked", "amber"),
-        );
-        if (failing.length) {
-          checksCell.append(subtle("Failing: " + failing.map((c) => c.label || c.id).join(", ")));
-        } else if (!checks.length) {
-          checksCell.append(subtle("No checks reported yet"));
-        }
-        tr.append(checksCell);
-
-        // Head sha + age.
-        const headCell = cell(shortSha(change.headSha));
-        headCell.classList.add("publish-mono");
-        tr.append(headCell);
-        tr.append(cell(age(change.updatedAt)));
-
-        // Actions.
-        const actions = document.createElement("td");
-        actions.className = "action publish-actions";
-
-        // rux5 — a synthetic not-built forge PR row (built:false / status
-        // "not-built") has NO built candidate: changeId is null, so the built-only
-        // actions below (Diff/Accept/Reject/Retire, all keyed on changeId) do not
-        // apply. Its one action is Build preview — materialize the PR's hosted
-        // preview on demand. Capability-gated: the button is SHOWN only to a
-        // ship-capable operator, and the server (buildGate) re-authorizes — the UI
-        // check is UX, not the real gate.
-        if (change.built === false || change.status === "not-built") {
-          if (canShip) {
-            const build = document.createElement("button");
-            build.type = "button";
-            build.className = "btn primary";
-            build.title = "Materialize this PR's hosted preview on demand (does not go live)";
-            // rux7: if a build for this PR is mid-flight, a poll re-render must
-            // reflect the spinner/disabled state (not a fresh clickable button
-            // that would let the operator double-submit). The in-flight closure
-            // re-renders on completion, clearing this.
-            if (change.prNumber != null && inflightBuilds.has(change.prNumber)) {
-              build.textContent = "Building…";
-              build.disabled = true;
-              build.dataset.building = "true";
-            } else {
-              build.textContent = "Build preview";
-            }
-            build.addEventListener("click", () => buildPreview(change, build));
-            actions.append(build);
-          } else {
-            actions.append(subtle("Owner/admin sign-in required to build"));
-          }
-          tr.append(actions);
-          queueBody.append(tr);
-          continue;
-        }
-
-        // rux7: while an integrate/reject/retire for this change is in flight,
-        // keep its mutating actions disabled across a poll re-render so the
-        // operator can't double-submit against a freshly-minted button.
-        const changeBusy = busyChanges.has(change.changeId);
-
-        // rux6 Review: expand the row into a single "review moment" pane —
-        // preview iframe + evidence chips + diff + Accept/Reject — so a reviewer
-        // never leaves the queue. Supersedes the standalone Diff button (the dg7
-        // diff now lives inside the pane, reusing renderDiff). The row's own
-        // Accept/Reject/Retire buttons below are unchanged.
-        const reviewBtn = document.createElement("button");
-        reviewBtn.type = "button";
-        reviewBtn.className = "btn";
-        reviewBtn.textContent = "Review";
-        reviewBtn.setAttribute("aria-expanded", "false");
-        reviewBtn.title = "Open one pane to preview, diff, and act on this change";
-        reviewBtn.addEventListener("click", () => toggleReview(change, reviewBtn, tr));
-        actions.append(reviewBtn);
-        // b11 SPLIT: the candidate-queue primary action is now ACCEPT TO PREVIEW
-        // (b08 integrate = advance the shared preview aggregate), NOT go-live.
-        // Integrate flips NO live channel, so it has NO paywall (entitled) gate —
-        // it holds only the ship-on-behalf capability floor. Going live is the
-        // aggregate card's Publish action, once the aggregate is green.
-        const accept = document.createElement("button");
-        accept.type = "button";
-        accept.className = "btn primary";
-        accept.textContent = "Accept to preview";
-        accept.disabled = !canShip || !change.mergeable || changeBusy;
-        accept.title = !canShip
-          ? "Requires an owner or admin sign-in"
-          : !change.mergeable
-            ? "This change is not ready to integrate"
-            : "Integrate this change into the preview aggregate (does not go live)";
-        accept.addEventListener("click", () => integrateCandidate(change, accept));
-        actions.append(accept);
-        const reject = document.createElement("button");
-        reject.type = "button";
-        reject.className = "btn";
-        reject.textContent = "Reject";
-        reject.disabled = !canShip || changeBusy;
-        reject.title = canShip ? "Close this change without publishing" : "Requires an owner or admin sign-in";
-        reject.addEventListener("click", () => rejectChange(change, reject));
-        actions.append(reject);
-
-        // U7 Retire/GC: evict this candidate's preview environment + version to
-        // reclaim space. DISTINCT from Reject — retire is reversible-by-rebuild
-        // (U1 build-on-demand + the U2 fallback page rematerialize it), so a
-        // retired PR degrades to "not built yet", not a dead 404.
-        const retire = document.createElement("button");
-        retire.type = "button";
-        retire.className = "btn";
-        retire.textContent = "Retire";
-        retire.disabled = !canShip || changeBusy;
-        retire.title = canShip
-          ? "Evict this preview to reclaim space — rebuildable on demand (not the same as Reject)"
-          : "Requires an owner or admin sign-in";
-        retire.addEventListener("click", () => retireChange(change, retire));
-        actions.append(retire);
-        tr.append(actions);
-
-        queueBody.append(tr);
-
-        // rux7: re-attach a diff pane that was open before this re-render. The
-        // pane node carries its already-fetched content; restore the expanded
-        // state + the "Hide diff" toggle affordance so a poll never collapses it.
-        const openDiff = openDiffNodes.get(change.changeId);
-        if (openDiff) {
-          tr.dataset.changeRowId = change.changeId;
-          diffBtn.textContent = "Hide diff";
-          tr.after(openDiff);
-        }
-      }
-    };
-
-    const renderCurrent = (current, shippedBy) => {
-      const versionEl = root.querySelector("[data-publish-live-version]");
-      const sourceEl = root.querySelector("[data-publish-live-source]");
-      const atEl = root.querySelector("[data-publish-live-at]");
-      const shippedByEl = root.querySelector("[data-publish-live-shipped-by]");
-      if (current && current.versionId) {
-        if (versionEl) versionEl.textContent = shortSha(current.versionId);
-        if (sourceEl) {
-          sourceEl.textContent =
-            (current.source === "commit" ? "Published from a change" : "Published version") +
-            (current.artifactCount != null ? " · " + current.artifactCount + " files" : "");
-        }
-        if (atEl) atEl.textContent = current.createdAt ? age(current.createdAt) : "—";
-        // Owner-facing "who did this" — see changeActorAttribution.ts. Absent for
-        // any version published before this attribution existed, which is honest,
-        // not a bug.
-        if (shippedByEl) {
-          shippedByEl.textContent = shippedBy ? "Shipped by " + (shippedBy.name || shippedBy.email) : "";
-        }
-      } else {
-        if (versionEl) versionEl.textContent = "Not live yet";
-        if (sourceEl) sourceEl.textContent = "Nothing has been published for this store";
-        if (atEl) atEl.textContent = "—";
-        if (shippedByEl) shippedByEl.textContent = "";
-      }
-    };
-
-    // ---- rux7: auto-refresh (poll GET /api/changes) ------------------------
-    // Keep the queue + aggregate live without a manual reload: poll on an
-    // interval that BACKS OFF while nothing changes (grow the delay up to a cap)
-    // and SNAPS BACK to the base the moment something does. Pause entirely while
-    // the tab is hidden (document.hidden) — a backgrounded admin tab must not
-    // hammer the endpoint — and refresh promptly on return. A poll re-render
-    // reuses renderQueue/renderAggregate, which already preserve open diff panes
-    // and in-flight actions (inflightBuilds / busyChanges / aggregatePublishing),
-    // and applyPrDeeplink stays a one-time effect (prDeeplinkResolved), so the
-    // ?pr scroll never re-fires on a tick.
-    const POLL_BASE_MS = 8000;
-    const POLL_MAX_MS = 60000;
-    const POLL_GROWTH = 1.6;
-    let pollDelay = POLL_BASE_MS;
-    let pollTimer = null;
-    let pollBusy = false;
-    let lastChangesSignature = null;
-
-    // A compact projection of everything the queue/aggregate render VISIBLY off,
-    // so a no-op poll (identical data) neither re-renders nor interrupts a text
-    // selection — it just backs off. Relative ages are intentionally excluded;
-    // they drift at most one backoff interval and refresh on any real change.
-    const changesSignature = (data) => {
-      const cur = data.current || {};
-      const agg = data.aggregate || {};
-      const run = agg.activeRun || agg.lastRun || {};
-      const plan = data.plan || {};
-      const rows = (Array.isArray(data.changes) ? data.changes : []).map((c) => [
-        c.changeId,
-        c.prNumber,
-        c.status,
-        c.headSha,
-        c.mergeable,
-        c.built,
-        c.lastError || null,
-        !!(c.evidence && c.evidence.promotable),
-        c.actors ? Object.keys(c.actors).sort().join(",") : "",
-      ]);
-      return JSON.stringify({
-        degraded: data.degraded === true,
-        current: [cur.versionId || null, cur.createdAt || null, cur.artifactCount ?? null],
-        shippedBy: (data.shippedBy && data.shippedBy.email) || null,
-        aggregate: [
-          agg.queueState || null,
-          agg.aggregateSha || null,
-          run.state || null,
-          run.finishedAt || null,
-          (agg.includedPrs || []).length,
-        ],
-        plan: [plan.ok === true, plan.pinnedSha || null, plan.artifactDigest || null, plan.alreadyShipped === true],
-        rows,
-      });
-    };
-
-    const clearPoll = () => {
-      if (pollTimer) {
-        clearTimeout(pollTimer);
-        pollTimer = null;
-      }
-    };
-
-    const schedulePoll = () => {
-      clearPoll();
-      if (document.hidden) return; // paused while hidden; visibilitychange resumes
-      pollTimer = setTimeout(runPoll, pollDelay);
-    };
-
-    // One poll tick: fetch, and only re-render when the projection actually
-    // changed. Returns an outcome the caller uses to size the next interval.
-    const pollChanges = async () => {
-      let res;
-      try {
-        res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
-      } catch {
-        return "error"; // network blip — keep the last good view, just back off
-      }
-      if (res.status === 401 || res.status === 403) return "auth"; // session gone
-      const data = await res.json().catch(() => null);
-      if (!res.ok || !data) return "error";
-      const sig = changesSignature(data);
-      if (sig === lastChangesSignature) return "unchanged";
-      lastChangesSignature = sig;
-      renderCurrent(data.current, data.shippedBy);
-      renderQueue(data);
-      applyPrDeeplink();
-      renderAggregate(data);
-      return "changed";
-    };
-
-    const runPoll = async () => {
-      pollTimer = null;
-      if (document.hidden || pollBusy) {
-        schedulePoll();
-        return;
-      }
-      pollBusy = true;
-      let outcome;
-      try {
-        outcome = await pollChanges();
-      } finally {
-        pollBusy = false;
-      }
-      if (outcome === "auth") {
-        clearPoll(); // stop polling — a sign-in is required; a manual refresh retries
-        return;
-      }
-      pollDelay =
-        outcome === "changed"
-          ? POLL_BASE_MS
-          : Math.min(POLL_MAX_MS, Math.round(pollDelay * POLL_GROWTH));
-      schedulePoll();
-    };
-
-    const loadQueue = async () => {
-      try {
-        const res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
-        if (res.status === 401 || res.status === 403) {
-          if (queueChip) queueChip.textContent = "Sign-in required";
-          if (degradedStrip) degradedStrip.hidden = true;
-          queueBody.textContent = "";
-          const tr = document.createElement("tr");
-          const td = cell(subtle("Sign in as a store owner or admin to view the publish queue."));
-          td.colSpan = 6;
-          tr.append(td);
-          queueBody.append(tr);
-          return;
-        }
-        const data = await res.json();
-        if (!res.ok) {
-          setStatus(statusEl, data.error || "Could not load the change queue (" + res.status + ")", "err");
-          return;
-        }
-        renderCurrent(data.current, data.shippedBy);
-        renderQueue(data);
-        applyPrDeeplink();
-        renderAggregate(data);
-        // rux7: this is fresh authoritative data — resync the poll clock so the
-        // next tick dedupes against it, and reset the cadence to responsive
-        // (a manual refresh / a just-completed action likely means more coming).
-        lastChangesSignature = changesSignature(data);
-        pollDelay = POLL_BASE_MS;
-        schedulePoll();
-      } catch {
-        setStatus(statusEl, "Could not load the change queue — network error", "err");
-      }
-    };
-
-    // ---- b11: the aggregate card + exact-digest Publish ---------------------
-    // Reads the aggregate/runs/plan projection GET /api/changes now returns
-    // (AggregateCardView + AggregateShipPlanView, built by aggregateView.ts):
-    //   - the aggregate's queueState + build sha + reviewed digest,
-    //   - the COMBINED EVIDENCE = the last integration run's honest state +
-    //     statusMessage (never re-derived),
-    //   - the included-PR batch,
-    //   - the b09 ship PLAN (pinned SHA/digest/PRs/rollback/paywall + run link),
-    //     shown inline so the confirm never has to POST to preview it.
-
-    const aggPanel = root.querySelector("[data-publish-aggregate]");
-    const AGG_STATE_CHIP = {
-      empty: "",
-      queued: "amber",
-      integrating: "blue",
-      green: "green",
-      red: "red",
-      shipped: "green",
-    };
-    // The plan we last rendered — the exact-digest guard the Publish POST sends
-    // back so a stale plan (queue moved / artifact changed) is refused, never
-    // shipped blind.
