@tokenoftrust/storefront-runner 1.4.1 → 2.0.0

package/apps/storefront/src/lib/publish/adminPublishTab.ts

@@ -0,0 +1,4625 @@
+/**
+ * Client island for the admin Publish tab (`components/admin/AdminPublishTab.astro`).
+ *
+ * The tab's template exposes every runtime endpoint + capability flag as `data-*`
+ * attributes on `#publish`; this module reads them and wires the queue, aggregate,
+ * versions, branch-retention, and domain panels — the whole go-live surface. It runs
+ * from a PROCESSED `<script>` (Astro bundles + type-checks it), so the pure logic it
+ * used to hand-mirror inline is imported from its tested source of truth instead of
+ * duplicated (see docs/architecture/decisions/0013-client-island-pattern-and-inline-drift-guard.md).
+ */
+import { createKeyedCache, createCoalescer } from "@/lib/publish/panelPolling";
+import {
+  shortSha,
+  shortDigest,
+  age,
+  linesNode,
+  chip,
+  cell,
+  subtle,
+  changeSummaryItem,
+} from "@/lib/publish/publishFormat";
+import { candidatePrUrl } from "@/lib/preview/candidateDashboard";
+import { currentPreviewUrl } from "@/lib/preview/tenantPreview";
+import { classifyResolveResponse } from "@/lib/change/views/resolve-conflict";
+import { mergeHealthBanner } from "@/lib/publish/mergeHealthBanner";
+import { mergeRowFindings, mergeRowKey } from "@/lib/publish/mergeRowFindings";
+import { mergeSupportEscalation } from "@/lib/publish/mergeSupportEscalation";
+// C5 — the doctor PUSH: on a failed accept/integrate or a refused ship, reduce the
+// SAME /api/changes payload to the one-line diagnosis and append it where the failure
+// already surfaced (so the developer doesn't have to go read the banner/chips).
+import { integrateFailureDoctor, shipFailureDoctor } from "@/lib/publish/mergeDoctorOnFailure";
+// Real-time build/check streaming: pure SSE parsing + progress reduction + copy text.
+import {
+  BUILD_STAGES,
+  parseSseChunk,
+  reduceBuildProgress,
+  initialBuildProgress,
+  buildFailureDetail,
+  assembleBuildFailureCopy,
+  type BuildProgress,
+  type BuildResult,
+} from "@/lib/publish/buildStream";
+// The SHARED scrolling live-log console reused across build/integrate/rebuild/ship:
+// pure phase→line formatting + terminal-line extraction (DOM glue verified live).
+import {
+  logLineForPhase,
+  terminalLogLine,
+  type StreamTerminalResult,
+} from "@/lib/publish/streamLogConsole";
+// Fail-visible, never fail-silent: pure state-derivation for the publish lifecycle.
+// classifyIntegrateOutcome derives an integrate attempt's HONEST result from the
+// actual merge/build signals (killing the false "Integration did not land");
+// classifyBuildLink withholds a rev deep-link that would 404 on an unbuilt sha.
+import {
+  classifyIntegrateOutcome,
+  classifyBuildLink,
+  type IntegrateOutcomeView,
+} from "@/lib/publish/lifecycleState";
+// r01 — the SINGLE "next action" hero state machine. Reduces the same
+// /api/changes read (queue count + merge health B1 + escalation B3 + ship plan)
+// into ONE sentence + ONE CTA; folds the two former standalone banners in.
+import { publishHeroState } from "@/lib/publish/publishHero";
+import { computePublishGuard } from "@/lib/publish/publish-guard";
+import { liveReleaseSummaryState } from "@/lib/publish/liveReleaseSummary";
+// r05 — per-store persistence of each collapsible section's open/closed state.
+import {
+  readPersistedOpen,
+  writePersistedOpen,
+  type CollapseSectionId,
+} from "@/lib/publish/collapsePersistence";
+
+export function initAdminPublishTab(): void {
+    const root: any = document.getElementById("publish");
+    if (!root) return;
+    const ds = root.dataset;
+    const canShip = ds.canShip === "true";
+    const repo = ds.repo || "";
+    const appDomain = ds.appDomain || "";
+    const publicSiteHost = ds.publicSiteHost || "";
+
+    // r08 — shareable, view-only `?__preview` capability links an owner can hand to
+    // a non-technical stakeholder (no sign-in). The token is minted server-side
+    // (see AdminPublishTab.astro) and rides in on `data-preview-share-token`; empty
+    // when signing isn't configured, in which case the copy affordances stay hidden.
+    // ONE token authorizes both the shared next-release preview and per-candidate
+    // links (it claims the tenant_id both verifiers accept).
+    const previewShareToken = ds.previewShareToken || "";
+    const canonicalDomain = ds.canonicalDomain || "";
+    // The shared preview channel = the next-release aggregate build.
+    const sharedPreviewUrl = (): string | null =>
+      previewShareToken && canonicalDomain
+        ? currentPreviewUrl(window.location.origin, canonicalDomain, previewShareToken)
+        : null;
+    // A single candidate PR's preview (the friendly `/preview/pr/<N>` alias, which
+    // accepts the same tenant-scoped token for a session-less viewer).
+    const candidatePreviewShareUrl = (prNumber?: any): string | null => {
+      if (!previewShareToken || prNumber == null) return null;
+      const path = candidatePrUrl(appDomain, prNumber);
+      return path
+        ? window.location.origin + path + "?__preview=" + encodeURIComponent(previewShareToken)
+        : null;
+    };
+    // Copy `url` and flash a brief "Copied" on the button's label element (icon+text
+    // stays intact — accessible, never color-only). Clipboard denial is silent (the
+    // link is selectable text on failure).
+    const copyPreviewLink = (url: string | null, labelEl?: any, restore = "Copy preview link") => {
+      if (!url || !labelEl) return;
+      navigator.clipboard.writeText(url).then(
+        () => {
+          labelEl.textContent = "Copied";
+          setTimeout(() => { labelEl.textContent = restore; }, 1600);
+        },
+        () => { /* clipboard denied — the link is selectable text */ },
+      );
+    };
+    // Build an inline `#i-copy` icon (matches the SSR sprite-`use` convention).
+    const copyIcon = (): SVGSVGElement => {
+      const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+      const use = document.createElementNS("http://www.w3.org/2000/svg", "use");
+      use.setAttribute("href", "#i-copy");
+      svg.append(use);
+      return svg;
+    };
+
+    const statusEl = root.querySelector("[data-publish-status]");
+    const queueBody = root.querySelector("[data-publish-queue-body]");
+    const queueChip = root.querySelector("[data-publish-queue-chip]");
+    const queueCount = root.querySelector("[data-publish-queue-count]");
+    // "See all" closed/rejected history (§ see-all-rejected).
+    const closedPanel = root.querySelector("[data-publish-closed-panel]");
+    const closedBody = root.querySelector("[data-publish-closed-body]");
+    const closedChip = root.querySelector("[data-publish-closed-chip]");
+    const degradedStrip = root.querySelector("[data-publish-degraded]");
+    // r01: the SINGLE state hero. Folds in what used to be two standalone banners
+    // — the merge-doctor health summary (B1) and the platform-fault escalation
+    // (B3) — plus the queue count + ship plan, into one sentence + one CTA.
+    // Toggled by renderHero() off the same /api/changes read.
+    const heroEl = root.querySelector("[data-publish-hero]");
+    const heroIconEl = root.querySelector("[data-publish-hero-icon]");
+    const heroKickerEl = root.querySelector("[data-publish-hero-kicker]");
+    const heroHeadlineEl = root.querySelector("[data-publish-hero-headline]");
+    const heroDetailEl = root.querySelector("[data-publish-hero-detail]");
+    const heroCtaEl = root.querySelector("[data-publish-hero-cta]");
+    const heroCtaLinkEl = root.querySelector("[data-publish-hero-cta-link]");
+
+    // rux7 — in-flight UI state the auto-refresh poll must preserve across a
+    // re-render. These are the AUTHORITATIVE source of truth (never scraped
+    // back out of the DOM): an action's async closure holds a reference to the
+    // OLD button, so after a poll swaps the row the completion signal lands on a
+    // detached node — reading `disabled`/`data-building` off the fresh DOM would
+    // wedge forever. buildPreview/integrate/reject add on start and
+    // delete in `finally` (before their own loadQueue), so the next render
+    // reflects the true busy set. Open diff panes are the exception: the DOM IS
+    // their source of truth (toggleDiff owns open/close), so renderQueue detaches
+    // and re-attaches the actual pane node — see renderQueue.
+    const inflightBuilds = new Set(); // prNumber currently building
+    const busyChanges = new Set(); // changeId with an in-flight integrate/reject
+    let aggregatePublishing = false; // the aggregate Publish POST is in flight
+    let aggregateRetrying = false; // u15: the aggregate Retry-build POST is in flight
+
+
+    // A fingerprint of the current publish state (candidate head shas + live
+    // version), updated on every /api/changes read. Heavy panels key their
+    // client cache on it: unchanged fingerprint ⇒ no re-fetch. See changesSignature.
+    let currentStateKey: string | null = null;
+
+    // Visibility state, driven by an IntersectionObserver (see Wiring). Panels
+    // don't fetch until first viewed, and the queue poll only runs while the tab
+    // is active — a backgrounded/inactive Publish tab must not fire heavy reads.
+    let tabActive = false;
+    let branchesVisible = false;
+
+    const setStatus = (el?: any, message?: any, state?: any) => {
+      if (!el) return;
+      el.textContent = message || "";
+      if (state) el.dataset.state = state;
+      else delete el.dataset.state;
+    };
+
+    // r12 — a status chip must read as icon + TEXT, never colour alone. The leading
+    // glyph is keyed by tone so every chip across the console speaks one visual
+    // language: ✓ good, ⚠ needs-attention, ✕ failed, • neutral/in-progress.
+    const CHIP_GLYPH: Record<string, string> = {
+      green: "✓",
+      teal: "✓",
+      amber: "⚠",
+      red: "✕",
+      blue: "•",
+      "": "•",
+    };
+    // Repaint an EXISTING chip element (SSR-rendered, re-used across polls) with a
+    // state word + tone + a leading glyph — the in-place analogue of publishFormat's
+    // `chip()` node builder, for the chips that live in the template rather than being
+    // created per render.
+    const paintChip = (el?: any, text?: string, tone?: string, glyph?: string) => {
+      if (!el) return;
+      el.className = "chip" + (tone ? " " + tone : "");
+      el.textContent = "";
+      if (glyph) {
+        const g = document.createElement("span");
+        g.className = "chip-glyph";
+        g.setAttribute("aria-hidden", "true");
+        g.textContent = glyph;
+        el.append(g);
+      }
+      el.append(document.createTextNode(text ?? ""));
+    };
+
+    // C5 — the doctor PUSH (admin side). On a failed accept/integrate or a refused
+    // ship, fetch the freshest /api/changes and, IF the merge-doctor has an opinion on
+    // this failure, append its one-line diagnosis to the failure's own outcome copy —
+    // so the developer sees WHY right where it failed, not only in the top-of-tab
+    // banner / row chips. Best-effort throughout: it never throws and never alters the
+    // action's outcome/status/exit path. `hintFor` runs the SAME pure analyzer the
+    // banner + row chips use (no new endpoint). `sinks` are elements to append to (the
+    // liftoff/shipoff outcome detail — stable, unlike statusEl which loadQueue rewrites).
+    const appendDoctorText = (el?: any, text?: string) => {
+      if (!el || !text) return;
+      const base = (el.textContent || "").trim();
+      el.textContent = base ? base + "  " + text : text;
+    };
+    const surfaceDoctorHint = (
+      hintFor: (payload: any) => { show: boolean; text: string },
+      sinks: any[],
+    ) => {
+      void (async () => {
+        try {
+          const res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
+          if (!res.ok) return;
+          const hint = hintFor(await res.json());
+          if (!hint.show) return;
+          for (const el of sinks) appendDoctorText(el, hint.text);
+        } catch { /* best-effort — the failure's own copy already stands */ }
+      })();
+    };
+
+    // ── The SHARED scrolling live-log console ─────────────────────────────────
+    // ONE "CI build log" panel, reused across all four long-running flows
+    // (build/integrate/rebuild/ship). `makeLogConsole` binds it to a scrollable
+    // `<div data-*-log>`; `reset()` clears + stamps the clock start, `pushEvent`
+    // appends one timestamped human line per server `phase` event (auto-scrolled
+    // to the bottom), and `finish` appends the terminal ✓/✗ line. Pure formatting
+    // lives in the tested streamLogConsole.ts; this is the DOM glue only.
+    const makeLogConsole = (logEl?: any) => {
+      let startedAt = Date.now();
+      const append = (line?: string | null) => {
+        if (!logEl || !line) return;
+        const div = document.createElement("div");
+        div.className = "stream-log-line";
+        div.textContent = line;
+        logEl.appendChild(div);
+        logEl.scrollTop = logEl.scrollHeight; // keep the newest line in view
+      };
+      return {
+        reset() {
+          startedAt = Date.now();
+          if (logEl) logEl.textContent = "";
+        },
+        pushEvent(ev: { event: string; data: string }) {
+          append(logLineForPhase(ev, Date.now() - startedAt));
+        },
+        finish(result: StreamTerminalResult) {
+          append(terminalLogLine(result, Date.now() - startedAt).line);
+        },
+      };
+    };
+    type LogConsole = ReturnType<typeof makeLogConsole>;
+
+    // Consume a streamed (SSE) or buffered (JSON) response uniformly. In stream
+    // mode each `phase` event feeds the shared log console + the optional `onPhase`
+    // (a flow's own stage-rail), and the terminal `result` event's payload is
+    // returned; in JSON mode (a buffering proxy, or a non-streaming server) the whole
+    // body is read once and treated as that terminal payload — so every flow completes
+    // honestly either way. Never throws for a well-formed response; the caller keeps
+    // its own try/catch for network faults. `res.ok`/`res.status` stay authoritative
+    // for the caller (a stream is always HTTP 200; the route front-loads its non-2xx
+    // auth/validation refusals as plain JSON BEFORE any stream).
+    const streamWithLog = async (
+      res: any,
+      logc?: LogConsole | null,
+      onPhase?: (ev: { event: string; data: string }) => void,
+    ): Promise<{ data: any }> => {
+      const ct = res.headers.get("content-type") || "";
+      if (res.body && ct.indexOf("text/event-stream") !== -1) {
+        const reader = res.body.getReader();
+        const decoder = new TextDecoder();
+        let buf = "";
+        let terminal: any = undefined;
+        for (;;) {
+          const { value, done } = await reader.read();
+          if (done) break;
+          buf += decoder.decode(value, { stream: true });
+          const parsed = parseSseChunk(buf);
+          buf = parsed.rest;
+          for (const ev of parsed.events) {
+            if (ev.event === "phase") {
+              if (logc) logc.pushEvent(ev);
+              if (onPhase) onPhase(ev);
+            } else if (ev.event === "result") {
+              try { terminal = JSON.parse(ev.data); } catch { terminal = {}; }
+              if (logc) logc.finish(terminal);
+            }
+          }
+        }
+        return { data: terminal ?? {} };
+      }
+      const data = await res.json().catch(() => ({}));
+      if (logc) logc.finish(data);
+      return { data };
+    };
+
+
+    const STATUS_CHIP: Record<string, string> = {
+      queued: "",
+      reconciling: "blue",
+      ready: "green",
+      blocked: "red",
+    };
+    // r04 — humanize the raw candidate-status word for the queue chip. The raw
+    // status still drives all logic; only the displayed label is merchant-facing
+    // (dev words like "reconciling" never reach the operator).
+    const STATUS_LABEL: Record<string, string> = {
+      queued: "Waiting",
+      reconciling: "Checking",
+      ready: "Ready",
+      blocked: "Needs attention",
+    };
+
+    // ---- ?pr=N deep link ---------------------------------------------------
+    // A deep link like /admin#publish?pr=42 asks us to surface a specific PR's
+    // row once the queue has loaded. The param rides in the hash fragment
+    // (after the tab anchor) because that's how the admin shell routes tabs;
+    // fall back to a real query string too. Resolve exactly once — so the
+    // scroll/highlight never re-fires on the reloads that follow every ship
+    // action — and until it resolves, keep an honest "not in the queue yet"
+    // callout up rather than silently doing nothing.
+
+    const readRequestedPr = () => {
+      const hash = window.location.hash || "";
+      const q = hash.indexOf("?");
+      let raw = new URLSearchParams(q >= 0 ? hash.slice(q + 1) : "").get("pr");
+      if (raw == null) raw = new URLSearchParams(window.location.search).get("pr");
+      if (raw == null) return null;
+      const n = Number.parseInt(raw, 10);
+      return Number.isInteger(n) && n > 0 ? n : null;
+    };
+
+    const requestedPr = readRequestedPr();
+    let prDeeplinkResolved = false;
+
+    const applyPrDeeplink = () => {
+      if (requestedPr == null || prDeeplinkResolved) return;
+      const callout = root.querySelector("[data-publish-pr-callout]");
+      const row = queueBody.querySelector('tr[data-pr-number="' + requestedPr + '"]');
+      if (!row) {
+        if (callout) {
+          callout.hidden = false;
+          callout.textContent = "PR #" + requestedPr + " isn't in the queue yet.";
+        }
+        return;
+      }
+      prDeeplinkResolved = true;
+      if (callout) {
+        callout.hidden = true;
+        callout.textContent = "";
+      }
+      row.scrollIntoView({ block: "center", behavior: "smooth" });
+      row.classList.remove("publish-row-highlight");
+      void row.offsetWidth; // restart the flash animation if re-applied
+      row.classList.add("publish-row-highlight");
+      window.setTimeout(() => row.classList.remove("publish-row-highlight"), 2600);
+    };
+
+    // ---- Open change queue -------------------------------------------------
+
+    // r01: the SINGLE state hero. Computed from the SAME /api/changes payload the
+    // queue + aggregate already have — no duplicate read. It folds in the merge-
+    // doctor health summary (B1, mergeHealthBanner) and the platform-fault
+    // escalation (B3, mergeSupportEscalation), plus the queue count and ship plan,
+    // and expresses whichever is the most urgent true state as one sentence + one
+    // CTA (publishHeroState orders the precedence). There is no separate B1/B3
+    // banner any more — a conflict/platform blocker turns THIS element red/urgent.
+    const HERO_ICON: Record<string, string> = {
+      blocker: "#i-alert",
+      warn: "#i-alert",
+      attention: "#i-box",
+      ready: "#i-export",
+      calm: "#i-check",
+    };
+    const scrollToPanel = (sel: string) => {
+      const el = document.getElementById(sel);
+      if (el) el.scrollIntoView({ block: "start", behavior: "smooth" });
+    };
+    const renderHero = (data?: any) => {
+      if (!heroEl) return;
+      const payload = data || {};
+      const changes = Array.isArray(payload.changes) ? payload.changes : [];
+      const agg = payload.aggregate || null;
+      const stagedSha = agg && agg.aggregateSha;
+      const liveId = payload.current && payload.current.versionId;
+      const view = publishHeroState({
+        changeCount: changes.length,
+        health: mergeHealthBanner(payload),
+        escalation: mergeSupportEscalation(payload),
+        plan: payload.plan || null,
+        aheadCount: (agg && agg.includedPrs ? agg.includedPrs.length : 0),
+        matchesLive: Boolean(stagedSha && liveId && stagedSha === liveId),
+        canShip,
+        publicSiteHost,
+      });
+
+      (heroEl as any).dataset.tone = view.tone;
+      if (heroIconEl) {
+        const use = heroIconEl.querySelector("use");
+        if (use) use.setAttribute("href", HERO_ICON[view.tone] || "#i-check");
+      }
+      if (heroKickerEl) (heroKickerEl as any).hidden = !view.urgent;
+      if (heroHeadlineEl) heroHeadlineEl.textContent = view.headline;
+      if (heroDetailEl) heroDetailEl.textContent = view.detail;
+
+      // ONE CTA: a mailto link for the "report to support" escalation, a button
+      // for every in-page action, nothing for the calm caught-up state.
+      const cta = view.cta;
+      if (cta.kind === "report-support") {
+        if (heroCtaEl) (heroCtaEl as any).hidden = true;
+        if (heroCtaLinkEl) {
+          heroCtaLinkEl.textContent = cta.label;
+          if (cta.href) heroCtaLinkEl.setAttribute("href", cta.href);
+          (heroCtaLinkEl as any).hidden = false;
+        }
+      } else {
+        if (heroCtaLinkEl) (heroCtaLinkEl as any).hidden = true;
+        if (heroCtaEl) {
+          if (cta.kind === "none") {
+            (heroCtaEl as any).hidden = true;
+            (heroCtaEl as any).onclick = null;
+          } else {
+            heroCtaEl.textContent = cta.label;
+            (heroCtaEl as any).hidden = false;
+            (heroCtaEl as any).onclick = () => {
+              if (cta.kind === "publish") publishAggregate(heroCtaEl);
+              else if (cta.kind === "review-queue") scrollToPanel("publish-queue");
+              else if (cta.kind === "goto-release") scrollToPanel("publish-next-release");
+            };
+          }
+        }
+      }
+      (heroEl as any).hidden = false;
+    };
+
+    // B2: per-row merge-doctor finding. Reads THIS row's dominant finding out of
+    // the map computed once per render (mergeRowFindings over the same payload the
+    // queue already holds — no extra fetch, no per-row analysis) and renders its
+    // ownership tag as a chip. When the finding carries an action it LIGHTS UP the
+    // row's EXISTING mapped button (resolve → the conflict-recovery button, build/
+    // retry → the build button) via a "primed" class + the remedy as its tooltip —
+    // it does NOT re-declare the API call. A finding with no inline button to prime
+    // (e.g. a promotable-yet-stalled platform retry) gets a fallback CTA that still
+    // calls the SAME existing action function. An informational finding (action:
+    // null) shows the chip only; a healthy row has no finding, so no chip.
+    const rowFindingFor = (findings: any, change: any) => {
+      const byChange =
+        change.changeId != null ? findings.get(mergeRowKey(change.changeId, null)) : undefined;
+      return (
+        byChange ||
+        (change.prNumber != null ? findings.get(mergeRowKey(null, change.prNumber)) : undefined)
+      );
+    };
+
+    const applyRowFinding = (actionsCell: any, change: any, findings: any, buttons: any = {}) => {
+      const finding = rowFindingFor(findings, change);
+      if (!finding) return;
+      const tag = chip(finding.ownershipLabel, finding.tone);
+      tag.classList.add("publish-finding-chip");
+      tag.title = finding.detail;
+      actionsCell.prepend(tag);
+      if (!finding.cta) return; // informational-only diagnosis — chip, no button
+      const mapped = finding.cta.kind === "resolve" ? buttons.resolve : buttons.build;
+      if (mapped) {
+        mapped.classList.add("publish-cta-primed");
+        mapped.title = finding.remedy;
+        return;
+      }
+      // No inline button maps to this finding — add a CTA that reuses the SAME
+      // existing action function (never a re-declared fetch). Only when the viewer
+      // can actually ship; otherwise the chip alone diagnoses it (the row already
+      // carries a sign-in hint), never a dead disabled duplicate.
+      if (!canShip) return;
+      const cta = document.createElement("button");
+      cta.type = "button";
+      cta.className = "btn publish-cta-primed";
+      cta.textContent = finding.cta.label;
+      cta.title = finding.remedy;
+      cta.addEventListener("click", () =>
+        finding.cta.kind === "resolve"
+          ? openConflictRecovery(change, cta)
+          : buildPreview(change, cta),
+      );
+      actionsCell.append(cta);
+    };
+
+    const renderQueue = (payload?: any) => {
+      const changes = Array.isArray(payload.changes) ? payload.changes : [];
+      const rowFindings = mergeRowFindings(payload);
+      // Ledger truth (fb-1787916141762-owjzis): which changes are ALREADY integrated
+      // into the staged aggregate, read straight from aggregate.includedPrs (the
+      // ledger), DECOUPLED from any per-row mergeable/rebuild signal. A change in
+      // this set has merged; its row must never offer conflict-recovery (which would
+      // try to refresh an already-merged candidate and error "No open candidate").
+      const stagedChangeIds = new Set<string>();
+      const stagedPrNumbers = new Set<number>();
+      for (const p of (payload.aggregate && payload.aggregate.includedPrs) || []) {
+        if (p && typeof p.changeId === "string") stagedChangeIds.add(p.changeId);
+        if (p && typeof p.prNumber === "number") stagedPrNumbers.add(p.prNumber);
+      }
+      const isIntegrated = (change: any) =>
+        stagedChangeIds.has(change.changeId) ||
+        (change.prNumber != null && stagedPrNumbers.has(change.prNumber));
+      // A change already staged into the next release has, by that act, been
+      // APPROVED — this panel asks "What needs your approval?", so it must not list
+      // it. It reappears here only if it's pulled back out of the next release (the
+      // "Next release" panel below owns that Undo/revert). So the review queue shows
+      // only changes NOT yet in the aggregate; the integrated ones live in "Next
+      // release". (Full `changes` is still used for the top "Open changes" metric,
+      // which counts everything waiting for review OR go-live.)
+      const pending = changes.filter((change: any) => !isIntegrated(change));
+      // rux1: surface a forge-listing failure as a visible strip — never let a
+      // degraded (short) list read as a genuine empty queue.
+      if (degradedStrip) degradedStrip.hidden = payload.degraded !== true;
+      queueBody.textContent = "";
+      if (queueCount) queueCount.textContent = String(changes.length);
+      if (queueChip) {
+        queueChip.textContent = pending.length === 1 ? "1 open" : pending.length + " open";
+        queueChip.className = "chip" + (pending.length ? " blue" : "");
+      }
+
+      if (!pending.length) {
+        const tr = document.createElement("tr");
+        // Distinguish "nothing here at all" from "everything open is already added" —
+        // the latter is the common state once a merchant has staged their changes, and
+        // "No changes waiting" would read as if their work vanished.
+        const td = cell(
+          subtle(
+            changes.length
+              ? "Nothing waiting for your approval — every open change is already in your next " +
+                  "release (see below). Pull one back out there if you want to review it again."
