@tokenoftrust/storefront-runner 1.4.2-rc.0 → 2.0.1

package/apps/storefront/src/lib/publish/adminPublishTab.ts

@@ -9,8 +9,65 @@
  * duplicated (see docs/architecture/decisions/0013-client-island-pattern-and-inline-drift-guard.md).
  */
 import { createKeyedCache, createCoalescer } from "@/lib/publish/panelPolling";
+import {
+  shortSha,
+  shortDigest,
+  age,
+  linesNode,
+  chip,
+  cell,
+  subtle,
+  changeSummaryItem,
+} from "@/lib/publish/publishFormat";
 import { candidatePrUrl } from "@/lib/preview/candidateDashboard";
-import { classifyResolveResponse } from "@/lib/change/resolveConflict";
+import { currentPreviewUrl } from "@/lib/preview/tenantPreview";
+import { classifyResolveResponse } from "@/lib/change/views/resolve-conflict";
+import { mergeHealthBanner } from "@/lib/publish/mergeHealthBanner";
+import { mergeRowFindings, mergeRowKey } from "@/lib/publish/mergeRowFindings";
+import { mergeSupportEscalation } from "@/lib/publish/mergeSupportEscalation";
+// C5 — the doctor PUSH: on a failed accept/integrate or a refused ship, reduce the
+// SAME /api/changes payload to the one-line diagnosis and append it where the failure
+// already surfaced (so the developer doesn't have to go read the banner/chips).
+import { integrateFailureDoctor, shipFailureDoctor } from "@/lib/publish/mergeDoctorOnFailure";
+// Real-time build/check streaming: pure SSE parsing + progress reduction + copy text.
+import {
+  BUILD_STAGES,
+  parseSseChunk,
+  reduceBuildProgress,
+  initialBuildProgress,
+  buildFailureDetail,
+  assembleBuildFailureCopy,
+  type BuildProgress,
+  type BuildResult,
+} from "@/lib/publish/buildStream";
+// The SHARED scrolling live-log console reused across build/integrate/rebuild/ship:
+// pure phase→line formatting + terminal-line extraction (DOM glue verified live).
+import {
+  logLineForPhase,
+  terminalLogLine,
+  type StreamTerminalResult,
+} from "@/lib/publish/streamLogConsole";
+// Fail-visible, never fail-silent: pure state-derivation for the publish lifecycle.
+// classifyIntegrateOutcome derives an integrate attempt's HONEST result from the
+// actual merge/build signals (killing the false "Integration did not land");
+// classifyBuildLink withholds a rev deep-link that would 404 on an unbuilt sha.
+import {
+  classifyIntegrateOutcome,
+  classifyBuildLink,
+  type IntegrateOutcomeView,
+} from "@/lib/publish/lifecycleState";
+// r01 — the SINGLE "next action" hero state machine. Reduces the same
+// /api/changes read (queue count + merge health B1 + escalation B3 + ship plan)
+// into ONE sentence + ONE CTA; folds the two former standalone banners in.
+import { publishHeroState } from "@/lib/publish/publishHero";
+import { computePublishGuard } from "@/lib/publish/publish-guard";
+import { liveReleaseSummaryState } from "@/lib/publish/liveReleaseSummary";
+// r05 — per-store persistence of each collapsible section's open/closed state.
+import {
+  readPersistedOpen,
+  writePersistedOpen,
+  type CollapseSectionId,
+} from "@/lib/publish/collapsePersistence";
 
 export function initAdminPublishTab(): void {
     const root: any = document.getElementById("publish");
@@ -19,25 +76,85 @@ export function initAdminPublishTab(): void {
     const canShip = ds.canShip === "true";
     const repo = ds.repo || "";
     const appDomain = ds.appDomain || "";
+    const publicSiteHost = ds.publicSiteHost || "";
+
+    // r08 — shareable, view-only `?__preview` capability links an owner can hand to
+    // a non-technical stakeholder (no sign-in). The token is minted server-side
+    // (see AdminPublishTab.astro) and rides in on `data-preview-share-token`; empty
+    // when signing isn't configured, in which case the copy affordances stay hidden.
+    // ONE token authorizes both the shared next-release preview and per-candidate
+    // links (it claims the tenant_id both verifiers accept).
+    const previewShareToken = ds.previewShareToken || "";
+    const canonicalDomain = ds.canonicalDomain || "";
+    // The shared preview channel = the next-release aggregate build.
+    const sharedPreviewUrl = (): string | null =>
+      previewShareToken && canonicalDomain
+        ? currentPreviewUrl(window.location.origin, canonicalDomain, previewShareToken)
+        : null;
+    // A single candidate PR's preview (the friendly `/preview/pr/<N>` alias, which
+    // accepts the same tenant-scoped token for a session-less viewer).
+    const candidatePreviewShareUrl = (prNumber?: any): string | null => {
+      if (!previewShareToken || prNumber == null) return null;
+      const path = candidatePrUrl(appDomain, prNumber);
+      return path
+        ? window.location.origin + path + "?__preview=" + encodeURIComponent(previewShareToken)
+        : null;
+    };
+    // Copy `url` and flash a brief "Copied" on the button's label element (icon+text
+    // stays intact — accessible, never color-only). Clipboard denial is silent (the
+    // link is selectable text on failure).
+    const copyPreviewLink = (url: string | null, labelEl?: any, restore = "Copy preview link") => {
+      if (!url || !labelEl) return;
+      navigator.clipboard.writeText(url).then(
+        () => {
+          labelEl.textContent = "Copied";
+          setTimeout(() => { labelEl.textContent = restore; }, 1600);
+        },
+        () => { /* clipboard denied — the link is selectable text */ },
+      );
+    };
+    // Build an inline `#i-copy` icon (matches the SSR sprite-`use` convention).
+    const copyIcon = (): SVGSVGElement => {
+      const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+      const use = document.createElementNS("http://www.w3.org/2000/svg", "use");
+      use.setAttribute("href", "#i-copy");
+      svg.append(use);
+      return svg;
+    };
 
     const statusEl = root.querySelector("[data-publish-status]");
     const queueBody = root.querySelector("[data-publish-queue-body]");
     const queueChip = root.querySelector("[data-publish-queue-chip]");
     const queueCount = root.querySelector("[data-publish-queue-count]");
+    // "See all" closed/rejected history (§ see-all-rejected).
+    const closedPanel = root.querySelector("[data-publish-closed-panel]");
+    const closedBody = root.querySelector("[data-publish-closed-body]");
+    const closedChip = root.querySelector("[data-publish-closed-chip]");
     const degradedStrip = root.querySelector("[data-publish-degraded]");
+    // r01: the SINGLE state hero. Folds in what used to be two standalone banners
+    // — the merge-doctor health summary (B1) and the platform-fault escalation
+    // (B3) — plus the queue count + ship plan, into one sentence + one CTA.
+    // Toggled by renderHero() off the same /api/changes read.
+    const heroEl = root.querySelector("[data-publish-hero]");
+    const heroIconEl = root.querySelector("[data-publish-hero-icon]");
+    const heroKickerEl = root.querySelector("[data-publish-hero-kicker]");
+    const heroHeadlineEl = root.querySelector("[data-publish-hero-headline]");
+    const heroDetailEl = root.querySelector("[data-publish-hero-detail]");
+    const heroCtaEl = root.querySelector("[data-publish-hero-cta]");
+    const heroCtaLinkEl = root.querySelector("[data-publish-hero-cta-link]");
 
     // rux7 — in-flight UI state the auto-refresh poll must preserve across a
     // re-render. These are the AUTHORITATIVE source of truth (never scraped
     // back out of the DOM): an action's async closure holds a reference to the
     // OLD button, so after a poll swaps the row the completion signal lands on a
     // detached node — reading `disabled`/`data-building` off the fresh DOM would
-    // wedge forever. buildPreview/integrate/reject/retire add on start and
+    // wedge forever. buildPreview/integrate/reject add on start and
     // delete in `finally` (before their own loadQueue), so the next render
     // reflects the true busy set. Open diff panes are the exception: the DOM IS
     // their source of truth (toggleDiff owns open/close), so renderQueue detaches
     // and re-attaches the actual pane node — see renderQueue.
     const inflightBuilds = new Set(); // prNumber currently building
-    const busyChanges = new Set(); // changeId with an in-flight integrate/reject/retire
+    const busyChanges = new Set(); // changeId with an in-flight integrate/reject
     let aggregatePublishing = false; // the aggregate Publish POST is in flight
     let aggregateRetrying = false; // u15: the aggregate Retry-build POST is in flight
 
@@ -60,122 +177,153 @@ export function initAdminPublishTab(): void {
       else delete el.dataset.state;
     };
 
-    const shortSha = (sha?: any) => (sha ? String(sha).slice(0, 8) : "—");
-
-    // Build a "+N −M" lines-changed node (added green, removed red) as ONE element,
-    // so a meta "·" separator sits before the pair rather than between the numbers.
-    // Either count may be absent.
-    const linesNode = (added?: any, removed?: any) => {
-      const wrap = document.createElement("span");
-      wrap.className = "agg-lines";
-      if (typeof added === "number") {
-        const a = document.createElement("span");
-        a.className = "agg-add";
-        a.textContent = "+" + added;
-        wrap.append(a);
-      }
-      if (typeof removed === "number") {
-        const d = document.createElement("span");
-        d.className = "agg-del";
-        d.textContent = (typeof added === "number" ? " " : "") + "−" + removed;
-        wrap.append(d);
+    // r12 — a status chip must read as icon + TEXT, never colour alone. The leading
+    // glyph is keyed by tone so every chip across the console speaks one visual
+    // language: ✓ good, ⚠ needs-attention, ✕ failed, • neutral/in-progress.
+    const CHIP_GLYPH: Record<string, string> = {
+      green: "✓",
+      teal: "✓",
+      amber: "⚠",
+      red: "✕",
+      blue: "•",
+      "": "•",
+    };
+    // Repaint an EXISTING chip element (SSR-rendered, re-used across polls) with a
+    // state word + tone + a leading glyph — the in-place analogue of publishFormat's
+    // `chip()` node builder, for the chips that live in the template rather than being
+    // created per render.
+    const paintChip = (el?: any, text?: string, tone?: string, glyph?: string) => {
+      if (!el) return;
+      el.className = "chip" + (tone ? " " + tone : "");
+      el.textContent = "";
+      if (glyph) {
+        const g = document.createElement("span");
+        g.className = "chip-glyph";
+        g.setAttribute("aria-hidden", "true");
+        g.textContent = glyph;
+        el.append(g);
       }
-      return wrap;
+      el.append(document.createTextNode(text ?? ""));
     };
 
+    // C5 — the doctor PUSH (admin side). On a failed accept/integrate or a refused
+    // ship, fetch the freshest /api/changes and, IF the merge-doctor has an opinion on
+    // this failure, append its one-line diagnosis to the failure's own outcome copy —
+    // so the developer sees WHY right where it failed, not only in the top-of-tab
+    // banner / row chips. Best-effort throughout: it never throws and never alters the
+    // action's outcome/status/exit path. `hintFor` runs the SAME pure analyzer the
+    // banner + row chips use (no new endpoint). `sinks` are elements to append to (the
+    // liftoff/shipoff outcome detail — stable, unlike statusEl which loadQueue rewrites).
+    const appendDoctorText = (el?: any, text?: string) => {
+      if (!el || !text) return;
+      const base = (el.textContent || "").trim();
+      el.textContent = base ? base + "  " + text : text;
+    };
+    const surfaceDoctorHint = (
+      hintFor: (payload: any) => { show: boolean; text: string },
+      sinks: any[],
+    ) => {
+      void (async () => {
+        try {
+          const res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
+          if (!res.ok) return;
+          const hint = hintFor(await res.json());
+          if (!hint.show) return;
+          for (const el of sinks) appendDoctorText(el, hint.text);
+        } catch { /* best-effort — the failure's own copy already stands */ }
+      })();
+    };
 
-    const age = (iso?: any) => {
-      if (!iso) return "—";
-      const ms = Date.now() - new Date(iso).getTime();
-      if (!Number.isFinite(ms) || ms < 0) return "—";
-      const mins = Math.floor(ms / 60000);
-      if (mins < 1) return "just now";
-      if (mins < 60) return mins + "m ago";
-      const hours = Math.floor(mins / 60);
-      if (hours < 48) return hours + "h ago";
-      return Math.floor(hours / 24) + "d ago";
+    // ── The SHARED scrolling live-log console ─────────────────────────────────
+    // ONE "CI build log" panel, reused across all four long-running flows
+    // (build/integrate/rebuild/ship). `makeLogConsole` binds it to a scrollable
+    // `<div data-*-log>`; `reset()` clears + stamps the clock start, `pushEvent`
+    // appends one timestamped human line per server `phase` event (auto-scrolled
+    // to the bottom), and `finish` appends the terminal ✓/✗ line. Pure formatting
+    // lives in the tested streamLogConsole.ts; this is the DOM glue only.
+    const makeLogConsole = (logEl?: any) => {
+      let startedAt = Date.now();
+      const append = (line?: string | null) => {
+        if (!logEl || !line) return;
+        const div = document.createElement("div");
+        div.className = "stream-log-line";
+        div.textContent = line;
+        logEl.appendChild(div);
+        logEl.scrollTop = logEl.scrollHeight; // keep the newest line in view
+      };
+      return {
+        reset() {
+          startedAt = Date.now();
+          if (logEl) logEl.textContent = "";
+        },
+        pushEvent(ev: { event: string; data: string }) {
+          append(logLineForPhase(ev, Date.now() - startedAt));
+        },
+        finish(result: StreamTerminalResult) {
+          append(terminalLogLine(result, Date.now() - startedAt).line);
+        },
+      };
+    };
+    type LogConsole = ReturnType<typeof makeLogConsole>;
+
+    // Consume a streamed (SSE) or buffered (JSON) response uniformly. In stream
+    // mode each `phase` event feeds the shared log console + the optional `onPhase`
+    // (a flow's own stage-rail), and the terminal `result` event's payload is
+    // returned; in JSON mode (a buffering proxy, or a non-streaming server) the whole
+    // body is read once and treated as that terminal payload — so every flow completes
+    // honestly either way. Never throws for a well-formed response; the caller keeps
+    // its own try/catch for network faults. `res.ok`/`res.status` stay authoritative
+    // for the caller (a stream is always HTTP 200; the route front-loads its non-2xx
+    // auth/validation refusals as plain JSON BEFORE any stream).
+    const streamWithLog = async (
+      res: any,
+      logc?: LogConsole | null,
+      onPhase?: (ev: { event: string; data: string }) => void,
+    ): Promise<{ data: any }> => {
+      const ct = res.headers.get("content-type") || "";
+      if (res.body && ct.indexOf("text/event-stream") !== -1) {
+        const reader = res.body.getReader();
+        const decoder = new TextDecoder();
+        let buf = "";
+        let terminal: any = undefined;
+        for (;;) {
+          const { value, done } = await reader.read();
+          if (done) break;
+          buf += decoder.decode(value, { stream: true });
+          const parsed = parseSseChunk(buf);
+          buf = parsed.rest;
+          for (const ev of parsed.events) {
+            if (ev.event === "phase") {
+              if (logc) logc.pushEvent(ev);
+              if (onPhase) onPhase(ev);
+            } else if (ev.event === "result") {
+              try { terminal = JSON.parse(ev.data); } catch { terminal = {}; }
+              if (logc) logc.finish(terminal);
+            }
+          }
+        }
+        return { data: terminal ?? {} };
+      }
+      const data = await res.json().catch(() => ({}));
+      if (logc) logc.finish(data);
+      return { data };
     };
 