-    let currentPlan = null;
-
-    const runLink = (revHref, label) => {
-      if (!revHref) return null;
-      const a = document.createElement("a");
-      a.href = revHref;
-      a.target = "_blank";
-      a.rel = "noopener";
-      a.textContent = label || "Open build";
-      return a;
-    };
-
-    const renderAggregate = (data) => {
-      if (!aggPanel) return;
-      const agg = data.aggregate || null;
-      const plan = data.plan || null;
-      currentPlan = plan && plan.ok ? plan : null;
-
-      const chipEl = aggPanel.querySelector("[data-aggregate-chip]");
-      const shaEl = aggPanel.querySelector("[data-aggregate-sha]");
-      const runLinkEl = aggPanel.querySelector("[data-aggregate-run-link]");
-      const evEl = aggPanel.querySelector("[data-aggregate-evidence]");
-      const evDetailEl = aggPanel.querySelector("[data-aggregate-evidence-detail]");
-      const digestEl = aggPanel.querySelector("[data-aggregate-digest]");
-      const prsWrap = aggPanel.querySelector("[data-aggregate-prs-wrap]");
-      const prsList = aggPanel.querySelector("[data-aggregate-prs]");
-      const publishBtn = aggPanel.querySelector("[data-aggregate-publish]");
-      const publishDetail = aggPanel.querySelector("[data-aggregate-publish-detail]");
-
-      const state = (agg && agg.queueState) || "empty";
-      if (chipEl) {
-        chipEl.textContent = state;
-        chipEl.className = "chip " + (AGG_STATE_CHIP[state] || "");
-      }
-      if (shaEl) shaEl.textContent = agg && agg.aggregateSha ? shortSha(agg.aggregateSha) : "—";
-      if (runLinkEl) {
-        runLinkEl.textContent = "";
-        const link = agg && runLink(agg.revHref, "Open build");
-        if (link) runLinkEl.append(link);
-        else runLinkEl.append(document.createTextNode("The current green preview build for this store."));
-      }
-
-      // Combined evidence = the last (or in-flight) integration run's honest state.
-      const lastRun = agg && (agg.activeRun || agg.lastRun);
-      if (evEl) {
-        if (!lastRun) {
-          evEl.textContent = "No runs yet";
-        } else if (lastRun.state === "passed") {
-          evEl.textContent = "Passed";
-        } else if (lastRun.state === "failed") {
-          evEl.textContent = "Failed";
-        } else {
-          evEl.textContent = "Integrating…";
-        }
-      }
-      if (evDetailEl) {
-        evDetailEl.textContent = "";
-        if (lastRun) {
-          const parts = [];
-          if (lastRun.statusMessage) parts.push(lastRun.statusMessage);
-          else if (lastRun.state === "passed") parts.push("Combined evidence passed.");
-          else if (lastRun.state === "failed") parts.push("Combined evidence did not pass.");
-          if (lastRun.finishedAt) parts.push(age(lastRun.finishedAt));
-          evDetailEl.append(document.createTextNode(parts.join(" · ")));
-          const rl = runLink(lastRun.revHref, "Run build");
-          if (rl) {
-            evDetailEl.append(document.createTextNode(" · "));
-            evDetailEl.append(rl);
-          }
-        } else {
-          evDetailEl.append(document.createTextNode("The last integration run's verdict."));
-        }
-      }
-
-      // Reviewed digest: only known once the plan pins it (b09). Never fabricated.
-      if (digestEl) {
-        digestEl.textContent = currentPlan ? shortSha(currentPlan.artifactDigest.replace(/^sha256:/, "")) : "—";
-      }
-
-      // Included PRs.
-      const prs = (agg && agg.includedPrs) || [];
-      if (prsWrap) prsWrap.hidden = prs.length === 0;
-      if (prsList) {
-        prsList.textContent = "";
-        for (const pr of prs) {
-          const li = document.createElement("li");
-          const label = document.createElement("span");
-          label.textContent = pr.prNumber != null ? "PR #" + pr.prNumber : pr.changeId;
-          const sha = document.createElement("span");
-          sha.className = "publish-mono subtle";
-          sha.textContent = shortSha(pr.headSha);
-          li.append(label, sha);
-          prsList.append(li);
-        }
-      }
-
-      renderPlan(data.plan);
-
-      // The Publish button: enabled only for a shippable, paywall-cleared plan and
-      // a viewer who can ship. A paywalled plan is SHOWN (upsell), never hidden.
-      if (publishBtn) {
-        const shippable = Boolean(currentPlan);
-        const paywalled = currentPlan && currentPlan.paywall && !currentPlan.paywall.allowed;
-        // rux7: never re-enable the Publish button while its POST is in flight —
-        // a poll refresh landing mid-publish must not open a double-submit.
-        publishBtn.disabled =
-          aggregatePublishing || !canShip || !shippable || paywalled || currentPlan.alreadyShipped;
-        publishBtn.title = !canShip
-          ? "Requires an owner or admin sign-in"
-          : !shippable
-            ? "The aggregate is not green / has no passed run to publish yet"
-            : paywalled
-              ? "Publishing to your live store is part of the paid plan"
-              : currentPlan.alreadyShipped
-                ? "This reviewed build is already live"
-                : "Publish the exact reviewed digest to your live store";
-      }
-      if (publishDetail) {
-        if (currentPlan && currentPlan.alreadyShipped) {
-          publishDetail.textContent =
-            "This reviewed build (" + shortSha(currentPlan.pinnedSha) + ") is already live. ";
-          const view = document.createElement("a");
-          view.href = ds.liveHref || "/";
-          view.target = "_blank";
-          view.rel = "noopener";
-          view.textContent = "View your live store →";
-          publishDetail.append(view);
-        } else if (currentPlan) {
-          publishDetail.textContent =
-            "Publishes the exact reviewed digest " + shortSha(currentPlan.artifactDigest.replace(/^sha256:/, "")) +
-            " (build " + shortSha(currentPlan.pinnedSha) + ") — no rebuild.";
-        } else {
-          publishDetail.textContent =
-            "Publishes the exact reviewed digest — no rebuild. Available once the aggregate is green and its integration run passed.";
-        }
-      }
-    };
-
-    const renderPlan = (plan) => {
-      const planBox = aggPanel && aggPanel.querySelector("[data-aggregate-plan]");
-      if (!planBox) return;
-      const chipEl = planBox.querySelector("[data-aggregate-plan-chip]");
-      const grid = planBox.querySelector("[data-aggregate-plan-grid]");
-      const note = planBox.querySelector("[data-aggregate-plan-note]");
-      if (grid) grid.textContent = "";
-
-      // No plan at all (degenerate: no store bound) — hide the box.
-      if (!plan) {
-        planBox.hidden = true;
-        return;
-      }
-      planBox.hidden = false;
-
-      if (!plan.ok) {
-        // An honest refusal — show WHY it isn't shippable, never a fake plan.
-        if (chipEl) {
-          chipEl.textContent = "Not shippable";
-          chipEl.className = "chip amber";
-        }
-        if (note) note.textContent = plan.message || ("Not shippable (" + (plan.reason || "refused") + ").");
-        return;
-      }
-
-      const paywalled = plan.paywall && !plan.paywall.allowed;
-      if (chipEl) {
-        chipEl.textContent = plan.alreadyShipped ? "Already live" : paywalled ? "Upgrade required" : "Ready to publish";
-        chipEl.className = "chip " + (plan.alreadyShipped ? "green" : paywalled ? "amber" : "green");
-      }
-
-      const row = (term, value, mono) => {
-        const dt = document.createElement("dt");
-        dt.textContent = term;
-        const dd = document.createElement("dd");
-        if (value instanceof Node) dd.append(value);
-        else {
-          dd.textContent = value;
-          if (mono) dd.className = "publish-mono";
-        }
-        grid.append(dt, dd);
-      };
-
-      row("Reviewed build", shortSha(plan.pinnedSha), true);
-      row("Reviewed digest", shortSha(plan.artifactDigest.replace(/^sha256:/, "")), true);
-      row("Included changes", String((plan.includedPrs || []).length) + " change" + ((plan.includedPrs || []).length === 1 ? "" : "s"));
-      const runCell = document.createElement("span");
-      runCell.append(document.createTextNode(plan.integrationRunId));
-      const planRunLink = runLink(plan.pinnedRevHref, "Open build");
-      if (planRunLink) {
-        runCell.append(document.createTextNode(" · "));
-        runCell.append(planRunLink);
-      }
-      row("Integration run", runCell);
-      if (plan.rollbackTarget) {
-        row("Rollback to", shortSha(plan.rollbackTarget.aggregateSha), true);
-      } else {
-        row("Rollback to", "None (first publish)");
-      }
-      row("Subscription", plan.paywall && plan.paywall.allowed ? "Enabled" : "Not enabled");
-
-      if (note) {
-        note.textContent = paywalled
-          ? (plan.paywall.message || "Publishing to your live store requires the paid plan.")
-          : plan.alreadyShipped
-            ? "This reviewed build is already live — nothing to publish."
-            : "Publish sends the exact reviewed digest above to your live store. No rebuild.";
-      }
-    };
-
-    // The exact-digest Publish (b10 ship = b09 orchestrator.ship). Confirms the
-    // pinned plan, then POSTs { confirmGoLive, expectedAggregateSha,
-    // expectedArtifactDigest } — the reviewed-digest guard: a stale plan (queue
-    // moved / artifact changed) is refused by the server, never shipped blind.
-    // ── Publish-live ceremony (shipoff) ──────────────────────────────────────
-    // The go-live counterpart of the accept liftoff below (shares its shell,
-    // styles, planRow + celebrate helpers — referenced at runtime, defined a few
-    // sections down). One honest in-flight state: ship is a single POST that
-    // promotes the pinned digest, so no staged theater — just plan → publishing →
-    // outcome with a real "View your live store" link.
-    const shipoff = root.querySelector("[data-shipoff]");
-    const shipoffCard = shipoff && shipoff.querySelector(".liftoff-card");
-    const shipoffEls = shipoff
-      ? {
-          plan: shipoff.querySelector("[data-shipoff-plan]"),
-          flight: shipoff.querySelector("[data-shipoff-flight]"),
-          outcome: shipoff.querySelector("[data-shipoff-outcome]"),
-          grid: shipoff.querySelector("[data-shipoff-grid]"),
-          proceed: shipoff.querySelector("[data-shipoff-proceed]"),
-          cancel: shipoff.querySelector("[data-shipoff-cancel]"),
-          live: shipoff.querySelector("[data-shipoff-live]"),
-          elapsed: shipoff.querySelector("[data-shipoff-elapsed]"),
-          seal: shipoff.querySelector("[data-shipoff-seal]"),
-          outcomeTitle: shipoff.querySelector("[data-shipoff-outcome-title]"),
-          outcomeDetail: shipoff.querySelector("[data-shipoff-outcome-detail]"),
-          view: shipoff.querySelector("[data-shipoff-view]"),
-          done: shipoff.querySelector("[data-shipoff-done]"),
-          confetti: shipoff.querySelector("[data-shipoff-confetti]"),
-        }
-      : null;
-    let shipoffTimer = null;
-    const closeShipoff = () => {
-      if (shipoffTimer) { clearInterval(shipoffTimer); shipoffTimer = null; }
-      if (shipoff) shipoff.hidden = true;
-      if (shipoffEls) shipoffEls.confetti.textContent = "";
-    };
-    const showShipoffPhase = (phase) => {
-      if (!shipoffEls) return;
-      shipoffEls.plan.hidden = phase !== "plan";
-      shipoffEls.flight.hidden = phase !== "flight";
-      shipoffEls.outcome.hidden = phase !== "outcome";
-      if (shipoffCard) shipoffCard.dataset.mode = phase;
-    };
-
-    const buildPublishPlanText = (plan) => {
-      const lines = ["Publish plan (exact reviewed digest — no rebuild):"];
-      lines.push("  tenant:   " + (appDomain || repo));
-      lines.push("  build:    " + shortSha(plan.pinnedSha));
-      lines.push("  digest:   " + plan.artifactDigest);
-      lines.push("  changes:  " + (plan.includedPrs || []).length + " included");
-      if (plan.rollbackTarget) lines.push("  rollback: " + shortSha(plan.rollbackTarget.aggregateSha));
-      lines.push("  effect:   publish this exact digest to your LIVE store.");
-      return lines.join("\n");
-    };
-
-    const shortDigest = (digest) => {
-      const d = String(digest || "").replace(/^sha256:/, "");
-      return d ? "sha256:" + d.slice(0, 12) + "…" : "—";
-    };
-
-    const publishAggregate = (button) => {
-      if (!currentPlan) return;
-      const plan = currentPlan;
-      if (!shipoff || !shipoffEls) {
-        // No-markup fallback only — the ceremony IS the confirm now.