+              : "No changes waiting. Make an edit in your store and submit it — it'll show up here to " +
+                  "review and add to your next release.",
+          ),
+        );
+        td.colSpan = 6;
+        tr.append(td);
+        queueBody.append(tr);
+        return;
+      }
+
+      for (const change of pending) {
+        const tr = document.createElement("tr");
+        if (change.prNumber != null) tr.dataset.prNumber = String(change.prNumber);
+
+        // Change id + branch / PR + preview link.
+        const idCell = document.createElement("td");
+        const idStrong = document.createElement("strong");
+        idStrong.textContent = change.changeId || "—";
+        idCell.append(idStrong);
+        const meta = [];
+        if (change.branch) meta.push(change.branch);
+        if (change.prNumber != null) meta.push("PR #" + change.prNumber);
+        if (meta.length) idCell.append(subtle(meta.join(" · ")));
+        // Owner-facing "who did this" — accept takes priority over submit/build (a
+        // candidate that's been accepted-to-preview is more meaningfully
+        // "acted on" than merely submitted or built). Reject never shows here: a rejected
+        // candidate is closed and has already left the open queue.
+        const actorRecord = change.actors && (change.actors.accept || change.actors.submit || change.actors.build);
+        if (actorRecord) {
+          const label = change.actors.accept
+            ? "Added by "
+            : change.actors.submit
+              ? "Submitted by "
+              : "Built by ";
+          idCell.append(subtle(label + (actorRecord.name || actorRecord.email)));
+        }
+        // Prefer the synthesized friendly per-PR route (handles every state);
+        // fall back to any server-provided previewUrl for change-first rows
+        // that have no PR number yet.
+        const previewUrl = candidatePrUrl(appDomain, change.prNumber) || change.previewUrl;
+        if (previewUrl) {
+          const preview = document.createElement("a");
+          preview.href = previewUrl;
+          preview.target = "_blank";
+          preview.rel = "noopener";
+          preview.textContent = "Open preview";
+          const wrap = document.createElement("span");
+          wrap.className = "subtle";
+          wrap.append(preview);
+          idCell.append(wrap);
+        }
+        // r08: copy a shareable, view-only preview link for THIS candidate to hand
+        // to a non-technical stakeholder (no sign-in). Shown only when a share token
+        // was minted and the row has a PR number to point at.
+        const candidateShareUrl = candidatePreviewShareUrl(change.prNumber);
+        if (candidateShareUrl) {
+          const copyBtn = document.createElement("button");
+          copyBtn.type = "button";
+          copyBtn.className = "btn btn-compact publish-copy-preview";
+          const lbl = document.createElement("span");
+          lbl.textContent = "Copy preview link";
+          copyBtn.append(copyIcon(), lbl);
+          copyBtn.addEventListener("click", () => copyPreviewLink(candidateShareUrl, lbl));
+          const copyWrap = document.createElement("span");
+          copyWrap.className = "subtle";
+          copyWrap.append(copyBtn);
+          idCell.append(copyWrap);
+        }
+        tr.append(idCell);
+
+        // Reconcile status. u13 DISPLAY HONESTY: when the server could not confirm
+        // this row's live state against the forge (liveStateConfirmed === false — the
+        // forge listing failed), its stored label may be stale (e.g. a merged PR still
+        // reads "ready"). Render "State unknown" instead of asserting the stale label
+        // as current fact; keep the last-known label as a subtle, clearly-hedged note.
+        let statusCell;
+        if (change.liveStateConfirmed === false) {
+          statusCell = cell(chip("State unknown", "amber", CHIP_GLYPH.amber));
+          statusCell.append(
+            subtle("Status couldn't be confirmed — last known: " +
+              (STATUS_LABEL[change.status] || change.status || "unknown")),
+          );
+        } else {
+          const tone = STATUS_CHIP[change.status] ?? "amber";
+          statusCell = cell(
+            chip(STATUS_LABEL[change.status] || change.status || "unknown", tone, CHIP_GLYPH[tone]),
+          );
+          if (change.lastError) statusCell.append(subtle(change.lastError));
+        }
+        tr.append(statusCell);
+
+        // Evidence / compliance verdict.
+        const checks = (change.evidence && change.evidence.checks) || [];
+        const failing = checks.filter((c: any) => c.status === "fail");
+        const promotable = Boolean(change.evidence && change.evidence.promotable);
+        const checksCell = cell(
+          promotable
+          ? chip("Checks passed", "green", CHIP_GLYPH.green)
+          : chip("Checks blocked", "amber", CHIP_GLYPH.amber),
+        );
+        if (failing.length) {
+          checksCell.append(subtle("Failing: " + failing.map((c: any) => c.label || c.id).join(", ")));
+        } else if (!checks.length) {
+          checksCell.append(subtle("No checks reported yet"));
+        }
+        tr.append(checksCell);
+
+        // Head sha + age.
+        const headCell = cell(shortSha(change.headSha));
+        headCell.classList.add("publish-mono");
+        tr.append(headCell);
+        tr.append(cell(age(change.updatedAt)));
+
+        // Actions.
+        const actions = document.createElement("td");
+        actions.className = "action publish-actions";
+
+        // A synthetic not-built forge PR can be reviewed at the lifecycle level
+        // without paying to materialize it. Candidate-shaped branches carry a
+        // derived changeId, so the operator may Reject immediately; Build preview
+        // remains available when visual review is useful.
+        if (change.built === false || change.status === "not-built") {
+          let notBuiltBuild: any;
+          if (canShip) {
+            const build = document.createElement("button");
+            build.type = "button";
+            build.className = "btn primary";
+            build.title = "Materialize this PR's hosted preview on demand (does not go live)";
+            // rux7: if a build for this PR is mid-flight, a poll re-render must
+            // reflect the spinner/disabled state (not a fresh clickable button
+            // that would let the operator double-submit). The in-flight closure
+            // re-renders on completion, clearing this.
+            if (change.prNumber != null && inflightBuilds.has(change.prNumber)) {
+              build.textContent = "Building…";
+              build.disabled = true;
+              build.dataset.building = "true";
+            } else {
+              build.textContent = "Build preview";
+            }
+            build.addEventListener("click", () => buildPreview(change, build));
+            actions.append(build);
+            notBuiltBuild = build;
+            if (change.changeId) {
+              const reject = document.createElement("button");
+              reject.type = "button";
+              reject.className = "btn";
+              reject.textContent = "Reject";
+              reject.disabled = busyChanges.has(change.changeId);
+              reject.title = "Close this change without building or publishing it";
+              reject.addEventListener("click", () => rejectChange(change, reject));
+              actions.append(reject);
+            }
+          } else {
+            actions.append(subtle("Owner/admin sign-in required to build or reject"));
+          }
+          applyRowFinding(actions, change, rowFindings, { build: notBuiltBuild });
+          tr.append(actions);
+          queueBody.append(tr);
+          continue;
+        }
+
+        // rux7: while an integrate/reject for this change is in flight,
+        // keep its mutating actions disabled across a poll re-render so the
+        // operator can't double-submit against a freshly-minted button.
+        const changeBusy = busyChanges.has(change.changeId);
+
+        // A candidate that is still waiting for its reconciliation/evidence — or
+        // whose build FAILED (blocked) — has never become eligible for Accept. A
+        // disabled "Accept to preview" is a dead CTA; the safe recovery already
+        // exists at POST /api/preview/build, so make it the primary action: it
+        // re-materializes this exact PR head and re-runs its checks (does not merge
+        // or publish). `blocked` is included so a build-failed candidate keeps a
+        // live "Rebuild" nudge and never sits on a dead end (fail-visible, rule 3).
+        const buildFailed = change.status === "blocked";
+        const needsChecks = !promotable &&
+          (change.status === "queued" || change.status === "reconciling" || buildFailed);
+
+        // rux6 Review: expand the row into a single "review moment" pane —
+        // preview iframe + evidence chips + diff + Accept/Reject — so a reviewer
+        // never leaves the queue. Supersedes the standalone Diff button (the dg7
+        // diff now lives inside the pane, reusing renderDiff). The row's own
+        // Accept/Reject buttons below are unchanged.
+        const reviewBtn = document.createElement("button");
+        reviewBtn.type = "button";
+        reviewBtn.className = "btn";
+        reviewBtn.textContent = "Review";
+        reviewBtn.setAttribute("aria-expanded", "false");
+        reviewBtn.title = "Open one pane to preview, diff, and act on this change";
+        reviewBtn.addEventListener("click", () => toggleReview(change, reviewBtn, tr));
+        actions.append(reviewBtn);
+        let runChecksBuild: any;
+        if (needsChecks) {
+          const build = document.createElement("button");
+          build.type = "button";
+          build.className = "btn primary";
+          build.title = buildFailed
+            ? "This change's preview build failed — rebuild it (re-materializes this PR head and re-runs checks; does not merge or go live)"
+            : "Re-run this PR's preview build and checks (does not merge or go live)";
+          if (change.prNumber != null && inflightBuilds.has(change.prNumber)) {
+            build.textContent = buildFailed ? "Rebuilding…" : "Running checks…";
+            build.disabled = true;
+            build.dataset.building = "true";
+          } else {
+            build.textContent = buildFailed ? "Rebuild" : "Run checks";
+            build.disabled = !canShip || changeBusy;
+          }
+          build.addEventListener("click", () => buildPreview(change, build));
+          actions.append(build);
+          runChecksBuild = build;
+        }
+        // b11 SPLIT: the candidate-queue primary action is now ACCEPT TO PREVIEW
+        // (b08 integrate = advance the shared preview aggregate), NOT go-live.
+        // Integrate flips NO live channel, so it has NO paywall (entitled) gate —
+        // it holds only the ship-on-behalf capability floor. Going live is the
+        // aggregate card's Publish action, once the aggregate is green.
+        const accept = document.createElement("button");
+        accept.type = "button";
+        accept.className = "btn primary";
+        // A ready candidate with passed evidence but `mergeable:false` is a
+        // forge-settled conflict with the current preview tip. Make the existing
+        // automatic rebuild/re-integrate recovery reachable from the queue rather
+        // than presenting a generic, disabled "not ready" action. Other false
+        // mergeability states remain disabled: a rebuild cannot fix an incomplete
+        // reconcile or failed evidence.
+        // A change already in the staged aggregate has integrated — its stored
+        // `mergeable` can read false once the forge settles the just-merged PR
+        // against the tip, but that is NOT a conflict to recover. Read integration
+        // truth from the ledger and never route it to recovery.
+        const alreadyIntegrated = isIntegrated(change);
+        const needsPreviewUpdate =
+          !alreadyIntegrated && change.status === "ready" && promotable && change.mergeable === false;
+        // Only ONE primary action at a time: while checks are pending, "Run checks"
+        // above is the whole story — a second disabled "Run checks first" button
+        // next to it said nothing new and just looked broken.
+        if (!needsChecks) {
+          if (alreadyIntegrated) {
+            accept.textContent = "Already added";
+            accept.disabled = true;
+            accept.title = "This change is already in your next release.";
+          } else {
+            accept.textContent = needsPreviewUpdate ? "Update change" : "Add to release";
+            accept.disabled = !canShip || (!needsPreviewUpdate && !change.mergeable) || changeBusy;
+            accept.title = !canShip
+              ? "Requires a ship-on-behalf grant on your account — ask the store owner"
+              : needsPreviewUpdate
+                ? "Preview changed while you worked — update this change, then add it"
+                : !change.mergeable
+                  ? "This change isn't ready to add yet"
+                  : "Add this change to your next release (doesn't go live yet)";
+            accept.addEventListener("click", () =>
+              needsPreviewUpdate ? openConflictRecovery(change, accept) : integrateCandidate(change, accept),
+            );
+          }
+          actions.append(accept);
+        }
+        const reject = document.createElement("button");
+        reject.type = "button";
+        reject.className = "btn";
+        reject.textContent = "Reject";
+        reject.disabled = !canShip || changeBusy;
+        reject.title = canShip
+          ? "Close this change without publishing"
+          : "Requires a ship-on-behalf grant on your account — ask the store owner";
+        reject.addEventListener("click", () => rejectChange(change, reject));
+        actions.append(reject);
+        // B2: light up this row's mapped button — the build button when the row's
+        // finding is a build/retry, the conflict-recovery "Update change" accept
+        // button when it's a resolve.
+        applyRowFinding(actions, change, rowFindings, {
+          build: runChecksBuild,
+          resolve: needsPreviewUpdate ? accept : undefined,
+        });
+        tr.append(actions);
+
+        queueBody.append(tr);
+
+      }
+    };
+
+    // "See all" closed/rejected history. A rejected change leaves the open queue
+    // (server filters terminal status out of `changes`); the server now also returns
+    // the closed ones as `closedChanges` so a reject is recoverable-from-history
+    // rather than a black hole. Read-only: id + who-closed-it + a still-reachable
+    // preview link. The whole panel is HIDDEN when there are none (no empty chrome).
+    const renderClosed = (payload?: any) => {
+      if (!closedBody || !closedPanel) return;
+      const closed = Array.isArray(payload && payload.closedChanges) ? payload.closedChanges : [];
+      closedBody.textContent = "";
+      if (closedChip) closedChip.textContent = String(closed.length);
+      closedPanel.hidden = closed.length === 0;
+      if (!closed.length) return;
+
+      for (const change of closed) {
+        const tr = document.createElement("tr");
+        if (change.prNumber != null) tr.dataset.prNumber = String(change.prNumber);
+
+        // Change id + branch/PR + who closed it + a still-reachable preview link.
+        const idCell = document.createElement("td");
+        const idStrong = document.createElement("strong");
+        idStrong.textContent = change.changeId || "—";
+        idCell.append(idStrong);
+        const meta = [];
+        if (change.branch) meta.push(change.branch);
+        if (change.prNumber != null) meta.push("PR #" + change.prNumber);
+        if (meta.length) idCell.append(subtle(meta.join(" · ")));
+        // "Closed by" — the reject actor when known (fall back to the last actor
+        // who touched it, so the row is never anonymous when we have any attribution).
+        const closer = change.actors && (change.actors.reject || change.actors.accept || change.actors.build);
+        if (closer) idCell.append(subtle("Closed by " + (closer.name || closer.email)));
+        const previewUrl = candidatePrUrl(appDomain, change.prNumber) || change.previewUrl;
+        if (previewUrl) {
+          const preview = document.createElement("a");
+          preview.href = previewUrl;
+          preview.target = "_blank";
+          preview.rel = "noopener";
+          preview.textContent = "Open preview";
+          const wrap = document.createElement("span");
+          wrap.className = "subtle";
+          wrap.append(preview);
+          idCell.append(wrap);
+        }
+        tr.append(idCell);
+
+        // Closed (relative time of the last projection update = when it was closed).
+        tr.append(cell(age(change.updatedAt)));
+
+        // Head sha.
+        const headCell = cell(shortSha(change.headSha));
+        headCell.classList.add("publish-mono");
+        tr.append(headCell);
+
+        closedBody.append(tr);
+      }
+    };
+
+    const renderCurrent = (current?: any, shippedBy?: any) => {
+      // r02: the "Live version" metric is a HUMAN label — "v42" linked to the live
+      // store — not a raw SHA. The SHA is demoted to a "Technical details"
+      // disclosure. The counter (current.versionNumber) is derived from the
+      // promotion history server-side; a version with no number (unpromoted seed)
+      // falls back to its short SHA rather than fabricating one.
+      const linkEl = root.querySelector("[data-publish-live-version-link]");
+      const noneEl = root.querySelector("[data-publish-live-version-none]");
+      const techEl = root.querySelector("[data-publish-live-tech]");
+      const shaEl = root.querySelector("[data-publish-live-sha]");
+      const sourceEl = root.querySelector("[data-publish-live-source]");
+      const atEl = root.querySelector("[data-publish-live-at]");
+      const shippedByEl = root.querySelector("[data-publish-live-shipped-by]");
+      if (current && current.versionId) {
+        const label =
+          current.versionNumber != null ? "v" + current.versionNumber : shortSha(current.versionId);
+        if (linkEl) {
+          linkEl.textContent = label;
+          linkEl.setAttribute("href", ds.liveHref || "/");
+          (linkEl as any).hidden = false;
+        }
+        if (noneEl) (noneEl as any).hidden = true;
+        if (shaEl) shaEl.textContent = shortSha(current.versionId);
+        if (techEl) (techEl as any).hidden = false;
+        if (sourceEl) {
+          sourceEl.textContent =
+            (current.source === "commit" ? "Published from a change" : "Published version") +
+            (current.artifactCount != null ? " · " + current.artifactCount + " files" : "");
+        }
+        if (atEl) atEl.textContent = current.createdAt ? age(current.createdAt) : "—";
+        // Owner-facing "who did this" — see changeActorAttribution.ts. Absent for
+        // any version published before this attribution existed, which is honest,
+        // not a bug.
+        if (shippedByEl) {
+          shippedByEl.textContent = shippedBy ? "Shipped by " + (shippedBy.name || shippedBy.email) : "";
+        }
+      } else {
+        if (linkEl) (linkEl as any).hidden = true;
+        if (noneEl) {
+          noneEl.textContent = "Not live yet";
+          (noneEl as any).hidden = false;
+        }
+        if (techEl) (techEl as any).hidden = true;
+        if (shaEl) shaEl.textContent = "—";
+        if (sourceEl) sourceEl.textContent = "Nothing has been published for this store";
+        if (atEl) atEl.textContent = "—";
+        if (shippedByEl) shippedByEl.textContent = "";
+      }
+    };
+
+    // ---- rux7: auto-refresh (poll GET /api/changes) ------------------------
+    // Keep the queue + aggregate live without a manual reload: poll on an
+    // interval that BACKS OFF while nothing changes (grow the delay up to a cap)
+    // and SNAPS BACK to the base the moment something does. Pause entirely while
+    // the tab is hidden (document.hidden) — a backgrounded admin tab must not
+    // hammer the endpoint — and refresh promptly on return. A poll re-render
+    // reuses renderQueue/renderAggregate, which already preserve open diff panes
+    // and in-flight actions (inflightBuilds / busyChanges / aggregatePublishing),
+    // and applyPrDeeplink stays a one-time effect (prDeeplinkResolved), so the
+    // ?pr scroll never re-fires on a tick.
+    const POLL_BASE_MS = 8000;
+    const POLL_MAX_MS = 60000;
+    const POLL_GROWTH = 1.6;
+    let pollDelay = POLL_BASE_MS;
+    let pollTimer: any = null;
+    let pollBusy = false;
+    let lastChangesSignature: string | null = null;
+
+    // A compact projection of everything the queue/aggregate render VISIBLY off,
+    // so a no-op poll (identical data) neither re-renders nor interrupts a text
+    // selection — it just backs off. Relative ages are intentionally excluded;
+    // they drift at most one backoff interval and refresh on any real change.
+    const changesSignature = (data?: any) => {
+      const cur = data.current || {};
+      const agg = data.aggregate || {};
+      const run = agg.activeRun || agg.lastRun || {};
+      const plan = data.plan || {};
+      const rows = (Array.isArray(data.changes) ? data.changes : []).map((c: any) => [
+        c.changeId,
+        c.prNumber,
+        c.status,
+        c.headSha,
+        c.mergeable,
+        c.built,
+        c.lastError || null,
+        c.title || null,
+        c.description || null,
+        c.intent || null,
+        c.verification || null,
+        c.riskRollback || null,
+        !!(c.evidence && c.evidence.promotable),
+        c.actors ? Object.keys(c.actors).sort().join(",") : "",
+      ]);
+      const summary = data.releaseSummary || (agg.releaseSummary) || null;
+      return JSON.stringify({
+        degraded: data.degraded === true,
+        current: [cur.versionId || null, cur.createdAt || null, cur.artifactCount ?? null],
+        shippedBy: (data.shippedBy && data.shippedBy.email) || null,
+        aggregate: [
+          agg.queueState || null,
+          agg.aggregateSha || null,
+          run.state || null,
+          run.finishedAt || null,
+          // include per-PR identity + title + stats so enrichment (a title/scope
+          // arriving) re-renders
+          (agg.includedPrs || []).map((p: any) => [
+            p.prNumber ?? p.changeId ?? null, p.headSha || null, p.title || null,
+            p.fileCount ?? null, p.linesAdded ?? null, p.linesRemoved ?? null,
+            Array.isArray(p.diff) ? p.diff.length : 0,
+          ]),
+        ],
+        summary: summary ? [summary.lead || summary.text || null, (summary.highlights || []).length] : null,
+        scope: data.stagedScope
+          ? [data.stagedScope.files, data.stagedScope.added, data.stagedScope.removed]
+          : null,
+        plan: [plan.ok === true, plan.pinnedSha || null, plan.artifactDigest || null, plan.alreadyShipped === true],
+        rows,
+      });
+    };
+
+    const clearPoll = () => {
+      if (pollTimer) {
+        clearTimeout(pollTimer);
+        pollTimer = null;
+      }
+    };
+
+    const schedulePoll = () => {
+      clearPoll();
+      // Paused while the browser tab is hidden (visibilitychange resumes) OR
+      // while the Publish admin-tab is not the active one (the IntersectionObserver
+      // resumes it on activation) — an inactive tab must not poll heavy reads.
+      if (document.hidden || !tabActive) return;
+      pollTimer = setTimeout(runPoll, pollDelay);
+    };
+
+    // One poll tick: fetch, and only re-render when the projection actually
+    // changed. Returns an outcome the caller uses to size the next interval.
+    const pollChanges = async () => {
+      let res;
+      try {
+        res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
+      } catch {
+        return "error"; // network blip — keep the last good view, just back off
+      }
+      if (res.status === 401 || res.status === 403) return "auth"; // session gone
+      const data = await res.json().catch(() => null);
+      if (!res.ok || !data) return "error";
+      const sig = changesSignature(data);
+      currentStateKey = sig; // heavy panels cache against this fingerprint
+      if (sig === lastChangesSignature) return "unchanged";
+      lastChangesSignature = sig;
+      renderCurrent(data.current, data.shippedBy);
+      renderQueue(data);
+      renderClosed(data);
+      applyPrDeeplink();
+      renderAggregate(data);
+      renderHero(data);
+      return "changed";
+    };
+
+    const runPoll = async () => {
+      pollTimer = null;
+      if (document.hidden || !tabActive || pollBusy) {
+        schedulePoll();
+        return;
+      }
+      pollBusy = true;
+      let outcome;
+      try {
+        outcome = await pollChanges();
+      } finally {
+        pollBusy = false;
+      }
+      if (outcome === "auth") {
+        clearPoll(); // stop polling — a sign-in is required; a manual refresh retries
+        return;
+      }
+      // Branch retention rides the SAME cadence as the queue so its rows reflect
+      // live forge state, not a frozen page-load snapshot (b1: a stale "PR #11
+      // open / Keep" 30+ min after the PR closed) — but ONLY while the branches
+      // panel is actually on screen (lazy: don't fetch a panel the operator
+      // isn't looking at). loadBranches coalesces overlapping ticks and owns its
+      // own no-change guard and unreachable fallback.
+      if (branchesVisible) loadBranches();
+      pollDelay =
+        outcome === "changed"
+          ? POLL_BASE_MS
+          : Math.min(POLL_MAX_MS, Math.round(pollDelay * POLL_GROWTH));
+      schedulePoll();
+    };
+
+    const loadQueue = async () => {
+      try {
+        const res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
+        if (res.status === 401 || res.status === 403) {
+          if (queueChip) queueChip.textContent = "Sign-in required";
+          if (degradedStrip) degradedStrip.hidden = true;
+          if (heroEl) (heroEl as any).hidden = true;
+          queueBody.textContent = "";
+          const tr = document.createElement("tr");
+          const td = cell(subtle("Sign in as a store owner or admin to view the publish queue."));
+          td.colSpan = 6;
+          tr.append(td);
+          queueBody.append(tr);
+          return;
+        }
+        const data = await res.json();
+        if (!res.ok) {
+          setStatus(statusEl, data.error || "Could not load the change queue (" + res.status + ")", "err");
+          return;
+        }
+        renderCurrent(data.current, data.shippedBy);
+        renderQueue(data);
+        renderClosed(data);
+        applyPrDeeplink();
+        renderAggregate(data);
+        renderHero(data);
+        // rux7: this is fresh authoritative data — resync the poll clock so the
+        // next tick dedupes against it, and reset the cadence to responsive
+        // (a manual refresh / a just-completed action likely means more coming).
+        lastChangesSignature = changesSignature(data);
+        currentStateKey = lastChangesSignature; // heavy panels cache against this
+        pollDelay = POLL_BASE_MS;
+        schedulePoll();
+      } catch {
+        setStatus(statusEl, "Could not load the change queue — network error", "err");
+      }
+    };
+
+    // ---- b11: the aggregate card + exact-digest Publish ---------------------
+    // Reads the aggregate/runs/plan projection GET /api/changes now returns
+    // (AggregateCardView + AggregateShipPlanView, built by aggregateView.ts):
+    //   - the aggregate's queueState + build sha + reviewed digest,
+    //   - the COMBINED EVIDENCE = the last integration run's honest state +
+    //     statusMessage (never re-derived),
+    //   - the included-PR batch,
+    //   - the b09 ship PLAN (pinned SHA/digest/PRs/rollback/paywall + run link),
+    //     shown inline so the confirm never has to POST to preview it.
+
+    const aggPanel = root.querySelector("[data-publish-aggregate]");
+    const AGG_STATE_CHIP: Record<string, string> = {
+      empty: "",
+      queued: "amber",
+      integrating: "blue",
+      green: "green",
+      red: "red",
+      shipped: "green",
+    };
+    // r04 — the Next-release chip in merchant words; the raw queueState still drives
+    // logic, only the label is humanized (no "integrating"/"green"/"red" jargon).
+    const AGG_STATE_LABEL: Record<string, string> = {
+      empty: "No changes yet",
+      queued: "Waiting",
+      integrating: "Building…",
+      green: "Ready to publish",
+      red: "Needs attention",
+      shipped: "Published",
+    };
+    // The plan we last rendered — the exact-digest guard the Publish POST sends
+    // back so a stale plan (queue moved / artifact changed) is refused, never
+    // shipped blind.
