@tokenoftrust/storefront-runner 1.4.2-rc.0 → 2.0.0

package/apps/storefront/src/components/admin/AdminPublishTab.astro

@@ -6,7 +6,7 @@
  *
  *   - OPEN CHANGE QUEUE from GET /api/changes ({ current, changes }) with
  *     per-change reconcile/compliance state, preview link, head sha, and age.
- *   - ACCEPT TO PREVIEW (POST /api/changes/integrate — b11's accept-to-preview
+ *   - ACCEPT TO PREVIEW (POST /api/changes/integrate — the accept-to-preview
  *     split; advances the shared `preview` aggregate, does NOT go live) and
  *     REJECT (with a note) per change. Going live is the aggregate card's
  *     exact-digest PUBLISH (POST /api/changes/ship), never a per-change accept.
@@ -23,7 +23,7 @@
  *     OWNER_CAPABILITIES) — others see the queue read-only with a sign-in note.
  *   - Non-premium tenants see the go-live control as a PAYWALL UPSELL — never
  *     hidden, never "coming soon" (recorded product direction). The
- *     entitlement signal is the existing premium model (D4): a custom-domain
+ *     entitlement signal is the existing premium model: a custom-domain
  *     tenant is premium/pilot; a `<label>.tokenoftrust.store` self-serve store
  *     is not. TODO(paywall workstream): replace with the real billing
  *     entitlement when one exists.
@@ -32,9 +32,10 @@ import { readViewerSession } from "@/lib/auth/route";
 import { withBase } from "@/lib/basePath";
 import { readEnv } from "@/lib/env";
 import { resolveViewerShipCapability } from "@/lib/change";
-import { resolveLiveVersion } from "@/lib/change/liveVersion";
-import { isPublicSiteCurrent } from "@/lib/change/liveDigest";
+import { resolveLiveVersion } from "@/lib/change/views/live-version";
+import { isPublicSiteCurrent, staticLiveManifestUrl } from "@/lib/change/views/live-digest";
 import { isHostedStoreDomain, isInternalTestTenant } from "@tot/public-runtime";
+import { mintPreviewShareToken } from "@/lib/preview/previewShareLink";
 
 const { envelope } = Astro.props;
 const { tenant, basePath } = Astro.locals;
@@ -51,7 +52,7 @@ const viewerCapability =
 // A signed-in DEVELOPER (not owner/admin) may hold an explicit, owner-revocable
 // ship-on-behalf grant. Resolve it LIVE from the MCP subject-capability store —
 // NEVER the coarse role, NEVER a client header — so a ship-granted developer sees
-// the queue + Go-live/Reject/Retire. This MIRRORS the server (resolveShipSession /
+// the queue + Go-live/Reject. This MIRRORS the server (resolveShipSession /
 // effectiveShipCapability); the server re-authorizes every action. UX-only.
 let viewerCanShip = viewerCapability === "owner" || viewerCapability === "admin";
 if (!viewerCanShip && Astro.locals.viewer?.email) {
@@ -77,13 +78,13 @@ const internalTestTenant = isInternalTestTenant(tenant);
 const staticPublishEnabled = Boolean(
   tenant.staticPublish && tenant.staticPublish.enabled !== false,
 );
-// Presence-only signal for the T5 dispatch sink (never the value).
+// Presence-only signal for the dispatch sink (never the value).
 const dispatchConfigured = Boolean((await readEnv("WWW_PUBLISH_DISPATCH_TOKEN"))?.trim());
 
 // "What does the public site actually serve right now?" — the read-back half of
 // the static-publish seam (resolveLiveVersion's staticLiveDigest), computed here
 // so it's ALWAYS visible rather than only living in GET /api/changes JSON. This is
-// the exact gap that let tokenoftrust.com's public site (preview.tokenoftrust.com)
+// the exact gap that can let tokenoftrust.com's published public site
 // sit two days stale behind several accepted-but-unpublished changes with nothing
 // in the console calling it out — going live and staying live for the PUBLIC
 // static target are two different facts, and this card makes the second one
@@ -103,43 +104,37 @@ const liveVersion = staticPublishEnabled
   : null;
 const publicSiteDigest = liveVersion?.staticLiveDigest ?? null;
 // The actual verdict: does the public target's manifest sha match what was last
-// promoted to "live" here? Both are real tenant Gitea shas (dg5) — a direct,
+// promoted to "live" here? Both are real tenant Gitea shas — a direct,
 // honest comparison, not a heuristic. See liveDigest.ts's isPublicSiteCurrent.
 const publicSiteVerdict = publicSiteDigest
   ? isPublicSiteCurrent(liveVersion?.versionId ?? null, publicSiteDigest)
   : null;
 
 const changesEndpoint = withBase(basePath || "", "/api/changes");
-// b11 — the branch-integration lifecycle SPLIT of accept from publish:
-//   - integrateEndpoint = b08's "accept = integrate into the protected preview
+// The branch-integration lifecycle SPLIT of accept from publish:
+//   - integrateEndpoint = "accept = integrate into the protected preview
 //     aggregate" (POST /api/changes/integrate → TenantIntegrationQueue.enqueue).
 //     This is the candidate-queue "Accept to preview" action — it advances the
 //     shared aggregate, it does NOT go live. Returns an IntegrateOutcome
 //     (queueState/runState/statusMessage), never a bare merged:true.
-//   - shipEndpoint = b10's exact-digest go-live (POST /api/changes/ship →
-//     b09 AggregateShipOrchestrator.plan/ship). The aggregate card's "Publish"
+//   - shipEndpoint = the exact-digest go-live (POST /api/changes/ship →
+//     AggregateShipOrchestrator.plan/ship). The aggregate card's "Publish"
 //     action: it ships the reviewed pinned SHA + digest, double-gated
 //     (paywall + human confirm). The read-only plan is served on GET /api/changes
 //     (`plan`), so the confirm surface never has to POST to preview it.
-// If b08/b10's exact paths differ at fold, the integrator reconciles here —
-// these are the agreed contract paths (see the unit brief).
 const integrateEndpoint = withBase(basePath || "", "/api/changes/integrate");
 const shipEndpoint = withBase(basePath || "", "/api/changes/ship");
-// U7 — retire/GC: evict a candidate's ReviewEnvironment + version (rebuildable),
-// DISTINCT from reject (which closes the change). Gated server-side by retireGate.
-const retireEndpoint = withBase(basePath || "", "/api/preview/retire");
-// rux5 — build-on-demand for a synthetic not-built PR row: materialize the PR's
+// Build-on-demand for a synthetic not-built PR row: materialize the PR's
 // hosted preview (INERT — flips no live channel). Gated server-side by buildGate
 // (the ship-on-behalf floor); the endpoint resolves the head sha via forge PR-read
 // when the row supplies only the PR number.
 const buildEndpoint = withBase(basePath || "", "/api/preview/build");
-// dg7 — the ship-operations workspace woven into this tab: versions/promotion
+// The ship-operations workspace woven into this tab: versions/promotion
 // history, per-candidate diff, and rollback (through the ONE rollback
 // orchestrator). Read endpoints mirror the change-queue's auth/scope.
 const versionsEndpoint = withBase(basePath || "", "/api/changes/versions");
 const rollbackEndpoint = withBase(basePath || "", "/api/changes/rollback");
-// b17 — branch retention: GET dry-run classification / POST guarded delete.
-// DISTINCT endpoint from retireEndpoint above (branch delete vs artifact evict).
+// Branch retention: GET dry-run classification / POST guarded delete.
 const branchesEndpoint = withBase(basePath || "", "/api/changes/branches");
 // The client builds `${diffEndpointBase}/<changeId>/diff` per candidate.
 const diffEndpointBase = changesEndpoint;
@@ -147,9 +142,47 @@ const diffEndpointBase = changesEndpoint;
 // digest actually serves. Rendered into "already live" copy + the publish
 // ceremony's "View your live store" CTA.
 const liveHref = withBase(basePath || "", "/");
+
+// LIVE-SITE ENTRY POINTS — surfaced explicitly so "where does my store actually
+// serve?" is never a mystery (it was). Two public URLs, always shown + clickable:
+//   1. Hosted store — THIS worker at the request host + tenant base path
+//      (e.g. storefront.tokenoftrust.store/tokenoftrust.com/).
+//   2. Public site — the static target's canonical URL, derived from the SAME
+//      manifest URL the freshness read-back probes (WWW_PUBLISH_VERIFY_URL or
+//      https://<canonicalDomain>/manifest.json), minus the /manifest.json tail
+//      (e.g. published.tokenoftrust.com). Only for static-publish tenants; a
+//      hosted-only tenant has no separate public site. Computed PURELY (no probe)
+//      so the URL shows even when the freshness probe above timed out.
+const requestHost = Astro.request.headers.get("host") ?? Astro.url.host;
+const liveStoreUrl = `${Astro.url.protocol}//${requestHost}${liveHref}`;
+const publicManifestUrl = staticPublishEnabled
+  ? staticLiveManifestUrl({
+      canonicalDomain: tenant.canonicalDomain,
+      // Per-tenant override first (never bleeds across stores), then the global env
+      // escape hatch, then the canonical-apex default — mirrors resolveLiveVersion.
+      explicitUrl: tenant.staticPublish?.verifyUrl ?? (await readEnv("WWW_PUBLISH_VERIFY_URL")) ?? null,
+    })
+  : null;
+const publicSiteUrl = publicManifestUrl
+  ? publicManifestUrl.replace(/\/manifest\.json$/, "/")
+  : null;
+const stripScheme = (u: string): string => u.replace(/^https?:\/\//, "");
+
+// r08 — a signed, tenant-scoped, expiring `?__preview` capability link an owner can
+// copy and hand to a non-technical stakeholder (view-only, no sign-in required).
+// Minted server-side so the signing secret never reaches the browser (mirrors
+// preview/dashboard.astro). Signs the tenant_id claim: the shared-preview
+// middleware verifies against `tenant.tenant_id` and the candidate renderer accepts
+// tenant_id too, so ONE token authorizes BOTH the shared next-release preview AND
+// per-candidate `preview/pr/<N>` links. Only minted for a ship-capable viewer, and
+// absent when signing isn't configured — the copy buttons then stay hidden rather
+// than offering a dead link. TTL 24h so a link copied late in a long session still
+// works; a reload re-mints a fresh one.
+const previewShareToken = viewerCanShip ? await mintPreviewShareToken(tenant.tenant_id) : null;
+
 const domainStatusEndpoint = withBase(basePath || "", "/api/domain/status");
 const domainDispatchEndpoint = withBase(basePath || "", "/api/domain/dispatch");
-// u9: the machine-verifiable apex-cutover readiness gate — the SAME server gate the
+// The machine-verifiable apex-cutover readiness gate — the SAME server gate the
 // `tot go-live` CLI reads, so the admin display and the CLI never diverge.
 const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness");
 ---
@@ -165,7 +198,6 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
   data-changes-endpoint={changesEndpoint}
   data-integrate-endpoint={integrateEndpoint}
   data-ship-endpoint={shipEndpoint}
-  data-retire-endpoint={retireEndpoint}
   data-build-endpoint={buildEndpoint}
   data-versions-endpoint={versionsEndpoint}
   data-rollback-endpoint={rollbackEndpoint}
@@ -176,17 +208,20 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
   data-domain-readiness-endpoint={domainReadinessEndpoint}
   data-repo={tenant.appDomain}
   data-app-domain={tenant.appDomain}
+  data-canonical-domain={tenant.canonicalDomain ?? ""}
+  data-preview-share-token={previewShareToken ?? ""}
   data-live-href={liveHref}
   data-can-ship={viewerCanShip ? "true" : "false"}
   data-is-owner={viewerIsOwner ? "true" : "false"}
   data-entitled={goLiveEntitled ? "true" : "false"}
   data-static-publish={staticPublishEnabled ? "true" : "false"}
   data-dispatch-configured={dispatchConfigured ? "true" : "false"}
+  data-public-site-host={publicSiteUrl ? stripScheme(publicSiteUrl).replace(/\/$/, "") : ""}
 >
   <div class="section-title">
     <div>
       <h2 id="publish-title">Publish</h2>
-      <p>Accept changes into the preview aggregate, then publish the reviewed build live.</p>
+      <p>Review what's changed, then publish your next release when you're ready.</p>
     </div>
     <div class="actions">
       <button class="btn" type="button" data-publish-refresh>
@@ -237,11 +272,79 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     </div>
   )}
 
