@tokenoftrust/storefront-runner 1.4.1 → 2.0.0

package/apps/storefront/src/components/admin/AdminPublishTab.astro

@@ -6,7 +6,7 @@
  *
  *   - OPEN CHANGE QUEUE from GET /api/changes ({ current, changes }) with
  *     per-change reconcile/compliance state, preview link, head sha, and age.
- *   - ACCEPT TO PREVIEW (POST /api/changes/integrate — b11's accept-to-preview
+ *   - ACCEPT TO PREVIEW (POST /api/changes/integrate — the accept-to-preview
  *     split; advances the shared `preview` aggregate, does NOT go live) and
  *     REJECT (with a note) per change. Going live is the aggregate card's
  *     exact-digest PUBLISH (POST /api/changes/ship), never a per-change accept.
@@ -23,7 +23,7 @@
  *     OWNER_CAPABILITIES) — others see the queue read-only with a sign-in note.
  *   - Non-premium tenants see the go-live control as a PAYWALL UPSELL — never
  *     hidden, never "coming soon" (recorded product direction). The
- *     entitlement signal is the existing premium model (D4): a custom-domain
+ *     entitlement signal is the existing premium model: a custom-domain
  *     tenant is premium/pilot; a `<label>.tokenoftrust.store` self-serve store
  *     is not. TODO(paywall workstream): replace with the real billing
  *     entitlement when one exists.
@@ -32,10 +32,13 @@ import { readViewerSession } from "@/lib/auth/route";
 import { withBase } from "@/lib/basePath";
 import { readEnv } from "@/lib/env";
 import { resolveViewerShipCapability } from "@/lib/change";
+import { resolveLiveVersion } from "@/lib/change/views/live-version";
+import { isPublicSiteCurrent, staticLiveManifestUrl } from "@/lib/change/views/live-digest";
 import { isHostedStoreDomain, isInternalTestTenant } from "@tot/public-runtime";
+import { mintPreviewShareToken } from "@/lib/preview/previewShareLink";
 
 const { envelope } = Astro.props;
-const { tenant, basePath, cspNonce } = Astro.locals;
+const { tenant, basePath } = Astro.locals;
 
 // Viewer capability, mirrored from the same session model the API routes gate
 // on (resolveOwnerSession admits capability owner|admin). UX-only: the server
@@ -49,7 +52,7 @@ const viewerCapability =
 // A signed-in DEVELOPER (not owner/admin) may hold an explicit, owner-revocable
 // ship-on-behalf grant. Resolve it LIVE from the MCP subject-capability store —
 // NEVER the coarse role, NEVER a client header — so a ship-granted developer sees
-// the queue + Go-live/Reject/Retire. This MIRRORS the server (resolveShipSession /
+// the queue + Go-live/Reject. This MIRRORS the server (resolveShipSession /
 // effectiveShipCapability); the server re-authorizes every action. UX-only.
 let viewerCanShip = viewerCapability === "owner" || viewerCapability === "admin";
 if (!viewerCanShip && Astro.locals.viewer?.email) {
@@ -75,40 +78,63 @@ const internalTestTenant = isInternalTestTenant(tenant);
 const staticPublishEnabled = Boolean(
   tenant.staticPublish && tenant.staticPublish.enabled !== false,
 );
-// Presence-only signal for the T5 dispatch sink (never the value).
+// Presence-only signal for the dispatch sink (never the value).
 const dispatchConfigured = Boolean((await readEnv("WWW_PUBLISH_DISPATCH_TOKEN"))?.trim());
 
+// "What does the public site actually serve right now?" — the read-back half of
+// the static-publish seam (resolveLiveVersion's staticLiveDigest), computed here
+// so it's ALWAYS visible rather than only living in GET /api/changes JSON. This is
+// the exact gap that can let tokenoftrust.com's published public site
+// sit two days stale behind several accepted-but-unpublished changes with nothing
+// in the console calling it out — going live and staying live for the PUBLIC
+// static target are two different facts, and this card makes the second one
+// honest instead of assumed. Best-effort: resolveLiveVersion never throws.
+// BUDGETED: resolveLiveVersion chains several TENANT_CACHE reads (resolvePreviewTenant,
+// resolveChannelVersion, readSiteVersion) that are pathologically slow + variable on the
+// preview worker (measured 2-10s EACH, spiking together — a KV/storage-latency issue, not
+// this code). It runs in blocking SSR frontmatter, so it gated the whole admin document
+// stream. It's best-effort display chrome ("what does live/ serve right now"), and the
+// client-side GET /api/changes already returns `current`, so cap it: on timeout the card
+// renders from the client fetch instead of blocking first paint.
+const liveVersion = staticPublishEnabled
+  ? await Promise.race([
+      resolveLiveVersion(tenant.appDomain),
+      new Promise<null>((resolve) => setTimeout(() => resolve(null), 1500)),
+    ])
+  : null;
+const publicSiteDigest = liveVersion?.staticLiveDigest ?? null;
+// The actual verdict: does the public target's manifest sha match what was last
+// promoted to "live" here? Both are real tenant Gitea shas — a direct,
+// honest comparison, not a heuristic. See liveDigest.ts's isPublicSiteCurrent.
+const publicSiteVerdict = publicSiteDigest
+  ? isPublicSiteCurrent(liveVersion?.versionId ?? null, publicSiteDigest)
+  : null;
+
 const changesEndpoint = withBase(basePath || "", "/api/changes");
-// b11 — the branch-integration lifecycle SPLIT of accept from publish:
-//   - integrateEndpoint = b08's "accept = integrate into the protected preview
+// The branch-integration lifecycle SPLIT of accept from publish:
+//   - integrateEndpoint = "accept = integrate into the protected preview
 //     aggregate" (POST /api/changes/integrate → TenantIntegrationQueue.enqueue).
 //     This is the candidate-queue "Accept to preview" action — it advances the
 //     shared aggregate, it does NOT go live. Returns an IntegrateOutcome
 //     (queueState/runState/statusMessage), never a bare merged:true.
-//   - shipEndpoint = b10's exact-digest go-live (POST /api/changes/ship →
-//     b09 AggregateShipOrchestrator.plan/ship). The aggregate card's "Publish"
+//   - shipEndpoint = the exact-digest go-live (POST /api/changes/ship →
+//     AggregateShipOrchestrator.plan/ship). The aggregate card's "Publish"
 //     action: it ships the reviewed pinned SHA + digest, double-gated
 //     (paywall + human confirm). The read-only plan is served on GET /api/changes
 //     (`plan`), so the confirm surface never has to POST to preview it.
-// If b08/b10's exact paths differ at fold, the integrator reconciles here —
-// these are the agreed contract paths (see the unit brief).
 const integrateEndpoint = withBase(basePath || "", "/api/changes/integrate");
 const shipEndpoint = withBase(basePath || "", "/api/changes/ship");
-// U7 — retire/GC: evict a candidate's ReviewEnvironment + version (rebuildable),
-// DISTINCT from reject (which closes the change). Gated server-side by retireGate.
-const retireEndpoint = withBase(basePath || "", "/api/preview/retire");
-// rux5 — build-on-demand for a synthetic not-built PR row: materialize the PR's
+// Build-on-demand for a synthetic not-built PR row: materialize the PR's
 // hosted preview (INERT — flips no live channel). Gated server-side by buildGate
 // (the ship-on-behalf floor); the endpoint resolves the head sha via forge PR-read
 // when the row supplies only the PR number.
 const buildEndpoint = withBase(basePath || "", "/api/preview/build");
-// dg7 — the ship-operations workspace woven into this tab: versions/promotion
+// The ship-operations workspace woven into this tab: versions/promotion
 // history, per-candidate diff, and rollback (through the ONE rollback
 // orchestrator). Read endpoints mirror the change-queue's auth/scope.
 const versionsEndpoint = withBase(basePath || "", "/api/changes/versions");
 const rollbackEndpoint = withBase(basePath || "", "/api/changes/rollback");
-// b17 — branch retention: GET dry-run classification / POST guarded delete.
-// DISTINCT endpoint from retireEndpoint above (branch delete vs artifact evict).
+// Branch retention: GET dry-run classification / POST guarded delete.
 const branchesEndpoint = withBase(basePath || "", "/api/changes/branches");
 // The client builds `${diffEndpointBase}/<changeId>/diff` per candidate.
 const diffEndpointBase = changesEndpoint;
@@ -116,9 +142,47 @@ const diffEndpointBase = changesEndpoint;
 // digest actually serves. Rendered into "already live" copy + the publish
 // ceremony's "View your live store" CTA.
 const liveHref = withBase(basePath || "", "/");
+
+// LIVE-SITE ENTRY POINTS — surfaced explicitly so "where does my store actually
+// serve?" is never a mystery (it was). Two public URLs, always shown + clickable:
+//   1. Hosted store — THIS worker at the request host + tenant base path
+//      (e.g. storefront.tokenoftrust.store/tokenoftrust.com/).
+//   2. Public site — the static target's canonical URL, derived from the SAME
+//      manifest URL the freshness read-back probes (WWW_PUBLISH_VERIFY_URL or
+//      https://<canonicalDomain>/manifest.json), minus the /manifest.json tail
+//      (e.g. published.tokenoftrust.com). Only for static-publish tenants; a
+//      hosted-only tenant has no separate public site. Computed PURELY (no probe)
+//      so the URL shows even when the freshness probe above timed out.
+const requestHost = Astro.request.headers.get("host") ?? Astro.url.host;
+const liveStoreUrl = `${Astro.url.protocol}//${requestHost}${liveHref}`;
+const publicManifestUrl = staticPublishEnabled
+  ? staticLiveManifestUrl({
+      canonicalDomain: tenant.canonicalDomain,
+      // Per-tenant override first (never bleeds across stores), then the global env
+      // escape hatch, then the canonical-apex default — mirrors resolveLiveVersion.
+      explicitUrl: tenant.staticPublish?.verifyUrl ?? (await readEnv("WWW_PUBLISH_VERIFY_URL")) ?? null,
+    })
+  : null;
+const publicSiteUrl = publicManifestUrl
+  ? publicManifestUrl.replace(/\/manifest\.json$/, "/")
+  : null;
+const stripScheme = (u: string): string => u.replace(/^https?:\/\//, "");
+
+// r08 — a signed, tenant-scoped, expiring `?__preview` capability link an owner can
+// copy and hand to a non-technical stakeholder (view-only, no sign-in required).
+// Minted server-side so the signing secret never reaches the browser (mirrors
+// preview/dashboard.astro). Signs the tenant_id claim: the shared-preview
+// middleware verifies against `tenant.tenant_id` and the candidate renderer accepts
+// tenant_id too, so ONE token authorizes BOTH the shared next-release preview AND
+// per-candidate `preview/pr/<N>` links. Only minted for a ship-capable viewer, and
+// absent when signing isn't configured — the copy buttons then stay hidden rather
+// than offering a dead link. TTL 24h so a link copied late in a long session still
+// works; a reload re-mints a fresh one.
+const previewShareToken = viewerCanShip ? await mintPreviewShareToken(tenant.tenant_id) : null;
+
 const domainStatusEndpoint = withBase(basePath || "", "/api/domain/status");
 const domainDispatchEndpoint = withBase(basePath || "", "/api/domain/dispatch");
-// u9: the machine-verifiable apex-cutover readiness gate — the SAME server gate the
+// The machine-verifiable apex-cutover readiness gate — the SAME server gate the
 // `tot go-live` CLI reads, so the admin display and the CLI never diverge.
 const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness");
 ---
@@ -134,7 +198,6 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
   data-changes-endpoint={changesEndpoint}
   data-integrate-endpoint={integrateEndpoint}
   data-ship-endpoint={shipEndpoint}
-  data-retire-endpoint={retireEndpoint}
   data-build-endpoint={buildEndpoint}
   data-versions-endpoint={versionsEndpoint}
   data-rollback-endpoint={rollbackEndpoint}
@@ -145,17 +208,20 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
   data-domain-readiness-endpoint={domainReadinessEndpoint}
   data-repo={tenant.appDomain}
   data-app-domain={tenant.appDomain}
+  data-canonical-domain={tenant.canonicalDomain ?? ""}
+  data-preview-share-token={previewShareToken ?? ""}
   data-live-href={liveHref}
   data-can-ship={viewerCanShip ? "true" : "false"}
   data-is-owner={viewerIsOwner ? "true" : "false"}
   data-entitled={goLiveEntitled ? "true" : "false"}
   data-static-publish={staticPublishEnabled ? "true" : "false"}
   data-dispatch-configured={dispatchConfigured ? "true" : "false"}
+  data-public-site-host={publicSiteUrl ? stripScheme(publicSiteUrl).replace(/\/$/, "") : ""}
 >
   <div class="section-title">
     <div>
       <h2 id="publish-title">Publish</h2>
-      <p>Accept changes into the preview aggregate, then publish the reviewed build live.</p>
+      <p>Review what's changed, then publish your next release when you're ready.</p>
     </div>
     <div class="actions">
       <button class="btn" type="button" data-publish-refresh>
@@ -206,11 +272,79 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     </div>
   )}
 
+  <!-- State-driven "next action" hero (r01) — the SINGLE top-of-tab state
+       element. ONE sentence + ONE primary CTA, derived by lib/publish/publishHero.ts
+       from the SAME /api/changes read the queue + aggregate already fetch (no extra
+       read). It ABSORBS the two former standalone banners: the merge-doctor health
+       summary (B1) and the platform-fault "Report to support" escalation (B3) are
+       folded into the hero's state model, expressed through this one element — a
+       merge conflict/platform blocker turns the hero red/urgent instead of rendering
+       a separate banner. Rendered by renderHero() in adminPublishTab.ts; starts
+       hidden until the first /api/changes read resolves. The r03 stale-public-site
+       alarm sits alongside it in this region (a distinct top-level signal that
+       deep-links into Live Site), so there is ONE hero/alert region, not floating
+       banners. Urgency is never color-only: the tone drives the icon + an explicit
+       "Action needed" label. -->
+  <div class="publish-hero-region" data-publish-hero-region>
+    <div class="publish-hero" data-publish-hero data-tone="calm" hidden role="status" aria-live="polite">
+      <div class="publish-hero-main">
+        <span class="publish-hero-icon" data-publish-hero-icon aria-hidden="true">
+          <svg><use href="#i-check"></use></svg>
+        </span>
+        <div class="publish-hero-copy">
+          <span class="publish-hero-kicker" data-publish-hero-kicker hidden>Action needed</span>
+          <b class="publish-hero-headline" data-publish-hero-headline></b>
+          <span class="publish-hero-detail" data-publish-hero-detail></span>
+        </div>
+      </div>
+      <div class="publish-hero-actions">
+        <button class="btn primary publish-hero-cta" type="button" data-publish-hero-cta hidden></button>
+        <a class="btn primary publish-hero-cta" data-publish-hero-cta-link hidden href="mailto:success@tokenoftrust.com"></a>
+      </div>
+    </div>
+
+    <!-- r03: stale-public-site alarm, LIFTED to top-level. The "public site is
+         behind the live pointer" verdict (resolveLiveVersion / isPublicSiteCurrent)
+         used to sit buried inside the collapsible Live Site section; when the public
+         target is behind, surface it here as a top-level amber alarm that deep-links
+         into Live Site (where the full breakdown stays nested). SSR-driven from the
+         same publicSiteVerdict the Live Site chip reads — shown only for a
+         static-publish tenant whose public target is confirmed behind. -->
+    {staticPublishEnabled && publicSiteVerdict && publicSiteVerdict.status === "behind" && (
+      <div class="risk-alert amber publish-stale-site" data-publish-stale-site role="status" aria-live="polite">
+        <div class="risk-alert-main">
+          <svg><use href="#i-alert"></use></svg>
+          <div>
+            <b>Public site is behind — re-publish to catch it up</b>
+            <span>
+              Your public site is still serving an older release
+              (<code class="publish-mono">{publicSiteVerdict.publishedSha.slice(0, 12)}</code>)
+              while your live pointer has moved on to
+              (<code class="publish-mono">{publicSiteVerdict.livePointerSha.slice(0, 12)}</code>).
+              Re-publish, or open the publishing details for the full breakdown.
+            </span>
+          </div>
+        </div>
+        <a class="btn" href="#publish-live-site" data-publish-stale-site-link>Open publishing details</a>
+      </div>
+    )}
+  </div>
+
   <div class="grid cols-3">
     <div class="metric">
       <span>Live version</span>
-      <strong data-publish-live-version>—</strong>
+      <strong>
+        <!-- The human version label ("v42") links straight to the live store; the
+             raw SHA is demoted to the Technical details disclosure below. -->
+        <a class="live-version-link" data-publish-live-version-link href={liveHref}
+           target="_blank" rel="noopener" hidden>—</a>
+        <span data-publish-live-version-none>—</span>
+      </strong>
       <small data-publish-live-source>What shoppers see right now</small>
+      <details class="metric-tech" data-publish-live-tech hidden>
+        <summary>Technical details</summary>
+        <span class="publish-mono subtle" data-publish-live-sha>—</span>
+      </details>
     </div>
     <div class="metric">
       <span>Published</span>
@@ -240,11 +374,12 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     </div>
   )}
 
-  <div class="panel">
-    <div class="panel-head">
-      <h3><svg><use href="#i-export"></use></svg>Candidate queue</h3>
+  <div class="panel" id="publish-queue">
+    <details class="publish-queue-details" open>
+    <summary class="panel-head">
+      <h3><svg><use href="#i-export"></use></svg>What needs your approval?</h3>
       <span class="chip" data-publish-queue-chip>Loading</span>
-    </div>
+    </summary>
     <div class="panel-body grid">
       <p class="note publish-status" data-publish-status role="status" aria-live="polite"></p>
       <!-- rux1: forge-listing degraded strip. Shown ONLY when GET /api/changes
@@ -291,246 +426,470 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         </p>
       )}
     </div>
+    </details>
+  </div>
+
+  <!-- "See all" history: changes that LEFT the queue by being rejected. Rejecting
+       is otherwise a black hole — this collapsed panel keeps them visible (and their
+       preview reachable) so a reject is recoverable-from-history. Collapsed by
+       default (a reference, not a work surface); the whole panel is hidden by the
+       client when there are none, so it never adds empty chrome. Excludes shipped
+       (merged) changes — those live in the Live Site / versions panel. -->
+  <div class="panel" id="publish-closed" data-publish-closed-panel hidden>
+    <details class="closed-changes-details">
+    <summary class="panel-head">
+      <h3><svg><use href="#i-undo"></use></svg>Closed &amp; rejected changes</h3>
+      <span class="chip" data-publish-closed-chip>0</span>
+    </summary>
+    <div class="panel-body grid">
+      <p class="note subtle">
+        Changes you rejected. They're not in your next release and won't go live —
+        kept here so nothing you closed silently disappears. Open a preview to review
+        what it was.
+      </p>
+      <div class="table-wrap">
+        <table class="publish-table">
+          <thead>
+            <tr>
+              <th>Change</th>
+              <th>Closed</th>
+              <th>Head</th>
+            </tr>
+          </thead>
+          <tbody data-publish-closed-body></tbody>
+        </table>
+      </div>
+    </div>
+    </details>
   </div>
 
   <!-- b11: the AGGREGATE card — the protected `preview` aggregate the accepted
        candidates integrate into, its combined evidence (the last integration
        run's honest state), and the exact-digest Publish (b09/b10 ship the
        reviewed pinned SHA + digest, never a rebuild). -->
-  <div class="panel" data-publish-aggregate>
-    <div class="panel-head">
-      <h3><svg><use href="#i-box"></use></svg>Preview aggregate</h3>
+  <div class="panel agg-console" id="publish-next-release" data-publish-aggregate>
+    <details class="agg-console-details" open>
+    <summary class="panel-head">
+      <h3><svg><use href="#i-box"></use></svg>Next release</h3>
+      <!-- r11 — the human release name (aggregate.name), shown beside the heading.
+           Client-populated by renderAggregate; hidden (falls back to just "Next
+           release") when the release has no name. -->
+      <span class="agg-release-name" data-aggregate-name hidden></span>
+      <!-- One-click hop to the current preview build. Shown only when a
+           genuinely-built revision exists (renderAggregate toggles it via
+           classifyBuildLink), so it can never lead to a 404. The click is
+           stop-propagated in adminPublishTab.ts so opening the preview never
+           also toggles this collapsible. -->
+      <a class="btn btn-compact" data-aggregate-open-preview target="_blank" rel="noopener" hidden>Open preview</a>
+      <!-- r08 — copy a shareable, view-only preview link for the next release to hand
+           to a non-technical stakeholder (no sign-in). Unhidden by the client only
+           when a share token was minted; the click is stop-propagated so copying
+           never also toggles this collapsible. -->
+      <button class="btn btn-compact" type="button" data-aggregate-copy-preview hidden>
+        <svg><use href="#i-copy"></use></svg><span data-copy-preview-label>Copy preview link</span>
+      </button>
       <span class="chip" data-aggregate-chip>Loading</span>
-    </div>
+    </summary>
     <div class="panel-body grid">
       <p class="note publish-status" data-aggregate-status role="status" aria-live="polite"></p>
 
-      <div class="grid cols-3">
-        <div class="field">
-          <label>Aggregate build</label>
-          <strong class="publish-mono" data-aggregate-sha>—</strong>
-          <p data-aggregate-run-link>The current green preview build for this store.</p>
-        </div>
-        <div class="field">
-          <label>Combined evidence</label>
-          <strong data-aggregate-evidence>—</strong>
-          <p data-aggregate-evidence-detail>The last integration run's verdict.</p>
-        </div>
-        <div class="field">
-          <label>Reviewed digest</label>
-          <strong class="publish-mono" data-aggregate-digest>—</strong>
-          <p>The content digest that will be published — exactly what you reviewed.</p>
-        </div>
-      </div>
-
-      <!-- Included PRs — the batch this aggregate composes (b01 includedPrs). -->
-      <div class="aggregate-prs" data-aggregate-prs-wrap hidden>
-        <b>Included changes</b>
-        <ul class="aggregate-prs-list" data-aggregate-prs></ul>
-      </div>
-
-      <!-- The exact-digest Publish plan (b09 plan()): pinned SHA + digest +
-           included PRs + rollback target + paywall verdict + run link. Shown
-           inline (from GET /api/changes `plan`) so the confirm never POSTs to
-           preview. Publish is refused until the plan is `ok`. -->
-      <div class="aggregate-plan" data-aggregate-plan hidden>
-        <div class="aggregate-plan-head">
-          <b>Publish plan</b>
-          <span class="chip" data-aggregate-plan-chip></span>
-        </div>
-        <dl class="aggregate-plan-grid" data-aggregate-plan-grid></dl>
-        <p class="note" data-aggregate-plan-note></p>
-      </div>
-
-      <div class="check-row">
+      <!-- Keep the primary action beside the release status. The detail table can
+           be long; publishing must never be buried beneath it. -->
+      <div class="check-row agg-launch">
         <div>
-          <b>Publish the reviewed build to your live store</b>
+          <b>
+            {staticPublishEnabled
+              ? "Publish this release to the hosted and public sites"
+              : "Publish this release to your live store"}
+          </b>
           <p data-aggregate-publish-detail>
-            Publishes the exact reviewed digest — no rebuild. Available once the
-            aggregate is green and its integration run passed.
+            {publicSiteUrl ? (
+              <>
+                Publishes the exact build you reviewed to the hosted store, then
+                automatically republishes <code>{stripScheme(publicSiteUrl).replace(/\/$/, "")}</code>.
+              </>
+            ) : (
+              <>Publishes the exact build you reviewed — no rebuild.</>
+            )}
           </p>
         </div>
-        <button class="btn primary" type="button" data-aggregate-publish disabled>
-          <svg><use href="#i-export"></use></svg>Publish live
+        <button class="btn primary agg-publish-btn" type="button" data-aggregate-publish disabled>
+          <svg><use href="#i-export"></use></svg>
+          {staticPublishEnabled ? "Publish to both live sites" : "Publish live"}
         </button>
       </div>
-    </div>
-  </div>
 