+    let currentPlan: any = null;
+
+    const runLink = (revHref?: any, label?: any) => {
+      if (!revHref) return null;
+      const a = document.createElement("a");
+      a.href = revHref;
+      a.target = "_blank";
+      a.rel = "noopener";
+      a.textContent = label || "Open build";
+      return a;
+    };
+
+    const renderAggregate = (data?: any) => {
+      if (!aggPanel) return;
+      const agg = data.aggregate || null;
+      const plan = data.plan || null;
+      currentPlan = plan && plan.ok ? plan : null;
+
+      // AI-assembled release summary — plain-language "what am I publishing?".
+      // OPTIONAL server enrichment: data.releaseSummary { lead|text, highlights?:
+      // [{title, detail}] }. Absent → the whole card stays hidden and the panel
+      // degrades to the technical chain below (graceful fallback, never a stub).
+      const summaryWrap = aggPanel.querySelector("[data-aggregate-summary]");
+      if (summaryWrap) {
+        const summary = data.releaseSummary || (agg && agg.releaseSummary) || null;
+        const lead = summary && (summary.lead || summary.text);
+        if (!lead) {
+          summaryWrap.hidden = true;
+        } else {
+          summaryWrap.hidden = false;
+          const leadEl = summaryWrap.querySelector("[data-aggregate-summary-lead]");
+          const pointsEl = summaryWrap.querySelector("[data-aggregate-summary-points]");
+          if (leadEl) leadEl.textContent = lead;
+          if (pointsEl) {
+            pointsEl.textContent = "";
+            const points = Array.isArray(summary.highlights) ? summary.highlights : [];
+            for (const pt of points) {
+              const li = document.createElement("li");
+              const tick = document.createElement("span");
+              tick.className = "agg-tick";
+              tick.setAttribute("aria-hidden", "true");
+              const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+              const use = document.createElementNS("http://www.w3.org/2000/svg", "use");
+              use.setAttribute("href", "#i-check");
+              svg.append(use);
+              tick.append(svg);
+              const text = document.createElement("span");
+              if (pt && typeof pt === "object" && pt.title) {
+                const b = document.createElement("b");
+                b.textContent = pt.title;
+                text.append(b);
+                if (pt.detail) text.append(document.createTextNode(" — " + pt.detail));
+              } else {
+                text.textContent = typeof pt === "string" ? pt : (pt && pt.detail) || "";
+              }
+              li.append(tick, text);
+              pointsEl.append(li);
+            }
+            pointsEl.hidden = points.length === 0;
+          }
+        }
+      }
+
+      const chipEl = aggPanel.querySelector("[data-aggregate-chip]");
+      const shaEl = aggPanel.querySelector("[data-aggregate-sha]");
+      const runLinkEl = aggPanel.querySelector("[data-aggregate-run-link]");
+      const evEl = aggPanel.querySelector("[data-aggregate-evidence]");
+      const evDetailEl = aggPanel.querySelector("[data-aggregate-evidence-detail]");
+      const digestEl = aggPanel.querySelector("[data-aggregate-digest]");
+      const prsWrap = aggPanel.querySelector("[data-aggregate-prs-wrap]");
+      const prsTitle = aggPanel.querySelector("[data-aggregate-prs-title]");
+      const deltaNote = aggPanel.querySelector("[data-aggregate-delta-note]");
+      const scopeEl = aggPanel.querySelector("[data-aggregate-scope]");
+      const prsList = aggPanel.querySelector("[data-aggregate-prs]");
+      const publishBtn = aggPanel.querySelector("[data-aggregate-publish]");
+      const publishDetail = aggPanel.querySelector("[data-aggregate-publish-detail]");
+      const retryRow = aggPanel.querySelector("[data-aggregate-retry-row]");
+      const retryBtn = aggPanel.querySelector("[data-aggregate-retry-build]");
+
+      const state = (agg && agg.queueState) || "empty";
+      // u15 — only offer a retry while the aggregate is actually red; a poll
+      // refresh landing mid-retry must not re-enable a button whose click is
+      // already in flight (rux7's own guard, mirrored here).
+      if (retryRow) retryRow.hidden = state !== "red";
+      if (retryBtn) retryBtn.disabled = aggregateRetrying;
+      if (chipEl) {
+        const tone = AGG_STATE_CHIP[state] || "";
+        paintChip(chipEl, AGG_STATE_LABEL[state] || state, tone, CHIP_GLYPH[tone]);
+      }
+      // r11 — the human release name (aggregate.name), shown beside "Next release".
+      // Display-only: absent/null → hidden, and the section header reads as before.
+      const nameEl = aggPanel.querySelector("[data-aggregate-name]");
+      if (nameEl) {
+        const releaseName = agg && agg.name;
+        if (releaseName) {
+          nameEl.textContent = releaseName;
+          (nameEl as any).hidden = false;
+        } else {
+          nameEl.textContent = "";
+          (nameEl as any).hidden = true;
+        }
+      }
+      if (shaEl) shaEl.textContent = agg && agg.aggregateSha ? shortSha(agg.aggregateSha) : "—";
+      // Build-link honesty — the card's own sha is always the last-GREEN
+      // materialized sha (a red cycle leaves it untouched), so it's renderable
+      // whenever present: opening it reaches the last-good preview even while the
+      // current cycle is red/in-flight. When the aggregate has NEVER gone green
+      // there is no renderable sha — surface "build failed — rebuild" or "no build
+      // yet", never a link that 404s (rules 1 & 3).
+      const cardSha = agg && agg.aggregateSha;
+      const buildLink = classifyBuildLink({
+        sha: cardSha,
+        built: Boolean(cardSha),
+        building: Boolean(agg && (agg.activeRun || agg.queueState === "integrating")),
+        attempted: Boolean(agg && (agg.lastRun || agg.queueState === "red")),
+      });
+      if (runLinkEl) {
+        runLinkEl.textContent = "";
+        if (buildLink.available && agg && agg.revHref) {
+          runLinkEl.append(runLink(agg.revHref, buildLink.label)!);
+        } else if (buildLink.kind === "failed") {
+          runLinkEl.append(document.createTextNode(buildLink.note + " "));
+          if (canShip && buildLink.action) {
+            const rebuild = document.createElement("button");
+            rebuild.type = "button";
+            rebuild.className = "btn btn-compact publish-cta-primed";
+            rebuild.textContent = buildLink.action.label;
+            rebuild.disabled = aggregateRetrying;
+            rebuild.addEventListener("click", () => retryBuild(rebuild));
+            runLinkEl.append(rebuild);
+          }
+        } else {
+          runLinkEl.append(document.createTextNode(buildLink.note));
+        }
+      }
+      // "Open preview" next to the Next-release header — a one-click hop to the
+      // current preview build. Same honesty: shown only when a genuinely-built
+      // revision exists, so it can never lead to a 404.
+      const openPreviewEl = aggPanel.querySelector("[data-aggregate-open-preview]");
+      if (openPreviewEl) {
+        if (buildLink.available && agg && agg.revHref) {
+          openPreviewEl.setAttribute("href", agg.revHref);
+          (openPreviewEl as any).hidden = false;
+        } else {
+          (openPreviewEl as any).hidden = true;
+        }
+        // The Next-release header is now a <summary> (collapsible panel). This link
+        // lives inside it, so a click would ALSO toggle the panel — stop that so
+        // "Open preview" only opens the preview. Idempotent-guarded so re-renders
+        // don't stack listeners.
+        if (!(openPreviewEl as any).__noToggleBound) {
+          openPreviewEl.addEventListener("click", (e: Event) => e.stopPropagation());
+          (openPreviewEl as any).__noToggleBound = true;
+        }
+      }
+
+      // Combined evidence = the last (or in-flight) integration run's honest state.
+      const lastRun = agg && (agg.activeRun || agg.lastRun);
+      if (evEl) {
+        if (!lastRun) {
+          evEl.textContent = "No runs yet";
+          evEl.dataset.state = "none";
+        } else if (lastRun.state === "passed") {
+          evEl.textContent = "Passed";
+          evEl.dataset.state = "passed";
+        } else if (lastRun.state === "failed") {
+          evEl.textContent = "Failed";
+          evEl.dataset.state = "failed";
+        } else {
+          evEl.textContent = "Integrating…";
+          evEl.dataset.state = "running";
+        }
+      }
+      if (evDetailEl) {
+        evDetailEl.textContent = "";
+        if (lastRun) {
+          const parts = [];
+          if (lastRun.statusMessage) parts.push(lastRun.statusMessage);
+          else if (lastRun.state === "passed") parts.push("Combined evidence passed.");
+          else if (lastRun.state === "failed") parts.push("Combined evidence did not pass.");
+          if (lastRun.finishedAt) parts.push(age(lastRun.finishedAt));
+          evDetailEl.append(document.createTextNode(parts.join(" · ")));
+          // A run's sha is renderable IFF that run PASSED — a failed run's sha never
+          // materialized, so linking it 404s (the exact Open-Build trap). Link only a
+          // passed run; a failed run shows its rebuild affordance via runLinkEl above.
+          const runBuild = classifyBuildLink({
+            sha: lastRun.aggregateSha,
+            built: lastRun.state === "passed",
+            building: lastRun.state === "running" || lastRun.state === "pending",
+            attempted: true,
+          });
+          if (runBuild.available && lastRun.revHref) {
+            evDetailEl.append(document.createTextNode(" · "));
+            evDetailEl.append(runLink(lastRun.revHref, "Run build")!);
+          }
+        } else {
+          evDetailEl.append(document.createTextNode("The last integration run's verdict."));
+        }
+      }
+
+      // Reviewed digest: only known once the plan pins it (b09). Never fabricated.
+      if (digestEl) {
+        digestEl.textContent = currentPlan ? shortSha(currentPlan.artifactDigest.replace(/^sha256:/, "")) : "—";
+      }
+
+      // u14 — the STAGED delta vs live. The included-PR batch is the "missing
+      // middle": what's in the staged preview but NOT yet on the live site.
+      // `includedPrs` never clears on ship (a shipped aggregate still lists its
+      // PRs), so "ahead of live" MUST key on the shas — staged aggregateSha vs the
+      // live version id — not on the list length alone.
+      const prs = (agg && agg.includedPrs) || [];
+      const stagedSha = agg && agg.aggregateSha;
+      const liveId = data.current && data.current.versionId;
+      const matchesLive = Boolean(stagedSha && liveId && stagedSha === liveId);
+      const aheadCount = prs.length;
+
+      if (prsWrap) prsWrap.hidden = prs.length === 0;
+      if (prsTitle) {
+        prsTitle.textContent =
+          aheadCount && !matchesLive
+            ? "Staged changes — " + aheadCount + " ahead of live"
+            : "Included changes";
+      }
+      if (deltaNote) {
+        let msg = "";
+        if (matchesLive) {
+          msg = "This staged build is exactly what's live — nothing is waiting to publish.";
+        } else if (!liveId) {
+          msg = "Nothing is live yet — publishing makes this staged build your first version.";
+        } else if (aheadCount) {
+          msg =
+            "In the staged preview (" + shortSha(stagedSha) + ") but not on your live site (" +
+            shortSha(liveId) + ") until you publish.";
+        }
+        deltaNote.textContent = msg;
+        deltaNote.hidden = !msg;
+      }
+
+      // Staged → live delta strip: the staged aggregate sha ahead of the live
+      // pointer. Shown only when there IS a delta (ahead of a real live version).
+      const deltaStrip = aggPanel.querySelector("[data-aggregate-delta-strip]");
+      if (deltaStrip) {
+        const showStrip = Boolean(aheadCount && !matchesLive && stagedSha && liveId);
+        deltaStrip.hidden = !showStrip;
+        if (showStrip) {
+          const stagedEl = deltaStrip.querySelector("[data-agg-delta-staged]");
+          const liveEl = deltaStrip.querySelector("[data-agg-delta-live]");
+          const countEl = deltaStrip.querySelector("[data-agg-delta-count]");
+          if (stagedEl) stagedEl.textContent = shortSha(stagedSha);
+          if (liveEl) liveEl.textContent = shortSha(liveId);
+          if (countEl) countEl.textContent = aheadCount + " ahead";
+        }
+      }
+
+      // Top-level scope-of-change: "Scope · N files · +A −R" across the staged batch.
+      // A risk-at-a-glance measure; hidden when no staged change carries size stats.
+      if (scopeEl) {
+        const scope = data.stagedScope;
+        const hasScope = Boolean(scope && (scope.files > 0 || scope.added > 0 || scope.removed > 0));
+        scopeEl.textContent = "";
+        scopeEl.hidden = !hasScope;
+        if (hasScope) {
+          const label = document.createElement("span");
+          label.className = "agg-scope-label";
+          label.textContent = "Scope";
+          scopeEl.append(label);
+          const files = document.createElement("span");
+          files.textContent = scope.files + (scope.files === 1 ? " file" : " files");
+          scopeEl.append(files);
+          if (scope.added || scope.removed) {
+            scopeEl.append(linesNode(scope.added || 0, scope.removed || 0));
+          }
+          if (scope.partial) {
+            const partial = document.createElement("span");
+            partial.className = "agg-scope-partial";
+            partial.textContent = "partial";
+            partial.title = "Some staged changes had no size stats — the totals cover the rest.";
+            scopeEl.append(partial);
+          }
+        }
+      }
+
+      // Merges what used to be two separate "Included changes" lists (this staged-
+      // delta table + the Publish plan's own duplicate <details> list) into ONE:
+      // `agg.includedPrs` is already server-enriched with the same title/description/
+      // fileCount/lines/diff the plan's list used (see enrichIncludedPrs in
+      // api/changes/index.ts) — no separate cross-reference against `plan.includedPrs`
+      // is needed here, the row already carries everything.
+      if (prsList) {
+        prsList.textContent = "";
+        for (const pr of prs) {
+          const tr = document.createElement("tr");
+          tr.className = "agg-included-row";
+
+          // Change: PR # + title (+ description underneath, + diff disclosure if any).
+          const changeCell = document.createElement("td");
+          const prEl = document.createElement("div");
+          prEl.className = "agg-included-pr";
+          prEl.textContent = pr.prNumber != null ? "PR #" + pr.prNumber : pr.changeId;
+          changeCell.append(prEl);
+          if (pr.title) {
+            const t = document.createElement("div");
+            t.className = "agg-included-title";
+            t.textContent = pr.title;
+            changeCell.append(t);
+          }
+          const description = pr.description || pr.summary;
+          if (description) {
+            const desc = document.createElement("p");
+            desc.className = "agg-included-desc";
+            desc.textContent = description;
+            changeCell.append(desc);
+          }
+          // A trivial change carries its own bounded diff — offer it in a "View diff"
+          // disclosure (for a tiny change the diff IS the summary). Lines are colored
+          // by their leading +/- marker.
+          if (Array.isArray(pr.diff) && pr.diff.length) {
+            const details = document.createElement("details");
+            details.className = "agg-diff";
+            const summaryEl = document.createElement("summary");
+            summaryEl.textContent = "View diff";
+            details.append(summaryEl);
+            for (const file of pr.diff) {
+              const fileEl = document.createElement("div");
+              fileEl.className = "agg-diff-file";
+              const path = document.createElement("div");
+              path.className = "agg-diff-path publish-mono";
+              path.textContent = file.path;
+              fileEl.append(path);
+              if (file.patch) {
+                const pre = document.createElement("pre");
+                pre.className = "agg-diff-patch publish-mono";
+                for (const line of String(file.patch).split("\n")) {
+                  const ln = document.createElement("span");
+                  ln.className =
+                    line.startsWith("+") && !line.startsWith("+++") ? "agg-diff-add"
+                      : line.startsWith("-") && !line.startsWith("---") ? "agg-diff-del"
+                        : line.startsWith("@@") ? "agg-diff-hunk" : "";
+                  ln.textContent = line + "\n";
+                  pre.append(ln);
+                }
+                fileEl.append(pre);
+              } else {
+                const binary = document.createElement("div");
+                binary.className = "subtle";
+                binary.textContent = "(no line-level diff available)";
+                fileEl.append(binary);
+              }
+              details.append(fileEl);
+            }
+            changeCell.append(details);
+          }
+          tr.append(changeCell);
+
+          // Head sha.
+          const shaCell = document.createElement("td");
+          const sha = document.createElement("span");
+          sha.className = "publish-mono sha-token";
+          sha.textContent = shortSha(pr.headSha);
+          shaCell.append(sha);
+          tr.append(shaCell);
+
+          // Files changed.
+          const filesCell = document.createElement("td");
+          const fileCount = pr.fileCount != null ? pr.fileCount : pr.filesChanged;
+          filesCell.textContent = fileCount != null ? String(fileCount) : "—";
+          tr.append(filesCell);
+
+          // Lines added/removed (green/red).
+          const linesCell = document.createElement("td");
+          if (typeof pr.linesAdded === "number" || typeof pr.linesRemoved === "number") {
+            linesCell.append(linesNode(pr.linesAdded, pr.linesRemoved));
+          } else {
+            linesCell.textContent = "—";
+          }
+          tr.append(linesCell);
+
+          // Integrated when/by.
+          const whenCell = document.createElement("td");
+          const bits = [];
+          if (pr.integratedAt) bits.push("added " + age(pr.integratedAt));
+          if (pr.integratedBy && pr.integratedBy.email) bits.push("by " + pr.integratedBy.email);
+          whenCell.textContent = bits.length ? bits.join(" ") : "—";
+          tr.append(whenCell);
+
+          // Actions: u14 Undo — per-change revert: roll THIS change OUT of the staged
+          // preview (a revert commit + rebuild); the live site is untouched. Only for
+          // a PR-numbered, still-ahead-of-live change; gated on ship capability.
+          const actionsCell = document.createElement("td");
+          actionsCell.className = "action";
+          if (canShip && pr.prNumber != null && !matchesLive) {
+            const undo = document.createElement("button");
+            undo.type = "button";
+            undo.className = "btn btn-compact";
+            undo.textContent = "Undo";
+            undo.title =
+              "Revert PR #" + pr.prNumber + " out of the staged preview (your live site is untouched)";
+            undo.addEventListener("click", () => revertStaged(pr, undo));
+            actionsCell.append(undo);
+          }
+          tr.append(actionsCell);
+
+          prsList.append(tr);
+        }
+      }
+
+      renderPlan(data.plan);
+
+      // The Publish button: enabled only for a shippable, paywall-cleared plan and
+      // a viewer who can ship. A paywalled plan is SHOWN (upsell), never hidden. Bug 3
+      // publish-safety: computePublishGuard ALSO hard-blocks a red aggregate (the
+      // latest rebuild failed) regardless of a possibly-stale shippable plan, and
+      // surfaces a "serving stale build" indicator — see publish-guard.ts.
+      const servingBuildAtLabel = (() => {
+        const iso = data.current && data.current.createdAt;
+        if (!iso) return null;
+        const d = new Date(iso);
+        return Number.isNaN(d.getTime()) ? null : d.toLocaleString();
+      })();
+      const guard = computePublishGuard({
+        queueState: (agg && agg.queueState) || null,
+        aggregatePublishing,
+        canShip,
+        shippable: Boolean(currentPlan),
+        paywalled: Boolean(currentPlan && currentPlan.paywall && !currentPlan.paywall.allowed),
+        alreadyShipped: Boolean(currentPlan && currentPlan.alreadyShipped),
+        aheadCount,
+        servingBuildAtLabel,
+      });
+      if (publishBtn) {
+        // rux7: never re-enable the Publish button while its POST is in flight —
+        // a poll refresh landing mid-publish must not open a double-submit (folded
+        // into the guard's `aggregatePublishing` input).
+        publishBtn.disabled = guard.disabled;
+        publishBtn.title = guard.title;
+      }
+
+      // The collapsed destination panel answers the release question in its
+      // summary: green only when the staged release is already live; otherwise
+      // expose the action that advances live to that release. Public-site parity
+      // with the *old* live pointer must never paint this summary green.
+      const liveReleaseState: any = root.querySelector("[data-live-release-state]");
+      const liveReleasePublish: any = root.querySelector("[data-live-release-publish]");
+      if (liveReleaseState && liveReleasePublish) {
+        const liveReleaseView = liveReleaseSummaryState({
+          matchesLive,
+          hasStagedRelease: Boolean(stagedSha),
+          publishDisabled: guard.disabled,
+          publishTitle: guard.title,
+        });
+        if (liveReleaseView.kind === "current") {
+          paintChip(liveReleaseState, liveReleaseView.label, "green", CHIP_GLYPH.green);
+          liveReleaseState.hidden = false;
+          liveReleasePublish.hidden = true;
+        } else if (liveReleaseView.kind === "publish") {
+          liveReleaseState.hidden = true;
+          liveReleasePublish.hidden = false;
+          liveReleasePublish.textContent = liveReleaseView.label;
+          liveReleasePublish.disabled = liveReleaseView.disabled;
+          liveReleasePublish.title = liveReleaseView.title;
+        } else {
+          paintChip(liveReleaseState, liveReleaseView.label, "", "");
+          liveReleaseState.hidden = false;
+          liveReleasePublish.hidden = true;
+        }
+      }
+      if (publishDetail) {
+        if (guard.staleIndicator) {
+          // A failed rebuild is holding new work back — lead with the honest stale
+          // notice instead of the normal "publishes the exact build" copy.
+          publishDetail.textContent = guard.staleIndicator;
+        } else if (currentPlan && currentPlan.alreadyShipped) {
+          publishDetail.textContent =
+            "This reviewed build (" + shortSha(currentPlan.pinnedSha) + ") is already live. ";
+          const view = document.createElement("a");
+          view.href = ds.liveHref || "/";
+          view.target = "_blank";
+          view.rel = "noopener";
+          view.textContent = "View your live store →";
+          publishDetail.append(view);
+        } else if (currentPlan) {
+          publishDetail.textContent = publicSiteHost
+            ? "Publishes the exact build you reviewed (" + shortSha(currentPlan.pinnedSha) +
+              ") to the hosted store immediately, then automatically republishes " + publicSiteHost + "."
+            : "Publishes the exact build you reviewed (" + shortSha(currentPlan.pinnedSha) + ") — no rebuild.";
+        } else {
+          publishDetail.textContent =
+            "Publishes the exact build you reviewed — no rebuild. Available once your next release is ready and its checks pass.";
+        }
+      }
+
+      // u14 — orient the owner between the staged aggregate (above) and the live
+      // versions list (below): how many staged changes are still unpublished and
+      // what Publish does to the versions timeline. Owned here (its OWN element) so
+      // this render never races renderVersions' own poll.
+      const versionsOrientation = root.querySelector("[data-versions-orientation]");
+      if (versionsOrientation) {
+        if (aheadCount && !matchesLive) {
+          versionsOrientation.textContent =
+            aheadCount + " staged change" + (aheadCount === 1 ? " is" : "s are") +
+            " not yet published — Publish live creates the next version here, and the current version becomes your rollback target.";
+          versionsOrientation.hidden = false;
+        } else {
+          versionsOrientation.hidden = true;
+        }
+      }
+    };
+
+    const renderPlan = (plan?: any) => {
+      const planBox = aggPanel && aggPanel.querySelector("[data-aggregate-plan]");
+      if (!planBox) return;
+      const chipEl = planBox.querySelector("[data-aggregate-plan-chip]");
+      const grid = planBox.querySelector("[data-aggregate-plan-grid]");
+      const note = planBox.querySelector("[data-aggregate-plan-note]");
+      if (grid) grid.textContent = "";
+
+      // No plan at all (degenerate: no store bound) — hide the box.
+      if (!plan) {
+        planBox.hidden = true;
+        return;
+      }
+      planBox.hidden = false;
+
+      if (!plan.ok) {
+        // An honest refusal — show WHY it isn't ready, never a fake plan.
+        paintChip(chipEl, "Not ready to publish", "amber", CHIP_GLYPH.amber);
+        if (note) note.textContent = plan.message || ("Not ready to publish (" + (plan.reason || "refused") + ").");
+        return;
+      }
+
+      const paywalled = plan.paywall && !plan.paywall.allowed;
+      if (chipEl) {
+        const label = plan.alreadyShipped ? "Already live" : paywalled ? "Upgrade required" : "Ready to publish";
+        const tone = plan.alreadyShipped ? "green" : paywalled ? "amber" : "green";
+        paintChip(chipEl, label, tone, CHIP_GLYPH[tone]);
+      }
+
+      const row = (term?: any, value?: any, mono?: any) => {
+        const dt = document.createElement("dt");
+        dt.textContent = term;
+        const dd = document.createElement("dd");
+        if (value instanceof Node) dd.append(value);
+        else {
+          dd.textContent = value;
+          if (mono) dd.className = "publish-mono";
+        }
+        grid.append(dt, dd);
+      };
+
+      row("Reviewed build", shortSha(plan.pinnedSha), true);
+      row("Reviewed digest", shortSha(plan.artifactDigest.replace(/^sha256:/, "")), true);
+      const runCell = document.createElement("span");
+      runCell.append(document.createTextNode(plan.integrationRunId));
+      const planRunLink = runLink(plan.pinnedRevHref, "Open build");
+      if (planRunLink) {
+        runCell.append(document.createTextNode(" · "));
+        runCell.append(planRunLink);
+      }
+      row("Integration run", runCell);
+      if (plan.rollbackTarget) {
+        row("Rollback to", shortSha(plan.rollbackTarget.aggregateSha), true);
+      } else {
+        row("Rollback to", "None (first publish)");
+      }
+      row("Subscription", plan.paywall && plan.paywall.allowed ? "Enabled" : "Not enabled");
+      // Included changes: rendered ONCE, in the staged-delta table above (prsList) —
+      // the plan's own includedPrs is the same canonical set, so no second list here.
+
+      if (note) {
+        note.textContent = paywalled
+          ? (plan.paywall.message || "Publishing to your live store requires the paid plan.")
+          : plan.alreadyShipped
+            ? "This reviewed build is already live — nothing to publish."
+            : "Publish sends the exact build you reviewed to your live store. No rebuild.";
+      }
+    };
+
+    // The exact-digest Publish (b10 ship = b09 orchestrator.ship). Confirms the
+    // pinned plan, then POSTs { confirmGoLive, expectedAggregateSha,
+    // expectedArtifactDigest } — the reviewed-digest guard: a stale plan (queue
+    // moved / artifact changed) is refused by the server, never shipped blind.