-        if (!window.confirm(buildPublishPlanText(plan) + "\n\nPublish live?")) return;
-        runShip(plan, button);
-        return;
-      }
-      shipoffEls.grid.textContent = "";
-      shipoffEls.grid.append(
-        ...planRow("Store", appDomain || repo),
-        ...planRow("Build", shortSha(plan.pinnedSha), true),
-        ...planRow("Digest", shortDigest(plan.artifactDigest), true),
-        ...planRow("Changes", (plan.includedPrs || []).length + " included"),
-        ...(plan.rollbackTarget
-          ? planRow("Rollback to", shortSha(plan.rollbackTarget.aggregateSha), true)
-          : []),
-      );
-      showShipoffPhase("plan");
-      shipoff.hidden = false;
-      shipoffEls.proceed.focus();
-      shipoffEls.cancel.onclick = () => closeShipoff();
-      shipoffEls.done.onclick = () => closeShipoff();
-      shipoffEls.proceed.onclick = () => runShip(plan, button);
-    };
-
-    const runShip = async (plan, button) => {
-      if (button) button.disabled = true;
-      aggregatePublishing = true; // rux7: hold the button disabled across polls
-      setStatus(aggStatusEl, "Publishing the reviewed build (" + shortSha(plan.pinnedSha) + ") live…");
-      const startedAt = Date.now();
-      if (shipoffEls) {
-        showShipoffPhase("flight");
-        shipoffTimer = setInterval(() => {
-          const s = Math.floor((Date.now() - startedAt) / 1000);
-          shipoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
-        }, 1000);
-      }
-      const outcome = (state, title, detail, showView) => {
-        if (!shipoffEls) return;
-        if (shipoffTimer) { clearInterval(shipoffTimer); shipoffTimer = null; }
-        shipoffEls.seal.dataset.state = state;
-        shipoffEls.outcomeTitle.textContent = title;
-        shipoffEls.outcomeDetail.textContent = detail;
-        shipoffEls.view.hidden = !showView;
-        if (showView) shipoffEls.view.href = ds.liveHref || "/";
-        showShipoffPhase("outcome");
-        shipoffEls.done.focus();
-        if (state === "ok") celebrate(shipoffEls.confetti);
-      };
-      try {
-        const res = await fetch(ds.shipEndpoint, {
-          method: "POST",
-          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
-          body: JSON.stringify({
-            aggregateId: plan.aggregateId,
-            // The HUMAN go-live gate + the reviewed-digest guards (b09 ship input).
-            confirmGoLive: true,
-            expectedAggregateSha: plan.pinnedSha,
-            expectedArtifactDigest: plan.artifactDigest,
-          }),
-        });
-        const data = await res.json().catch(() => ({}));
-        // b09 AggregateShipResult: the ONLY live claim is state === "shipped".
-        if (data.state === "shipped") {
-          setStatus(
-            aggStatusEl,
-            "Published live · build " + shortSha(data.pinnedSha) + " (receipt " + (data.receiptId || "—") + ").",
-            "ok",
-          );
-          outcome(
-            "ok",
-            "Your store is live",
-            "Build " + shortSha(data.pinnedSha) + " — the exact digest you reviewed — is now serving" +
-              (data.receiptId ? " (receipt " + data.receiptId + ")." : "."),
-            true,
-          );
-        } else {
-          let message;
-          if (data.state === "promote_failed" || data.state === "record_failed") {
-            // Honest partial-failure truth — recoverable, never a false "shipped".
-            message = data.message || "Publish did not complete (" + data.state + "). Retry.";
-          } else if (data.reason === "paywall") {
-            message = data.message || "Publishing to your live store is part of the paid plan.";
-          } else {
-            message = data.message || data.error || "Publish refused (" + (data.reason || res.status) + ")";
-          }
-          setStatus(aggStatusEl, message, "err");
-          outcome("err", "Publish did not complete", message + " Your live store is unchanged.", false);
-        }
-      } catch {
-        setStatus(aggStatusEl, "Publish failed — network error", "err");
-        outcome(
-          "err",
-          "Publish did not complete",
-          "Network error mid-publish — refresh to see the honest state; your live store serves the last published version.",
-          false,
-        );
-      } finally {
-        aggregatePublishing = false;
-        if (button) button.disabled = false;
-        loadQueue();
-        loadVersions();
-      }
-    };
-
-    const aggStatusEl = aggPanel && aggPanel.querySelector("[data-aggregate-status]");
-    aggPanel
-      ?.querySelector("[data-aggregate-publish]")
-      ?.addEventListener("click", (event) => publishAggregate(event.currentTarget));
-
-    // ── Accept-to-preview LIFTOFF ─────────────────────────────────────────────
-    // The plan confirm + live integration flight + outcome ceremony (replaces
-    // the old window.confirm plan popup). Same b11 contract as before: accept =
-    // `POST /api/changes/integrate` (b08) → integrate into the protected
-    // `preview` aggregate, rebuild + combined-evidence it (b05). Flips NO live
-    // channel — going live is the aggregate card's Publish.
-    //
-    // HONESTY RULE for the stage rail: a stage only advances on a REAL signal —
-    // the outcome POST resolving, or GET /api/changes polling showing the
-    // candidate inside `aggregate.includedPrs` (merge landed) / an `activeRun`
-    // (build+evidence running, statusMessage relayed verbatim). No timers ever
-    // fake progress.
-    const liftoff = root.querySelector("[data-liftoff]");
-    const liftoffCard = liftoff && liftoff.querySelector(".liftoff-card");
-    const liftoffEls = liftoff
-      ? {
-          plan: liftoff.querySelector("[data-liftoff-plan]"),
-          flight: liftoff.querySelector("[data-liftoff-flight]"),
-          outcome: liftoff.querySelector("[data-liftoff-outcome]"),
-          title: liftoff.querySelector("[data-liftoff-title]"),
-          grid: liftoff.querySelector("[data-liftoff-grid]"),
-          proceed: liftoff.querySelector("[data-liftoff-proceed]"),
-          cancel: liftoff.querySelector("[data-liftoff-cancel]"),
-          flightTitle: liftoff.querySelector("[data-liftoff-flight-title]"),
-          live: liftoff.querySelector("[data-liftoff-live]"),
-          elapsed: liftoff.querySelector("[data-liftoff-elapsed]"),
-          hide: liftoff.querySelector("[data-liftoff-hide]"),
-          seal: liftoff.querySelector("[data-liftoff-seal]"),
-          outcomeTitle: liftoff.querySelector("[data-liftoff-outcome-title]"),
-          outcomeDetail: liftoff.querySelector("[data-liftoff-outcome-detail]"),
-          review: liftoff.querySelector("[data-liftoff-review]"),
-          done: liftoff.querySelector("[data-liftoff-done]"),
-          confetti: liftoff.querySelector("[data-liftoff-confetti]"),
-        }
-      : null;
-
-    const liftoffStage = (name) =>
-      liftoff && liftoff.querySelector('[data-liftoff-stage="' + name + '"]');
-    const LIFTOFF_STAGES = ["merge", "build", "evidence", "green"];
-    const setStage = (name, state) => {
-      const el = liftoffStage(name);
-      if (el) el.dataset.state = state; // pending | active | done | fail
-    };
-    // Advance the rail so everything before `name` is done and `name` is active.
-    const railTo = (name) => {
-      const idx = LIFTOFF_STAGES.indexOf(name);
-      LIFTOFF_STAGES.forEach((s, i) => {
-        const el = liftoffStage(s);
-        const cur = el && el.dataset.state;
-        if (cur === "fail") return; // never un-fail
-        setStage(s, i < idx ? "done" : i === idx ? "active" : "pending");
-      });
-    };
-
-    let liftoffTimer = null;
-    let liftoffPoll = null;
-    let liftoffOpenedFrom = null;
-    const stopLiftoffLoops = () => {
-      if (liftoffTimer) { clearInterval(liftoffTimer); liftoffTimer = null; }
-      if (liftoffPoll) { clearInterval(liftoffPoll); liftoffPoll = null; }
-    };
-    const closeLiftoff = () => {
-      stopLiftoffLoops();
-      if (liftoff) liftoff.hidden = true;
-      if (liftoffEls) liftoffEls.confetti.textContent = "";
-      if (liftoffOpenedFrom && document.contains(liftoffOpenedFrom)) liftoffOpenedFrom.focus();
-      liftoffOpenedFrom = null;
-    };
-    const showPhase = (phase) => {
-      if (!liftoffEls) return;
-      liftoffEls.plan.hidden = phase !== "plan";
-      liftoffEls.flight.hidden = phase !== "flight";
-      liftoffEls.outcome.hidden = phase !== "outcome";
-      if (liftoffCard) liftoffCard.dataset.mode = phase;
-    };
-
-    const planRow = (dt, dd, mono) => {
-      const t = document.createElement("dt");
-      t.textContent = dt;
-      const d = document.createElement("dd");
-      d.textContent = dd;
-      if (mono) d.className = "publish-mono";
-      return [t, d];
-    };
-
-    const celebrate = (container) => {
-      if (!container) return;
-      if (window.matchMedia && window.matchMedia("(prefers-reduced-motion: reduce)").matches) return;
-      const colors = ["#0f9d8f", "#25b8a8", "#f4b942", "#5b8def", "#e2634f"];
-      for (let i = 0; i < 42; i++) {
-        const p = document.createElement("i");
-        p.style.left = Math.random() * 100 + "%";
-        p.style.background = colors[i % colors.length];
-        p.style.animationDelay = Math.random() * 0.35 + "s";
-        p.style.animationDuration = 0.9 + Math.random() * 0.9 + "s";
-        p.style.setProperty("--liftoff-drift", (Math.random() * 160 - 80).toFixed(0) + "px");
-        p.style.setProperty("--liftoff-spin", (Math.random() * 640 - 320).toFixed(0) + "deg");
-        container.append(p);
-      }
-      setTimeout(() => { container.textContent = ""; }, 2400);
-    };
-
-    // The live poll during flight: reflect the server's REAL progress.
-    const startFlightPoll = (change, preFlightSha) => {
-      let inAggregate = false;
-      liftoffPoll = setInterval(async () => {
-        try {
-          const res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
-          if (!res.ok) return;
-          const data = await res.json();
-          const agg = data.aggregate || {};
-          const included = (agg.includedPrs || []).some((p) => p.changeId === change.changeId);
-          const shaMoved = agg.aggregateSha && agg.aggregateSha !== preFlightSha;
-          const run = agg.activeRun || null;
-          if (!inAggregate && (included || shaMoved)) {
-            inAggregate = true;
-            railTo("build");
-            if (liftoffEls) liftoffEls.live.textContent =
-              "Merged into preview — rebuilding the combined aggregate…";
-          }
-          if (run) {
-            railTo("evidence");
-            if (liftoffEls) liftoffEls.live.textContent =
-              run.statusMessage || "Combined evidence is running…";
-          }
-        } catch { /* polling is best-effort; the POST outcome is authoritative */ }
-      }, 2500);
-    };
-
-    const openLiftoff = (change, button) => {
-      if (!liftoff || !liftoffEls) return false;
-      liftoffOpenedFrom = button || null;
-      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
-      liftoffEls.title.textContent = "Integrate " + target + " into preview";
-      liftoffEls.grid.textContent = "";
-      liftoffEls.grid.append(
-        ...planRow("Store", appDomain || repo),
-        ...(change.prNumber != null ? planRow("Pull request", "#" + change.prNumber) : []),
-        ...planRow("Change", change.changeId, true),
-        ...(change.headSha ? planRow("Head", shortSha(change.headSha), true) : []),
-      );
-      LIFTOFF_STAGES.forEach((s) => setStage(s, "pending"));
-      liftoffEls.live.textContent = "Working…";
-      liftoffEls.elapsed.textContent = "0:00";
-      showPhase("plan");
-      liftoff.hidden = false;
-      liftoffEls.proceed.focus();
-
-      liftoffEls.cancel.onclick = () => closeLiftoff();
-      liftoffEls.done.onclick = () => closeLiftoff();
-      liftoffEls.hide.onclick = () => { liftoff.hidden = true; }; // flight keeps running
-      liftoffEls.proceed.onclick = () => runIntegration(change, button);
-      return true;
-    };
-
-    // Esc: close in plan/outcome; during flight just hide (the POST keeps going).
-    // Handles BOTH ceremonies (accept liftoff + publish shipoff).
-    document.addEventListener("keydown", (ev) => {
-      if (ev.key !== "Escape") return;
-      if (liftoff && !liftoff.hidden) {
-        const mode = liftoffCard && liftoffCard.dataset.mode;
-        if (mode === "flight") liftoff.hidden = true;
-        else closeLiftoff();
-      }
-      if (shipoff && !shipoff.hidden) {
-        const mode = shipoffCard && shipoffCard.dataset.mode;
-        if (mode === "flight") shipoff.hidden = true;
-        else closeShipoff();
-      }
-    });
-
-    // b08 integrate returns an IntegrateOutcome — { ok, queueState, runState,
-    // aggregateSha, pointerMoved, statusMessage, reason? } — NEVER a bare
-    // merged:true. Render it honestly: green advances the aggregate; red left it
-    // exactly where it was and names the failing stage.
-    const runIntegration = async (change, button) => {
-      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
-      if (button) button.disabled = true;
-      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
-      setStatus(statusEl, "Integrating " + change.changeId + " into preview…");
-      const startedAt = Date.now();
-      let preFlightSha = null;
-      if (liftoffEls) {
-        showPhase("flight");
-        liftoffEls.flightTitle.textContent = "Integrating " + target + " into preview";
-        railTo("merge");
-        liftoffEls.live.textContent = "Squash-merging the candidate into preview…";
-        liftoffTimer = setInterval(() => {
-          const s = Math.floor((Date.now() - startedAt) / 1000);
-          liftoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
-        }, 1000);
-      }
-      try {
-        // Snapshot the pre-flight aggregate sha so the poll can detect the merge
-        // landing (sha moved) even before includedPrs reflects it.
-        try {
-          const pre = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
-          if (pre.ok) preFlightSha = ((await pre.json()).aggregate || {}).aggregateSha || null;
-        } catch { /* best-effort */ }
-        startFlightPoll(change, preFlightSha);
-
-        const res = await fetch(ds.integrateEndpoint, {
-          method: "POST",
-          headers: {
-            "content-type": "application/json",
-            // Mirror of the server-side capability model (UX): the server
-            // re-derives capability and stays authoritative.