-  <!-- dg7: published versions + promotion history + rollback (u2/u3 promotion_status,
-       u5 immutable /rev links, u8 rollback through the one orchestrator). -->
-  <div class="panel" data-publish-versions>
-    <div class="panel-head">
-      <h3><svg><use href="#i-refresh"></use></svg>Published versions</h3>
-      <span class="chip" data-versions-chip>Loading</span>
-    </div>
-    <div class="panel-body grid">
-      <p class="note publish-status" data-versions-status role="status" aria-live="polite"></p>
-      <p class="note" data-versions-rollback-note hidden></p>
-      <div class="table-wrap">
-        <table class="publish-table versions-table">
-          <thead>
-            <tr>
-              <th>Version</th>
-              <th>Digest</th>
-              <th>Promoted</th>
-              <th>Preview</th>
-              <th>State</th>
-              <th class="action">Actions</th>
-            </tr>
-          </thead>
-          <tbody data-versions-body>
-            <tr data-versions-placeholder>
-              <td colspan="6"><span class="subtle">Loading published versions…</span></td>
-            </tr>
-          </tbody>
-        </table>
+      <!-- Only visible after an actually failed aggregate rebuild. -->
+      <div class="check-row" data-aggregate-retry-row hidden>
+        <div>
+          <b>Retry the build</b>
+          <p>
+            Your change was added, but rebuilding the preview failed. Retry rebuilds it
+            and re-runs your store's checks — nothing new is added.
+          </p>
+        </div>
+        <button class="btn" type="button" data-aggregate-retry-build>
+          <svg><use href="#i-refresh"></use></svg>Retry build
+        </button>
       </div>
-    </div>
-  </div>
 
-  <!-- b17: branch retention — Admin visibility into the branch-lifecycle
-       contract's "Candidate branch retirement" table (P1 items 8/9/11). Reads
-       the guarded `candidate_list` classification (protected/active-open/
-       stale-open/integrated/closed-or-rejected/orphan) and, for a branch that
-       classifies as ready, runs the guarded `candidate_delete` — which
-       re-classifies fresh server-side and refuses anything not integrated or
-       closed-or-rejected, no matter what this panel last rendered. DISTINCT
-       from the "Retire" action in the candidate queue above: retire evicts a
-       hosted PREVIEW ARTIFACT (rebuildable); this panel deletes a Git BRANCH
-       (transport only, never the durable record — see the note below). An
-       orphan is always shown quarantined for review, never one-click deletable. -->
-  <div class="panel" data-publish-branches>
-    <div class="panel-head">
-      <h3><svg><use href="#i-workflows"></use></svg>Branch retention</h3>
-      <span class="chip" data-branches-chip>Loading</span>
-    </div>
-    <div class="panel-body grid">
-      <p class="note">
-        Cleans up candidate <b>branches</b> once their pull request is merged or
-        closed — a different action on a different object than <b>Retire</b> in
-        the queue above, which only evicts a hosted preview build (rebuildable
-        on demand, never a branch). Every classification below is a fresh
-        dry-run; deleting always re-checks eligibility on the server and asks
-        you to confirm before removing anything. Orphan branches (no PR record
-        at all) are quarantined for your review, never deleted automatically.
-      </p>
-      <p class="note publish-status" data-branches-status role="status" aria-live="polite"></p>
-      <div class="table-wrap">
-        <table class="publish-table">
-          <thead>
-            <tr>
-              <th>Branch</th>
-              <th>Classification</th>
-              <th>PR</th>
-              <th>Tip commit</th>
-              <th>Age</th>
-              <th>Evidence</th>
-              <th class="action">Actions</th>
-            </tr>
-          </thead>
-          <tbody data-branches-body>
-            <tr data-branches-placeholder>
-              <td colspan="7"><span class="subtle">Loading branch classification…</span></td>
-            </tr>
-          </tbody>
-        </table>
+      <!-- AI-assembled release summary — a plain-language "what am I about to
+           publish?" ahead of the technical trust chain. Rendered ONLY when the
+           server supplies data.releaseSummary; otherwise it stays hidden and the
+           panel degrades to today's behavior (graceful fallback). -->
+      <div class="agg-summary" data-aggregate-summary hidden>
+        <div class="agg-summary-head">
+          <span class="agg-summary-glyph" aria-hidden="true">
+            <svg viewBox="0 0 24 24" fill="currentColor"><path d="M12 2l1.9 4.7L18.5 8.6l-4.6 1.9L12 15.2l-1.9-4.7L5.5 8.6l4.6-1.9L12 2z"></path><path d="M18.5 14l.9 2.2 2.3.9-2.3.9-.9 2.2-.9-2.2-2.3-.9 2.3-.9.9-2.2z"></path></svg>
+          </span>
+          <span class="agg-summary-label">What&rsquo;s in this release</span>
+          <span class="agg-ai-chip">
+            <svg viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M12 2l1.9 4.7L18.5 8.6l-4.6 1.9L12 15.2l-1.9-4.7L5.5 8.6l4.6-1.9L12 2z"></path></svg>
+            AI summary
+          </span>
+        </div>
+        <p class="agg-summary-lead" data-aggregate-summary-lead></p>
+        <ul class="agg-summary-points" data-aggregate-summary-points></ul>
       </div>
-    </div>
-  </div>
 
-  {staticPublishEnabled && (
-    <div class="panel" data-publish-domain>
-      <div class="panel-head">
-        <h3><svg><use href="#i-shield"></use></svg>Public domain</h3>
-        <span class="chip" data-domain-state-chip>Loading</span>
-      </div>
-      <div class="panel-body grid">
-        <div class="grid cols-3">
-          <div class="field">
-            <label>Serving from</label>
-            <strong data-domain-state>—</strong>
-            <p data-domain-since>Current host for {tenant.appDomain}</p>
+      <!-- Chain of custody: the build that was verified → its combined evidence →
+           the digest that ships. Collapsed by default — this is verification
+           detail for a developer, not something a merchant needs to read to
+           decide whether to publish; the plain-language summary above and the
+           Publish button below are the actual decision surface. -->
+      <details class="agg-chain-details">
+        <summary>Technical details</summary>
+        <div class="agg-chain">
+          <div class="agg-stop">
+            <span class="agg-stop-label">Aggregate build</span>
+            <span class="agg-stop-val"><strong class="publish-mono" data-aggregate-sha>—</strong></span>
+            <p class="agg-stop-cap" data-aggregate-run-link>The current green preview build for this store.</p>
+          </div>
+          <div class="agg-link" aria-hidden="true">
+            <span class="agg-flowlabel">verified by</span>
+            <span class="agg-arrow"><svg viewBox="0 0 34 10" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M1 5h29m0 0-4-4m4 4-4 4"></path></svg></span>
           </div>
-          <div class="field">
-            <label>Rollback records</label>
-            <strong data-domain-capture>None captured</strong>
-            <p>DNS records captured before connect — rollback restores these.</p>
+          <div class="agg-stop">
+            <span class="agg-stop-label">Combined evidence</span>
+            <span class="agg-stop-val"><strong data-aggregate-evidence>—</strong></span>
+            <p class="agg-stop-cap" data-aggregate-evidence-detail>The last integration run's verdict.</p>
           </div>
-          <div class="field">
-            <label>Last run</label>
-            <strong data-domain-run>None</strong>
-            <p data-domain-run-detail>Connect and rollback runs appear here.</p>
+          <div class="agg-link" aria-hidden="true">
+            <span class="agg-flowlabel">produces</span>
+            <span class="agg-arrow"><svg viewBox="0 0 34 10" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M1 5h29m0 0-4-4m4 4-4 4"></path></svg></span>
+          </div>
+          <div class="agg-stop">
+            <span class="agg-stop-label">Reviewed digest</span>
+            <span class="agg-stop-val"><strong class="publish-mono agg-digest" data-aggregate-digest>—</strong></span>
+            <p class="agg-stop-cap">The content digest that will be published — exactly what you reviewed.</p>
           </div>
         </div>
+      </details>
+
+      <!-- Included PRs — the batch this aggregate composes (b01 includedPrs). u14:
+           the "missing middle" — this is the STAGED delta vs live. The title + note
+           narrate how far ahead of the live site the staged preview is, and each row
+           carries an Undo (per-change revert) to roll the staged preview backward. -->
+      <div class="aggregate-prs agg-staged" data-aggregate-prs-wrap hidden>
+        <div class="agg-staged-head">
+          <b data-aggregate-prs-title>Included changes</b>
+          <!-- Scope-of-change risk measure across the whole staged batch (total
+               files + lines). Populated by renderAggregate from data.stagedScope;
+               hidden when no staged change carries size stats. -->
+          <span class="agg-scope" data-aggregate-scope hidden></span>
+        </div>
+        <!-- Staged → live delta strip: staged aggregate sha ahead of the live
+             pointer. Populated by renderAggregate; hidden when nothing is ahead. -->
+        <div class="agg-delta-strip" data-aggregate-delta-strip hidden>
+          <span class="agg-delta-node">
+            <span class="agg-stop-label">Staged preview</span>
+            <span class="sha-token" data-agg-delta-staged>—</span>
+          </span>
+          <span class="agg-delta-mid" aria-hidden="true">
+            <span class="agg-delta-count" data-agg-delta-count></span>
+            <svg viewBox="0 0 26 10" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M1 5h21m0 0-4-4m4 4-4 4"></path></svg>
+          </span>
+          <span class="agg-delta-node">
+            <span class="agg-stop-label">Live site</span>
+            <span class="sha-token ghost" data-agg-delta-live>—</span>
+          </span>
+        </div>
+        <p class="note" data-aggregate-delta-note hidden></p>
+        <!-- ONE table, one row per change — merges what used to be two separate
+             "Included changes" lists (this staged-delta section + the Publish
+             plan's own duplicate) into a single source of truth. Populated by
+             renderAggregate, enriched with the plan's per-change title/description/
+             file+line counts when available. -->
+        <div class="table-wrap">
+          <table class="publish-table agg-included-table">
+            <thead>
+              <tr>
+                <th>Change</th>
+                <th>Head</th>
+                <th>Files</th>
+                <th>Lines</th>
+                <th>Added</th>
+                <th class="action">Actions</th>
+              </tr>
+            </thead>
+            <tbody data-aggregate-prs></tbody>
+          </table>
+        </div>
+      </div>
 
-        <p class="note publish-status" data-domain-status role="status" aria-live="polite"></p>
-
-        <!-- u9: apex-cutover readiness — the itemized preconditions the server gate
-             requires before a connect is permitted. Populated from
-             /api/domain/readiness (the SAME gate `tot go-live` reads). -->
-        <div class="domain-readiness" data-domain-readiness hidden>
-          <div class="domain-readiness-head">
-            <b>Cutover readiness</b>
-            <span class="chip" data-domain-readiness-chip>Checking…</span>
-          </div>
-          <ul class="domain-readiness-list" data-domain-readiness-list></ul>
-          <p class="note" data-domain-readiness-note></p>
+      <!-- The exact-digest Publish plan (b09 plan()): pinned SHA + digest +
+           rollback target + paywall verdict + run link. Shown inline (from
+           GET /api/changes `plan`) so the confirm never POSTs to preview.
+           Publish is refused until the plan is `ok`. Its own included-changes
+           list was merged into the single table above — see data-aggregate-prs. -->
+      <div class="aggregate-plan agg-manifest" data-aggregate-plan hidden>
+        <div class="aggregate-plan-head agg-manifest-head">
+          <b><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M9 11l3 3L22 4"></path><path d="M21 12v7a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h11"></path></svg>Publish plan</b>
+          <span class="chip" data-aggregate-plan-chip></span>
         </div>
+        <details class="agg-chain-details">
+          <summary>Technical details</summary>
+          <dl class="aggregate-plan-grid" data-aggregate-plan-grid></dl>
+        </details>
 
-        <div class="check-row">
-          <div>
-            <b>Connect {tenant.appDomain} to the storefront</b>
-            <p>
-              Updates two DNS names — <code>{tenant.appDomain}</code> and <code>www.{tenant.appDomain}</code> —
-              to serve the published site. Takes effect in about a minute. Type the
-              domain to confirm.
-            </p>
-            {!viewerCanApexCutover && (
-              <p><span class="chip amber">Owner/admin only</span> Connecting the domain requires an owner or admin sign-in.</p>
-            )}
-          </div>
-          <div class="domain-connect-controls">
-            <input
-              type="text"
-              placeholder={tenant.appDomain}
-              autocomplete="off"
-              spellcheck="false"
-              aria-label="Type the domain to confirm"
-              data-domain-confirm
-              disabled={!viewerCanApexCutover}
-            />
-            <label class="domain-rehearsal">
-              <input type="checkbox" data-domain-rehearsal disabled={!viewerCanApexCutover} />
-              Rehearsal (dry run, no DNS change)
-            </label>
-            <button
-              class="btn primary"
-              type="button"
-              data-domain-connect
-              data-owner-locked={!viewerCanApexCutover ? "true" : undefined}
-              disabled={!viewerCanApexCutover}
-            >
-              <svg><use href="#i-check"></use></svg>Connect domain
-            </button>
+        <p class="note" data-aggregate-plan-note></p>
+      </div>
+
+    </div>
+    </details>
+  </div>
+
+  <!-- Branch retention panel removed entirely — old candidate branches now
+       clean themselves up automatically (auto-swept after each successful
+       accept/publish, see adminPublishTab.ts autoSweepBranches). There is
+       nothing here for anyone to look at or act on day-to-day, so there is no
+       panel at all, not even a collapsed one. -->
+
+  <!-- Publish next release — the collapsed destination/status panel below the
+       staged release. Its summary answers the operational question first: either
+       live already matches the staged release, or there is an action to advance it.
+       The disclosure contains destination links, freshness, rollback, and domain
+       controls for operators who need the detail. -->
+  <div class="panel" id="publish-live-site" data-publish-live-site>
+    <details class="live-site-details">
+      <summary class="panel-head">
+        <h3><svg><use href="#i-export"></use></svg>Publish next release</h3>
+        <span class="chip" data-live-release-state>Checking release…</span>
+        <button
+          class="btn primary btn-compact live-release-publish"
+          type="button"
+          data-live-release-publish
+          hidden
+        >Publish next release</button>
+      </summary>
+      <div class="panel-body grid">
+        <ul class="live-site-links">
+          <li>
+            <span class="live-site-link-label">Hosted store</span>
+            <a class="live-site-link-url publish-mono" href={liveHref} target="_blank" rel="noopener">{stripScheme(liveStoreUrl)}</a>
+            <span class="live-site-link-note">Updates immediately when you publish the reviewed release above.</span>
+          </li>
+          {publicSiteUrl && (
+            <li>
+              <span class="live-site-link-label">Public site</span>
+              <a class="live-site-link-url publish-mono" href={publicSiteUrl} target="_blank" rel="noopener">{stripScheme(publicSiteUrl)}</a>
+              <span class="live-site-link-note">Republishes automatically after the hosted release is published.</span>
+            </li>
+          )}
+        </ul>
+
+        <!-- Public-site freshness read-back (static-publish seam's staticLiveDigest):
+             what the external target (CloudFront/S3) is HONESTLY observed serving
+             right now, vs the control-plane's live pointer — the two can diverge on a
+             stale/failed republish. Answers "did going live actually reach the public
+             site?" without a manual curl. -->
+        {staticPublishEnabled && publicSiteDigest && publicSiteVerdict && (
+          <div
+            class={`risk-alert ${publicSiteVerdict.status === "current" ? "public-site-ok" : "amber"}`}
+            data-publish-public-site
+          >
+            <div class="risk-alert-main">
+              <svg><use href={publicSiteVerdict.status === "current" ? "#i-check" : "#i-alert"}></use></svg>
+              <div>
+                {publicSiteVerdict.status === "current" ? (
+                  <>
+                    <b>Public site matches the currently published release</b>
+                    <span>
+                      <code>{stripScheme(publicSiteUrl ?? tenant.appDomain).replace(/\/$/, "")}</code> is serving
+                      (<code class="publish-mono">{liveVersion?.versionId?.slice(0, 12)}</code>)
+                      — the same release as the hosted store. Staged preview changes are
+                      a separate next release: use <b>Publish to both live sites</b> above
+                      to advance the hosted store and republish this public site.
+                    </span>
+                  </>
+                ) : publicSiteVerdict.status === "behind" ? (
+                  <>
+                    <b>Public site is behind the hosted store's live pointer</b>
+                    <span>
+                      <code>{tenant.appDomain}</code>'s public target is still serving{" "}
+                      <code class="publish-mono">{publicSiteVerdict.publishedSha.slice(0, 12)}</code>, but
+                      the hosted store's live pointer has since moved to{" "}
+                      <code class="publish-mono">{publicSiteVerdict.livePointerSha.slice(0, 12)}</code>.
+                      The republish job hasn't caught up yet (or a go-live happened before it was enabled) —
+                      check the workflow run, or trigger a fresh go-live to re-dispatch it.
+                    </span>
+                  </>
+                ) : (
+                  <>
+                    <b>Couldn't verify the public site is current</b>
+                    <span>
+                      Checked <code class="publish-mono">{publicSiteDigest.url}</code>: {publicSiteVerdict.reason}.
+                      This does NOT mean the hosted store's own "Live version" above is wrong, only that the
+                      separate public static target couldn't be confirmed current.
+                    </span>
+                  </>
+                )}
+              </div>
+            </div>
           </div>
+        )}
+
+        <!-- Rollback options — CONTAINED within Live Site as a subsection (was a sibling
+             panel). The full published-version history + one-click rollback through the
+             single rollback orchestrator; collapsed by default (most people never open
+             it — the live version is already the metric up top). Keeps its
+             data-publish-versions + data-versions-* hooks verbatim. -->
+        <div class="live-site-subsection" data-publish-versions>
+          <details class="versions-details">
+            <summary class="live-site-subhead">
+              <h4><svg><use href="#i-refresh"></use></svg>Rollback options</h4>
+              <span class="chip" data-versions-chip>Loading</span>
+            </summary>
+            <div class="grid">
+              <p class="note publish-status" data-versions-status role="status" aria-live="polite"></p>
+              <p class="note" data-versions-rollback-note hidden></p>
+              <!-- u14: orients the owner between the staged aggregate above and live versions
+                   below — "N staged change(s) not yet published; Publish live creates the next
+                   version here." Owned by renderAggregate (its own element, so its timing never
+                   races renderVersions). -->
+              <p class="note" data-versions-orientation hidden></p>
+              <div class="table-wrap">
+                <table class="publish-table versions-table">
+                  <thead>
+                    <tr>
+                      <th>Version</th>
+                      <th>Digest</th>
+                      <th>Promoted</th>
+                      <th>Preview</th>
+                      <th>State</th>
+                      <th class="action">Actions</th>
+                    </tr>
+                  </thead>
+                  <tbody data-versions-body>
+                    <tr data-versions-placeholder>
+                      <td colspan="6"><span class="subtle">Loading published versions…</span></td>
+                    </tr>
+                  </tbody>
+                </table>
+              </div>
+            </div>
+          </details>
         </div>
 
-        <div class="check-row">
-          <div>
-            <b>Roll back to the previous host</b>
-            <p data-domain-rollback-detail>
-              Restores the DNS records captured before connect. Available once records
-              have been captured.
-            </p>
+        <!-- Public domain (apex connect / rollback) — CONTAINED within Live Site as a
+             subsection. Keeps its data-publish-domain + data-domain-* hooks verbatim so
+             the client controller is unchanged; only the wrapper/heading are lighter to
+             read as a nested section rather than a sibling panel. -->
+        {staticPublishEnabled && (
+          <div class="live-site-subsection" data-publish-domain>
+            <div class="live-site-subhead">
+              <h4><svg><use href="#i-shield"></use></svg>Public domain</h4>
+              <span class="chip" data-domain-state-chip>Loading</span>
+            </div>
+            <div class="grid">
+              <div class="grid cols-3">
+                <div class="field">
+                  <label>Serving from</label>
+                  <strong data-domain-state>—</strong>
+                  <p data-domain-since>Current host for {tenant.appDomain}</p>
+                </div>
+                <div class="field">
+                  <label>Rollback records</label>
+                  <strong data-domain-capture>None captured</strong>
+                  <p>DNS records captured before connect — rollback restores these.</p>
+                </div>
+                <div class="field">
+                  <label>Last run</label>
+                  <strong data-domain-run>None</strong>
+                  <p data-domain-run-detail>Connect and rollback runs appear here.</p>
+                </div>
+              </div>
+
+              <p class="note publish-status" data-domain-status role="status" aria-live="polite"></p>
+
+              <!-- u9: apex-cutover readiness — the itemized preconditions the server gate
+                   requires before a connect is permitted. Populated from
+                   /api/domain/readiness (the SAME gate `tot go-live` reads). -->
+              <div class="domain-readiness" data-domain-readiness hidden>
+                <div class="domain-readiness-head">
+                  <b>Cutover readiness</b>
+                  <span class="chip" data-domain-readiness-chip>Checking…</span>
+                </div>
+                <ul class="domain-readiness-list" data-domain-readiness-list></ul>
+                <p class="note" data-domain-readiness-note></p>
+              </div>
+
+              <div class="check-row">
+                <div>
+                  <b>Connect {tenant.appDomain} to the storefront</b>
+                  <p>
+                    Updates two DNS names — <code>{tenant.appDomain}</code> and <code>www.{tenant.appDomain}</code> —
+                    to serve the published site. Takes effect in about a minute. Type the
+                    domain to confirm.
+                  </p>
+                  {!viewerCanApexCutover && (
+                    <p><span class="chip amber">Owner/admin only</span> Connecting the domain requires an owner or admin sign-in.</p>
+                  )}
+                </div>
+                <div class="domain-connect-controls">
+                  <input
+                    type="text"
+                    placeholder={tenant.appDomain}
+                    autocomplete="off"
+                    spellcheck="false"
+                    aria-label="Type the domain to confirm"
+                    data-domain-confirm
+                    disabled={!viewerCanApexCutover}
+                  />
+                  <label class="domain-rehearsal">
+                    <input type="checkbox" data-domain-rehearsal disabled={!viewerCanApexCutover} />
+                    Rehearsal (dry run, no DNS change)
+                  </label>
+                  <button
+                    class="btn primary"
+                    type="button"
+                    data-domain-connect
+                    data-owner-locked={!viewerCanApexCutover ? "true" : undefined}
+                    disabled={!viewerCanApexCutover}
+                  >
+                    <svg><use href="#i-check"></use></svg>Connect domain
+                  </button>
+                </div>
+              </div>
+
+              <div class="check-row">
+                <div>
+                  <b>Roll back to the previous host</b>
+                  <p data-domain-rollback-detail>
+                    Restores the DNS records captured before connect. Available once records
+                    have been captured.
+                  </p>
+                </div>
+                <button class="btn" type="button" data-domain-rollback disabled={!viewerCanShip}>
+                  <svg><use href="#i-refresh"></use></svg>Roll back
+                </button>
+              </div>
+            </div>
           </div>
-          <button class="btn" type="button" data-domain-rollback disabled={!viewerCanShip}>
-            <svg><use href="#i-refresh"></use></svg>Roll back
-          </button>
-        </div>
+        )}
       </div>
-    </div>
-  )}
+    </details>
+  </div>
 
   <!-- Accept-to-preview LIFTOFF — the plan confirm + live integration flight +
        outcome ceremony. One dialog, three phases (plan → flight → outcome).
@@ -540,44 +899,45 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
   <div class="liftoff-backdrop" data-liftoff hidden>
     <div class="liftoff-card" role="dialog" aria-modal="true" aria-labelledby="liftoff-title" tabindex="-1">
       <div class="liftoff-phase" data-liftoff-plan>
-        <p class="liftoff-kicker">Accept to preview</p>
-        <h3 class="liftoff-title" id="liftoff-title" data-liftoff-title>Integrate into preview</h3>
+        <p class="liftoff-kicker">Add to release</p>
+        <h3 class="liftoff-title" id="liftoff-title" data-liftoff-title>Add to your next release</h3>
         <dl class="liftoff-grid" data-liftoff-grid></dl>
         <p class="note">
-          Integrates this candidate into the protected <code>preview</code> aggregate, then
-          rebuilds it and re-runs its combined evidence. <b>Nothing goes live</b> —
-          publishing the reviewed build stays a separate, explicit step.
+          Adds this change to your next release, then rebuilds the preview and re-runs your
+          store's checks. <b>Nothing goes live</b> — publishing your release stays a
+          separate, explicit step.
         </p>
         <div class="liftoff-actions">
           <button class="btn" type="button" data-liftoff-cancel>Cancel</button>
           <button class="btn primary" type="button" data-liftoff-proceed>
-            <svg><use href="#i-check"></use></svg>Integrate into preview
+            <svg><use href="#i-check"></use></svg>Add to release
           </button>
         </div>
       </div>
 