+    // ── Publish-live ceremony (shipoff) ──────────────────────────────────────
+    // The go-live counterpart of the accept liftoff below (shares its shell,
+    // styles, planRow + celebrate helpers — referenced at runtime, defined a few
+    // sections down). One honest in-flight state: ship is a single POST that
+    // promotes the pinned digest, so no staged theater — just plan → publishing →
+    // outcome with a real "View your live store" link.
+    const shipoff = root.querySelector("[data-shipoff]");
+    const shipoffCard = shipoff && shipoff.querySelector(".liftoff-card");
+    const shipoffEls: any = shipoff
+      ? {
+          plan: shipoff.querySelector("[data-shipoff-plan]"),
+          flight: shipoff.querySelector("[data-shipoff-flight]"),
+          outcome: shipoff.querySelector("[data-shipoff-outcome]"),
+          log: shipoff.querySelector("[data-shipoff-log]"),
+          grid: shipoff.querySelector("[data-shipoff-grid]"),
+          proceed: shipoff.querySelector("[data-shipoff-proceed]"),
+          cancel: shipoff.querySelector("[data-shipoff-cancel]"),
+          live: shipoff.querySelector("[data-shipoff-live]"),
+          elapsed: shipoff.querySelector("[data-shipoff-elapsed]"),
+          hide: shipoff.querySelector("[data-shipoff-hide]"),
+          seal: shipoff.querySelector("[data-shipoff-seal]"),
+          outcomeTitle: shipoff.querySelector("[data-shipoff-outcome-title]"),
+          outcomeDetail: shipoff.querySelector("[data-shipoff-outcome-detail]"),
+          failure: shipoff.querySelector("[data-shipoff-failure]"),
+          failureDetail: shipoff.querySelector("[data-shipoff-failure-detail]"),
+          copy: shipoff.querySelector("[data-shipoff-copy]"),
+          view: shipoff.querySelector("[data-shipoff-view]"),
+          undo: shipoff.querySelector("[data-shipoff-undo]"),
+          done: shipoff.querySelector("[data-shipoff-done]"),
+          confetti: shipoff.querySelector("[data-shipoff-confetti]"),
+        }
+      : null;
+    let shipoffTimer: any = null;
+    // r12 — the element that opened the publish ceremony, so closing returns focus
+    // to it (the Publish button or the hero CTA) rather than dropping it to <body>.
+    let shipoffOpenedFrom: any = null;
+    const shipLog = makeLogConsole(shipoffEls && shipoffEls.log);
+    let shipFailureCopyText = "";
+    // A paste-ready brief for a coding agent when a publish-live did not complete —
+    // the honest reason + the pinned build the human was shipping (mirrors
+    // assembleBuildFailureCopy's framing).
+    const assembleShipFailureCopy = (plan?: any, data?: any, message?: string) => {
+      const tenant = appDomain || repo;
+      return [
+        "In my " + tenant + " store, publishing the reviewed build " +
+          (plan && plan.pinnedSha ? shortSha(plan.pinnedSha) + " " : "") +
+          "to my live store did not complete. Diagnose why from the detail below, then tell me the exact fix.",
+        "",
+        "What publish reported:",
+        message || "(no detail was reported)",
+        data && data.state ? "\nOutcome state: " + data.state : "",
+        data && data.reason ? "Reason: " + data.reason : "",
+        "\nContext: this is a Token of Trust storefront tenant. Go-live pins the exact reviewed " +
+          "aggregate digest and promotes it to the live channel — it never rebuilds. A refusal " +
+          "(not_green / paywall / sha_mismatch / bundle_unstaged) leaves the live store unchanged.",
+      ]
+        .filter((l) => l !== "")
+        .join("\n");
+    };
+    if (shipoffEls && shipoffEls.copy) {
+      shipoffEls.copy.addEventListener("click", () => {
+        navigator.clipboard.writeText(shipFailureCopyText).then(
+          () => {
+            shipoffEls.copy.textContent = "Copied";
+            setTimeout(() => { shipoffEls.copy.textContent = "Copy for your AI agent"; }, 1600);
+          },
+          () => { /* clipboard denied — the detail is selectable text */ },
+        );
+      });
+    }
+    const closeShipoff = () => {
+      if (shipoffTimer) { clearInterval(shipoffTimer); shipoffTimer = null; }
+      if (shipoff) shipoff.hidden = true;
+      if (shipoffEls) shipoffEls.confetti.textContent = "";
+      if (shipoffOpenedFrom && document.contains(shipoffOpenedFrom)) shipoffOpenedFrom.focus();
+      shipoffOpenedFrom = null;
+    };
+    const showShipoffPhase = (phase?: any) => {
+      if (!shipoffEls) return;
+      shipoffEls.plan.hidden = phase !== "plan";
+      shipoffEls.flight.hidden = phase !== "flight";
+      shipoffEls.outcome.hidden = phase !== "outcome";
+      if (shipoffCard) shipoffCard.dataset.mode = phase;
+    };
+
+    const buildPublishPlanText = (plan?: any) => {
+      const lines = ["Publish plan (exact reviewed digest — no rebuild):"];
+      lines.push("  tenant:   " + (appDomain || repo));
+      lines.push("  build:    " + shortSha(plan.pinnedSha));
+      lines.push("  digest:   " + plan.artifactDigest);
+      lines.push("  changes:  " + (plan.includedPrs || []).length + " included");
+      if (plan.rollbackTarget) lines.push("  rollback: " + shortSha(plan.rollbackTarget.aggregateSha));
+      lines.push("  effect:   publish this exact digest to your LIVE store.");
+      return lines.join("\n");
+    };
+
+    const publishAggregate = (button?: any) => {
+      if (!currentPlan) return;
+      const plan = currentPlan;
+      shipoffOpenedFrom = button || null; // r12: return focus here on close
+      if (!shipoff || !shipoffEls) {
+        // No-markup fallback only — the ceremony IS the confirm now.
+        if (!window.confirm(buildPublishPlanText(plan) + "\n\nPublish live?")) return;
+        runShip(plan, button);
+        return;
+      }
+      shipoffEls.grid.textContent = "";
+      shipoffEls.grid.append(
+        ...planRow("Store", appDomain || repo),
+        ...planRow("Build", shortSha(plan.pinnedSha), true),
+        ...planRow("Digest", shortDigest(plan.artifactDigest), true),
+        ...planRow("Changes", (plan.includedPrs || []).length + " included"),
+        ...(plan.rollbackTarget
+          ? planRow("Rollback to", shortSha(plan.rollbackTarget.aggregateSha), true)
+          : []),
+      );
+      showShipoffPhase("plan");
+      shipoff.hidden = false;
+      shipoffEls.proceed.focus();
+      shipoffEls.cancel.onclick = () => closeShipoff();
+      shipoffEls.done.onclick = () => closeShipoff();
+      shipoffEls.proceed.onclick = () => runShip(plan, button);
+    };
+
+    const runShip = async (plan?: any, button?: any) => {
+      if (button) button.disabled = true;
+      aggregatePublishing = true; // rux7: hold the button disabled across polls
+      setStatus(aggStatusEl, "Publishing the reviewed build (" + shortSha(plan.pinnedSha) + ") live…");
+      const startedAt = Date.now();
+      if (shipoffEls) {
+        showShipoffPhase("flight");
+        shipLog.reset();
+        if (shipoffEls.failure) shipoffEls.failure.hidden = true;
+        shipoffEls.live.textContent = "Pinning the exact reviewed build to your live channel…";
+        shipoffEls.elapsed.textContent = "0:00";
+        if (shipoffEls.hide) shipoffEls.hide.onclick = () => { shipoff.hidden = true; }; // stream keeps running
+        shipoffTimer = setInterval(() => {
+          const s = Math.floor((Date.now() - startedAt) / 1000);
+          shipoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
+        }, 1000);
+      }
+      const outcome = (state?: any, title?: any, detail?: any, showView?: any, failureDetail?: any) => {
+        if (!shipoffEls) return;
+        if (shipoffTimer) { clearInterval(shipoffTimer); shipoffTimer = null; }
+        shipoffEls.seal.dataset.state = state;
+        shipoffEls.outcomeTitle.textContent = title;
+        shipoffEls.outcomeDetail.textContent = detail;
+        shipoffEls.view.hidden = !showView;
+        if (showView) shipoffEls.view.href = ds.liveHref || "/";
+        // r10: the Undo affordance is wired only on a successful ship (below); reset
+        // it hidden for every outcome so a failure never shows a stale Undo.
+        if (shipoffEls.undo) shipoffEls.undo.hidden = true;
+        // A failure gets the honest detail + a "Copy for your AI agent" brief (same
+        // affordance as the build flight); a clean success hides it.
+        if (shipoffEls.failure) {
+          if (failureDetail) {
+            shipoffEls.failure.hidden = false;
+            shipoffEls.failureDetail.textContent = failureDetail;
+          } else {
+            shipoffEls.failure.hidden = true;
+          }
+        }
+        if (shipoff.hidden) shipoff.hidden = false; // re-surface if backgrounded
+        showShipoffPhase("outcome");
+        shipoffEls.done.focus();
+        if (state === "ok") celebrate(shipoffEls.confetti);
+      };
+      try {
+        const res = await fetch(ds.shipEndpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            // Real-time server-pushed progress (pin → promote → verify → record) over
+            // SSE; falls back to buffered JSON for a non-streaming proxy.
+            accept: "text/event-stream",
+            "x-tot-capability": "ship-on-behalf",
+          },
+          body: JSON.stringify({
+            aggregateId: plan.aggregateId,
+            // The HUMAN go-live gate + the reviewed-digest guards (b09 ship input).
+            confirmGoLive: true,
+            expectedAggregateSha: plan.pinnedSha,
+            expectedArtifactDigest: plan.artifactDigest,
+          }),
+        });
+        const { data } = await streamWithLog(res, shipLog);
+        // b09 AggregateShipResult: the ONLY live claim is state === "shipped".
+        if (data.state === "shipped") {
+          setStatus(
+            aggStatusEl,
+            "Published live · build " + shortSha(data.pinnedSha) + " (receipt " + (data.receiptId || "—") + ").",
+            "ok",
+          );
+          void autoSweepBranches();
+          outcome(
+            "ok",
+            "Your store is live",
+            "Build " + shortSha(data.pinnedSha) + " — exactly what you reviewed — is now serving" +
+              (data.receiptId ? " (receipt " + data.receiptId + ")." : "."),
+            true,
+          );
+          // r10: right after publishing, offer a one-click Undo that jumps to the
+          // rollback row for the version this release just REPLACED (the plan's
+          // rollback target = the prior live version), pre-targeted. Reuses the Live
+          // Site rollback action; only offered when there IS a prior version.
+          const undoTarget = plan.rollbackTarget && plan.rollbackTarget.aggregateSha;
+          if (shipoffEls && shipoffEls.undo && undoTarget) {
+            shipoffEls.undo.hidden = false;
+            shipoffEls.undo.onclick = () => {
+              closeShipoff();
+              focusRollbackTarget(undoTarget);
+            };
+          }
+        } else {
+          let message;
+          if (data.state === "promote_failed" || data.state === "record_failed") {
+            // Honest partial-failure truth — recoverable, never a false "shipped".
+            message = data.message || "Publish did not complete (" + data.state + "). Retry.";
+          } else if (data.reason === "paywall") {
+            message = data.message || "Publishing to your live store is part of the paid plan.";
+          } else {
+            message = data.message || data.error || "Publish refused (" + (data.reason || data.status || res.status) + ")";
+          }
+          setStatus(aggStatusEl, message, "err");
+          shipFailureCopyText = assembleShipFailureCopy(plan, data, message);
+          outcome("err", "Publish did not complete", message + " Your live store is unchanged.", false, message);
+          // C5 — a refused/failed publish is an aggregate-level event (most tellingly
+          // "not green"); append the health-banner roll-up of what's keeping it red to
+          // the outcome detail (best-effort, additive).
+          surfaceDoctorHint((p) => shipFailureDoctor(p), [shipoffEls && shipoffEls.outcomeDetail, aggStatusEl]);
+        }
+      } catch {
+        setStatus(aggStatusEl, "Publish failed — network error", "err");
+        outcome(
+          "err",
+          "Publish did not complete",
+          "Network error mid-publish — refresh to see the honest state; your live store serves the last published version.",
+          false,
+        );
+      } finally {
+        aggregatePublishing = false;
+        if (button) button.disabled = false;
+        loadQueue();
+        loadVersions({ force: true }); // a publish changed the versions list
+      }
+    };
+
+    const aggStatusEl = aggPanel && aggPanel.querySelector("[data-aggregate-status]");
+    aggPanel
+      ?.querySelector("[data-aggregate-publish]")
+      ?.addEventListener("click", (event: any) => publishAggregate(event.currentTarget));
+    root
+      .querySelector("[data-live-release-publish]")
+      ?.addEventListener("click", (event: any) => {
+        // This action lives inside <summary>; publishing must not also toggle the
+        // disclosure open or closed.
+        event.preventDefault();
+        event.stopPropagation();
+        publishAggregate(event.currentTarget);
+      });
+    root
+      .querySelector("[data-publish-stale-site-link]")
+      ?.addEventListener("click", () => {
+        // The destination panel is collapsed by default; an alert promising the
+        // full breakdown must reveal it before the anchor scroll lands.
+        const details: any = root.querySelector(".live-site-details");
+        if (details) details.open = true;
+      });
+    aggPanel
+      ?.querySelector("[data-aggregate-retry-build]")
+      ?.addEventListener("click", (event: any) => retryBuild(event.currentTarget));
+    // r08: the Next-release "Copy preview link" — shown only when a share token was
+    // minted. The shared preview URL is static (token + canonical domain), so it's
+    // wired once. stopPropagation keeps a copy from also toggling the collapsible.
+    const aggCopyPreviewBtn: any = aggPanel && aggPanel.querySelector("[data-aggregate-copy-preview]");
+    if (aggCopyPreviewBtn && sharedPreviewUrl()) {
+      aggCopyPreviewBtn.hidden = false;
+      const lbl = aggCopyPreviewBtn.querySelector("[data-copy-preview-label]");
+      aggCopyPreviewBtn.addEventListener("click", (e: Event) => {
+        e.stopPropagation();
+        copyPreviewLink(sharedPreviewUrl(), lbl);
+      });
+    }
+
+    // ── Accept-to-preview LIFTOFF ─────────────────────────────────────────────
+    // The plan confirm + live integration flight + outcome ceremony (replaces
+    // the old window.confirm plan popup). Same b11 contract as before: accept =
+    // `POST /api/changes/integrate` (b08) → integrate into the protected
+    // `preview` aggregate, rebuild + combined-evidence it (b05). Flips NO live
+    // channel — going live is the aggregate card's Publish.
+    //
+    // HONESTY RULE for the stage rail: a stage only advances on a REAL signal —
+    // the outcome POST resolving, or GET /api/changes polling showing the
+    // candidate inside `aggregate.includedPrs` (merge landed) / an `activeRun`
+    // (build+evidence running, statusMessage relayed verbatim). No timers ever
+    // fake progress.
+    const liftoff = root.querySelector("[data-liftoff]");
+    const liftoffCard = liftoff && liftoff.querySelector(".liftoff-card");
+    const liftoffEls: any = liftoff
+      ? {
+          plan: liftoff.querySelector("[data-liftoff-plan]"),
+          flight: liftoff.querySelector("[data-liftoff-flight]"),
+          outcome: liftoff.querySelector("[data-liftoff-outcome]"),
+          log: liftoff.querySelector("[data-liftoff-log]"),
+          title: liftoff.querySelector("[data-liftoff-title]"),
+          grid: liftoff.querySelector("[data-liftoff-grid]"),
+          proceed: liftoff.querySelector("[data-liftoff-proceed]"),
+          cancel: liftoff.querySelector("[data-liftoff-cancel]"),
+          flightTitle: liftoff.querySelector("[data-liftoff-flight-title]"),
+          live: liftoff.querySelector("[data-liftoff-live]"),
+          elapsed: liftoff.querySelector("[data-liftoff-elapsed]"),
+          hide: liftoff.querySelector("[data-liftoff-hide]"),
+          seal: liftoff.querySelector("[data-liftoff-seal]"),
+          outcomeTitle: liftoff.querySelector("[data-liftoff-outcome-title]"),
+          outcomeDetail: liftoff.querySelector("[data-liftoff-outcome-detail]"),
+          review: liftoff.querySelector("[data-liftoff-review]"),
+          rebuild: liftoff.querySelector("[data-liftoff-rebuild]"),
+          done: liftoff.querySelector("[data-liftoff-done]"),
+          confetti: liftoff.querySelector("[data-liftoff-confetti]"),
+          conflict: liftoff.querySelector("[data-liftoff-conflict]"),
+          conflictCommands: liftoff.querySelector("[data-conflict-commands]"),
+          conflictCopy: liftoff.querySelector("[data-conflict-copy]"),
+          conflictCopyPrompt: liftoff.querySelector("[data-conflict-copy-prompt]"),
+          conflictRaw: liftoff.querySelector("[data-conflict-raw]"),
+          // u4 — the automate-first recovery surface layered over the expert fallback.
+          conflictSummary: liftoff.querySelector("[data-conflict-summary]"),
+          conflictAuto: liftoff.querySelector("[data-conflict-auto]"),
+          conflictPrimaryStatus: liftoff.querySelector("[data-conflict-primary-status]"),
+          conflictCards: liftoff.querySelector("[data-conflict-cards]"),
+          conflictFiles: liftoff.querySelector("[data-conflict-files]"),
+          conflictCardsStatus: liftoff.querySelector("[data-conflict-cards-status]"),
+          conflictCardButtons: liftoff.querySelectorAll("[data-conflict-card]"),
+          conflictExpert: liftoff.querySelector("[data-conflict-expert]"),
+        }
+      : null;
+
+    // The terminal recovery for a merge-refused candidate: verify the checkout
+    // actually backs THIS change (`tot pr` marks the current checkout's candidate
+    // "(active)" — rebasing the wrong clone/branch is the classic footgun), then
+    // rebase onto the moved preview and re-submit. The open PR updates in place
+    // on re-push. DELIBERATELY comment-free: a live paste-through showed zsh
+    // (no interactivecomments) chokes on `#` lines — every word of guidance
+    // lives in the prose above the block, the block is pure paste-safe commands.
+    const conflictCommandsFor = () => ["tot pr", "git fetch origin", "git rebase origin/preview", "tot preview"].join("\n");
+
+    // The same recovery shaped as a PROMPT for the operator's coding agent
+    // (Claude Code, etc.) — the multi-step, judgment-required version. Every
+    // step below earned its place in a live 2026-08-20 recovery run:
+    // the git-status preflight (an ABANDONED half-rebase with committed
+    // conflict markers was lurking and poisoned the first attempt), the
+    // two-stage auth self-heal (tot login fixes the session, NOT the token
+    // baked into the remote URL — u10 credential-helper removes this), the
+    // conflict-intent framing, and the never-`--fork-candidate` rule.
+    const conflictPromptFor = (change?: any, rawMessage?: any) => {
+      const tenant = appDomain || repo;
+      const pr = change && change.prNumber != null ? "PR #" + change.prNumber : "my open candidate PR";
+      return [
+        "In my " + tenant + " store checkout on this machine, " + pr + " could not be integrated: " +
+          "the shared `preview` branch changed after my change branched, and the two now conflict. " +
+          "Bring my change up to date and re-submit it.",
+        "",
+        "1. Run `git status` first. If a rebase/merge is already in progress (a previous recovery attempt may have been abandoned), inspect it, then `git rebase --abort` to start clean — and check the tracked files for committed `<<<<<<<` conflict markers while you're there.",
+        "2. Run `tot pr` and confirm " + pr + " is listed and marked (active) for this checkout — if it isn't, stop and tell me before touching anything.",
+        "3. Run `git fetch origin`, then `git rebase origin/preview`. On an authentication failure: `tot login`, retry; if fetch STILL fails, the token embedded in the remote URL has rotated — replace the remote with a freshly minted one: `git remote set-url origin \"$(tot clone " + tenant + " --remote-only --print-remote)\"` (this matches how the checkout was originally configured; ask me first if you're unsure).",
+        "4. Resolve any conflicts git flags, preserving the intent of my change on the lines it edited; keep preview's version everywhere else. Show me the resolution if the same lines were edited on both sides. Never commit a file still containing conflict markers; finish with `git rebase --continue` — a half-done rebase must never be left behind.",
+        "5. Re-submit with `tot preview` (plain — never `--fork-candidate`, which would fork a separate PR). " + pr + " updates in place.",
+        "6. Confirm the push succeeded and the submit output reports the preview building. Then end by reminding me how to FINISH adding it once the build is ready: back in the store admin's Publish tab (" + adminPublishUrl() + "), " + pr + " → Add to release" +
+          (change && change.prNumber != null
+            ? " — or from this terminal: `tot accept --tenant " + tenant + " --pr " + change.prNumber + "`."
+            : "."),
+        rawMessage ? "\nThe system's refusal, for reference: " + rawMessage : "",
+      ].join("\n");
+    };
+
+    // The Publish tab's own URL — where the operator copying this prompt is
+    // standing right now — so the agent's closing hand-back can name it exactly.
+    const adminPublishUrl = () => window.location.origin + window.location.pathname + "#publish";
+
+    // ── u4: automate-first conflict recovery ──────────────────────────────────
+    // The per-change resolve route (u3): POST /api/changes/<changeId>/resolve.
+    // Derived off changesEndpoint so it inherits the tenant surface's basePath.
+    const resolveEndpointFor = (changeId?: any) =>
+      ds.changesEndpoint + "/" + encodeURIComponent(changeId) + "/resolve";
+
+
+    // Reveal the three option cards, naming the exact files diff3 could not
+    // auto-combine (never a bare list with no next step).
+    const revealConflictCards = (unresolved?: any) => {
+      if (!liftoffEls.conflictCards) return;
+      liftoffEls.conflictCards.hidden = false;
+      if (liftoffEls.conflictFiles) {
+        liftoffEls.conflictFiles.textContent = "";
+        (unresolved || []).forEach((f: any) => {
+          const li = document.createElement("li");
+          li.textContent = f;
+          liftoffEls.conflictFiles.append(li);
+        });
+        liftoffEls.conflictFiles.hidden = (unresolved || []).length === 0;
+      }
+    };
+
+    // Open the collapsed expert/terminal fallback and bring it into view — the
+    // honest destination for a same-line overlap only a human/agent can combine,
+    // and the graceful landing when automation isn't deployed (501).
+    const revealExpertFallback = () => {
+      if (liftoffEls.conflictExpert) {
+        liftoffEls.conflictExpert.open = true;
+        liftoffEls.conflictExpert.scrollIntoView({ block: "nearest" });
+      }
+    };
+
+    const setConflictStatus = (el?: any, message?: any, state?: any) => {
+      if (!el) return;
+      el.hidden = !message;
+      el.textContent = message || "";
+      if (state) el.dataset.state = state;
+      else delete el.dataset.state;
+    };
+
+    // POST /resolve with `strategy`, then act on the classified outcome. From the
+    // primary action `source` is "primary" (a clean rebuild reveals cards on the
+    // rare overlap); from a card it's "card" (a merge card that re-hits the overlap
+    // escalates to the expert fallback rather than looping). A clean rebuild ALWAYS
+    // auto-re-integrates exactly once via the existing runIntegration flow.
+    const resolveThenReintegrate = async (change?: any, strategy?: any, button?: any, source?: any) => {
+      const statusEl2 = source === "card" ? liftoffEls.conflictCardsStatus : liftoffEls.conflictPrimaryStatus;
+      const controls = [liftoffEls.conflictAuto, ...Array.from(liftoffEls.conflictCardButtons || [])].filter(Boolean);
+      controls.forEach((b) => { b.disabled = true; });
+      setConflictStatus(statusEl2, "Updating your change…");
+      try {
+        const res = await fetch(resolveEndpointFor(change.changeId), {
+          method: "POST",
+          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
+          body: JSON.stringify({ repo, strategy }),
+        });
+        const body = await res.json().catch(() => ({}));
+        const action = classifyResolveResponse(change, res.status, body);
+        if (action.kind === "reintegrate") {
+          setConflictStatus(statusEl2, "");
+          // Auto-re-integrate ONCE with the refreshed change (new PR/head).
+          runIntegration(action.change, button);
+        } else if (action.kind === "already-integrated") {
+          // The change already merged/integrated — recovery is a clean no-op success,
+          // NOT an error (fb-1787916141762-owjzis). Close the panel and refresh the
+          // queue so the now-stale row drops off; never reveal the expert fallback.
+          setConflictStatus(statusEl2, "This change is already in your next release — nothing to recover.", "ok");
+          if (liftoff) liftoff.hidden = true;
+          loadQueue();
+        } else if (action.kind === "cards") {
+          if (source === "card") {
+            // A merge card that STILL overlaps — no safe auto-combine exists; hand
+            // the specific files to the expert/terminal path.
+            setConflictStatus(
+              statusEl2,
+              "These files need a hand-merge — see “Do it manually instead” below.",
+              "err",
+            );
+            revealConflictCards(action.unresolved);
+            revealExpertFallback();
+          } else {
+            setConflictStatus(statusEl2, "");
+            revealConflictCards(action.unresolved);
+          }
+        } else if (action.kind === "unavailable") {
+          setConflictStatus(
+            statusEl2,
+            "Automatic update isn't available on this store yet — use the manual steps below.",
+            "err",
+          );
+          revealExpertFallback();
+        } else {
+          setConflictStatus(statusEl2, action.message, "err");
+          revealExpertFallback();
+        }
+      } catch {
+        setConflictStatus(statusEl2, "Couldn't reach the server — try the manual steps below.", "err");
+        revealExpertFallback();
+      } finally {
+        controls.forEach((b) => { b.disabled = false; });
+      }
+    };
+
+    // Show/clear the merge-conflict guidance inside the outcome phase. Every
+    // outcome path calls this — visible ONLY for the merge_failed refusal, so a
+    // conflict block from a previous run can never leak into an unrelated outcome.