+
     const STATUS_CHIP: Record<string, string> = {
       queued: "",
       reconciling: "blue",
       ready: "green",
       blocked: "red",
     };
-
-    const chip = (text?: any, tone?: any) => {
-      const el = document.createElement("span");
-      el.className = "chip" + (tone ? " " + tone : "");
-      el.textContent = text;
-      return el;
-    };
-
-    const cell = (...children: any[]) => {
-      const td = document.createElement("td");
-      for (const child of children) {
-        if (child == null) continue;
-        td.append(typeof child === "string" ? document.createTextNode(child) : child);
-      }
-      return td;
-    };
-
-    const subtle = (text?: any) => {
-      const el = document.createElement("span");
-      el.className = "subtle";
-      el.textContent = text;
-      return el;
-    };
-
-    // One included-change line item (PR # + human title, a one-line description of
-    // what it does, and meta: sha / files / lines). Shared by the aggregate plan's
-    // "Included changes" and the published-versions "what shipped" list, so both
-    // read the same way. Every enrichment field is optional — a row degrades to
-    // just "PR #N · <sha>" when candidate_summary didn't cover it.
-    const changeSummaryItem = (ch?: any) => {
-      const li = document.createElement("li");
-      li.className = "agg-included-item";
-
-      const top = document.createElement("div");
-      top.className = "agg-included-top";
-      const prEl = document.createElement("span");
-      prEl.className = "agg-included-pr";
-      prEl.textContent = ch.prNumber != null ? "PR #" + ch.prNumber : ch.changeId;
-      top.append(prEl);
-      if (ch.title) {
-        const t = document.createElement("span");
-        t.className = "agg-included-title";
-        t.textContent = ch.title;
-        top.append(t);
-      }
-      li.append(top);
-
-      const description = ch.description || ch.summary;
-      if (description) {
-        const desc = document.createElement("p");
-        desc.className = "agg-included-desc";
-        desc.textContent = description;
-        li.append(desc);
-      }
-
-      const meta = document.createElement("div");
-      meta.className = "agg-included-meta";
-      if (ch.headSha) {
-        const sha = document.createElement("span");
-        sha.className = "publish-mono sha-token";
-        sha.textContent = shortSha(ch.headSha);
-        meta.append(sha);
-      }
-      const fileCount = ch.fileCount != null ? ch.fileCount : ch.filesChanged;
-      if (fileCount != null) {
-        const f = document.createElement("span");
-        f.textContent = fileCount + (fileCount === 1 ? " file" : " files");
-        meta.append(f);
-      }
-      if (typeof ch.linesAdded === "number" || typeof ch.linesRemoved === "number") {
-        meta.append(linesNode(ch.linesAdded, ch.linesRemoved));
-      }
-      if (meta.childNodes.length) li.append(meta);
-      return li;
+    // r04 — humanize the raw candidate-status word for the queue chip. The raw
+    // status still drives all logic; only the displayed label is merchant-facing
+    // (dev words like "reconciling" never reach the operator).
+    const STATUS_LABEL: Record<string, string> = {
+      queued: "Waiting",
+      reconciling: "Checking",
+      ready: "Ready",
+      blocked: "Needs attention",
     };
 
     // ---- ?pr=N deep link ---------------------------------------------------
@@ -225,23 +373,179 @@ export function initAdminPublishTab(): void {
 
     // ---- Open change queue -------------------------------------------------
 
+    // r01: the SINGLE state hero. Computed from the SAME /api/changes payload the
+    // queue + aggregate already have — no duplicate read. It folds in the merge-
+    // doctor health summary (B1, mergeHealthBanner) and the platform-fault
+    // escalation (B3, mergeSupportEscalation), plus the queue count and ship plan,
+    // and expresses whichever is the most urgent true state as one sentence + one
+    // CTA (publishHeroState orders the precedence). There is no separate B1/B3
+    // banner any more — a conflict/platform blocker turns THIS element red/urgent.
+    const HERO_ICON: Record<string, string> = {
+      blocker: "#i-alert",
+      warn: "#i-alert",
+      attention: "#i-box",
+      ready: "#i-export",
+      calm: "#i-check",
+    };
+    const scrollToPanel = (sel: string) => {
+      const el = document.getElementById(sel);
+      if (el) el.scrollIntoView({ block: "start", behavior: "smooth" });
+    };
+    const renderHero = (data?: any) => {
+      if (!heroEl) return;
+      const payload = data || {};
+      const changes = Array.isArray(payload.changes) ? payload.changes : [];
+      const agg = payload.aggregate || null;
+      const stagedSha = agg && agg.aggregateSha;
+      const liveId = payload.current && payload.current.versionId;
+      const view = publishHeroState({
+        changeCount: changes.length,
+        health: mergeHealthBanner(payload),
+        escalation: mergeSupportEscalation(payload),
+        plan: payload.plan || null,
+        aheadCount: (agg && agg.includedPrs ? agg.includedPrs.length : 0),
+        matchesLive: Boolean(stagedSha && liveId && stagedSha === liveId),
+        canShip,
+        publicSiteHost,
+      });
+
+      (heroEl as any).dataset.tone = view.tone;
+      if (heroIconEl) {
+        const use = heroIconEl.querySelector("use");
+        if (use) use.setAttribute("href", HERO_ICON[view.tone] || "#i-check");
+      }
+      if (heroKickerEl) (heroKickerEl as any).hidden = !view.urgent;
+      if (heroHeadlineEl) heroHeadlineEl.textContent = view.headline;
+      if (heroDetailEl) heroDetailEl.textContent = view.detail;
+
+      // ONE CTA: a mailto link for the "report to support" escalation, a button
+      // for every in-page action, nothing for the calm caught-up state.
+      const cta = view.cta;
+      if (cta.kind === "report-support") {
+        if (heroCtaEl) (heroCtaEl as any).hidden = true;
+        if (heroCtaLinkEl) {
+          heroCtaLinkEl.textContent = cta.label;
+          if (cta.href) heroCtaLinkEl.setAttribute("href", cta.href);
+          (heroCtaLinkEl as any).hidden = false;
+        }
+      } else {
+        if (heroCtaLinkEl) (heroCtaLinkEl as any).hidden = true;
+        if (heroCtaEl) {
+          if (cta.kind === "none") {
+            (heroCtaEl as any).hidden = true;
+            (heroCtaEl as any).onclick = null;
+          } else {
+            heroCtaEl.textContent = cta.label;
+            (heroCtaEl as any).hidden = false;
+            (heroCtaEl as any).onclick = () => {
+              if (cta.kind === "publish") publishAggregate(heroCtaEl);
+              else if (cta.kind === "review-queue") scrollToPanel("publish-queue");
+              else if (cta.kind === "goto-release") scrollToPanel("publish-next-release");
+            };
+          }
+        }
+      }
+      (heroEl as any).hidden = false;
+    };
+
+    // B2: per-row merge-doctor finding. Reads THIS row's dominant finding out of
+    // the map computed once per render (mergeRowFindings over the same payload the
+    // queue already holds — no extra fetch, no per-row analysis) and renders its
+    // ownership tag as a chip. When the finding carries an action it LIGHTS UP the
+    // row's EXISTING mapped button (resolve → the conflict-recovery button, build/
+    // retry → the build button) via a "primed" class + the remedy as its tooltip —
+    // it does NOT re-declare the API call. A finding with no inline button to prime
+    // (e.g. a promotable-yet-stalled platform retry) gets a fallback CTA that still
+    // calls the SAME existing action function. An informational finding (action:
+    // null) shows the chip only; a healthy row has no finding, so no chip.
+    const rowFindingFor = (findings: any, change: any) => {
+      const byChange =
+        change.changeId != null ? findings.get(mergeRowKey(change.changeId, null)) : undefined;
+      return (
+        byChange ||
+        (change.prNumber != null ? findings.get(mergeRowKey(null, change.prNumber)) : undefined)
+      );
+    };
+
+    const applyRowFinding = (actionsCell: any, change: any, findings: any, buttons: any = {}) => {
+      const finding = rowFindingFor(findings, change);
+      if (!finding) return;
+      const tag = chip(finding.ownershipLabel, finding.tone);
+      tag.classList.add("publish-finding-chip");
+      tag.title = finding.detail;
+      actionsCell.prepend(tag);
+      if (!finding.cta) return; // informational-only diagnosis — chip, no button
+      const mapped = finding.cta.kind === "resolve" ? buttons.resolve : buttons.build;
+      if (mapped) {
+        mapped.classList.add("publish-cta-primed");
+        mapped.title = finding.remedy;
+        return;
+      }
+      // No inline button maps to this finding — add a CTA that reuses the SAME
+      // existing action function (never a re-declared fetch). Only when the viewer
+      // can actually ship; otherwise the chip alone diagnoses it (the row already
+      // carries a sign-in hint), never a dead disabled duplicate.
+      if (!canShip) return;
+      const cta = document.createElement("button");
+      cta.type = "button";
+      cta.className = "btn publish-cta-primed";
+      cta.textContent = finding.cta.label;
+      cta.title = finding.remedy;
+      cta.addEventListener("click", () =>
+        finding.cta.kind === "resolve"
+          ? openConflictRecovery(change, cta)
+          : buildPreview(change, cta),
+      );
+      actionsCell.append(cta);
+    };
+
     const renderQueue = (payload?: any) => {
       const changes = Array.isArray(payload.changes) ? payload.changes : [];
+      const rowFindings = mergeRowFindings(payload);
+      // Ledger truth (fb-1787916141762-owjzis): which changes are ALREADY integrated
+      // into the staged aggregate, read straight from aggregate.includedPrs (the
+      // ledger), DECOUPLED from any per-row mergeable/rebuild signal. A change in
+      // this set has merged; its row must never offer conflict-recovery (which would
+      // try to refresh an already-merged candidate and error "No open candidate").
+      const stagedChangeIds = new Set<string>();
+      const stagedPrNumbers = new Set<number>();
+      for (const p of (payload.aggregate && payload.aggregate.includedPrs) || []) {
+        if (p && typeof p.changeId === "string") stagedChangeIds.add(p.changeId);
+        if (p && typeof p.prNumber === "number") stagedPrNumbers.add(p.prNumber);
+      }
+      const isIntegrated = (change: any) =>
+        stagedChangeIds.has(change.changeId) ||
+        (change.prNumber != null && stagedPrNumbers.has(change.prNumber));
+      // A change already staged into the next release has, by that act, been
+      // APPROVED — this panel asks "What needs your approval?", so it must not list
+      // it. It reappears here only if it's pulled back out of the next release (the
+      // "Next release" panel below owns that Undo/revert). So the review queue shows
+      // only changes NOT yet in the aggregate; the integrated ones live in "Next
+      // release". (Full `changes` is still used for the top "Open changes" metric,
+      // which counts everything waiting for review OR go-live.)
+      const pending = changes.filter((change: any) => !isIntegrated(change));
       // rux1: surface a forge-listing failure as a visible strip — never let a
       // degraded (short) list read as a genuine empty queue.
       if (degradedStrip) degradedStrip.hidden = payload.degraded !== true;
       queueBody.textContent = "";
       if (queueCount) queueCount.textContent = String(changes.length);
       if (queueChip) {
-        queueChip.textContent = changes.length === 1 ? "1 open" : changes.length + " open";
-        queueChip.className = "chip" + (changes.length ? " blue" : "");
+        queueChip.textContent = pending.length === 1 ? "1 open" : pending.length + " open";
+        queueChip.className = "chip" + (pending.length ? " blue" : "");
       }
 
-      if (!changes.length) {
+      if (!pending.length) {
         const tr = document.createElement("tr");
+        // Distinguish "nothing here at all" from "everything open is already added" —
+        // the latter is the common state once a merchant has staged their changes, and
+        // "No changes waiting" would read as if their work vanished.
         const td = cell(
           subtle(
-            "No open changes. New store changes appear here when a developer submits them for review.",
+            changes.length
+              ? "Nothing waiting for your approval — every open change is already in your next " +
+                  "release (see below). Pull one back out there if you want to review it again."
+              : "No changes waiting. Make an edit in your store and submit it — it'll show up here to " +
+                  "review and add to your next release.",
           ),
         );
         td.colSpan = 6;
@@ -250,7 +554,7 @@ export function initAdminPublishTab(): void {
         return;
       }
 
-      for (const change of changes) {
+      for (const change of pending) {
         const tr = document.createElement("tr");
         if (change.prNumber != null) tr.dataset.prNumber = String(change.prNumber);
 
@@ -263,13 +567,17 @@ export function initAdminPublishTab(): void {
         if (change.branch) meta.push(change.branch);
         if (change.prNumber != null) meta.push("PR #" + change.prNumber);
         if (meta.length) idCell.append(subtle(meta.join(" · ")));
-        // Owner-facing "who did this" — accept takes priority over build (a
+        // Owner-facing "who did this" — accept takes priority over submit/build (a
         // candidate that's been accepted-to-preview is more meaningfully
-        // "acted on" than merely built). Reject never shows here: a rejected
+        // "acted on" than merely submitted or built). Reject never shows here: a rejected
         // candidate is closed and has already left the open queue.
-        const actorRecord = change.actors && (change.actors.accept || change.actors.build);
+        const actorRecord = change.actors && (change.actors.accept || change.actors.submit || change.actors.build);
         if (actorRecord) {
-          const label = change.actors.accept ? "Accepted by " : "Built by ";
+          const label = change.actors.accept
+            ? "Added by "
+            : change.actors.submit
+              ? "Submitted by "
+              : "Built by ";
           idCell.append(subtle(label + (actorRecord.name || actorRecord.email)));
         }
         // Prefer the synthesized friendly per-PR route (handles every state);
@@ -287,6 +595,23 @@ export function initAdminPublishTab(): void {
           wrap.append(preview);
           idCell.append(wrap);
         }
+        // r08: copy a shareable, view-only preview link for THIS candidate to hand
+        // to a non-technical stakeholder (no sign-in). Shown only when a share token
+        // was minted and the row has a PR number to point at.
+        const candidateShareUrl = candidatePreviewShareUrl(change.prNumber);
+        if (candidateShareUrl) {
+          const copyBtn = document.createElement("button");
+          copyBtn.type = "button";
+          copyBtn.className = "btn btn-compact publish-copy-preview";
+          const lbl = document.createElement("span");
+          lbl.textContent = "Copy preview link";
+          copyBtn.append(copyIcon(), lbl);
+          copyBtn.addEventListener("click", () => copyPreviewLink(candidateShareUrl, lbl));
+          const copyWrap = document.createElement("span");
+          copyWrap.className = "subtle";
+          copyWrap.append(copyBtn);
+          idCell.append(copyWrap);
+        }
         tr.append(idCell);
 
         // Reconcile status. u13 DISPLAY HONESTY: when the server could not confirm
@@ -296,12 +621,16 @@ export function initAdminPublishTab(): void {
         // as current fact; keep the last-known label as a subtle, clearly-hedged note.
         let statusCell;
         if (change.liveStateConfirmed === false) {
-          statusCell = cell(chip("State unknown", "amber"));
+          statusCell = cell(chip("State unknown", "amber", CHIP_GLYPH.amber));
           statusCell.append(
-            subtle("Forge unreachable — last known: " + (change.status || "unknown")),
+            subtle("Status couldn't be confirmed — last known: " +
+              (STATUS_LABEL[change.status] || change.status || "unknown")),
           );
         } else {
-          statusCell = cell(chip(change.status || "unknown", STATUS_CHIP[change.status] ?? "amber"));
+          const tone = STATUS_CHIP[change.status] ?? "amber";
+          statusCell = cell(
+            chip(STATUS_LABEL[change.status] || change.status || "unknown", tone, CHIP_GLYPH[tone]),
+          );
           if (change.lastError) statusCell.append(subtle(change.lastError));
         }
         tr.append(statusCell);
@@ -311,7 +640,9 @@ export function initAdminPublishTab(): void {
         const failing = checks.filter((c: any) => c.status === "fail");
         const promotable = Boolean(change.evidence && change.evidence.promotable);
         const checksCell = cell(
-          promotable ? chip("Checks passed", "green") : chip("Checks blocked", "amber"),
+          promotable
+          ? chip("Checks passed", "green", CHIP_GLYPH.green)
+          : chip("Checks blocked", "amber", CHIP_GLYPH.amber),
         );
         if (failing.length) {
           checksCell.append(subtle("Failing: " + failing.map((c: any) => c.label || c.id).join(", ")));
@@ -330,14 +661,12 @@ export function initAdminPublishTab(): void {
         const actions = document.createElement("td");
         actions.className = "action publish-actions";
 