       <div class="liftoff-phase" data-liftoff-flight hidden>
-        <p class="liftoff-kicker">Integration in flight</p>
-        <h3 class="liftoff-title" data-liftoff-flight-title>Integrating…</h3>
+        <p class="liftoff-kicker">Adding to your release</p>
+        <h3 class="liftoff-title" data-liftoff-flight-title>Adding…</h3>
         <ol class="liftoff-stages">
           <li data-liftoff-stage="merge">
             <span class="liftoff-dot"></span>
-            <div><b>Merge</b><span>squash-merge the candidate into <code>preview</code></span></div>
+            <div><b>Add</b><span>add this change to your next release</span></div>
           </li>
           <li data-liftoff-stage="build">
             <span class="liftoff-dot"></span>
-            <div><b>Rebuild</b><span>build the combined preview aggregate</span></div>
+            <div><b>Build</b><span>rebuild the preview with your change in it</span></div>
           </li>
           <li data-liftoff-stage="evidence">
             <span class="liftoff-dot"></span>
-            <div><b>Evidence</b><span>re-run the aggregate's combined checks</span></div>
+            <div><b>Check</b><span>re-run your store's checks on the preview</span></div>
           </li>
           <li data-liftoff-stage="green">
             <span class="liftoff-dot"></span>
-            <div><b>Green</b><span>the aggregate becomes the reviewable, shippable build</span></div>
+            <div><b>Ready</b><span>your next release is ready to review and publish</span></div>
           </li>
         </ol>
         <p class="liftoff-live" data-liftoff-live role="status" aria-live="polite">Working…</p>
+        <div class="stream-log" data-liftoff-log role="log" aria-live="polite"></div>
         <div class="liftoff-meta">
           <span class="publish-mono" data-liftoff-elapsed>0:00</span>
           <button class="btn" type="button" data-liftoff-hide>Continue in background</button>
@@ -588,8 +948,81 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         <div class="liftoff-seal" data-liftoff-seal aria-hidden="true"></div>
         <h3 class="liftoff-title" data-liftoff-outcome-title></h3>
         <p class="note" data-liftoff-outcome-detail></p>
+        <!-- Merge-conflict recovery (shown ONLY for reason "merge_failed") — decision
+             `automate-first-conflict-recovery` (u4): the refusal LEADS with one primary
+             action ("Update this change automatically" → /resolve strategy:"merge",
+             then auto-re-integrate). The three option cards appear only when diff3 hits
+             a genuine same-line overlap (RefreshResult.unresolved); the old terminal +
+             AI-agent guidance is demoted VERBATIM into the collapsed "Do it manually
+             instead" expert section (nothing removed). Decision logic lives in the
+             tested `resolveConflict.ts`; this glue mirrors it (verified on preview). -->
+        <div class="liftoff-conflict" data-liftoff-conflict hidden>
+          <p class="note liftoff-conflict-summary" data-conflict-summary hidden></p>
+
+          <!-- PRIMARY ACTION — always first when a candidate is refused not-mergeable. -->
+          <div class="liftoff-conflict-primary" data-conflict-primary>
+            <p class="note" data-conflict-primary-note>
+              We can rebuild your change on top of the store's current version and
+              re-integrate it for you — no terminal, no re-submit.
+            </p>
+            <button class="btn primary" type="button" data-conflict-auto>Update this change automatically</button>
+            <p class="note liftoff-conflict-primary-status" data-conflict-primary-status role="status" aria-live="polite" hidden></p>
+          </div>
+
+          <!-- OPTION CARDS — revealed only on a genuine same-line overlap diff3 can't
+               safely auto-pick. Static nodes mirror CONFLICT_OPTION_CARDS. -->
+          <div class="liftoff-conflict-cards" data-conflict-cards hidden>
+            <p class="note" data-conflict-cards-intro>
+              Some of the same lines were changed on both sides, so there's no single safe
+              answer. Pick how to resolve the overlap:
+            </p>
+            <ul class="liftoff-conflict-files publish-mono" data-conflict-files></ul>
+            <div class="liftoff-conflict-card-grid" role="group" aria-label="Resolve the overlap">
+              <button class="liftoff-option-card" type="button" data-conflict-card data-strategy="merge" data-recommended="1">
+                <b>Combine both</b>
+                <span>Recommended — weave both sets of edits together</span>
+              </button>
+              <button class="liftoff-option-card" type="button" data-conflict-card data-strategy="ours">
+                <b>Keep my change</b>
+                <span>Use your edits on the conflicting lines</span>
+              </button>
+              <button class="liftoff-option-card" type="button" data-conflict-card data-strategy="theirs">
+                <b>Keep the store's current version</b>
+                <span>Use the store's edits on the conflicting lines</span>
+              </button>
+            </div>
+            <p class="note liftoff-conflict-cards-status" data-conflict-cards-status role="status" aria-live="polite" hidden></p>
+          </div>
+
+          <!-- EXPERT FALLBACK — the ORIGINAL terminal + AI-agent guidance, verbatim,
+               collapsed. Nothing deleted; just demoted from primary to fallback. -->
+          <details class="liftoff-conflict-expert" data-conflict-expert>
+            <summary>Do it manually instead</summary>
+            <p class="note" data-conflict-intro>
+              From the store checkout that submitted this change, bring it up to date and
+              re-submit — the open PR updates in place. Once the new build is ready,
+              finish here with <b>Add to release</b>, or from the terminal with
+              <code>tot accept --tenant &lt;store&gt; --pr &lt;N&gt;</code>.
+              Check <code>git status</code> first — abort any half-finished rebase from an
+              earlier attempt. Then <code>tot pr</code>: this change should be marked
+              <code>(active)</code>, proving you're in the right checkout and branch.
+              If git reports an authentication failure, run <code>tot login</code> and retry.
+            </p>
+            <pre class="liftoff-commands publish-mono" data-conflict-commands></pre>
+            <div class="liftoff-conflict-actions">
+              <button class="btn" type="button" data-conflict-copy-prompt>Copy prompt for your AI agent</button>
+              <button class="btn" type="button" data-conflict-copy>Copy commands</button>
+            </div>
+            <p class="liftoff-conflict-raw publish-mono" data-conflict-raw></p>
+          </details>
+        </div>
         <div class="liftoff-actions">
           <a class="btn" data-liftoff-review target="_blank" rel="noopener" hidden>Review the preview build</a>
+          <!-- Fail-visible next step: when the merge LANDED but the preview build
+               failed, this offers Rebuild (not a dead "did not land"); on an
+               indeterminate outcome it offers Re-check. Hidden on success/conflict
+               (conflict recovery owns its own primary action). -->
+          <button class="btn primary" type="button" data-liftoff-rebuild hidden>Rebuild the preview build</button>
           <button class="btn primary" type="button" data-liftoff-done>Done</button>
         </div>
       </div>
@@ -628,8 +1061,10 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         <p class="liftoff-live" data-shipoff-live role="status" aria-live="polite">
           Pinning the exact reviewed build to your live channel…
         </p>
+        <div class="stream-log" data-shipoff-log role="log" aria-live="polite"></div>
         <div class="liftoff-meta">
           <span class="publish-mono" data-shipoff-elapsed>0:00</span>
+          <button class="btn" type="button" data-shipoff-hide>Continue in background</button>
         </div>
       </div>
 
@@ -637,8 +1072,23 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         <div class="liftoff-seal" data-shipoff-seal aria-hidden="true"></div>
         <h3 class="liftoff-title" data-shipoff-outcome-title></h3>
         <p class="note" data-shipoff-outcome-detail></p>
+        <!-- Failure detail + "Copy for your AI agent" — shown ONLY when the publish did
+             not complete. Mirrors the build-flight failure affordance. -->
+        <div class="liftoff-conflict" data-shipoff-failure hidden>
+          <pre class="liftoff-commands publish-mono" data-shipoff-failure-detail></pre>
+          <div class="liftoff-conflict-actions">
+            <button class="btn" type="button" data-shipoff-copy>Copy for your AI agent</button>
+          </div>
+        </div>
         <div class="liftoff-actions">
-          <a class="btn primary" data-shipoff-view target="_blank" rel="noopener" hidden>View your live store</a>
+          <a class="btn primary" data-shipoff-view target="_blank" rel="noopener" hidden>View live</a>
+          <!-- r10 — right at the post-publish moment: jump straight to the rollback
+               row for the version this release just replaced, pre-targeted, so a
+               publish that looked wrong is one click from being undone. Reuses the
+               existing Live Site rollback action; shown only on a successful ship. -->
+          <button class="btn" type="button" data-shipoff-undo hidden>
+            <svg><use href="#i-undo"></use></svg>Undo this release
+          </button>
           <button class="btn" type="button" data-shipoff-done>Done</button>
         </div>
       </div>
@@ -646,2312 +1096,108 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
       <div class="liftoff-confetti" data-shipoff-confetti aria-hidden="true"></div>
     </div>
   </div>
+
+  <!-- Build/check flight — the real-time counterpart of the accept liftoff for the
+       "Build preview" / "Run checks" action. `POST /api/preview/build` streams its
+       lifecycle phases over SSE (Accept: text/event-stream); this dialog reflects them
+       live on the SAME stage-rail + "Continue in background" pattern as the liftoff.
+       On a FAILURE the outcome shows the full detail the build reported plus a "Copy
+       for your AI agent" button (mirrors the merge-conflict copy affordance). Progress
+       reduction + copy assembly live in the tested buildStream.ts; this glue mirrors
+       it (verified on preview). -->
+  <div class="liftoff-backdrop" data-buildoff hidden>
+    <div class="liftoff-card" role="dialog" aria-modal="true" aria-labelledby="buildoff-title" tabindex="-1">
+      <div class="liftoff-phase" data-buildoff-flight>
+        <p class="liftoff-kicker">Building preview</p>
+        <h3 class="liftoff-title" id="buildoff-title" data-buildoff-flight-title>Building…</h3>
+        <ol class="liftoff-stages">
+          <li data-buildoff-stage="resolve">
+            <span class="liftoff-dot"></span>
+            <div><b>Locate commit</b><span>find the pull request's latest commit</span></div>
+          </li>
+          <li data-buildoff-stage="read">
+            <span class="liftoff-dot"></span>
+            <div><b>Read &amp; validate</b><span>read your store's files and check them</span></div>
+          </li>
+          <li data-buildoff-stage="publish">
+            <span class="liftoff-dot"></span>
+            <div><b>Publish version</b><span>materialize this version's hosted preview</span></div>
+          </li>
+          <li data-buildoff-stage="check">
+            <span class="liftoff-dot"></span>
+            <div><b>Run checks</b><span>compute the evidence for this version</span></div>
+          </li>
+        </ol>
+        <p class="liftoff-live" data-buildoff-live role="status" aria-live="polite">Starting…</p>
+        <div class="stream-log" data-buildoff-log role="log" aria-live="polite"></div>
+        <div class="liftoff-meta">
+          <span class="publish-mono" data-buildoff-elapsed>0:00</span>
+          <button class="btn" type="button" data-buildoff-hide>Continue in background</button>
+        </div>
+      </div>
+
+      <div class="liftoff-phase liftoff-outcome-phase" data-buildoff-outcome hidden>
+        <div class="liftoff-seal" data-buildoff-seal aria-hidden="true"></div>
+        <h3 class="liftoff-title" data-buildoff-outcome-title></h3>
+        <p class="note" data-buildoff-outcome-detail></p>
+        <!-- Failure detail + "Copy for your AI agent" — shown ONLY when the build did
+             not succeed. The detail is the honest reason the build reported (errors +
+             blocking findings); the copy button hands a framed brief to a coding agent. -->
+        <div class="liftoff-conflict" data-buildoff-failure hidden>
+          <pre class="liftoff-commands publish-mono" data-buildoff-failure-detail></pre>
+          <div class="liftoff-conflict-actions">
+            <button class="btn" type="button" data-buildoff-copy>Copy for your AI agent</button>
+          </div>
+        </div>
+        <div class="liftoff-actions">
+          <a class="btn" data-buildoff-review target="_blank" rel="noopener" hidden>Open the preview</a>
+          <button class="btn primary" type="button" data-buildoff-done>Done</button>
+        </div>
+      </div>
+    </div>
+  </div>
+
+  <!-- Retry-build flight — the real-time counterpart for the aggregate "Retry build"
+       action (`POST /api/changes/rebuild`), which re-runs ONLY the aggregate rebuild +
+       combined evidence against the last merged commit (no new merge). It streams its
+       reading/publishing/checking phases over SSE into the SAME shared scrolling
+       live-log console; "Continue in background" hides it while the stream keeps
+       running, and on a FAILURE the outcome shows the honest detail + a "Copy for your
+       AI agent" button — the same affordances as the build/ship flights. -->
+  <div class="liftoff-backdrop" data-rebuildoff hidden>
+    <div class="liftoff-card" role="dialog" aria-modal="true" aria-labelledby="rebuildoff-title" tabindex="-1">
+      <div class="liftoff-phase" data-rebuildoff-flight>
+        <p class="liftoff-kicker">Retrying the build</p>
+        <h3 class="liftoff-title" id="rebuildoff-title">Rebuilding your next release preview…</h3>
+        <p class="liftoff-live" data-rebuildoff-live role="status" aria-live="polite">Starting…</p>
+        <div class="stream-log" data-rebuildoff-log role="log" aria-live="polite"></div>
+        <div class="liftoff-meta">
+          <span class="publish-mono" data-rebuildoff-elapsed>0:00</span>
+          <button class="btn" type="button" data-rebuildoff-hide>Continue in background</button>
+        </div>
+      </div>
+
+      <div class="liftoff-phase liftoff-outcome-phase" data-rebuildoff-outcome hidden>
+        <div class="liftoff-seal" data-rebuildoff-seal aria-hidden="true"></div>
+        <h3 class="liftoff-title" data-rebuildoff-outcome-title></h3>
+        <p class="note" data-rebuildoff-outcome-detail></p>
+        <div class="liftoff-conflict" data-rebuildoff-failure hidden>
+          <pre class="liftoff-commands publish-mono" data-rebuildoff-failure-detail></pre>
+          <div class="liftoff-conflict-actions">
+            <button class="btn" type="button" data-rebuildoff-copy>Copy for your AI agent</button>
+          </div>
+        </div>
+        <div class="liftoff-actions">
+          <button class="btn primary" type="button" data-rebuildoff-done>Done</button>
+        </div>
+      </div>
+    </div>
+  </div>
 </section>
 