+  <!-- State-driven "next action" hero (r01) — the SINGLE top-of-tab state
+       element. ONE sentence + ONE primary CTA, derived by lib/publish/publishHero.ts
+       from the SAME /api/changes read the queue + aggregate already fetch (no extra
+       read). It ABSORBS the two former standalone banners: the merge-doctor health
+       summary (B1) and the platform-fault "Report to support" escalation (B3) are
+       folded into the hero's state model, expressed through this one element — a
+       merge conflict/platform blocker turns the hero red/urgent instead of rendering
+       a separate banner. Rendered by renderHero() in adminPublishTab.ts; starts
+       hidden until the first /api/changes read resolves. The r03 stale-public-site
+       alarm sits alongside it in this region (a distinct top-level signal that
+       deep-links into Live Site), so there is ONE hero/alert region, not floating
+       banners. Urgency is never color-only: the tone drives the icon + an explicit
+       "Action needed" label. -->
+  <div class="publish-hero-region" data-publish-hero-region>
+    <div class="publish-hero" data-publish-hero data-tone="calm" hidden role="status" aria-live="polite">
+      <div class="publish-hero-main">
+        <span class="publish-hero-icon" data-publish-hero-icon aria-hidden="true">
+          <svg><use href="#i-check"></use></svg>
+        </span>
+        <div class="publish-hero-copy">
+          <span class="publish-hero-kicker" data-publish-hero-kicker hidden>Action needed</span>
+          <b class="publish-hero-headline" data-publish-hero-headline></b>
+          <span class="publish-hero-detail" data-publish-hero-detail></span>
+        </div>
+      </div>
+      <div class="publish-hero-actions">
+        <button class="btn primary publish-hero-cta" type="button" data-publish-hero-cta hidden></button>
+        <a class="btn primary publish-hero-cta" data-publish-hero-cta-link hidden href="mailto:success@tokenoftrust.com"></a>
+      </div>
+    </div>
+
+    <!-- r03: stale-public-site alarm, LIFTED to top-level. The "public site is
+         behind the live pointer" verdict (resolveLiveVersion / isPublicSiteCurrent)
+         used to sit buried inside the collapsible Live Site section; when the public
+         target is behind, surface it here as a top-level amber alarm that deep-links
+         into Live Site (where the full breakdown stays nested). SSR-driven from the
+         same publicSiteVerdict the Live Site chip reads — shown only for a
+         static-publish tenant whose public target is confirmed behind. -->
+    {staticPublishEnabled && publicSiteVerdict && publicSiteVerdict.status === "behind" && (
+      <div class="risk-alert amber publish-stale-site" data-publish-stale-site role="status" aria-live="polite">
+        <div class="risk-alert-main">
+          <svg><use href="#i-alert"></use></svg>
+          <div>
+            <b>Public site is behind — re-publish to catch it up</b>
+            <span>
+              Your public site is still serving an older release
+              (<code class="publish-mono">{publicSiteVerdict.publishedSha.slice(0, 12)}</code>)
+              while your live pointer has moved on to
+              (<code class="publish-mono">{publicSiteVerdict.livePointerSha.slice(0, 12)}</code>).
+              Re-publish, or open the publishing details for the full breakdown.
+            </span>
+          </div>
+        </div>
+        <a class="btn" href="#publish-live-site" data-publish-stale-site-link>Open publishing details</a>
+      </div>
+    )}
+  </div>
+
   <div class="grid cols-3">
     <div class="metric">
       <span>Live version</span>
-      <strong data-publish-live-version>—</strong>
+      <strong>
+        <!-- The human version label ("v42") links straight to the live store; the
+             raw SHA is demoted to the Technical details disclosure below. -->
+        <a class="live-version-link" data-publish-live-version-link href={liveHref}
+           target="_blank" rel="noopener" hidden>—</a>
+        <span data-publish-live-version-none>—</span>
+      </strong>
       <small data-publish-live-source>What shoppers see right now</small>
+      <details class="metric-tech" data-publish-live-tech hidden>
+        <summary>Technical details</summary>
+        <span class="publish-mono subtle" data-publish-live-sha>—</span>
+      </details>
     </div>
     <div class="metric">
       <span>Published</span>
@@ -271,64 +374,12 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     </div>
   )}
 
-  <!-- Public-site status — the READ-BACK half of the static-publish seam
-       (resolveLiveVersion's staticLiveDigest), made visible instead of only
-       existing in API JSON. Distinct from "Live version" above: that's the
-       CONTROL-PLANE record of what was promoted; this is what the external
-       target (CloudFront/S3) is HONESTLY observed serving right now — the two
-       can diverge (a stale/failed republish job) with nothing else in this
-       console able to tell you. Answers "did going live actually reach the
-       public site?" without a manual curl. -->
-  {staticPublishEnabled && publicSiteDigest && publicSiteVerdict && (
-    <div
-      class={`risk-alert ${publicSiteVerdict.status === "current" ? "public-site-ok" : "amber"}`}
-      data-publish-public-site
-    >
-      <div class="risk-alert-main">
-        <svg><use href={publicSiteVerdict.status === "current" ? "#i-check" : "#i-alert"}></use></svg>
-        <div>
-          {publicSiteVerdict.status === "current" ? (
-            <>
-              <b>Public site is up to date</b>
-              <span>
-                <code>{tenant.appDomain}</code>'s public target is serving the same commit
-                (<code class="publish-mono">{liveVersion?.versionId?.slice(0, 12)}</code>)
-                as the hosted store's live pointer. Publishing live above
-                republishes it automatically — usually within a few minutes.
-              </span>
-            </>
-          ) : publicSiteVerdict.status === "behind" ? (
-            <>
-              <b>Public site is behind the hosted store's live pointer</b>
-              <span>
-                <code>{tenant.appDomain}</code>'s public target is still serving{" "}
-                <code class="publish-mono">{publicSiteVerdict.publishedSha.slice(0, 12)}</code>, but
-                the hosted store's live pointer has since moved to{" "}
-                <code class="publish-mono">{publicSiteVerdict.livePointerSha.slice(0, 12)}</code>.
-                The republish job hasn't caught up yet (or a go-live happened before it was enabled) —
-                check the workflow run, or trigger a fresh go-live to re-dispatch it.
-              </span>
-            </>
-          ) : (
-            <>
-              <b>Couldn't verify the public site is current</b>
-              <span>
-                Checked <code class="publish-mono">{publicSiteDigest.url}</code>: {publicSiteVerdict.reason}.
-                This does NOT mean the hosted store's own "Live version" above is wrong, only that the
-                separate public static target couldn't be confirmed current.
-              </span>
-            </>
-          )}
-        </div>
-      </div>
-    </div>
-  )}
-
-  <div class="panel">
-    <div class="panel-head">
-      <h3><svg><use href="#i-export"></use></svg>Candidate queue</h3>
+  <div class="panel" id="publish-queue">
+    <details class="publish-queue-details" open>
+    <summary class="panel-head">
+      <h3><svg><use href="#i-export"></use></svg>What needs your approval?</h3>
       <span class="chip" data-publish-queue-chip>Loading</span>
-    </div>
+    </summary>
     <div class="panel-body grid">
       <p class="note publish-status" data-publish-status role="status" aria-live="polite"></p>
       <!-- rux1: forge-listing degraded strip. Shown ONLY when GET /api/changes
@@ -375,20 +426,113 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         </p>
       )}
     </div>
+    </details>
+  </div>
+
+  <!-- "See all" history: changes that LEFT the queue by being rejected. Rejecting
+       is otherwise a black hole — this collapsed panel keeps them visible (and their
+       preview reachable) so a reject is recoverable-from-history. Collapsed by
+       default (a reference, not a work surface); the whole panel is hidden by the
+       client when there are none, so it never adds empty chrome. Excludes shipped
+       (merged) changes — those live in the Live Site / versions panel. -->
+  <div class="panel" id="publish-closed" data-publish-closed-panel hidden>
+    <details class="closed-changes-details">
+    <summary class="panel-head">
+      <h3><svg><use href="#i-undo"></use></svg>Closed &amp; rejected changes</h3>
+      <span class="chip" data-publish-closed-chip>0</span>
+    </summary>
+    <div class="panel-body grid">
+      <p class="note subtle">
+        Changes you rejected. They're not in your next release and won't go live —
+        kept here so nothing you closed silently disappears. Open a preview to review
+        what it was.
+      </p>
+      <div class="table-wrap">
+        <table class="publish-table">
+          <thead>
+            <tr>
+              <th>Change</th>
+              <th>Closed</th>
+              <th>Head</th>
+            </tr>
+          </thead>
+          <tbody data-publish-closed-body></tbody>
+        </table>
+      </div>
+    </div>
+    </details>
   </div>
 