-            "x-tot-capability": "ship-on-behalf",
-          },
-          body: JSON.stringify({
-            repo,
-            changeId: change.changeId,
-            prNumber: change.prNumber ?? undefined,
-            expectedHeadSha: change.headSha || undefined,
-          }),
-        });
-        const data = await res.json().catch(() => ({}));
-        stopLiftoffLoops();
-        if (res.ok && data.ok) {
-          setStatus(
-            statusEl,
-            "Integrated " + change.changeId + " — preview aggregate is green (" +
-              shortSha(data.aggregateSha) + "). Review the aggregate, then Publish to go live.",
-            "ok",
-          );
-          if (liftoffEls) {
-            LIFTOFF_STAGES.forEach((s) => setStage(s, "done"));
-            liftoffEls.seal.dataset.state = "ok";
-            liftoffEls.outcomeTitle.textContent = "The preview aggregate is green";
-            liftoffEls.outcomeDetail.textContent =
-              target + " is in. Aggregate build " + shortSha(data.aggregateSha) +
-              " passed its combined evidence — this exact build is what you review, and what " +
-              "Publish would take live. Nothing is live yet.";
-            if (data.aggregateSha) {
-              liftoffEls.review.href =
-                "/preview/" + encodeURIComponent(appDomain) + "/rev/" + data.aggregateSha + "/";
-              liftoffEls.review.hidden = false;
-            } else {
-              liftoffEls.review.hidden = true;
-            }
-            if (liftoff.hidden) liftoff.hidden = false; // surface the payoff even if backgrounded
-            showPhase("outcome");
-            liftoffEls.done.focus();
-            celebrate(liftoffEls.confetti);
-          }
-        } else {
-          let message;
-          let failStage = "merge";
-          if (res.ok && data.queueState === "red") {
-            // The queue ran but the aggregate did not go green — the candidate did
-            // NOT advance the shippable set. Name the honest failing stage.
-            failStage = "evidence";
-            message =
-              "Integration of " + change.changeId + " failed (" + (data.reason || "red") + "): " +
-              (data.statusMessage || "the aggregate did not pass its combined evidence.") +
-              " The aggregate is unchanged.";
-          } else if (data.reason === "not_preview_base") {
-            message =
-              "Not integrated: " + change.changeId + " does not target the preview branch " +
-              "(base is not \"preview\"). " + (data.statusMessage || "");
-          } else {
-            message = data.statusMessage || data.error || "Integrate failed (" + res.status + ")";
-          }
-          setStatus(statusEl, message, "err");
-          if (liftoffEls) {
-            setStage(failStage, "fail");
-            liftoffEls.seal.dataset.state = "err";
-            liftoffEls.outcomeTitle.textContent = "Integration did not land";
-            liftoffEls.outcomeDetail.textContent = message;
-            liftoffEls.review.hidden = true;
-            if (liftoff.hidden) liftoff.hidden = false;
-            showPhase("outcome");
-            liftoffEls.done.focus();
-          }
-        }
-      } catch {
-        stopLiftoffLoops();
-        setStatus(statusEl, "Integrate failed — network error", "err");
-        if (liftoffEls) {
-          liftoffEls.seal.dataset.state = "err";
-          liftoffEls.outcomeTitle.textContent = "Integration did not land";
-          liftoffEls.outcomeDetail.textContent =
-            "Network error mid-flight — refresh the queue to see the aggregate's honest state.";
-          liftoffEls.review.hidden = true;
-          if (liftoff.hidden) liftoff.hidden = false;
-          showPhase("outcome");
-        }
-      } finally {
-        busyChanges.delete(change.changeId);
-        if (button) button.disabled = false;
-        loadQueue();
-      }
-    };
-
-    const integrateCandidate = (change, button) => {
-      // The liftoff dialog IS the plan confirm now; window.confirm stays only as
-      // the no-dialog fallback (markup missing = fail open to the old popup).
-      if (openLiftoff(change, button)) return;
-      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
-      const plan =
-        "Accept-to-preview plan:\n  tenant:    " + (appDomain || repo) +
-        (change.prNumber != null ? "\n  PR:        #" + change.prNumber : "") +
-        "\n  change id: " + change.changeId +
-        (change.headSha ? "\n  head sha:  " + shortSha(change.headSha) : "") +
-        "\n  effect:    integrate " + target + " into the preview aggregate, then rebuild + " +
-        "re-evidence it. Does NOT go live — publish the reviewed build separately.";
-      if (!window.confirm(plan + "\n\nProceed?")) return;
-      runIntegration(change, button);
-    };
-
-    const rejectChange = async (change, button) => {
-      const reason = window.prompt(
-        "Reject " + change.changeId + " — add a short note for the submitter:",
-      );
-      if (reason == null) return;
-      if (!reason.trim()) {
-        setStatus(statusEl, "A reject note is required.", "err");
-        return;
-      }
-      button.disabled = true;
-      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
-      setStatus(statusEl, "Rejecting " + change.changeId + "…");
-      try {
-        const res = await fetch(
-          ds.changesEndpoint + "/" + encodeURIComponent(change.changeId) + "/reject",
-          {
-            method: "POST",
-            headers: {
-              "content-type": "application/json",
-              "x-tot-capability": "ship-on-behalf",
-            },
-            body: JSON.stringify({ repo, reason: reason.trim() }),
-          },
-        );
-        const data = await res.json().catch(() => ({}));
-        if (res.ok) {
-          setStatus(statusEl, "Change " + change.changeId + " rejected.", "ok");
-        } else {
-          setStatus(statusEl, data.error || "Reject failed (" + res.status + ")", "err");
-        }
-      } catch {
-        setStatus(statusEl, "Reject failed — network error", "err");
-      } finally {
-        busyChanges.delete(change.changeId);
-        button.disabled = false;
-        loadQueue();
-      }
-    };
-
-    // U7 — retire/GC. Mirror of the accept plan affordance (decision
-    // operator-verb-and-hosting-model): state EXACTLY what retire does — evict the
-    // candidate's preview environment + immutable version — and that it is
-    // REBUILDABLE (degrades to "not built yet", not a 404), so an operator can't
-    // confuse it with Reject. Same shape as `tot retire`'s CLI plan for parity.
-    const buildRetirePlan = (change) => {
-      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
-      const lines = ["Retire plan:", "  tenant:    " + (appDomain || repo)];
-      if (change.prNumber != null) lines.push("  PR:        #" + change.prNumber);
-      lines.push("  change id: " + change.changeId);
-      if (change.headSha) lines.push("  head sha:  " + shortSha(change.headSha));
-      lines.push(
-        "  effect:    evict " + target + "'s preview environment + version to reclaim space.",
-      );
-      lines.push(
-        "  rebuild:   REVERSIBLE — rebuild it any time (this is NOT Reject; the change stays open).",
-      );
-      return lines.join("\n");
-    };
-
-    const retireChange = async (change, button) => {
-      if (!window.confirm(buildRetirePlan(change) + "\n\nProceed?")) return;
-      button.disabled = true;
-      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
-      setStatus(statusEl, "Retiring " + change.changeId + "…");
-      try {
-        const res = await fetch(ds.retireEndpoint, {
-          method: "POST",
-          headers: {
-            "content-type": "application/json",
-            // Mirror of the server-side capability model (UX); the server
-            // re-derives capability and stays authoritative.
-            "x-tot-capability": "ship-on-behalf",
-          },
-          body: JSON.stringify({
-            changeId: change.changeId,
-            pr: change.prNumber ?? undefined,
-          }),
-        });
-        const data = await res.json().catch(() => ({}));
-        if (res.ok && data.ok) {
-          setStatus(
-            statusEl,
-            data.evicted
-              ? "Retired " + change.changeId + " — the preview was evicted (rebuildable on demand)."
-              : "Retire " + change.changeId + ": nothing to evict (already retired).",
-            "ok",
-          );
-        } else {
-          setStatus(statusEl, data.error || "Retire failed (" + res.status + ")", "err");
-        }
-      } catch {
-        setStatus(statusEl, "Retire failed — network error", "err");
-      } finally {
-        busyChanges.delete(change.changeId);
-        button.disabled = false;
-        loadQueue();
-      }
-    };
-
-    // ---- rux5: build-on-demand for a synthetic not-built PR ------------------
-    // Mirror of the integrate/retire plan affordances: state EXACTLY what build
-    // does — materialize this PR's hosted preview at its forge head — and that it
-    // is INERT (flips no live channel). POSTs { pr, headSha?, baseSha? }; the row
-    // already carries the head sha GET /api/changes resolved via forge PR-read, and
-    // the server re-resolves it authoritatively when the body omits it. Shows an
-    // in-progress state (disabled + "Building…") while the build runs, then reloads
-    // the queue so the freshly-built PR reappears as a built candidate.
-
-    const buildPreviewPlan = (change) => {
-      const lines = ["Build preview plan:", "  tenant:   " + (appDomain || repo)];
-      lines.push("  PR:       #" + change.prNumber);
-      if (change.headSha) lines.push("  head sha: " + shortSha(change.headSha));
-      lines.push(
-        "  effect:   materialize this PR's hosted preview at its head — INERT " +
-          "(does NOT go live).",
-      );
-      return lines.join("\n");
-    };
-
-    const buildPreview = async (change, button) => {
-      const label = "PR #" + change.prNumber;
-      if (!window.confirm(buildPreviewPlan(change) + "\n\nBuild the preview now?")) return;
-      button.disabled = true;
-      const originalText = button.textContent;
-      button.textContent = "Building…";
-      button.dataset.building = "true";
-      // rux7: record the in-flight build so a poll re-render preserves the
-      // spinner/disabled state on the freshly-rendered button (cleared in finally).
-      if (change.prNumber != null) inflightBuilds.add(change.prNumber);
-      setStatus(statusEl, "Building preview for " + label + "…");
-      try {
-        const res = await fetch(ds.buildEndpoint, {
-          method: "POST",
-          headers: {
-            "content-type": "application/json",
-            // Mirror of the server-side capability model (UX); the server
-            // re-derives capability (buildGate) and stays authoritative.
-            "x-tot-capability": "ship-on-behalf",
-          },
-          body: JSON.stringify({
-            pr: change.prNumber,
-            headSha: change.headSha || undefined,
-            baseSha: change.baseSha || undefined,
-          }),
-        });
-        const data = await res.json().catch(() => ({}));
-        if (res.ok && data.ok) {
-          setStatus(
-            statusEl,
-            "Built preview for " + label +
-              " — it now appears as a built change in the queue.",
-            "ok",
-          );
-        } else if (data && data.ok === false) {
-          // reconcileCandidate returned a blocked/failed candidate (e.g. a safety
-          // finding with no override) — the honest reason, never a false success.
-          setStatus(
-            statusEl,
-            "Build did not complete for " + label + ": " +
-              ((data.errors && data.errors.join("; ")) || data.error || "blocked"),
-            "err",
-          );
-        } else {
-          setStatus(statusEl, data.error || "Build failed (" + res.status + ")", "err");
-        }
-      } catch {
-        setStatus(statusEl, "Build failed — network error", "err");
-      } finally {
-        if (change.prNumber != null) inflightBuilds.delete(change.prNumber);
-        button.disabled = false;
-        button.textContent = originalText;
-        delete button.dataset.building;
-        loadQueue();
-      }
-    };
-
-    // ---- rux6: unified review pane -----------------------------------------
-    // "One review moment": expanding a candidate row reveals a single pane with
-    // the live preview (iframed SAME-ORIGIN — the /preview/<tenant>/pr/<N> route
-    // serves `frame-ancestors 'self'` + `X-Frame-Options: SAMEORIGIN`, so a
-    // same-origin admin embed is permitted; a cross-origin embed is refused,
-    // which is why the pane also always offers an "Open in new tab" link), the
-    // evidence chips the row already carries (change.evidence), the dg7 diff
-    // (reusing renderDiff below — GET /api/changes/<id>/diff, which never invents
-    // a diff for a non-renderable candidate), and the SAME Accept-to-preview /
-    // Reject actions. The reviewer never leaves the queue to review and act; the
-    // server stays authoritative for every action (this is UI consolidation only).
-
-    const diffBase = ds.diffEndpointBase;
-
-    const reviewRowFor = (tr) => {
-      const next = tr.nextElementSibling;
-      return next && next.dataset && next.dataset.publishReviewRow === tr.dataset.changeRowId
-        ? next
-        : null;
-    };
-
-    const closeReview = (tr, button) => {
-      const existing = reviewRowFor(tr);
-      if (existing) existing.remove();
-      if (button) {
-        button.textContent = "Review";
-        button.setAttribute("aria-expanded", "false");
-      }
-    };
-
-    // Evidence chips from the data the row already carries (change.evidence):
-    // an overall promotable verdict + one chip per reported check.
-    const renderEvidenceChips = (container, change) => {
-      const checks = (change.evidence && change.evidence.checks) || [];
-      const promotable = Boolean(change.evidence && change.evidence.promotable);
-      container.append(
-        promotable ? chip("Checks passed", "green") : chip("Checks blocked", "amber"),
-      );
-      for (const c of checks) {
-        const tone = c.status === "pass" ? "green" : c.status === "fail" ? "red" : "amber";
-        const label = (c.label || c.id || "check") + (c.status && c.status !== "pass" ? " · " + c.status : "");
-        const el = chip(label, tone);
-        if (c.detail) el.title = c.detail;
-        container.append(el);
-      }
-      if (!checks.length) container.append(subtle("No checks reported yet"));
-    };
-
-    // Build the split pane. Returns the pane node + the diff container so the
-    // caller can populate the diff asynchronously (reusing renderDiff).
-    const buildReviewPane = (change) => {
-      const pane = document.createElement("div");
-      pane.className = "review-pane";
-
-      // Preview column — same-origin iframe of the friendly per-PR route (it
-      // handles every state: ready render, or the not-built page). Falls back to
-      // any server-provided previewUrl for a change-first row with no PR number.