+    const setConflictGuidance = (visible?: any, rawMessage?: any, change?: any) => {
+      if (!liftoffEls || !liftoffEls.conflict) return;
+      liftoffEls.conflict.hidden = !visible;
+      if (!visible) return;
+      liftoffEls.conflictCommands.textContent = conflictCommandsFor();
+      // The AI prompt is rebuilt per outcome (change + raw message vary) and
+      // stashed on the element; the one-time click handler reads the stash.
+      liftoffEls.conflict.dataset.prompt = conflictPromptFor(change, rawMessage || "");
+      // The forge's own words, kept small for support/diagnosis — the headline
+      // above already says what happened in product language.
+      liftoffEls.conflictRaw.textContent = rawMessage || "";
+      const wireCopy = (btn?: any, label?: any, getText?: any) => {
+        if (!btn || btn.dataset.wired) return;
+        btn.dataset.wired = "1";
+        btn.addEventListener("click", () => {
+          navigator.clipboard.writeText(getText()).then(
+            () => {
+              btn.textContent = "Copied";
+              setTimeout(() => { btn.textContent = label; }, 1600);
+            },
+            () => { /* clipboard denied — the commands are selectable text */ },
+          );
+        });
+      };
+      wireCopy(liftoffEls.conflictCopy, "Copy commands", () => liftoffEls.conflictCommands.textContent);
+      wireCopy(liftoffEls.conflictCopyPrompt, "Copy prompt for your AI agent", () => liftoffEls.conflict.dataset.prompt || "");
+
+      // u4 — reset the automate-first surface for THIS outcome so a prior run's
+      // cards/status/expanded-expert never leak in, then bind the primary action +
+      // option cards to the current change (`.onclick` overwrites, never stacks).
+      if (liftoffEls.conflictCards) liftoffEls.conflictCards.hidden = true;
+      if (liftoffEls.conflictFiles) liftoffEls.conflictFiles.textContent = "";
+      if (liftoffEls.conflictExpert) liftoffEls.conflictExpert.open = false;
+      setConflictStatus(liftoffEls.conflictPrimaryStatus, "");
+      setConflictStatus(liftoffEls.conflictCardsStatus, "");
+      if (liftoffEls.conflictSummary) {
+        // The only structured collision data that survives to the client is the
+        // forge's refusal text (integrate flattens u2's {files,competing} to a
+        // string) + the diff3 `unresolved` list on the resolve response. Name the
+        // competing PR when the refusal mentions one; else stay generic.
+        const prRef = /pr[ #]*([0-9]+)/i.exec(rawMessage || "");
+        liftoffEls.conflictSummary.textContent = prRef
+          ? "Another change (PR #" + prRef[1] + ") reached the store first and touched the same content."
+          : "";
+        liftoffEls.conflictSummary.hidden = !prRef;
+      }
+      if (liftoffEls.conflictAuto) {
+        liftoffEls.conflictAuto.onclick = () =>
+          resolveThenReintegrate(change, "merge", liftoffEls.conflictAuto, "primary");
+      }
+      (liftoffEls.conflictCardButtons || []).forEach((card: any) => {
+        card.onclick = () =>
+          resolveThenReintegrate(change, card.dataset.strategy, card, "card");
+      });
+    };
+
+    // A settled conflict is visible in the queue before an integration POST.
+    // Open the same recovery surface normally shown after `merge_failed`, without
+    // claiming that an integration was attempted or changing the aggregate.
+    const openConflictRecovery = (change?: any, button?: any) => {
+      if (!liftoff || !liftoffEls) {
+        setStatus(
+          statusEl,
+          "This change needs updating against the latest preview before it can be added.",
+          "err",
+        );
+        return;
+      }
+      liftoffOpenedFrom = button || null;
+      const target = change.prNumber != null ? "PR #" + change.prNumber : "This change";
+      liftoffEls.seal.dataset.state = "err";
+      liftoffEls.outcomeTitle.textContent = "Preview changed while you worked";
+      liftoffEls.outcomeDetail.textContent =
+        target + " passed its checks, but preview changed after it was created and the two now " +
+        "conflict. Nothing was added — update this change automatically, then review the result.";
+      liftoffEls.review.hidden = true;
+      setConflictGuidance(true, "", change);
+      showPhase("outcome");
+      liftoff.hidden = false;
+      if (liftoffEls.conflictAuto) liftoffEls.conflictAuto.focus();
+    };
+
+    const liftoffStage = (name?: any) =>
+      liftoff && liftoff.querySelector('[data-liftoff-stage="' + name + '"]');
+    const LIFTOFF_STAGES = ["merge", "build", "evidence", "green"];
+    const setStage = (name?: any, state?: any) => {
+      const el = liftoffStage(name);
+      if (el) el.dataset.state = state; // pending | active | done | fail
+    };
+    // Advance the rail so everything before `name` is done and `name` is active.
+    const railTo = (name?: any) => {
+      const idx = LIFTOFF_STAGES.indexOf(name);
+      LIFTOFF_STAGES.forEach((s, i) => {
+        const el = liftoffStage(s);
+        const cur = el && el.dataset.state;
+        if (cur === "fail") return; // never un-fail
+        setStage(s, i < idx ? "done" : i === idx ? "active" : "pending");
+      });
+    };
+
+    let liftoffTimer: any = null;
+    let liftoffPoll: any = null;
+    let liftoffOpenedFrom: any = null;
+    const liftoffLog = makeLogConsole(liftoffEls && liftoffEls.log);
+    // Map a server-pushed integrate phase onto the four-stage rail — the SAME rail,
+    // now driven by REAL boundaries instead of a guessing poll: `merging` → Merge,
+    // the aggregate rebuild's `reading`/`publishing` → Rebuild, `checking` → Evidence.
+    const railFromIntegratePhase = (ev: { event: string; data: string }) => {
+      if (ev.event !== "phase") return;
+      let phase = "";
+      try { phase = JSON.parse(ev.data).phase || ""; } catch { /* ignore */ }
+      if (phase === "merging") railTo("merge");
+      else if (phase === "reading" || phase === "publishing") railTo("build");
+      else if (phase === "checking") railTo("evidence");
+    };
+    const stopLiftoffLoops = () => {
+      if (liftoffTimer) { clearInterval(liftoffTimer); liftoffTimer = null; }
+      if (liftoffPoll) { clearInterval(liftoffPoll); liftoffPoll = null; }
+    };
+    const closeLiftoff = () => {
+      stopLiftoffLoops();
+      if (liftoff) liftoff.hidden = true;
+      if (liftoffEls) liftoffEls.confetti.textContent = "";
+      if (liftoffOpenedFrom && document.contains(liftoffOpenedFrom)) liftoffOpenedFrom.focus();
+      liftoffOpenedFrom = null;
+    };
+    const showPhase = (phase?: any) => {
+      if (!liftoffEls) return;
+      liftoffEls.plan.hidden = phase !== "plan";
+      liftoffEls.flight.hidden = phase !== "flight";
+      liftoffEls.outcome.hidden = phase !== "outcome";
+      if (liftoffCard) liftoffCard.dataset.mode = phase;
+    };
+
+    const planRow = (dt?: any, dd?: any, mono?: any) => {
+      const t = document.createElement("dt");
+      t.textContent = dt;
+      const d = document.createElement("dd");
+      d.textContent = dd;
+      if (mono) d.className = "publish-mono";
+      return [t, d];
+    };
+
+    const celebrate = (container?: any) => {
+      if (!container) return;
+      if (window.matchMedia && window.matchMedia("(prefers-reduced-motion: reduce)").matches) return;
+      const colors = ["#0f9d8f", "#25b8a8", "#f4b942", "#5b8def", "#e2634f"];
+      for (let i = 0; i < 42; i++) {
+        const p = document.createElement("i");
+        p.style.left = Math.random() * 100 + "%";
+        p.style.background = colors[i % colors.length]!;
+        p.style.animationDelay = Math.random() * 0.35 + "s";
+        p.style.animationDuration = 0.9 + Math.random() * 0.9 + "s";
+        p.style.setProperty("--liftoff-drift", (Math.random() * 160 - 80).toFixed(0) + "px");
+        p.style.setProperty("--liftoff-spin", (Math.random() * 640 - 320).toFixed(0) + "deg");
+        container.append(p);
+      }
+      setTimeout(() => { container.textContent = ""; }, 2400);
+    };
+
+
+    const openLiftoff = (change?: any, button?: any) => {
+      if (!liftoff || !liftoffEls) return false;
+      liftoffOpenedFrom = button || null;
+      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
+      liftoffEls.title.textContent = "Add " + target + " to your next release";
+      liftoffEls.grid.textContent = "";
+      liftoffEls.grid.append(
+        ...planRow("Store", appDomain || repo),
+        ...(change.prNumber != null ? planRow("Pull request", "#" + change.prNumber) : []),
+        ...planRow("Change", change.changeId, true),
+        ...(change.headSha ? planRow("Head", shortSha(change.headSha), true) : []),
+      );
+      LIFTOFF_STAGES.forEach((s) => setStage(s, "pending"));
+      liftoffEls.live.textContent = "Working…";
+      liftoffEls.elapsed.textContent = "0:00";
+      showPhase("plan");
+      liftoff.hidden = false;
+      liftoffEls.proceed.focus();
+
+      liftoffEls.cancel.onclick = () => closeLiftoff();
+      liftoffEls.done.onclick = () => closeLiftoff();
+      liftoffEls.hide.onclick = () => { liftoff.hidden = true; }; // flight keeps running
+      liftoffEls.proceed.onclick = () => runIntegration(change, button);
+      return true;
+    };
+
+    // Esc: close in plan/outcome; during flight just hide (the POST keeps going).
+    // Handles BOTH ceremonies (accept liftoff + publish shipoff).
+    document.addEventListener("keydown", (ev) => {
+      if (ev.key !== "Escape") return;
+      if (liftoff && !liftoff.hidden) {
+        const mode = liftoffCard && liftoffCard.dataset.mode;
+        if (mode === "flight") liftoff.hidden = true;
+        else closeLiftoff();
+      }
+      if (shipoff && !shipoff.hidden) {
+        const mode = shipoffCard && shipoffCard.dataset.mode;
+        if (mode === "flight") shipoff.hidden = true;
+        else closeShipoff();
+      }
+      if (buildoff && !buildoff.hidden) {
+        const mode = buildoffCard && buildoffCard.dataset.mode;
+        if (mode === "flight") buildoff.hidden = true; // stream keeps running
+        else closeBuildoff();
+      }
+      if (rebuildoff && !rebuildoff.hidden) {
+        const mode = rebuildoffCard && rebuildoffCard.dataset.mode;
+        if (mode === "flight") rebuildoff.hidden = true; // stream keeps running
+        else closeRebuildoff();
+      }
+    });
+
+    // r12 — focus trap. While a modal ceremony is open (aria-modal), Tab must cycle
+    // WITHIN its card, never escaping to the page behind it. Only the visible phase's
+    // controls are tabbable (the hidden phases' buttons fail the offsetParent test), and
+    // a backgrounded ("Continue in background", hidden) dialog is not trapped.
+    document.addEventListener("keydown", (ev) => {
+      if (ev.key !== "Tab") return;
+      const open: any = [liftoff, shipoff, buildoff, rebuildoff].find((d: any) => d && !d.hidden);
+      if (!open) return;
+      const card: any = open.querySelector(".liftoff-card");
+      if (!card) return;
+      const nodes = Array.from(
+        card.querySelectorAll(
+          'a[href],button:not([disabled]),input:not([disabled]),select:not([disabled]),textarea:not([disabled]),[tabindex]:not([tabindex="-1"])',
+        ),
+      ).filter((el: any) => el.offsetParent !== null || el === document.activeElement) as any[];
+      if (!nodes.length) {
+        ev.preventDefault();
+        card.focus();
+        return;
+      }
+      const first = nodes[0];
+      const last = nodes[nodes.length - 1];
+      const active = document.activeElement;
+      if (ev.shiftKey) {
+        if (active === first || active === card || !card.contains(active)) {
+          ev.preventDefault();
+          last.focus();
+        }
+      } else if (active === last || active === card || !card.contains(active)) {
+        ev.preventDefault();
+        first.focus();
+      }
+    });
+
+    // Render one classified IntegrateOutcomeView onto the liftoff outcome phase —
+    // the SINGLE place the honest result becomes UI. It reads the derived view
+    // (never re-deciding from raw fields), so "Integration did not land" can only
+    // appear when the merge genuinely did not land; a merge that landed with a
+    // failed build reads "Integrated — preview build failed" and offers Rebuild;
+    // an indeterminate outcome reads "unknown" and offers Re-check. Never a 404
+    // review link (only shown when a genuinely-built revision exists).
+    const applyIntegrateOutcome = (view: IntegrateOutcomeView, change?: any) => {
+      if (!liftoffEls) return;
+      // A successful seal (green OR already-integrated) shows every stage done; a
+      // failure marks its honest failing stage.
+      if (view.seal === "ok") {
+        LIFTOFF_STAGES.forEach((s) => setStage(s, "done"));
+      } else if (view.failStage) {
+        setStage(view.failStage, "fail");
+      }
+      liftoffEls.seal.dataset.state = view.seal;
+      liftoffEls.outcomeTitle.textContent = view.title;
+      liftoffEls.outcomeDetail.textContent = view.detail;
+      setConflictGuidance(
+        view.conflictGuidance,
+        view.conflictGuidance ? view.detail : "",
+        change,
+      );
+      // Review deep-link — shown only for a genuinely-built revision (rule 3: no 404).
+      if (view.review.show && view.review.sha) {
+        liftoffEls.review.href =
+          "/" + encodeURIComponent(appDomain) + "/preview/rev/" + view.review.sha + "/";
+        liftoffEls.review.hidden = false;
+      } else {
+        liftoffEls.review.hidden = true;
+      }
+      // The concrete next-step action button (rebuild / re-check). Conflict recovery
+      // owns its own primary button inside the conflict panel, so no duplicate here.
+      const rebuildBtn = liftoffEls.rebuild;
+      if (rebuildBtn) {
+        const act = view.action;
+        const inlineAction =
+          act && (act.kind === "rebuild" || act.kind === "recheck") ? act : null;
+        if (inlineAction) {
+          rebuildBtn.hidden = false;
+          rebuildBtn.textContent = inlineAction.label;
+          rebuildBtn.onclick = () => {
+            closeLiftoff();
+            if (inlineAction.kind === "rebuild") retryBuild(rebuildBtn);
+            else loadQueue();
+          };
+        } else {
+          rebuildBtn.hidden = true;
+          rebuildBtn.onclick = null;
+        }
+      }
+      if (liftoff.hidden) liftoff.hidden = false; // surface even if backgrounded
+      showPhase("outcome");
+      liftoffEls.done.focus();
+      if (view.ok) celebrate(liftoffEls.confetti);
+    };
+
+    // b08 integrate returns an IntegrateOutcome — { ok, queueState, runState,
+    // aggregateSha, pointerMoved, statusMessage, reason? } — NEVER a bare
+    // merged:true. Render it honestly via classifyIntegrateOutcome: green advances
+    // the aggregate; a landed-but-red merge says the build failed (not "did not
+    // land"); an indeterminate result is an explicit unknown, never a silent pass.
+    const runIntegration = async (change?: any, button?: any) => {
+      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
+      if (button) button.disabled = true;
+      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
+      setStatus(statusEl, "Adding " + change.changeId + " to your next release…");
+      const startedAt = Date.now();
+      if (liftoffEls) {
+        showPhase("flight");
+        liftoffLog.reset();
+        liftoffEls.flightTitle.textContent = "Adding " + target + " to your next release";
+        railTo("merge");
+        liftoffEls.live.textContent = "Adding your change to the next release…";
+        liftoffTimer = setInterval(() => {
+          const s = Math.floor((Date.now() - startedAt) / 1000);
+          liftoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
+        }, 1000);
+      }
+      try {
+        const res = await fetch(ds.integrateEndpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            // Real-time server-pushed progress (merge → rebuild → evidence) over SSE;
+            // falls back to buffered JSON for a non-streaming proxy.
+            accept: "text/event-stream",
+            // Mirror of the server-side capability model (UX): the server
+            // re-derives capability and stays authoritative.
+            "x-tot-capability": "ship-on-behalf",
+          },
+          body: JSON.stringify({
+            repo,
+            changeId: change.changeId,
+            prNumber: change.prNumber ?? undefined,
+            expectedHeadSha: change.headSha || undefined,
+          }),
+        });
+        // Drive the stage-rail + scrolling log from the REAL streamed phases (no
+        // more client-side guessing poll); the terminal `result` carries the honest
+        // IntegrateOutcome the branches below render.
+        const { data } = await streamWithLog(res, liftoffLog, railFromIntegratePhase);
+        stopLiftoffLoops();
+        // HONEST RESULT — derived from the actual merge/build signals, never a
+        // separate optimistic flag. `aggregateSha` is the discriminator: the
+        // orchestrator writes it IFF the forge merge landed, so a landed merge
+        // whose build failed reads "Integrated — preview build failed" (with a
+        // Rebuild), and only a genuinely-unlanded merge reads "did not land".
+        const view = classifyIntegrateOutcome({
+          httpOk: res.ok,
+          ok: data.ok === true,
+          aggregateSha: data.aggregateSha ?? null,
+          queueState: data.queueState ?? null,
+          reason: data.reason ?? null,
+          statusMessage: data.statusMessage ?? null,
+          error: data.error ?? null,
+          target,
+        });
+        setStatus(statusEl, view.detail, view.seal);
+        if (view.ok) void autoSweepBranches();
+        if (view.seal === "err") {
+          // C5 — append the merge-doctor's read of THIS candidate's failure to the
+          // outcome detail (best-effort, additive; the view's copy stands on its own).
+          surfaceDoctorHint(
+            (p) => integrateFailureDoctor(p, { changeId: change.changeId, prNumber: change.prNumber }),
+            [liftoffEls && liftoffEls.outcomeDetail, statusEl],
+          );
+        }
+        applyIntegrateOutcome(view, change);
+      } catch {
+        stopLiftoffLoops();
+        // A network fault means we DON'T KNOW whether the merge landed — unknown =
+        // error, never a silent "did not land". Re-check the queue, don't assume.
+        const view = classifyIntegrateOutcome({ httpOk: false, networkError: true, target });
+        setStatus(statusEl, view.detail, "err");
+        applyIntegrateOutcome(view, change);
+      } finally {
+        busyChanges.delete(change.changeId);
+        if (button) button.disabled = false;
+        loadQueue();
+      }
+    };
+
+    const integrateCandidate = (change?: any, button?: any) => {
+      // The liftoff dialog IS the plan confirm now; window.confirm stays only as
+      // the no-dialog fallback (markup missing = fail open to the old popup).
+      if (openLiftoff(change, button)) return;
+      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
+      const plan =
+        "Add to release plan:\n  store:     " + (appDomain || repo) +
+        (change.prNumber != null ? "\n  PR:        #" + change.prNumber : "") +
+        "\n  change id: " + change.changeId +
+        (change.headSha ? "\n  head sha:  " + shortSha(change.headSha) : "") +
+        "\n  effect:    add " + target + " to your next release, then rebuild the preview and " +
+        "re-run its checks. Does NOT go live — you publish your release separately.";
+      if (!window.confirm(plan + "\n\nProceed?")) return;
+      runIntegration(change, button);
+    };
+
+    const rejectChange = async (change?: any, button?: any) => {
+      const reason = window.prompt(
+        "Reject " + change.changeId +
+        " — this closes the PR and removes its hosted preview and candidate branch. " +
+        "Add a short note for the submitter:",
+      );
+      if (reason == null) return;
+      if (!reason.trim()) {
+        setStatus(statusEl, "A reject note is required.", "err");
+        return;
+      }
+      button.disabled = true;
+      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
+      setStatus(statusEl, "Rejecting " + change.changeId + "…");
+      try {
+        const res = await fetch(
+          ds.changesEndpoint + "/" + encodeURIComponent(change.changeId) + "/reject",
+          {
+            method: "POST",
+            headers: {
+              "content-type": "application/json",
+              "x-tot-capability": "ship-on-behalf",
+            },
+            body: JSON.stringify({ repo, reason: reason.trim() }),
+          },
+        );
+        const data = await res.json().catch(() => ({}));
+        if (res.ok) {
+          setStatus(
+            statusEl,
+            data.cleanupWarning
+              ? "Change " + change.changeId + " rejected. " + data.cleanupWarning + "."
+              : "Change " +
+                  change.changeId +
+                  " rejected; its PR, preview, and candidate branch are cleaned up.",
+            data.cleanupWarning ? "err" : "ok",
+          );
+          void autoSweepBranches();
+        } else {
+          setStatus(statusEl, data.error || "Reject failed (" + res.status + ")", "err");
+        }
+      } catch {
+        setStatus(statusEl, "Reject failed — network error", "err");
+      } finally {
+        busyChanges.delete(change.changeId);
+        button.disabled = false;
+        loadQueue();
+      }
+    };
+
+    // u14 — per-change REVERT (Undo): roll ONE change OUT of the shared staged
+    // preview. Appends a revert commit + rebuilds the `preview` aggregate; it NEVER
+    // touches the live channel (no paywall, `/api/changes/revert`). The outcome is
+    // rendered HONESTLY per the queue's reason — `already_reverted` / `target_not_found`
+    // are calm informational states (the change is simply already out of staging), not
+    // errors, so they never flash red.
+    const revertStaged = async (pr?: any, button?: any) => {
+      const target = pr.prNumber != null ? "PR #" + pr.prNumber : pr.changeId;
+      const plan =
+        "Undo " + target + " from the staged preview?\n\n" +
+        "  tenant:  " + (appDomain || repo) + "\n" +
+        "  target:  " + target + "\n" +
+        "  effect:  append a revert commit to the staged preview and rebuild — the change\n" +
+        "           comes OUT of staging. Your live site is untouched.\n\n" +
+        "Proceed?";
+      if (!window.confirm(plan)) return;
+      button.disabled = true;
+      setStatus(statusEl, "Reverting " + target + " out of the staged preview…");
+      try {
+        const res = await fetch(ds.changesEndpoint + "/revert", {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            "x-tot-capability": "ship-on-behalf",
+          },
+          body: JSON.stringify({ repo, prNumber: pr.prNumber }),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (res.ok && data.ok) {
+          setStatus(statusEl, "Reverted " + target + " — the staged preview is rebuilding.", "ok");
+        } else if (res.ok && (data.reason === "already_reverted" || data.reason === "target_not_found")) {
+          // Not an error: the change is already out of staging (or was never in it).
+          setStatus(
+            statusEl,
+            data.reason === "already_reverted"
+              ? target + " was already removed from the staged preview."
+              : target + " isn't in the staged preview — nothing to undo.",
+          );
+        } else {
+          setStatus(statusEl, data.error || data.statusMessage || "Undo failed (" + res.status + ")", "err");
+        }
+      } catch {
+        setStatus(statusEl, "Undo failed — network error", "err");
+      } finally {
+        button.disabled = false;
+        loadQueue();
+      }
+    };
+
+    // u15 — retry a DEAD aggregate rebuild, no new merge: the last candidate's
+    // PR already merged into preview, but the build/evidence step that follows
+    // died (e.g. a transient MCP error). `POST /api/changes/rebuild` re-runs
+    // ONLY that step against the sha the forge already carries — never a
+    // second merge attempt, never a membership change. It streams its
+    // reading/publishing/checking phases into the SAME shared scrolling live-log
+    // console the other flights use, with Continue-in-background + a Copy-for-AI
+    // failure brief.