   <!-- b11: the AGGREGATE card — the protected `preview` aggregate the accepted
        candidates integrate into, its combined evidence (the last integration
        run's honest state), and the exact-digest Publish (b09/b10 ship the
        reviewed pinned SHA + digest, never a rebuild). -->
-  <div class="panel agg-console" data-publish-aggregate>
-    <div class="panel-head">
-      <h3><svg><use href="#i-box"></use></svg>Preview aggregate</h3>
+  <div class="panel agg-console" id="publish-next-release" data-publish-aggregate>
+    <details class="agg-console-details" open>
+    <summary class="panel-head">
+      <h3><svg><use href="#i-box"></use></svg>Next release</h3>
+      <!-- r11 — the human release name (aggregate.name), shown beside the heading.
+           Client-populated by renderAggregate; hidden (falls back to just "Next
+           release") when the release has no name. -->
+      <span class="agg-release-name" data-aggregate-name hidden></span>
+      <!-- One-click hop to the current preview build. Shown only when a
+           genuinely-built revision exists (renderAggregate toggles it via
+           classifyBuildLink), so it can never lead to a 404. The click is
+           stop-propagated in adminPublishTab.ts so opening the preview never
+           also toggles this collapsible. -->
+      <a class="btn btn-compact" data-aggregate-open-preview target="_blank" rel="noopener" hidden>Open preview</a>
+      <!-- r08 — copy a shareable, view-only preview link for the next release to hand
+           to a non-technical stakeholder (no sign-in). Unhidden by the client only
+           when a share token was minted; the click is stop-propagated so copying
+           never also toggles this collapsible. -->
+      <button class="btn btn-compact" type="button" data-aggregate-copy-preview hidden>
+        <svg><use href="#i-copy"></use></svg><span data-copy-preview-label>Copy preview link</span>
+      </button>
       <span class="chip" data-aggregate-chip>Loading</span>
-    </div>
+    </summary>
     <div class="panel-body grid">
       <p class="note publish-status" data-aggregate-status role="status" aria-live="polite"></p>
 
+      <!-- Keep the primary action beside the release status. The detail table can
+           be long; publishing must never be buried beneath it. -->
+      <div class="check-row agg-launch">
+        <div>
+          <b>
+            {staticPublishEnabled
+              ? "Publish this release to the hosted and public sites"
+              : "Publish this release to your live store"}
+          </b>
+          <p data-aggregate-publish-detail>
+            {publicSiteUrl ? (
+              <>
+                Publishes the exact build you reviewed to the hosted store, then
+                automatically republishes <code>{stripScheme(publicSiteUrl).replace(/\/$/, "")}</code>.
+              </>
+            ) : (
+              <>Publishes the exact build you reviewed — no rebuild.</>
+            )}
+          </p>
+        </div>
+        <button class="btn primary agg-publish-btn" type="button" data-aggregate-publish disabled>
+          <svg><use href="#i-export"></use></svg>
+          {staticPublishEnabled ? "Publish to both live sites" : "Publish live"}
+        </button>
+      </div>
+
+      <!-- Only visible after an actually failed aggregate rebuild. -->
+      <div class="check-row" data-aggregate-retry-row hidden>
+        <div>
+          <b>Retry the build</b>
+          <p>
+            Your change was added, but rebuilding the preview failed. Retry rebuilds it
+            and re-runs your store's checks — nothing new is added.
+          </p>
+        </div>
+        <button class="btn" type="button" data-aggregate-retry-build>
+          <svg><use href="#i-refresh"></use></svg>Retry build
+        </button>
+      </div>
+
       <!-- AI-assembled release summary — a plain-language "what am I about to
            publish?" ahead of the technical trust chain. Rendered ONLY when the
            server supplies data.releaseSummary; otherwise it stays hidden and the
@@ -409,34 +553,38 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
       </div>
 
       <!-- Chain of custody: the build that was verified → its combined evidence →
-           the digest that ships. The reviewed digest wears an accented token so
-           the eye can track that exactly what was reviewed is what goes live. The
-           three values keep their original data hooks (sha / evidence / digest). -->
-      <div class="agg-chain">
-        <div class="agg-stop">
-          <span class="agg-stop-label">Aggregate build</span>
-          <span class="agg-stop-val"><strong class="publish-mono" data-aggregate-sha>—</strong></span>
-          <p class="agg-stop-cap" data-aggregate-run-link>The current green preview build for this store.</p>
-        </div>
-        <div class="agg-link" aria-hidden="true">
-          <span class="agg-flowlabel">verified by</span>
-          <span class="agg-arrow"><svg viewBox="0 0 34 10" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M1 5h29m0 0-4-4m4 4-4 4"></path></svg></span>
-        </div>
-        <div class="agg-stop">
-          <span class="agg-stop-label">Combined evidence</span>
-          <span class="agg-stop-val"><strong data-aggregate-evidence>—</strong></span>
-          <p class="agg-stop-cap" data-aggregate-evidence-detail>The last integration run's verdict.</p>
-        </div>
-        <div class="agg-link" aria-hidden="true">
-          <span class="agg-flowlabel">produces</span>
-          <span class="agg-arrow"><svg viewBox="0 0 34 10" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M1 5h29m0 0-4-4m4 4-4 4"></path></svg></span>
-        </div>
-        <div class="agg-stop">
-          <span class="agg-stop-label">Reviewed digest</span>
-          <span class="agg-stop-val"><strong class="publish-mono agg-digest" data-aggregate-digest>—</strong></span>
-          <p class="agg-stop-cap">The content digest that will be published — exactly what you reviewed.</p>
+           the digest that ships. Collapsed by default — this is verification
+           detail for a developer, not something a merchant needs to read to
+           decide whether to publish; the plain-language summary above and the
+           Publish button below are the actual decision surface. -->
+      <details class="agg-chain-details">
+        <summary>Technical details</summary>
+        <div class="agg-chain">
+          <div class="agg-stop">
+            <span class="agg-stop-label">Aggregate build</span>
+            <span class="agg-stop-val"><strong class="publish-mono" data-aggregate-sha>—</strong></span>
+            <p class="agg-stop-cap" data-aggregate-run-link>The current green preview build for this store.</p>
+          </div>
+          <div class="agg-link" aria-hidden="true">
+            <span class="agg-flowlabel">verified by</span>
+            <span class="agg-arrow"><svg viewBox="0 0 34 10" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M1 5h29m0 0-4-4m4 4-4 4"></path></svg></span>
+          </div>
+          <div class="agg-stop">
+            <span class="agg-stop-label">Combined evidence</span>
+            <span class="agg-stop-val"><strong data-aggregate-evidence>—</strong></span>
+            <p class="agg-stop-cap" data-aggregate-evidence-detail>The last integration run's verdict.</p>
+          </div>
+          <div class="agg-link" aria-hidden="true">
+            <span class="agg-flowlabel">produces</span>
+            <span class="agg-arrow"><svg viewBox="0 0 34 10" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M1 5h29m0 0-4-4m4 4-4 4"></path></svg></span>
+          </div>
+          <div class="agg-stop">
+            <span class="agg-stop-label">Reviewed digest</span>
+            <span class="agg-stop-val"><strong class="publish-mono agg-digest" data-aggregate-digest>—</strong></span>
+            <p class="agg-stop-cap">The content digest that will be published — exactly what you reviewed.</p>
+          </div>
         </div>
-      </div>
+      </details>
 
       <!-- Included PRs — the batch this aggregate composes (b01 includedPrs). u14:
            the "missing middle" — this is the STAGED delta vs live. The title + note
@@ -467,255 +615,281 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
           </span>
         </div>
         <p class="note" data-aggregate-delta-note hidden></p>
-        <ul class="aggregate-prs-list agg-changes" data-aggregate-prs></ul>
+        <!-- ONE table, one row per change — merges what used to be two separate
+             "Included changes" lists (this staged-delta section + the Publish
+             plan's own duplicate) into a single source of truth. Populated by
+             renderAggregate, enriched with the plan's per-change title/description/
+             file+line counts when available. -->
+        <div class="table-wrap">
+          <table class="publish-table agg-included-table">
+            <thead>
+              <tr>
+                <th>Change</th>
+                <th>Head</th>
+                <th>Files</th>
+                <th>Lines</th>
+                <th>Added</th>
+                <th class="action">Actions</th>
+              </tr>
+            </thead>
+            <tbody data-aggregate-prs></tbody>
+          </table>
+        </div>
       </div>
 