-      const previewUrl = candidatePrUrl(change.prNumber) || change.previewUrl;
-      const previewCol = document.createElement("div");
-      previewCol.className = "review-preview";
-      const pHead = document.createElement("div");
-      pHead.className = "review-pane-head";
-      const pTitle = document.createElement("b");
-      pTitle.textContent = "Preview";
-      pHead.append(pTitle);
-      if (previewUrl) {
-        const openLink = document.createElement("a");
-        openLink.href = previewUrl;
-        openLink.target = "_blank";
-        openLink.rel = "noopener";
-        openLink.textContent = "Open in new tab ↗";
-        pHead.append(openLink);
-      }
-      previewCol.append(pHead);
-      if (previewUrl) {
-        const frame = document.createElement("iframe");
-        frame.className = "review-frame";
-        frame.src = previewUrl;
-        frame.loading = "lazy";
-        frame.title =
-          change.prNumber != null
-            ? "Preview of PR #" + change.prNumber
-            : "Preview of " + change.changeId;
-        previewCol.append(frame);
-      } else {
-        previewCol.append(subtle("No preview is available for this change yet."));
-      }
-
-      // Detail column — evidence chips + diff + the same Accept/Reject actions.
-      const detailCol = document.createElement("div");
-      detailCol.className = "review-detail";
-
-      const evSection = document.createElement("div");
-      evSection.className = "review-section";
-      const evTitle = document.createElement("b");
-      evTitle.textContent = "Checks";
-      const evChips = document.createElement("div");
-      evChips.className = "review-chips";
-      renderEvidenceChips(evChips, change);
-      evSection.append(evTitle, evChips);
-      detailCol.append(evSection);
-
-      const diffSection = document.createElement("div");
-      diffSection.className = "review-section";
-      const diffTitle = document.createElement("b");
-      diffTitle.textContent = "Diff";
-      const diffTarget = document.createElement("div");
-      diffTarget.className = "review-diff-target";
-      diffTarget.append(subtle("Loading the diff…"));
-      diffSection.append(diffTitle, diffTarget);
-      detailCol.append(diffSection);
-
-      // The SAME actions as the row — same handlers, same gates. Not a new authz
-      // path: integrateCandidate/rejectChange POST to the same endpoints, and the
-      // server re-authorizes.
-      const actionRow = document.createElement("div");
-      actionRow.className = "review-actions";
-      const accept = document.createElement("button");
-      accept.type = "button";
-      accept.className = "btn primary";
-      accept.textContent = "Accept to preview";
-      accept.disabled = !canShip || !change.mergeable;
-      accept.title = !canShip
-        ? "Requires an owner or admin sign-in"
-        : !change.mergeable
-          ? "This change is not ready to integrate"
-          : "Integrate this change into the preview aggregate (does not go live)";
-      accept.addEventListener("click", () => integrateCandidate(change, accept));
-      const reject = document.createElement("button");
-      reject.type = "button";
-      reject.className = "btn";
-      reject.textContent = "Reject";
-      reject.disabled = !canShip;
-      reject.title = canShip
-        ? "Close this change without publishing"
-        : "Requires an owner or admin sign-in";
-      reject.addEventListener("click", () => rejectChange(change, reject));
-      actionRow.append(accept, reject);
-      detailCol.append(actionRow);
-
-      pane.append(previewCol, detailCol);
-      return { pane, diffTarget };
-    };
-
-    const loadReviewDiff = async (change, diffTarget) => {
-      try {
-        const res = await fetch(diffBase + "/" + encodeURIComponent(change.changeId) + "/diff", {
-          headers: { accept: "application/json" },
-        });
-        const data = await res.json().catch(() => ({}));
-        diffTarget.textContent = "";
-        if (!res.ok) {
-          diffTarget.append(subtle(data.error || "Could not load the diff (" + res.status + ")"));
-        } else {
-          renderDiff(diffTarget, data.diff || {});
-        }
-      } catch {
-        diffTarget.textContent = "";
-        diffTarget.append(subtle("Could not load the diff — network error"));
-      }
-    };
-
-    const toggleReview = (change, button, tr) => {
-      if (!tr.dataset.changeRowId) tr.dataset.changeRowId = change.changeId;
-      if (reviewRowFor(tr)) {
-        closeReview(tr, button);
-        return;
-      }
-      const detailTr = document.createElement("tr");
-      detailTr.dataset.publishReviewRow = tr.dataset.changeRowId;
-      const td = document.createElement("td");
-      td.colSpan = 6;
-      td.className = "publish-review-cell";
-      const { pane, diffTarget } = buildReviewPane(change);
-      td.append(pane);
-      detailTr.append(td);
-      tr.after(detailTr);
-      button.textContent = "Hide review";
-      button.setAttribute("aria-expanded", "true");
-      loadReviewDiff(change, diffTarget);
-    };
-
-    const CHANGE_MARK = { added: "+", changed: "~", removed: "−" };
-
-    const renderDiff = (td, diff) => {
-      td.textContent = "";
-      const head = document.createElement("div");
-      head.className = "publish-diff-head";
-
-      // Authority: honest label of whether the diff describes the exact head.
-      const authority = diff.authority || {};
-      const authChip = chip(
-        authority.authoritative
-          ? "Reviewed at head"
-          : authority.stale
-            ? "Last-good preview (stale vs head)"
-            : authority.missing
-              ? "No evidence yet"
-              : "Head",
-        authority.authoritative ? "green" : authority.stale ? "amber" : "",
-      );
-      head.append(authChip);
-
-      if (diff.headSha) {
-        const sha = document.createElement("span");
-        sha.className = "publish-mono subtle";
-        sha.textContent = "head " + shortSha(diff.headSha);
-        head.append(sha);
-      }
-      if (diff.revHref) {
-        const rev = document.createElement("a");
-        rev.href = diff.revHref;
-        rev.target = "_blank";
-        rev.rel = "noopener";
-        rev.textContent = "Open reviewed revision";
-        head.append(rev);
-      }
-      td.append(head);
-
-      if (!diff.renderable) {
-        // Honest: a candidate that can't render has NO diff — say why (dg3), no fake.
-        const reason = document.createElement("p");
-        reason.className = "note publish-diff-blocked";
-        reason.textContent =
-          diff.blockedReason || "This candidate has no renderable version to diff yet.";
-        td.append(reason);
-        return;
-      }
-
-      const files = Array.isArray(diff.files) ? diff.files : [];
-      if (!files.length) {
-        td.append(subtle("No file changes vs the current live version."));
-        return;
-      }
-      const list = document.createElement("ul");
-      list.className = "publish-diff-list";
-      for (const f of files) {
-        const li = document.createElement("li");
-        li.className = "publish-diff-" + f.change;
-        const mark = document.createElement("span");
-        mark.className = "publish-diff-mark";
-        mark.textContent = CHANGE_MARK[f.change] || "•";
-        const path = document.createElement("code");
-        path.textContent = f.path;
-        li.append(mark, path);
-        list.append(li);
-      }
-      td.append(list);
-    };
-
-    // ---- dg7: versions / promotion history + rollback ----------------------
-    // The promotion history (u2/u3 promotion_status) with the tenant Gitea SHA,
-    // its /rev link (u5), and the current-live marker; a prior version rolls back
-    // THROUGH the one orchestrator (/api/changes/rollback → u8), rendering only the
-    // HONEST terminal state (rolled_back only when verified).
-
-    const versionsPanel = root.querySelector("[data-publish-versions]");
-    const versionsBody = versionsPanel?.querySelector("[data-versions-body]");
-    const versionsChip = versionsPanel?.querySelector("[data-versions-chip]");
-    const versionsStatus = versionsPanel?.querySelector("[data-versions-status]");
-    const versionsRollbackNote = versionsPanel?.querySelector("[data-versions-rollback-note]");
-    let rollbackMode = "control-plane";
-
-    const renderVersions = (view) => {
-      if (!versionsBody) return;
-      const versions = Array.isArray(view.versions) ? view.versions : [];
-      rollbackMode = view.rollbackMode || "control-plane";
-      versionsBody.textContent = "";
-
-      if (versionsChip) {
-        versionsChip.textContent = versions.length === 1 ? "1 version" : versions.length + " versions";
-        versionsChip.className = "chip" + (versions.length ? " blue" : "");
-      }
-
-      // Static tenants (rux13): per-version rollback is an HONEST ONE-DISPATCH.
-      // The console can't enumerate the S3 versions archive digest, so it dispatches
-      // by the tenant version id and CI resolves the digest + re-publishes — it
-      // completes via CI, not instantly (never implied one-click).
-      if (versionsRollbackNote) {
-        if (rollbackMode === "static-archive") {
-          versionsRollbackNote.hidden = false;
-          versionsRollbackNote.textContent =
-            "This store publishes to a static public site. Rolling back DISPATCHES a CI job that " +
-            "re-publishes the prior version from the S3 versions archive — it completes via CI, not " +
-            "instantly. The store keeps serving the current version until the re-publish is verified live.";
-        } else {
-          versionsRollbackNote.hidden = true;
-        }
-      }
-
-      if (!versions.length) {
-        const tr = document.createElement("tr");
-        const td = cell(subtle("No versions have been promoted to live yet."));
-        td.colSpan = 6;
-        tr.append(td);
-        versionsBody.append(tr);
-        return;
-      }
-
-      for (const v of versions) {
-        const tr = document.createElement("tr");
-
-        // Version identity: the tenant Gitea SHA (content authority) + source.
-        const idCell = document.createElement("td");
-        const strong = document.createElement("strong");
-        strong.className = "publish-mono";
-        strong.textContent = shortSha(v.versionId);
-        idCell.append(strong);
-        if (v.source) idCell.append(subtle(v.source === "commit" ? "From a commit" : "Content hash"));
-        tr.append(idCell);
-
-        // Digest (static current only — never fabricated for priors).
-        const digestCell = cell(v.digest ? shortSha(v.digest) : "—");
-        digestCell.classList.add("publish-mono");
-        if (!v.digest) digestCell.classList.add("subtle");
-        tr.append(digestCell);
-
-        tr.append(cell(age(v.promotedAt)));
-
-        // Preview: the u5 immutable /rev/<sha> link.
-        const revCell = document.createElement("td");
-        if (v.revHref) {
-          const a = document.createElement("a");
-          a.href = v.revHref;
-          a.target = "_blank";
-          a.rel = "noopener";
-          a.textContent = "Revision";
-          revCell.append(a);
-        } else {
-          revCell.append(subtle("—"));
-        }
-        tr.append(revCell);
-
-        // State: current live vs prior.
-        tr.append(cell(v.isCurrent ? chip("Current live", "green") : chip("Prior", "")));
-
-        // Action: roll back to a PRIOR version (never the current one).
-        const act = document.createElement("td");
-        act.className = "action publish-actions";
-        if (!v.isCurrent) {
-          const rollbackBtn = document.createElement("button");
-          rollbackBtn.type = "button";
-          rollbackBtn.className = "btn";
-          const isStatic = rollbackMode === "static-archive";
-          // Honest label: a static rollback completes via CI, not instantly (rux13).
-          rollbackBtn.textContent = isStatic ? "Roll back via CI" : "Roll back";
-          rollbackBtn.disabled = !canShip;
-          rollbackBtn.title = !canShip
-            ? "Requires an owner or ship-on-behalf sign-in"
-            : isStatic
-              ? "Dispatch a rollback to this version — completes via CI (not instant)"
-              : "Roll the live site back to this version";
-          rollbackBtn.addEventListener("click", () => rollbackVersion(v, rollbackBtn));
-          act.append(rollbackBtn);
-        }
-        tr.append(act);
-
-        versionsBody.append(tr);
-      }
-    };
-
-    const loadVersions = async () => {
-      if (!versionsBody) return;
-      try {
-        const res = await fetch(ds.versionsEndpoint, { headers: { accept: "application/json" } });
-        if (res.status === 401 || res.status === 403) {
-          if (versionsChip) versionsChip.textContent = "Sign-in required";
-          versionsBody.textContent = "";
-          const tr = document.createElement("tr");
-          const td = cell(subtle("Sign in as a store owner or admin to view published versions."));
-          td.colSpan = 6;
-          tr.append(td);
-          versionsBody.append(tr);
-          return;
-        }
-        const data = await res.json().catch(() => ({}));
-        if (!res.ok) {
-          setStatus(versionsStatus, data.error || "Could not load versions (" + res.status + ")", "err");
-          return;
-        }
-        renderVersions(data.view || {});
-      } catch {
-        setStatus(versionsStatus, "Could not load versions — network error", "err");
-      }
-    };
-
-    // Interpret the rollback response into ONE honest terminal state (mirrors the
-    // pure lib/publish/shipWorkspace `interpretRollbackResponse`; duplicated in
-    // plain JS because is:inline scripts can't import modules). `rolledBack` is
-    // true ONLY for a verified `rolled_back` — a `publish_pending` is NEVER a
-    // rolled-back claim.
-    const interpretRollback = (httpOk, body) => {
-      const toVersionId = typeof body.toVersionId === "string" ? body.toVersionId : null;
-      if (typeof body.state === "string") {
-        const state = ["rolled_back", "publish_pending", "publish_failed", "blocked"].includes(body.state)
-          ? body.state
-          : "error";
-        return {
-          state,
-          rolledBack: state === "rolled_back",
-          message: body.message || body.error || "Rollback returned state " + state + ".",
-        };
-      }
-      if (httpOk && body.rolledBack === true) {
-        return {
-          state: "rolled_back",
-          rolledBack: true,
-          message: toVersionId ? "Rolled back live to " + shortSha(toVersionId) + "." : "Rolled back live.",
-        };
-      }
-      return {
-        state: "blocked",
-        rolledBack: false,
-        message: (body.error || "Rollback failed") + (body.reason ? " (" + body.reason + ")" : ""),
-      };
-    };
-
-    const rollbackVersion = async (version, button) => {
-      // Static rollback (rux13) is an honest one-DISPATCH — completes via CI, not
-      // instantly; the confirm/status copy must never imply an instant flip.