-        // rux5 — a synthetic not-built forge PR row (built:false / status
-        // "not-built") has NO built candidate: changeId is null, so the built-only
-        // actions below (Diff/Accept/Reject/Retire, all keyed on changeId) do not
-        // apply. Its one action is Build preview — materialize the PR's hosted
-        // preview on demand. Capability-gated: the button is SHOWN only to a
-        // ship-capable operator, and the server (buildGate) re-authorizes — the UI
-        // check is UX, not the real gate.
+        // A synthetic not-built forge PR can be reviewed at the lifecycle level
+        // without paying to materialize it. Candidate-shaped branches carry a
+        // derived changeId, so the operator may Reject immediately; Build preview
+        // remains available when visual review is useful.
         if (change.built === false || change.status === "not-built") {
+          let notBuiltBuild: any;
           if (canShip) {
             const build = document.createElement("button");
             build.type = "button";
@@ -356,24 +685,47 @@ export function initAdminPublishTab(): void {
             }
             build.addEventListener("click", () => buildPreview(change, build));
             actions.append(build);
+            notBuiltBuild = build;
+            if (change.changeId) {
+              const reject = document.createElement("button");
+              reject.type = "button";
+              reject.className = "btn";
+              reject.textContent = "Reject";
+              reject.disabled = busyChanges.has(change.changeId);
+              reject.title = "Close this change without building or publishing it";
+              reject.addEventListener("click", () => rejectChange(change, reject));
+              actions.append(reject);
+            }
           } else {
-            actions.append(subtle("Owner/admin sign-in required to build"));
+            actions.append(subtle("Owner/admin sign-in required to build or reject"));
           }
+          applyRowFinding(actions, change, rowFindings, { build: notBuiltBuild });
           tr.append(actions);
           queueBody.append(tr);
           continue;
         }
 
-        // rux7: while an integrate/reject/retire for this change is in flight,
+        // rux7: while an integrate/reject for this change is in flight,
         // keep its mutating actions disabled across a poll re-render so the
         // operator can't double-submit against a freshly-minted button.
         const changeBusy = busyChanges.has(change.changeId);
 
+        // A candidate that is still waiting for its reconciliation/evidence — or
+        // whose build FAILED (blocked) — has never become eligible for Accept. A
+        // disabled "Accept to preview" is a dead CTA; the safe recovery already
+        // exists at POST /api/preview/build, so make it the primary action: it
+        // re-materializes this exact PR head and re-runs its checks (does not merge
+        // or publish). `blocked` is included so a build-failed candidate keeps a
+        // live "Rebuild" nudge and never sits on a dead end (fail-visible, rule 3).
+        const buildFailed = change.status === "blocked";
+        const needsChecks = !promotable &&
+          (change.status === "queued" || change.status === "reconciling" || buildFailed);
+
         // rux6 Review: expand the row into a single "review moment" pane —
         // preview iframe + evidence chips + diff + Accept/Reject — so a reviewer
         // never leaves the queue. Supersedes the standalone Diff button (the dg7
         // diff now lives inside the pane, reusing renderDiff). The row's own
-        // Accept/Reject/Retire buttons below are unchanged.
+        // Accept/Reject buttons below are unchanged.
         const reviewBtn = document.createElement("button");
         reviewBtn.type = "button";
         reviewBtn.className = "btn";
@@ -382,6 +734,26 @@ export function initAdminPublishTab(): void {
         reviewBtn.title = "Open one pane to preview, diff, and act on this change";
         reviewBtn.addEventListener("click", () => toggleReview(change, reviewBtn, tr));
         actions.append(reviewBtn);
+        let runChecksBuild: any;
+        if (needsChecks) {
+          const build = document.createElement("button");
+          build.type = "button";
+          build.className = "btn primary";
+          build.title = buildFailed
+            ? "This change's preview build failed — rebuild it (re-materializes this PR head and re-runs checks; does not merge or go live)"
+            : "Re-run this PR's preview build and checks (does not merge or go live)";
+          if (change.prNumber != null && inflightBuilds.has(change.prNumber)) {
+            build.textContent = buildFailed ? "Rebuilding…" : "Running checks…";
+            build.disabled = true;
+            build.dataset.building = "true";
+          } else {
+            build.textContent = buildFailed ? "Rebuild" : "Run checks";
+            build.disabled = !canShip || changeBusy;
+          }
+          build.addEventListener("click", () => buildPreview(change, build));
+          actions.append(build);
+          runChecksBuild = build;
+        }
         // b11 SPLIT: the candidate-queue primary action is now ACCEPT TO PREVIEW
         // (b08 integrate = advance the shared preview aggregate), NOT go-live.
         // Integrate flips NO live channel, so it has NO paywall (entitled) gate —
@@ -396,21 +768,37 @@ export function initAdminPublishTab(): void {
         // than presenting a generic, disabled "not ready" action. Other false
         // mergeability states remain disabled: a rebuild cannot fix an incomplete
         // reconcile or failed evidence.
+        // A change already in the staged aggregate has integrated — its stored
+        // `mergeable` can read false once the forge settles the just-merged PR
+        // against the tip, but that is NOT a conflict to recover. Read integration
+        // truth from the ledger and never route it to recovery.
+        const alreadyIntegrated = isIntegrated(change);
         const needsPreviewUpdate =
-          change.status === "ready" && promotable && change.mergeable === false;
-        accept.textContent = needsPreviewUpdate ? "Update change" : "Accept to preview";
-        accept.disabled = !canShip || (!needsPreviewUpdate && !change.mergeable) || changeBusy;
-        accept.title = !canShip
-          ? "Requires a ship-on-behalf grant on your account — ask the store owner"
-          : needsPreviewUpdate
-            ? "Preview changed while you worked — update this change, then integrate it"
-            : !change.mergeable
-              ? "This change is not ready to integrate"
-              : "Integrate this change into the preview aggregate (does not go live)";
-        accept.addEventListener("click", () =>
-          needsPreviewUpdate ? openConflictRecovery(change, accept) : integrateCandidate(change, accept),
-        );
-        actions.append(accept);
+          !alreadyIntegrated && change.status === "ready" && promotable && change.mergeable === false;
+        // Only ONE primary action at a time: while checks are pending, "Run checks"
+        // above is the whole story — a second disabled "Run checks first" button
+        // next to it said nothing new and just looked broken.
+        if (!needsChecks) {
+          if (alreadyIntegrated) {
+            accept.textContent = "Already added";
+            accept.disabled = true;
+            accept.title = "This change is already in your next release.";
+          } else {
+            accept.textContent = needsPreviewUpdate ? "Update change" : "Add to release";
+            accept.disabled = !canShip || (!needsPreviewUpdate && !change.mergeable) || changeBusy;
+            accept.title = !canShip
+              ? "Requires a ship-on-behalf grant on your account — ask the store owner"
+              : needsPreviewUpdate
+                ? "Preview changed while you worked — update this change, then add it"
+                : !change.mergeable
+                  ? "This change isn't ready to add yet"
+                  : "Add this change to your next release (doesn't go live yet)";
+            accept.addEventListener("click", () =>
+              needsPreviewUpdate ? openConflictRecovery(change, accept) : integrateCandidate(change, accept),
+            );
+          }
+          actions.append(accept);
+        }
         const reject = document.createElement("button");
         reject.type = "button";
         reject.className = "btn";
@@ -421,21 +809,13 @@ export function initAdminPublishTab(): void {
           : "Requires a ship-on-behalf grant on your account — ask the store owner";
         reject.addEventListener("click", () => rejectChange(change, reject));
         actions.append(reject);
-
-        // U7 Retire/GC: evict this candidate's preview environment + version to
-        // reclaim space. DISTINCT from Reject — retire is reversible-by-rebuild
-        // (U1 build-on-demand + the U2 fallback page rematerialize it), so a
-        // retired PR degrades to "not built yet", not a dead 404.
-        const retire = document.createElement("button");
-        retire.type = "button";
-        retire.className = "btn";
-        retire.textContent = "Retire";
-        retire.disabled = !canShip || changeBusy;
-        retire.title = canShip
-          ? "Evict this preview to reclaim space — rebuildable on demand (not the same as Reject)"
-          : "Requires an owner or admin sign-in";
-        retire.addEventListener("click", () => retireChange(change, retire));
-        actions.append(retire);
+        // B2: light up this row's mapped button — the build button when the row's
+        // finding is a build/retry, the conflict-recovery "Update change" accept
+        // button when it's a resolve.
+        applyRowFinding(actions, change, rowFindings, {
+          build: runChecksBuild,
+          resolve: needsPreviewUpdate ? accept : undefined,
+        });
         tr.append(actions);
 
         queueBody.append(tr);
@@ -443,13 +823,86 @@ export function initAdminPublishTab(): void {
       }
     };
 
+    // "See all" closed/rejected history. A rejected change leaves the open queue
+    // (server filters terminal status out of `changes`); the server now also returns
+    // the closed ones as `closedChanges` so a reject is recoverable-from-history
+    // rather than a black hole. Read-only: id + who-closed-it + a still-reachable
+    // preview link. The whole panel is HIDDEN when there are none (no empty chrome).
+    const renderClosed = (payload?: any) => {
+      if (!closedBody || !closedPanel) return;
+      const closed = Array.isArray(payload && payload.closedChanges) ? payload.closedChanges : [];
+      closedBody.textContent = "";
+      if (closedChip) closedChip.textContent = String(closed.length);
+      closedPanel.hidden = closed.length === 0;
+      if (!closed.length) return;
+
+      for (const change of closed) {
+        const tr = document.createElement("tr");
+        if (change.prNumber != null) tr.dataset.prNumber = String(change.prNumber);
+
+        // Change id + branch/PR + who closed it + a still-reachable preview link.
+        const idCell = document.createElement("td");
+        const idStrong = document.createElement("strong");
+        idStrong.textContent = change.changeId || "—";
+        idCell.append(idStrong);
+        const meta = [];
+        if (change.branch) meta.push(change.branch);
+        if (change.prNumber != null) meta.push("PR #" + change.prNumber);
+        if (meta.length) idCell.append(subtle(meta.join(" · ")));
+        // "Closed by" — the reject actor when known (fall back to the last actor
+        // who touched it, so the row is never anonymous when we have any attribution).
+        const closer = change.actors && (change.actors.reject || change.actors.accept || change.actors.build);
+        if (closer) idCell.append(subtle("Closed by " + (closer.name || closer.email)));
+        const previewUrl = candidatePrUrl(appDomain, change.prNumber) || change.previewUrl;
+        if (previewUrl) {
+          const preview = document.createElement("a");
+          preview.href = previewUrl;
+          preview.target = "_blank";
+          preview.rel = "noopener";
+          preview.textContent = "Open preview";
+          const wrap = document.createElement("span");
+          wrap.className = "subtle";
+          wrap.append(preview);
+          idCell.append(wrap);
+        }
+        tr.append(idCell);
+
+        // Closed (relative time of the last projection update = when it was closed).
+        tr.append(cell(age(change.updatedAt)));
+
+        // Head sha.
+        const headCell = cell(shortSha(change.headSha));
+        headCell.classList.add("publish-mono");
+        tr.append(headCell);
+
+        closedBody.append(tr);
+      }
+    };
+
     const renderCurrent = (current?: any, shippedBy?: any) => {
-      const versionEl = root.querySelector("[data-publish-live-version]");
+      // r02: the "Live version" metric is a HUMAN label — "v42" linked to the live
+      // store — not a raw SHA. The SHA is demoted to a "Technical details"
+      // disclosure. The counter (current.versionNumber) is derived from the
+      // promotion history server-side; a version with no number (unpromoted seed)
+      // falls back to its short SHA rather than fabricating one.
+      const linkEl = root.querySelector("[data-publish-live-version-link]");
+      const noneEl = root.querySelector("[data-publish-live-version-none]");
+      const techEl = root.querySelector("[data-publish-live-tech]");
+      const shaEl = root.querySelector("[data-publish-live-sha]");
       const sourceEl = root.querySelector("[data-publish-live-source]");
       const atEl = root.querySelector("[data-publish-live-at]");
       const shippedByEl = root.querySelector("[data-publish-live-shipped-by]");
       if (current && current.versionId) {
-        if (versionEl) versionEl.textContent = shortSha(current.versionId);
+        const label =
+          current.versionNumber != null ? "v" + current.versionNumber : shortSha(current.versionId);
+        if (linkEl) {
+          linkEl.textContent = label;
+          linkEl.setAttribute("href", ds.liveHref || "/");
+          (linkEl as any).hidden = false;
+        }
+        if (noneEl) (noneEl as any).hidden = true;
+        if (shaEl) shaEl.textContent = shortSha(current.versionId);
+        if (techEl) (techEl as any).hidden = false;
         if (sourceEl) {
           sourceEl.textContent =
             (current.source === "commit" ? "Published from a change" : "Published version") +
@@ -463,7 +916,13 @@ export function initAdminPublishTab(): void {
           shippedByEl.textContent = shippedBy ? "Shipped by " + (shippedBy.name || shippedBy.email) : "";
         }
       } else {
-        if (versionEl) versionEl.textContent = "Not live yet";
+        if (linkEl) (linkEl as any).hidden = true;
+        if (noneEl) {
+          noneEl.textContent = "Not live yet";
+          (noneEl as any).hidden = false;
+        }
+        if (techEl) (techEl as any).hidden = true;
+        if (shaEl) shaEl.textContent = "—";
         if (sourceEl) sourceEl.textContent = "Nothing has been published for this store";
         if (atEl) atEl.textContent = "—";
         if (shippedByEl) shippedByEl.textContent = "";
@@ -505,6 +964,11 @@ export function initAdminPublishTab(): void {
         c.mergeable,
         c.built,
         c.lastError || null,
+        c.title || null,
+        c.description || null,
+        c.intent || null,
+        c.verification || null,
+        c.riskRollback || null,
         !!(c.evidence && c.evidence.promotable),
         c.actors ? Object.keys(c.actors).sort().join(",") : "",
       ]);
@@ -569,8 +1033,10 @@ export function initAdminPublishTab(): void {
       lastChangesSignature = sig;
       renderCurrent(data.current, data.shippedBy);
       renderQueue(data);
+      renderClosed(data);
       applyPrDeeplink();
       renderAggregate(data);
+      renderHero(data);
       return "changed";
     };
 