       <!-- The exact-digest Publish plan (b09 plan()): pinned SHA + digest +
-           included PRs + rollback target + paywall verdict + run link. Shown
-           inline (from GET /api/changes `plan`) so the confirm never POSTs to
-           preview. Publish is refused until the plan is `ok`. -->
+           rollback target + paywall verdict + run link. Shown inline (from
+           GET /api/changes `plan`) so the confirm never POSTs to preview.
+           Publish is refused until the plan is `ok`. Its own included-changes
+           list was merged into the single table above — see data-aggregate-prs. -->
       <div class="aggregate-plan agg-manifest" data-aggregate-plan hidden>
         <div class="aggregate-plan-head agg-manifest-head">
           <b><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M9 11l3 3L22 4"></path><path d="M21 12v7a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h11"></path></svg>Publish plan</b>
           <span class="chip" data-aggregate-plan-chip></span>
         </div>
-        <dl class="aggregate-plan-grid" data-aggregate-plan-grid></dl>
-
-        <!-- Openable "Included changes": each accepted PR as a line item with its
-             human title, a one-line description of what it does, and meta (sha /
-             files / who + when). Populated by renderPlan; degrades to a bare count
-             when per-change titles/descriptions aren't available. The <details>
-             element is static so its open/closed state survives a poll re-render —
-             only the list contents are replaced. -->
-        <div class="agg-included" data-aggregate-plan-included hidden>
-          <details class="agg-included-details">
-            <summary>
-              <span class="agg-included-lead">Included changes</span>
-              <span class="agg-included-badge" data-aggregate-plan-included-count>0</span>
-              <span class="agg-included-hint" data-aggregate-plan-included-hint></span>
-              <span class="agg-chev" aria-hidden="true"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"><path d="M9 6l6 6-6 6"></path></svg></span>
-            </summary>
-            <ul class="agg-included-list" data-aggregate-plan-included-list></ul>
-          </details>
-        </div>
+        <details class="agg-chain-details">
+          <summary>Technical details</summary>
+          <dl class="aggregate-plan-grid" data-aggregate-plan-grid></dl>
+        </details>
 
         <p class="note" data-aggregate-plan-note></p>
       </div>
 
-      <!-- u15 — retry a DEAD rebuild (no new merge). Shown only while the aggregate
-           is red: a candidate's PR already merged into preview, but the
-           build/evidence step that follows died (e.g. a transient MCP error) — this
-           retries ONLY that step, against the sha the forge already carries. -->
-      <div class="check-row" data-aggregate-retry-row hidden>
-        <div>
-          <b>Retry the build</b>
-          <p>
-            The last merge landed on preview, but rebuilding it failed. Retry re-runs
-            the build + evidence check alone — no new merge, no membership change.
-          </p>
-        </div>
-        <button class="btn" type="button" data-aggregate-retry-build>
-          <svg><use href="#i-refresh"></use></svg>Retry build
-        </button>
-      </div>
-
-      <div class="check-row agg-launch">
-        <div>
-          <b>Publish the reviewed build to your live store</b>
-          <p data-aggregate-publish-detail>
-            Publishes the exact reviewed digest — no rebuild. Available once the
-            aggregate is green and its integration run passed.
-          </p>
-        </div>
-        <button class="btn primary agg-publish-btn" type="button" data-aggregate-publish disabled>
-          <svg><use href="#i-export"></use></svg>Publish live
-        </button>
-      </div>
-    </div>
-  </div>
-
-  <!-- dg7: published versions + promotion history + rollback (u2/u3 promotion_status,
-       u5 immutable /rev links, u8 rollback through the one orchestrator). -->
-  <div class="panel" data-publish-versions>
-    <div class="panel-head">
-      <h3><svg><use href="#i-refresh"></use></svg>Published versions</h3>
-      <span class="chip" data-versions-chip>Loading</span>
-    </div>
-    <div class="panel-body grid">
-      <p class="note publish-status" data-versions-status role="status" aria-live="polite"></p>
-      <p class="note" data-versions-rollback-note hidden></p>
-      <!-- u14: orients the owner between the staged aggregate above and live versions
-           below — "N staged change(s) not yet published; Publish live creates the next
-           version here." Owned by renderAggregate (its own element, so its timing never
-           races renderVersions). -->
-      <p class="note" data-versions-orientation hidden></p>
-      <div class="table-wrap">
-        <table class="publish-table versions-table">
-          <thead>
-            <tr>
-              <th>Version</th>
-              <th>Digest</th>
-              <th>Promoted</th>
-              <th>Preview</th>
-              <th>State</th>
-              <th class="action">Actions</th>
-            </tr>
-          </thead>
-          <tbody data-versions-body>
-            <tr data-versions-placeholder>
-              <td colspan="6"><span class="subtle">Loading published versions…</span></td>
-            </tr>
-          </tbody>
-        </table>
-      </div>
-    </div>
-  </div>
-
-  <!-- b17: branch retention — Admin visibility into the branch-lifecycle
-       contract's "Candidate branch retirement" table (P1 items 8/9/11). Reads
-       the guarded `candidate_list` classification (protected/active-open/
-       stale-open/integrated/closed-or-rejected/orphan) and, for a branch that
-       classifies as ready, runs the guarded `candidate_delete` — which
-       re-classifies fresh server-side and refuses anything not integrated or
-       closed-or-rejected, no matter what this panel last rendered. DISTINCT
-       from the "Retire" action in the candidate queue above: retire evicts a
-       hosted PREVIEW ARTIFACT (rebuildable); this panel deletes a Git BRANCH
-       (transport only, never the durable record — see the note below). An
-       orphan is always shown quarantined for review, never one-click deletable. -->
-  <div class="panel" data-publish-branches>
-    <div class="panel-head">
-      <h3><svg><use href="#i-workflows"></use></svg>Branch retention</h3>
-      <span class="chip" data-branches-chip>Loading</span>
-    </div>
-    <div class="panel-body grid">
-      <p class="note">
-        Cleans up candidate <b>branches</b> once their pull request is merged or
-        closed — a different action on a different object than <b>Retire</b> in
-        the queue above, which only evicts a hosted preview build (rebuildable
-        on demand, never a branch). Every classification below is a fresh
-        dry-run; <b>Sweep dead branches</b> lists exactly what it will delete and
-        asks once to confirm, then the server re-checks each ref fresh before
-        removing it.
-      </p>
-      <p class="note publish-status" data-branches-status role="status" aria-live="polite"></p>
-      <div class="toolbar" data-branches-actions hidden>
-        <button type="button" class="btn" data-branches-sweep>Sweep dead branches</button>
-      </div>
-      <div class="table-wrap">
-        <table class="publish-table">
-          <thead>
-            <tr>
-              <th>Branch</th>
-              <th>Classification</th>
-              <th>PR</th>
-              <th>Tip commit</th>
-              <th>Age</th>
-              <th>Evidence</th>
-              <th class="action">Actions</th>
-            </tr>
-          </thead>
-          <tbody data-branches-body>
-            <tr data-branches-placeholder>
-              <td colspan="7"><span class="subtle">Loading branch classification…</span></td>
-            </tr>
-          </tbody>
-        </table>
-      </div>
     </div>
+    </details>
   </div>
 