+    const rebuildoff: any = root.querySelector("[data-rebuildoff]");
+    const rebuildoffCard = rebuildoff && rebuildoff.querySelector(".liftoff-card");
+    const rebuildoffEls: any = rebuildoff
+      ? {
+          flight: rebuildoff.querySelector("[data-rebuildoff-flight]"),
+          outcome: rebuildoff.querySelector("[data-rebuildoff-outcome]"),
+          log: rebuildoff.querySelector("[data-rebuildoff-log]"),
+          live: rebuildoff.querySelector("[data-rebuildoff-live]"),
+          elapsed: rebuildoff.querySelector("[data-rebuildoff-elapsed]"),
+          hide: rebuildoff.querySelector("[data-rebuildoff-hide]"),
+          seal: rebuildoff.querySelector("[data-rebuildoff-seal]"),
+          outcomeTitle: rebuildoff.querySelector("[data-rebuildoff-outcome-title]"),
+          outcomeDetail: rebuildoff.querySelector("[data-rebuildoff-outcome-detail]"),
+          failure: rebuildoff.querySelector("[data-rebuildoff-failure]"),
+          failureDetail: rebuildoff.querySelector("[data-rebuildoff-failure-detail]"),
+          copy: rebuildoff.querySelector("[data-rebuildoff-copy]"),
+          done: rebuildoff.querySelector("[data-rebuildoff-done]"),
+        }
+      : null;
+    let rebuildoffTimer: any = null;
+    let rebuildoffOpenedFrom: any = null; // r12: return focus here on close
+    let rebuildFailureCopyText = "";
+    const rebuildLog = makeLogConsole(rebuildoffEls && rebuildoffEls.log);
+    const stopRebuildoffTimer = () => {
+      if (rebuildoffTimer) { clearInterval(rebuildoffTimer); rebuildoffTimer = null; }
+    };
+    const closeRebuildoff = () => {
+      stopRebuildoffTimer();
+      if (rebuildoff) rebuildoff.hidden = true;
+      if (rebuildoffOpenedFrom && document.contains(rebuildoffOpenedFrom)) rebuildoffOpenedFrom.focus();
+      rebuildoffOpenedFrom = null;
+    };
+    const showRebuildoffPhase = (phase?: any) => {
+      if (!rebuildoffEls) return;
+      rebuildoffEls.flight.hidden = phase !== "flight";
+      rebuildoffEls.outcome.hidden = phase !== "outcome";
+      if (rebuildoffCard) rebuildoffCard.dataset.mode = phase;
+    };
+    if (rebuildoffEls) {
+      rebuildoffEls.done.onclick = () => closeRebuildoff();
+      if (rebuildoffEls.hide) rebuildoffEls.hide.onclick = () => { rebuildoff.hidden = true; }; // stream keeps running
+      if (rebuildoffEls.copy) {
+        rebuildoffEls.copy.addEventListener("click", () => {
+          navigator.clipboard.writeText(rebuildFailureCopyText).then(
+            () => {
+              rebuildoffEls.copy.textContent = "Copied";
+              setTimeout(() => { rebuildoffEls.copy.textContent = "Copy for your AI agent"; }, 1600);
+            },
+            () => { /* clipboard denied — the detail is selectable text */ },
+          );
+        });
+      }
+    }
+
+    const retryBuild = async (button?: any) => {
+      if (!window.confirm(
+        "Retry the build for " + (appDomain || repo) + "?\n\n" +
+          "  effect:  rebuild your next release and re-run its checks —\n" +
+          "           nothing new is added.\n\n" +
+          "Proceed?",
+      )) return;
+      button.disabled = true;
+      rebuildoffOpenedFrom = button || null; // r12: return focus here on close
+      aggregateRetrying = true; // rux7-style: hold disabled across a poll landing mid-retry
+      setStatus(aggStatusEl, "Retrying the build…");
+      const startedAt = Date.now();
+      if (rebuildoffEls) {
+        showRebuildoffPhase("flight");
+        rebuildLog.reset();
+        if (rebuildoffEls.failure) rebuildoffEls.failure.hidden = true;
+        rebuildoffEls.live.textContent = "Rebuilding your next release preview…";
+        rebuildoffEls.elapsed.textContent = "0:00";
+        rebuildoff.hidden = false;
+        stopRebuildoffTimer();
+        rebuildoffTimer = setInterval(() => {
+          const s = Math.floor((Date.now() - startedAt) / 1000);
+          rebuildoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
+        }, 1000);
+      }
+      const outcome = (state?: any, title?: any, detail?: any, failureDetail?: any) => {
+        stopRebuildoffTimer();
+        if (!rebuildoffEls) return;
+        rebuildoffEls.seal.dataset.state = state;
+        rebuildoffEls.outcomeTitle.textContent = title;
+        rebuildoffEls.outcomeDetail.textContent = detail;
+        if (rebuildoffEls.failure) {
+          if (failureDetail) {
+            rebuildoffEls.failure.hidden = false;
+            rebuildoffEls.failureDetail.textContent = failureDetail;
+          } else {
+            rebuildoffEls.failure.hidden = true;
+          }
+        }
+        if (rebuildoff.hidden) rebuildoff.hidden = false; // re-surface if backgrounded
+        showRebuildoffPhase("outcome");
+        rebuildoffEls.done.focus();
+      };
+      try {
+        const res = await fetch(ds.changesEndpoint + "/rebuild", {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            // Real-time server-pushed progress (reading → publishing → checking) over
+            // SSE; falls back to buffered JSON for a non-streaming proxy.
+            accept: "text/event-stream",
+            "x-tot-capability": "ship-on-behalf",
+          },
+          body: JSON.stringify({ repo }),
+        });
+        const { data } = await streamWithLog(res, rebuildLog);
+        if (data.ok) {
+          setStatus(aggStatusEl, "Build retry passed — your next release is ready.", "ok");
+          outcome("ok", "Your next release is ready", "The rebuild passed all your store's checks. Nothing is live yet.");
+        } else if (data.reason === "nothing_to_rebuild") {
+          setStatus(aggStatusEl, "Nothing to rebuild — there's no earlier build to retry yet.");
+          outcome(
+            "ok",
+            "Nothing to rebuild",
+            "There's no earlier preview build for this store to retry yet.",
+          );
+        } else {
+          const detail =
+            data.statusMessage || data.error || "your next release did not pass its checks (" + (data.reason || data.queueState) + ")";
+          setStatus(aggStatusEl, "Build retry did not pass: " + detail, "err");
+          rebuildFailureCopyText = [
+            "In my " + (appDomain || repo) + " store, retrying the preview build did not pass. " +
+              "Diagnose why from the detail below, then tell me the exact fix.",
+            "",
+            "What the rebuild reported:",
+            detail,
+            "\nContext: this re-runs ONLY the aggregate rebuild + combined evidence against the " +
+              "last merged commit on the shared `preview` branch — no new merge, no membership change.",
+          ].join("\n");
+          outcome("err", "The rebuild didn't pass", detail + " Your next release is unchanged.", detail);
+          surfaceDoctorHint((p) => shipFailureDoctor(p), [rebuildoffEls && rebuildoffEls.outcomeDetail, aggStatusEl]);
+        }
+      } catch {
+        setStatus(aggStatusEl, "Retry failed — network error", "err");
+        outcome(
+          "err",
+          "The rebuild didn't finish",
+          "Network error mid-rebuild — refresh the queue to see your next release's honest state.",
+        );
+      } finally {
+        aggregateRetrying = false;
+        button.disabled = false;
+        loadQueue();
+      }
+    };
+
+    // ---- rux5: build-on-demand for a synthetic not-built PR ------------------
+    // Mirror of the integrate plan affordance: state EXACTLY what build
+    // does — materialize this PR's hosted preview at its forge head — and that it
+    // is INERT (flips no live channel). POSTs { pr, headSha?, baseSha? }; the row
+    // already carries the head sha GET /api/changes resolved via forge PR-read, and
+    // the server re-resolves it authoritatively when the body omits it. Shows an
+    // in-progress state (disabled + "Building…") while the build runs, then reloads
+    // the queue so the freshly-built PR reappears as a built candidate.
+
+    const buildPreviewPlan = (change?: any) => {
+      const lines = ["Build preview plan:", "  tenant:   " + (appDomain || repo)];
+      lines.push("  PR:       #" + change.prNumber);
+      if (change.headSha) lines.push("  head sha: " + shortSha(change.headSha));
+      lines.push(
+        "  effect:   materialize this PR's hosted preview at its head — INERT " +
+          "(does NOT go live).",
+      );
+      return lines.join("\n");
+    };
+
+    // ── Build-flight dialog (real-time SSE build/check progress) ─────────────
+    // Mirrors the accept liftoff's flight → outcome ceremony (same liftoff-* markup)
+    // but is driven by the phase events `POST /api/preview/build` streams over SSE.
+    // "Continue in background" hides the dialog while the stream keeps running; on a
+    // FAILURE the outcome shows the honest detail + a "Copy for your AI agent" button.
+    const buildoff: any = root.querySelector("[data-buildoff]");
+    const buildoffCard = buildoff && buildoff.querySelector(".liftoff-card");
+    const buildoffEls: any = buildoff
+      ? {
+          flight: buildoff.querySelector("[data-buildoff-flight]"),
+          outcome: buildoff.querySelector("[data-buildoff-outcome]"),
+          log: buildoff.querySelector("[data-buildoff-log]"),
+          flightTitle: buildoff.querySelector("[data-buildoff-flight-title]"),
+          live: buildoff.querySelector("[data-buildoff-live]"),
+          elapsed: buildoff.querySelector("[data-buildoff-elapsed]"),
+          hide: buildoff.querySelector("[data-buildoff-hide]"),
+          seal: buildoff.querySelector("[data-buildoff-seal]"),
+          outcomeTitle: buildoff.querySelector("[data-buildoff-outcome-title]"),
+          outcomeDetail: buildoff.querySelector("[data-buildoff-outcome-detail]"),
+          failure: buildoff.querySelector("[data-buildoff-failure]"),
+          failureDetail: buildoff.querySelector("[data-buildoff-failure-detail]"),
+          copy: buildoff.querySelector("[data-buildoff-copy]"),
+          review: buildoff.querySelector("[data-buildoff-review]"),
+          done: buildoff.querySelector("[data-buildoff-done]"),
+        }
+      : null;
+
+    let buildoffTimer: any = null;
+    let buildoffOpenedFrom: any = null;
+    let buildFailureCopyText = "";
+    const buildLog = makeLogConsole(buildoffEls && buildoffEls.log);
+    const stopBuildoffTimer = () => {
+      if (buildoffTimer) { clearInterval(buildoffTimer); buildoffTimer = null; }
+    };
+    const closeBuildoff = () => {
+      stopBuildoffTimer();
+      if (buildoff) buildoff.hidden = true;
+      if (buildoffOpenedFrom && document.contains(buildoffOpenedFrom)) buildoffOpenedFrom.focus();
+      buildoffOpenedFrom = null;
+    };
+    const showBuildoffPhase = (phase?: any) => {
+      if (!buildoffEls) return;
+      buildoffEls.flight.hidden = phase !== "flight";
+      buildoffEls.outcome.hidden = phase !== "outcome";
+      if (buildoffCard) buildoffCard.dataset.mode = phase;
+    };
+    const setBuildRail = (stageState?: any) => {
+      if (!buildoff) return;
+      BUILD_STAGES.forEach((s) => {
+        const el = buildoff.querySelector('[data-buildoff-stage="' + s + '"]');
+        if (el) el.dataset.state = stageState[s];
+      });
+    };
+    if (buildoffEls) {
+      // Copy-for-AI wiring (once): the honest failure brief for a coding agent.
+      buildoffEls.copy.addEventListener("click", () => {
+        navigator.clipboard.writeText(buildFailureCopyText).then(
+          () => {
+            buildoffEls.copy.textContent = "Copied";
+            setTimeout(() => { buildoffEls.copy.textContent = "Copy for your AI agent"; }, 1600);
+          },
+          () => { /* clipboard denied — the detail is selectable text */ },
+        );
+      });
+      buildoffEls.done.onclick = () => closeBuildoff();
+    }
+
+    // Stream the build over SSE, reflecting each phase on the flight rail. Falls back
+    // to a one-shot JSON read if the response wasn't an event-stream (a buffering
+    // proxy, or a server that doesn't stream) so the action always completes honestly.
+    const streamBuild = async (change?: any, button?: any) => {
+      const label = "PR #" + change.prNumber;
+      if (change.prNumber != null) inflightBuilds.add(change.prNumber);
+      if (button) {
+        button.disabled = true;
+        button.dataset.building = "true";
+        button.textContent = "Building…";
+      }
+      setStatus(statusEl, "Building preview for " + label + "…");
+
+      let progress: BuildProgress = initialBuildProgress();
+      if (buildoffEls) {
+        buildoffOpenedFrom = button || null;
+        buildoffEls.flightTitle.textContent = "Building preview for " + label;
+        setBuildRail(progress.stageState);
+        buildLog.reset();
+        buildoffEls.live.textContent = "Starting…";
+        buildoffEls.elapsed.textContent = "0:00";
+        if (buildoffEls.failure) buildoffEls.failure.hidden = true;
+        if (buildoffEls.review) buildoffEls.review.hidden = true;
+        showBuildoffPhase("flight");
+        buildoff.hidden = false;
+        const startedAt = Date.now();
+        stopBuildoffTimer();
+        buildoffTimer = setInterval(() => {
+          const s = Math.floor((Date.now() - startedAt) / 1000);
+          buildoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
+        }, 1000);
+        buildoffEls.hide.onclick = () => { buildoff.hidden = true; }; // stream keeps running
+        buildoffEls.done.onclick = () => closeBuildoff();
+      }
+
+      const applyEvent = (ev: any) => {
+        if (ev && ev.event === "phase") buildLog.pushEvent(ev);
+        progress = reduceBuildProgress(progress, ev);
+        if (buildoffEls) {
+          setBuildRail(progress.stageState);
+          buildoffEls.live.textContent = progress.liveLabel;
+        }
+      };
+
+      const renderOutcome = (result: BuildResult) => {
+        stopBuildoffTimer();
+        buildLog.finish(result as StreamTerminalResult);
+        if (result.ok) {
+          setStatus(
+            statusEl,
+            "Built preview for " + label + " — it now appears as a built change in the queue.",
+            "ok",
+          );
+        } else if (result.outcome === "blocked") {
+          setStatus(
+            statusEl,
+            "Build did not complete for " + label + ": " + (buildFailureDetail(result) || "blocked"),
+            "err",
+          );
+        } else {
+          setStatus(
+            statusEl,
+            (result.errors && result.errors.join("; ")) || result.error || "Build failed",
+            "err",
+          );
+        }
+        if (!buildoffEls) return;
+        if (result.ok) {
+          buildoffEls.seal.dataset.state = "ok";
+          buildoffEls.outcomeTitle.textContent = "Preview built";
+          buildoffEls.outcomeDetail.textContent =
+            label + " is materialized — it now appears as a built change in the queue, ready to review.";
+          if (buildoffEls.failure) buildoffEls.failure.hidden = true;
+          if (buildoffEls.review) {
+            if (result.previewUrl) {
+              buildoffEls.review.href = result.previewUrl;
+              buildoffEls.review.hidden = false;
+            } else {
+              buildoffEls.review.hidden = true;
+            }
+          }
+        } else {
+          buildoffEls.seal.dataset.state = "err";
+          buildoffEls.outcomeTitle.textContent =
+            result.outcome === "blocked" ? "A check blocked this build" : "The build didn't finish";
+          buildoffEls.outcomeDetail.textContent =
+            result.outcome === "blocked"
+              ? label + " built, but a check blocked it. Here's exactly what stopped it — copy it for your AI agent to fix:"
+              : label + " couldn't be built. Here's what the build reported — copy it for your AI agent to diagnose:";
+          if (buildoffEls.review) buildoffEls.review.hidden = true;
+          buildFailureCopyText = assembleBuildFailureCopy({
+            tenant: appDomain || repo,
+            prNumber: change.prNumber,
+            changeId: change.changeId,
+            result,
+          });
+          if (buildoffEls.failure) {
+            buildoffEls.failure.hidden = false;
+            buildoffEls.failureDetail.textContent = buildFailureDetail(result) || "(no detail was reported)";
+          }
+          // Re-surface the dialog if it was dismissed to the background — a failure
+          // needs the operator's eyes, unlike a clean success they already walked away from.
+          if (buildoff.hidden) buildoff.hidden = false;
+        }
+        showBuildoffPhase("outcome");
+        if (!buildoff.hidden) buildoffEls.done.focus();
+      };
+
+      try {
+        const res = await fetch(ds.buildEndpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            accept: "text/event-stream",
+            // Mirror of the server-side capability model (UX); the server
+            // re-derives capability (buildGate) and stays authoritative.
+            "x-tot-capability": "ship-on-behalf",
+          },
+          body: JSON.stringify({
+            pr: change.prNumber,
+            // A row for an ALREADY-KNOWN candidate must carry its real changeId, or
+            // the server falls back to synthesizing "pr-<N>" and writes/reads a
+            // SEPARATE phantom record — the real candidate's ReviewEnvironment never
+            // advances no matter how many times "Run checks" is clicked. Omit it only
+            // for a genuinely not-yet-built row (change.changeId is null there).
+            changeId: change.changeId || undefined,
+            headSha: change.headSha || undefined,
+            baseSha: change.baseSha || undefined,
+          }),
+        });
+        const ct = res.headers.get("content-type") || "";
+        if (res.body && ct.indexOf("text/event-stream") !== -1) {
+          const reader = res.body.getReader();
+          const decoder = new TextDecoder();
+          let buf = "";
+          for (;;) {
+            const { value, done } = await reader.read();
+            if (done) break;
+            buf += decoder.decode(value, { stream: true });
+            const parsed = parseSseChunk(buf);
+            buf = parsed.rest;
+            for (const ev of parsed.events) applyEvent(ev);
+            if (progress.terminal) break;
+          }
+          if (!progress.terminal) {
+            // Stream ended without a terminal result — treat as an honest failure.
+            applyEvent({
+              event: "result",
+              data: JSON.stringify({ ok: false, outcome: "failed", errors: ["the build stream ended unexpectedly"] }),
+            });
+          }
+          renderOutcome(progress.result as BuildResult);
+        } else {
+          // Non-streaming fallback: read the JSON body the endpoint returns to
+          // non-streaming callers and normalize it into the same outcome shape.
+          const data = await res.json().catch(() => ({}) as any);
+          renderOutcome({
+            ok: !!data.ok,
+            outcome: data.outcome || (data.ok ? "ok" : res.status === 422 ? "blocked" : "failed"),
+            tenantId: data.tenantId,
+            changeId: data.changeId,
+            headSha: data.headSha,
+            previewUrl: data.previewUrl,
+            errors: data.errors,
+            error: data.error,
+            findings: data.findings,
+          });
+        }
+      } catch {
+        setStatus(statusEl, "Build failed — network error", "err");
+        if (buildoffEls) {
+          stopBuildoffTimer();
+          buildoffEls.seal.dataset.state = "err";
+          buildoffEls.outcomeTitle.textContent = "The build didn't finish";
+          buildoffEls.outcomeDetail.textContent =
+            "Network error mid-build — refresh the queue to see the honest state.";
+          if (buildoffEls.failure) buildoffEls.failure.hidden = true;
+          if (buildoffEls.review) buildoffEls.review.hidden = true;
+          if (buildoff.hidden) buildoff.hidden = false;
+          showBuildoffPhase("outcome");
+        }
+      } finally {
+        if (change.prNumber != null) inflightBuilds.delete(change.prNumber);
+        if (button) {
+          button.disabled = false;
+          delete button.dataset.building;
+        }
+        loadQueue();
+      }
+    };
+
+    const buildPreview = async (change?: any, button?: any) => {
+      if (!window.confirm(buildPreviewPlan(change) + "\n\nBuild the preview now?")) return;
+      await streamBuild(change, button);
+    };
+
+    // ---- rux6: unified review pane -----------------------------------------
+    // "One review moment": expanding a candidate row reveals a single pane with
+    // the live preview (iframed SAME-ORIGIN — the /<tenant>/preview/pr/<N> route
+    // serves `frame-ancestors 'self'` + `X-Frame-Options: SAMEORIGIN`, so a
+    // same-origin admin embed is permitted; a cross-origin embed is refused,
+    // which is why the pane also always offers an "Open in new tab" link), the
+    // evidence chips the row already carries (change.evidence), the dg7 diff
+    // (reusing renderDiff below — GET /api/changes/<id>/diff, which never invents
+    // a diff for a non-renderable candidate), and the SAME Accept-to-preview /
+    // Reject actions. The reviewer never leaves the queue to review and act; the
+    // server stays authoritative for every action (this is UI consolidation only).
+
+    const diffBase = ds.diffEndpointBase;
+
+    const reviewRowFor = (tr?: any) => {
+      const next = tr.nextElementSibling;
+      return next && next.dataset && next.dataset.publishReviewRow === tr.dataset.changeRowId
+        ? next
+        : null;
+    };
+
+    const closeReview = (tr?: any, button?: any) => {
+      const existing = reviewRowFor(tr);
+      if (existing) existing.remove();
+      if (button) {
+        button.textContent = "Review";
+        button.setAttribute("aria-expanded", "false");
+      }
+    };
+
+    // Evidence chips from the data the row already carries (change.evidence):
+    // an overall promotable verdict + one chip per reported check.
+    const renderEvidenceChips = (container?: any, change?: any) => {
+      const checks = (change.evidence && change.evidence.checks) || [];
+      const promotable = Boolean(change.evidence && change.evidence.promotable);
+      container.append(
+        promotable
+          ? chip("Checks passed", "green", CHIP_GLYPH.green)
+          : chip("Checks blocked", "amber", CHIP_GLYPH.amber),
+      );
+      for (const c of checks) {
+        const tone = c.status === "pass" ? "green" : c.status === "fail" ? "red" : "amber";
+        const label = (c.label || c.id || "check") + (c.status && c.status !== "pass" ? " · " + c.status : "");
+        const el = chip(label, tone, CHIP_GLYPH[tone]);
+        if (c.detail) el.title = c.detail;
+        container.append(el);
+      }
+      if (!checks.length) container.append(subtle("No checks reported yet"));
+    };
+
+    // Build the split pane. Returns the pane node + the diff container so the
+    // caller can populate the diff asynchronously (reusing renderDiff).
+    const buildReviewPane = (change?: any) => {
+      const pane = document.createElement("div");
+      pane.className = "review-pane";
+
+      // Preview column — same-origin iframe of the friendly per-PR route (it
+      // handles every state: ready render, or the not-built page). Falls back to
+      // any server-provided previewUrl for a change-first row with no PR number.
+      const previewUrl = candidatePrUrl(appDomain, change.prNumber) || change.previewUrl;
+      const previewCol = document.createElement("div");
+      previewCol.className = "review-preview";
+      const pHead = document.createElement("div");
+      pHead.className = "review-pane-head";
+      const pTitle = document.createElement("b");
+      pTitle.textContent = "Preview";
+      pHead.append(pTitle);
+      if (previewUrl) {
+        const openLink = document.createElement("a");
+        openLink.href = previewUrl;
+        openLink.target = "_blank";
+        openLink.rel = "noopener";
+        openLink.textContent = "Open in new tab ↗";
+        pHead.append(openLink);
+      }
+      previewCol.append(pHead);
+      if (previewUrl) {
+        const frame = document.createElement("iframe");
+        frame.className = "review-frame";
+        frame.src = previewUrl;
+        frame.loading = "lazy";
+        frame.title =
+          change.prNumber != null
+            ? "Preview of PR #" + change.prNumber
+            : "Preview of " + change.changeId;
+        previewCol.append(frame);
+      } else {
+        previewCol.append(subtle("No preview is available for this change yet."));
+      }
+
+      // Detail column — evidence chips + diff + the same Accept/Reject actions.
+      const detailCol = document.createElement("div");
+      detailCol.className = "review-detail";
+
+      const summaryValues = [
+        ["Intent", change.intent],
+        ["User-visible effect", change.description],
+        ["Verification", change.verification],
+        ["Risk / rollback", change.riskRollback],
+      ].filter((entry) => typeof entry[1] === "string" && entry[1].trim());
+      if ((typeof change.title === "string" && change.title.trim()) || summaryValues.length) {
+        const summarySection = document.createElement("div");
+        summarySection.className = "review-section";
+        const summaryTitle = document.createElement("b");
+        summaryTitle.textContent = change.title && change.title.trim()
+          ? change.title.trim()
+          : "About this change";
+        summarySection.append(summaryTitle);
+        for (const [label, value] of summaryValues) {
+          const line = document.createElement("div");
+          const labelEl = document.createElement("strong");
+          labelEl.textContent = label + ": ";
+          line.append(labelEl, document.createTextNode(value.trim()));
+          summarySection.append(line);
+        }
+        detailCol.append(summarySection);
+      }
+
+      const evSection = document.createElement("div");
+      evSection.className = "review-section";
+      const evTitle = document.createElement("b");
+      evTitle.textContent = "Checks";
+      const evChips = document.createElement("div");
+      evChips.className = "review-chips";
+      renderEvidenceChips(evChips, change);
+      evSection.append(evTitle, evChips);
+      detailCol.append(evSection);
+
+      const diffSection = document.createElement("div");
+      diffSection.className = "review-section";
+      const diffTitle = document.createElement("b");
+      diffTitle.textContent = "Diff";
+      const diffTarget = document.createElement("div");
+      diffTarget.className = "review-diff-target";
+      diffTarget.append(subtle("Loading the diff…"));
+      diffSection.append(diffTitle, diffTarget);
+      detailCol.append(diffSection);
+
+      // The SAME actions as the row — same handlers, same gates. Not a new authz
+      // path: integrateCandidate/rejectChange POST to the same endpoints, and the
+      // server re-authorizes.
+      const actionRow = document.createElement("div");
+      actionRow.className = "review-actions";
+      const accept = document.createElement("button");
+      accept.type = "button";
+      accept.className = "btn primary";
+      const needsPreviewUpdate =
+        change.status === "ready" &&
+        Boolean(change.evidence && change.evidence.promotable) &&
+        change.mergeable === false;
+      const needsChecks = !Boolean(change.evidence && change.evidence.promotable) &&
+        (change.status === "queued" || change.status === "reconciling");
+      if (needsChecks) {
+        const build = document.createElement("button");
+        build.type = "button";
+        build.className = "btn primary";
+        build.textContent = "Run checks";
+        build.disabled = !canShip || (change.prNumber != null && inflightBuilds.has(change.prNumber));
+        build.title = "Re-run this PR's preview build and checks (does not merge or go live)";
+        build.addEventListener("click", () => buildPreview(change, build));
+        actionRow.append(build);
+      }
+      // Only ONE primary action at a time — see the queue-row fix above.
+      if (!needsChecks) {
+        accept.textContent = needsPreviewUpdate ? "Update change" : "Add to release";
+        accept.disabled = !canShip || (!needsPreviewUpdate && !change.mergeable);
+        accept.title = !canShip
+          ? "Requires a ship-on-behalf grant on your account — ask the store owner"
+          : needsPreviewUpdate
+            ? "Preview changed while you worked — update this change, then add it"
+            : !change.mergeable
+              ? "This change isn't ready to add yet"
+              : "Add this change to your next release (doesn't go live yet)";
+        accept.addEventListener("click", () =>
+          needsPreviewUpdate ? openConflictRecovery(change, accept) : integrateCandidate(change, accept),
+        );
+      }
+      const reject = document.createElement("button");
+      reject.type = "button";
+      reject.className = "btn";
+      reject.textContent = "Reject";
+      reject.disabled = !canShip;
+      reject.title = canShip
+        ? "Close this change without publishing"
+        : "Requires an owner or admin sign-in";
+      reject.addEventListener("click", () => rejectChange(change, reject));
+      actionRow.append(...(needsChecks ? [] : [accept]), reject);
+      detailCol.append(actionRow);
+
+      pane.append(previewCol, detailCol);
+      return { pane, diffTarget };
+    };
+
+    // A candidate's diff at a fixed head sha is immutable, so re-opening a review
+    // pane for the same changeId@headSha serves from cache without re-fetching.