@@ -611,6 +1077,7 @@ export function initAdminPublishTab(): void {
         if (res.status === 401 || res.status === 403) {
           if (queueChip) queueChip.textContent = "Sign-in required";
           if (degradedStrip) degradedStrip.hidden = true;
+          if (heroEl) (heroEl as any).hidden = true;
           queueBody.textContent = "";
           const tr = document.createElement("tr");
           const td = cell(subtle("Sign in as a store owner or admin to view the publish queue."));
@@ -626,8 +1093,10 @@ export function initAdminPublishTab(): void {
         }
         renderCurrent(data.current, data.shippedBy);
         renderQueue(data);
+        renderClosed(data);
         applyPrDeeplink();
         renderAggregate(data);
+        renderHero(data);
         // rux7: this is fresh authoritative data — resync the poll clock so the
         // next tick dedupes against it, and reset the cadence to responsive
         // (a manual refresh / a just-completed action likely means more coming).
@@ -659,6 +1128,16 @@ export function initAdminPublishTab(): void {
       red: "red",
       shipped: "green",
     };
+    // r04 — the Next-release chip in merchant words; the raw queueState still drives
+    // logic, only the label is humanized (no "integrating"/"green"/"red" jargon).
+    const AGG_STATE_LABEL: Record<string, string> = {
+      empty: "No changes yet",
+      queued: "Waiting",
+      integrating: "Building…",
+      green: "Ready to publish",
+      red: "Needs attention",
+      shipped: "Published",
+    };
     // The plan we last rendered — the exact-digest guard the Publish POST sends
     // back so a stale plan (queue moved / artifact changed) is refused, never
     // shipped blind.
@@ -748,15 +1227,74 @@ export function initAdminPublishTab(): void {
       if (retryRow) retryRow.hidden = state !== "red";
       if (retryBtn) retryBtn.disabled = aggregateRetrying;
       if (chipEl) {
-        chipEl.textContent = state;
-        chipEl.className = "chip " + (AGG_STATE_CHIP[state] || "");
+        const tone = AGG_STATE_CHIP[state] || "";
+        paintChip(chipEl, AGG_STATE_LABEL[state] || state, tone, CHIP_GLYPH[tone]);
+      }
+      // r11 — the human release name (aggregate.name), shown beside "Next release".
+      // Display-only: absent/null → hidden, and the section header reads as before.
+      const nameEl = aggPanel.querySelector("[data-aggregate-name]");
+      if (nameEl) {
+        const releaseName = agg && agg.name;
+        if (releaseName) {
+          nameEl.textContent = releaseName;
+          (nameEl as any).hidden = false;
+        } else {
+          nameEl.textContent = "";
+          (nameEl as any).hidden = true;
+        }
       }
       if (shaEl) shaEl.textContent = agg && agg.aggregateSha ? shortSha(agg.aggregateSha) : "—";
+      // Build-link honesty — the card's own sha is always the last-GREEN
+      // materialized sha (a red cycle leaves it untouched), so it's renderable
+      // whenever present: opening it reaches the last-good preview even while the
+      // current cycle is red/in-flight. When the aggregate has NEVER gone green
+      // there is no renderable sha — surface "build failed — rebuild" or "no build
+      // yet", never a link that 404s (rules 1 & 3).
+      const cardSha = agg && agg.aggregateSha;
+      const buildLink = classifyBuildLink({
+        sha: cardSha,
+        built: Boolean(cardSha),
+        building: Boolean(agg && (agg.activeRun || agg.queueState === "integrating")),
+        attempted: Boolean(agg && (agg.lastRun || agg.queueState === "red")),
+      });
       if (runLinkEl) {
         runLinkEl.textContent = "";
-        const link = agg && runLink(agg.revHref, "Open build");
-        if (link) runLinkEl.append(link);
-        else runLinkEl.append(document.createTextNode("The current green preview build for this store."));
+        if (buildLink.available && agg && agg.revHref) {
+          runLinkEl.append(runLink(agg.revHref, buildLink.label)!);
+        } else if (buildLink.kind === "failed") {
+          runLinkEl.append(document.createTextNode(buildLink.note + " "));
+          if (canShip && buildLink.action) {
+            const rebuild = document.createElement("button");
+            rebuild.type = "button";
+            rebuild.className = "btn btn-compact publish-cta-primed";
+            rebuild.textContent = buildLink.action.label;
+            rebuild.disabled = aggregateRetrying;
+            rebuild.addEventListener("click", () => retryBuild(rebuild));
+            runLinkEl.append(rebuild);
+          }
+        } else {
+          runLinkEl.append(document.createTextNode(buildLink.note));
+        }
+      }
+      // "Open preview" next to the Next-release header — a one-click hop to the
+      // current preview build. Same honesty: shown only when a genuinely-built
+      // revision exists, so it can never lead to a 404.
+      const openPreviewEl = aggPanel.querySelector("[data-aggregate-open-preview]");
+      if (openPreviewEl) {
+        if (buildLink.available && agg && agg.revHref) {
+          openPreviewEl.setAttribute("href", agg.revHref);
+          (openPreviewEl as any).hidden = false;
+        } else {
+          (openPreviewEl as any).hidden = true;
+        }
+        // The Next-release header is now a <summary> (collapsible panel). This link
+        // lives inside it, so a click would ALSO toggle the panel — stop that so
+        // "Open preview" only opens the preview. Idempotent-guarded so re-renders
+        // don't stack listeners.
+        if (!(openPreviewEl as any).__noToggleBound) {
+          openPreviewEl.addEventListener("click", (e: Event) => e.stopPropagation());
+          (openPreviewEl as any).__noToggleBound = true;
+        }
       }
 
       // Combined evidence = the last (or in-flight) integration run's honest state.
@@ -785,10 +1323,18 @@ export function initAdminPublishTab(): void {
           else if (lastRun.state === "failed") parts.push("Combined evidence did not pass.");
           if (lastRun.finishedAt) parts.push(age(lastRun.finishedAt));
           evDetailEl.append(document.createTextNode(parts.join(" · ")));
-          const rl = runLink(lastRun.revHref, "Run build");
-          if (rl) {
+          // A run's sha is renderable IFF that run PASSED — a failed run's sha never
+          // materialized, so linking it 404s (the exact Open-Build trap). Link only a
+          // passed run; a failed run shows its rebuild affordance via runLinkEl above.
+          const runBuild = classifyBuildLink({
+            sha: lastRun.aggregateSha,
+            built: lastRun.state === "passed",
+            building: lastRun.state === "running" || lastRun.state === "pending",
+            attempted: true,
+          });
+          if (runBuild.available && lastRun.revHref) {
             evDetailEl.append(document.createTextNode(" · "));
-            evDetailEl.append(rl);
+            evDetailEl.append(runLink(lastRun.revHref, "Run build")!);
           }
         } else {
           evDetailEl.append(document.createTextNode("The last integration run's verdict."));
@@ -877,53 +1423,114 @@ export function initAdminPublishTab(): void {
         }
       }
 
+      // Merges what used to be two separate "Included changes" lists (this staged-
+      // delta table + the Publish plan's own duplicate <details> list) into ONE:
+      // `agg.includedPrs` is already server-enriched with the same title/description/
+      // fileCount/lines/diff the plan's list used (see enrichIncludedPrs in
+      // api/changes/index.ts) — no separate cross-reference against `plan.includedPrs`
+      // is needed here, the row already carries everything.
       if (prsList) {
         prsList.textContent = "";
         for (const pr of prs) {
-          const li = document.createElement("li");
-          li.className = "agg-change";
-
-          const main = document.createElement("div");
-          main.className = "agg-change-main";
-
-          // Line 1: PR label + optional human title (what the change actually is).
-          const line1 = document.createElement("div");
-          line1.className = "agg-change-line";
-          const label = document.createElement("span");
-          label.className = "agg-change-pr";
-          label.textContent = pr.prNumber != null ? "PR #" + pr.prNumber : pr.changeId;
-          line1.append(label);
+          const tr = document.createElement("tr");
+          tr.className = "agg-included-row";
+
+          // Change: PR # + title (+ description underneath, + diff disclosure if any).
+          const changeCell = document.createElement("td");
+          const prEl = document.createElement("div");
+          prEl.className = "agg-included-pr";
+          prEl.textContent = pr.prNumber != null ? "PR #" + pr.prNumber : pr.changeId;
+          changeCell.append(prEl);
           if (pr.title) {
-            const title = document.createElement("span");
-            title.className = "agg-change-title";
-            title.textContent = pr.title;
-            line1.append(title);
+            const t = document.createElement("div");
+            t.className = "agg-included-title";
+            t.textContent = pr.title;
+            changeCell.append(t);
+          }
+          const description = pr.description || pr.summary;
+          if (description) {
+            const desc = document.createElement("p");
+            desc.className = "agg-included-desc";
+            desc.textContent = description;
+            changeCell.append(desc);
           }
-          main.append(line1);
+          // A trivial change carries its own bounded diff — offer it in a "View diff"
+          // disclosure (for a tiny change the diff IS the summary). Lines are colored
+          // by their leading +/- marker.
+          if (Array.isArray(pr.diff) && pr.diff.length) {
+            const details = document.createElement("details");
+            details.className = "agg-diff";
+            const summaryEl = document.createElement("summary");
+            summaryEl.textContent = "View diff";
+            details.append(summaryEl);
+            for (const file of pr.diff) {
+              const fileEl = document.createElement("div");
+              fileEl.className = "agg-diff-file";
+              const path = document.createElement("div");
+              path.className = "agg-diff-path publish-mono";
+              path.textContent = file.path;
+              fileEl.append(path);
+              if (file.patch) {
+                const pre = document.createElement("pre");
+                pre.className = "agg-diff-patch publish-mono";
+                for (const line of String(file.patch).split("\n")) {
+                  const ln = document.createElement("span");
+                  ln.className =
+                    line.startsWith("+") && !line.startsWith("+++") ? "agg-diff-add"
+                      : line.startsWith("-") && !line.startsWith("---") ? "agg-diff-del"
+                        : line.startsWith("@@") ? "agg-diff-hunk" : "";
+                  ln.textContent = line + "\n";
+                  pre.append(ln);
+                }
+                fileEl.append(pre);
+              } else {
+                const binary = document.createElement("div");
+                binary.className = "subtle";
+                binary.textContent = "(no line-level diff available)";
+                fileEl.append(binary);
+              }
+              details.append(fileEl);
+            }
+            changeCell.append(details);
+          }
+          tr.append(changeCell);
 
-          // Line 2: sha token + provenance (server enrichment): WHEN it entered the
-          // staged preview + WHO ran Integrate. Best-effort — absent when unattributed.
-          const line2 = document.createElement("div");
-          line2.className = "agg-change-line agg-change-sub";
+          // Head sha.
+          const shaCell = document.createElement("td");
           const sha = document.createElement("span");
           sha.className = "publish-mono sha-token";
           sha.textContent = shortSha(pr.headSha);
-          line2.append(sha);
-          if (pr.integratedAt || (pr.integratedBy && pr.integratedBy.email)) {
-            const meta = document.createElement("span");
-            meta.className = "subtle aggregate-pr-meta";
-            const bits = [];
-            if (pr.integratedAt) bits.push("integrated " + age(pr.integratedAt));
-            if (pr.integratedBy && pr.integratedBy.email) bits.push("by " + pr.integratedBy.email);
-            meta.textContent = bits.join(" ");
-            line2.append(meta);
+          shaCell.append(sha);
+          tr.append(shaCell);
+
+          // Files changed.
+          const filesCell = document.createElement("td");
+          const fileCount = pr.fileCount != null ? pr.fileCount : pr.filesChanged;
+          filesCell.textContent = fileCount != null ? String(fileCount) : "—";
+          tr.append(filesCell);
+
+          // Lines added/removed (green/red).
+          const linesCell = document.createElement("td");
+          if (typeof pr.linesAdded === "number" || typeof pr.linesRemoved === "number") {
+            linesCell.append(linesNode(pr.linesAdded, pr.linesRemoved));
+          } else {
+            linesCell.textContent = "—";
           }
-          main.append(line2);
-          li.append(main);
-
-          // u14 Undo — per-change revert: roll THIS change OUT of the staged preview
-          // (a revert commit + rebuild); the live site is untouched. Only for a
-          // PR-numbered, still-ahead-of-live change; gated on ship capability.
+          tr.append(linesCell);
+
+          // Integrated when/by.
+          const whenCell = document.createElement("td");
+          const bits = [];
+          if (pr.integratedAt) bits.push("added " + age(pr.integratedAt));
+          if (pr.integratedBy && pr.integratedBy.email) bits.push("by " + pr.integratedBy.email);
+          whenCell.textContent = bits.length ? bits.join(" ") : "—";
+          tr.append(whenCell);
+
+          // Actions: u14 Undo — per-change revert: roll THIS change OUT of the staged
+          // preview (a revert commit + rebuild); the live site is untouched. Only for
+          // a PR-numbered, still-ahead-of-live change; gated on ship capability.
+          const actionsCell = document.createElement("td");
+          actionsCell.className = "action";
           if (canShip && pr.prNumber != null && !matchesLive) {
             const undo = document.createElement("button");
             undo.type = "button";
@@ -932,35 +1539,80 @@ export function initAdminPublishTab(): void {
             undo.title =
               "Revert PR #" + pr.prNumber + " out of the staged preview (your live site is untouched)";
             undo.addEventListener("click", () => revertStaged(pr, undo));
-            li.append(undo);
+            actionsCell.append(undo);
           }
-          prsList.append(li);
+          tr.append(actionsCell);
+
+          prsList.append(tr);
         }
       }
 
       renderPlan(data.plan);
 
       // The Publish button: enabled only for a shippable, paywall-cleared plan and
-      // a viewer who can ship. A paywalled plan is SHOWN (upsell), never hidden.
+      // a viewer who can ship. A paywalled plan is SHOWN (upsell), never hidden. Bug 3
+      // publish-safety: computePublishGuard ALSO hard-blocks a red aggregate (the
+      // latest rebuild failed) regardless of a possibly-stale shippable plan, and
+      // surfaces a "serving stale build" indicator — see publish-guard.ts.
+      const servingBuildAtLabel = (() => {
+        const iso = data.current && data.current.createdAt;
+        if (!iso) return null;
+        const d = new Date(iso);
+        return Number.isNaN(d.getTime()) ? null : d.toLocaleString();
+      })();
+      const guard = computePublishGuard({
+        queueState: (agg && agg.queueState) || null,
+        aggregatePublishing,
+        canShip,
+        shippable: Boolean(currentPlan),
+        paywalled: Boolean(currentPlan && currentPlan.paywall && !currentPlan.paywall.allowed),
+        alreadyShipped: Boolean(currentPlan && currentPlan.alreadyShipped),
+        aheadCount,
+        servingBuildAtLabel,
+      });
       if (publishBtn) {
-        const shippable = Boolean(currentPlan);
-        const paywalled = currentPlan && currentPlan.paywall && !currentPlan.paywall.allowed;
         // rux7: never re-enable the Publish button while its POST is in flight —
-        // a poll refresh landing mid-publish must not open a double-submit.
-        publishBtn.disabled =
-          aggregatePublishing || !canShip || !shippable || paywalled || currentPlan.alreadyShipped;
-        publishBtn.title = !canShip
-          ? "Requires an owner or admin sign-in"
-          : !shippable
-            ? "The aggregate is not green / has no passed run to publish yet"
-            : paywalled
-              ? "Publishing to your live store is part of the paid plan"
-              : currentPlan.alreadyShipped
-                ? "This reviewed build is already live"
-                : "Publish the exact reviewed digest to your live store";
+        // a poll refresh landing mid-publish must not open a double-submit (folded
+        // into the guard's `aggregatePublishing` input).
+        publishBtn.disabled = guard.disabled;
+        publishBtn.title = guard.title;
+      }
+
+      // The collapsed destination panel answers the release question in its
+      // summary: green only when the staged release is already live; otherwise
+      // expose the action that advances live to that release. Public-site parity
+      // with the *old* live pointer must never paint this summary green.
+      const liveReleaseState: any = root.querySelector("[data-live-release-state]");
+      const liveReleasePublish: any = root.querySelector("[data-live-release-publish]");
+      if (liveReleaseState && liveReleasePublish) {
+        const liveReleaseView = liveReleaseSummaryState({
+          matchesLive,
+          hasStagedRelease: Boolean(stagedSha),
+          publishDisabled: guard.disabled,
+          publishTitle: guard.title,
+        });
+        if (liveReleaseView.kind === "current") {
+          paintChip(liveReleaseState, liveReleaseView.label, "green", CHIP_GLYPH.green);
+          liveReleaseState.hidden = false;
+          liveReleasePublish.hidden = true;
+        } else if (liveReleaseView.kind === "publish") {
+          liveReleaseState.hidden = true;
+          liveReleasePublish.hidden = false;
+          liveReleasePublish.textContent = liveReleaseView.label;
+          liveReleasePublish.disabled = liveReleaseView.disabled;
+          liveReleasePublish.title = liveReleaseView.title;
+        } else {
+          paintChip(liveReleaseState, liveReleaseView.label, "", "");
+          liveReleaseState.hidden = false;
+          liveReleasePublish.hidden = true;
+        }
       }
       if (publishDetail) {
-        if (currentPlan && currentPlan.alreadyShipped) {
+        if (guard.staleIndicator) {
+          // A failed rebuild is holding new work back — lead with the honest stale
+          // notice instead of the normal "publishes the exact build" copy.
+          publishDetail.textContent = guard.staleIndicator;
+        } else if (currentPlan && currentPlan.alreadyShipped) {
           publishDetail.textContent =
             "This reviewed build (" + shortSha(currentPlan.pinnedSha) + ") is already live. ";
           const view = document.createElement("a");
@@ -970,12 +1622,13 @@ export function initAdminPublishTab(): void {
           view.textContent = "View your live store →";
           publishDetail.append(view);
         } else if (currentPlan) {
-          publishDetail.textContent =
-            "Publishes the exact reviewed digest " + shortSha(currentPlan.artifactDigest.replace(/^sha256:/, "")) +
-            " (build " + shortSha(currentPlan.pinnedSha) + ") — no rebuild.";
+          publishDetail.textContent = publicSiteHost
+            ? "Publishes the exact build you reviewed (" + shortSha(currentPlan.pinnedSha) +
+              ") to the hosted store immediately, then automatically republishes " + publicSiteHost + "."
+            : "Publishes the exact build you reviewed (" + shortSha(currentPlan.pinnedSha) + ") — no rebuild.";
         } else {
           publishDetail.textContent =
-            "Publishes the exact reviewed digest — no rebuild. Available once the aggregate is green and its integration run passed.";
+            "Publishes the exact build you reviewed — no rebuild. Available once your next release is ready and its checks pass.";
         }
       }
 