-      const isStatic = rollbackMode === "static-archive";
-      const confirmMsg = isStatic
-        ? "Roll the static public site back to version " + shortSha(version.versionId) +
-            "? This DISPATCHES a rollback that completes via CI (not instantly) — the store keeps " +
-            "serving the current version until CI re-publishes the prior one."
-        : "Roll the live store back to version " + shortSha(version.versionId) +
-            "? This publishes that prior version to the live site.";
-      if (!window.confirm(confirmMsg)) return;
-      button.disabled = true;
-      setStatus(
-        versionsStatus,
-        isStatic
-          ? "Dispatching rollback to " + shortSha(version.versionId) + " (completes via CI)…"
-          : "Rolling back to " + shortSha(version.versionId) + "…",
-      );
-      try {
-        // The console dispatches by version id only; a static prior version's
-        // archive digest lives only in S3 (CI resolves it). Pass a digest ONLY when
-        // we honestly have one (never for a static prior — its digest is always null).
-        const payload = { targetVersionId: version.versionId };
-        if (version.digest) payload.targetDigest = version.digest;
-        const res = await fetch(ds.rollbackEndpoint, {
-          method: "POST",
-          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
-          body: JSON.stringify(payload),
-        });
-        const data = await res.json().catch(() => ({}));
-        const outcome = interpretRollback(res.ok, data);
-        setStatus(versionsStatus, outcome.message, outcome.rolledBack ? "ok" : outcome.state === "publish_pending" ? "ok" : "err");
-      } catch {
-        setStatus(versionsStatus, "Rollback failed — network error", "err");
-      } finally {
-        button.disabled = false;
-        loadVersions();
-        loadQueue();
-      }
-    };
-
-    // ---- Domain section ----------------------------------------------------
-
-    const domainPanel = root.querySelector("[data-publish-domain]");
-    let domainPollTimer = null;
-
-    const renderDomain = (payload) => {
-      if (!domainPanel) return;
-      const domain = payload.domain || {};
-      const stateEl = domainPanel.querySelector("[data-domain-state]");
-      const stateChip = domainPanel.querySelector("[data-domain-state-chip]");
-      const sinceEl = domainPanel.querySelector("[data-domain-since]");
-      const captureEl = domainPanel.querySelector("[data-domain-capture]");
-      const runEl = domainPanel.querySelector("[data-domain-run]");
-      const runDetailEl = domainPanel.querySelector("[data-domain-run-detail]");
-      const rollbackBtn = domainPanel.querySelector("[data-domain-rollback]");
-      const rollbackDetail = domainPanel.querySelector("[data-domain-rollback-detail]");
-      const connected = domain.state === "cloudfront";
-
-      if (stateEl) {
-        stateEl.textContent = connected
-          ? "Storefront CDN (cloudfront)"
-          : "Previous host (pantheon)";
-      }
-      if (stateChip) {
-        stateChip.textContent = connected ? "Connected" : "Not connected";
-        stateChip.className = "chip " + (connected ? "green" : "amber");
-      }
-      if (sinceEl) {
-        sinceEl.textContent = domain.since
-          ? "Since " + new Date(domain.since).toLocaleString()
-          : "Current host for " + (payload.appDomain || ds.appDomain);
-      }
-      if (captureEl) {
-        captureEl.textContent = domain.priorCapturedAt
-          ? "Captured " + new Date(domain.priorCapturedAt).toLocaleString()
-          : "None captured";
-      }
-
-      const run = domain.lastRun;
-      // "dispatched" = awaiting the CI completion callback (terminal-only wire).
-      const inFlight = run && run.status === "dispatched";
-      if (runEl) {
-        runEl.textContent = run
-          ? run.action + (run.rehearsal ? " (rehearsal)" : "") + " · " + run.status
-          : "None";
-      }
-      if (runDetailEl) {
-        runDetailEl.textContent = "";
-        if (run) {
-          const parts = [];
-          if (run.actor) parts.push("by " + run.actor);
-          if (run.startedAt) parts.push(age(run.startedAt));
-          runDetailEl.append(document.createTextNode(parts.join(" · ")));
-          if (run.runUrl) {
-            const link = document.createElement("a");
-            link.href = run.runUrl;
-            link.target = "_blank";
-            link.rel = "noopener";
-            link.textContent = "View run";
-            runDetailEl.append(document.createTextNode(" · "));
-            runDetailEl.append(link);
-          }
-          if (run.status === "failed" && run.error) {
-            const err = document.createElement("span");
-            err.className = "publish-error-detail";
-            err.textContent = run.error;
-            runDetailEl.append(document.createElement("br"));
-            runDetailEl.append(err);
-          }
-        } else {
-          runDetailEl.textContent = "Connect and rollback runs appear here.";
-        }
-      }
-      if (rollbackBtn) {
-        rollbackBtn.disabled =
-          !canShip || inFlight || !domain.priorRecordsKey;
-      }
-      if (rollbackDetail && domain.priorCapturedAt) {
-        rollbackDetail.textContent =
-          "Restores the DNS records captured " +
-          new Date(domain.priorCapturedAt).toLocaleString() + ".";
-      }
-
-      // Poll while a run is in flight so completion lands without a manual refresh.
-      if (domainPollTimer) {
-        clearTimeout(domainPollTimer);
-        domainPollTimer = null;
-      }
-      if (inFlight) domainPollTimer = setTimeout(loadDomain, 15000);
-    };
-
-    const loadDomain = async () => {
-      if (!domainPanel) return;
-      try {
-        const res = await fetch(ds.domainStatusEndpoint, {
-          headers: { accept: "application/json" },
-        });
-        if (!res.ok) return;
-        renderDomain(await res.json());
-      } catch {
-        /* leave the last rendered state */
-      }
-      // u9: refresh the readiness itemization alongside the status.
-      loadReadiness();
-    };
-
-    // ---- Cutover readiness (u9) --------------------------------------------
-    // Reads the SAME server gate `tot go-live` reads (/api/domain/readiness) and
-    // itemizes the preconditions. The Connect button additionally requires the
-    // server to report ready — the display and the enforcement can't diverge.
-    const readinessBox = domainPanel?.querySelector("[data-domain-readiness]");
-    const connectBtn = domainPanel?.querySelector("[data-domain-connect]");
-    let domainReady = false;
-
-    const renderReadiness = (payload) => {
-      if (!readinessBox) return;
-      const readiness = (payload && payload.readiness) || {};
-      const checks = Array.isArray(readiness.checks) ? readiness.checks : [];
-      domainReady = readiness.ready === true;
-      readinessBox.hidden = false;
-
-      const chip = readinessBox.querySelector("[data-domain-readiness-chip]");
-      if (chip) {
-        chip.textContent = domainReady ? "Ready" : "Not ready";
-        chip.className = "chip " + (domainReady ? "green" : "amber");
-      }
-      const list = readinessBox.querySelector("[data-domain-readiness-list]");
-      if (list) {
-        list.textContent = "";
-        for (const c of checks) {
-          const li = document.createElement("li");
-          li.className = c.ok ? "ok" : "blocked";
-          const mark = document.createElement("span");
-          mark.className = "domain-readiness-mark";
-          mark.textContent = c.ok ? "✓" : "✗";
-          const label = document.createElement("b");
-          label.textContent = c.label || c.id || "";
-          li.append(mark, label);
-          if (c.detail) {
-            const detail = document.createElement("span");
-            detail.className = "domain-readiness-detail";
-            detail.textContent = c.detail;
-            li.append(detail);
-          }
-          list.append(li);
-        }
-      }
-      const note = readinessBox.querySelector("[data-domain-readiness-note]");
-      if (note) {
-        note.textContent = payload && payload.ownerCapable === false
-          ? "Apex cutover is owner-only — sign in as the store owner to connect the domain."
-          : domainReady
-            ? "All preconditions are green — the cutover is permitted."
-            : "Clear the failing preconditions above before connecting the apex.";
-      }
-      // Gate the Connect button on server readiness in ADDITION to owner (the
-      // markup already disables it for non-owners); never enable it when blocked.
-      if (connectBtn && !connectBtn.dataset.ownerLocked) {
-        connectBtn.disabled = !domainReady;
-      }
-    };
-
-    const loadReadiness = async () => {
-      if (!readinessBox || !ds.domainReadinessEndpoint) return;
-      try {
-        const res = await fetch(ds.domainReadinessEndpoint, {
-          headers: { accept: "application/json", "x-tot-capability": "ship-on-behalf" },
-        });
-        if (!res.ok) return;
-        renderReadiness(await res.json());
-      } catch {
-        /* leave the last rendered readiness */
-      }
-    };
-
-    const domainStatusEl = domainPanel?.querySelector("[data-domain-status]");
-
-    const domainAction = async (body, button) => {
-      button.disabled = true;
-      setStatus(domainStatusEl, (body.action === "connect" ? "Connecting" : "Rolling back") + "…");
-      try {
-        const res = await fetch(ds.domainDispatchEndpoint, {
-          method: "POST",
-          headers: {
-            "content-type": "application/json",
-            "x-tot-capability": "ship-on-behalf",
-          },
-          body: JSON.stringify(body),
-        });
-        const data = await res.json().catch(() => ({}));
-        if (res.ok && data.dispatched) {
-          setStatus(
-            domainStatusEl,
-            (body.action === "connect" ? "Connect" : "Rollback") +
-              (body.rehearsal ? " rehearsal" : "") +
-              " dispatched — the run status updates below as it progresses.",
-            "ok",
-          );
-        } else {
-          setStatus(domainStatusEl, data.error || "Request failed (" + res.status + ")", "err");
-        }
-      } catch {
-        setStatus(domainStatusEl, "Request failed — network error", "err");
-      } finally {
-        button.disabled = false;
-        loadDomain();
-      }
-    };
-
-    domainPanel?.querySelector("[data-domain-connect]")?.addEventListener("click", (event) => {
-      const confirmInput = domainPanel.querySelector("[data-domain-confirm]");
-      const rehearsal = Boolean(domainPanel.querySelector("[data-domain-rehearsal]")?.checked);
-      domainAction(
-        {
-          action: "connect",
-          confirmDomain: (confirmInput?.value || "").trim(),
-          rehearsal,
-        },
-        event.currentTarget,
-      );
-    });
-
-    domainPanel?.querySelector("[data-domain-rollback]")?.addEventListener("click", (event) => {
-      if (
-        !window.confirm(
-          "Roll back " + ds.appDomain + " to the previous host? DNS returns to the captured records in about a minute.",
-        )
-      ) {
-        return;
-      }
-      domainAction({ action: "rollback" }, event.currentTarget);
-    });
-
-    // ---- b17: branch retention ----------------------------------------------
-    // Renders the GET /api/changes/branches dry-run classification (already
-    // projected server-side by branchRetentionView.ts — this script only
-    // paints it, same division of labor as renderQueue/renderVersions above)
-    // and drives the guarded delete. The server (candidate_delete, b13)
-    // re-classifies fresh on every delete, so the confirm below is the HUMAN
-    // gate, not the safety guarantee — the safety guarantee is server-side.
-
-    const branchesPanel = root.querySelector("[data-publish-branches]");
-    const branchesBody = branchesPanel?.querySelector("[data-branches-body]");
-    const branchesChip = branchesPanel?.querySelector("[data-branches-chip]");
-    const branchesStatus = branchesPanel?.querySelector("[data-branches-status]");
-
-    const BRANCH_TONE = {
-      protected: "",
-      "active-open": "green",
-      "stale-open": "amber",
-      integrated: "blue",
-      "closed-or-rejected": "blue",
-      orphan: "red",
-    };
-
-    const buildCleanupPlan = (row) => {
-      return [
-        "Delete branch plan:",
-        "  repo:           " + (appDomain || repo),
-        "  branch:         " + row.ref,
-        "  tip sha:        " + row.shortSha,
-        "  classification: " + row.classificationLabel,
-        "  reason:         " + row.reason,
-        "",
-        "This deletes the Git BRANCH only — it never evicts a hosted preview build",
-        "(that is Retire, a separate action above). The server re-classifies this",
-        "branch fresh before deleting; a moved tip or a branch that is no longer",
-        "integrated/closed-or-rejected is refused, not silently skipped.",
-      ].join("\n");
-    };
-
-    const cleanupBranch = async (row, button) => {
-      if (!window.confirm(buildCleanupPlan(row) + "\n\nDelete this branch?")) return;
-      button.disabled = true;
-      setStatus(branchesStatus, "Deleting " + row.shortRef + "…");
-      try {
-        const res = await fetch(ds.branchesEndpoint, {
-          method: "POST",
-          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
-          body: JSON.stringify({ ref: row.ref, expectedSha: row.sha }),
-        });
-        const data = await res.json().catch(() => ({}));
-        if (res.ok && data.ok) {
-          setStatus(
-            branchesStatus,
-            data.alreadyAbsent
-              ? row.shortRef + " was already gone (nothing to delete)."