-<script is:inline nonce={cspNonce}>
-  (() => {
-    const root = document.getElementById("publish");
-    if (!root) return;
-    const ds = root.dataset;
-    const canShip = ds.canShip === "true";
-    const repo = ds.repo || "";
-    const appDomain = ds.appDomain || "";
-
-    const statusEl = root.querySelector("[data-publish-status]");
-    const queueBody = root.querySelector("[data-publish-queue-body]");
-    const queueChip = root.querySelector("[data-publish-queue-chip]");
-    const queueCount = root.querySelector("[data-publish-queue-count]");
-    const degradedStrip = root.querySelector("[data-publish-degraded]");
-
-    // rux7 — in-flight UI state the auto-refresh poll must preserve across a
-    // re-render. These are the AUTHORITATIVE source of truth (never scraped
-    // back out of the DOM): an action's async closure holds a reference to the
-    // OLD button, so after a poll swaps the row the completion signal lands on a
-    // detached node — reading `disabled`/`data-building` off the fresh DOM would
-    // wedge forever. buildPreview/integrate/reject/retire add on start and
-    // delete in `finally` (before their own loadQueue), so the next render
-    // reflects the true busy set. Open diff panes are the exception: the DOM IS
-    // their source of truth (toggleDiff owns open/close), so renderQueue detaches
-    // and re-attaches the actual pane node — see renderQueue.
-    const inflightBuilds = new Set(); // prNumber currently building
-    const busyChanges = new Set(); // changeId with an in-flight integrate/reject/retire
-    let aggregatePublishing = false; // the aggregate Publish POST is in flight
-
-    const setStatus = (el, message, state) => {
-      if (!el) return;
-      el.textContent = message || "";
-      if (state) el.dataset.state = state;
-      else delete el.dataset.state;
-    };
-
-    const shortSha = (sha) => (sha ? String(sha).slice(0, 8) : "—");
-
-    // Inline mirror of `candidatePrUrl` (lib/preview/candidateDashboard.ts) — an
-    // is:inline script can't import a module, so the pure URL shape is mirrored
-    // here (same pattern as `shortSha`). The friendly `/preview/<tenant>/pr/<N>`
-    // route handles every state (ready, not-built, …), so a row with a PR number
-    // always has a working preview link even when `previewUrl` is still null.
-    const candidatePrUrl = (prNumber) =>
-      prNumber != null ? "/preview/" + encodeURIComponent(appDomain) + "/pr/" + prNumber : null;
-
-    const age = (iso) => {
-      if (!iso) return "—";
-      const ms = Date.now() - new Date(iso).getTime();
-      if (!Number.isFinite(ms) || ms < 0) return "—";
-      const mins = Math.floor(ms / 60000);
-      if (mins < 1) return "just now";
-      if (mins < 60) return mins + "m ago";
-      const hours = Math.floor(mins / 60);
-      if (hours < 48) return hours + "h ago";
-      return Math.floor(hours / 24) + "d ago";
-    };
-
-    const STATUS_CHIP = {
-      queued: "",
-      reconciling: "blue",
-      ready: "green",
-      blocked: "red",
-    };
-
-    const chip = (text, tone) => {
-      const el = document.createElement("span");
-      el.className = "chip" + (tone ? " " + tone : "");
-      el.textContent = text;
-      return el;
-    };
-
-    const cell = (...children) => {
-      const td = document.createElement("td");
-      for (const child of children) {
-        if (child == null) continue;
-        td.append(typeof child === "string" ? document.createTextNode(child) : child);
-      }
-      return td;
-    };
-
-    const subtle = (text) => {
-      const el = document.createElement("span");
-      el.className = "subtle";
-      el.textContent = text;
-      return el;
-    };
-
-    // ---- ?pr=N deep link ---------------------------------------------------
-    // A deep link like /admin#publish?pr=42 asks us to surface a specific PR's
-    // row once the queue has loaded. The param rides in the hash fragment
-    // (after the tab anchor) because that's how the admin shell routes tabs;
-    // fall back to a real query string too. Resolve exactly once — so the
-    // scroll/highlight never re-fires on the reloads that follow every ship
-    // action — and until it resolves, keep an honest "not in the queue yet"
-    // callout up rather than silently doing nothing.
-
-    const readRequestedPr = () => {
-      const hash = window.location.hash || "";
-      const q = hash.indexOf("?");
-      let raw = new URLSearchParams(q >= 0 ? hash.slice(q + 1) : "").get("pr");
-      if (raw == null) raw = new URLSearchParams(window.location.search).get("pr");
-      if (raw == null) return null;
-      const n = Number.parseInt(raw, 10);
-      return Number.isInteger(n) && n > 0 ? n : null;
-    };
-
-    const requestedPr = readRequestedPr();
-    let prDeeplinkResolved = false;
-
-    const applyPrDeeplink = () => {
-      if (requestedPr == null || prDeeplinkResolved) return;
-      const callout = root.querySelector("[data-publish-pr-callout]");
-      const row = queueBody.querySelector('tr[data-pr-number="' + requestedPr + '"]');
-      if (!row) {
-        if (callout) {
-          callout.hidden = false;
-          callout.textContent = "PR #" + requestedPr + " isn't in the queue yet.";
-        }
-        return;
-      }
-      prDeeplinkResolved = true;
-      if (callout) {
-        callout.hidden = true;
-        callout.textContent = "";
-      }
-      row.scrollIntoView({ block: "center", behavior: "smooth" });
-      row.classList.remove("publish-row-highlight");
-      void row.offsetWidth; // restart the flash animation if re-applied
-      row.classList.add("publish-row-highlight");
-      window.setTimeout(() => row.classList.remove("publish-row-highlight"), 2600);
-    };
-
-    // ---- Open change queue -------------------------------------------------
-
-    const renderQueue = (payload) => {
-      const changes = Array.isArray(payload.changes) ? payload.changes : [];
-      // rux1: surface a forge-listing failure as a visible strip — never let a
-      // degraded (short) list read as a genuine empty queue.
-      if (degradedStrip) degradedStrip.hidden = payload.degraded !== true;
-      // rux7: capture any open diff panes BEFORE wiping so a poll re-render
-      // re-attaches the exact node (with its already-fetched content) under the
-      // matching new row, instead of blowing the expanded pane away. Keyed by
-      // changeId (== the diff row's data-publish-diff-row). Wiping detaches them
-      // from the DOM but the Map keeps them alive for re-attachment.
-      const openDiffNodes = new Map();
-      queueBody.querySelectorAll("tr[data-publish-diff-row]").forEach((node) => {
-        openDiffNodes.set(node.dataset.publishDiffRow, node);
-      });
-      queueBody.textContent = "";
-      if (queueCount) queueCount.textContent = String(changes.length);
-      if (queueChip) {
-        queueChip.textContent = changes.length === 1 ? "1 open" : changes.length + " open";
-        queueChip.className = "chip" + (changes.length ? " blue" : "");
-      }
-
-      if (!changes.length) {
-        const tr = document.createElement("tr");
-        const td = cell(
-          subtle(
-            "No open changes. New store changes appear here when a developer submits them for review.",
-          ),
-        );
-        td.colSpan = 6;
-        tr.append(td);
-        queueBody.append(tr);
-        return;
-      }
-
-      for (const change of changes) {
-        const tr = document.createElement("tr");
-        if (change.prNumber != null) tr.dataset.prNumber = String(change.prNumber);
-
-        // Change id + branch / PR + preview link.
-        const idCell = document.createElement("td");
-        const idStrong = document.createElement("strong");
-        idStrong.textContent = change.changeId || "—";
-        idCell.append(idStrong);
-        const meta = [];
-        if (change.branch) meta.push(change.branch);
-        if (change.prNumber != null) meta.push("PR #" + change.prNumber);
-        if (meta.length) idCell.append(subtle(meta.join(" · ")));
-        // Owner-facing "who did this" — accept takes priority over build (a
-        // candidate that's been accepted-to-preview is more meaningfully
-        // "acted on" than merely built). Reject never shows here: a rejected
-        // candidate is closed and has already left the open queue.
-        const actorRecord = change.actors && (change.actors.accept || change.actors.build);
-        if (actorRecord) {
-          const label = change.actors.accept ? "Accepted by " : "Built by ";
-          idCell.append(subtle(label + (actorRecord.name || actorRecord.email)));
-        }
-        // Prefer the synthesized friendly per-PR route (handles every state);
-        // fall back to any server-provided previewUrl for change-first rows
-        // that have no PR number yet.
-        const previewUrl = candidatePrUrl(change.prNumber) || change.previewUrl;
-        if (previewUrl) {
-          const preview = document.createElement("a");
-          preview.href = previewUrl;
-          preview.target = "_blank";
-          preview.rel = "noopener";
-          preview.textContent = "Open preview";
-          const wrap = document.createElement("span");
-          wrap.className = "subtle";
-          wrap.append(preview);
-          idCell.append(wrap);
-        }
-        tr.append(idCell);
-
-        // Reconcile status.
-        const statusCell = cell(
-          chip(change.status || "unknown", STATUS_CHIP[change.status] ?? "amber"),
-        );
-        if (change.lastError) statusCell.append(subtle(change.lastError));
-        tr.append(statusCell);
-
-        // Evidence / compliance verdict.
-        const checks = (change.evidence && change.evidence.checks) || [];
-        const failing = checks.filter((c) => c.status === "fail");
-        const promotable = Boolean(change.evidence && change.evidence.promotable);
-        const checksCell = cell(
-          promotable ? chip("Checks passed", "green") : chip("Checks blocked", "amber"),
-        );
-        if (failing.length) {
-          checksCell.append(subtle("Failing: " + failing.map((c) => c.label || c.id).join(", ")));
-        } else if (!checks.length) {
-          checksCell.append(subtle("No checks reported yet"));
-        }
-        tr.append(checksCell);
-
-        // Head sha + age.
-        const headCell = cell(shortSha(change.headSha));
-        headCell.classList.add("publish-mono");
-        tr.append(headCell);
-        tr.append(cell(age(change.updatedAt)));
-
-        // Actions.
-        const actions = document.createElement("td");
-        actions.className = "action publish-actions";
-
-        // rux5 — a synthetic not-built forge PR row (built:false / status
-        // "not-built") has NO built candidate: changeId is null, so the built-only
-        // actions below (Diff/Accept/Reject/Retire, all keyed on changeId) do not
-        // apply. Its one action is Build preview — materialize the PR's hosted
-        // preview on demand. Capability-gated: the button is SHOWN only to a
-        // ship-capable operator, and the server (buildGate) re-authorizes — the UI
-        // check is UX, not the real gate.
-        if (change.built === false || change.status === "not-built") {
-          if (canShip) {
-            const build = document.createElement("button");
-            build.type = "button";
-            build.className = "btn primary";
-            build.title = "Materialize this PR's hosted preview on demand (does not go live)";
-            // rux7: if a build for this PR is mid-flight, a poll re-render must
-            // reflect the spinner/disabled state (not a fresh clickable button
-            // that would let the operator double-submit). The in-flight closure
-            // re-renders on completion, clearing this.
-            if (change.prNumber != null && inflightBuilds.has(change.prNumber)) {
-              build.textContent = "Building…";
-              build.disabled = true;
-              build.dataset.building = "true";
-            } else {
-              build.textContent = "Build preview";
-            }
-            build.addEventListener("click", () => buildPreview(change, build));
-            actions.append(build);
-          } else {
-            actions.append(subtle("Owner/admin sign-in required to build"));
-          }
-          tr.append(actions);
-          queueBody.append(tr);
-          continue;
-        }
-
-        // rux7: while an integrate/reject/retire for this change is in flight,
-        // keep its mutating actions disabled across a poll re-render so the
-        // operator can't double-submit against a freshly-minted button.
-        const changeBusy = busyChanges.has(change.changeId);
-
-        // rux6 Review: expand the row into a single "review moment" pane —
-        // preview iframe + evidence chips + diff + Accept/Reject — so a reviewer
-        // never leaves the queue. Supersedes the standalone Diff button (the dg7
-        // diff now lives inside the pane, reusing renderDiff). The row's own
-        // Accept/Reject/Retire buttons below are unchanged.
-        const reviewBtn = document.createElement("button");
-        reviewBtn.type = "button";
-        reviewBtn.className = "btn";
-        reviewBtn.textContent = "Review";
-        reviewBtn.setAttribute("aria-expanded", "false");
-        reviewBtn.title = "Open one pane to preview, diff, and act on this change";
-        reviewBtn.addEventListener("click", () => toggleReview(change, reviewBtn, tr));
-        actions.append(reviewBtn);
-        // b11 SPLIT: the candidate-queue primary action is now ACCEPT TO PREVIEW
-        // (b08 integrate = advance the shared preview aggregate), NOT go-live.
-        // Integrate flips NO live channel, so it has NO paywall (entitled) gate —
-        // it holds only the ship-on-behalf capability floor. Going live is the
-        // aggregate card's Publish action, once the aggregate is green.
-        const accept = document.createElement("button");
-        accept.type = "button";
-        accept.className = "btn primary";
-        accept.textContent = "Accept to preview";
-        accept.disabled = !canShip || !change.mergeable || changeBusy;
-        accept.title = !canShip
-          ? "Requires an owner or admin sign-in"
-          : !change.mergeable
-            ? "This change is not ready to integrate"
-            : "Integrate this change into the preview aggregate (does not go live)";
-        accept.addEventListener("click", () => integrateCandidate(change, accept));
-        actions.append(accept);
-        const reject = document.createElement("button");
-        reject.type = "button";
-        reject.className = "btn";
-        reject.textContent = "Reject";
-        reject.disabled = !canShip || changeBusy;
-        reject.title = canShip ? "Close this change without publishing" : "Requires an owner or admin sign-in";
-        reject.addEventListener("click", () => rejectChange(change, reject));
-        actions.append(reject);
-
-        // U7 Retire/GC: evict this candidate's preview environment + version to
-        // reclaim space. DISTINCT from Reject — retire is reversible-by-rebuild
-        // (U1 build-on-demand + the U2 fallback page rematerialize it), so a
-        // retired PR degrades to "not built yet", not a dead 404.
-        const retire = document.createElement("button");
-        retire.type = "button";
-        retire.className = "btn";
-        retire.textContent = "Retire";
-        retire.disabled = !canShip || changeBusy;
-        retire.title = canShip
-          ? "Evict this preview to reclaim space — rebuildable on demand (not the same as Reject)"
-          : "Requires an owner or admin sign-in";
-        retire.addEventListener("click", () => retireChange(change, retire));
-        actions.append(retire);
-        tr.append(actions);
-
-        queueBody.append(tr);
-
-        // rux7: re-attach a diff pane that was open before this re-render. The
-        // pane node carries its already-fetched content; restore the expanded
-        // state + the "Hide diff" toggle affordance so a poll never collapses it.
-        const openDiff = openDiffNodes.get(change.changeId);
-        if (openDiff) {
-          tr.dataset.changeRowId = change.changeId;
-          diffBtn.textContent = "Hide diff";
-          tr.after(openDiff);
-        }
-      }
-    };
-
-    const renderCurrent = (current, shippedBy) => {
-      const versionEl = root.querySelector("[data-publish-live-version]");
-      const sourceEl = root.querySelector("[data-publish-live-source]");
-      const atEl = root.querySelector("[data-publish-live-at]");
-      const shippedByEl = root.querySelector("[data-publish-live-shipped-by]");
-      if (current && current.versionId) {
-        if (versionEl) versionEl.textContent = shortSha(current.versionId);
-        if (sourceEl) {
-          sourceEl.textContent =
-            (current.source === "commit" ? "Published from a change" : "Published version") +
-            (current.artifactCount != null ? " · " + current.artifactCount + " files" : "");
-        }
-        if (atEl) atEl.textContent = current.createdAt ? age(current.createdAt) : "—";
-        // Owner-facing "who did this" — see changeActorAttribution.ts. Absent for
-        // any version published before this attribution existed, which is honest,
-        // not a bug.
-        if (shippedByEl) {
-          shippedByEl.textContent = shippedBy ? "Shipped by " + (shippedBy.name || shippedBy.email) : "";
-        }
-      } else {
-        if (versionEl) versionEl.textContent = "Not live yet";
-        if (sourceEl) sourceEl.textContent = "Nothing has been published for this store";
-        if (atEl) atEl.textContent = "—";
-        if (shippedByEl) shippedByEl.textContent = "";
-      }
-    };
-
-    // ---- rux7: auto-refresh (poll GET /api/changes) ------------------------
-    // Keep the queue + aggregate live without a manual reload: poll on an
-    // interval that BACKS OFF while nothing changes (grow the delay up to a cap)
-    // and SNAPS BACK to the base the moment something does. Pause entirely while
-    // the tab is hidden (document.hidden) — a backgrounded admin tab must not
-    // hammer the endpoint — and refresh promptly on return. A poll re-render
-    // reuses renderQueue/renderAggregate, which already preserve open diff panes
-    // and in-flight actions (inflightBuilds / busyChanges / aggregatePublishing),
-    // and applyPrDeeplink stays a one-time effect (prDeeplinkResolved), so the
-    // ?pr scroll never re-fires on a tick.
-    const POLL_BASE_MS = 8000;
-    const POLL_MAX_MS = 60000;
-    const POLL_GROWTH = 1.6;
-    let pollDelay = POLL_BASE_MS;
-    let pollTimer = null;
-    let pollBusy = false;
-    let lastChangesSignature = null;
-
-    // A compact projection of everything the queue/aggregate render VISIBLY off,
-    // so a no-op poll (identical data) neither re-renders nor interrupts a text
-    // selection — it just backs off. Relative ages are intentionally excluded;
-    // they drift at most one backoff interval and refresh on any real change.
-    const changesSignature = (data) => {
-      const cur = data.current || {};
-      const agg = data.aggregate || {};
-      const run = agg.activeRun || agg.lastRun || {};
-      const plan = data.plan || {};
-      const rows = (Array.isArray(data.changes) ? data.changes : []).map((c) => [
-        c.changeId,
-        c.prNumber,
-        c.status,
-        c.headSha,
-        c.mergeable,
-        c.built,
-        c.lastError || null,
-        !!(c.evidence && c.evidence.promotable),
-        c.actors ? Object.keys(c.actors).sort().join(",") : "",
-      ]);
-      return JSON.stringify({
-        degraded: data.degraded === true,
-        current: [cur.versionId || null, cur.createdAt || null, cur.artifactCount ?? null],
-        shippedBy: (data.shippedBy && data.shippedBy.email) || null,
-        aggregate: [
-          agg.queueState || null,
-          agg.aggregateSha || null,
-          run.state || null,
-          run.finishedAt || null,
-          (agg.includedPrs || []).length,
-        ],
-        plan: [plan.ok === true, plan.pinnedSha || null, plan.artifactDigest || null, plan.alreadyShipped === true],
-        rows,
-      });
-    };
-
-    const clearPoll = () => {
-      if (pollTimer) {
-        clearTimeout(pollTimer);
-        pollTimer = null;
-      }
-    };
-
-    const schedulePoll = () => {
-      clearPoll();
-      if (document.hidden) return; // paused while hidden; visibilitychange resumes
-      pollTimer = setTimeout(runPoll, pollDelay);
-    };
-
-    // One poll tick: fetch, and only re-render when the projection actually
-    // changed. Returns an outcome the caller uses to size the next interval.
-    const pollChanges = async () => {
-      let res;
-      try {
-        res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
-      } catch {
-        return "error"; // network blip — keep the last good view, just back off
-      }
-      if (res.status === 401 || res.status === 403) return "auth"; // session gone
-      const data = await res.json().catch(() => null);
-      if (!res.ok || !data) return "error";
-      const sig = changesSignature(data);
-      if (sig === lastChangesSignature) return "unchanged";
-      lastChangesSignature = sig;
-      renderCurrent(data.current, data.shippedBy);
-      renderQueue(data);
-      applyPrDeeplink();
-      renderAggregate(data);
-      return "changed";
-    };
-
-    const runPoll = async () => {
-      pollTimer = null;
-      if (document.hidden || pollBusy) {
-        schedulePoll();
-        return;
-      }
-      pollBusy = true;
-      let outcome;
-      try {
-        outcome = await pollChanges();
-      } finally {
-        pollBusy = false;
-      }
-      if (outcome === "auth") {
-        clearPoll(); // stop polling — a sign-in is required; a manual refresh retries
-        return;
-      }
-      pollDelay =
-        outcome === "changed"
-          ? POLL_BASE_MS
-          : Math.min(POLL_MAX_MS, Math.round(pollDelay * POLL_GROWTH));
-      schedulePoll();
-    };
-
-    const loadQueue = async () => {
-      try {
-        const res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
-        if (res.status === 401 || res.status === 403) {
-          if (queueChip) queueChip.textContent = "Sign-in required";
-          if (degradedStrip) degradedStrip.hidden = true;
-          queueBody.textContent = "";
-          const tr = document.createElement("tr");
-          const td = cell(subtle("Sign in as a store owner or admin to view the publish queue."));
-          td.colSpan = 6;
-          tr.append(td);
-          queueBody.append(tr);
-          return;
-        }
-        const data = await res.json();
-        if (!res.ok) {
-          setStatus(statusEl, data.error || "Could not load the change queue (" + res.status + ")", "err");
-          return;
-        }
-        renderCurrent(data.current, data.shippedBy);
-        renderQueue(data);
-        applyPrDeeplink();
-        renderAggregate(data);
-        // rux7: this is fresh authoritative data — resync the poll clock so the
-        // next tick dedupes against it, and reset the cadence to responsive
-        // (a manual refresh / a just-completed action likely means more coming).
-        lastChangesSignature = changesSignature(data);
-        pollDelay = POLL_BASE_MS;
-        schedulePoll();
-      } catch {
-        setStatus(statusEl, "Could not load the change queue — network error", "err");
-      }
-    };
-
-    // ---- b11: the aggregate card + exact-digest Publish ---------------------
-    // Reads the aggregate/runs/plan projection GET /api/changes now returns
-    // (AggregateCardView + AggregateShipPlanView, built by aggregateView.ts):
-    //   - the aggregate's queueState + build sha + reviewed digest,
-    //   - the COMBINED EVIDENCE = the last integration run's honest state +
-    //     statusMessage (never re-derived),
-    //   - the included-PR batch,
-    //   - the b09 ship PLAN (pinned SHA/digest/PRs/rollback/paywall + run link),
-    //     shown inline so the confirm never has to POST to preview it.
-
-    const aggPanel = root.querySelector("[data-publish-aggregate]");
-    const AGG_STATE_CHIP = {
-      empty: "",
-      queued: "amber",
-      integrating: "blue",
-      green: "green",
-      red: "red",
-      shipped: "green",
-    };
-    // The plan we last rendered — the exact-digest guard the Publish POST sends
-    // back so a stale plan (queue moved / artifact changed) is refused, never
-    // shipped blind.
-    let currentPlan = null;
-
-    const runLink = (revHref, label) => {
-      if (!revHref) return null;
-      const a = document.createElement("a");
-      a.href = revHref;
-      a.target = "_blank";
-      a.rel = "noopener";
-      a.textContent = label || "Open build";
-      return a;
-    };
-
-    const renderAggregate = (data) => {
-      if (!aggPanel) return;
-      const agg = data.aggregate || null;
-      const plan = data.plan || null;
-      currentPlan = plan && plan.ok ? plan : null;
-
-      const chipEl = aggPanel.querySelector("[data-aggregate-chip]");
-      const shaEl = aggPanel.querySelector("[data-aggregate-sha]");
-      const runLinkEl = aggPanel.querySelector("[data-aggregate-run-link]");
-      const evEl = aggPanel.querySelector("[data-aggregate-evidence]");
-      const evDetailEl = aggPanel.querySelector("[data-aggregate-evidence-detail]");
-      const digestEl = aggPanel.querySelector("[data-aggregate-digest]");
-      const prsWrap = aggPanel.querySelector("[data-aggregate-prs-wrap]");
-      const prsList = aggPanel.querySelector("[data-aggregate-prs]");
-      const publishBtn = aggPanel.querySelector("[data-aggregate-publish]");
-      const publishDetail = aggPanel.querySelector("[data-aggregate-publish-detail]");
-
-      const state = (agg && agg.queueState) || "empty";
-      if (chipEl) {
-        chipEl.textContent = state;
-        chipEl.className = "chip " + (AGG_STATE_CHIP[state] || "");
-      }
-      if (shaEl) shaEl.textContent = agg && agg.aggregateSha ? shortSha(agg.aggregateSha) : "—";
-      if (runLinkEl) {
-        runLinkEl.textContent = "";
-        const link = agg && runLink(agg.revHref, "Open build");
-        if (link) runLinkEl.append(link);
-        else runLinkEl.append(document.createTextNode("The current green preview build for this store."));
-      }
-
-      // Combined evidence = the last (or in-flight) integration run's honest state.
-      const lastRun = agg && (agg.activeRun || agg.lastRun);
-      if (evEl) {
-        if (!lastRun) {
-          evEl.textContent = "No runs yet";
-        } else if (lastRun.state === "passed") {
-          evEl.textContent = "Passed";
-        } else if (lastRun.state === "failed") {
-          evEl.textContent = "Failed";
-        } else {
-          evEl.textContent = "Integrating…";
-        }
-      }
-      if (evDetailEl) {
-        evDetailEl.textContent = "";
-        if (lastRun) {
-          const parts = [];
-          if (lastRun.statusMessage) parts.push(lastRun.statusMessage);
-          else if (lastRun.state === "passed") parts.push("Combined evidence passed.");
-          else if (lastRun.state === "failed") parts.push("Combined evidence did not pass.");
-          if (lastRun.finishedAt) parts.push(age(lastRun.finishedAt));
-          evDetailEl.append(document.createTextNode(parts.join(" · ")));
-          const rl = runLink(lastRun.revHref, "Run build");
-          if (rl) {
-            evDetailEl.append(document.createTextNode(" · "));
-            evDetailEl.append(rl);
-          }
-        } else {
-          evDetailEl.append(document.createTextNode("The last integration run's verdict."));
-        }
-      }
-
-      // Reviewed digest: only known once the plan pins it (b09). Never fabricated.
-      if (digestEl) {
-        digestEl.textContent = currentPlan ? shortSha(currentPlan.artifactDigest.replace(/^sha256:/, "")) : "—";
-      }
-
-      // Included PRs.
-      const prs = (agg && agg.includedPrs) || [];
-      if (prsWrap) prsWrap.hidden = prs.length === 0;
-      if (prsList) {
-        prsList.textContent = "";
-        for (const pr of prs) {
-          const li = document.createElement("li");
-          const label = document.createElement("span");
-          label.textContent = pr.prNumber != null ? "PR #" + pr.prNumber : pr.changeId;
-          const sha = document.createElement("span");
-          sha.className = "publish-mono subtle";
-          sha.textContent = shortSha(pr.headSha);
-          li.append(label, sha);
-          prsList.append(li);
-        }
-      }
-
-      renderPlan(data.plan);
-
-      // The Publish button: enabled only for a shippable, paywall-cleared plan and
-      // a viewer who can ship. A paywalled plan is SHOWN (upsell), never hidden.
-      if (publishBtn) {
-        const shippable = Boolean(currentPlan);
-        const paywalled = currentPlan && currentPlan.paywall && !currentPlan.paywall.allowed;
-        // rux7: never re-enable the Publish button while its POST is in flight —
-        // a poll refresh landing mid-publish must not open a double-submit.
-        publishBtn.disabled =
-          aggregatePublishing || !canShip || !shippable || paywalled || currentPlan.alreadyShipped;
-        publishBtn.title = !canShip
-          ? "Requires an owner or admin sign-in"
-          : !shippable
-            ? "The aggregate is not green / has no passed run to publish yet"
-            : paywalled
-              ? "Publishing to your live store is part of the paid plan"
-              : currentPlan.alreadyShipped
-                ? "This reviewed build is already live"
-                : "Publish the exact reviewed digest to your live store";
-      }
-      if (publishDetail) {
-        if (currentPlan && currentPlan.alreadyShipped) {
-          publishDetail.textContent =
-            "This reviewed build (" + shortSha(currentPlan.pinnedSha) + ") is already live. ";
-          const view = document.createElement("a");
-          view.href = ds.liveHref || "/";
-          view.target = "_blank";
-          view.rel = "noopener";
-          view.textContent = "View your live store →";
-          publishDetail.append(view);
-        } else if (currentPlan) {
-          publishDetail.textContent =
-            "Publishes the exact reviewed digest " + shortSha(currentPlan.artifactDigest.replace(/^sha256:/, "")) +
-            " (build " + shortSha(currentPlan.pinnedSha) + ") — no rebuild.";
-        } else {
-          publishDetail.textContent =
-            "Publishes the exact reviewed digest — no rebuild. Available once the aggregate is green and its integration run passed.";
-        }
-      }
-    };
-
-    const renderPlan = (plan) => {
-      const planBox = aggPanel && aggPanel.querySelector("[data-aggregate-plan]");
-      if (!planBox) return;
-      const chipEl = planBox.querySelector("[data-aggregate-plan-chip]");
-      const grid = planBox.querySelector("[data-aggregate-plan-grid]");
-      const note = planBox.querySelector("[data-aggregate-plan-note]");
-      if (grid) grid.textContent = "";
-
-      // No plan at all (degenerate: no store bound) — hide the box.
-      if (!plan) {
-        planBox.hidden = true;
-        return;
-      }
-      planBox.hidden = false;
-
-      if (!plan.ok) {
-        // An honest refusal — show WHY it isn't shippable, never a fake plan.
-        if (chipEl) {
-          chipEl.textContent = "Not shippable";
-          chipEl.className = "chip amber";
-        }
-        if (note) note.textContent = plan.message || ("Not shippable (" + (plan.reason || "refused") + ").");
-        return;
-      }
-
-      const paywalled = plan.paywall && !plan.paywall.allowed;
-      if (chipEl) {
-        chipEl.textContent = plan.alreadyShipped ? "Already live" : paywalled ? "Upgrade required" : "Ready to publish";
-        chipEl.className = "chip " + (plan.alreadyShipped ? "green" : paywalled ? "amber" : "green");
-      }
-
-      const row = (term, value, mono) => {
-        const dt = document.createElement("dt");
-        dt.textContent = term;
-        const dd = document.createElement("dd");
-        if (value instanceof Node) dd.append(value);
-        else {
-          dd.textContent = value;
-          if (mono) dd.className = "publish-mono";
-        }
-        grid.append(dt, dd);
-      };
-
-      row("Reviewed build", shortSha(plan.pinnedSha), true);
-      row("Reviewed digest", shortSha(plan.artifactDigest.replace(/^sha256:/, "")), true);
-      row("Included changes", String((plan.includedPrs || []).length) + " change" + ((plan.includedPrs || []).length === 1 ? "" : "s"));
-      const runCell = document.createElement("span");
-      runCell.append(document.createTextNode(plan.integrationRunId));
-      const planRunLink = runLink(plan.pinnedRevHref, "Open build");
-      if (planRunLink) {
-        runCell.append(document.createTextNode(" · "));
-        runCell.append(planRunLink);
-      }
-      row("Integration run", runCell);
-      if (plan.rollbackTarget) {
-        row("Rollback to", shortSha(plan.rollbackTarget.aggregateSha), true);
-      } else {
-        row("Rollback to", "None (first publish)");
-      }
-      row("Subscription", plan.paywall && plan.paywall.allowed ? "Enabled" : "Not enabled");
-
-      if (note) {
-        note.textContent = paywalled
-          ? (plan.paywall.message || "Publishing to your live store requires the paid plan.")
-          : plan.alreadyShipped
-            ? "This reviewed build is already live — nothing to publish."
-            : "Publish sends the exact reviewed digest above to your live store. No rebuild.";
-      }
-    };
-
-    // The exact-digest Publish (b10 ship = b09 orchestrator.ship). Confirms the
-    // pinned plan, then POSTs { confirmGoLive, expectedAggregateSha,
-    // expectedArtifactDigest } — the reviewed-digest guard: a stale plan (queue
-    // moved / artifact changed) is refused by the server, never shipped blind.
-    // ── Publish-live ceremony (shipoff) ──────────────────────────────────────
-    // The go-live counterpart of the accept liftoff below (shares its shell,
-    // styles, planRow + celebrate helpers — referenced at runtime, defined a few
-    // sections down). One honest in-flight state: ship is a single POST that
-    // promotes the pinned digest, so no staged theater — just plan → publishing →
-    // outcome with a real "View your live store" link.
-    const shipoff = root.querySelector("[data-shipoff]");
-    const shipoffCard = shipoff && shipoff.querySelector(".liftoff-card");
-    const shipoffEls = shipoff
-      ? {
-          plan: shipoff.querySelector("[data-shipoff-plan]"),
-          flight: shipoff.querySelector("[data-shipoff-flight]"),
-          outcome: shipoff.querySelector("[data-shipoff-outcome]"),
-          grid: shipoff.querySelector("[data-shipoff-grid]"),
-          proceed: shipoff.querySelector("[data-shipoff-proceed]"),
-          cancel: shipoff.querySelector("[data-shipoff-cancel]"),
-          live: shipoff.querySelector("[data-shipoff-live]"),
-          elapsed: shipoff.querySelector("[data-shipoff-elapsed]"),
-          seal: shipoff.querySelector("[data-shipoff-seal]"),
-          outcomeTitle: shipoff.querySelector("[data-shipoff-outcome-title]"),
-          outcomeDetail: shipoff.querySelector("[data-shipoff-outcome-detail]"),
-          view: shipoff.querySelector("[data-shipoff-view]"),
-          done: shipoff.querySelector("[data-shipoff-done]"),
-          confetti: shipoff.querySelector("[data-shipoff-confetti]"),
-        }
-      : null;
-    let shipoffTimer = null;
-    const closeShipoff = () => {
-      if (shipoffTimer) { clearInterval(shipoffTimer); shipoffTimer = null; }
-      if (shipoff) shipoff.hidden = true;
-      if (shipoffEls) shipoffEls.confetti.textContent = "";
-    };
-    const showShipoffPhase = (phase) => {
-      if (!shipoffEls) return;
-      shipoffEls.plan.hidden = phase !== "plan";
-      shipoffEls.flight.hidden = phase !== "flight";
-      shipoffEls.outcome.hidden = phase !== "outcome";
-      if (shipoffCard) shipoffCard.dataset.mode = phase;
-    };
-
-    const buildPublishPlanText = (plan) => {
-      const lines = ["Publish plan (exact reviewed digest — no rebuild):"];
-      lines.push("  tenant:   " + (appDomain || repo));
-      lines.push("  build:    " + shortSha(plan.pinnedSha));
-      lines.push("  digest:   " + plan.artifactDigest);
-      lines.push("  changes:  " + (plan.includedPrs || []).length + " included");
-      if (plan.rollbackTarget) lines.push("  rollback: " + shortSha(plan.rollbackTarget.aggregateSha));
-      lines.push("  effect:   publish this exact digest to your LIVE store.");
-      return lines.join("\n");
-    };
-
-    const shortDigest = (digest) => {
-      const d = String(digest || "").replace(/^sha256:/, "");
-      return d ? "sha256:" + d.slice(0, 12) + "…" : "—";
-    };
-
-    const publishAggregate = (button) => {
-      if (!currentPlan) return;
-      const plan = currentPlan;
-      if (!shipoff || !shipoffEls) {
-        // No-markup fallback only — the ceremony IS the confirm now.
-        if (!window.confirm(buildPublishPlanText(plan) + "\n\nPublish live?")) return;
-        runShip(plan, button);
-        return;
-      }
-      shipoffEls.grid.textContent = "";
-      shipoffEls.grid.append(
-        ...planRow("Store", appDomain || repo),
-        ...planRow("Build", shortSha(plan.pinnedSha), true),
-        ...planRow("Digest", shortDigest(plan.artifactDigest), true),
-        ...planRow("Changes", (plan.includedPrs || []).length + " included"),
-        ...(plan.rollbackTarget
-          ? planRow("Rollback to", shortSha(plan.rollbackTarget.aggregateSha), true)
-          : []),
-      );
-      showShipoffPhase("plan");
-      shipoff.hidden = false;
-      shipoffEls.proceed.focus();
-      shipoffEls.cancel.onclick = () => closeShipoff();
-      shipoffEls.done.onclick = () => closeShipoff();
-      shipoffEls.proceed.onclick = () => runShip(plan, button);
-    };
-
-    const runShip = async (plan, button) => {
-      if (button) button.disabled = true;
-      aggregatePublishing = true; // rux7: hold the button disabled across polls
-      setStatus(aggStatusEl, "Publishing the reviewed build (" + shortSha(plan.pinnedSha) + ") live…");
-      const startedAt = Date.now();
-      if (shipoffEls) {
-        showShipoffPhase("flight");
-        shipoffTimer = setInterval(() => {
-          const s = Math.floor((Date.now() - startedAt) / 1000);
-          shipoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
-        }, 1000);
-      }
-      const outcome = (state, title, detail, showView) => {
-        if (!shipoffEls) return;
-        if (shipoffTimer) { clearInterval(shipoffTimer); shipoffTimer = null; }
-        shipoffEls.seal.dataset.state = state;
-        shipoffEls.outcomeTitle.textContent = title;
-        shipoffEls.outcomeDetail.textContent = detail;
-        shipoffEls.view.hidden = !showView;
-        if (showView) shipoffEls.view.href = ds.liveHref || "/";
-        showShipoffPhase("outcome");
-        shipoffEls.done.focus();
-        if (state === "ok") celebrate(shipoffEls.confetti);
-      };
-      try {
-        const res = await fetch(ds.shipEndpoint, {
-          method: "POST",
-          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
-          body: JSON.stringify({
-            aggregateId: plan.aggregateId,
-            // The HUMAN go-live gate + the reviewed-digest guards (b09 ship input).
-            confirmGoLive: true,
-            expectedAggregateSha: plan.pinnedSha,
-            expectedArtifactDigest: plan.artifactDigest,
-          }),
-        });
-        const data = await res.json().catch(() => ({}));
-        // b09 AggregateShipResult: the ONLY live claim is state === "shipped".
-        if (data.state === "shipped") {
-          setStatus(
-            aggStatusEl,
-            "Published live · build " + shortSha(data.pinnedSha) + " (receipt " + (data.receiptId || "—") + ").",
-            "ok",
-          );
-          outcome(
-            "ok",
-            "Your store is live",
-            "Build " + shortSha(data.pinnedSha) + " — the exact digest you reviewed — is now serving" +
-              (data.receiptId ? " (receipt " + data.receiptId + ")." : "."),
-            true,
-          );
-        } else {
-          let message;
-          if (data.state === "promote_failed" || data.state === "record_failed") {
-            // Honest partial-failure truth — recoverable, never a false "shipped".
-            message = data.message || "Publish did not complete (" + data.state + "). Retry.";
-          } else if (data.reason === "paywall") {
-            message = data.message || "Publishing to your live store is part of the paid plan.";
-          } else {
-            message = data.message || data.error || "Publish refused (" + (data.reason || res.status) + ")";
-          }
-          setStatus(aggStatusEl, message, "err");
-          outcome("err", "Publish did not complete", message + " Your live store is unchanged.", false);
-        }
-      } catch {
-        setStatus(aggStatusEl, "Publish failed — network error", "err");
-        outcome(
-          "err",
-          "Publish did not complete",
-          "Network error mid-publish — refresh to see the honest state; your live store serves the last published version.",
-          false,
-        );
-      } finally {
-        aggregatePublishing = false;
-        if (button) button.disabled = false;
-        loadQueue();
-        loadVersions();
-      }
-    };
-
-    const aggStatusEl = aggPanel && aggPanel.querySelector("[data-aggregate-status]");
-    aggPanel
-      ?.querySelector("[data-aggregate-publish]")
-      ?.addEventListener("click", (event) => publishAggregate(event.currentTarget));
-
-    // ── Accept-to-preview LIFTOFF ─────────────────────────────────────────────
-    // The plan confirm + live integration flight + outcome ceremony (replaces
-    // the old window.confirm plan popup). Same b11 contract as before: accept =
-    // `POST /api/changes/integrate` (b08) → integrate into the protected
-    // `preview` aggregate, rebuild + combined-evidence it (b05). Flips NO live
-    // channel — going live is the aggregate card's Publish.
-    //
-    // HONESTY RULE for the stage rail: a stage only advances on a REAL signal —
-    // the outcome POST resolving, or GET /api/changes polling showing the
-    // candidate inside `aggregate.includedPrs` (merge landed) / an `activeRun`
-    // (build+evidence running, statusMessage relayed verbatim). No timers ever
-    // fake progress.
-    const liftoff = root.querySelector("[data-liftoff]");
-    const liftoffCard = liftoff && liftoff.querySelector(".liftoff-card");
-    const liftoffEls = liftoff
-      ? {
-          plan: liftoff.querySelector("[data-liftoff-plan]"),
-          flight: liftoff.querySelector("[data-liftoff-flight]"),
-          outcome: liftoff.querySelector("[data-liftoff-outcome]"),
-          title: liftoff.querySelector("[data-liftoff-title]"),
-          grid: liftoff.querySelector("[data-liftoff-grid]"),
-          proceed: liftoff.querySelector("[data-liftoff-proceed]"),
-          cancel: liftoff.querySelector("[data-liftoff-cancel]"),
-          flightTitle: liftoff.querySelector("[data-liftoff-flight-title]"),
-          live: liftoff.querySelector("[data-liftoff-live]"),
-          elapsed: liftoff.querySelector("[data-liftoff-elapsed]"),
-          hide: liftoff.querySelector("[data-liftoff-hide]"),
-          seal: liftoff.querySelector("[data-liftoff-seal]"),
-          outcomeTitle: liftoff.querySelector("[data-liftoff-outcome-title]"),
-          outcomeDetail: liftoff.querySelector("[data-liftoff-outcome-detail]"),
-          review: liftoff.querySelector("[data-liftoff-review]"),
-          done: liftoff.querySelector("[data-liftoff-done]"),
-          confetti: liftoff.querySelector("[data-liftoff-confetti]"),
-        }
-      : null;
-
-    const liftoffStage = (name) =>
-      liftoff && liftoff.querySelector('[data-liftoff-stage="' + name + '"]');
-    const LIFTOFF_STAGES = ["merge", "build", "evidence", "green"];
-    const setStage = (name, state) => {
-      const el = liftoffStage(name);
-      if (el) el.dataset.state = state; // pending | active | done | fail
-    };
-    // Advance the rail so everything before `name` is done and `name` is active.
-    const railTo = (name) => {
-      const idx = LIFTOFF_STAGES.indexOf(name);
-      LIFTOFF_STAGES.forEach((s, i) => {
-        const el = liftoffStage(s);
-        const cur = el && el.dataset.state;
-        if (cur === "fail") return; // never un-fail
-        setStage(s, i < idx ? "done" : i === idx ? "active" : "pending");
-      });
-    };
-
-    let liftoffTimer = null;
-    let liftoffPoll = null;
-    let liftoffOpenedFrom = null;
-    const stopLiftoffLoops = () => {
-      if (liftoffTimer) { clearInterval(liftoffTimer); liftoffTimer = null; }
-      if (liftoffPoll) { clearInterval(liftoffPoll); liftoffPoll = null; }
-    };
-    const closeLiftoff = () => {
-      stopLiftoffLoops();
-      if (liftoff) liftoff.hidden = true;
-      if (liftoffEls) liftoffEls.confetti.textContent = "";
-      if (liftoffOpenedFrom && document.contains(liftoffOpenedFrom)) liftoffOpenedFrom.focus();
-      liftoffOpenedFrom = null;
-    };
-    const showPhase = (phase) => {
-      if (!liftoffEls) return;
-      liftoffEls.plan.hidden = phase !== "plan";
-      liftoffEls.flight.hidden = phase !== "flight";
-      liftoffEls.outcome.hidden = phase !== "outcome";
-      if (liftoffCard) liftoffCard.dataset.mode = phase;
-    };
-
-    const planRow = (dt, dd, mono) => {
-      const t = document.createElement("dt");
-      t.textContent = dt;
-      const d = document.createElement("dd");
-      d.textContent = dd;
-      if (mono) d.className = "publish-mono";
-      return [t, d];
-    };
-
-    const celebrate = (container) => {
-      if (!container) return;
-      if (window.matchMedia && window.matchMedia("(prefers-reduced-motion: reduce)").matches) return;
-      const colors = ["#0f9d8f", "#25b8a8", "#f4b942", "#5b8def", "#e2634f"];
-      for (let i = 0; i < 42; i++) {
-        const p = document.createElement("i");
-        p.style.left = Math.random() * 100 + "%";
-        p.style.background = colors[i % colors.length];
-        p.style.animationDelay = Math.random() * 0.35 + "s";
-        p.style.animationDuration = 0.9 + Math.random() * 0.9 + "s";
-        p.style.setProperty("--liftoff-drift", (Math.random() * 160 - 80).toFixed(0) + "px");
-        p.style.setProperty("--liftoff-spin", (Math.random() * 640 - 320).toFixed(0) + "deg");
-        container.append(p);
-      }
-      setTimeout(() => { container.textContent = ""; }, 2400);
-    };
-
-    // The live poll during flight: reflect the server's REAL progress.
-    const startFlightPoll = (change, preFlightSha) => {
-      let inAggregate = false;
-      liftoffPoll = setInterval(async () => {
-        try {
-          const res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
-          if (!res.ok) return;
-          const data = await res.json();
-          const agg = data.aggregate || {};
-          const included = (agg.includedPrs || []).some((p) => p.changeId === change.changeId);
-          const shaMoved = agg.aggregateSha && agg.aggregateSha !== preFlightSha;
-          const run = agg.activeRun || null;
-          if (!inAggregate && (included || shaMoved)) {
-            inAggregate = true;
-            railTo("build");
-            if (liftoffEls) liftoffEls.live.textContent =
-              "Merged into preview — rebuilding the combined aggregate…";
-          }
-          if (run) {
-            railTo("evidence");
-            if (liftoffEls) liftoffEls.live.textContent =
-              run.statusMessage || "Combined evidence is running…";
-          }
-        } catch { /* polling is best-effort; the POST outcome is authoritative */ }
-      }, 2500);
-    };
-
-    const openLiftoff = (change, button) => {
-      if (!liftoff || !liftoffEls) return false;
-      liftoffOpenedFrom = button || null;
-      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
-      liftoffEls.title.textContent = "Integrate " + target + " into preview";
-      liftoffEls.grid.textContent = "";
-      liftoffEls.grid.append(
-        ...planRow("Store", appDomain || repo),
-        ...(change.prNumber != null ? planRow("Pull request", "#" + change.prNumber) : []),
-        ...planRow("Change", change.changeId, true),
-        ...(change.headSha ? planRow("Head", shortSha(change.headSha), true) : []),
-      );
-      LIFTOFF_STAGES.forEach((s) => setStage(s, "pending"));
-      liftoffEls.live.textContent = "Working…";
-      liftoffEls.elapsed.textContent = "0:00";
-      showPhase("plan");
-      liftoff.hidden = false;
-      liftoffEls.proceed.focus();
-
-      liftoffEls.cancel.onclick = () => closeLiftoff();
-      liftoffEls.done.onclick = () => closeLiftoff();
-      liftoffEls.hide.onclick = () => { liftoff.hidden = true; }; // flight keeps running
-      liftoffEls.proceed.onclick = () => runIntegration(change, button);
-      return true;
-    };
-
-    // Esc: close in plan/outcome; during flight just hide (the POST keeps going).
-    // Handles BOTH ceremonies (accept liftoff + publish shipoff).
-    document.addEventListener("keydown", (ev) => {
-      if (ev.key !== "Escape") return;
-      if (liftoff && !liftoff.hidden) {
-        const mode = liftoffCard && liftoffCard.dataset.mode;
-        if (mode === "flight") liftoff.hidden = true;
-        else closeLiftoff();
-      }
-      if (shipoff && !shipoff.hidden) {
-        const mode = shipoffCard && shipoffCard.dataset.mode;
-        if (mode === "flight") shipoff.hidden = true;
-        else closeShipoff();
-      }
-    });
-
-    // b08 integrate returns an IntegrateOutcome — { ok, queueState, runState,
-    // aggregateSha, pointerMoved, statusMessage, reason? } — NEVER a bare
-    // merged:true. Render it honestly: green advances the aggregate; red left it
-    // exactly where it was and names the failing stage.
-    const runIntegration = async (change, button) => {
-      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
-      if (button) button.disabled = true;
-      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
-      setStatus(statusEl, "Integrating " + change.changeId + " into preview…");
-      const startedAt = Date.now();
-      let preFlightSha = null;
-      if (liftoffEls) {
-        showPhase("flight");
-        liftoffEls.flightTitle.textContent = "Integrating " + target + " into preview";
-        railTo("merge");
-        liftoffEls.live.textContent = "Squash-merging the candidate into preview…";
-        liftoffTimer = setInterval(() => {