-  {staticPublishEnabled && (
-    <div class="panel" data-publish-domain>
-      <div class="panel-head">
-        <h3><svg><use href="#i-shield"></use></svg>Public domain</h3>
-        <span class="chip" data-domain-state-chip>Loading</span>
-      </div>
+  <!-- Branch retention panel removed entirely — old candidate branches now
+       clean themselves up automatically (auto-swept after each successful
+       accept/publish, see adminPublishTab.ts autoSweepBranches). There is
+       nothing here for anyone to look at or act on day-to-day, so there is no
+       panel at all, not even a collapsed one. -->
+
+  <!-- Publish next release — the collapsed destination/status panel below the
+       staged release. Its summary answers the operational question first: either
+       live already matches the staged release, or there is an action to advance it.
+       The disclosure contains destination links, freshness, rollback, and domain
+       controls for operators who need the detail. -->
+  <div class="panel" id="publish-live-site" data-publish-live-site>
+    <details class="live-site-details">
+      <summary class="panel-head">
+        <h3><svg><use href="#i-export"></use></svg>Publish next release</h3>
+        <span class="chip" data-live-release-state>Checking release…</span>
+        <button
+          class="btn primary btn-compact live-release-publish"
+          type="button"
+          data-live-release-publish
+          hidden
+        >Publish next release</button>
+      </summary>
       <div class="panel-body grid">
-        <div class="grid cols-3">
-          <div class="field">
-            <label>Serving from</label>
-            <strong data-domain-state>—</strong>
-            <p data-domain-since>Current host for {tenant.appDomain}</p>
-          </div>
-          <div class="field">
-            <label>Rollback records</label>
-            <strong data-domain-capture>None captured</strong>
-            <p>DNS records captured before connect — rollback restores these.</p>
-          </div>
-          <div class="field">
-            <label>Last run</label>
-            <strong data-domain-run>None</strong>
-            <p data-domain-run-detail>Connect and rollback runs appear here.</p>
-          </div>
-        </div>
-
-        <p class="note publish-status" data-domain-status role="status" aria-live="polite"></p>
-
-        <!-- u9: apex-cutover readiness — the itemized preconditions the server gate
-             requires before a connect is permitted. Populated from
-             /api/domain/readiness (the SAME gate `tot go-live` reads). -->
-        <div class="domain-readiness" data-domain-readiness hidden>
-          <div class="domain-readiness-head">
-            <b>Cutover readiness</b>
-            <span class="chip" data-domain-readiness-chip>Checking…</span>
-          </div>
-          <ul class="domain-readiness-list" data-domain-readiness-list></ul>
-          <p class="note" data-domain-readiness-note></p>
-        </div>
-
-        <div class="check-row">
-          <div>
-            <b>Connect {tenant.appDomain} to the storefront</b>
-            <p>
-              Updates two DNS names — <code>{tenant.appDomain}</code> and <code>www.{tenant.appDomain}</code> —
-              to serve the published site. Takes effect in about a minute. Type the
-              domain to confirm.
-            </p>
-            {!viewerCanApexCutover && (
-              <p><span class="chip amber">Owner/admin only</span> Connecting the domain requires an owner or admin sign-in.</p>
-            )}
-          </div>
-          <div class="domain-connect-controls">
-            <input
-              type="text"
-              placeholder={tenant.appDomain}
-              autocomplete="off"
-              spellcheck="false"
-              aria-label="Type the domain to confirm"
-              data-domain-confirm
-              disabled={!viewerCanApexCutover}
-            />
-            <label class="domain-rehearsal">
-              <input type="checkbox" data-domain-rehearsal disabled={!viewerCanApexCutover} />
-              Rehearsal (dry run, no DNS change)
-            </label>
-            <button
-              class="btn primary"
-              type="button"
-              data-domain-connect
-              data-owner-locked={!viewerCanApexCutover ? "true" : undefined}
-              disabled={!viewerCanApexCutover}
-            >
-              <svg><use href="#i-check"></use></svg>Connect domain
-            </button>
+        <ul class="live-site-links">
+          <li>
+            <span class="live-site-link-label">Hosted store</span>
+            <a class="live-site-link-url publish-mono" href={liveHref} target="_blank" rel="noopener">{stripScheme(liveStoreUrl)}</a>
+            <span class="live-site-link-note">Updates immediately when you publish the reviewed release above.</span>
+          </li>
+          {publicSiteUrl && (
+            <li>
+              <span class="live-site-link-label">Public site</span>
+              <a class="live-site-link-url publish-mono" href={publicSiteUrl} target="_blank" rel="noopener">{stripScheme(publicSiteUrl)}</a>
+              <span class="live-site-link-note">Republishes automatically after the hosted release is published.</span>
+            </li>
+          )}
+        </ul>
+
+        <!-- Public-site freshness read-back (static-publish seam's staticLiveDigest):
+             what the external target (CloudFront/S3) is HONESTLY observed serving
+             right now, vs the control-plane's live pointer — the two can diverge on a
+             stale/failed republish. Answers "did going live actually reach the public
+             site?" without a manual curl. -->
+        {staticPublishEnabled && publicSiteDigest && publicSiteVerdict && (
+          <div
+            class={`risk-alert ${publicSiteVerdict.status === "current" ? "public-site-ok" : "amber"}`}
+            data-publish-public-site
+          >
+            <div class="risk-alert-main">
+              <svg><use href={publicSiteVerdict.status === "current" ? "#i-check" : "#i-alert"}></use></svg>
+              <div>
+                {publicSiteVerdict.status === "current" ? (
+                  <>
+                    <b>Public site matches the currently published release</b>
+                    <span>
+                      <code>{stripScheme(publicSiteUrl ?? tenant.appDomain).replace(/\/$/, "")}</code> is serving
+                      (<code class="publish-mono">{liveVersion?.versionId?.slice(0, 12)}</code>)
+                      — the same release as the hosted store. Staged preview changes are
+                      a separate next release: use <b>Publish to both live sites</b> above
+                      to advance the hosted store and republish this public site.
+                    </span>
+                  </>
+                ) : publicSiteVerdict.status === "behind" ? (
+                  <>
+                    <b>Public site is behind the hosted store's live pointer</b>
+                    <span>
+                      <code>{tenant.appDomain}</code>'s public target is still serving{" "}
+                      <code class="publish-mono">{publicSiteVerdict.publishedSha.slice(0, 12)}</code>, but
+                      the hosted store's live pointer has since moved to{" "}
+                      <code class="publish-mono">{publicSiteVerdict.livePointerSha.slice(0, 12)}</code>.
+                      The republish job hasn't caught up yet (or a go-live happened before it was enabled) —
+                      check the workflow run, or trigger a fresh go-live to re-dispatch it.
+                    </span>
+                  </>
+                ) : (
+                  <>
+                    <b>Couldn't verify the public site is current</b>
+                    <span>
+                      Checked <code class="publish-mono">{publicSiteDigest.url}</code>: {publicSiteVerdict.reason}.
+                      This does NOT mean the hosted store's own "Live version" above is wrong, only that the
+                      separate public static target couldn't be confirmed current.
+                    </span>
+                  </>
+                )}
+              </div>
+            </div>
           </div>
+        )}
+
+        <!-- Rollback options — CONTAINED within Live Site as a subsection (was a sibling
+             panel). The full published-version history + one-click rollback through the
+             single rollback orchestrator; collapsed by default (most people never open
+             it — the live version is already the metric up top). Keeps its
+             data-publish-versions + data-versions-* hooks verbatim. -->
+        <div class="live-site-subsection" data-publish-versions>
+          <details class="versions-details">
+            <summary class="live-site-subhead">
+              <h4><svg><use href="#i-refresh"></use></svg>Rollback options</h4>
+              <span class="chip" data-versions-chip>Loading</span>
+            </summary>
+            <div class="grid">
+              <p class="note publish-status" data-versions-status role="status" aria-live="polite"></p>
+              <p class="note" data-versions-rollback-note hidden></p>
+              <!-- u14: orients the owner between the staged aggregate above and live versions
+                   below — "N staged change(s) not yet published; Publish live creates the next
+                   version here." Owned by renderAggregate (its own element, so its timing never
+                   races renderVersions). -->
+              <p class="note" data-versions-orientation hidden></p>
+              <div class="table-wrap">
+                <table class="publish-table versions-table">
+                  <thead>
+                    <tr>
+                      <th>Version</th>
+                      <th>Digest</th>
+                      <th>Promoted</th>
+                      <th>Preview</th>
+                      <th>State</th>
+                      <th class="action">Actions</th>
+                    </tr>
+                  </thead>
+                  <tbody data-versions-body>
+                    <tr data-versions-placeholder>
+                      <td colspan="6"><span class="subtle">Loading published versions…</span></td>
+                    </tr>
+                  </tbody>
+                </table>
+              </div>
+            </div>
+          </details>
         </div>
 
-        <div class="check-row">
-          <div>
-            <b>Roll back to the previous host</b>
-            <p data-domain-rollback-detail>
-              Restores the DNS records captured before connect. Available once records
-              have been captured.
-            </p>
+        <!-- Public domain (apex connect / rollback) — CONTAINED within Live Site as a
+             subsection. Keeps its data-publish-domain + data-domain-* hooks verbatim so
+             the client controller is unchanged; only the wrapper/heading are lighter to
+             read as a nested section rather than a sibling panel. -->
+        {staticPublishEnabled && (
+          <div class="live-site-subsection" data-publish-domain>
+            <div class="live-site-subhead">
+              <h4><svg><use href="#i-shield"></use></svg>Public domain</h4>
+              <span class="chip" data-domain-state-chip>Loading</span>
+            </div>
+            <div class="grid">
+              <div class="grid cols-3">
+                <div class="field">
+                  <label>Serving from</label>
+                  <strong data-domain-state>—</strong>
+                  <p data-domain-since>Current host for {tenant.appDomain}</p>
+                </div>
+                <div class="field">
+                  <label>Rollback records</label>
+                  <strong data-domain-capture>None captured</strong>
+                  <p>DNS records captured before connect — rollback restores these.</p>
+                </div>
+                <div class="field">
+                  <label>Last run</label>
+                  <strong data-domain-run>None</strong>
+                  <p data-domain-run-detail>Connect and rollback runs appear here.</p>
+                </div>
+              </div>
+
+              <p class="note publish-status" data-domain-status role="status" aria-live="polite"></p>
+
+              <!-- u9: apex-cutover readiness — the itemized preconditions the server gate
+                   requires before a connect is permitted. Populated from
+                   /api/domain/readiness (the SAME gate `tot go-live` reads). -->
+              <div class="domain-readiness" data-domain-readiness hidden>
+                <div class="domain-readiness-head">
+                  <b>Cutover readiness</b>
+                  <span class="chip" data-domain-readiness-chip>Checking…</span>
+                </div>
+                <ul class="domain-readiness-list" data-domain-readiness-list></ul>
+                <p class="note" data-domain-readiness-note></p>
+              </div>
+
+              <div class="check-row">
+                <div>
+                  <b>Connect {tenant.appDomain} to the storefront</b>
+                  <p>
+                    Updates two DNS names — <code>{tenant.appDomain}</code> and <code>www.{tenant.appDomain}</code> —
+                    to serve the published site. Takes effect in about a minute. Type the
+                    domain to confirm.
+                  </p>
+                  {!viewerCanApexCutover && (
+                    <p><span class="chip amber">Owner/admin only</span> Connecting the domain requires an owner or admin sign-in.</p>
+                  )}
+                </div>
+                <div class="domain-connect-controls">
+                  <input
+                    type="text"
+                    placeholder={tenant.appDomain}
+                    autocomplete="off"
+                    spellcheck="false"
+                    aria-label="Type the domain to confirm"
+                    data-domain-confirm
+                    disabled={!viewerCanApexCutover}
+                  />
+                  <label class="domain-rehearsal">
+                    <input type="checkbox" data-domain-rehearsal disabled={!viewerCanApexCutover} />
+                    Rehearsal (dry run, no DNS change)
+                  </label>
+                  <button
+                    class="btn primary"
+                    type="button"
+                    data-domain-connect
+                    data-owner-locked={!viewerCanApexCutover ? "true" : undefined}
+                    disabled={!viewerCanApexCutover}
+                  >
+                    <svg><use href="#i-check"></use></svg>Connect domain
+                  </button>
+                </div>
+              </div>
+
+              <div class="check-row">
+                <div>
+                  <b>Roll back to the previous host</b>
+                  <p data-domain-rollback-detail>
+                    Restores the DNS records captured before connect. Available once records
+                    have been captured.
+                  </p>
+                </div>
+                <button class="btn" type="button" data-domain-rollback disabled={!viewerCanShip}>
+                  <svg><use href="#i-refresh"></use></svg>Roll back
+                </button>
+              </div>
+            </div>
           </div>
-          <button class="btn" type="button" data-domain-rollback disabled={!viewerCanShip}>
-            <svg><use href="#i-refresh"></use></svg>Roll back
-          </button>
-        </div>
+        )}
       </div>
-    </div>
-  )}
+    </details>
+  </div>
 