@@ -996,133 +1649,9 @@ export function initAdminPublishTab(): void {
       }
     };
 
-    // Openable "Included changes" — each accepted PR as a line item with its
-    // human title, a one-line description of what it does, and meta (sha / files /
-    // who + when). title/description/fileCount are OPTIONAL server enrichment: a
-    // row degrades to just "PR #N · <sha>" when they're absent, and the <details>
-    // still lists every included change. The <details> element itself is static
-    // (in the markup) so its open/closed state survives a poll re-render.
-    const renderIncludedChanges = (planBox?: any, prs?: any) => {
-      const wrap = planBox.querySelector("[data-aggregate-plan-included]");
-      if (!wrap) return;
-      if (!prs.length) {
-        wrap.hidden = true;
-        return;
-      }
-      wrap.hidden = false;
-      const countEl = wrap.querySelector("[data-aggregate-plan-included-count]");
-      const hintEl = wrap.querySelector("[data-aggregate-plan-included-hint]");
-      const listEl = wrap.querySelector("[data-aggregate-plan-included-list]");
-      if (countEl) countEl.textContent = String(prs.length);
-      if (hintEl) {
-        hintEl.textContent = prs
-          .map((pr: any) => (pr.prNumber != null ? "PR #" + pr.prNumber : pr.changeId))
-          .filter(Boolean)
-          .join(", ");
-      }
-      if (!listEl) return;
-      listEl.textContent = "";
-      for (const pr of prs) {
-        const li = document.createElement("li");
-        li.className = "agg-included-item";
-
-        const top = document.createElement("div");
-        top.className = "agg-included-top";
-        const prEl = document.createElement("span");
-        prEl.className = "agg-included-pr";
-        prEl.textContent = pr.prNumber != null ? "PR #" + pr.prNumber : pr.changeId;
-        top.append(prEl);
-        if (pr.title) {
-          const t = document.createElement("span");
-          t.className = "agg-included-title";
-          t.textContent = pr.title;
-          top.append(t);
-        }
-        li.append(top);
-
-        const description = pr.description || pr.summary;
-        if (description) {
-          const desc = document.createElement("p");
-          desc.className = "agg-included-desc";
-          desc.textContent = description;
-          li.append(desc);
-        }
-
-        const meta = document.createElement("div");
-        meta.className = "agg-included-meta";
-        const sha = document.createElement("span");
-        sha.className = "publish-mono sha-token";
-        sha.textContent = shortSha(pr.headSha);
-        meta.append(sha);
-        const fileCount = pr.fileCount != null ? pr.fileCount : pr.filesChanged;
-        if (fileCount != null) {
-          const f = document.createElement("span");
-          f.textContent = fileCount + (fileCount === 1 ? " file" : " files");
-          meta.append(f);
-        }
-        // Lines added/removed (green/red) — one meta item so the "·" separator sits
-        // before the pair, not between +N and −M.
-        if (typeof pr.linesAdded === "number" || typeof pr.linesRemoved === "number") {
-          meta.append(linesNode(pr.linesAdded, pr.linesRemoved));
-        }
-        const bits = [];
-        if (pr.integratedAt) bits.push("integrated " + age(pr.integratedAt));
-        if (pr.integratedBy && pr.integratedBy.email) bits.push("by " + pr.integratedBy.email);
-        if (bits.length) {
-          const when = document.createElement("span");
-          when.textContent = bits.join(" ");
-          meta.append(when);
-        }
-        li.append(meta);
-
-        // A trivial change carries its own bounded diff — offer it in a "View diff"
-        // disclosure (for a tiny change the diff IS the summary). Lines are colored
-        // by their leading +/- marker.
-        if (Array.isArray(pr.diff) && pr.diff.length) {
-          const details = document.createElement("details");
-          details.className = "agg-diff";
-          const summaryEl = document.createElement("summary");
-          summaryEl.textContent = "View diff";
-          details.append(summaryEl);
-          for (const file of pr.diff) {
-            const fileEl = document.createElement("div");
-            fileEl.className = "agg-diff-file";
-            const path = document.createElement("div");
-            path.className = "agg-diff-path publish-mono";
-            path.textContent = file.path;
-            fileEl.append(path);
-            if (file.patch) {
-              const pre = document.createElement("pre");
-              pre.className = "agg-diff-patch publish-mono";
-              for (const line of String(file.patch).split("\n")) {
-                const ln = document.createElement("span");
-                ln.className =
-                  line.startsWith("+") && !line.startsWith("+++") ? "agg-diff-add"
-                    : line.startsWith("-") && !line.startsWith("---") ? "agg-diff-del"
-                      : line.startsWith("@@") ? "agg-diff-hunk" : "";
-                ln.textContent = line + "\n";
-                pre.append(ln);
-              }
-              fileEl.append(pre);
-            } else {
-              const binary = document.createElement("div");
-              binary.className = "subtle";
-              binary.textContent = "(no line-level diff available)";
-              fileEl.append(binary);
-            }
-            details.append(fileEl);
-          }
-          li.append(details);
-        }
-
-        listEl.append(li);
-      }
-    };
-
     const renderPlan = (plan?: any) => {
       const planBox = aggPanel && aggPanel.querySelector("[data-aggregate-plan]");
       if (!planBox) return;
-      const includedWrap = planBox.querySelector("[data-aggregate-plan-included]");
       const chipEl = planBox.querySelector("[data-aggregate-plan-chip]");
       const grid = planBox.querySelector("[data-aggregate-plan-grid]");
       const note = planBox.querySelector("[data-aggregate-plan-note]");
@@ -1131,26 +1660,22 @@ export function initAdminPublishTab(): void {
       // No plan at all (degenerate: no store bound) — hide the box.
       if (!plan) {
         planBox.hidden = true;
-        if (includedWrap) includedWrap.hidden = true;
         return;
       }
       planBox.hidden = false;
 
       if (!plan.ok) {
-        // An honest refusal — show WHY it isn't shippable, never a fake plan.
-        if (chipEl) {
-          chipEl.textContent = "Not shippable";
-          chipEl.className = "chip amber";
-        }
-        if (note) note.textContent = plan.message || ("Not shippable (" + (plan.reason || "refused") + ").");
-        if (includedWrap) includedWrap.hidden = true;
+        // An honest refusal — show WHY it isn't ready, never a fake plan.
+        paintChip(chipEl, "Not ready to publish", "amber", CHIP_GLYPH.amber);
+        if (note) note.textContent = plan.message || ("Not ready to publish (" + (plan.reason || "refused") + ").");
         return;
       }
 
       const paywalled = plan.paywall && !plan.paywall.allowed;
       if (chipEl) {
-        chipEl.textContent = plan.alreadyShipped ? "Already live" : paywalled ? "Upgrade required" : "Ready to publish";
-        chipEl.className = "chip " + (plan.alreadyShipped ? "green" : paywalled ? "amber" : "green");
+        const label = plan.alreadyShipped ? "Already live" : paywalled ? "Upgrade required" : "Ready to publish";
+        const tone = plan.alreadyShipped ? "green" : paywalled ? "amber" : "green";
+        paintChip(chipEl, label, tone, CHIP_GLYPH[tone]);
       }
 
       const row = (term?: any, value?: any, mono?: any) => {
@@ -1181,16 +1706,15 @@ export function initAdminPublishTab(): void {
         row("Rollback to", "None (first publish)");
       }
       row("Subscription", plan.paywall && plan.paywall.allowed ? "Enabled" : "Not enabled");
-
-      // The openable per-PR line items (replaces the bare "Included changes: N" row).
-      renderIncludedChanges(planBox, plan.includedPrs || []);
+      // Included changes: rendered ONCE, in the staged-delta table above (prsList) —
+      // the plan's own includedPrs is the same canonical set, so no second list here.
 
       if (note) {
         note.textContent = paywalled
           ? (plan.paywall.message || "Publishing to your live store requires the paid plan.")
           : plan.alreadyShipped
             ? "This reviewed build is already live — nothing to publish."
-            : "Publish sends the exact reviewed digest above to your live store. No rebuild.";
+            : "Publish sends the exact build you reviewed to your live store. No rebuild.";
       }
     };
 
@@ -1211,24 +1735,69 @@ export function initAdminPublishTab(): void {
           plan: shipoff.querySelector("[data-shipoff-plan]"),
           flight: shipoff.querySelector("[data-shipoff-flight]"),
           outcome: shipoff.querySelector("[data-shipoff-outcome]"),
+          log: shipoff.querySelector("[data-shipoff-log]"),
           grid: shipoff.querySelector("[data-shipoff-grid]"),
           proceed: shipoff.querySelector("[data-shipoff-proceed]"),
           cancel: shipoff.querySelector("[data-shipoff-cancel]"),
           live: shipoff.querySelector("[data-shipoff-live]"),
           elapsed: shipoff.querySelector("[data-shipoff-elapsed]"),
+          hide: shipoff.querySelector("[data-shipoff-hide]"),
           seal: shipoff.querySelector("[data-shipoff-seal]"),
           outcomeTitle: shipoff.querySelector("[data-shipoff-outcome-title]"),
           outcomeDetail: shipoff.querySelector("[data-shipoff-outcome-detail]"),
+          failure: shipoff.querySelector("[data-shipoff-failure]"),
+          failureDetail: shipoff.querySelector("[data-shipoff-failure-detail]"),
+          copy: shipoff.querySelector("[data-shipoff-copy]"),
           view: shipoff.querySelector("[data-shipoff-view]"),
+          undo: shipoff.querySelector("[data-shipoff-undo]"),
           done: shipoff.querySelector("[data-shipoff-done]"),
           confetti: shipoff.querySelector("[data-shipoff-confetti]"),
         }
       : null;
     let shipoffTimer: any = null;
+    // r12 — the element that opened the publish ceremony, so closing returns focus
+    // to it (the Publish button or the hero CTA) rather than dropping it to <body>.
+    let shipoffOpenedFrom: any = null;
+    const shipLog = makeLogConsole(shipoffEls && shipoffEls.log);
+    let shipFailureCopyText = "";
+    // A paste-ready brief for a coding agent when a publish-live did not complete —
+    // the honest reason + the pinned build the human was shipping (mirrors
+    // assembleBuildFailureCopy's framing).
+    const assembleShipFailureCopy = (plan?: any, data?: any, message?: string) => {
+      const tenant = appDomain || repo;
+      return [
+        "In my " + tenant + " store, publishing the reviewed build " +
+          (plan && plan.pinnedSha ? shortSha(plan.pinnedSha) + " " : "") +
+          "to my live store did not complete. Diagnose why from the detail below, then tell me the exact fix.",
+        "",
+        "What publish reported:",
+        message || "(no detail was reported)",
+        data && data.state ? "\nOutcome state: " + data.state : "",
+        data && data.reason ? "Reason: " + data.reason : "",
+        "\nContext: this is a Token of Trust storefront tenant. Go-live pins the exact reviewed " +
+          "aggregate digest and promotes it to the live channel — it never rebuilds. A refusal " +
+          "(not_green / paywall / sha_mismatch / bundle_unstaged) leaves the live store unchanged.",
+      ]
+        .filter((l) => l !== "")
+        .join("\n");
+    };
+    if (shipoffEls && shipoffEls.copy) {
+      shipoffEls.copy.addEventListener("click", () => {
+        navigator.clipboard.writeText(shipFailureCopyText).then(
+          () => {
+            shipoffEls.copy.textContent = "Copied";
+            setTimeout(() => { shipoffEls.copy.textContent = "Copy for your AI agent"; }, 1600);
+          },
+          () => { /* clipboard denied — the detail is selectable text */ },
+        );
+      });
+    }
     const closeShipoff = () => {
       if (shipoffTimer) { clearInterval(shipoffTimer); shipoffTimer = null; }
       if (shipoff) shipoff.hidden = true;
       if (shipoffEls) shipoffEls.confetti.textContent = "";
+      if (shipoffOpenedFrom && document.contains(shipoffOpenedFrom)) shipoffOpenedFrom.focus();
+      shipoffOpenedFrom = null;
     };
     const showShipoffPhase = (phase?: any) => {
       if (!shipoffEls) return;
@@ -1249,14 +1818,10 @@ export function initAdminPublishTab(): void {
       return lines.join("\n");
     };
 