-          const s = Math.floor((Date.now() - startedAt) / 1000);
-          liftoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
-        }, 1000);
-      }
-      try {
-        // Snapshot the pre-flight aggregate sha so the poll can detect the merge
-        // landing (sha moved) even before includedPrs reflects it.
-        try {
-          const pre = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
-          if (pre.ok) preFlightSha = ((await pre.json()).aggregate || {}).aggregateSha || null;
-        } catch { /* best-effort */ }
-        startFlightPoll(change, preFlightSha);
-
-        const res = await fetch(ds.integrateEndpoint, {
-          method: "POST",
-          headers: {
-            "content-type": "application/json",
-            // Mirror of the server-side capability model (UX): the server
-            // re-derives capability and stays authoritative.
-            "x-tot-capability": "ship-on-behalf",
-          },
-          body: JSON.stringify({
-            repo,
-            changeId: change.changeId,
-            prNumber: change.prNumber ?? undefined,
-            expectedHeadSha: change.headSha || undefined,
-          }),
-        });
-        const data = await res.json().catch(() => ({}));
-        stopLiftoffLoops();
-        if (res.ok && data.ok) {
-          setStatus(
-            statusEl,
-            "Integrated " + change.changeId + " — preview aggregate is green (" +
-              shortSha(data.aggregateSha) + "). Review the aggregate, then Publish to go live.",
-            "ok",
-          );
-          if (liftoffEls) {
-            LIFTOFF_STAGES.forEach((s) => setStage(s, "done"));
-            liftoffEls.seal.dataset.state = "ok";
-            liftoffEls.outcomeTitle.textContent = "The preview aggregate is green";
-            liftoffEls.outcomeDetail.textContent =
-              target + " is in. Aggregate build " + shortSha(data.aggregateSha) +
-              " passed its combined evidence — this exact build is what you review, and what " +
-              "Publish would take live. Nothing is live yet.";
-            if (data.aggregateSha) {
-              liftoffEls.review.href =
-                "/preview/" + encodeURIComponent(appDomain) + "/rev/" + data.aggregateSha + "/";
-              liftoffEls.review.hidden = false;
-            } else {
-              liftoffEls.review.hidden = true;
-            }
-            if (liftoff.hidden) liftoff.hidden = false; // surface the payoff even if backgrounded
-            showPhase("outcome");
-            liftoffEls.done.focus();
-            celebrate(liftoffEls.confetti);
-          }
-        } else {
-          let message;
-          let failStage = "merge";
-          if (res.ok && data.queueState === "red") {
-            // The queue ran but the aggregate did not go green — the candidate did
-            // NOT advance the shippable set. Name the honest failing stage.
-            failStage = "evidence";
-            message =
-              "Integration of " + change.changeId + " failed (" + (data.reason || "red") + "): " +
-              (data.statusMessage || "the aggregate did not pass its combined evidence.") +
-              " The aggregate is unchanged.";
-          } else if (data.reason === "not_preview_base") {
-            message =
-              "Not integrated: " + change.changeId + " does not target the preview branch " +
-              "(base is not \"preview\"). " + (data.statusMessage || "");
-          } else {
-            message = data.statusMessage || data.error || "Integrate failed (" + res.status + ")";
-          }
-          setStatus(statusEl, message, "err");
-          if (liftoffEls) {
-            setStage(failStage, "fail");
-            liftoffEls.seal.dataset.state = "err";
-            liftoffEls.outcomeTitle.textContent = "Integration did not land";
-            liftoffEls.outcomeDetail.textContent = message;
-            liftoffEls.review.hidden = true;
-            if (liftoff.hidden) liftoff.hidden = false;
-            showPhase("outcome");
-            liftoffEls.done.focus();
-          }
-        }
-      } catch {
-        stopLiftoffLoops();
-        setStatus(statusEl, "Integrate failed — network error", "err");
-        if (liftoffEls) {
-          liftoffEls.seal.dataset.state = "err";
-          liftoffEls.outcomeTitle.textContent = "Integration did not land";
-          liftoffEls.outcomeDetail.textContent =
-            "Network error mid-flight — refresh the queue to see the aggregate's honest state.";
-          liftoffEls.review.hidden = true;
-          if (liftoff.hidden) liftoff.hidden = false;
-          showPhase("outcome");
-        }
-      } finally {
-        busyChanges.delete(change.changeId);
-        if (button) button.disabled = false;
-        loadQueue();
-      }
-    };
-
-    const integrateCandidate = (change, button) => {
-      // The liftoff dialog IS the plan confirm now; window.confirm stays only as
-      // the no-dialog fallback (markup missing = fail open to the old popup).
-      if (openLiftoff(change, button)) return;
-      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
-      const plan =
-        "Accept-to-preview plan:\n  tenant:    " + (appDomain || repo) +
-        (change.prNumber != null ? "\n  PR:        #" + change.prNumber : "") +
-        "\n  change id: " + change.changeId +
-        (change.headSha ? "\n  head sha:  " + shortSha(change.headSha) : "") +
-        "\n  effect:    integrate " + target + " into the preview aggregate, then rebuild + " +
-        "re-evidence it. Does NOT go live — publish the reviewed build separately.";
-      if (!window.confirm(plan + "\n\nProceed?")) return;
-      runIntegration(change, button);
-    };
-
-    const rejectChange = async (change, button) => {
-      const reason = window.prompt(
-        "Reject " + change.changeId + " — add a short note for the submitter:",
-      );
-      if (reason == null) return;
-      if (!reason.trim()) {
-        setStatus(statusEl, "A reject note is required.", "err");
-        return;
-      }
-      button.disabled = true;
-      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
-      setStatus(statusEl, "Rejecting " + change.changeId + "…");
-      try {
-        const res = await fetch(
-          ds.changesEndpoint + "/" + encodeURIComponent(change.changeId) + "/reject",
-          {
-            method: "POST",
-            headers: {
-              "content-type": "application/json",
-              "x-tot-capability": "ship-on-behalf",
-            },
-            body: JSON.stringify({ repo, reason: reason.trim() }),
-          },
-        );
-        const data = await res.json().catch(() => ({}));
-        if (res.ok) {
-          setStatus(statusEl, "Change " + change.changeId + " rejected.", "ok");
-        } else {
-          setStatus(statusEl, data.error || "Reject failed (" + res.status + ")", "err");
-        }
-      } catch {
-        setStatus(statusEl, "Reject failed — network error", "err");
-      } finally {
-        busyChanges.delete(change.changeId);
-        button.disabled = false;
-        loadQueue();
-      }
-    };
-
-    // U7 — retire/GC. Mirror of the accept plan affordance (decision
-    // operator-verb-and-hosting-model): state EXACTLY what retire does — evict the
-    // candidate's preview environment + immutable version — and that it is
-    // REBUILDABLE (degrades to "not built yet", not a 404), so an operator can't
-    // confuse it with Reject. Same shape as `tot retire`'s CLI plan for parity.
-    const buildRetirePlan = (change) => {
-      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
-      const lines = ["Retire plan:", "  tenant:    " + (appDomain || repo)];
-      if (change.prNumber != null) lines.push("  PR:        #" + change.prNumber);
-      lines.push("  change id: " + change.changeId);
-      if (change.headSha) lines.push("  head sha:  " + shortSha(change.headSha));
-      lines.push(
-        "  effect:    evict " + target + "'s preview environment + version to reclaim space.",
-      );
-      lines.push(
-        "  rebuild:   REVERSIBLE — rebuild it any time (this is NOT Reject; the change stays open).",
-      );
-      return lines.join("\n");
-    };
-
-    const retireChange = async (change, button) => {
-      if (!window.confirm(buildRetirePlan(change) + "\n\nProceed?")) return;
-      button.disabled = true;
-      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
-      setStatus(statusEl, "Retiring " + change.changeId + "…");
-      try {
-        const res = await fetch(ds.retireEndpoint, {
-          method: "POST",
-          headers: {
-            "content-type": "application/json",
-            // Mirror of the server-side capability model (UX); the server
-            // re-derives capability and stays authoritative.
-            "x-tot-capability": "ship-on-behalf",
-          },
-          body: JSON.stringify({
-            changeId: change.changeId,
-            pr: change.prNumber ?? undefined,
-          }),
-        });
-        const data = await res.json().catch(() => ({}));
-        if (res.ok && data.ok) {
-          setStatus(
-            statusEl,
-            data.evicted
-              ? "Retired " + change.changeId + " — the preview was evicted (rebuildable on demand)."
-              : "Retire " + change.changeId + ": nothing to evict (already retired).",
-            "ok",
-          );
-        } else {
-          setStatus(statusEl, data.error || "Retire failed (" + res.status + ")", "err");
-        }
-      } catch {
-        setStatus(statusEl, "Retire failed — network error", "err");
-      } finally {
-        busyChanges.delete(change.changeId);
-        button.disabled = false;
-        loadQueue();
-      }
-    };
-
-    // ---- rux5: build-on-demand for a synthetic not-built PR ------------------
-    // Mirror of the integrate/retire plan affordances: state EXACTLY what build
-    // does — materialize this PR's hosted preview at its forge head — and that it
-    // is INERT (flips no live channel). POSTs { pr, headSha?, baseSha? }; the row
-    // already carries the head sha GET /api/changes resolved via forge PR-read, and
-    // the server re-resolves it authoritatively when the body omits it. Shows an
-    // in-progress state (disabled + "Building…") while the build runs, then reloads
-    // the queue so the freshly-built PR reappears as a built candidate.
-
-    const buildPreviewPlan = (change) => {
-      const lines = ["Build preview plan:", "  tenant:   " + (appDomain || repo)];
-      lines.push("  PR:       #" + change.prNumber);
-      if (change.headSha) lines.push("  head sha: " + shortSha(change.headSha));
-      lines.push(
-        "  effect:   materialize this PR's hosted preview at its head — INERT " +
-          "(does NOT go live).",
-      );
-      return lines.join("\n");
-    };
-
-    const buildPreview = async (change, button) => {
-      const label = "PR #" + change.prNumber;
-      if (!window.confirm(buildPreviewPlan(change) + "\n\nBuild the preview now?")) return;
-      button.disabled = true;
-      const originalText = button.textContent;
-      button.textContent = "Building…";
-      button.dataset.building = "true";
-      // rux7: record the in-flight build so a poll re-render preserves the
-      // spinner/disabled state on the freshly-rendered button (cleared in finally).
-      if (change.prNumber != null) inflightBuilds.add(change.prNumber);
-      setStatus(statusEl, "Building preview for " + label + "…");
-      try {
-        const res = await fetch(ds.buildEndpoint, {
-          method: "POST",
-          headers: {
-            "content-type": "application/json",
-            // Mirror of the server-side capability model (UX); the server
-            // re-derives capability (buildGate) and stays authoritative.
-            "x-tot-capability": "ship-on-behalf",
-          },
-          body: JSON.stringify({
-            pr: change.prNumber,
-            headSha: change.headSha || undefined,
-            baseSha: change.baseSha || undefined,
-          }),
-        });
-        const data = await res.json().catch(() => ({}));
-        if (res.ok && data.ok) {
-          setStatus(
-            statusEl,
-            "Built preview for " + label +
-              " — it now appears as a built change in the queue.",
-            "ok",
-          );
-        } else if (data && data.ok === false) {
-          // reconcileCandidate returned a blocked/failed candidate (e.g. a safety
-          // finding with no override) — the honest reason, never a false success.
-          setStatus(
-            statusEl,
-            "Build did not complete for " + label + ": " +
-              ((data.errors && data.errors.join("; ")) || data.error || "blocked"),
-            "err",
-          );
-        } else {
-          setStatus(statusEl, data.error || "Build failed (" + res.status + ")", "err");
-        }
-      } catch {
-        setStatus(statusEl, "Build failed — network error", "err");
-      } finally {
-        if (change.prNumber != null) inflightBuilds.delete(change.prNumber);
-        button.disabled = false;
-        button.textContent = originalText;
-        delete button.dataset.building;
-        loadQueue();
-      }
-    };
-
-    // ---- rux6: unified review pane -----------------------------------------
-    // "One review moment": expanding a candidate row reveals a single pane with
-    // the live preview (iframed SAME-ORIGIN — the /preview/<tenant>/pr/<N> route
-    // serves `frame-ancestors 'self'` + `X-Frame-Options: SAMEORIGIN`, so a
-    // same-origin admin embed is permitted; a cross-origin embed is refused,
-    // which is why the pane also always offers an "Open in new tab" link), the
-    // evidence chips the row already carries (change.evidence), the dg7 diff
-    // (reusing renderDiff below — GET /api/changes/<id>/diff, which never invents
-    // a diff for a non-renderable candidate), and the SAME Accept-to-preview /
-    // Reject actions. The reviewer never leaves the queue to review and act; the
-    // server stays authoritative for every action (this is UI consolidation only).
-
-    const diffBase = ds.diffEndpointBase;
-
-    const reviewRowFor = (tr) => {
-      const next = tr.nextElementSibling;
-      return next && next.dataset && next.dataset.publishReviewRow === tr.dataset.changeRowId
-        ? next
-        : null;
-    };
-
-    const closeReview = (tr, button) => {
-      const existing = reviewRowFor(tr);
-      if (existing) existing.remove();
-      if (button) {
-        button.textContent = "Review";
-        button.setAttribute("aria-expanded", "false");
-      }
-    };
-
-    // Evidence chips from the data the row already carries (change.evidence):
-    // an overall promotable verdict + one chip per reported check.
-    const renderEvidenceChips = (container, change) => {
-      const checks = (change.evidence && change.evidence.checks) || [];
-      const promotable = Boolean(change.evidence && change.evidence.promotable);
-      container.append(
-        promotable ? chip("Checks passed", "green") : chip("Checks blocked", "amber"),
-      );
-      for (const c of checks) {
-        const tone = c.status === "pass" ? "green" : c.status === "fail" ? "red" : "amber";
-        const label = (c.label || c.id || "check") + (c.status && c.status !== "pass" ? " · " + c.status : "");
-        const el = chip(label, tone);
-        if (c.detail) el.title = c.detail;
-        container.append(el);
-      }
-      if (!checks.length) container.append(subtle("No checks reported yet"));
-    };
-
-    // Build the split pane. Returns the pane node + the diff container so the
-    // caller can populate the diff asynchronously (reusing renderDiff).
-    const buildReviewPane = (change) => {
-      const pane = document.createElement("div");
-      pane.className = "review-pane";
-
-      // Preview column — same-origin iframe of the friendly per-PR route (it
-      // handles every state: ready render, or the not-built page). Falls back to
-      // any server-provided previewUrl for a change-first row with no PR number.
-      const previewUrl = candidatePrUrl(change.prNumber) || change.previewUrl;
-      const previewCol = document.createElement("div");
-      previewCol.className = "review-preview";
-      const pHead = document.createElement("div");
-      pHead.className = "review-pane-head";
-      const pTitle = document.createElement("b");
-      pTitle.textContent = "Preview";
-      pHead.append(pTitle);
-      if (previewUrl) {
-        const openLink = document.createElement("a");
-        openLink.href = previewUrl;
-        openLink.target = "_blank";
-        openLink.rel = "noopener";
-        openLink.textContent = "Open in new tab ↗";
-        pHead.append(openLink);
-      }
-      previewCol.append(pHead);
-      if (previewUrl) {
-        const frame = document.createElement("iframe");
-        frame.className = "review-frame";
-        frame.src = previewUrl;
-        frame.loading = "lazy";
-        frame.title =
-          change.prNumber != null
-            ? "Preview of PR #" + change.prNumber
-            : "Preview of " + change.changeId;
-        previewCol.append(frame);
-      } else {
-        previewCol.append(subtle("No preview is available for this change yet."));
-      }
-
-      // Detail column — evidence chips + diff + the same Accept/Reject actions.
-      const detailCol = document.createElement("div");
-      detailCol.className = "review-detail";
-
-      const evSection = document.createElement("div");
-      evSection.className = "review-section";
-      const evTitle = document.createElement("b");
-      evTitle.textContent = "Checks";
-      const evChips = document.createElement("div");
-      evChips.className = "review-chips";
-      renderEvidenceChips(evChips, change);
-      evSection.append(evTitle, evChips);
-      detailCol.append(evSection);
-
-      const diffSection = document.createElement("div");
-      diffSection.className = "review-section";
-      const diffTitle = document.createElement("b");
-      diffTitle.textContent = "Diff";
-      const diffTarget = document.createElement("div");
-      diffTarget.className = "review-diff-target";
-      diffTarget.append(subtle("Loading the diff…"));
-      diffSection.append(diffTitle, diffTarget);
-      detailCol.append(diffSection);
-
-      // The SAME actions as the row — same handlers, same gates. Not a new authz
-      // path: integrateCandidate/rejectChange POST to the same endpoints, and the
-      // server re-authorizes.
-      const actionRow = document.createElement("div");
-      actionRow.className = "review-actions";
-      const accept = document.createElement("button");
-      accept.type = "button";
-      accept.className = "btn primary";
-      accept.textContent = "Accept to preview";
-      accept.disabled = !canShip || !change.mergeable;
-      accept.title = !canShip
-        ? "Requires an owner or admin sign-in"
-        : !change.mergeable
-          ? "This change is not ready to integrate"
-          : "Integrate this change into the preview aggregate (does not go live)";
-      accept.addEventListener("click", () => integrateCandidate(change, accept));
-      const reject = document.createElement("button");
-      reject.type = "button";
-      reject.className = "btn";
-      reject.textContent = "Reject";
-      reject.disabled = !canShip;
-      reject.title = canShip
-        ? "Close this change without publishing"
-        : "Requires an owner or admin sign-in";
-      reject.addEventListener("click", () => rejectChange(change, reject));
-      actionRow.append(accept, reject);
-      detailCol.append(actionRow);
-
-      pane.append(previewCol, detailCol);
-      return { pane, diffTarget };
-    };
-
-    const loadReviewDiff = async (change, diffTarget) => {
-      try {
-        const res = await fetch(diffBase + "/" + encodeURIComponent(change.changeId) + "/diff", {
-          headers: { accept: "application/json" },
-        });
-        const data = await res.json().catch(() => ({}));
-        diffTarget.textContent = "";
-        if (!res.ok) {
-          diffTarget.append(subtle(data.error || "Could not load the diff (" + res.status + ")"));
-        } else {
-          renderDiff(diffTarget, data.diff || {});
-        }
-      } catch {
-        diffTarget.textContent = "";
-        diffTarget.append(subtle("Could not load the diff — network error"));
-      }
-    };
-
-    const toggleReview = (change, button, tr) => {
-      if (!tr.dataset.changeRowId) tr.dataset.changeRowId = change.changeId;
-      if (reviewRowFor(tr)) {
-        closeReview(tr, button);
-        return;
-      }
-      const detailTr = document.createElement("tr");
-      detailTr.dataset.publishReviewRow = tr.dataset.changeRowId;
-      const td = document.createElement("td");
-      td.colSpan = 6;
-      td.className = "publish-review-cell";
-      const { pane, diffTarget } = buildReviewPane(change);
-      td.append(pane);
-      detailTr.append(td);
-      tr.after(detailTr);
-      button.textContent = "Hide review";
-      button.setAttribute("aria-expanded", "true");
-      loadReviewDiff(change, diffTarget);
-    };
-
-    const CHANGE_MARK = { added: "+", changed: "~", removed: "−" };
-
-    const renderDiff = (td, diff) => {
-      td.textContent = "";
-      const head = document.createElement("div");
-      head.className = "publish-diff-head";
-
-      // Authority: honest label of whether the diff describes the exact head.
-      const authority = diff.authority || {};
-      const authChip = chip(
-        authority.authoritative
-          ? "Reviewed at head"
-          : authority.stale
-            ? "Last-good preview (stale vs head)"
-            : authority.missing
-              ? "No evidence yet"
-              : "Head",
-        authority.authoritative ? "green" : authority.stale ? "amber" : "",
-      );
-      head.append(authChip);
-
-      if (diff.headSha) {
-        const sha = document.createElement("span");
-        sha.className = "publish-mono subtle";
-        sha.textContent = "head " + shortSha(diff.headSha);
-        head.append(sha);
-      }
-      if (diff.revHref) {
-        const rev = document.createElement("a");
-        rev.href = diff.revHref;
-        rev.target = "_blank";
-        rev.rel = "noopener";
-        rev.textContent = "Open reviewed revision";
-        head.append(rev);
-      }
-      td.append(head);
-
-      if (!diff.renderable) {
-        // Honest: a candidate that can't render has NO diff — say why (dg3), no fake.
-        const reason = document.createElement("p");
-        reason.className = "note publish-diff-blocked";
-        reason.textContent =
-          diff.blockedReason || "This candidate has no renderable version to diff yet.";
-        td.append(reason);
-        return;
-      }
-
-      const files = Array.isArray(diff.files) ? diff.files : [];
-      if (!files.length) {
-        td.append(subtle("No file changes vs the current live version."));
-        return;
-      }
-      const list = document.createElement("ul");
-      list.className = "publish-diff-list";
-      for (const f of files) {
-        const li = document.createElement("li");
-        li.className = "publish-diff-" + f.change;
-        const mark = document.createElement("span");
-        mark.className = "publish-diff-mark";
-        mark.textContent = CHANGE_MARK[f.change] || "•";
-        const path = document.createElement("code");
-        path.textContent = f.path;
-        li.append(mark, path);
-        list.append(li);
-      }
-      td.append(list);
-    };
-
-    // ---- dg7: versions / promotion history + rollback ----------------------
-    // The promotion history (u2/u3 promotion_status) with the tenant Gitea SHA,
-    // its /rev link (u5), and the current-live marker; a prior version rolls back
-    // THROUGH the one orchestrator (/api/changes/rollback → u8), rendering only the
-    // HONEST terminal state (rolled_back only when verified).
-
-    const versionsPanel = root.querySelector("[data-publish-versions]");
-    const versionsBody = versionsPanel?.querySelector("[data-versions-body]");
-    const versionsChip = versionsPanel?.querySelector("[data-versions-chip]");
-    const versionsStatus = versionsPanel?.querySelector("[data-versions-status]");
-    const versionsRollbackNote = versionsPanel?.querySelector("[data-versions-rollback-note]");
-    let rollbackMode = "control-plane";
-
-    const renderVersions = (view) => {
-      if (!versionsBody) return;
-      const versions = Array.isArray(view.versions) ? view.versions : [];
-      rollbackMode = view.rollbackMode || "control-plane";
-      versionsBody.textContent = "";
-
-      if (versionsChip) {
-        versionsChip.textContent = versions.length === 1 ? "1 version" : versions.length + " versions";
-        versionsChip.className = "chip" + (versions.length ? " blue" : "");
-      }
-
-      // Static tenants (rux13): per-version rollback is an HONEST ONE-DISPATCH.
-      // The console can't enumerate the S3 versions archive digest, so it dispatches
-      // by the tenant version id and CI resolves the digest + re-publishes — it
-      // completes via CI, not instantly (never implied one-click).
-      if (versionsRollbackNote) {
-        if (rollbackMode === "static-archive") {
-          versionsRollbackNote.hidden = false;
-          versionsRollbackNote.textContent =
-            "This store publishes to a static public site. Rolling back DISPATCHES a CI job that " +
-            "re-publishes the prior version from the S3 versions archive — it completes via CI, not " +
-            "instantly. The store keeps serving the current version until the re-publish is verified live.";
-        } else {
-          versionsRollbackNote.hidden = true;
-        }
-      }
-
-      if (!versions.length) {
-        const tr = document.createElement("tr");
-        const td = cell(subtle("No versions have been promoted to live yet."));
-        td.colSpan = 6;
-        tr.append(td);
-        versionsBody.append(tr);
-        return;
-      }
-
-      for (const v of versions) {
-        const tr = document.createElement("tr");
-
-        // Version identity: the tenant Gitea SHA (content authority) + source.
-        const idCell = document.createElement("td");
-        const strong = document.createElement("strong");
-        strong.className = "publish-mono";
-        strong.textContent = shortSha(v.versionId);
-        idCell.append(strong);
-        if (v.source) idCell.append(subtle(v.source === "commit" ? "From a commit" : "Content hash"));
-        tr.append(idCell);
-
-        // Digest (static current only — never fabricated for priors).
-        const digestCell = cell(v.digest ? shortSha(v.digest) : "—");
-        digestCell.classList.add("publish-mono");
-        if (!v.digest) digestCell.classList.add("subtle");
-        tr.append(digestCell);
-
-        tr.append(cell(age(v.promotedAt)));
-
-        // Preview: the u5 immutable /rev/<sha> link.
-        const revCell = document.createElement("td");
-        if (v.revHref) {
-          const a = document.createElement("a");
-          a.href = v.revHref;
-          a.target = "_blank";
-          a.rel = "noopener";
-          a.textContent = "Revision";
-          revCell.append(a);
-        } else {
-          revCell.append(subtle("—"));
-        }
-        tr.append(revCell);
-
-        // State: current live vs prior.
-        tr.append(cell(v.isCurrent ? chip("Current live", "green") : chip("Prior", "")));
-
-        // Action: roll back to a PRIOR version (never the current one).
-        const act = document.createElement("td");
-        act.className = "action publish-actions";
-        if (!v.isCurrent) {
-          const rollbackBtn = document.createElement("button");
-          rollbackBtn.type = "button";
-          rollbackBtn.className = "btn";
-          const isStatic = rollbackMode === "static-archive";
-          // Honest label: a static rollback completes via CI, not instantly (rux13).
-          rollbackBtn.textContent = isStatic ? "Roll back via CI" : "Roll back";
-          rollbackBtn.disabled = !canShip;
-          rollbackBtn.title = !canShip
-            ? "Requires an owner or ship-on-behalf sign-in"
-            : isStatic
-              ? "Dispatch a rollback to this version — completes via CI (not instant)"
-              : "Roll the live site back to this version";
-          rollbackBtn.addEventListener("click", () => rollbackVersion(v, rollbackBtn));
-          act.append(rollbackBtn);
-        }
-        tr.append(act);
-
-        versionsBody.append(tr);
-      }
-    };
-
-    const loadVersions = async () => {
-      if (!versionsBody) return;
-      try {
-        const res = await fetch(ds.versionsEndpoint, { headers: { accept: "application/json" } });
-        if (res.status === 401 || res.status === 403) {
-          if (versionsChip) versionsChip.textContent = "Sign-in required";
-          versionsBody.textContent = "";
-          const tr = document.createElement("tr");
-          const td = cell(subtle("Sign in as a store owner or admin to view published versions."));
-          td.colSpan = 6;
-          tr.append(td);
-          versionsBody.append(tr);
-          return;
-        }
-        const data = await res.json().catch(() => ({}));
-        if (!res.ok) {
-          setStatus(versionsStatus, data.error || "Could not load versions (" + res.status + ")", "err");
-          return;
-        }
-        renderVersions(data.view || {});
-      } catch {
-        setStatus(versionsStatus, "Could not load versions — network error", "err");
-      }
-    };
-
-    // Interpret the rollback response into ONE honest terminal state (mirrors the
-    // pure lib/publish/shipWorkspace `interpretRollbackResponse`; duplicated in
-    // plain JS because is:inline scripts can't import modules). `rolledBack` is
-    // true ONLY for a verified `rolled_back` — a `publish_pending` is NEVER a
-    // rolled-back claim.
-    const interpretRollback = (httpOk, body) => {
-      const toVersionId = typeof body.toVersionId === "string" ? body.toVersionId : null;
-      if (typeof body.state === "string") {
-        const state = ["rolled_back", "publish_pending", "publish_failed", "blocked"].includes(body.state)
-          ? body.state
-          : "error";
-        return {
-          state,
-          rolledBack: state === "rolled_back",
-          message: body.message || body.error || "Rollback returned state " + state + ".",
-        };
-      }
-      if (httpOk && body.rolledBack === true) {
-        return {
-          state: "rolled_back",
-          rolledBack: true,
-          message: toVersionId ? "Rolled back live to " + shortSha(toVersionId) + "." : "Rolled back live.",
-        };
-      }
-      return {
-        state: "blocked",
-        rolledBack: false,
-        message: (body.error || "Rollback failed") + (body.reason ? " (" + body.reason + ")" : ""),
-      };
-    };
-
-    const rollbackVersion = async (version, button) => {
-      // Static rollback (rux13) is an honest one-DISPATCH — completes via CI, not
-      // instantly; the confirm/status copy must never imply an instant flip.
-      const isStatic = rollbackMode === "static-archive";
-      const confirmMsg = isStatic
-        ? "Roll the static public site back to version " + shortSha(version.versionId) +
-            "? This DISPATCHES a rollback that completes via CI (not instantly) — the store keeps " +
-            "serving the current version until CI re-publishes the prior one."
-        : "Roll the live store back to version " + shortSha(version.versionId) +
-            "? This publishes that prior version to the live site.";
-      if (!window.confirm(confirmMsg)) return;
-      button.disabled = true;
-      setStatus(
-        versionsStatus,
-        isStatic
-          ? "Dispatching rollback to " + shortSha(version.versionId) + " (completes via CI)…"
-          : "Rolling back to " + shortSha(version.versionId) + "…",
-      );
-      try {
-        // The console dispatches by version id only; a static prior version's
-        // archive digest lives only in S3 (CI resolves it). Pass a digest ONLY when
-        // we honestly have one (never for a static prior — its digest is always null).
-        const payload = { targetVersionId: version.versionId };
-        if (version.digest) payload.targetDigest = version.digest;
-        const res = await fetch(ds.rollbackEndpoint, {
-          method: "POST",
-          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
-          body: JSON.stringify(payload),
-        });
-        const data = await res.json().catch(() => ({}));
-        const outcome = interpretRollback(res.ok, data);
-        setStatus(versionsStatus, outcome.message, outcome.rolledBack ? "ok" : outcome.state === "publish_pending" ? "ok" : "err");
-      } catch {
-        setStatus(versionsStatus, "Rollback failed — network error", "err");
-      } finally {
-        button.disabled = false;
-        loadVersions();
-        loadQueue();
-      }
-    };
-
-    // ---- Domain section ----------------------------------------------------
-
-    const domainPanel = root.querySelector("[data-publish-domain]");
-    let domainPollTimer = null;
-
-    const renderDomain = (payload) => {
-      if (!domainPanel) return;
-      const domain = payload.domain || {};
-      const stateEl = domainPanel.querySelector("[data-domain-state]");
-      const stateChip = domainPanel.querySelector("[data-domain-state-chip]");
-      const sinceEl = domainPanel.querySelector("[data-domain-since]");
-      const captureEl = domainPanel.querySelector("[data-domain-capture]");
-      const runEl = domainPanel.querySelector("[data-domain-run]");
-      const runDetailEl = domainPanel.querySelector("[data-domain-run-detail]");
-      const rollbackBtn = domainPanel.querySelector("[data-domain-rollback]");
-      const rollbackDetail = domainPanel.querySelector("[data-domain-rollback-detail]");
-      const connected = domain.state === "cloudfront";
-
-      if (stateEl) {
-        stateEl.textContent = connected
-          ? "Storefront CDN (cloudfront)"
-          : "Previous host (pantheon)";
-      }
-      if (stateChip) {
-        stateChip.textContent = connected ? "Connected" : "Not connected";
-        stateChip.className = "chip " + (connected ? "green" : "amber");
-      }
-      if (sinceEl) {
-        sinceEl.textContent = domain.since
-          ? "Since " + new Date(domain.since).toLocaleString()
-          : "Current host for " + (payload.appDomain || ds.appDomain);
-      }
-      if (captureEl) {
-        captureEl.textContent = domain.priorCapturedAt
-          ? "Captured " + new Date(domain.priorCapturedAt).toLocaleString()
-          : "None captured";
-      }
-
-      const run = domain.lastRun;
-      // "dispatched" = awaiting the CI completion callback (terminal-only wire).
-      const inFlight = run && run.status === "dispatched";
-      if (runEl) {
-        runEl.textContent = run
-          ? run.action + (run.rehearsal ? " (rehearsal)" : "") + " · " + run.status
-          : "None";
-      }
-      if (runDetailEl) {
-        runDetailEl.textContent = "";
-        if (run) {
-          const parts = [];
-          if (run.actor) parts.push("by " + run.actor);
-          if (run.startedAt) parts.push(age(run.startedAt));
-          runDetailEl.append(document.createTextNode(parts.join(" · ")));
-          if (run.runUrl) {
-            const link = document.createElement("a");
-            link.href = run.runUrl;
-            link.target = "_blank";
-            link.rel = "noopener";
-            link.textContent = "View run";
-            runDetailEl.append(document.createTextNode(" · "));
-            runDetailEl.append(link);
-          }
-          if (run.status === "failed" && run.error) {
-            const err = document.createElement("span");
-            err.className = "publish-error-detail";
-            err.textContent = run.error;
-            runDetailEl.append(document.createElement("br"));
-            runDetailEl.append(err);
-          }
-        } else {
-          runDetailEl.textContent = "Connect and rollback runs appear here.";
-        }
-      }
-      if (rollbackBtn) {
-        rollbackBtn.disabled =
-          !canShip || inFlight || !domain.priorRecordsKey;
-      }
-      if (rollbackDetail && domain.priorCapturedAt) {
-        rollbackDetail.textContent =
-          "Restores the DNS records captured " +
-          new Date(domain.priorCapturedAt).toLocaleString() + ".";
-      }
-
-      // Poll while a run is in flight so completion lands without a manual refresh.
-      if (domainPollTimer) {
-        clearTimeout(domainPollTimer);
-        domainPollTimer = null;
-      }
-      if (inFlight) domainPollTimer = setTimeout(loadDomain, 15000);
-    };
-
-    const loadDomain = async () => {
-      if (!domainPanel) return;
-      try {
-        const res = await fetch(ds.domainStatusEndpoint, {
-          headers: { accept: "application/json" },
-        });
-        if (!res.ok) return;
-        renderDomain(await res.json());
-      } catch {
-        /* leave the last rendered state */
-      }
-      // u9: refresh the readiness itemization alongside the status.
-      loadReadiness();
-    };
-
-    // ---- Cutover readiness (u9) --------------------------------------------
-    // Reads the SAME server gate `tot go-live` reads (/api/domain/readiness) and
-    // itemizes the preconditions. The Connect button additionally requires the
-    // server to report ready — the display and the enforcement can't diverge.
-    const readinessBox = domainPanel?.querySelector("[data-domain-readiness]");
-    const connectBtn = domainPanel?.querySelector("[data-domain-connect]");
-    let domainReady = false;
-
-    const renderReadiness = (payload) => {
-      if (!readinessBox) return;
-      const readiness = (payload && payload.readiness) || {};
-      const checks = Array.isArray(readiness.checks) ? readiness.checks : [];
-      domainReady = readiness.ready === true;
-      readinessBox.hidden = false;
-
-      const chip = readinessBox.querySelector("[data-domain-readiness-chip]");
-      if (chip) {
-        chip.textContent = domainReady ? "Ready" : "Not ready";
-        chip.className = "chip " + (domainReady ? "green" : "amber");
-      }
-      const list = readinessBox.querySelector("[data-domain-readiness-list]");
-      if (list) {
-        list.textContent = "";
-        for (const c of checks) {
-          const li = document.createElement("li");
-          li.className = c.ok ? "ok" : "blocked";
-          const mark = document.createElement("span");
-          mark.className = "domain-readiness-mark";
-          mark.textContent = c.ok ? "✓" : "✗";
-          const label = document.createElement("b");
-          label.textContent = c.label || c.id || "";
-          li.append(mark, label);
-          if (c.detail) {
-            const detail = document.createElement("span");
-            detail.className = "domain-readiness-detail";
-            detail.textContent = c.detail;
-            li.append(detail);
-          }
-          list.append(li);
-        }
-      }
-      const note = readinessBox.querySelector("[data-domain-readiness-note]");
-      if (note) {
-        note.textContent = payload && payload.ownerCapable === false
-          ? "Apex cutover is owner-only — sign in as the store owner to connect the domain."
-          : domainReady
-            ? "All preconditions are green — the cutover is permitted."
-            : "Clear the failing preconditions above before connecting the apex.";
-      }
-      // Gate the Connect button on server readiness in ADDITION to owner (the
-      // markup already disables it for non-owners); never enable it when blocked.
-      if (connectBtn && !connectBtn.dataset.ownerLocked) {
-        connectBtn.disabled = !domainReady;
-      }
-    };
-
-    const loadReadiness = async () => {
-      if (!readinessBox || !ds.domainReadinessEndpoint) return;
-      try {
-        const res = await fetch(ds.domainReadinessEndpoint, {
-          headers: { accept: "application/json", "x-tot-capability": "ship-on-behalf" },
-        });
-        if (!res.ok) return;
-        renderReadiness(await res.json());
-      } catch {
-        /* leave the last rendered readiness */
-      }
-    };
-
-    const domainStatusEl = domainPanel?.querySelector("[data-domain-status]");
-
-    const domainAction = async (body, button) => {
-      button.disabled = true;
-      setStatus(domainStatusEl, (body.action === "connect" ? "Connecting" : "Rolling back") + "…");
-      try {
-        const res = await fetch(ds.domainDispatchEndpoint, {
-          method: "POST",
-          headers: {
-            "content-type": "application/json",
-            "x-tot-capability": "ship-on-behalf",
-          },
-          body: JSON.stringify(body),
-        });
-        const data = await res.json().catch(() => ({}));
-        if (res.ok && data.dispatched) {
-          setStatus(
-            domainStatusEl,
-            (body.action === "connect" ? "Connect" : "Rollback") +
-              (body.rehearsal ? " rehearsal" : "") +
-              " dispatched — the run status updates below as it progresses.",
-            "ok",
-          );
-        } else {
-          setStatus(domainStatusEl, data.error || "Request failed (" + res.status + ")", "err");
-        }
-      } catch {
-        setStatus(domainStatusEl, "Request failed — network error", "err");
-      } finally {
-        button.disabled = false;
-        loadDomain();
-      }
-    };
-
-    domainPanel?.querySelector("[data-domain-connect]")?.addEventListener("click", (event) => {
-      const confirmInput = domainPanel.querySelector("[data-domain-confirm]");
-      const rehearsal = Boolean(domainPanel.querySelector("[data-domain-rehearsal]")?.checked);
-      domainAction(
-        {
-          action: "connect",
-          confirmDomain: (confirmInput?.value || "").trim(),
-          rehearsal,
-        },
-        event.currentTarget,
-      );
-    });
-
-    domainPanel?.querySelector("[data-domain-rollback]")?.addEventListener("click", (event) => {
-      if (
-        !window.confirm(
-          "Roll back " + ds.appDomain + " to the previous host? DNS returns to the captured records in about a minute.",
-        )
-      ) {
-        return;
-      }
-      domainAction({ action: "rollback" }, event.currentTarget);
-    });
-
-    // ---- b17: branch retention ----------------------------------------------
-    // Renders the GET /api/changes/branches dry-run classification (already
-    // projected server-side by branchRetentionView.ts — this script only
-    // paints it, same division of labor as renderQueue/renderVersions above)
-    // and drives the guarded delete. The server (candidate_delete, b13)
-    // re-classifies fresh on every delete, so the confirm below is the HUMAN
-    // gate, not the safety guarantee — the safety guarantee is server-side.
-
-    const branchesPanel = root.querySelector("[data-publish-branches]");
-    const branchesBody = branchesPanel?.querySelector("[data-branches-body]");
-    const branchesChip = branchesPanel?.querySelector("[data-branches-chip]");
-    const branchesStatus = branchesPanel?.querySelector("[data-branches-status]");
-
-    const BRANCH_TONE = {
-      protected: "",
-      "active-open": "green",
-      "stale-open": "amber",
-      integrated: "blue",
-      "closed-or-rejected": "blue",
-      orphan: "red",
-    };
-
-    const buildCleanupPlan = (row) => {
-      return [
-        "Delete branch plan:",
-        "  repo:           " + (appDomain || repo),
-        "  branch:         " + row.ref,
-        "  tip sha:        " + row.shortSha,
-        "  classification: " + row.classificationLabel,
-        "  reason:         " + row.reason,
-        "",
-        "This deletes the Git BRANCH only — it never evicts a hosted preview build",
-        "(that is Retire, a separate action above). The server re-classifies this",
-        "branch fresh before deleting; a moved tip or a branch that is no longer",
-        "integrated/closed-or-rejected is refused, not silently skipped.",
-      ].join("\n");
-    };
-
-    const cleanupBranch = async (row, button) => {
-      if (!window.confirm(buildCleanupPlan(row) + "\n\nDelete this branch?")) return;
-      button.disabled = true;
-      setStatus(branchesStatus, "Deleting " + row.shortRef + "…");
-      try {
-        const res = await fetch(ds.branchesEndpoint, {
-          method: "POST",
-          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
-          body: JSON.stringify({ ref: row.ref, expectedSha: row.sha }),
-        });
-        const data = await res.json().catch(() => ({}));
-        if (res.ok && data.ok) {
-          setStatus(
-            branchesStatus,
-            data.alreadyAbsent
-              ? row.shortRef + " was already gone (nothing to delete)."
-              : "Deleted " + row.shortRef + ".",
-            "ok",
-          );
-        } else {
-          setStatus(branchesStatus, data.error || "Delete refused (" + res.status + ")", "err");
-        }
-      } catch {
-        setStatus(branchesStatus, "Delete failed — network error", "err");
-      } finally {
-        button.disabled = false;
-        loadBranches();
-      }
-    };
-
-    const renderBranches = (view) => {
-      if (!branchesBody) return;
-      const rows = Array.isArray(view.rows) ? view.rows : [];
-      if (branchesChip) {
-        const needsReview = rows.filter((r) => r.quarantine || r.eligibleForDelete).length;
-        branchesChip.textContent = needsReview
-          ? needsReview + " to review"
-          : rows.length
-            ? rows.length + " branches"
-            : "0 branches";
-        branchesChip.className = "chip" + (needsReview ? " amber" : "");
-      }
-      branchesBody.textContent = "";
-      if (!rows.length) {
-        const tr = document.createElement("tr");
-        const td = cell(subtle("No candidate branches found for this repo."));
-        td.colSpan = 7;
-        tr.append(td);
-        branchesBody.append(tr);
-        return;
-      }
-
-      for (const row of rows) {
-        const tr = document.createElement("tr");
-
-        const branchCell = document.createElement("td");
-        const branchStrong = document.createElement("strong");
-        branchStrong.textContent = row.shortRef;
-        branchCell.append(branchStrong, subtle(row.ref + " @ " + row.shortSha));
-        tr.append(branchCell);
-
-        tr.append(cell(chip(row.classificationLabel, BRANCH_TONE[row.classification] || "")));
-
-        const prCell = document.createElement("td");
-        if (row.prNumber != null) {
-          // Link to the INTERNAL friendly PR route (/preview/<tenant>/pr/<N>), never
-          // the server-provided `row.prUrl` — that is the raw Gitea forge html_url the
-          // MCP candidate_list projection emits (<forge-host>/<org>/<repo>/pulls/N),
-          // and surfacing a raw forge link to an owner is exactly the boundary
-          // noGiteaLinks.test.ts guards (the source scan can't catch a host that
-          // arrives in data, so we refuse it here at render). Mirrors the candidate
-          // queue, which already builds its preview link this way.
-          const prHref = candidatePrUrl(row.prNumber);
-          if (prHref) {
-            const a = document.createElement("a");
-            a.href = prHref;
-            a.target = "_blank";
-            a.rel = "noopener";
-            a.textContent = "PR #" + row.prNumber;
-            prCell.append(a);
-          } else {
-            prCell.append(document.createTextNode("PR #" + row.prNumber));
-          }
-          prCell.append(subtle((row.prState || "") + (row.integratedIntoAggregate ? " · in aggregate" : "")));
-        } else {
-          prCell.append(subtle("No PR record"));
-        }
-        tr.append(prCell);
-
-        tr.append(cell(row.commitTimestampDisplay));
-        tr.append(cell(row.ageLabel));
-        tr.append(cell(row.evidenceSummary));
-
-        const actionsCell = document.createElement("td");
-        actionsCell.className = "action";
-        if (row.quarantine) {
-          actionsCell.append(chip("Needs owner review", "red"));
-        } else if (row.eligibleForDelete) {
-          const btn = document.createElement("button");
-          btn.type = "button";
-          btn.className = "btn";
-          btn.disabled = !canShip;
-          btn.title = canShip ? "" : "Requires an owner/admin sign-in.";
-          btn.textContent = "Clean up";
-          btn.addEventListener("click", () => cleanupBranch(row, btn));
-          actionsCell.append(btn);
-        } else {
-          actionsCell.append(subtle("Keep"));
-        }
-        tr.append(actionsCell);
-
-        branchesBody.append(tr);
-      }
-    };
-
-    const loadBranches = async () => {
-      if (!branchesBody) return;
-      try {
-        const res = await fetch(ds.branchesEndpoint, { headers: { accept: "application/json" } });
-        if (res.status === 401 || res.status === 403) {
-          if (branchesChip) branchesChip.textContent = "Sign-in required";
-          branchesBody.textContent = "";
-          const tr = document.createElement("tr");
-          const td = cell(subtle("Sign in as a store owner or admin to view branch retention."));
-          td.colSpan = 7;
-          tr.append(td);
-          branchesBody.append(tr);
-          return;
-        }
-        const data = await res.json().catch(() => ({}));
-        if (!res.ok) {
-          setStatus(branchesStatus, data.error || "Could not load branch classification (" + res.status + ")", "err");
-          return;
-        }
-        renderBranches(data.report || {});
-      } catch {
-        setStatus(branchesStatus, "Could not load branch classification — network error", "err");
-      }
-    };
-
-    // ---- Wiring ------------------------------------------------------------
-
-    root.querySelector("[data-publish-refresh]")?.addEventListener("click", () => {
-      setStatus(statusEl, "");
-      loadQueue();
-      loadVersions();
-      loadDomain();
-      loadBranches();
-    });
-
-    // rux7: pause polling while hidden; on return, refresh immediately (loadQueue
-    // re-renders + resyncs the poll clock) rather than waiting out the interval.
-    document.addEventListener("visibilitychange", () => {
-      if (document.hidden) {
-        clearPoll();
-      } else {
-        loadQueue();
-      }
-    });
-
-    // loadQueue starts the poll cadence via its tail (schedulePoll).
-    loadQueue();
-    loadVersions();
-    loadDomain();
-    loadBranches();
-  })();
+<script>
+  import { initAdminPublishTab } from "@/lib/publish/adminPublishTab";
+  initAdminPublishTab();
 </script>
 