   <!-- Accept-to-preview LIFTOFF — the plan confirm + live integration flight +
        outcome ceremony. One dialog, three phases (plan → flight → outcome).
@@ -725,44 +899,45 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
   <div class="liftoff-backdrop" data-liftoff hidden>
     <div class="liftoff-card" role="dialog" aria-modal="true" aria-labelledby="liftoff-title" tabindex="-1">
       <div class="liftoff-phase" data-liftoff-plan>
-        <p class="liftoff-kicker">Accept to preview</p>
-        <h3 class="liftoff-title" id="liftoff-title" data-liftoff-title>Integrate into preview</h3>
+        <p class="liftoff-kicker">Add to release</p>
+        <h3 class="liftoff-title" id="liftoff-title" data-liftoff-title>Add to your next release</h3>
         <dl class="liftoff-grid" data-liftoff-grid></dl>
         <p class="note">
-          Integrates this candidate into the protected <code>preview</code> aggregate, then
-          rebuilds it and re-runs its combined evidence. <b>Nothing goes live</b> —
-          publishing the reviewed build stays a separate, explicit step.
+          Adds this change to your next release, then rebuilds the preview and re-runs your
+          store's checks. <b>Nothing goes live</b> — publishing your release stays a
+          separate, explicit step.
         </p>
         <div class="liftoff-actions">
           <button class="btn" type="button" data-liftoff-cancel>Cancel</button>
           <button class="btn primary" type="button" data-liftoff-proceed>
-            <svg><use href="#i-check"></use></svg>Integrate into preview
+            <svg><use href="#i-check"></use></svg>Add to release
           </button>
         </div>
       </div>
 
       <div class="liftoff-phase" data-liftoff-flight hidden>
-        <p class="liftoff-kicker">Integration in flight</p>
-        <h3 class="liftoff-title" data-liftoff-flight-title>Integrating…</h3>
+        <p class="liftoff-kicker">Adding to your release</p>
+        <h3 class="liftoff-title" data-liftoff-flight-title>Adding…</h3>
         <ol class="liftoff-stages">
           <li data-liftoff-stage="merge">
             <span class="liftoff-dot"></span>
-            <div><b>Merge</b><span>squash-merge the candidate into <code>preview</code></span></div>
+            <div><b>Add</b><span>add this change to your next release</span></div>
           </li>
           <li data-liftoff-stage="build">
             <span class="liftoff-dot"></span>
-            <div><b>Rebuild</b><span>build the combined preview aggregate</span></div>
+            <div><b>Build</b><span>rebuild the preview with your change in it</span></div>
           </li>
           <li data-liftoff-stage="evidence">
             <span class="liftoff-dot"></span>
-            <div><b>Evidence</b><span>re-run the aggregate's combined checks</span></div>
+            <div><b>Check</b><span>re-run your store's checks on the preview</span></div>
           </li>
           <li data-liftoff-stage="green">
             <span class="liftoff-dot"></span>
-            <div><b>Green</b><span>the aggregate becomes the reviewable, shippable build</span></div>
+            <div><b>Ready</b><span>your next release is ready to review and publish</span></div>
           </li>
         </ol>
         <p class="liftoff-live" data-liftoff-live role="status" aria-live="polite">Working…</p>
+        <div class="stream-log" data-liftoff-log role="log" aria-live="polite"></div>
         <div class="liftoff-meta">
           <span class="publish-mono" data-liftoff-elapsed>0:00</span>
           <button class="btn" type="button" data-liftoff-hide>Continue in background</button>
@@ -826,7 +1001,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
             <p class="note" data-conflict-intro>
               From the store checkout that submitted this change, bring it up to date and
               re-submit — the open PR updates in place. Once the new build is ready,
-              finish here with <b>Integrate into preview</b>, or from the terminal with
+              finish here with <b>Add to release</b>, or from the terminal with
               <code>tot accept --tenant &lt;store&gt; --pr &lt;N&gt;</code>.
               Check <code>git status</code> first — abort any half-finished rebase from an
               earlier attempt. Then <code>tot pr</code>: this change should be marked
@@ -843,6 +1018,11 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         </div>
         <div class="liftoff-actions">
           <a class="btn" data-liftoff-review target="_blank" rel="noopener" hidden>Review the preview build</a>
+          <!-- Fail-visible next step: when the merge LANDED but the preview build
+               failed, this offers Rebuild (not a dead "did not land"); on an
+               indeterminate outcome it offers Re-check. Hidden on success/conflict
+               (conflict recovery owns its own primary action). -->
+          <button class="btn primary" type="button" data-liftoff-rebuild hidden>Rebuild the preview build</button>
           <button class="btn primary" type="button" data-liftoff-done>Done</button>
         </div>
       </div>
@@ -881,8 +1061,10 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         <p class="liftoff-live" data-shipoff-live role="status" aria-live="polite">
           Pinning the exact reviewed build to your live channel…
         </p>
+        <div class="stream-log" data-shipoff-log role="log" aria-live="polite"></div>
         <div class="liftoff-meta">
           <span class="publish-mono" data-shipoff-elapsed>0:00</span>
+          <button class="btn" type="button" data-shipoff-hide>Continue in background</button>
         </div>
       </div>
 
@@ -890,8 +1072,23 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
         <div class="liftoff-seal" data-shipoff-seal aria-hidden="true"></div>
         <h3 class="liftoff-title" data-shipoff-outcome-title></h3>
         <p class="note" data-shipoff-outcome-detail></p>
+        <!-- Failure detail + "Copy for your AI agent" — shown ONLY when the publish did
+             not complete. Mirrors the build-flight failure affordance. -->
+        <div class="liftoff-conflict" data-shipoff-failure hidden>
+          <pre class="liftoff-commands publish-mono" data-shipoff-failure-detail></pre>
+          <div class="liftoff-conflict-actions">
+            <button class="btn" type="button" data-shipoff-copy>Copy for your AI agent</button>
+          </div>
+        </div>
         <div class="liftoff-actions">
-          <a class="btn primary" data-shipoff-view target="_blank" rel="noopener" hidden>View your live store</a>
+          <a class="btn primary" data-shipoff-view target="_blank" rel="noopener" hidden>View live</a>
+          <!-- r10 — right at the post-publish moment: jump straight to the rollback
+               row for the version this release just replaced, pre-targeted, so a
+               publish that looked wrong is one click from being undone. Reuses the
+               existing Live Site rollback action; shown only on a successful ship. -->
+          <button class="btn" type="button" data-shipoff-undo hidden>
+            <svg><use href="#i-undo"></use></svg>Undo this release
+          </button>
           <button class="btn" type="button" data-shipoff-done>Done</button>
         </div>
       </div>
@@ -899,6 +1096,103 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
       <div class="liftoff-confetti" data-shipoff-confetti aria-hidden="true"></div>
     </div>
   </div>
+
+  <!-- Build/check flight — the real-time counterpart of the accept liftoff for the
+       "Build preview" / "Run checks" action. `POST /api/preview/build` streams its
+       lifecycle phases over SSE (Accept: text/event-stream); this dialog reflects them
+       live on the SAME stage-rail + "Continue in background" pattern as the liftoff.
+       On a FAILURE the outcome shows the full detail the build reported plus a "Copy
+       for your AI agent" button (mirrors the merge-conflict copy affordance). Progress
+       reduction + copy assembly live in the tested buildStream.ts; this glue mirrors
+       it (verified on preview). -->
+  <div class="liftoff-backdrop" data-buildoff hidden>
+    <div class="liftoff-card" role="dialog" aria-modal="true" aria-labelledby="buildoff-title" tabindex="-1">
+      <div class="liftoff-phase" data-buildoff-flight>
+        <p class="liftoff-kicker">Building preview</p>
+        <h3 class="liftoff-title" id="buildoff-title" data-buildoff-flight-title>Building…</h3>
+        <ol class="liftoff-stages">
+          <li data-buildoff-stage="resolve">
+            <span class="liftoff-dot"></span>
+            <div><b>Locate commit</b><span>find the pull request's latest commit</span></div>
+          </li>
+          <li data-buildoff-stage="read">
+            <span class="liftoff-dot"></span>
+            <div><b>Read &amp; validate</b><span>read your store's files and check them</span></div>
+          </li>
+          <li data-buildoff-stage="publish">
+            <span class="liftoff-dot"></span>
+            <div><b>Publish version</b><span>materialize this version's hosted preview</span></div>
+          </li>
+          <li data-buildoff-stage="check">
+            <span class="liftoff-dot"></span>
+            <div><b>Run checks</b><span>compute the evidence for this version</span></div>
+          </li>
+        </ol>
+        <p class="liftoff-live" data-buildoff-live role="status" aria-live="polite">Starting…</p>
+        <div class="stream-log" data-buildoff-log role="log" aria-live="polite"></div>
+        <div class="liftoff-meta">
+          <span class="publish-mono" data-buildoff-elapsed>0:00</span>
+          <button class="btn" type="button" data-buildoff-hide>Continue in background</button>
+        </div>
+      </div>
+
+      <div class="liftoff-phase liftoff-outcome-phase" data-buildoff-outcome hidden>
+        <div class="liftoff-seal" data-buildoff-seal aria-hidden="true"></div>
+        <h3 class="liftoff-title" data-buildoff-outcome-title></h3>
+        <p class="note" data-buildoff-outcome-detail></p>
+        <!-- Failure detail + "Copy for your AI agent" — shown ONLY when the build did
+             not succeed. The detail is the honest reason the build reported (errors +
+             blocking findings); the copy button hands a framed brief to a coding agent. -->
+        <div class="liftoff-conflict" data-buildoff-failure hidden>
+          <pre class="liftoff-commands publish-mono" data-buildoff-failure-detail></pre>
+          <div class="liftoff-conflict-actions">
+            <button class="btn" type="button" data-buildoff-copy>Copy for your AI agent</button>
+          </div>
+        </div>
+        <div class="liftoff-actions">
+          <a class="btn" data-buildoff-review target="_blank" rel="noopener" hidden>Open the preview</a>
+          <button class="btn primary" type="button" data-buildoff-done>Done</button>
+        </div>
+      </div>
+    </div>
+  </div>
+
+  <!-- Retry-build flight — the real-time counterpart for the aggregate "Retry build"
+       action (`POST /api/changes/rebuild`), which re-runs ONLY the aggregate rebuild +
+       combined evidence against the last merged commit (no new merge). It streams its
+       reading/publishing/checking phases over SSE into the SAME shared scrolling
+       live-log console; "Continue in background" hides it while the stream keeps
+       running, and on a FAILURE the outcome shows the honest detail + a "Copy for your
+       AI agent" button — the same affordances as the build/ship flights. -->
+  <div class="liftoff-backdrop" data-rebuildoff hidden>
+    <div class="liftoff-card" role="dialog" aria-modal="true" aria-labelledby="rebuildoff-title" tabindex="-1">
+      <div class="liftoff-phase" data-rebuildoff-flight>
+        <p class="liftoff-kicker">Retrying the build</p>
+        <h3 class="liftoff-title" id="rebuildoff-title">Rebuilding your next release preview…</h3>
+        <p class="liftoff-live" data-rebuildoff-live role="status" aria-live="polite">Starting…</p>
+        <div class="stream-log" data-rebuildoff-log role="log" aria-live="polite"></div>
+        <div class="liftoff-meta">
+          <span class="publish-mono" data-rebuildoff-elapsed>0:00</span>
+          <button class="btn" type="button" data-rebuildoff-hide>Continue in background</button>
+        </div>
+      </div>
+
+      <div class="liftoff-phase liftoff-outcome-phase" data-rebuildoff-outcome hidden>
+        <div class="liftoff-seal" data-rebuildoff-seal aria-hidden="true"></div>
+        <h3 class="liftoff-title" data-rebuildoff-outcome-title></h3>
+        <p class="note" data-rebuildoff-outcome-detail></p>
+        <div class="liftoff-conflict" data-rebuildoff-failure hidden>
+          <pre class="liftoff-commands publish-mono" data-rebuildoff-failure-detail></pre>
+          <div class="liftoff-conflict-actions">
+            <button class="btn" type="button" data-rebuildoff-copy>Copy for your AI agent</button>
+          </div>
+        </div>
+        <div class="liftoff-actions">
+          <button class="btn primary" type="button" data-rebuildoff-done>Done</button>
+        </div>
+      </div>
+    </div>
+  </div>
 </section>
 