-              : "Deleted " + row.shortRef + ".",
-            "ok",
-          );
-        } else {
-          setStatus(branchesStatus, data.error || "Delete refused (" + res.status + ")", "err");
-        }
-      } catch {
-        setStatus(branchesStatus, "Delete failed — network error", "err");
-      } finally {
-        button.disabled = false;
-        loadBranches();
-      }
-    };
-
-    const renderBranches = (view) => {
-      if (!branchesBody) return;
-      const rows = Array.isArray(view.rows) ? view.rows : [];
-      if (branchesChip) {
-        const needsReview = rows.filter((r) => r.quarantine || r.eligibleForDelete).length;
-        branchesChip.textContent = needsReview
-          ? needsReview + " to review"
-          : rows.length
-            ? rows.length + " branches"
-            : "0 branches";
-        branchesChip.className = "chip" + (needsReview ? " amber" : "");
-      }
-      branchesBody.textContent = "";
-      if (!rows.length) {
-        const tr = document.createElement("tr");
-        const td = cell(subtle("No candidate branches found for this repo."));
-        td.colSpan = 7;
-        tr.append(td);
-        branchesBody.append(tr);
-        return;
-      }
-
-      for (const row of rows) {
-        const tr = document.createElement("tr");
-
-        const branchCell = document.createElement("td");
-        const branchStrong = document.createElement("strong");
-        branchStrong.textContent = row.shortRef;
-        branchCell.append(branchStrong, subtle(row.ref + " @ " + row.shortSha));
-        tr.append(branchCell);
-
-        tr.append(cell(chip(row.classificationLabel, BRANCH_TONE[row.classification] || "")));
-
-        const prCell = document.createElement("td");
-        if (row.prNumber != null) {
-          // Link to the INTERNAL friendly PR route (/preview/<tenant>/pr/<N>), never
-          // the server-provided `row.prUrl` — that is the raw Gitea forge html_url the
-          // MCP candidate_list projection emits (<forge-host>/<org>/<repo>/pulls/N),
-          // and surfacing a raw forge link to an owner is exactly the boundary
-          // noGiteaLinks.test.ts guards (the source scan can't catch a host that
-          // arrives in data, so we refuse it here at render). Mirrors the candidate
-          // queue, which already builds its preview link this way.
-          const prHref = candidatePrUrl(row.prNumber);
-          if (prHref) {
-            const a = document.createElement("a");
-            a.href = prHref;
-            a.target = "_blank";
-            a.rel = "noopener";
-            a.textContent = "PR #" + row.prNumber;
-            prCell.append(a);
-          } else {
-            prCell.append(document.createTextNode("PR #" + row.prNumber));
-          }
-          prCell.append(subtle((row.prState || "") + (row.integratedIntoAggregate ? " · in aggregate" : "")));
-        } else {
-          prCell.append(subtle("No PR record"));
-        }
-        tr.append(prCell);
-
-        tr.append(cell(row.commitTimestampDisplay));
-        tr.append(cell(row.ageLabel));
-        tr.append(cell(row.evidenceSummary));
-
-        const actionsCell = document.createElement("td");
-        actionsCell.className = "action";
-        if (row.quarantine) {
-          actionsCell.append(chip("Needs owner review", "red"));
-        } else if (row.eligibleForDelete) {
-          const btn = document.createElement("button");
-          btn.type = "button";
-          btn.className = "btn";
-          btn.disabled = !canShip;
-          btn.title = canShip ? "" : "Requires an owner/admin sign-in.";
-          btn.textContent = "Clean up";
-          btn.addEventListener("click", () => cleanupBranch(row, btn));
-          actionsCell.append(btn);
-        } else {
-          actionsCell.append(subtle("Keep"));
-        }
-        tr.append(actionsCell);
-
-        branchesBody.append(tr);
-      }
-    };
-
-    const loadBranches = async () => {
-      if (!branchesBody) return;
-      try {
-        const res = await fetch(ds.branchesEndpoint, { headers: { accept: "application/json" } });
-        if (res.status === 401 || res.status === 403) {
-          if (branchesChip) branchesChip.textContent = "Sign-in required";
-          branchesBody.textContent = "";
-          const tr = document.createElement("tr");
-          const td = cell(subtle("Sign in as a store owner or admin to view branch retention."));
-          td.colSpan = 7;
-          tr.append(td);
-          branchesBody.append(tr);
-          return;
-        }
-        const data = await res.json().catch(() => ({}));
-        if (!res.ok) {
-          setStatus(branchesStatus, data.error || "Could not load branch classification (" + res.status + ")", "err");
-          return;
-        }
-        renderBranches(data.report || {});
-      } catch {
-        setStatus(branchesStatus, "Could not load branch classification — network error", "err");
-      }
-    };
-
-    // ---- Wiring ------------------------------------------------------------
-
-    root.querySelector("[data-publish-refresh]")?.addEventListener("click", () => {
-      setStatus(statusEl, "");
-      loadQueue();
-      loadVersions();
-      loadDomain();
-      loadBranches();
-    });
-
-    // rux7: pause polling while hidden; on return, refresh immediately (loadQueue
-    // re-renders + resyncs the poll clock) rather than waiting out the interval.
-    document.addEventListener("visibilitychange", () => {
-      if (document.hidden) {
-        clearPoll();
-      } else {
-        loadQueue();
-      }
-    });
-
-    // loadQueue starts the poll cadence via its tail (schedulePoll).
-    loadQueue();
-    loadVersions();
-    loadDomain();
-    loadBranches();
-  })();
+<script>
+  import { initAdminPublishTab } from "@/lib/publish/adminPublishTab";
+  initAdminPublishTab();
 </script>
 
 <style>
@@ -2972,6 +924,19 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     margin-left: 6px;
   }
 
+  /* The per-row orphan "Delete this branch" action — a deliberate, destructive,
+     one-at-a-time HUMAN delete, styled distinct from the neutral "Clean up" and the
+     bulk "Sweep dead branches" so it never reads as a routine cleanup. */
+  .btn.branch-delete-orphan {
+    border-color: var(--admin-danger, #b3261e);
+    color: var(--admin-danger, #b3261e);
+  }
+
+  .btn.branch-delete-orphan:not(:disabled):hover {
+    background: var(--admin-danger, #b3261e);
+    color: #fff;
+  }
+
   .publish-status {
     min-height: 0;
   }
@@ -2988,6 +953,17 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     color: var(--admin-red);
   }
 
+  /* Public-site status card, verified-current tone — .risk-alert defaults to an
+     amber/warning look (admin.astro), wrong for "this is fine, confirmed fresh". */
+  .risk-alert.public-site-ok {
+    border-color: var(--admin-green);
+    background: var(--admin-green-soft);
+  }
+
+  .risk-alert.public-site-ok svg {
+    color: var(--admin-green);
+  }
+
   /* ?pr=N deep link: "not in the queue" callout + row flash */
   .publish-pr-callout {
     border: 1px solid var(--admin-line-strong);
@@ -3127,6 +1103,126 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     margin-top: 16px;
   }
 
+  /* Merge-conflict guidance (outcome phase, reason "merge_failed" only) —
+     directions, not mood: the terminal recovery front and center, the forge's
+     raw refusal kept small underneath for support/diagnosis. Left-aligned
+     inside the centered outcome phase: commands and prose read as
+     instructions, not ceremony. */
+  .liftoff-conflict {
+    margin-top: 10px;
+    text-align: left;
+  }
+
+  .liftoff-commands {
+    margin: 10px 0 8px;
+    padding: 10px 12px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+    font-size: 12px;
+    line-height: 1.55;
+    overflow-x: auto;
+    white-space: pre;
+  }
+
+  .liftoff-conflict-actions {
+    display: flex;
+    justify-content: flex-end;
+    gap: 8px;
+    flex-wrap: wrap;
+  }
+
+  .liftoff-conflict-raw {
+    margin: 10px 0 0;
+    font-size: 11px;
+    color: var(--admin-muted);
+    overflow-wrap: anywhere;
+  }
+
+  /* u4 — automate-first recovery: the primary action leads, option cards appear
+     only on a genuine overlap, the terminal guidance is a collapsed fallback. */
+  .liftoff-conflict-summary {
+    margin: 0 0 10px;
+  }
+  .liftoff-conflict-primary {
+    display: flex;
+    flex-direction: column;
+    align-items: flex-start;
+    gap: 8px;
+    margin-bottom: 12px;
+  }
+  .liftoff-conflict-primary .btn.primary {
+    align-self: flex-start;
+  }
+  .liftoff-conflict-primary-status[data-state="err"],
+  .liftoff-conflict-cards-status[data-state="err"] {
+    color: var(--admin-danger, #b3261e);
+  }
+  .liftoff-conflict-cards {
+    margin: 4px 0 12px;
+    padding: 12px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+  }
+  .liftoff-conflict-files {
+    list-style: none;
+    margin: 8px 0 12px;
+    padding: 8px 10px;
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface, #fff);
+    font-size: 12px;
+    line-height: 1.6;
+    overflow-x: auto;
+  }
+  .liftoff-conflict-card-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+    gap: 8px;
+  }
+  .liftoff-option-card {
+    display: flex;
+    flex-direction: column;
+    gap: 4px;
+    text-align: left;
+    padding: 12px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface, #fff);
+    cursor: pointer;
+    font: inherit;
+    color: inherit;
+  }
+  .liftoff-option-card:hover:not(:disabled) {
+    border-color: var(--admin-accent, #0f9d8f);
+  }
+  .liftoff-option-card:disabled {
+    opacity: 0.55;
+    cursor: default;
+  }
+  .liftoff-option-card[data-recommended="1"] {
+    border-color: var(--admin-accent, #0f9d8f);
+    box-shadow: inset 0 0 0 1px var(--admin-accent, #0f9d8f);
+  }
+  .liftoff-option-card b {
+    font-size: 13px;
+  }
+  .liftoff-option-card span {
+    font-size: 11px;
+    color: var(--admin-muted);
+  }
+  .liftoff-conflict-expert {
+    margin-top: 10px;
+    border-top: 1px solid var(--admin-line, #e5e5e5);
+    padding-top: 8px;
+  }
+  .liftoff-conflict-expert > summary {
+    cursor: pointer;
+    font-size: 12px;
+    color: var(--admin-muted);
+    user-select: none;
+  }
+
   .liftoff-stages {
     list-style: none;
     margin: 6px 0 4px;
@@ -3369,14 +1465,19 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     gap: 0.25rem;
   }
   .domain-readiness-list li {
+    display: grid;
+    gap: 0.1rem;
+    font-size: 0.9em;
+  }
+  .domain-readiness-item-head {
     display: flex;
     align-items: baseline;
     gap: 0.4rem;
-    font-size: 0.9em;
   }
   .domain-readiness-mark {
     font-weight: 700;
     width: 1em;
+    flex: 0 0 auto;
   }
   .domain-readiness-list li.ok .domain-readiness-mark {
     color: var(--good, #1a7f37);
@@ -3384,9 +1485,20 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
   .domain-readiness-list li.blocked .domain-readiness-mark {
     color: var(--bad, #b42318);
   }
+  /* detail + remedy sit on their OWN lines, indented under the label (past the
+     mark) so neither runs together with the bold label above it. */
+  .domain-readiness-detail,
+  .domain-readiness-remedy {
+    margin: 0;
+    padding-left: 1.4em;
+  }
   .domain-readiness-detail {
     opacity: 0.75;
   }
+  .domain-readiness-remedy {
+    color: var(--accent, #0b6bcb);
+    opacity: 0.95;
+  }
 
   /* b11: aggregate card + ship plan */
   .aggregate-prs {
@@ -3404,11 +1516,24 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
 
   .aggregate-prs-list li {
     display: flex;
-    align-items: baseline;
-    gap: 10px;
+    align-items: center;
+    gap: 8px;
     font-size: 13px;
   }
 
+  /* u14 — provenance ("integrated <age> by <email>") sits after the sha, subtle. */
+  .aggregate-pr-meta {
+    font-size: 12px;
+  }
+
+  /* u14 — the per-change Undo (revert) button is pushed to the row's trailing edge
+     and kept compact so the batch reads as a list, not a stack of buttons. */
+  .aggregate-prs-list .btn-compact {
+    margin-left: auto;
+    padding: 2px 10px;
+    font-size: 12px;
+  }
+
   .aggregate-plan {
     padding: 0.75rem 1rem;
     border: 1px solid var(--hairline, rgba(0, 0, 0, 0.12));
@@ -3441,6 +1566,652 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     overflow-wrap: anywhere;
   }
 
+  /* ── Preview-aggregate console — the go-live surface ─────────────────────
+     Everything here is scoped under [data-publish-aggregate] / .agg-* so it
+     never leaks into the other panels (candidate queue, versions, branches)
+     that share .panel / .field / .check-row / .chip. */
+  .agg-console .panel-body {
+    gap: 16px;
+  }
+
+  [data-publish-aggregate] .sha-token {
+    display: inline-flex;
+    align-items: center;
+    padding: 2px 8px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: 5px;
+    background: var(--admin-surface-soft);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 12.5px;
+    color: var(--admin-ink);
+  }
+  [data-publish-aggregate] .sha-token.ghost {
+    background: transparent;
+    color: var(--admin-muted);
+    border-style: dashed;
+  }
+
+  /* AI-assembled release summary */
+  .agg-summary {
+    display: grid;
+    gap: 11px;
+    padding: 15px 16px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius);
+    background:
+      linear-gradient(180deg, var(--admin-teal-soft), transparent 62%),
+      var(--admin-surface);
+  }
+  .agg-summary[hidden] {
+    display: none;
+  }
+  .agg-summary-head {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+  }