 <style>
@@ -2959,11 +1205,241 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     min-width: 900px;
   }
 
+  /* r06 — responsive change queue. On a narrow screen the min-width:900px queue
+     table forces horizontal scroll, unusable on a phone. Below ~700px, restack the
+     existing rows into labeled cards — CSS-only, no DOM/JS change: the table, rows
+     and cells become blocks, the visual header is hidden (kept for assistive tech),
+     and each cell gains its column label via a ::before drawn from the fixed thead
+     order. Scoped to #publish-queue so the aggregate/versions tables are untouched.
+     Full-width colspan rows (empty state, sign-in notice, the inline review pane)
+     stay unlabeled and full width. */
+  @media (max-width: 700px) {
+    #publish-queue .publish-table,
+    #publish-queue .publish-table tbody,
+    #publish-queue .publish-table tr,
+    #publish-queue .publish-table td {
+      display: block;
+      min-width: 0;
+      width: auto;
+    }
+    #publish-queue .publish-table thead {
+      position: absolute;
+      width: 1px;
+      height: 1px;
+      overflow: hidden;
+      clip: rect(0 0 0 0);
+      clip-path: inset(50%);
+      white-space: nowrap;
+    }
+    #publish-queue .publish-table tbody tr {
+      margin: 0 0 12px;
+      padding: 10px 12px;
+      border: 1px solid var(--admin-line);
+      border-radius: var(--admin-radius-sm);
+      background: var(--admin-surface, #fff);
+    }
+    #publish-queue .publish-table tbody td {
+      padding: 4px 0;
+      text-align: left;
+      border: 0;
+    }
+    #publish-queue .publish-table tbody td:not([colspan])::before {
+      display: block;
+      margin-bottom: 2px;
+      font-size: 11px;
+      font-weight: 600;
+      text-transform: uppercase;
+      letter-spacing: 0.04em;
+      opacity: 0.6;
+    }
+    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(1)::before {
+      content: "Change";
+    }
+    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(2)::before {
+      content: "Status";
+    }
+    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(3)::before {
+      content: "Checks";
+    }
+    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(4)::before {
+      content: "Head";
+    }
+    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(5)::before {
+      content: "Updated";
+    }
+    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(6)::before {
+      content: "Actions";
+    }
+  }
+
+  /* Collapsible panels (What needs your approval, Next release, Live Site): the
+     panel-head IS the summary. Kill the native marker, add a rotating chevron, and
+     make the whole head a click target. Mirrors the Rollback options (.versions-details). */
+  .publish-queue-details > summary.panel-head,
+  .closed-changes-details > summary.panel-head,
+  .agg-console-details > summary.panel-head,
+  .live-site-details > summary.panel-head,
+  .versions-details > summary.live-site-subhead {
+    cursor: pointer;
+    list-style: none;
+    user-select: none;
+  }
+  .publish-queue-details > summary.panel-head::-webkit-details-marker,
+  .closed-changes-details > summary.panel-head::-webkit-details-marker,
+  .agg-console-details > summary.panel-head::-webkit-details-marker,
+  .live-site-details > summary.panel-head::-webkit-details-marker,
+  .versions-details > summary.live-site-subhead::-webkit-details-marker {
+    display: none;
+  }
+  .publish-queue-details > summary.panel-head h3::before,
+  .closed-changes-details > summary.panel-head h3::before,
+  .agg-console-details > summary.panel-head h3::before,
+  .live-site-details > summary.panel-head h3::before,
+  .versions-details > summary.live-site-subhead h4::before {
+    content: "";
+    width: 7px;
+    height: 7px;
+    margin-right: 2px;
+    border-right: 2px solid currentColor;
+    border-bottom: 2px solid currentColor;
+    transform: rotate(-45deg);
+    transition: transform 0.15s ease;
+    opacity: 0.6;
+  }
+  .publish-queue-details[open] > summary.panel-head h3::before,
+  .closed-changes-details[open] > summary.panel-head h3::before,
+  .agg-console-details[open] > summary.panel-head h3::before,
+  .live-site-details[open] > summary.panel-head h3::before,
+  .versions-details[open] > summary.live-site-subhead h4::before {
+    transform: rotate(45deg);
+  }
+
+  /* The collapsed release summary owns one mutually exclusive state affordance:
+     a green current-state chip or the action that advances live. Both classes set
+     display, so explicitly preserve the semantic hidden state. */
+  [data-live-release-state][hidden],
+  .live-release-publish[hidden] {
+    display: none;
+  }
+
+  /* Live Site — the two clickable public entry points, previously undiscoverable. */
+  .live-site-links {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+    display: grid;
+    gap: 12px;
+  }
+  .live-site-links > li {
+    display: grid;
+    grid-template-columns: minmax(96px, auto) 1fr;
+    align-items: baseline;
+    gap: 4px 12px;
+  }
+  .live-site-link-label {
+    font-weight: 600;
+    font-size: 13px;
+    color: var(--admin-fg, inherit);
+  }
+  .live-site-link-url {
+    word-break: break-all;
+    font-size: 13px;
+  }
+  .live-site-link-note {
+    grid-column: 2;
+    font-size: 12px;
+    opacity: 0.7;
+  }
+
+  /* r13 — Rollback + Public domain nested INSIDE Live Site read as a subsection,
+     not a sibling panel: a single left rule + generous spacing rather than a boxed
+     card, so the Live Site panel doesn't stack boxes-in-boxes. */
+  .live-site-subsection {
+    border-left: 2px solid var(--admin-line);
+    padding-left: 16px;
+    margin-top: 18px;
+    display: grid;
+    gap: 12px;
+  }
+  /* r13 — the Public-domain status trio (Serving from / Rollback records / Last run)
+     were full `.field` cards (border + fill) nested inside the Live Site panel — the
+     genuine boxes-in-boxes. Flatten them to plain label/value blocks (hooks kept);
+     the subsection's left rule + grid gap carry the separation instead. */
+  .live-site-subsection .field {
+    border: 0;
+    background: transparent;
+    padding: 0;
+  }
+  .live-site-subhead {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 12px;
+  }
+  .live-site-subhead h4 {
+    margin: 0;
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    font-size: 14px;
+  }
+
   .publish-mono {
     font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
     font-size: 12px;
   }
 