 <script>
@@ -911,11 +1205,241 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     min-width: 900px;
   }
 
+  /* r06 — responsive change queue. On a narrow screen the min-width:900px queue
+     table forces horizontal scroll, unusable on a phone. Below ~700px, restack the
+     existing rows into labeled cards — CSS-only, no DOM/JS change: the table, rows
+     and cells become blocks, the visual header is hidden (kept for assistive tech),
+     and each cell gains its column label via a ::before drawn from the fixed thead
+     order. Scoped to #publish-queue so the aggregate/versions tables are untouched.
+     Full-width colspan rows (empty state, sign-in notice, the inline review pane)
+     stay unlabeled and full width. */
+  @media (max-width: 700px) {
+    #publish-queue .publish-table,
+    #publish-queue .publish-table tbody,
+    #publish-queue .publish-table tr,
+    #publish-queue .publish-table td {
+      display: block;
+      min-width: 0;
+      width: auto;
+    }
+    #publish-queue .publish-table thead {
+      position: absolute;
+      width: 1px;
+      height: 1px;
+      overflow: hidden;
+      clip: rect(0 0 0 0);
+      clip-path: inset(50%);
+      white-space: nowrap;
+    }
+    #publish-queue .publish-table tbody tr {
+      margin: 0 0 12px;
+      padding: 10px 12px;
+      border: 1px solid var(--admin-line);
+      border-radius: var(--admin-radius-sm);
+      background: var(--admin-surface, #fff);
+    }
+    #publish-queue .publish-table tbody td {
+      padding: 4px 0;
+      text-align: left;
+      border: 0;
+    }
+    #publish-queue .publish-table tbody td:not([colspan])::before {
+      display: block;
+      margin-bottom: 2px;
+      font-size: 11px;
+      font-weight: 600;
+      text-transform: uppercase;
+      letter-spacing: 0.04em;
+      opacity: 0.6;
+    }
+    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(1)::before {
+      content: "Change";
+    }
+    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(2)::before {
+      content: "Status";
+    }
+    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(3)::before {
+      content: "Checks";
+    }
+    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(4)::before {
+      content: "Head";
+    }
+    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(5)::before {
+      content: "Updated";
+    }
+    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(6)::before {
+      content: "Actions";
+    }
+  }
+
+  /* Collapsible panels (What needs your approval, Next release, Live Site): the
+     panel-head IS the summary. Kill the native marker, add a rotating chevron, and
+     make the whole head a click target. Mirrors the Rollback options (.versions-details). */
+  .publish-queue-details > summary.panel-head,
+  .closed-changes-details > summary.panel-head,
+  .agg-console-details > summary.panel-head,
+  .live-site-details > summary.panel-head,
+  .versions-details > summary.live-site-subhead {
+    cursor: pointer;
+    list-style: none;
+    user-select: none;
+  }
+  .publish-queue-details > summary.panel-head::-webkit-details-marker,
+  .closed-changes-details > summary.panel-head::-webkit-details-marker,
+  .agg-console-details > summary.panel-head::-webkit-details-marker,
+  .live-site-details > summary.panel-head::-webkit-details-marker,
+  .versions-details > summary.live-site-subhead::-webkit-details-marker {
+    display: none;
+  }
+  .publish-queue-details > summary.panel-head h3::before,
+  .closed-changes-details > summary.panel-head h3::before,
+  .agg-console-details > summary.panel-head h3::before,
+  .live-site-details > summary.panel-head h3::before,
+  .versions-details > summary.live-site-subhead h4::before {
+    content: "";
+    width: 7px;
+    height: 7px;
+    margin-right: 2px;
+    border-right: 2px solid currentColor;
+    border-bottom: 2px solid currentColor;
+    transform: rotate(-45deg);
+    transition: transform 0.15s ease;
+    opacity: 0.6;
+  }
+  .publish-queue-details[open] > summary.panel-head h3::before,
+  .closed-changes-details[open] > summary.panel-head h3::before,
+  .agg-console-details[open] > summary.panel-head h3::before,
+  .live-site-details[open] > summary.panel-head h3::before,
+  .versions-details[open] > summary.live-site-subhead h4::before {
+    transform: rotate(45deg);
+  }
+
+  /* The collapsed release summary owns one mutually exclusive state affordance:
+     a green current-state chip or the action that advances live. Both classes set
+     display, so explicitly preserve the semantic hidden state. */
+  [data-live-release-state][hidden],
+  .live-release-publish[hidden] {
+    display: none;
+  }
+
+  /* Live Site — the two clickable public entry points, previously undiscoverable. */
+  .live-site-links {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+    display: grid;
+    gap: 12px;
+  }
+  .live-site-links > li {
+    display: grid;
+    grid-template-columns: minmax(96px, auto) 1fr;
+    align-items: baseline;
+    gap: 4px 12px;
+  }
+  .live-site-link-label {
+    font-weight: 600;
+    font-size: 13px;
+    color: var(--admin-fg, inherit);
+  }
+  .live-site-link-url {
+    word-break: break-all;
+    font-size: 13px;
+  }
+  .live-site-link-note {
+    grid-column: 2;
+    font-size: 12px;
+    opacity: 0.7;
+  }
+
+  /* r13 — Rollback + Public domain nested INSIDE Live Site read as a subsection,
+     not a sibling panel: a single left rule + generous spacing rather than a boxed
+     card, so the Live Site panel doesn't stack boxes-in-boxes. */
+  .live-site-subsection {
+    border-left: 2px solid var(--admin-line);
+    padding-left: 16px;
+    margin-top: 18px;
+    display: grid;
+    gap: 12px;
+  }
+  /* r13 — the Public-domain status trio (Serving from / Rollback records / Last run)
+     were full `.field` cards (border + fill) nested inside the Live Site panel — the
+     genuine boxes-in-boxes. Flatten them to plain label/value blocks (hooks kept);
+     the subsection's left rule + grid gap carry the separation instead. */
+  .live-site-subsection .field {
+    border: 0;
+    background: transparent;
+    padding: 0;
+  }
+  .live-site-subhead {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 12px;
+  }
+  .live-site-subhead h4 {
+    margin: 0;
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    font-size: 14px;
+  }
+
   .publish-mono {
     font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
     font-size: 12px;
   }
 
+  /* r11 — the human release name beside the "Next release" heading. */
+  .agg-release-name {
+    font-size: 13px;
+    font-weight: 600;
+    color: var(--admin-muted);
+  }
+  .agg-release-name[hidden] {
+    display: none;
+  }
+
+  /* r02 — the humanized "Live version" metric: "v42" as a link to the live store,
+     with the raw SHA tucked into a "Technical details" disclosure. */
+  .live-version-link {
+    color: inherit;
+    text-decoration: none;
+    border-bottom: 1px solid color-mix(in srgb, currentColor 35%, transparent);
+  }
+  .live-version-link:hover {
+    border-bottom-color: currentColor;
+  }
+  .metric-tech,
+  .ver-tech {
+    margin-top: 4px;
+    font-size: 12px;
+  }
+  .metric-tech > summary,
+  .ver-tech > summary {
+    cursor: pointer;
+    color: var(--muted, #64716d);
+    font-size: 11px;
+    list-style: none;
+  }
+  .metric-tech > summary::-webkit-details-marker,
+  .ver-tech > summary::-webkit-details-marker {
+    display: none;
+  }
+  .ver-tech {
+    margin-top: 6px;
+  }
+
+  /* r08 — the "Copy preview link" affordance (icon + text, never color-only). */
+  .publish-copy-preview {
+    display: inline-flex;
+    align-items: center;
+    gap: 5px;
+  }
+  .publish-copy-preview svg {
+    width: 14px;
+    height: 14px;
+  }
+
   .publish-actions {
     white-space: nowrap;
   }
@@ -964,6 +1488,148 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     color: var(--admin-green);
   }
 