+    const diffCache = createKeyedCache();
+    const loadReviewDiff = async (change?: any, diffTarget?: any) => {
+      const cacheKey = change.changeId + "@" + (change.headSha || "");
+      const cached = diffCache.get(cacheKey);
+      if (cached) {
+        diffTarget.textContent = "";
+        renderDiff(diffTarget, cached);
+        return;
+      }
+      try {
+        const res = await fetch(diffBase + "/" + encodeURIComponent(change.changeId) + "/diff", {
+          headers: { accept: "application/json" },
+        });
+        const data = await res.json().catch(() => ({}));
+        diffTarget.textContent = "";
+        if (!res.ok) {
+          diffTarget.append(subtle(data.error || "Could not load the diff (" + res.status + ")"));
+        } else {
+          const diff = data.diff || {};
+          diffCache.set(cacheKey, diff);
+          renderDiff(diffTarget, diff);
+        }
+      } catch {
+        diffTarget.textContent = "";
+        diffTarget.append(subtle("Could not load the diff — network error"));
+      }
+    };
+
+    const toggleReview = (change?: any, button?: any, tr?: any) => {
+      if (!tr.dataset.changeRowId) tr.dataset.changeRowId = change.changeId;
+      if (reviewRowFor(tr)) {
+        closeReview(tr, button);
+        return;
+      }
+      const detailTr = document.createElement("tr");
+      detailTr.dataset.publishReviewRow = tr.dataset.changeRowId;
+      const td = document.createElement("td");
+      td.colSpan = 6;
+      td.className = "publish-review-cell";
+      const { pane, diffTarget } = buildReviewPane(change);
+      td.append(pane);
+      detailTr.append(td);
+      tr.after(detailTr);
+      button.textContent = "Hide review";
+      button.setAttribute("aria-expanded", "true");
+      loadReviewDiff(change, diffTarget);
+    };
+
+    const CHANGE_MARK: Record<string, string> = { added: "+", changed: "~", removed: "−" };
+
+    const renderDiff = (td?: any, diff?: any) => {
+      td.textContent = "";
+      const head = document.createElement("div");
+      head.className = "publish-diff-head";
+
+      // Authority: honest label of whether the diff describes the exact head.
+      const authority = diff.authority || {};
+      const authTone = authority.authoritative ? "green" : authority.stale ? "amber" : "";
+      const authChip = chip(
+        authority.authoritative
+          ? "Reviewed at head"
+          : authority.stale
+            ? "Last-good preview (stale vs head)"
+            : authority.missing
+              ? "No evidence yet"
+              : "Head",
+        authTone,
+        CHIP_GLYPH[authTone],
+      );
+      head.append(authChip);
+
+      if (diff.headSha) {
+        const sha = document.createElement("span");
+        sha.className = "publish-mono subtle";
+        sha.textContent = "head " + shortSha(diff.headSha);
+        head.append(sha);
+      }
+      if (diff.revHref) {
+        const rev = document.createElement("a");
+        rev.href = diff.revHref;
+        rev.target = "_blank";
+        rev.rel = "noopener";
+        rev.textContent = "Open reviewed revision";
+        head.append(rev);
+      }
+      td.append(head);
+
+      if (!diff.renderable) {
+        // Honest: a candidate that can't render has NO diff — say why (dg3), no fake.
+        const reason = document.createElement("p");
+        reason.className = "note publish-diff-blocked";
+        reason.textContent =
+          diff.blockedReason || "This change has no preview to compare yet.";
+        td.append(reason);
+        return;
+      }
+
+      const files = Array.isArray(diff.files) ? diff.files : [];
+      if (!files.length) {
+        td.append(subtle("No file changes vs the current live version."));
+        return;
+      }
+      const list = document.createElement("ul");
+      list.className = "publish-diff-list";
+      for (const f of files) {
+        const li = document.createElement("li");
+        li.className = "publish-diff-" + f.change;
+        const mark = document.createElement("span");
+        mark.className = "publish-diff-mark";
+        mark.textContent = CHANGE_MARK[f.change] || "•";
+        const path = document.createElement("code");
+        path.textContent = f.path;
+        li.append(mark, path);
+        list.append(li);
+      }
+      td.append(list);
+    };
+
+    // ---- dg7: versions / promotion history + rollback ----------------------
+    // The promotion history (u2/u3 promotion_status) with the tenant Gitea SHA,
+    // its /rev link (u5), and the current-live marker; a prior version rolls back
+    // THROUGH the one orchestrator (/api/changes/rollback → u8), rendering only the
+    // HONEST terminal state (rolled_back only when verified).
+
+    const versionsPanel = root.querySelector("[data-publish-versions]");
+    const versionsBody = versionsPanel?.querySelector("[data-versions-body]");
+    const versionsChip = versionsPanel?.querySelector("[data-versions-chip]");
+    const versionsStatus = versionsPanel?.querySelector("[data-versions-status]");
+    const versionsRollbackNote = versionsPanel?.querySelector("[data-versions-rollback-note]");
+    // Hosted and static-publish stores both render the same instant "Roll back" UX
+    // below — every rollback is an instant KV pointer flip.
+
+    // r10: the post-publish "Undo" deep-link. focusRollbackTarget stashes the
+    // version-id to undo, opens the Live Site + Rollback disclosures, forces a fresh
+    // versions read, and scrolls the panel into view; renderVersions then applies the
+    // pending focus once that row exists (applyRollbackFocus) — highlighting it and
+    // focusing its "Roll back" button so the operator lands pre-targeted.
+    let pendingRollbackFocus: string | null = null;
+    const openLiveSiteRollback = () => {
+      const liveSite: any = root.querySelector(".live-site-details");
+      if (liveSite) liveSite.open = true;
+      const versionsDetails: any = versionsPanel && versionsPanel.querySelector(".versions-details");
+      if (versionsDetails) versionsDetails.open = true;
+    };
+    const applyRollbackFocus = () => {
+      if (!pendingRollbackFocus || !versionsBody) return;
+      let target: any = null;
+      versionsBody.querySelectorAll("tr[data-version-id]").forEach((r: any) => {
+        if (r.dataset.versionId === pendingRollbackFocus) target = r;
+      });
+      if (!target) return; // not rendered yet — a pending fetch will re-run this
+      pendingRollbackFocus = null;
+      target.scrollIntoView({ block: "center", behavior: "smooth" });
+      target.classList.remove("publish-row-highlight");
+      void target.offsetWidth; // restart the flash if re-applied
+      target.classList.add("publish-row-highlight");
+      window.setTimeout(() => target.classList.remove("publish-row-highlight"), 2600);
+      const btn: any = target.querySelector("button");
+      if (btn) btn.focus();
+    };
+    const focusRollbackTarget = (versionId?: string) => {
+      if (!versionId) return;
+      pendingRollbackFocus = versionId;
+      openLiveSiteRollback();
+      loadVersions({ force: true }); // fresh read: the replaced version is now a prior row
+      const panel = document.getElementById("publish-live-site");
+      if (panel) panel.scrollIntoView({ block: "start", behavior: "smooth" });
+    };
+
+    const renderVersions = (view?: any) => {
+      if (!versionsBody) return;
+      const versions = Array.isArray(view.versions) ? view.versions : [];
+      versionsBody.textContent = "";
+
+      if (versionsChip) {
+        versionsChip.textContent = versions.length === 1 ? "1 version" : versions.length + " versions";
+        versionsChip.className = "chip" + (versions.length ? " blue" : "");
+      }
+
+      // u14 — orient a store with exactly ONE live version: rollback needs a PRIOR
+      // target, which only exists once a SECOND version is published. Only fill the
+      // status line if nothing else has claimed it (an action/error message wins).
+      if (versionsStatus && versions.length === 1 && !versionsStatus.textContent) {
+        versionsStatus.textContent = "Rollback targets appear here once a second version is published.";
+      }
+
+      // Every rollback is an instant KV pointer flip, so there is no CI-latency
+      // note to show.
+      if (versionsRollbackNote) versionsRollbackNote.hidden = true;
+
+      if (!versions.length) {
+        const tr = document.createElement("tr");
+        const td = cell(
+          subtle(
+            "Nothing published yet. When you publish your next release it becomes your first live " +
+              "version — and any earlier versions you can roll back to will appear here.",
+          ),
+        );
+        td.colSpan = 6;
+        tr.append(td);
+        versionsBody.append(tr);
+        return;
+      }
+
+      for (const v of versions) {
+        const tr = document.createElement("tr");
+        // r10: tag the row with its version id so the post-publish "Undo" can deep-
+        // link straight to the replaced version's rollback row (applyRollbackFocus).
+        tr.dataset.versionId = v.versionId;
+
+        // Version identity: the merchant-facing "v42" counter is the primary label;
+        // the tenant Gitea SHA is demoted to a "Technical details" disclosure below
+        // (r02 — a raw SHA is meaningless to a merchant). Falls back to the short SHA
+        // only when a version carries no number (an unpromoted seed), never faked.
+        const idCell = document.createElement("td");
+        const strong = document.createElement("strong");
+        // r11 — the human release name leads when present; the "v42" counter falls
+        // back when it's null (and rides along as a subtle secondary when a name shows).
+        const releaseName = v.name || null;
+        strong.textContent = releaseName || (v.number != null ? "v" + v.number : shortSha(v.versionId));
+        idCell.append(strong);
+        if (releaseName && v.number != null) idCell.append(subtle("v" + v.number));
+        if (v.source) idCell.append(subtle(v.source === "commit" ? "From a commit" : "Content hash"));
+        const tech = document.createElement("details");
+        tech.className = "ver-tech";
+        const techSummary = document.createElement("summary");
+        techSummary.textContent = "Technical details";
+        tech.append(techSummary);
+        const shaSpan = document.createElement("span");
+        shaSpan.className = "publish-mono subtle";
+        shaSpan.textContent = shortSha(v.versionId);
+        tech.append(shaSpan);
+        idCell.append(tech);
+
+        // "What shipped" — the SAME human summary the staged Publish console shows,
+        // now describing the RELEASE: a plain-language lead + an openable list of the
+        // PRs this version shipped (from its release receipt). OPTIONAL server
+        // enrichment: absent (an older version with no linked receipt) → the cell
+        // stays just the sha + source, exactly as before (graceful fallback).
+        const summary = v.releaseSummary || null;
+        if (summary && (summary.lead || summary.text)) {
+          const lead = document.createElement("p");
+          lead.className = "ver-summary";
+          lead.textContent = summary.lead || summary.text;
+          idCell.append(lead);
+        }
+        const changes = Array.isArray(v.changes) ? v.changes : [];
+        if (changes.length) {
+          const details = document.createElement("details");
+          details.className = "agg-included-details ver-changes";
+          const sm = document.createElement("summary");
+          const smLead = document.createElement("span");
+          smLead.className = "agg-included-lead";
+          smLead.textContent = "What shipped";
+          const badge = document.createElement("span");
+          badge.className = "agg-included-badge";
+          badge.textContent = String(changes.length);
+          const chev = document.createElement("span");
+          chev.className = "agg-chev";
+          chev.setAttribute("aria-hidden", "true");
+          const chevSvg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+          const chevPath = document.createElementNS("http://www.w3.org/2000/svg", "path");
+          chevPath.setAttribute("d", "M9 6l6 6-6 6");
+          chevSvg.setAttribute("viewBox", "0 0 24 24");
+          chevSvg.setAttribute("fill", "none");
+          chevSvg.setAttribute("stroke", "currentColor");
+          chevSvg.setAttribute("stroke-width", "2.2");
+          chevSvg.append(chevPath);
+          chev.append(chevSvg);
+          sm.append(smLead, badge, chev);
+          details.append(sm);
+          const ul = document.createElement("ul");
+          ul.className = "agg-included-list";
+          for (const ch of changes) ul.append(changeSummaryItem(ch));
+          details.append(ul);
+          idCell.append(details);
+        }
+        tr.append(idCell);
+
+        // Digest (static current only — never fabricated for priors).
+        const digestCell = cell(v.digest ? shortSha(v.digest) : "—");
+        digestCell.classList.add("publish-mono");
+        if (!v.digest) digestCell.classList.add("subtle");
+        tr.append(digestCell);
+
+        tr.append(cell(age(v.promotedAt)));
+
+        // Preview: the u5 immutable /rev/<sha> link.
+        const revCell = document.createElement("td");
+        if (v.revHref) {
+          const a = document.createElement("a");
+          a.href = v.revHref;
+          a.target = "_blank";
+          a.rel = "noopener";
+          a.textContent = "Revision";
+          revCell.append(a);
+        } else {
+          revCell.append(subtle("—"));
+        }
+        tr.append(revCell);
+
+        // State: current live vs prior.
+        tr.append(
+          cell(
+            v.isCurrent
+              ? chip("Current live", "green", CHIP_GLYPH.green)
+              : chip("Prior", "", CHIP_GLYPH[""]),
+          ),
+        );
+
+        // Action: roll back to a PRIOR version (never the current one).
+        const act = document.createElement("td");
+        act.className = "action publish-actions";
+        if (!v.isCurrent) {
+          const rollbackBtn = document.createElement("button");
+          rollbackBtn.type = "button";
+          rollbackBtn.className = "btn";
+          rollbackBtn.textContent = "Roll back";
+          rollbackBtn.disabled = !canShip;
+          rollbackBtn.title = !canShip
+            ? "Requires an owner or ship-on-behalf sign-in"
+            : "Roll the live site back to this version";
+          rollbackBtn.addEventListener("click", () => rollbackVersion(v, rollbackBtn));
+          act.append(rollbackBtn);
+        }
+        tr.append(act);
+
+        versionsBody.append(tr);
+      }
+
+      // r10: land a pending post-publish "Undo" on the replaced version's row now
+      // that the rows exist.
+      applyRollbackFocus();
+    };
+
+    // Published versions only change when something is published, which moves the
+    // change-queue fingerprint (currentStateKey). Cache the view against that key
+    // so re-viewing the panel or a re-render doesn't re-fire the read; refetch
+    // only when the fingerprint changes or on an explicit refresh (force).
+    const versionsCache = createKeyedCache();
+    const loadVersionsImpl = async () => {
+      if (!versionsBody) return;
+      const key = currentStateKey;
+      if (key != null && versionsCache.has(key)) {
+        renderVersions(versionsCache.get(key));
+        return;
+      }
+      try {
+        const res = await fetch(ds.versionsEndpoint, { headers: { accept: "application/json" } });
+        if (res.status === 401 || res.status === 403) {
+          if (versionsChip) versionsChip.textContent = "Sign-in required";
+          versionsBody.textContent = "";
+          const tr = document.createElement("tr");
+          const td = cell(subtle("Sign in as a store owner or admin to view published versions."));
+          td.colSpan = 6;
+          tr.append(td);
+          versionsBody.append(tr);
+          return;
+        }
+        const data = await res.json().catch(() => ({}));
+        if (!res.ok) {
+          setStatus(versionsStatus, data.error || "Could not load versions (" + res.status + ")", "err");
+          return;
+        }
+        const view = data.view || {};
+        if (key != null) versionsCache.set(key, view);
+        renderVersions(view);
+      } catch {
+        setStatus(versionsStatus, "Could not load versions — network error", "err");
+      }
+    };
+    const versionsCoalescer = createCoalescer(loadVersionsImpl);
+    const loadVersions = (opts?: any) => {
+      // force (explicit refresh / post-action) drops the cached entry so the
+      // next run re-fetches even if the fingerprint hasn't caught up yet.
+      if (opts && opts.force && currentStateKey != null) versionsCache.delete(currentStateKey);
+      return versionsCoalescer.trigger();
+    };
+
+    // Interpret the rollback response into ONE honest terminal state. Kept local
+    // (NOT imported from lib/publish/shipWorkspace's interpretRollbackResponse):
+    // that module pulls lib/preview value dependencies, which must not be dragged
+    // into this client bundle. `rolledBack` is
+    // true ONLY for a verified `rolled_back` — a `publish_pending` is NEVER a
+    // rolled-back claim.
+    const interpretRollback = (httpOk?: any, body?: any) => {
+      const toVersionId = typeof body.toVersionId === "string" ? body.toVersionId : null;
+      if (typeof body.state === "string") {
+        const state = ["rolled_back", "publish_pending", "publish_failed", "blocked"].includes(body.state)
+          ? body.state
+          : "error";
+        return {
+          state,
+          rolledBack: state === "rolled_back",
+          message: body.message || body.error || "Rollback returned state " + state + ".",
+        };
+      }
+      if (httpOk && body.rolledBack === true) {
+        return {
+          state: "rolled_back",
+          rolledBack: true,
+          message: toVersionId ? "Rolled back live to " + shortSha(toVersionId) + "." : "Rolled back live.",
+        };
+      }
+      return {
+        state: "blocked",
+        rolledBack: false,
+        message: (body.error || "Rollback failed") + (body.reason ? " (" + body.reason + ")" : ""),
+      };
+    };
+
+    const rollbackVersion = async (version?: any, button?: any) => {
+      // Every rollback is an instant KV pointer flip — the confirm/status copy is
+      // the same for a hosted and a static-publish store.
+      const confirmMsg =
+        "Roll the live store back to version " + shortSha(version.versionId) +
+        "? This publishes that prior version to the live site.";
+      if (!window.confirm(confirmMsg)) return;
+      button.disabled = true;
+      setStatus(versionsStatus, "Rolling back to " + shortSha(version.versionId) + "…");
+      try {
+        // The console dispatches by version id only; a static prior version's
+        // archive digest lives only in S3 (CI resolves it). Pass a digest ONLY when
+        // we honestly have one (never for a static prior — its digest is always null).
+        const payload: any = { targetVersionId: version.versionId };
+        if (version.digest) payload.targetDigest = version.digest;
+        const res = await fetch(ds.rollbackEndpoint, {
+          method: "POST",
+          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
+          body: JSON.stringify(payload),
+        });
+        const data = await res.json().catch(() => ({}));
+        const outcome = interpretRollback(res.ok, data);
+        setStatus(versionsStatus, outcome.message, outcome.rolledBack ? "ok" : outcome.state === "publish_pending" ? "ok" : "err");
+      } catch {
+        setStatus(versionsStatus, "Rollback failed — network error", "err");
+      } finally {
+        button.disabled = false;
+        loadVersions({ force: true }); // a rollback changed the live version
+        loadQueue();
+      }
+    };
+
+    // ---- Domain section ----------------------------------------------------
+
+    const domainPanel = root.querySelector("[data-publish-domain]");
+    let domainPollTimer: any = null;
+
+    const renderDomain = (payload?: any) => {
+      if (!domainPanel) return;
+      const domain = payload.domain || {};
+      const stateEl = domainPanel.querySelector("[data-domain-state]");
+      const stateChip = domainPanel.querySelector("[data-domain-state-chip]");
+      const sinceEl = domainPanel.querySelector("[data-domain-since]");
+      const captureEl = domainPanel.querySelector("[data-domain-capture]");
+      const runEl = domainPanel.querySelector("[data-domain-run]");
+      const runDetailEl = domainPanel.querySelector("[data-domain-run-detail]");
+      const rollbackBtn = domainPanel.querySelector("[data-domain-rollback]");
+      const rollbackDetail = domainPanel.querySelector("[data-domain-rollback-detail]");
+      const connected = domain.state === "cloudfront";
+
+      if (stateEl) {
+        stateEl.textContent = connected
+          ? "Storefront CDN (cloudfront)"
+          : "Previous host (pantheon)";
+      }
+      if (stateChip) {
+        const tone = connected ? "green" : "amber";
+        paintChip(stateChip, connected ? "Connected" : "Not connected", tone, CHIP_GLYPH[tone]);
+      }
+      if (sinceEl) {
+        sinceEl.textContent = domain.since
+          ? "Since " + new Date(domain.since).toLocaleString()
+          : "Current host for " + (payload.appDomain || ds.appDomain);
+      }
+      if (captureEl) {
+        captureEl.textContent = domain.priorCapturedAt
+          ? "Captured " + new Date(domain.priorCapturedAt).toLocaleString()
+          : "None captured";
+      }
+
+      const run = domain.lastRun;
+      // "dispatched" = awaiting the CI completion callback (terminal-only wire).
+      const inFlight = run && run.status === "dispatched";
+      if (runEl) {
+        runEl.textContent = run
+          ? run.action + (run.rehearsal ? " (rehearsal)" : "") + " · " + run.status
+          : "None";
+      }
+      if (runDetailEl) {
+        runDetailEl.textContent = "";
+        if (run) {
+          const parts = [];
+          if (run.actor) parts.push("by " + run.actor);
+          if (run.startedAt) parts.push(age(run.startedAt));
+          runDetailEl.append(document.createTextNode(parts.join(" · ")));
+          if (run.runUrl) {
+            const link = document.createElement("a");
+            link.href = run.runUrl;
+            link.target = "_blank";
+            link.rel = "noopener";
+            link.textContent = "View run";
+            runDetailEl.append(document.createTextNode(" · "));
+            runDetailEl.append(link);
+          }
+          if (run.status === "failed" && run.error) {
+            const err = document.createElement("span");
+            err.className = "publish-error-detail";
+            err.textContent = run.error;
+            runDetailEl.append(document.createElement("br"));
+            runDetailEl.append(err);
+          }
+        } else {
+          runDetailEl.textContent = "Connect and rollback runs appear here.";
+        }
+      }
+      if (rollbackBtn) {
+        rollbackBtn.disabled =
+          !canShip || inFlight || !domain.priorRecordsKey;
+      }
+      if (rollbackDetail && domain.priorCapturedAt) {
+        rollbackDetail.textContent =
+          "Restores the DNS records captured " +
+          new Date(domain.priorCapturedAt).toLocaleString() + ".";
+      }
+
+      // Poll while a run is in flight so completion lands without a manual refresh.
+      if (domainPollTimer) {
+        clearTimeout(domainPollTimer);
+        domainPollTimer = null;
+      }
+      if (inFlight) domainPollTimer = setTimeout(loadDomain, 15000);
+    };
+
+    const loadDomain = async () => {
+      if (!domainPanel) return;
+      try {
+        const res = await fetch(ds.domainStatusEndpoint, {
+          headers: { accept: "application/json" },
+        });
+        if (!res.ok) return;
+        renderDomain(await res.json());
+      } catch {
+        /* leave the last rendered state */
+      }
+      // u9: refresh the readiness itemization alongside the status.
+      loadReadiness();
+    };
+
+    // ---- Cutover readiness (u9) --------------------------------------------
+    // Reads the SAME server gate `tot go-live` reads (/api/domain/readiness) and
+    // itemizes the preconditions. The Connect button additionally requires the
+    // server to report ready — the display and the enforcement can't diverge.
+    const readinessBox = domainPanel?.querySelector("[data-domain-readiness]");
+    const connectBtn = domainPanel?.querySelector("[data-domain-connect]");
+    let domainReady = false;
+
+    const renderReadiness = (payload?: any) => {
+      if (!readinessBox) return;
+      const readiness = (payload && payload.readiness) || {};
+      const checks = Array.isArray(readiness.checks) ? readiness.checks : [];
+      domainReady = readiness.ready === true;
+      readinessBox.hidden = false;
+
+      const chip = readinessBox.querySelector("[data-domain-readiness-chip]");
+      if (chip) {
+        const tone = domainReady ? "green" : "amber";
+        paintChip(chip, domainReady ? "Ready" : "Not ready", tone, CHIP_GLYPH[tone]);
+      }
+      const list = readinessBox.querySelector("[data-domain-readiness-list]");
+      if (list) {
+        list.textContent = "";
+        for (const c of checks) {
+          const li = document.createElement("li");
+          li.className = c.ok ? "ok" : "blocked";
+          // Header row: mark + bold label. The detail and remedy render on their
+          // OWN lines below (not as inline siblings of the label) so the label and
+          // its description never run together as one string.
+          const head = document.createElement("div");
+          head.className = "domain-readiness-item-head";
+          const mark = document.createElement("span");
+          mark.className = "domain-readiness-mark";
+          mark.textContent = c.ok ? "✓" : "✗";
+          const label = document.createElement("b");
+          label.textContent = c.label || c.id || "";
+          head.append(mark, label);
+          li.append(head);
+          if (c.detail) {
+            const detail = document.createElement("p");
+            detail.className = "domain-readiness-detail";
+            detail.textContent = c.detail;
+            li.append(detail);
+          }
+          // Blocked checks carry a "how to clear this" remedy from the SAME gate
+          // `tot go-live` reads — the guide lives with the enforcement, never a
+          // divergent side note.
+          if (!c.ok && c.remedy) {
+            const remedy = document.createElement("p");
+            remedy.className = "domain-readiness-remedy";
+            remedy.textContent = "→ " + c.remedy;
+            li.append(remedy);
+          }
+          list.append(li);
+        }
+      }
+      const note = readinessBox.querySelector("[data-domain-readiness-note]");
+      if (note) {
+        note.textContent = payload && payload.ownerCapable === false
+          ? "Apex cutover is owner-only — sign in as the store owner to connect the domain."
+          : domainReady
+            ? "All preconditions are green — the cutover is permitted."
+            : "Clear the failing preconditions above before connecting the apex.";
+      }
+      // Gate the Connect button on server readiness in ADDITION to owner (the
+      // markup already disables it for non-owners); never enable it when blocked.