-    const shortDigest = (digest?: any) => {
-      const d = String(digest || "").replace(/^sha256:/, "");
-      return d ? "sha256:" + d.slice(0, 12) + "…" : "—";
-    };
-
     const publishAggregate = (button?: any) => {
       if (!currentPlan) return;
       const plan = currentPlan;
+      shipoffOpenedFrom = button || null; // r12: return focus here on close
       if (!shipoff || !shipoffEls) {
         // No-markup fallback only — the ceremony IS the confirm now.
         if (!window.confirm(buildPublishPlanText(plan) + "\n\nPublish live?")) return;
@@ -1288,12 +1853,17 @@ export function initAdminPublishTab(): void {
       const startedAt = Date.now();
       if (shipoffEls) {
         showShipoffPhase("flight");
+        shipLog.reset();
+        if (shipoffEls.failure) shipoffEls.failure.hidden = true;
+        shipoffEls.live.textContent = "Pinning the exact reviewed build to your live channel…";
+        shipoffEls.elapsed.textContent = "0:00";
+        if (shipoffEls.hide) shipoffEls.hide.onclick = () => { shipoff.hidden = true; }; // stream keeps running
         shipoffTimer = setInterval(() => {
           const s = Math.floor((Date.now() - startedAt) / 1000);
           shipoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
         }, 1000);
       }
-      const outcome = (state?: any, title?: any, detail?: any, showView?: any) => {
+      const outcome = (state?: any, title?: any, detail?: any, showView?: any, failureDetail?: any) => {
         if (!shipoffEls) return;
         if (shipoffTimer) { clearInterval(shipoffTimer); shipoffTimer = null; }
         shipoffEls.seal.dataset.state = state;
@@ -1301,6 +1871,20 @@ export function initAdminPublishTab(): void {
         shipoffEls.outcomeDetail.textContent = detail;
         shipoffEls.view.hidden = !showView;
         if (showView) shipoffEls.view.href = ds.liveHref || "/";
+        // r10: the Undo affordance is wired only on a successful ship (below); reset
+        // it hidden for every outcome so a failure never shows a stale Undo.
+        if (shipoffEls.undo) shipoffEls.undo.hidden = true;
+        // A failure gets the honest detail + a "Copy for your AI agent" brief (same
+        // affordance as the build flight); a clean success hides it.
+        if (shipoffEls.failure) {
+          if (failureDetail) {
+            shipoffEls.failure.hidden = false;
+            shipoffEls.failureDetail.textContent = failureDetail;
+          } else {
+            shipoffEls.failure.hidden = true;
+          }
+        }
+        if (shipoff.hidden) shipoff.hidden = false; // re-surface if backgrounded
         showShipoffPhase("outcome");
         shipoffEls.done.focus();
         if (state === "ok") celebrate(shipoffEls.confetti);
@@ -1308,7 +1892,13 @@ export function initAdminPublishTab(): void {
       try {
         const res = await fetch(ds.shipEndpoint, {
           method: "POST",
-          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
+          headers: {
+            "content-type": "application/json",
+            // Real-time server-pushed progress (pin → promote → verify → record) over
+            // SSE; falls back to buffered JSON for a non-streaming proxy.
+            accept: "text/event-stream",
+            "x-tot-capability": "ship-on-behalf",
+          },
           body: JSON.stringify({
             aggregateId: plan.aggregateId,
             // The HUMAN go-live gate + the reviewed-digest guards (b09 ship input).
@@ -1317,7 +1907,7 @@ export function initAdminPublishTab(): void {
             expectedArtifactDigest: plan.artifactDigest,
           }),
         });
-        const data = await res.json().catch(() => ({}));
+        const { data } = await streamWithLog(res, shipLog);
         // b09 AggregateShipResult: the ONLY live claim is state === "shipped".
         if (data.state === "shipped") {
           setStatus(
@@ -1325,13 +1915,26 @@ export function initAdminPublishTab(): void {
             "Published live · build " + shortSha(data.pinnedSha) + " (receipt " + (data.receiptId || "—") + ").",
             "ok",
           );
+          void autoSweepBranches();
           outcome(
             "ok",
             "Your store is live",
-            "Build " + shortSha(data.pinnedSha) + " — the exact digest you reviewed — is now serving" +
+            "Build " + shortSha(data.pinnedSha) + " — exactly what you reviewed — is now serving" +
               (data.receiptId ? " (receipt " + data.receiptId + ")." : "."),
             true,
           );
+          // r10: right after publishing, offer a one-click Undo that jumps to the
+          // rollback row for the version this release just REPLACED (the plan's
+          // rollback target = the prior live version), pre-targeted. Reuses the Live
+          // Site rollback action; only offered when there IS a prior version.
+          const undoTarget = plan.rollbackTarget && plan.rollbackTarget.aggregateSha;
+          if (shipoffEls && shipoffEls.undo && undoTarget) {
+            shipoffEls.undo.hidden = false;
+            shipoffEls.undo.onclick = () => {
+              closeShipoff();
+              focusRollbackTarget(undoTarget);
+            };
+          }
         } else {
           let message;
           if (data.state === "promote_failed" || data.state === "record_failed") {
@@ -1340,10 +1943,15 @@ export function initAdminPublishTab(): void {
           } else if (data.reason === "paywall") {
             message = data.message || "Publishing to your live store is part of the paid plan.";
           } else {
-            message = data.message || data.error || "Publish refused (" + (data.reason || res.status) + ")";
+            message = data.message || data.error || "Publish refused (" + (data.reason || data.status || res.status) + ")";
           }
           setStatus(aggStatusEl, message, "err");
-          outcome("err", "Publish did not complete", message + " Your live store is unchanged.", false);
+          shipFailureCopyText = assembleShipFailureCopy(plan, data, message);
+          outcome("err", "Publish did not complete", message + " Your live store is unchanged.", false, message);
+          // C5 — a refused/failed publish is an aggregate-level event (most tellingly
+          // "not green"); append the health-banner roll-up of what's keeping it red to
+          // the outcome detail (best-effort, additive).
+          surfaceDoctorHint((p) => shipFailureDoctor(p), [shipoffEls && shipoffEls.outcomeDetail, aggStatusEl]);
         }
       } catch {
         setStatus(aggStatusEl, "Publish failed — network error", "err");
@@ -1365,9 +1973,38 @@ export function initAdminPublishTab(): void {
     aggPanel
       ?.querySelector("[data-aggregate-publish]")
       ?.addEventListener("click", (event: any) => publishAggregate(event.currentTarget));
+    root
+      .querySelector("[data-live-release-publish]")
+      ?.addEventListener("click", (event: any) => {
+        // This action lives inside <summary>; publishing must not also toggle the
+        // disclosure open or closed.
+        event.preventDefault();
+        event.stopPropagation();
+        publishAggregate(event.currentTarget);
+      });
+    root
+      .querySelector("[data-publish-stale-site-link]")
+      ?.addEventListener("click", () => {
+        // The destination panel is collapsed by default; an alert promising the
+        // full breakdown must reveal it before the anchor scroll lands.
+        const details: any = root.querySelector(".live-site-details");
+        if (details) details.open = true;
+      });
     aggPanel
       ?.querySelector("[data-aggregate-retry-build]")
       ?.addEventListener("click", (event: any) => retryBuild(event.currentTarget));
+    // r08: the Next-release "Copy preview link" — shown only when a share token was
+    // minted. The shared preview URL is static (token + canonical domain), so it's
+    // wired once. stopPropagation keeps a copy from also toggling the collapsible.
+    const aggCopyPreviewBtn: any = aggPanel && aggPanel.querySelector("[data-aggregate-copy-preview]");
+    if (aggCopyPreviewBtn && sharedPreviewUrl()) {
+      aggCopyPreviewBtn.hidden = false;
+      const lbl = aggCopyPreviewBtn.querySelector("[data-copy-preview-label]");
+      aggCopyPreviewBtn.addEventListener("click", (e: Event) => {
+        e.stopPropagation();
+        copyPreviewLink(sharedPreviewUrl(), lbl);
+      });
+    }
 
     // ── Accept-to-preview LIFTOFF ─────────────────────────────────────────────
     // The plan confirm + live integration flight + outcome ceremony (replaces
@@ -1388,6 +2025,7 @@ export function initAdminPublishTab(): void {
           plan: liftoff.querySelector("[data-liftoff-plan]"),
           flight: liftoff.querySelector("[data-liftoff-flight]"),
           outcome: liftoff.querySelector("[data-liftoff-outcome]"),
+          log: liftoff.querySelector("[data-liftoff-log]"),
           title: liftoff.querySelector("[data-liftoff-title]"),
           grid: liftoff.querySelector("[data-liftoff-grid]"),
           proceed: liftoff.querySelector("[data-liftoff-proceed]"),
@@ -1400,6 +2038,7 @@ export function initAdminPublishTab(): void {
           outcomeTitle: liftoff.querySelector("[data-liftoff-outcome-title]"),
           outcomeDetail: liftoff.querySelector("[data-liftoff-outcome-detail]"),
           review: liftoff.querySelector("[data-liftoff-review]"),
+          rebuild: liftoff.querySelector("[data-liftoff-rebuild]"),
           done: liftoff.querySelector("[data-liftoff-done]"),
           confetti: liftoff.querySelector("[data-liftoff-confetti]"),
           conflict: liftoff.querySelector("[data-liftoff-conflict]"),
@@ -1435,7 +2074,7 @@ export function initAdminPublishTab(): void {
     // conflict markers was lurking and poisoned the first attempt), the
     // two-stage auth self-heal (tot login fixes the session, NOT the token
     // baked into the remote URL — u10 credential-helper removes this), the
-    // conflict-intent framing, and the never-`--new` rule.
+    // conflict-intent framing, and the never-`--fork-candidate` rule.
     const conflictPromptFor = (change?: any, rawMessage?: any) => {
       const tenant = appDomain || repo;
       const pr = change && change.prNumber != null ? "PR #" + change.prNumber : "my open candidate PR";
@@ -1448,8 +2087,8 @@ export function initAdminPublishTab(): void {
         "2. Run `tot pr` and confirm " + pr + " is listed and marked (active) for this checkout — if it isn't, stop and tell me before touching anything.",
         "3. Run `git fetch origin`, then `git rebase origin/preview`. On an authentication failure: `tot login`, retry; if fetch STILL fails, the token embedded in the remote URL has rotated — replace the remote with a freshly minted one: `git remote set-url origin \"$(tot clone " + tenant + " --remote-only --print-remote)\"` (this matches how the checkout was originally configured; ask me first if you're unsure).",
         "4. Resolve any conflicts git flags, preserving the intent of my change on the lines it edited; keep preview's version everywhere else. Show me the resolution if the same lines were edited on both sides. Never commit a file still containing conflict markers; finish with `git rebase --continue` — a half-done rebase must never be left behind.",
-        "5. Re-submit with `tot preview` (plain — never `--new`, which would fork a separate PR). " + pr + " updates in place.",
-        "6. Confirm the push succeeded and the submit output reports the preview building. Then end by reminding me how to FINISH the merge once the build is ready: back in the store admin's Publish tab (" + adminPublishUrl() + "), " + pr + " → Integrate into preview" +
+        "5. Re-submit with `tot preview` (plain — never `--fork-candidate`, which would fork a separate PR). " + pr + " updates in place.",
+        "6. Confirm the push succeeded and the submit output reports the preview building. Then end by reminding me how to FINISH adding it once the build is ready: back in the store admin's Publish tab (" + adminPublishUrl() + "), " + pr + " → Add to release" +
           (change && change.prNumber != null
             ? " — or from this terminal: `tot accept --tenant " + tenant + " --pr " + change.prNumber + "`."
             : "."),
@@ -1524,6 +2163,13 @@ export function initAdminPublishTab(): void {
           setConflictStatus(statusEl2, "");
           // Auto-re-integrate ONCE with the refreshed change (new PR/head).
           runIntegration(action.change, button);
+        } else if (action.kind === "already-integrated") {
+          // The change already merged/integrated — recovery is a clean no-op success,
+          // NOT an error (fb-1787916141762-owjzis). Close the panel and refresh the
+          // queue so the now-stale row drops off; never reveal the expert fallback.
+          setConflictStatus(statusEl2, "This change is already in your next release — nothing to recover.", "ok");
+          if (liftoff) liftoff.hidden = true;
+          loadQueue();
         } else if (action.kind === "cards") {
           if (source === "card") {
             // A merge card that STILL overlaps — no safe auto-combine exists; hand
@@ -1624,7 +2270,7 @@ export function initAdminPublishTab(): void {
       if (!liftoff || !liftoffEls) {
         setStatus(
           statusEl,
-          "This change needs updating against the latest preview before it can integrate.",
+          "This change needs updating against the latest preview before it can be added.",
           "err",
         );
         return;
@@ -1635,7 +2281,7 @@ export function initAdminPublishTab(): void {
       liftoffEls.outcomeTitle.textContent = "Preview changed while you worked";
       liftoffEls.outcomeDetail.textContent =
         target + " passed its checks, but preview changed after it was created and the two now " +
-        "conflict. Nothing was integrated — update this change automatically, then review the result.";
+        "conflict. Nothing was added — update this change automatically, then review the result.";
       liftoffEls.review.hidden = true;
       setConflictGuidance(true, "", change);
       showPhase("outcome");
@@ -1664,6 +2310,18 @@ export function initAdminPublishTab(): void {
     let liftoffTimer: any = null;
     let liftoffPoll: any = null;
     let liftoffOpenedFrom: any = null;
+    const liftoffLog = makeLogConsole(liftoffEls && liftoffEls.log);
+    // Map a server-pushed integrate phase onto the four-stage rail — the SAME rail,
+    // now driven by REAL boundaries instead of a guessing poll: `merging` → Merge,
+    // the aggregate rebuild's `reading`/`publishing` → Rebuild, `checking` → Evidence.
+    const railFromIntegratePhase = (ev: { event: string; data: string }) => {
+      if (ev.event !== "phase") return;
+      let phase = "";
+      try { phase = JSON.parse(ev.data).phase || ""; } catch { /* ignore */ }
+      if (phase === "merging") railTo("merge");
+      else if (phase === "reading" || phase === "publishing") railTo("build");
+      else if (phase === "checking") railTo("evidence");
+    };
     const stopLiftoffLoops = () => {
       if (liftoffTimer) { clearInterval(liftoffTimer); liftoffTimer = null; }
       if (liftoffPoll) { clearInterval(liftoffPoll); liftoffPoll = null; }
@@ -1709,38 +2367,12 @@ export function initAdminPublishTab(): void {
       setTimeout(() => { container.textContent = ""; }, 2400);
     };
 
-    // The live poll during flight: reflect the server's REAL progress.
-    const startFlightPoll = (change?: any, preFlightSha?: any) => {
-      let inAggregate = false;
-      liftoffPoll = setInterval(async () => {
-        try {
-          const res = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
-          if (!res.ok) return;
-          const data = await res.json();
-          const agg = data.aggregate || {};
-          const included = (agg.includedPrs || []).some((p: any) => p.changeId === change.changeId);
-          const shaMoved = agg.aggregateSha && agg.aggregateSha !== preFlightSha;
-          const run = agg.activeRun || null;
-          if (!inAggregate && (included || shaMoved)) {
-            inAggregate = true;
-            railTo("build");
-            if (liftoffEls) liftoffEls.live.textContent =
-              "Merged into preview — rebuilding the combined aggregate…";
-          }
-          if (run) {
-            railTo("evidence");
-            if (liftoffEls) liftoffEls.live.textContent =
-              run.statusMessage || "Combined evidence is running…";
-          }
-        } catch { /* polling is best-effort; the POST outcome is authoritative */ }
-      }, 2500);
-    };
 
     const openLiftoff = (change?: any, button?: any) => {
       if (!liftoff || !liftoffEls) return false;
       liftoffOpenedFrom = button || null;
       const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
-      liftoffEls.title.textContent = "Integrate " + target + " into preview";
+      liftoffEls.title.textContent = "Add " + target + " to your next release";
       liftoffEls.grid.textContent = "";
       liftoffEls.grid.append(
         ...planRow("Store", appDomain || repo),
@@ -1776,42 +2408,140 @@ export function initAdminPublishTab(): void {
         if (mode === "flight") shipoff.hidden = true;
         else closeShipoff();
       }
+      if (buildoff && !buildoff.hidden) {
+        const mode = buildoffCard && buildoffCard.dataset.mode;
+        if (mode === "flight") buildoff.hidden = true; // stream keeps running
+        else closeBuildoff();
+      }
+      if (rebuildoff && !rebuildoff.hidden) {
+        const mode = rebuildoffCard && rebuildoffCard.dataset.mode;
+        if (mode === "flight") rebuildoff.hidden = true; // stream keeps running
+        else closeRebuildoff();
+      }
     });
 