+  .agg-summary-glyph {
+    flex: none;
+    width: 26px;
+    height: 26px;
+    display: grid;
+    place-items: center;
+    border-radius: 7px;
+    background: var(--admin-surface);
+    color: var(--admin-teal-dark);
+    border: 1px solid color-mix(in srgb, var(--admin-teal) 30%, transparent);
+  }
+  /* The sparkle glyphs are filled shapes; opt out of the global stroked-svg rule. */
+  .agg-summary-glyph svg,
+  .agg-ai-chip svg {
+    fill: currentColor;
+    stroke: none;
+  }
+  .agg-summary-glyph svg {
+    width: 15px;
+    height: 15px;
+  }
+  .agg-summary-label {
+    flex: 1;
+    font-size: 11px;
+    font-weight: 760;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--admin-muted);
+  }
+  .agg-ai-chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 5px;
+    padding: 3px 9px;
+    border-radius: 999px;
+    background: var(--admin-teal-soft);
+    color: #007973;
+    font-size: 10px;
+    font-weight: 760;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+  }
+  .agg-ai-chip svg {
+    width: 10px;
+    height: 10px;
+  }
+  .agg-summary-lead {
+    margin: 0;
+    font-size: 15px;
+    line-height: 1.55;
+    color: var(--admin-ink);
+    max-width: 68ch;
+  }
+  .agg-summary-points {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+    display: grid;
+    gap: 7px;
+  }
+  .agg-summary-points[hidden] {
+    display: none;
+  }
+  .agg-summary-points li {
+    display: flex;
+    align-items: flex-start;
+    gap: 9px;
+    font-size: 13px;
+    color: var(--admin-muted);
+    line-height: 1.45;
+  }
+  .agg-summary-points .agg-tick {
+    flex: none;
+    margin-top: 1px;
+    width: 16px;
+    height: 16px;
+    border-radius: 50%;
+    display: grid;
+    place-items: center;
+    background: var(--admin-green-soft);
+    color: var(--admin-green);
+  }
+  .agg-summary-points .agg-tick svg {
+    width: 10px;
+    height: 10px;
+  }
+  .agg-summary-points b {
+    color: var(--admin-ink);
+    font-weight: 640;
+  }
+
+  /* Chain of custody: build → evidence → digest */
+  .agg-chain {
+    display: grid;
+    grid-template-columns: 1fr auto 1fr auto 1fr;
+    align-items: stretch;
+    padding: 16px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius);
+    background: var(--admin-surface-soft);
+  }
+  .agg-stop {
+    display: flex;
+    flex-direction: column;
+    gap: 7px;
+    padding: 2px 12px;
+    min-width: 0;
+  }
+  .agg-stop:first-child {
+    padding-left: 2px;
+  }
+  .agg-stop:last-child {
+    padding-right: 2px;
+  }
+  .agg-stop-label {
+    font-size: 10.5px;
+    font-weight: 760;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--admin-muted);
+  }
+  .agg-stop-val {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    font-size: 15px;
+    font-weight: 680;
+  }
+  .agg-stop-val strong {
+    font-size: 15px;
+  }
+  .agg-stop-cap {
+    margin: 0;
+    font-size: 12px;
+    color: var(--admin-muted);
+    line-height: 1.45;
+  }
+  .agg-stop-cap a {
+    white-space: nowrap;
+  }
+  .agg-digest {
+    padding: 2px 8px;
+    border: 1px solid color-mix(in srgb, var(--admin-teal) 55%, var(--admin-line-strong));
+    border-radius: 5px;
+    background: var(--admin-teal-soft);
+    color: #007973;
+  }
+  [data-publish-aggregate] [data-aggregate-evidence][data-state="passed"] {
+    color: var(--admin-green);
+  }
+  [data-publish-aggregate] [data-aggregate-evidence][data-state="failed"] {
+    color: var(--admin-red);
+  }
+  .agg-link {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    gap: 6px;
+    padding: 0 2px;
+    align-self: center;
+  }
+  .agg-flowlabel {
+    font-size: 9px;
+    font-weight: 720;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+    color: var(--admin-muted-2);
+  }
+  .agg-arrow {
+    display: grid;
+    place-items: center;
+    color: var(--admin-teal);
+  }
+  .agg-arrow svg {
+    width: 32px;
+    height: 10px;
+  }
+
+  /* Staged → live delta strip */
+  .agg-delta-strip {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    flex-wrap: wrap;
+    padding: 10px 13px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+  }
+  .agg-delta-strip[hidden] {
+    display: none;
+  }
+  .agg-delta-node {
+    display: flex;
+    flex-direction: column;
+    gap: 3px;
+  }
+  .agg-delta-mid {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    color: var(--admin-teal);
+  }
+  .agg-delta-mid svg {
+    width: 24px;
+    height: 10px;
+  }
+  .agg-delta-count {
+    padding: 2px 9px;
+    border-radius: 999px;
+    background: var(--admin-teal-soft);
+    color: #007973;
+    font-size: 11.5px;
+    font-weight: 720;
+  }
+
+  /* Staged change rows (richer than the plain PR list) */
+  .agg-changes li.agg-change {
+    display: grid;
+    grid-template-columns: 1fr auto;
+    align-items: center;
+    gap: 12px;
+    padding: 10px 12px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface);
+  }
+  .agg-change-main {
+    display: grid;
+    gap: 4px;
+    min-width: 0;
+  }
+  .agg-change-line {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    flex-wrap: wrap;
+  }
+  .agg-change-pr {
+    font-weight: 720;
+    font-size: 13px;
+  }
+  .agg-change-title {
+    font-weight: 600;
+    font-size: 13.5px;
+  }
+  .agg-change-sub {
+    color: var(--admin-muted);
+    font-size: 12px;
+  }
+
+  /* Publish plan → launch manifest */
+  [data-publish-aggregate] .agg-manifest {
+    display: block;
+    padding: 0;
+    overflow: hidden;
+    background:
+      linear-gradient(180deg, var(--admin-surface-tint), transparent 46px),
+      var(--admin-surface);
+  }
+  .agg-manifest-head {
+    padding: 12px 15px;
+    border-bottom: 1px dashed var(--admin-line-strong);
+  }
+  .agg-manifest-head b {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    font-size: 13px;
+  }
+  .agg-manifest-head b svg {
+    width: 15px;
+    height: 15px;
+    color: var(--admin-teal);
+  }
+  [data-publish-aggregate] .agg-manifest .aggregate-plan-grid {
+    padding: 8px 15px 12px;
+  }
+  [data-publish-aggregate] .agg-manifest > .note {
+    margin: 0;
+    padding: 11px 15px;
+    border-top: 1px dashed var(--admin-line-strong);
+    background: var(--admin-surface-soft);
+  }
+
+  /* Openable "Included changes" */
+  .agg-included {
+    border-top: 1px dashed var(--admin-line-strong);
+  }
+  .agg-included[hidden] {
+    display: none;
+  }
+  .agg-included-details > summary {
+    list-style: none;
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    padding: 11px 15px;
+    font-size: 12px;
+    color: var(--admin-muted);
+  }
+  .agg-included-details > summary::-webkit-details-marker {
+    display: none;
+  }
+  .agg-included-details > summary::marker {
+    content: "";
+  }
+  .agg-included-details > summary:focus-visible {
+    outline: 2px solid var(--admin-teal);
+    outline-offset: -2px;
+  }
+  .agg-included-lead {
+    font-size: 11px;
+    font-weight: 740;
+    letter-spacing: 0.03em;
+    text-transform: uppercase;
+    color: var(--admin-ink);
+  }
+  .agg-included-badge {
+    padding: 1px 8px;
+    border-radius: 999px;
+    background: var(--admin-surface-tint);
+    color: #3f4d49;
+    font-size: 11.5px;
+    font-weight: 720;
+  }
+  .agg-included-hint {
+    color: var(--admin-muted-2);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 11.5px;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+  .agg-chev {
+    margin-left: auto;
+    display: inline-flex;
+    color: var(--admin-muted-2);
+    transition: transform 0.18s ease;
+  }
+  .agg-chev svg {
+    width: 14px;
+    height: 14px;
+  }
+  .agg-included-details[open] > summary .agg-chev {
+    transform: rotate(90deg);
+  }
+  @media (prefers-reduced-motion: reduce) {
+    .agg-chev {
+      transition: none;
+    }
+  }
+  .agg-included-list {
+    list-style: none;
+    margin: 0;
+    padding: 0 15px 14px;
+    display: grid;
+    gap: 8px;
+  }
+  .agg-included-item {
+    display: grid;
+    gap: 5px;
+    padding: 11px 12px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+  }
+  .agg-included-top {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    flex-wrap: wrap;
+  }
+  .agg-included-pr {
+    font-weight: 720;
+    font-size: 13px;
+  }
+  .agg-included-title {
+    font-weight: 600;
+    font-size: 13.5px;
+  }
+  .agg-included-desc {
+    margin: 0;
+    color: var(--admin-muted);
+    font-size: 12.5px;
+    line-height: 1.5;
+  }
+  .agg-included-meta {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    flex-wrap: wrap;
+    color: var(--admin-muted-2);
+    font-size: 11.5px;
+  }
+  .agg-included-meta > span + span::before {
+    content: "·";
+    padding-right: 6px;
+    color: var(--admin-line-strong);
+  }
+  .agg-included-meta .sha-token {
+    font-size: 11px;
+    padding: 1px 6px;
+  }
+
+  /* Published-versions "what shipped": the release summary lead + openable
+     per-change list, inline in the Version cell. Reuses the .agg-included-*
+     item markup; only the container chrome is retuned for a table cell. */
+  .ver-summary {
+    margin: 6px 0 0;
+    color: var(--admin-muted);
+    font-size: 12.5px;
+    line-height: 1.5;
+    max-width: 48ch;
+  }
+  .ver-changes {
+    margin-top: 8px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+  }
+  .ver-changes > summary {
+    padding: 8px 10px;
+  }
+  .ver-changes .agg-included-list {
+    padding: 0 10px 10px;
+  }
+
+  /* Branch-retention "what this branch changes": the PR title + one-line
+     description + scope meta, inline under the branch ref. */
+  .branch-pr-title {
+    margin: 6px 0 0;
+    font-weight: 600;
+    font-size: 13px;
+    color: var(--admin-ink);
+    max-width: 46ch;
+  }
+  .branch-pr-desc {
+    margin: 3px 0 0;
+    color: var(--admin-muted);
+    font-size: 12.5px;
+    line-height: 1.5;
+    max-width: 46ch;
+  }
+  .branch-pr-meta {
+    margin-top: 5px;
+  }
+  .branch-pr-ai {
+    color: var(--admin-teal-dark);
+    font-weight: 640;
+  }
+
+  /* Scope-of-change: lines added/removed (green/red), + the top-level readout */
+  .agg-lines {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-variant-numeric: tabular-nums;
+    white-space: nowrap;
+  }
+  .agg-add {
+    color: var(--admin-green);
+  }
+  .agg-del {
+    color: var(--admin-red);
+  }
+
+  /* "View diff" disclosure for a trivial change (the diff IS its summary). */
+  .agg-diff {
+    margin-top: 2px;
+  }
+  .agg-diff > summary {
+    cursor: pointer;
+    font-size: 11.5px;
+    font-weight: 640;
+    color: var(--admin-teal-dark);
+    width: max-content;
+  }
+  .agg-diff[open] > summary {
+    margin-bottom: 6px;
+  }
+  .agg-diff-file {
+    margin-top: 6px;
+  }
+  .agg-diff-path {
+    font-size: 11px;
+    color: var(--admin-muted);
+    margin-bottom: 3px;
+  }
+  .agg-diff-patch {
+    margin: 0;
+    padding: 8px 10px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface);
+    font-size: 11.5px;
+    line-height: 1.5;
+    overflow-x: auto;
+    white-space: pre;
+  }
+  .agg-diff-add {
+    color: var(--admin-green);
+    background: var(--admin-green-soft);
+  }
+  .agg-diff-del {
+    color: var(--admin-red);
+    background: var(--admin-red-soft);
+  }
+  .agg-diff-hunk {
+    color: var(--admin-muted-2);
+  }
+
+  .agg-staged-head {
+    display: flex;
+    align-items: baseline;
+    justify-content: space-between;
+    gap: 12px;
+    flex-wrap: wrap;
+  }
+  .agg-scope {
+    display: inline-flex;
+    align-items: center;
+    gap: 8px;
+    padding: 3px 10px;
+    border: 1px solid var(--admin-line);
+    border-radius: 999px;
+    background: var(--admin-surface-soft);
+    font-size: 11.5px;
+    color: var(--admin-ink);
+  }
+  .agg-scope[hidden] {
+    display: none;
+  }
+  .agg-scope > span + span::before {
+    content: "·";
+    padding-right: 8px;
+    color: var(--admin-line-strong);
+  }
+  .agg-scope-label {
+    font-size: 10px;
+    font-weight: 760;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--admin-muted);
+  }
+  .agg-scope-partial {
+    color: var(--admin-muted-2);
+    font-style: italic;
+    cursor: help;
+  }
+
+  /* Publish action — stack the copy above a full-width, weighted CTA */
+  [data-publish-aggregate] .agg-launch {
+    display: grid;
+    grid-template-columns: 1fr;
+    gap: 12px;
+    padding: 14px 0 2px;
+  }
+  /* Extra selector weight so the gradient/shadow beat the .btn.primary base. */
+  [data-publish-aggregate] .btn.agg-publish-btn {
+    width: 100%;
+    justify-content: center;
+    min-height: 50px;
+    gap: 9px;
+    font-size: 15px;
+    border-radius: var(--admin-radius-sm);
+    background: linear-gradient(178deg, var(--admin-teal), var(--admin-teal-dark));
+    box-shadow: 0 8px 22px color-mix(in srgb, var(--admin-teal) 26%, transparent);
+  }
+  .agg-publish-btn svg {
+    width: 18px;
+    height: 18px;
+  }
+  [data-publish-aggregate] .btn.agg-publish-btn:not(:disabled):hover {
+    filter: brightness(1.05);
+  }
+  [data-publish-aggregate] .btn.agg-publish-btn:disabled {
+    background: var(--admin-surface-tint);
+    border-color: var(--admin-line-strong);
+    color: var(--admin-muted);
+    box-shadow: none;
+    cursor: not-allowed;
+  }
+
+  @media (max-width: 760px) {
+    .agg-chain {
+      grid-template-columns: 1fr;
+      gap: 4px;
+    }
+    .agg-link {
+      flex-direction: row;
+      gap: 10px;
+      padding: 4px 12px;
+    }
+    .agg-link .agg-arrow svg {
+      transform: rotate(90deg);
+    }
+    .agg-stop {
+      padding: 8px 2px;
+    }
+  }
+
   /* dg7: versions + diff */
   .versions-table {
     min-width: 780px;