+  /* ── State-driven hero (r01) ─────────────────────────────────────────────
+     The single top-of-tab state element. One row: an icon whose tone conveys
+     urgency (never color alone — a "Action needed" kicker rides the two blocker
+     tones), the one-sentence state + supporting detail, and one primary CTA laid
+     out to the trailing edge (like the paywall gate). Tone is set by
+     renderHero() via [data-tone]. */
+  .publish-hero-region {
+    display: grid;
+    gap: 12px;
+  }
+  .publish-hero {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 16px;
+    flex-wrap: wrap;
+    padding: 14px 16px;
+    border: 1px solid var(--admin-line-strong);
+    border-left-width: 4px;
+    border-radius: var(--admin-radius, 12px);
+    background: var(--admin-surface);
+  }
+  .publish-hero[hidden] {
+    display: none;
+  }
+  .publish-hero-main {
+    display: flex;
+    align-items: center;
+    gap: 13px;
+    min-width: 0;
+  }
+  .publish-hero-icon {
+    flex: none;
+    width: 34px;
+    height: 34px;
+    display: grid;
+    place-items: center;
+    border-radius: 9px;
+    background: var(--admin-surface-soft);
+  }
+  .publish-hero-icon svg {
+    width: 19px;
+    height: 19px;
+  }
+  .publish-hero-copy {
+    display: grid;
+    gap: 2px;
+    min-width: 0;
+  }
+  .publish-hero-kicker {
+    font-size: 10.5px;
+    font-weight: 760;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--admin-red);
+  }
+  .publish-hero-kicker[hidden] {
+    display: none;
+  }
+  .publish-hero-headline {
+    font-size: 15.5px;
+    line-height: 1.3;
+    color: var(--admin-ink);
+  }
+  .publish-hero-detail {
+    font-size: 13px;
+    color: var(--admin-muted);
+    line-height: 1.45;
+  }
+  .publish-hero-detail:empty {
+    display: none;
+  }
+  .publish-hero-actions {
+    flex: none;
+    display: flex;
+    gap: 8px;
+  }
+  .publish-hero-cta[hidden] {
+    display: none;
+  }
+
+  /* Tones — the accent rail + icon colour. Blocker/warn borrow the admin
+     red/amber tokens; ready/attention the teal; calm stays neutral. */
+  .publish-hero[data-tone="blocker"] {
+    border-left-color: var(--admin-red);
+    background: var(--admin-red-soft);
+  }
+  .publish-hero[data-tone="blocker"] .publish-hero-icon svg {
+    color: var(--admin-red);
+  }
+  .publish-hero[data-tone="warn"] {
+    border-left-color: var(--admin-amber);
+    background: var(--admin-surface-soft);
+  }
+  .publish-hero[data-tone="warn"] .publish-hero-icon svg {
+    color: var(--admin-amber);
+  }
+  .publish-hero[data-tone="attention"] {
+    border-left-color: var(--admin-teal, #0f9d8f);
+  }
+  .publish-hero[data-tone="attention"] .publish-hero-icon svg {
+    color: var(--admin-teal, #0f9d8f);
+  }
+  .publish-hero[data-tone="ready"] {
+    border-left-color: var(--admin-green);
+    background: var(--admin-green-soft);
+  }
+  .publish-hero[data-tone="ready"] .publish-hero-icon svg {
+    color: var(--admin-green);
+  }
+  .publish-hero[data-tone="calm"] {
+    border-left-color: var(--admin-line-strong);
+  }
+  .publish-hero[data-tone="calm"] .publish-hero-icon svg {
+    color: var(--admin-green);
+  }
+
+  /* r03 stale-public-site alarm — lays its "Open Live Site" deep-link to the
+     trailing edge, like the paywall gate. Inherits the amber .risk-alert look. */
+  .risk-alert.publish-stale-site {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 12px;
+    flex-wrap: wrap;
+  }
+  .risk-alert.publish-stale-site .btn {
+    flex: none;
+  }
+
+  /* Per-row finding: the ownership-tag chip leads the row's action cell (what's
+     wrong, in operator words), and the mapped action button gets a subtle ring so
+     the operator sees which button resolves it. Tone (red/amber/neutral) rides the
+     shared .chip convention; primed emphasis is added to the EXISTING button. */
+  .publish-actions .publish-finding-chip {
+    vertical-align: middle;
+  }
+
+  .publish-actions .btn.publish-cta-primed {
+    box-shadow: 0 0 0 2px var(--admin-amber);
+  }
+
   /* ?pr=N deep link: "not in the queue" callout + row flash */
   .publish-pr-callout {
     border: 1px solid var(--admin-line-strong);
@@ -1139,7 +1805,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     overflow-wrap: anywhere;
   }
 
-  /* u4 — automate-first recovery: the primary action leads, option cards appear
+  /* Automate-first recovery: the primary action leads, option cards appear
      only on a genuine overlap, the terminal guidance is a collapsed fallback. */
   .liftoff-conflict-summary {
     margin: 0 0 10px;
@@ -1320,6 +1986,31 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     color: var(--admin-ink);
   }
 
+  /* The shared scrolling live-log console — a "CI build log" window reused across
+     the build / integrate / rebuild / ship flight dialogs. Fixed height, scrolls,
+     newest line auto-scrolled into view by the client (see makeLogConsole). */
+  .stream-log {
+    margin: 10px 0 0;
+    max-height: 150px;
+    overflow-y: auto;
+    padding: 8px 10px;
+    border: 1px solid var(--admin-border, rgba(0, 0, 0, 0.12));
+    border-radius: 8px;
+    background: var(--admin-code-bg, rgba(0, 0, 0, 0.04));
+    font-family: ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, monospace;
+    font-size: 12px;
+    line-height: 1.5;
+    color: var(--admin-ink);
+    -webkit-overflow-scrolling: touch;
+  }
+  .stream-log:empty {
+    display: none;
+  }
+  .stream-log-line {
+    white-space: pre-wrap;
+    word-break: break-word;
+  }
+
   .liftoff-meta {
     display: flex;
     justify-content: space-between;
@@ -1444,7 +2135,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     }
   }
 
-  /* u9: apex-cutover readiness itemization */
+  /* Apex-cutover readiness itemization */
   .domain-readiness {
     margin: 0.75rem 0;
     padding: 0.75rem 1rem;
@@ -1500,7 +2191,7 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     opacity: 0.95;
   }
 
-  /* b11: aggregate card + ship plan */
+  /* Aggregate card + ship plan */
   .aggregate-prs {
     display: grid;
     gap: 6px;
@@ -1521,12 +2212,12 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     font-size: 13px;
   }
 
-  /* u14 — provenance ("integrated <age> by <email>") sits after the sha, subtle. */
+  /* Provenance ("integrated <age> by <email>") sits after the sha, subtle. */
   .aggregate-pr-meta {
     font-size: 12px;
   }
 
-  /* u14 — the per-change Undo (revert) button is pushed to the row's trailing edge
+  /* The per-change Undo (revert) button is pushed to the row's trailing edge
      and kept compact so the batch reads as a list, not a stack of buttons. */
   .aggregate-prs-list .btn-compact {
     margin-left: auto;
@@ -1827,41 +2518,6 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     font-weight: 720;
   }
 
-  /* Staged change rows (richer than the plain PR list) */
-  .agg-changes li.agg-change {
-    display: grid;
-    grid-template-columns: 1fr auto;
-    align-items: center;
-    gap: 12px;
-    padding: 10px 12px;
-    border: 1px solid var(--admin-line);
-    border-radius: var(--admin-radius-sm);
-    background: var(--admin-surface);
-  }
-  .agg-change-main {
-    display: grid;
-    gap: 4px;
-    min-width: 0;
-  }
-  .agg-change-line {
-    display: flex;
-    align-items: center;
-    gap: 10px;
-    flex-wrap: wrap;
-  }
-  .agg-change-pr {
-    font-weight: 720;
-    font-size: 13px;
-  }
-  .agg-change-title {
-    font-weight: 600;
-    font-size: 13.5px;
-  }
-  .agg-change-sub {
-    color: var(--admin-muted);
-    font-size: 12px;
-  }
-
   /* Publish plan → launch manifest */
   [data-publish-aggregate] .agg-manifest {
     display: block;
@@ -1896,13 +2552,10 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     background: var(--admin-surface-soft);
   }
 
-  /* Openable "Included changes" */
-  .agg-included {
-    border-top: 1px dashed var(--admin-line-strong);
-  }
-  .agg-included[hidden] {
-    display: none;
-  }
+  /* Openable "Included changes" — reused by the Published Versions "What
+     shipped" per-version disclosure (.ver-changes below); the staged-delta
+     table above no longer uses the <details> wrap itself, only the row/diff
+     classes it shares with changeSummaryItem. */
   .agg-included-details > summary {
     list-style: none;
     cursor: pointer;
@@ -1938,14 +2591,6 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     font-size: 11.5px;
     font-weight: 720;
   }
-  .agg-included-hint {
-    color: var(--admin-muted-2);
-    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-    font-size: 11.5px;
-    overflow: hidden;
-    text-overflow: ellipsis;
-    white-space: nowrap;
-  }
   .agg-chev {
     margin-left: auto;
     display: inline-flex;
@@ -2212,12 +2857,12 @@ const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness"
     }
   }
 
-  /* dg7: versions + diff */
+  /* Versions + diff */
   .versions-table {
     min-width: 780px;
   }
 
-  /* rux6: unified review pane */
+  /* Unified review pane */
   .publish-review-cell {
     padding: 12px 14px;
     background: var(--admin-surface-soft);