+    // r12 — focus trap. While a modal ceremony is open (aria-modal), Tab must cycle
+    // WITHIN its card, never escaping to the page behind it. Only the visible phase's
+    // controls are tabbable (the hidden phases' buttons fail the offsetParent test), and
+    // a backgrounded ("Continue in background", hidden) dialog is not trapped.
+    document.addEventListener("keydown", (ev) => {
+      if (ev.key !== "Tab") return;
+      const open: any = [liftoff, shipoff, buildoff, rebuildoff].find((d: any) => d && !d.hidden);
+      if (!open) return;
+      const card: any = open.querySelector(".liftoff-card");
+      if (!card) return;
+      const nodes = Array.from(
+        card.querySelectorAll(
+          'a[href],button:not([disabled]),input:not([disabled]),select:not([disabled]),textarea:not([disabled]),[tabindex]:not([tabindex="-1"])',
+        ),
+      ).filter((el: any) => el.offsetParent !== null || el === document.activeElement) as any[];
+      if (!nodes.length) {
+        ev.preventDefault();
+        card.focus();
+        return;
+      }
+      const first = nodes[0];
+      const last = nodes[nodes.length - 1];
+      const active = document.activeElement;
+      if (ev.shiftKey) {
+        if (active === first || active === card || !card.contains(active)) {
+          ev.preventDefault();
+          last.focus();
+        }
+      } else if (active === last || active === card || !card.contains(active)) {
+        ev.preventDefault();
+        first.focus();
+      }
+    });
+
+    // Render one classified IntegrateOutcomeView onto the liftoff outcome phase —
+    // the SINGLE place the honest result becomes UI. It reads the derived view
+    // (never re-deciding from raw fields), so "Integration did not land" can only
+    // appear when the merge genuinely did not land; a merge that landed with a
+    // failed build reads "Integrated — preview build failed" and offers Rebuild;
+    // an indeterminate outcome reads "unknown" and offers Re-check. Never a 404
+    // review link (only shown when a genuinely-built revision exists).
+    const applyIntegrateOutcome = (view: IntegrateOutcomeView, change?: any) => {
+      if (!liftoffEls) return;
+      // A successful seal (green OR already-integrated) shows every stage done; a
+      // failure marks its honest failing stage.
+      if (view.seal === "ok") {
+        LIFTOFF_STAGES.forEach((s) => setStage(s, "done"));
+      } else if (view.failStage) {
+        setStage(view.failStage, "fail");
+      }
+      liftoffEls.seal.dataset.state = view.seal;
+      liftoffEls.outcomeTitle.textContent = view.title;
+      liftoffEls.outcomeDetail.textContent = view.detail;
+      setConflictGuidance(
+        view.conflictGuidance,
+        view.conflictGuidance ? view.detail : "",
+        change,
+      );
+      // Review deep-link — shown only for a genuinely-built revision (rule 3: no 404).
+      if (view.review.show && view.review.sha) {
+        liftoffEls.review.href =
+          "/" + encodeURIComponent(appDomain) + "/preview/rev/" + view.review.sha + "/";
+        liftoffEls.review.hidden = false;
+      } else {
+        liftoffEls.review.hidden = true;
+      }
+      // The concrete next-step action button (rebuild / re-check). Conflict recovery
+      // owns its own primary button inside the conflict panel, so no duplicate here.
+      const rebuildBtn = liftoffEls.rebuild;
+      if (rebuildBtn) {
+        const act = view.action;
+        const inlineAction =
+          act && (act.kind === "rebuild" || act.kind === "recheck") ? act : null;
+        if (inlineAction) {
+          rebuildBtn.hidden = false;
+          rebuildBtn.textContent = inlineAction.label;
+          rebuildBtn.onclick = () => {
+            closeLiftoff();
+            if (inlineAction.kind === "rebuild") retryBuild(rebuildBtn);
+            else loadQueue();
+          };
+        } else {
+          rebuildBtn.hidden = true;
+          rebuildBtn.onclick = null;
+        }
+      }
+      if (liftoff.hidden) liftoff.hidden = false; // surface even if backgrounded
+      showPhase("outcome");
+      liftoffEls.done.focus();
+      if (view.ok) celebrate(liftoffEls.confetti);
+    };
+
     // b08 integrate returns an IntegrateOutcome — { ok, queueState, runState,
     // aggregateSha, pointerMoved, statusMessage, reason? } — NEVER a bare
-    // merged:true. Render it honestly: green advances the aggregate; red left it
-    // exactly where it was and names the failing stage.
+    // merged:true. Render it honestly via classifyIntegrateOutcome: green advances
+    // the aggregate; a landed-but-red merge says the build failed (not "did not
+    // land"); an indeterminate result is an explicit unknown, never a silent pass.
     const runIntegration = async (change?: any, button?: any) => {
       const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
       if (button) button.disabled = true;
       busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
-      setStatus(statusEl, "Integrating " + change.changeId + " into preview…");
+      setStatus(statusEl, "Adding " + change.changeId + " to your next release…");
       const startedAt = Date.now();
-      let preFlightSha: any = null;
       if (liftoffEls) {
         showPhase("flight");
-        liftoffEls.flightTitle.textContent = "Integrating " + target + " into preview";
+        liftoffLog.reset();
+        liftoffEls.flightTitle.textContent = "Adding " + target + " to your next release";
         railTo("merge");
-        liftoffEls.live.textContent = "Squash-merging the candidate into preview…";
+        liftoffEls.live.textContent = "Adding your change to the next release…";
         liftoffTimer = setInterval(() => {
           const s = Math.floor((Date.now() - startedAt) / 1000);
           liftoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
         }, 1000);
       }
       try {
-        // Snapshot the pre-flight aggregate sha so the poll can detect the merge
-        // landing (sha moved) even before includedPrs reflects it.
-        try {
-          const pre = await fetch(ds.changesEndpoint, { headers: { accept: "application/json" } });
-          if (pre.ok) preFlightSha = ((await pre.json()).aggregate || {}).aggregateSha || null;
-        } catch { /* best-effort */ }
-        startFlightPoll(change, preFlightSha);
-
         const res = await fetch(ds.integrateEndpoint, {
           method: "POST",
           headers: {
             "content-type": "application/json",
+            // Real-time server-pushed progress (merge → rebuild → evidence) over SSE;
+            // falls back to buffered JSON for a non-streaming proxy.
+            accept: "text/event-stream",
             // Mirror of the server-side capability model (UX): the server
             // re-derives capability and stays authoritative.
             "x-tot-capability": "ship-on-behalf",
@@ -1823,118 +2553,44 @@ export function initAdminPublishTab(): void {
             expectedHeadSha: change.headSha || undefined,
           }),
         });
-        const data = await res.json().catch(() => ({}));
+        // Drive the stage-rail + scrolling log from the REAL streamed phases (no
+        // more client-side guessing poll); the terminal `result` carries the honest
+        // IntegrateOutcome the branches below render.
+        const { data } = await streamWithLog(res, liftoffLog, railFromIntegratePhase);
         stopLiftoffLoops();
-        if (res.ok && data.ok) {
-          setStatus(
-            statusEl,
-            "Integrated " + change.changeId + " — preview aggregate is green (" +
-              shortSha(data.aggregateSha) + "). Review the aggregate, then Publish to go live.",
-            "ok",
+        // HONEST RESULT — derived from the actual merge/build signals, never a
+        // separate optimistic flag. `aggregateSha` is the discriminator: the
+        // orchestrator writes it IFF the forge merge landed, so a landed merge
+        // whose build failed reads "Integrated — preview build failed" (with a
+        // Rebuild), and only a genuinely-unlanded merge reads "did not land".
+        const view = classifyIntegrateOutcome({
+          httpOk: res.ok,
+          ok: data.ok === true,
+          aggregateSha: data.aggregateSha ?? null,
+          queueState: data.queueState ?? null,
+          reason: data.reason ?? null,
+          statusMessage: data.statusMessage ?? null,
+          error: data.error ?? null,
+          target,
+        });
+        setStatus(statusEl, view.detail, view.seal);
+        if (view.ok) void autoSweepBranches();
+        if (view.seal === "err") {
+          // C5 — append the merge-doctor's read of THIS candidate's failure to the
+          // outcome detail (best-effort, additive; the view's copy stands on its own).
+          surfaceDoctorHint(
+            (p) => integrateFailureDoctor(p, { changeId: change.changeId, prNumber: change.prNumber }),
+            [liftoffEls && liftoffEls.outcomeDetail, statusEl],
           );
-          if (liftoffEls) {
-            LIFTOFF_STAGES.forEach((s) => setStage(s, "done"));
-            liftoffEls.seal.dataset.state = "ok";
-            liftoffEls.outcomeTitle.textContent = "The preview aggregate is green";
-            liftoffEls.outcomeDetail.textContent =
-              target + " is in. Aggregate build " + shortSha(data.aggregateSha) +
-              " passed its combined evidence — this exact build is what you review, and what " +
-              "Publish would take live. Nothing is live yet.";
-            if (data.aggregateSha) {
-              liftoffEls.review.href =
-                "/" + encodeURIComponent(appDomain) + "/preview/rev/" + data.aggregateSha + "/";
-              liftoffEls.review.hidden = false;
-            } else {
-              liftoffEls.review.hidden = true;
-            }
-            setConflictGuidance(false);
-            if (liftoff.hidden) liftoff.hidden = false; // surface the payoff even if backgrounded
-            showPhase("outcome");
-            liftoffEls.done.focus();
-            celebrate(liftoffEls.confetti);
-          }
-        } else if (data.reason === "candidate_not_open") {
-          // "No open candidate" = the PR already merged before this attempt —
-          // usually a second click on a just-integrated candidate whose row went
-          // stale (DZ, 2026-08-20). That is a SUCCESS the operator is re-hearing,
-          // not a failure: green seal, happy copy, no fail stage, never conflict
-          // guidance. The queue read now drops merged rows, so the row is gone on
-          // the next refresh; the durable KV closeout is u12.
-          const target = change.prNumber != null ? "PR #" + change.prNumber : "This change";
-          setStatus(statusEl, target + " was already integrated — it's in the preview build.", "ok");
-          if (liftoffEls) {
-            LIFTOFF_STAGES.forEach((s) => setStage(s, "done"));
-            liftoffEls.seal.dataset.state = "ok";
-            liftoffEls.outcomeTitle.textContent = "Already integrated";
-            liftoffEls.outcomeDetail.textContent =
-              target + " landed in the preview build earlier — this attempt found " +
-              "nothing left to do. It will drop off the queue on the next refresh; " +
-              "the integration is recorded in the history below.";
-            setConflictGuidance(false);
-            liftoffEls.review.hidden = true;
-            if (liftoff.hidden) liftoff.hidden = false;
-            showPhase("outcome");
-            liftoffEls.done.focus();
-          }
-        } else {
-          let message;
-          let failStage = "merge";
-          // The merge-refused conflict is a FORK, not a failure of the change:
-          // preview moved after the candidate branched and both edit the same
-          // content. Render it as directions (rebase + re-submit), never as the
-          // raw forge refusal — that dead-ended real operators (2026-08-20).
-          const isMergeConflict = data.reason === "merge_failed";
-          if (res.ok && data.queueState === "red") {
-            // The queue ran but the aggregate did not go green — the candidate did
-            // NOT advance the shippable set. Name the honest failing stage.
-            failStage = "evidence";
-            message =
-              "Integration of " + change.changeId + " failed (" + (data.reason || "red") + "): " +
-              (data.statusMessage || "the aggregate did not pass its combined evidence.") +
-              " The aggregate is unchanged.";
-          } else if (data.reason === "not_preview_base") {
-            message =
-              "Not integrated: " + change.changeId + " does not target the preview branch " +
-              "(base is not \"preview\"). " + (data.statusMessage || "");
-          } else {
-            message = data.statusMessage || data.error || "Integrate failed (" + res.status + ")";
-          }
-          setStatus(statusEl, message, "err");
-          if (liftoffEls) {
-            setStage(failStage, "fail");
-            liftoffEls.seal.dataset.state = "err";
-            if (isMergeConflict) {
-              const target = change.prNumber != null ? "PR #" + change.prNumber : "This change";
-              liftoffEls.outcomeTitle.textContent = "Preview changed while you worked";
-              liftoffEls.outcomeDetail.textContent =
-                target + " edits content that also changed on preview after it was " +
-                "created, so it couldn't merge as-is. Nothing was integrated — preview " +
-                "is exactly as it was. You can update this change automatically below.";
-              setConflictGuidance(true, data.statusMessage || "", change);
-            } else {
-              liftoffEls.outcomeTitle.textContent = "Integration did not land";
-              liftoffEls.outcomeDetail.textContent = message;
-              setConflictGuidance(false);
-            }
-            liftoffEls.review.hidden = true;
-            if (liftoff.hidden) liftoff.hidden = false;
-            showPhase("outcome");
-            liftoffEls.done.focus();
-          }
         }
+        applyIntegrateOutcome(view, change);
       } catch {
         stopLiftoffLoops();
-        setStatus(statusEl, "Integrate failed — network error", "err");
-        if (liftoffEls) {
-          liftoffEls.seal.dataset.state = "err";
-          liftoffEls.outcomeTitle.textContent = "Integration did not land";
-          liftoffEls.outcomeDetail.textContent =
-            "Network error mid-flight — refresh the queue to see the aggregate's honest state.";
-          setConflictGuidance(false);
-          liftoffEls.review.hidden = true;
-          if (liftoff.hidden) liftoff.hidden = false;
-          showPhase("outcome");
-        }
+        // A network fault means we DON'T KNOW whether the merge landed — unknown =
+        // error, never a silent "did not land". Re-check the queue, don't assume.
+        const view = classifyIntegrateOutcome({ httpOk: false, networkError: true, target });
+        setStatus(statusEl, view.detail, "err");
+        applyIntegrateOutcome(view, change);
       } finally {
         busyChanges.delete(change.changeId);
         if (button) button.disabled = false;
@@ -1948,19 +2604,21 @@ export function initAdminPublishTab(): void {
       if (openLiftoff(change, button)) return;
       const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
       const plan =
-        "Accept-to-preview plan:\n  tenant:    " + (appDomain || repo) +
+        "Add to release plan:\n  store:     " + (appDomain || repo) +
         (change.prNumber != null ? "\n  PR:        #" + change.prNumber : "") +
         "\n  change id: " + change.changeId +
         (change.headSha ? "\n  head sha:  " + shortSha(change.headSha) : "") +
-        "\n  effect:    integrate " + target + " into the preview aggregate, then rebuild + " +
-        "re-evidence it. Does NOT go live — publish the reviewed build separately.";
+        "\n  effect:    add " + target + " to your next release, then rebuild the preview and " +
+        "re-run its checks. Does NOT go live — you publish your release separately.";
       if (!window.confirm(plan + "\n\nProceed?")) return;
       runIntegration(change, button);
     };
 