+      if (connectBtn && !connectBtn.dataset.ownerLocked) {
+        connectBtn.disabled = !domainReady;
+      }
+    };
+
+    const loadReadiness = async () => {
+      if (!readinessBox || !ds.domainReadinessEndpoint) return;
+      try {
+        const res = await fetch(ds.domainReadinessEndpoint, {
+          headers: { accept: "application/json", "x-tot-capability": "ship-on-behalf" },
+        });
+        if (!res.ok) return;
+        renderReadiness(await res.json());
+      } catch {
+        /* leave the last rendered readiness */
+      }
+    };
+
+    const domainStatusEl = domainPanel?.querySelector("[data-domain-status]");
+
+    const domainAction = async (body?: any, button?: any) => {
+      button.disabled = true;
+      setStatus(domainStatusEl, (body.action === "connect" ? "Connecting" : "Rolling back") + "…");
+      try {
+        const res = await fetch(ds.domainDispatchEndpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            "x-tot-capability": "ship-on-behalf",
+          },
+          body: JSON.stringify(body),
+        });
+        const data = await res.json().catch(() => ({}));
+        if (res.ok && data.dispatched) {
+          setStatus(
+            domainStatusEl,
+            (body.action === "connect" ? "Connect" : "Rollback") +
+              (body.rehearsal ? " rehearsal" : "") +
+              " dispatched — the run status updates below as it progresses.",
+            "ok",
+          );
+        } else {
+          setStatus(domainStatusEl, data.error || "Request failed (" + res.status + ")", "err");
+        }
+      } catch {
+        setStatus(domainStatusEl, "Request failed — network error", "err");
+      } finally {
+        button.disabled = false;
+        loadDomain();
+      }
+    };
+
+    domainPanel?.querySelector("[data-domain-connect]")?.addEventListener("click", (event: any) => {
+      const confirmInput = domainPanel.querySelector("[data-domain-confirm]");
+      const rehearsal = Boolean(domainPanel.querySelector("[data-domain-rehearsal]")?.checked);
+      domainAction(
+        {
+          action: "connect",
+          confirmDomain: (confirmInput?.value || "").trim(),
+          rehearsal,
+        },
+        event.currentTarget,
+      );
+    });
+
+    domainPanel?.querySelector("[data-domain-rollback]")?.addEventListener("click", (event: any) => {
+      if (
+        !window.confirm(
+          "Roll back " + ds.appDomain + " to the previous host? DNS returns to the captured records in about a minute.",
+        )
+      ) {
+        return;
+      }
+      domainAction({ action: "rollback" }, event.currentTarget);
+    });
+
+    // ---- b17: branch retention ----------------------------------------------
+    // Renders the GET /api/changes/branches dry-run classification (already
+    // projected server-side by branchRetentionView.ts — this script only
+    // paints it, same division of labor as renderQueue/renderVersions above)
+    // and drives the guarded delete. The server (candidate_delete, b13)
+    // re-classifies fresh on every delete, so the confirm below is the HUMAN
+    // gate, not the safety guarantee — the safety guarantee is server-side.
+
+    const branchesPanel = root.querySelector("[data-publish-branches]");
+    const branchesBody = branchesPanel?.querySelector("[data-branches-body]");
+    const branchesChip = branchesPanel?.querySelector("[data-branches-chip]");
+    const branchesStatus = branchesPanel?.querySelector("[data-branches-status]");
+    const branchesActions = branchesPanel?.querySelector("[data-branches-actions]");
+    const branchesSweepBtn = branchesPanel?.querySelector("[data-branches-sweep]");
+
+    // Kept local (NOT imported from branchRetentionView): that module pulls a
+    // lib/forge value dependency, which must not be dragged into this client bundle.
+    // Shown when a live classification fetch fails — the table must NEVER keep the
+    // last-known chips (a confident stale label is exactly the b1 bug).
+    const FORGE_UNREACHABLE_LABEL = "State unknown (forge unreachable)";
+
+    // The last classification the panel rendered from a SUCCESSFUL fetch. Kept so a
+    // later fetch failure can re-stamp those same branches as "state unknown" (never
+    // leave the stale confident chips), and so an unchanged poll can skip re-render.
+    let lastBranchesRows: any[] = [];
+    let lastBranchesSignature: string | null = null;
+    // Refs the "Sweep dead branches" action deletes, as pre-computed server-side
+    // (view.sweepableRefs): Dead + delete-eligible + reachable. The UI never re-derives
+    // the delete set — it confirms these, then loops the guarded delete.
+    let lastSweepableRefs: any[] = [];
+
+    const buildCleanupPlan = (row?: any) => {
+      return [
+        "Delete branch plan:",
+        "  repo:           " + (appDomain || repo),
+        "  branch:         " + row.ref,
+        "  tip sha:        " + row.shortSha,
+        "  classification: " + row.classificationLabel,
+        "  reason:         " + row.reason,
+        "",
+        "This deletes the Git BRANCH only. Reject already closes the PR and removes",
+        "its hosted candidate artifacts. The server re-classifies this",
+        "branch fresh before deleting; a moved tip or a branch that is no longer",
+        "integrated/closed-or-rejected is refused, not silently skipped.",
+      ].join("\n");
+    };
+
+    // One guarded delete round-trip. Shared by the per-row "Clean up", the bulk
+    // "Sweep dead branches", and the per-row orphan "Delete this branch" — the server
+    // re-checks eligibility fresh on every ref. `opts` opts into the explicit HUMAN
+    // delete (explicitConfirm + expectedClassification) for an orphan the default
+    // eligibility path refuses; omitted, this is the default guarded delete.
+    const postDeleteRef = async (ref?: any, expectedSha?: any, opts: any = {}) => {
+      const body: any = { ref, expectedSha };
+      if (opts.explicitConfirm) body.explicitConfirm = true;
+      if (opts.expectedClassification) body.expectedClassification = opts.expectedClassification;
+      const res = await fetch(ds.branchesEndpoint, {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
+        body: JSON.stringify(body),
+      });
+      const data = await res.json().catch(() => ({}));
+      return { ok: res.ok && data.ok, status: res.status, data };
+    };
+
+    // Old branches should clean themselves up — a non-developer shouldn't need to
+    // find and click "Sweep dead branches" for routine housekeeping. Runs silently
+    // (no confirm dialog, no visible status) after a successful accept/publish;
+    // the manual sweep in the advanced panel below still exists for anyone who
+    // wants to trigger or inspect it directly.
+    const autoSweepBranches = async () => {
+      if (!canShip) return;
+      try {
+        const res = await fetch(ds.branchesEndpoint, { headers: { accept: "application/json" } });
+        if (!res.ok) return;
+        const view = await res.json().catch(() => null);
+        if (!view) return;
+        const rows = Array.isArray(view.rows) ? view.rows : [];
+        const sweepable = Array.isArray(view.sweepableRefs) ? view.sweepableRefs : [];
+        if (!sweepable.length) return;
+        const rowsByRef = new Map<string, any>(rows.map((r: any): [string, any] => [r.ref, r]));
+        for (const ref of sweepable) {
+          const row = rowsByRef.get(ref);
+          if (!row) continue;
+          await postDeleteRef(row.ref, row.sha).catch(() => {});
+        }
+        loadBranches(); // refresh the advanced panel if it happens to be open
+      } catch {
+        // Best-effort — a manual sweep in the advanced panel still works.
+      }
+    };
+
+    const cleanupBranch = async (row?: any, button?: any) => {
+      if (!window.confirm(buildCleanupPlan(row) + "\n\nDelete this branch?")) return;
+      button.disabled = true;
+      setStatus(branchesStatus, "Deleting " + row.shortRef + "…");
+      try {
+        const { ok, status, data } = await postDeleteRef(row.ref, row.sha);
+        if (ok) {
+          setStatus(
+            branchesStatus,
+            data.alreadyAbsent
+              ? row.shortRef + " was already gone (nothing to delete)."
+              : "Deleted " + row.shortRef + ".",
+            "ok",
+          );
+        } else {
+          setStatus(branchesStatus, data.error || "Delete refused (" + status + ")", "err");
+        }
+      } catch {
+        setStatus(branchesStatus, "Delete failed — network error", "err");
+      } finally {
+        button.disabled = false;
+        loadBranches();
+      }
+    };
+
+    // Per-row "Delete this branch": the deliberate, one-at-a-time HUMAN delete of an
+    // ORPHAN — a branch the auto/bulk "Sweep" and one-click "Clean up" both refuse
+    // (it is quarantined out of the sweep, and never eligibleForDelete). This is the
+    // ONLY path that removes one. It routes through candidate_delete's guarded explicit
+    // path (explicitConfirm + expectedClassification), which re-verifies the ref is
+    // still an orphan at the same tip server-side and refuses (classification_changed /
+    // sha_mismatch) if it drifted since this row was read — so the confirm below is the
+    // human gate, the server re-check is the safety guarantee.
+    const buildOrphanDeletePlan = (row?: any) => {
+      return [
+        "Delete ORPHANED branch:",
+        "  repo:           " + (appDomain || repo),
+        "  branch:         " + row.ref,
+        "  tip sha:        " + row.shortSha,
+        "  classification: orphan",
+        "  reason:         " + row.reason,
+        "",
+        "An orphan has no open PR and no integration record — nothing else will ever",
+        "clean it up (the scheduled sweep and one-click cleanup both skip it). This",
+        "deletes the Git BRANCH only — it never evicts a hosted preview build. The",
+        "server re-checks this branch fresh before deleting; if it is no longer an",
+        "orphan, or its tip has moved, the delete is refused — not silently skipped.",
+      ].join("\n");
+    };
+
+    const deleteOrphanBranch = async (row?: any, button?: any) => {
+      if (!window.confirm(buildOrphanDeletePlan(row) + "\n\nPermanently delete this orphaned branch?")) return;
+      button.disabled = true;
+      setStatus(branchesStatus, "Deleting orphan " + row.shortRef + "…");
+      try {
+        const { ok, status, data } = await postDeleteRef(row.ref, row.sha, {
+          explicitConfirm: true,
+          expectedClassification: row.classification,
+        });
+        if (ok) {
+          setStatus(
+            branchesStatus,
+            data.alreadyAbsent
+              ? row.shortRef + " was already gone (nothing to delete)."
+              : "Deleted orphaned branch " + row.shortRef + ".",
+            "ok",
+          );
+        } else {
+          setStatus(branchesStatus, data.error || "Delete refused (" + status + ")", "err");
+        }
+      } catch {
+        setStatus(branchesStatus, "Delete failed — network error", "err");
+      } finally {
+        button.disabled = false;
+        loadBranches();
+      }
+    };
+
+    // Bulk "Sweep dead branches": one confirm showing EXACTLY the refs it will delete,
+    // then a guarded delete per ref (each re-checked fresh server-side — a ref that has
+    // moved or is no longer eligible is refused, never silently skipped).
+    const sweepDeadBranches = async () => {
+      const rowsByRef = new Map<string, any>(lastBranchesRows.map((r: any): [string, any] => [r.ref, r]));
+      const targets = lastSweepableRefs.map((ref) => rowsByRef.get(ref)).filter(Boolean);
+      if (!targets.length) return;
+      const preview = [
+        "Sweep dead branches — this deletes " + targets.length + " branch(es):",
+        "",
+        ...targets.map((r: any) => "  • " + r.ref + " @ " + r.shortSha + "  (" + r.classificationLabel + ")"),
+        "",
+        "Each deletes the Git BRANCH only (never a hosted preview build). The server",
+        "re-checks every ref fresh before deleting; anything no longer eligible is",
+        "refused, not silently skipped.",
+      ].join("\n");
+      if (!window.confirm(preview + "\n\nDelete these branches?")) return;
+      branchesSweepBtn.disabled = true;
+      let deleted = 0;
+      let refused = 0;
+      for (const r of targets) {
+        setStatus(branchesStatus, "Sweeping " + r.shortRef + "…");
+        try {
+          const { ok } = await postDeleteRef(r.ref, r.sha);
+          if (ok) deleted++;
+          else refused++;
+        } catch {
+          refused++;
+        }
+      }
+      setStatus(
+        branchesStatus,
+        "Swept " + deleted + " branch(es)" + (refused ? ", " + refused + " refused" : "") + ".",
+        refused ? "err" : "ok",
+      );
+      branchesSweepBtn.disabled = false;
+      loadBranches();
+    };
+
+    // Show/enable the sweep button only when there is a Dead+eligible set to sweep.
+    const updateSweepButton = () => {
+      if (!branchesActions || !branchesSweepBtn) return;
+      const n = lastSweepableRefs.length;
+      branchesActions.hidden = n === 0;
+      branchesSweepBtn.disabled = !canShip || n === 0;
+      branchesSweepBtn.title = canShip ? "" : "Requires an owner/admin sign-in.";
+      branchesSweepBtn.textContent = n ? "Sweep dead branches (" + n + ")" : "Sweep dead branches";
+    };
+    branchesSweepBtn?.addEventListener("click", sweepDeadBranches);
+
+    // Paint the table body from a set of rows. `unreachable` re-stamps every row
+    // as "state unknown" and withdraws its action — used when a live fetch fails,
+    // so the operator never sees a confident classification the forge can no
+    // longer confirm (the b1 bug: a stale "PR #11 open / Keep" long after close).
+    const renderBranchRows = (rows?: any, { unreachable = false }: any = {}) => {
+      branchesBody.textContent = "";
+      if (!rows.length) {
+        const tr = document.createElement("tr");
+        const td = cell(
+          subtle(
+            unreachable
+              ? "Branch state unknown — the forge could not be reached."
+              : "No candidate branches found for this repo.",
+          ),
+        );
+        td.colSpan = 7;
+        tr.append(td);
+        branchesBody.append(tr);
+        return;
+      }
+
+      for (const row of rows) {
+        const rowUnknown = unreachable || row.forgeUnreachable === true;
+        const tr = document.createElement("tr");
+
+        const branchCell = document.createElement("td");
+        const branchStrong = document.createElement("strong");
+        branchStrong.textContent = row.shortRef;
+        branchCell.append(branchStrong, subtle(row.ref + " @ " + row.shortSha));
+
+        // Describe the branch by WHAT it changes — the SAME candidate_summary the
+        // staged Publish console + versions list read. OPTIONAL server enrichment:
+        // absent (no PR, or the summary read missed it) → the cell stays just the
+        // ref, exactly as before (graceful fallback). Never shown on an unreachable
+        // row: its classification is precisely what couldn't be confirmed.
+        if (!rowUnknown && (row.prTitle || row.prDescription)) {
+          if (row.prTitle) {
+            const t = document.createElement("p");
+            t.className = "branch-pr-title";
+            t.textContent = row.prTitle;
+            branchCell.append(t);
+          }
+          if (row.prDescription) {
+            const d = document.createElement("p");
+            d.className = "branch-pr-desc";
+            d.textContent = row.prDescription;
+            branchCell.append(d);
+          }
+          const fileCount = typeof row.fileCount === "number" ? row.fileCount : null;
+          const hasLines = typeof row.linesAdded === "number" || typeof row.linesRemoved === "number";
+          if (fileCount != null || hasLines || row.aiDrafted) {
+            const meta = document.createElement("div");
+            meta.className = "agg-included-meta branch-pr-meta";
+            if (fileCount != null) {
+              const f = document.createElement("span");
+              f.textContent = fileCount + (fileCount === 1 ? " file" : " files");
+              meta.append(f);
+            }
+            if (hasLines) meta.append(linesNode(row.linesAdded, row.linesRemoved));
+            if (row.aiDrafted) {
+              const ai = document.createElement("span");
+              ai.className = "branch-pr-ai";
+              ai.textContent = "AI summary";
+              meta.append(ai);
+            }
+            branchCell.append(meta);
+          }
+        }
+        tr.append(branchCell);
+
+        // Protected rows collapse to one line — branch + classification + a single
+        // status. Nobody acts on them, so the PR/tip/age/evidence detail is just noise.
+        if (row.compact && !rowUnknown) {
+          tr.append(cell(chip(row.classificationLabel, row.tone || "")));
+          const statusTd = cell(subtle(row.reason || "Protected — permanent"));
+          statusTd.colSpan = 5;
+          tr.append(statusTd);
+          branchesBody.append(tr);
+          continue;
+        }
+
+        tr.append(
+          cell(
+            rowUnknown
+              ? chip(FORGE_UNREACHABLE_LABEL, "amber")
+              : chip(row.classificationLabel, row.tone || ""),
+          ),
+        );
+
+        const prCell = document.createElement("td");
+        if (row.prNumber != null) {
+          // Link to the INTERNAL friendly PR route (/<tenant>/preview/pr/<N>), never
+          // the server-provided `row.prUrl` — that is the raw Gitea forge html_url the
+          // MCP candidate_list projection emits (<forge-host>/<org>/<repo>/pulls/N),
+          // and surfacing a raw forge link to an owner is exactly the boundary
+          // noGiteaLinks.test.ts guards (the source scan can't catch a host that
+          // arrives in data, so we refuse it here at render). Mirrors the candidate
+          // queue, which already builds its preview link this way.
+          const prHref = candidatePrUrl(appDomain, row.prNumber);
+          if (prHref) {
+            const a = document.createElement("a");
+            a.href = prHref;
+            a.target = "_blank";
+            a.rel = "noopener";
+            a.textContent = "PR #" + row.prNumber;
+            prCell.append(a);
+          } else {
+            prCell.append(document.createTextNode("PR #" + row.prNumber));
+          }
+          prCell.append(subtle((row.prState || "") + (row.integratedIntoAggregate ? " · in aggregate" : "")));
+        } else {
+          prCell.append(subtle("No PR record"));
+        }
+        tr.append(prCell);
+
+        tr.append(cell(row.commitTimestampDisplay));
+        tr.append(cell(row.ageLabel));
+        // Evidence cell shows a summary only when the row actually HAS evidence —
+        // never a "no evidence reported" placeholder in an otherwise empty column.
+        tr.append(row.hasEvidence ? cell(row.evidenceSummary) : cell());
+
+        const actionsCell = document.createElement("td");
+        actionsCell.className = "action";
+        if (rowUnknown) {
+          // No trustworthy classification → offer no delete; the row's own eligibility
+          // is exactly what we could not confirm. A cleanup still re-checks server-side,
+          // but we must not INVITE one off a state we know we could not read.
+          actionsCell.append(subtle("—"));
+        } else if (row.classification === "orphan") {
+          // Orphan (human quarantined OR machine "Dead"): the sweep and one-click "Clean
+          // up" both refuse it, so this deliberate per-row HUMAN delete is its only path
+          // out. Distinct from "Clean up" (styled danger) and re-verified fresh server-side.
+          const btn = document.createElement("button");
+          btn.type = "button";
+          btn.className = "btn branch-delete-orphan";
+          btn.dataset.deleteOrphan = "1";
+          btn.disabled = !canShip;
+          btn.title = canShip ? "" : "Requires an owner/admin sign-in.";
+          btn.textContent = "Delete this branch";
+          btn.addEventListener("click", () => deleteOrphanBranch(row, btn));
+          actionsCell.append(btn);
+        } else if (row.eligibleForDelete) {
+          const btn = document.createElement("button");
+          btn.type = "button";
+          btn.className = "btn";
+          btn.disabled = !canShip;
+          btn.title = canShip ? "" : "Requires an owner/admin sign-in.";
+          btn.textContent = "Clean up";
+          btn.addEventListener("click", () => cleanupBranch(row, btn));
+          actionsCell.append(btn);
+        } else {
+          actionsCell.append(subtle("Keep"));
+        }
+        tr.append(actionsCell);
+
+        branchesBody.append(tr);
+      }
+    };
+
+    // Render a SUCCESSFUL live fetch: cache the rows (so a later failure can stamp
+    // them unknown), skip re-render when nothing changed, and set the summary chip.
+    const renderBranches = (view?: any) => {
+      if (!branchesBody) return;
+      const rows = Array.isArray(view.rows) ? view.rows : [];
+      const sig = JSON.stringify(rows);
+      lastBranchesRows = rows;
+      lastSweepableRefs = Array.isArray(view.sweepableRefs) ? view.sweepableRefs : [];
+      updateSweepButton();
+      if (sig === lastBranchesSignature) return; // no visible change — don't churn the DOM
+      lastBranchesSignature = sig;
+      if (branchesChip) {
+        const needsReview = rows.filter((r: any) => r.quarantine || r.eligibleForDelete).length;
+        branchesChip.textContent = needsReview
+          ? needsReview + " to review"
+          : rows.length
+            ? rows.length + " branches"
+            : "0 branches";
+        branchesChip.className = "chip" + (needsReview ? " amber" : "");
+      }
+      renderBranchRows(rows);
+    };
+
+    // Render the forge-unreachable state: re-stamp the last-known branches as
+    // "state unknown" (or a single notice if none were ever loaded), never leaving
+    // the stale confident chips a fetch failure would otherwise freeze on screen.
+    const renderBranchesUnreachable = () => {
+      if (!branchesBody) return;
+      lastBranchesSignature = null; // force a real re-render when the forge returns
+      lastSweepableRefs = []; // can't confirm eligibility → nothing is sweepable
+      updateSweepButton();
+      if (branchesChip) {
+        branchesChip.textContent = "State unknown";
+        branchesChip.className = "chip amber";
+      }
+      renderBranchRows(lastBranchesRows, { unreachable: true });
+    };
+
+    const loadBranchesImpl = async () => {
+      if (!branchesBody) return;
+      try {
+        const res = await fetch(ds.branchesEndpoint, { headers: { accept: "application/json" } });
+        if (res.status === 401 || res.status === 403) {
+          if (branchesChip) branchesChip.textContent = "Sign-in required";
+          lastSweepableRefs = [];
+          updateSweepButton();
+          branchesBody.textContent = "";
+          const tr = document.createElement("tr");
+          const td = cell(subtle("Sign in as a store owner or admin to view branch retention."));
+          td.colSpan = 7;
+          tr.append(td);
+          branchesBody.append(tr);
+          return;
+        }
+        const data = await res.json().catch(() => ({}));
+        if (!res.ok) {
+          // A non-2xx means the live classification is UNKNOWN — never keep the last
+          // chips on screen (they may now be lies). Stamp the branches "state unknown".
+          setStatus(branchesStatus, data.error || "Could not load branch classification (" + res.status + ")", "err");
+          renderBranchesUnreachable();
+          return;
+        }
+        renderBranches(data.report || {});
+      } catch {
+        setStatus(branchesStatus, "Could not load branch classification — network error", "err");
+        renderBranchesUnreachable();
+      }
+    };
+    // Coalesce overlapping branch reads: a poll tick, a reveal, and a post-action
+    // refresh can all fire at once — only one runs, with at most one trailing run.
+    const branchesCoalescer = createCoalescer(loadBranchesImpl);
+    const loadBranches = () => branchesCoalescer.trigger();
+
+    // ---- Wiring ------------------------------------------------------------
+
+    // Progressive + lazy: the tab shell is already server-rendered; each heavy
+    // panel fires its first read only when it (or the tab) actually becomes
+    // visible, and the queue poll only runs while the tab is active. An
+    // IntersectionObserver is the single visibility signal — a panel inside a
+    // hidden admin-tab (display:none) never intersects, so nothing fetches until
+    // the operator opens the Publish tab and scrolls the panel into view.
+    // r05 — restore each collapsible section's open/closed state from localStorage
+    // (per store, so one store's layout never bleeds into another) and persist it on
+    // every toggle. When nothing is stored the section keeps its SSR default. Native
+    // <details> carry no aria-expanded of their own, so we mirror it onto the summary
+    // and keep it in sync — a later a11y bundle asserts against it.
+    const setupCollapsePersistence = () => {
+      let storage: Storage | null;
+      try {
+        storage = typeof window !== "undefined" ? window.localStorage : null;
+      } catch {
+        storage = null; // localStorage access can throw (private mode / disabled)
+      }
+      const sections: Array<{ id: CollapseSectionId; selector: string }> = [
+        { id: "review-queue", selector: ".publish-queue-details" },
+        { id: "closed-changes", selector: ".closed-changes-details" },
+        { id: "next-release", selector: ".agg-console-details" },
+        { id: "live-site", selector: ".live-site-details" },
+        { id: "rollback", selector: ".versions-details" },
+      ];
+      for (const { id, selector } of sections) {
+        const details: any = root.querySelector(selector);
+        if (!details) continue;
+        const summary = details.querySelector("summary");
+        const syncAria = () => {
+          if (summary) summary.setAttribute("aria-expanded", details.open ? "true" : "false");
+        };
+        if (storage) {
+          const stored = readPersistedOpen(storage, appDomain, id);
+          if (stored !== null) details.open = stored; // otherwise keep the SSR default
+        }
+        syncAria();
+        details.addEventListener("toggle", () => {
+          if (storage) writePersistedOpen(storage, appDomain, id, details.open);
+          syncAria();
+        });
+      }
+    };
+
+    const revealDomainOnce = (() => {
+      let done = false;
+      return () => {
+        if (done) return;
+        done = true;
+        loadDomain();
+      };
+    })();
+
+    const onTabActivate = () => {
+      if (tabActive) return;
+      tabActive = true;
+      // loadQueue renders + resyncs the poll clock + (re)starts the cadence.
+      loadQueue();
+    };
+    const onTabDeactivate = () => {
+      if (!tabActive) return;
+      tabActive = false;
+      clearPoll(); // an inactive tab must not keep polling heavy reads
+    };
+
+    const observeVisibility = () => {
+      if (typeof IntersectionObserver !== "function") {
+        // No IO (very old/headless env): fall back to eager load — correctness
+        // over efficiency. Behaves like the pre-progressive-render tab.
+        tabActive = true;
+        branchesVisible = true;
+        loadQueue();
+        loadVersions();
+        revealDomainOnce();
+        loadBranches();
+        return;
+      }
+      const io = new IntersectionObserver(
+        (entries) => {
+          for (const e of entries) {
+            const visible = e.isIntersecting;
+            if (e.target === root) {
+              if (visible) onTabActivate();
+              else onTabDeactivate();
+            } else if (e.target === versionsPanel) {
+              if (visible) loadVersions();
+            } else if (e.target === branchesPanel) {
+              branchesVisible = visible;
+              if (visible) loadBranches();
+            } else if (e.target === domainPanel) {
+              if (visible) revealDomainOnce();
+            }
+          }
+        },
+        { rootMargin: "200px" },
+      );
+      io.observe(root);
+      if (versionsPanel) io.observe(versionsPanel);
+      if (branchesPanel) io.observe(branchesPanel);
+      if (domainPanel) io.observe(domainPanel);
+    };
+
+    root.querySelector("[data-publish-refresh]")?.addEventListener("click", () => {
+      setStatus(statusEl, "");
+      // Explicit refresh: force past every client cache and re-read what's on screen.
+      diffCache.clear();
+      versionsCache.clear();
+      loadQueue();
+      loadVersions({ force: true });
+      loadDomain();
+      loadBranches();
+    });
+
+    // rux7: pause polling while hidden; on return, refresh immediately (loadQueue
+    // re-renders + resyncs the poll clock) rather than waiting out the interval.
+    document.addEventListener("visibilitychange", () => {
+      if (document.hidden) {
+        clearPoll();
+      } else if (tabActive) {
+        // Only resume when the Publish tab is the active one — a background
+        // browser-tab return must not wake a Publish tab the operator left.
+        loadQueue();
+        if (branchesVisible) loadBranches(); // refresh branch truth on return
+      }
+    });
+
+    setupCollapsePersistence();
+    observeVisibility();
+}