+  /* r11 — the human release name beside the "Next release" heading. */
+  .agg-release-name {
+    font-size: 13px;
+    font-weight: 600;
+    color: var(--admin-muted);
+  }
+  .agg-release-name[hidden] {
+    display: none;
+  }
+
+  /* r02 — the humanized "Live version" metric: "v42" as a link to the live store,
+     with the raw SHA tucked into a "Technical details" disclosure. */
+  .live-version-link {
+    color: inherit;
+    text-decoration: none;
+    border-bottom: 1px solid color-mix(in srgb, currentColor 35%, transparent);
+  }
+  .live-version-link:hover {
+    border-bottom-color: currentColor;
+  }
+  .metric-tech,
+  .ver-tech {
+    margin-top: 4px;
+    font-size: 12px;
+  }
+  .metric-tech > summary,
+  .ver-tech > summary {
+    cursor: pointer;
+    color: var(--muted, #64716d);
+    font-size: 11px;
+    list-style: none;
+  }
+  .metric-tech > summary::-webkit-details-marker,
+  .ver-tech > summary::-webkit-details-marker {
+    display: none;
+  }
+  .ver-tech {
+    margin-top: 6px;
+  }
+
+  /* r08 — the "Copy preview link" affordance (icon + text, never color-only). */
+  .publish-copy-preview {
+    display: inline-flex;
+    align-items: center;
+    gap: 5px;
+  }
+  .publish-copy-preview svg {
+    width: 14px;
+    height: 14px;
+  }
+
   .publish-actions {
     white-space: nowrap;
   }
@@ -2972,6 +1448,19 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     margin-left: 6px;
   }
 
+  /* The per-row orphan "Delete this branch" action — a deliberate, destructive,
+     one-at-a-time HUMAN delete, styled distinct from the neutral "Clean up" and the
+     bulk "Sweep dead branches" so it never reads as a routine cleanup. */
+  .btn.branch-delete-orphan {
+    border-color: var(--admin-danger, #b3261e);
+    color: var(--admin-danger, #b3261e);
+  }
+
+  .btn.branch-delete-orphan:not(:disabled):hover {
+    background: var(--admin-danger, #b3261e);
+    color: #fff;
+  }
+
   .publish-status {
     min-height: 0;
   }
@@ -2988,13 +1477,166 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     color: var(--admin-red);
   }
 
-  /* ?pr=N deep link: "not in the queue" callout + row flash */
-  .publish-pr-callout {
-    border: 1px solid var(--admin-line-strong);
-    border-left: 3px solid var(--admin-amber);
-    background: var(--admin-surface-soft);
-    padding: 8px 12px;
-    border-radius: var(--admin-radius-sm);
+  /* Public-site status card, verified-current tone — .risk-alert defaults to an
+     amber/warning look (admin.astro), wrong for "this is fine, confirmed fresh". */
+  .risk-alert.public-site-ok {
+    border-color: var(--admin-green);
+    background: var(--admin-green-soft);
+  }
+
+  .risk-alert.public-site-ok svg {
+    color: var(--admin-green);
+  }
+
+  /* ── State-driven hero (r01) ─────────────────────────────────────────────
+     The single top-of-tab state element. One row: an icon whose tone conveys
+     urgency (never color alone — a "Action needed" kicker rides the two blocker
+     tones), the one-sentence state + supporting detail, and one primary CTA laid
+     out to the trailing edge (like the paywall gate). Tone is set by
+     renderHero() via [data-tone]. */
+  .publish-hero-region {
+    display: grid;
+    gap: 12px;
+  }
+  .publish-hero {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 16px;
+    flex-wrap: wrap;
+    padding: 14px 16px;
+    border: 1px solid var(--admin-line-strong);
+    border-left-width: 4px;
+    border-radius: var(--admin-radius, 12px);
+    background: var(--admin-surface);
+  }
+  .publish-hero[hidden] {
+    display: none;
+  }
+  .publish-hero-main {
+    display: flex;
+    align-items: center;
+    gap: 13px;
+    min-width: 0;
+  }
+  .publish-hero-icon {
+    flex: none;
+    width: 34px;
+    height: 34px;
+    display: grid;
+    place-items: center;
+    border-radius: 9px;
+    background: var(--admin-surface-soft);
+  }
+  .publish-hero-icon svg {
+    width: 19px;
+    height: 19px;
+  }
+  .publish-hero-copy {
+    display: grid;
+    gap: 2px;
+    min-width: 0;
+  }
+  .publish-hero-kicker {
+    font-size: 10.5px;
+    font-weight: 760;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--admin-red);
+  }
+  .publish-hero-kicker[hidden] {
+    display: none;
+  }
+  .publish-hero-headline {
+    font-size: 15.5px;
+    line-height: 1.3;
+    color: var(--admin-ink);
+  }
+  .publish-hero-detail {
+    font-size: 13px;
+    color: var(--admin-muted);
+    line-height: 1.45;
+  }
+  .publish-hero-detail:empty {
+    display: none;
+  }
+  .publish-hero-actions {
+    flex: none;
+    display: flex;
+    gap: 8px;
+  }
+  .publish-hero-cta[hidden] {
+    display: none;
+  }
+
+  /* Tones — the accent rail + icon colour. Blocker/warn borrow the admin
+     red/amber tokens; ready/attention the teal; calm stays neutral. */
+  .publish-hero[data-tone="blocker"] {
+    border-left-color: var(--admin-red);
+    background: var(--admin-red-soft);
+  }
+  .publish-hero[data-tone="blocker"] .publish-hero-icon svg {
+    color: var(--admin-red);
+  }
+  .publish-hero[data-tone="warn"] {
+    border-left-color: var(--admin-amber);
+    background: var(--admin-surface-soft);
+  }
+  .publish-hero[data-tone="warn"] .publish-hero-icon svg {
+    color: var(--admin-amber);
+  }
+  .publish-hero[data-tone="attention"] {
+    border-left-color: var(--admin-teal, #0f9d8f);
+  }
+  .publish-hero[data-tone="attention"] .publish-hero-icon svg {
+    color: var(--admin-teal, #0f9d8f);
+  }
+  .publish-hero[data-tone="ready"] {
+    border-left-color: var(--admin-green);
+    background: var(--admin-green-soft);
+  }
+  .publish-hero[data-tone="ready"] .publish-hero-icon svg {
+    color: var(--admin-green);
+  }
+  .publish-hero[data-tone="calm"] {
+    border-left-color: var(--admin-line-strong);
+  }
+  .publish-hero[data-tone="calm"] .publish-hero-icon svg {
+    color: var(--admin-green);
+  }
+
+  /* r03 stale-public-site alarm — lays its "Open Live Site" deep-link to the
+     trailing edge, like the paywall gate. Inherits the amber .risk-alert look. */
+  .risk-alert.publish-stale-site {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 12px;
+    flex-wrap: wrap;
+  }
+  .risk-alert.publish-stale-site .btn {
+    flex: none;
+  }
+
+  /* Per-row finding: the ownership-tag chip leads the row's action cell (what's
+     wrong, in operator words), and the mapped action button gets a subtle ring so
+     the operator sees which button resolves it. Tone (red/amber/neutral) rides the
+     shared .chip convention; primed emphasis is added to the EXISTING button. */
+  .publish-actions .publish-finding-chip {
+    vertical-align: middle;
+  }
+
+  .publish-actions .btn.publish-cta-primed {
+    box-shadow: 0 0 0 2px var(--admin-amber);
+  }
+
+  /* ?pr=N deep link: "not in the queue" callout + row flash */
+  .publish-pr-callout {
+    border: 1px solid var(--admin-line-strong);
+    border-left: 3px solid var(--admin-amber);
+    background: var(--admin-surface-soft);
+    padding: 8px 12px;
+    border-radius: var(--admin-radius-sm);
     color: var(--admin-ink);
   }
 
@@ -3127,6 +1769,126 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     margin-top: 16px;
   }
 
+  /* Merge-conflict guidance (outcome phase, reason "merge_failed" only) —
+     directions, not mood: the terminal recovery front and center, the forge's
+     raw refusal kept small underneath for support/diagnosis. Left-aligned
+     inside the centered outcome phase: commands and prose read as
+     instructions, not ceremony. */
+  .liftoff-conflict {
+    margin-top: 10px;
+    text-align: left;
+  }
+
+  .liftoff-commands {
+    margin: 10px 0 8px;
+    padding: 10px 12px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+    font-size: 12px;
+    line-height: 1.55;
+    overflow-x: auto;
+    white-space: pre;
+  }
+
+  .liftoff-conflict-actions {
+    display: flex;
+    justify-content: flex-end;
+    gap: 8px;
+    flex-wrap: wrap;
+  }
+
+  .liftoff-conflict-raw {
+    margin: 10px 0 0;
+    font-size: 11px;
+    color: var(--admin-muted);
+    overflow-wrap: anywhere;
+  }
+
+  /* Automate-first recovery: the primary action leads, option cards appear
+     only on a genuine overlap, the terminal guidance is a collapsed fallback. */
+  .liftoff-conflict-summary {
+    margin: 0 0 10px;
+  }
+  .liftoff-conflict-primary {
+    display: flex;
+    flex-direction: column;
+    align-items: flex-start;
+    gap: 8px;
+    margin-bottom: 12px;
+  }
+  .liftoff-conflict-primary .btn.primary {
+    align-self: flex-start;
+  }
+  .liftoff-conflict-primary-status[data-state="err"],
+  .liftoff-conflict-cards-status[data-state="err"] {
+    color: var(--admin-danger, #b3261e);
+  }
+  .liftoff-conflict-cards {
+    margin: 4px 0 12px;
+    padding: 12px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+  }
+  .liftoff-conflict-files {
+    list-style: none;
+    margin: 8px 0 12px;
+    padding: 8px 10px;
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface, #fff);
+    font-size: 12px;
+    line-height: 1.6;
+    overflow-x: auto;
+  }
+  .liftoff-conflict-card-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+    gap: 8px;
+  }
+  .liftoff-option-card {
+    display: flex;
+    flex-direction: column;
+    gap: 4px;
+    text-align: left;
+    padding: 12px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface, #fff);
+    cursor: pointer;
+    font: inherit;
+    color: inherit;
+  }
+  .liftoff-option-card:hover:not(:disabled) {
+    border-color: var(--admin-accent, #0f9d8f);
+  }
+  .liftoff-option-card:disabled {
+    opacity: 0.55;
+    cursor: default;
+  }
+  .liftoff-option-card[data-recommended="1"] {
+    border-color: var(--admin-accent, #0f9d8f);
+    box-shadow: inset 0 0 0 1px var(--admin-accent, #0f9d8f);
+  }
+  .liftoff-option-card b {
+    font-size: 13px;
+  }
+  .liftoff-option-card span {
+    font-size: 11px;
+    color: var(--admin-muted);
+  }
+  .liftoff-conflict-expert {
+    margin-top: 10px;
+    border-top: 1px solid var(--admin-line, #e5e5e5);
+    padding-top: 8px;
+  }
+  .liftoff-conflict-expert > summary {
+    cursor: pointer;
+    font-size: 12px;
+    color: var(--admin-muted);
+    user-select: none;
+  }
+
   .liftoff-stages {
     list-style: none;
     margin: 6px 0 4px;
@@ -3224,6 +1986,31 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     color: var(--admin-ink);
   }
 
+  /* The shared scrolling live-log console — a "CI build log" window reused across
+     the build / integrate / rebuild / ship flight dialogs. Fixed height, scrolls,
+     newest line auto-scrolled into view by the client (see makeLogConsole). */
+  .stream-log {
+    margin: 10px 0 0;
+    max-height: 150px;
+    overflow-y: auto;
+    padding: 8px 10px;
+    border: 1px solid var(--admin-border, rgba(0, 0, 0, 0.12));
+    border-radius: 8px;
+    background: var(--admin-code-bg, rgba(0, 0, 0, 0.04));
+    font-family: ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, monospace;
+    font-size: 12px;
+    line-height: 1.5;
+    color: var(--admin-ink);
+    -webkit-overflow-scrolling: touch;
+  }
+  .stream-log:empty {
+    display: none;
+  }
+  .stream-log-line {
+    white-space: pre-wrap;
+    word-break: break-word;
+  }
+
   .liftoff-meta {
     display: flex;
     justify-content: space-between;
@@ -3348,7 +2135,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     }
   }
 
-  /* u9: apex-cutover readiness itemization */
+  /* Apex-cutover readiness itemization */
   .domain-readiness {
     margin: 0.75rem 0;
     padding: 0.75rem 1rem;
@@ -3369,14 +2156,19 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     gap: 0.25rem;
   }
   .domain-readiness-list li {
+    display: grid;
+    gap: 0.1rem;
+    font-size: 0.9em;
+  }
+  .domain-readiness-item-head {
     display: flex;
     align-items: baseline;
     gap: 0.4rem;
-    font-size: 0.9em;
   }
   .domain-readiness-mark {
     font-weight: 700;
     width: 1em;
+    flex: 0 0 auto;
   }
   .domain-readiness-list li.ok .domain-readiness-mark {
     color: var(--good, #1a7f37);
@@ -3384,11 +2176,22 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
   .domain-readiness-list li.blocked .domain-readiness-mark {
     color: var(--bad, #b42318);
   }
+  /* detail + remedy sit on their OWN lines, indented under the label (past the
+     mark) so neither runs together with the bold label above it. */
+  .domain-readiness-detail,
+  .domain-readiness-remedy {
+    margin: 0;
+    padding-left: 1.4em;
+  }
   .domain-readiness-detail {
     opacity: 0.75;
   }
+  .domain-readiness-remedy {
+    color: var(--accent, #0b6bcb);
+    opacity: 0.95;
+  }
 
-  /* b11: aggregate card + ship plan */
+  /* Aggregate card + ship plan */
   .aggregate-prs {
     display: grid;
     gap: 6px;
@@ -3404,11 +2207,24 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
 
   .aggregate-prs-list li {
     display: flex;
-    align-items: baseline;
-    gap: 10px;
+    align-items: center;
+    gap: 8px;
     font-size: 13px;
   }
 
+  /* Provenance ("integrated <age> by <email>") sits after the sha, subtle. */
+  .aggregate-pr-meta {
+    font-size: 12px;
+  }
+
+  /* The per-change Undo (revert) button is pushed to the row's trailing edge
+     and kept compact so the batch reads as a list, not a stack of buttons. */
+  .aggregate-prs-list .btn-compact {
+    margin-left: auto;
+    padding: 2px 10px;
+    font-size: 12px;
+  }
+
   .aggregate-plan {
     padding: 0.75rem 1rem;
     border: 1px solid var(--hairline, rgba(0, 0, 0, 0.12));
@@ -3441,12 +2257,612 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     overflow-wrap: anywhere;
   }
 
-  /* dg7: versions + diff */
+  /* ── Preview-aggregate console — the go-live surface ─────────────────────
+     Everything here is scoped under [data-publish-aggregate] / .agg-* so it
+     never leaks into the other panels (candidate queue, versions, branches)
+     that share .panel / .field / .check-row / .chip. */
+  .agg-console .panel-body {
+    gap: 16px;
+  }
+
+  [data-publish-aggregate] .sha-token {
+    display: inline-flex;
+    align-items: center;
+    padding: 2px 8px;
+    border: 1px solid var(--admin-line-strong);
+    border-radius: 5px;
+    background: var(--admin-surface-soft);
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 12.5px;
+    color: var(--admin-ink);
+  }
+  [data-publish-aggregate] .sha-token.ghost {
+    background: transparent;
+    color: var(--admin-muted);
+    border-style: dashed;
+  }
+
+  /* AI-assembled release summary */
+  .agg-summary {
+    display: grid;
+    gap: 11px;
+    padding: 15px 16px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius);
+    background:
+      linear-gradient(180deg, var(--admin-teal-soft), transparent 62%),
+      var(--admin-surface);
+  }
+  .agg-summary[hidden] {
+    display: none;
+  }
+  .agg-summary-head {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+  }
+  .agg-summary-glyph {
+    flex: none;
+    width: 26px;
+    height: 26px;
+    display: grid;
+    place-items: center;
+    border-radius: 7px;
+    background: var(--admin-surface);
+    color: var(--admin-teal-dark);
+    border: 1px solid color-mix(in srgb, var(--admin-teal) 30%, transparent);
+  }
+  /* The sparkle glyphs are filled shapes; opt out of the global stroked-svg rule. */
+  .agg-summary-glyph svg,
+  .agg-ai-chip svg {
+    fill: currentColor;
+    stroke: none;
+  }
+  .agg-summary-glyph svg {
+    width: 15px;
+    height: 15px;
+  }
+  .agg-summary-label {
+    flex: 1;
+    font-size: 11px;
+    font-weight: 760;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--admin-muted);
+  }
+  .agg-ai-chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 5px;
+    padding: 3px 9px;
+    border-radius: 999px;
+    background: var(--admin-teal-soft);
+    color: #007973;
+    font-size: 10px;
+    font-weight: 760;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+  }
+  .agg-ai-chip svg {
+    width: 10px;
+    height: 10px;
+  }
+  .agg-summary-lead {
+    margin: 0;
+    font-size: 15px;
+    line-height: 1.55;
+    color: var(--admin-ink);
+    max-width: 68ch;
+  }
+  .agg-summary-points {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+    display: grid;
+    gap: 7px;
+  }
+  .agg-summary-points[hidden] {
+    display: none;
+  }
+  .agg-summary-points li {
+    display: flex;
+    align-items: flex-start;
+    gap: 9px;
+    font-size: 13px;
+    color: var(--admin-muted);
+    line-height: 1.45;
+  }
+  .agg-summary-points .agg-tick {
+    flex: none;
+    margin-top: 1px;
+    width: 16px;
+    height: 16px;
+    border-radius: 50%;
+    display: grid;
+    place-items: center;
+    background: var(--admin-green-soft);
+    color: var(--admin-green);
+  }
+  .agg-summary-points .agg-tick svg {
+    width: 10px;
+    height: 10px;
+  }
+  .agg-summary-points b {
+    color: var(--admin-ink);
+    font-weight: 640;
+  }
+
+  /* Chain of custody: build → evidence → digest */
+  .agg-chain {
+    display: grid;
+    grid-template-columns: 1fr auto 1fr auto 1fr;
+    align-items: stretch;
+    padding: 16px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius);
+    background: var(--admin-surface-soft);
+  }
+  .agg-stop {
+    display: flex;
+    flex-direction: column;
+    gap: 7px;
+    padding: 2px 12px;
+    min-width: 0;
+  }
+  .agg-stop:first-child {
+    padding-left: 2px;
+  }
+  .agg-stop:last-child {
+    padding-right: 2px;
+  }
+  .agg-stop-label {
+    font-size: 10.5px;
+    font-weight: 760;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--admin-muted);
+  }
+  .agg-stop-val {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    font-size: 15px;
+    font-weight: 680;
+  }
+  .agg-stop-val strong {
+    font-size: 15px;
+  }
+  .agg-stop-cap {
+    margin: 0;
+    font-size: 12px;
+    color: var(--admin-muted);
+    line-height: 1.45;
+  }
+  .agg-stop-cap a {
+    white-space: nowrap;
+  }
+  .agg-digest {
+    padding: 2px 8px;
+    border: 1px solid color-mix(in srgb, var(--admin-teal) 55%, var(--admin-line-strong));
+    border-radius: 5px;
+    background: var(--admin-teal-soft);
+    color: #007973;
+  }
+  [data-publish-aggregate] [data-aggregate-evidence][data-state="passed"] {
+    color: var(--admin-green);
+  }
+  [data-publish-aggregate] [data-aggregate-evidence][data-state="failed"] {
+    color: var(--admin-red);
+  }
+  .agg-link {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    gap: 6px;
+    padding: 0 2px;
+    align-self: center;
+  }
+  .agg-flowlabel {
+    font-size: 9px;
+    font-weight: 720;
+    letter-spacing: 0.06em;
+    text-transform: uppercase;
+    color: var(--admin-muted-2);
+  }
+  .agg-arrow {
+    display: grid;
+    place-items: center;
+    color: var(--admin-teal);
+  }
+  .agg-arrow svg {
+    width: 32px;
+    height: 10px;
+  }
+
+  /* Staged → live delta strip */
+  .agg-delta-strip {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    flex-wrap: wrap;
+    padding: 10px 13px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+  }
+  .agg-delta-strip[hidden] {
+    display: none;
+  }
+  .agg-delta-node {
+    display: flex;
+    flex-direction: column;
+    gap: 3px;
+  }
+  .agg-delta-mid {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    color: var(--admin-teal);
+  }
+  .agg-delta-mid svg {
+    width: 24px;
+    height: 10px;
+  }
+  .agg-delta-count {
+    padding: 2px 9px;
+    border-radius: 999px;
+    background: var(--admin-teal-soft);
+    color: #007973;
+    font-size: 11.5px;
+    font-weight: 720;
+  }
+
+  /* Publish plan → launch manifest */
+  [data-publish-aggregate] .agg-manifest {
+    display: block;
+    padding: 0;
+    overflow: hidden;
+    background:
+      linear-gradient(180deg, var(--admin-surface-tint), transparent 46px),
+      var(--admin-surface);
+  }
+  .agg-manifest-head {
+    padding: 12px 15px;
+    border-bottom: 1px dashed var(--admin-line-strong);
+  }
+  .agg-manifest-head b {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    font-size: 13px;
+  }
+  .agg-manifest-head b svg {
+    width: 15px;
+    height: 15px;
+    color: var(--admin-teal);
+  }
+  [data-publish-aggregate] .agg-manifest .aggregate-plan-grid {
+    padding: 8px 15px 12px;
+  }
+  [data-publish-aggregate] .agg-manifest > .note {
+    margin: 0;
+    padding: 11px 15px;
+    border-top: 1px dashed var(--admin-line-strong);
+    background: var(--admin-surface-soft);
+  }
+
+  /* Openable "Included changes" — reused by the Published Versions "What
+     shipped" per-version disclosure (.ver-changes below); the staged-delta
+     table above no longer uses the <details> wrap itself, only the row/diff
+     classes it shares with changeSummaryItem. */
+  .agg-included-details > summary {
+    list-style: none;
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    padding: 11px 15px;
+    font-size: 12px;
+    color: var(--admin-muted);
+  }
+  .agg-included-details > summary::-webkit-details-marker {
+    display: none;
+  }
+  .agg-included-details > summary::marker {
+    content: "";
+  }
+  .agg-included-details > summary:focus-visible {
+    outline: 2px solid var(--admin-teal);
+    outline-offset: -2px;
+  }
+  .agg-included-lead {
+    font-size: 11px;
+    font-weight: 740;
+    letter-spacing: 0.03em;
+    text-transform: uppercase;
+    color: var(--admin-ink);
+  }
+  .agg-included-badge {
+    padding: 1px 8px;
+    border-radius: 999px;
+    background: var(--admin-surface-tint);
+    color: #3f4d49;
+    font-size: 11.5px;
+    font-weight: 720;
+  }
+  .agg-chev {
+    margin-left: auto;
+    display: inline-flex;
+    color: var(--admin-muted-2);
+    transition: transform 0.18s ease;
+  }
+  .agg-chev svg {
+    width: 14px;
+    height: 14px;
+  }
+  .agg-included-details[open] > summary .agg-chev {
+    transform: rotate(90deg);
+  }
+  @media (prefers-reduced-motion: reduce) {
+    .agg-chev {
+      transition: none;
+    }
+  }
+  .agg-included-list {
+    list-style: none;
+    margin: 0;
+    padding: 0 15px 14px;
+    display: grid;
+    gap: 8px;
+  }
+  .agg-included-item {
+    display: grid;
+    gap: 5px;
+    padding: 11px 12px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+  }
+  .agg-included-top {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    flex-wrap: wrap;
+  }
+  .agg-included-pr {
+    font-weight: 720;
+    font-size: 13px;
+  }
+  .agg-included-title {
+    font-weight: 600;
+    font-size: 13.5px;
+  }
+  .agg-included-desc {
+    margin: 0;
+    color: var(--admin-muted);
+    font-size: 12.5px;
+    line-height: 1.5;
+  }
+  .agg-included-meta {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    flex-wrap: wrap;
+    color: var(--admin-muted-2);
+    font-size: 11.5px;
+  }
+  .agg-included-meta > span + span::before {
+    content: "·";
+    padding-right: 6px;
+    color: var(--admin-line-strong);
+  }
+  .agg-included-meta .sha-token {
+    font-size: 11px;
+    padding: 1px 6px;
+  }
+
+  /* Published-versions "what shipped": the release summary lead + openable
+     per-change list, inline in the Version cell. Reuses the .agg-included-*
+     item markup; only the container chrome is retuned for a table cell. */
+  .ver-summary {
+    margin: 6px 0 0;
+    color: var(--admin-muted);
+    font-size: 12.5px;
+    line-height: 1.5;
+    max-width: 48ch;
+  }
+  .ver-changes {
+    margin-top: 8px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface-soft);
+  }
+  .ver-changes > summary {
+    padding: 8px 10px;
+  }
+  .ver-changes .agg-included-list {
+    padding: 0 10px 10px;
+  }
+
+  /* Branch-retention "what this branch changes": the PR title + one-line
+     description + scope meta, inline under the branch ref. */
+  .branch-pr-title {
+    margin: 6px 0 0;
+    font-weight: 600;
+    font-size: 13px;
+    color: var(--admin-ink);
+    max-width: 46ch;
+  }
+  .branch-pr-desc {
+    margin: 3px 0 0;
+    color: var(--admin-muted);
+    font-size: 12.5px;
+    line-height: 1.5;
+    max-width: 46ch;
+  }
+  .branch-pr-meta {
+    margin-top: 5px;
+  }
+  .branch-pr-ai {
+    color: var(--admin-teal-dark);
+    font-weight: 640;
+  }
+
+  /* Scope-of-change: lines added/removed (green/red), + the top-level readout */
+  .agg-lines {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-variant-numeric: tabular-nums;
+    white-space: nowrap;
+  }
+  .agg-add {
+    color: var(--admin-green);
+  }
+  .agg-del {
+    color: var(--admin-red);
+  }
+
+  /* "View diff" disclosure for a trivial change (the diff IS its summary). */
+  .agg-diff {
+    margin-top: 2px;
+  }
+  .agg-diff > summary {
+    cursor: pointer;
+    font-size: 11.5px;
+    font-weight: 640;
+    color: var(--admin-teal-dark);
+    width: max-content;
+  }
+  .agg-diff[open] > summary {
+    margin-bottom: 6px;
+  }
+  .agg-diff-file {
+    margin-top: 6px;
+  }
+  .agg-diff-path {
+    font-size: 11px;
+    color: var(--admin-muted);
+    margin-bottom: 3px;
+  }
+  .agg-diff-patch {
+    margin: 0;
+    padding: 8px 10px;
+    border: 1px solid var(--admin-line);
+    border-radius: var(--admin-radius-sm);
+    background: var(--admin-surface);
+    font-size: 11.5px;
+    line-height: 1.5;
+    overflow-x: auto;
+    white-space: pre;
+  }
+  .agg-diff-add {
+    color: var(--admin-green);
+    background: var(--admin-green-soft);
+  }
+  .agg-diff-del {
+    color: var(--admin-red);
+    background: var(--admin-red-soft);
+  }
+  .agg-diff-hunk {
+    color: var(--admin-muted-2);
+  }
+
+  .agg-staged-head {
+    display: flex;
+    align-items: baseline;
+    justify-content: space-between;
+    gap: 12px;
+    flex-wrap: wrap;
+  }
+  .agg-scope {
+    display: inline-flex;
+    align-items: center;
+    gap: 8px;
+    padding: 3px 10px;
+    border: 1px solid var(--admin-line);
+    border-radius: 999px;
+    background: var(--admin-surface-soft);
+    font-size: 11.5px;
+    color: var(--admin-ink);
+  }
+  .agg-scope[hidden] {
+    display: none;
+  }
+  .agg-scope > span + span::before {
+    content: "·";
+    padding-right: 8px;
+    color: var(--admin-line-strong);
+  }
+  .agg-scope-label {
+    font-size: 10px;
+    font-weight: 760;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--admin-muted);
+  }
+  .agg-scope-partial {
+    color: var(--admin-muted-2);
+    font-style: italic;
+    cursor: help;
+  }
+
+  /* Publish action — stack the copy above a full-width, weighted CTA */
+  [data-publish-aggregate] .agg-launch {
+    display: grid;
+    grid-template-columns: 1fr;
+    gap: 12px;
+    padding: 14px 0 2px;
+  }
+  /* Extra selector weight so the gradient/shadow beat the .btn.primary base. */
+  [data-publish-aggregate] .btn.agg-publish-btn {
+    width: 100%;
+    justify-content: center;
+    min-height: 50px;
+    gap: 9px;
+    font-size: 15px;
+    border-radius: var(--admin-radius-sm);
+    background: linear-gradient(178deg, var(--admin-teal), var(--admin-teal-dark));
+    box-shadow: 0 8px 22px color-mix(in srgb, var(--admin-teal) 26%, transparent);
+  }
+  .agg-publish-btn svg {
+    width: 18px;
+    height: 18px;
+  }
+  [data-publish-aggregate] .btn.agg-publish-btn:not(:disabled):hover {
+    filter: brightness(1.05);
+  }
+  [data-publish-aggregate] .btn.agg-publish-btn:disabled {
+    background: var(--admin-surface-tint);
+    border-color: var(--admin-line-strong);
+    color: var(--admin-muted);
+    box-shadow: none;
+    cursor: not-allowed;
+  }
+
+  @media (max-width: 760px) {
+    .agg-chain {
+      grid-template-columns: 1fr;
+      gap: 4px;
+    }
+    .agg-link {
+      flex-direction: row;
+      gap: 10px;
+      padding: 4px 12px;
+    }
+    .agg-link .agg-arrow svg {
+      transform: rotate(90deg);
+    }
+    .agg-stop {
+      padding: 8px 2px;
+    }
+  }
+
+  /* Versions + diff */
   .versions-table {
     min-width: 780px;
   }
 
-  /* rux6: unified review pane */
+  /* Unified review pane */
   .publish-review-cell {
     padding: 12px 14px;
     background: var(--admin-surface-soft);