     const rejectChange = async (change?: any, button?: any) => {
       const reason = window.prompt(
-        "Reject " + change.changeId + " — add a short note for the submitter:",
+        "Reject " + change.changeId +
+        " — this closes the PR and removes its hosted preview and candidate branch. " +
+        "Add a short note for the submitter:",
       );
       if (reason == null) return;
       if (!reason.trim()) {
@@ -1984,7 +2642,16 @@ export function initAdminPublishTab(): void {
         );
         const data = await res.json().catch(() => ({}));
         if (res.ok) {
-          setStatus(statusEl, "Change " + change.changeId + " rejected.", "ok");
+          setStatus(
+            statusEl,
+            data.cleanupWarning
+              ? "Change " + change.changeId + " rejected. " + data.cleanupWarning + "."
+              : "Change " +
+                  change.changeId +
+                  " rejected; its PR, preview, and candidate branch are cleaned up.",
+            data.cleanupWarning ? "err" : "ok",
+          );
+          void autoSweepBranches();
         } else {
           setStatus(statusEl, data.error || "Reject failed (" + res.status + ")", "err");
         }
@@ -2050,109 +2717,162 @@ export function initAdminPublishTab(): void {
     // PR already merged into preview, but the build/evidence step that follows
     // died (e.g. a transient MCP error). `POST /api/changes/rebuild` re-runs
     // ONLY that step against the sha the forge already carries — never a
-    // second merge attempt, never a membership change.
+    // second merge attempt, never a membership change. It streams its
+    // reading/publishing/checking phases into the SAME shared scrolling live-log
+    // console the other flights use, with Continue-in-background + a Copy-for-AI
+    // failure brief.
+    const rebuildoff: any = root.querySelector("[data-rebuildoff]");
+    const rebuildoffCard = rebuildoff && rebuildoff.querySelector(".liftoff-card");
+    const rebuildoffEls: any = rebuildoff
+      ? {
+          flight: rebuildoff.querySelector("[data-rebuildoff-flight]"),
+          outcome: rebuildoff.querySelector("[data-rebuildoff-outcome]"),
+          log: rebuildoff.querySelector("[data-rebuildoff-log]"),
+          live: rebuildoff.querySelector("[data-rebuildoff-live]"),
+          elapsed: rebuildoff.querySelector("[data-rebuildoff-elapsed]"),
+          hide: rebuildoff.querySelector("[data-rebuildoff-hide]"),
+          seal: rebuildoff.querySelector("[data-rebuildoff-seal]"),
+          outcomeTitle: rebuildoff.querySelector("[data-rebuildoff-outcome-title]"),
+          outcomeDetail: rebuildoff.querySelector("[data-rebuildoff-outcome-detail]"),
+          failure: rebuildoff.querySelector("[data-rebuildoff-failure]"),
+          failureDetail: rebuildoff.querySelector("[data-rebuildoff-failure-detail]"),
+          copy: rebuildoff.querySelector("[data-rebuildoff-copy]"),
+          done: rebuildoff.querySelector("[data-rebuildoff-done]"),
+        }
+      : null;
+    let rebuildoffTimer: any = null;
+    let rebuildoffOpenedFrom: any = null; // r12: return focus here on close
+    let rebuildFailureCopyText = "";
+    const rebuildLog = makeLogConsole(rebuildoffEls && rebuildoffEls.log);
+    const stopRebuildoffTimer = () => {
+      if (rebuildoffTimer) { clearInterval(rebuildoffTimer); rebuildoffTimer = null; }
+    };
+    const closeRebuildoff = () => {
+      stopRebuildoffTimer();
+      if (rebuildoff) rebuildoff.hidden = true;
+      if (rebuildoffOpenedFrom && document.contains(rebuildoffOpenedFrom)) rebuildoffOpenedFrom.focus();
+      rebuildoffOpenedFrom = null;
+    };
+    const showRebuildoffPhase = (phase?: any) => {
+      if (!rebuildoffEls) return;
+      rebuildoffEls.flight.hidden = phase !== "flight";
+      rebuildoffEls.outcome.hidden = phase !== "outcome";
+      if (rebuildoffCard) rebuildoffCard.dataset.mode = phase;
+    };
+    if (rebuildoffEls) {
+      rebuildoffEls.done.onclick = () => closeRebuildoff();
+      if (rebuildoffEls.hide) rebuildoffEls.hide.onclick = () => { rebuildoff.hidden = true; }; // stream keeps running
+      if (rebuildoffEls.copy) {
+        rebuildoffEls.copy.addEventListener("click", () => {
+          navigator.clipboard.writeText(rebuildFailureCopyText).then(
+            () => {
+              rebuildoffEls.copy.textContent = "Copied";
+              setTimeout(() => { rebuildoffEls.copy.textContent = "Copy for your AI agent"; }, 1600);
+            },
+            () => { /* clipboard denied — the detail is selectable text */ },
+          );
+        });
+      }
+    }
+
     const retryBuild = async (button?: any) => {
       if (!window.confirm(
         "Retry the build for " + (appDomain || repo) + "?\n\n" +
-          "  effect:  re-run the build + evidence check against the last merged\n" +
-          "           commit — no new merge, no membership change.\n\n" +
+          "  effect:  rebuild your next release and re-run its checks —\n" +
+          "           nothing new is added.\n\n" +
           "Proceed?",
       )) return;
       button.disabled = true;
+      rebuildoffOpenedFrom = button || null; // r12: return focus here on close
       aggregateRetrying = true; // rux7-style: hold disabled across a poll landing mid-retry
       setStatus(aggStatusEl, "Retrying the build…");
-      try {
-        const res = await fetch(ds.changesEndpoint + "/rebuild", {
-          method: "POST",
-          headers: { "content-type": "application/json", "x-tot-capability": "ship-on-behalf" },
-          body: JSON.stringify({ repo }),
-        });
-        const data = await res.json().catch(() => ({}));
-        if (res.ok && data.ok) {
-          setStatus(aggStatusEl, "Build retry passed — the aggregate is green.", "ok");
-        } else if (res.ok && data.reason === "nothing_to_rebuild") {
-          setStatus(aggStatusEl, "Nothing to rebuild — no prior integration attempt exists yet.");
-        } else if (res.ok) {
-          setStatus(
-            aggStatusEl,
-            "Build retry did not pass" +
-              (data.statusMessage ? ": " + data.statusMessage : " (" + (data.reason || data.queueState) + ")"),
-            "err",
-          );
-        } else {
-          setStatus(aggStatusEl, data.error || "Retry failed (" + res.status + ")", "err");
-        }
-      } catch {
-        setStatus(aggStatusEl, "Retry failed — network error", "err");
-      } finally {
-        aggregateRetrying = false;
-        button.disabled = false;
-        loadQueue();
+      const startedAt = Date.now();
+      if (rebuildoffEls) {
+        showRebuildoffPhase("flight");
+        rebuildLog.reset();
+        if (rebuildoffEls.failure) rebuildoffEls.failure.hidden = true;
+        rebuildoffEls.live.textContent = "Rebuilding your next release preview…";
+        rebuildoffEls.elapsed.textContent = "0:00";
+        rebuildoff.hidden = false;
+        stopRebuildoffTimer();
+        rebuildoffTimer = setInterval(() => {
+          const s = Math.floor((Date.now() - startedAt) / 1000);
+          rebuildoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
+        }, 1000);
       }
-    };
-
-    // U7 — retire/GC. Mirror of the accept plan affordance (decision
-    // operator-verb-and-hosting-model): state EXACTLY what retire does — evict the
-    // candidate's preview environment + immutable version — and that it is
-    // REBUILDABLE (degrades to "not built yet", not a 404), so an operator can't
-    // confuse it with Reject. Same shape as `tot retire`'s CLI plan for parity.
-    const buildRetirePlan = (change?: any) => {
-      const target = change.prNumber != null ? "PR #" + change.prNumber : change.changeId;
-      const lines = ["Retire plan:", "  tenant:    " + (appDomain || repo)];
-      if (change.prNumber != null) lines.push("  PR:        #" + change.prNumber);
-      lines.push("  change id: " + change.changeId);
-      if (change.headSha) lines.push("  head sha:  " + shortSha(change.headSha));
-      lines.push(
-        "  effect:    evict " + target + "'s preview environment + version to reclaim space.",
-      );
-      lines.push(
-        "  rebuild:   REVERSIBLE — rebuild it any time (this is NOT Reject; the change stays open).",
-      );
-      return lines.join("\n");
-    };
-
-    const retireChange = async (change?: any, button?: any) => {
-      if (!window.confirm(buildRetirePlan(change) + "\n\nProceed?")) return;
-      button.disabled = true;
-      busyChanges.add(change.changeId); // rux7: survive a poll re-render as busy
-      setStatus(statusEl, "Retiring " + change.changeId + "…");
+      const outcome = (state?: any, title?: any, detail?: any, failureDetail?: any) => {
+        stopRebuildoffTimer();
+        if (!rebuildoffEls) return;
+        rebuildoffEls.seal.dataset.state = state;
+        rebuildoffEls.outcomeTitle.textContent = title;
+        rebuildoffEls.outcomeDetail.textContent = detail;
+        if (rebuildoffEls.failure) {
+          if (failureDetail) {
+            rebuildoffEls.failure.hidden = false;
+            rebuildoffEls.failureDetail.textContent = failureDetail;
+          } else {
+            rebuildoffEls.failure.hidden = true;
+          }
+        }
+        if (rebuildoff.hidden) rebuildoff.hidden = false; // re-surface if backgrounded
+        showRebuildoffPhase("outcome");
+        rebuildoffEls.done.focus();
+      };
       try {
-        const res = await fetch(ds.retireEndpoint, {
+        const res = await fetch(ds.changesEndpoint + "/rebuild", {
           method: "POST",
           headers: {
             "content-type": "application/json",
-            // Mirror of the server-side capability model (UX); the server
-            // re-derives capability and stays authoritative.
+            // Real-time server-pushed progress (reading → publishing → checking) over
+            // SSE; falls back to buffered JSON for a non-streaming proxy.
+            accept: "text/event-stream",
             "x-tot-capability": "ship-on-behalf",
           },
-          body: JSON.stringify({
-            changeId: change.changeId,
-            pr: change.prNumber ?? undefined,
-          }),
+          body: JSON.stringify({ repo }),
         });
-        const data = await res.json().catch(() => ({}));
-        if (res.ok && data.ok) {
-          setStatus(
-            statusEl,
-            data.evicted
-              ? "Retired " + change.changeId + " — the preview was evicted (rebuildable on demand)."
-              : "Retire " + change.changeId + ": nothing to evict (already retired).",
+        const { data } = await streamWithLog(res, rebuildLog);
+        if (data.ok) {
+          setStatus(aggStatusEl, "Build retry passed — your next release is ready.", "ok");
+          outcome("ok", "Your next release is ready", "The rebuild passed all your store's checks. Nothing is live yet.");
+        } else if (data.reason === "nothing_to_rebuild") {
+          setStatus(aggStatusEl, "Nothing to rebuild — there's no earlier build to retry yet.");
+          outcome(
             "ok",
+            "Nothing to rebuild",
+            "There's no earlier preview build for this store to retry yet.",
           );
         } else {
-          setStatus(statusEl, data.error || "Retire failed (" + res.status + ")", "err");
+          const detail =
+            data.statusMessage || data.error || "your next release did not pass its checks (" + (data.reason || data.queueState) + ")";
+          setStatus(aggStatusEl, "Build retry did not pass: " + detail, "err");
+          rebuildFailureCopyText = [
+            "In my " + (appDomain || repo) + " store, retrying the preview build did not pass. " +
+              "Diagnose why from the detail below, then tell me the exact fix.",
+            "",
+            "What the rebuild reported:",
+            detail,
+            "\nContext: this re-runs ONLY the aggregate rebuild + combined evidence against the " +
+              "last merged commit on the shared `preview` branch — no new merge, no membership change.",
+          ].join("\n");
+          outcome("err", "The rebuild didn't pass", detail + " Your next release is unchanged.", detail);
+          surfaceDoctorHint((p) => shipFailureDoctor(p), [rebuildoffEls && rebuildoffEls.outcomeDetail, aggStatusEl]);
         }
       } catch {
-        setStatus(statusEl, "Retire failed — network error", "err");
+        setStatus(aggStatusEl, "Retry failed — network error", "err");
+        outcome(
+          "err",
+          "The rebuild didn't finish",
+          "Network error mid-rebuild — refresh the queue to see your next release's honest state.",
+        );
       } finally {
-        busyChanges.delete(change.changeId);
+        aggregateRetrying = false;
         button.disabled = false;
         loadQueue();
       }
     };
 
     // ---- rux5: build-on-demand for a synthetic not-built PR ------------------
-    // Mirror of the integrate/retire plan affordances: state EXACTLY what build
+    // Mirror of the integrate plan affordance: state EXACTLY what build
     // does — materialize this PR's hosted preview at its forge head — and that it
     // is INERT (flips no live channel). POSTs { pr, headSha?, baseSha? }; the row
     // already carries the head sha GET /api/changes resolved via forge PR-read, and
@@ -2171,63 +2891,269 @@ export function initAdminPublishTab(): void {
       return lines.join("\n");
     };
 
-    const buildPreview = async (change?: any, button?: any) => {
+    // ── Build-flight dialog (real-time SSE build/check progress) ─────────────
+    // Mirrors the accept liftoff's flight → outcome ceremony (same liftoff-* markup)
+    // but is driven by the phase events `POST /api/preview/build` streams over SSE.
+    // "Continue in background" hides the dialog while the stream keeps running; on a
+    // FAILURE the outcome shows the honest detail + a "Copy for your AI agent" button.
+    const buildoff: any = root.querySelector("[data-buildoff]");
+    const buildoffCard = buildoff && buildoff.querySelector(".liftoff-card");
+    const buildoffEls: any = buildoff
+      ? {
+          flight: buildoff.querySelector("[data-buildoff-flight]"),
+          outcome: buildoff.querySelector("[data-buildoff-outcome]"),
+          log: buildoff.querySelector("[data-buildoff-log]"),
+          flightTitle: buildoff.querySelector("[data-buildoff-flight-title]"),
+          live: buildoff.querySelector("[data-buildoff-live]"),
+          elapsed: buildoff.querySelector("[data-buildoff-elapsed]"),
+          hide: buildoff.querySelector("[data-buildoff-hide]"),
+          seal: buildoff.querySelector("[data-buildoff-seal]"),
+          outcomeTitle: buildoff.querySelector("[data-buildoff-outcome-title]"),
+          outcomeDetail: buildoff.querySelector("[data-buildoff-outcome-detail]"),
+          failure: buildoff.querySelector("[data-buildoff-failure]"),
+          failureDetail: buildoff.querySelector("[data-buildoff-failure-detail]"),
+          copy: buildoff.querySelector("[data-buildoff-copy]"),
+          review: buildoff.querySelector("[data-buildoff-review]"),
+          done: buildoff.querySelector("[data-buildoff-done]"),
+        }
+      : null;
+
+    let buildoffTimer: any = null;
+    let buildoffOpenedFrom: any = null;
+    let buildFailureCopyText = "";
+    const buildLog = makeLogConsole(buildoffEls && buildoffEls.log);
+    const stopBuildoffTimer = () => {
+      if (buildoffTimer) { clearInterval(buildoffTimer); buildoffTimer = null; }
+    };
+    const closeBuildoff = () => {
+      stopBuildoffTimer();
+      if (buildoff) buildoff.hidden = true;
+      if (buildoffOpenedFrom && document.contains(buildoffOpenedFrom)) buildoffOpenedFrom.focus();
+      buildoffOpenedFrom = null;
+    };
+    const showBuildoffPhase = (phase?: any) => {
+      if (!buildoffEls) return;
+      buildoffEls.flight.hidden = phase !== "flight";
+      buildoffEls.outcome.hidden = phase !== "outcome";
+      if (buildoffCard) buildoffCard.dataset.mode = phase;
+    };
+    const setBuildRail = (stageState?: any) => {
+      if (!buildoff) return;
+      BUILD_STAGES.forEach((s) => {
+        const el = buildoff.querySelector('[data-buildoff-stage="' + s + '"]');
+        if (el) el.dataset.state = stageState[s];
+      });
+    };
+    if (buildoffEls) {
+      // Copy-for-AI wiring (once): the honest failure brief for a coding agent.
+      buildoffEls.copy.addEventListener("click", () => {
+        navigator.clipboard.writeText(buildFailureCopyText).then(
+          () => {
+            buildoffEls.copy.textContent = "Copied";
+            setTimeout(() => { buildoffEls.copy.textContent = "Copy for your AI agent"; }, 1600);
+          },
+          () => { /* clipboard denied — the detail is selectable text */ },
+        );
+      });
+      buildoffEls.done.onclick = () => closeBuildoff();
+    }
+
+    // Stream the build over SSE, reflecting each phase on the flight rail. Falls back
+    // to a one-shot JSON read if the response wasn't an event-stream (a buffering
+    // proxy, or a server that doesn't stream) so the action always completes honestly.
+    const streamBuild = async (change?: any, button?: any) => {
       const label = "PR #" + change.prNumber;
-      if (!window.confirm(buildPreviewPlan(change) + "\n\nBuild the preview now?")) return;
-      button.disabled = true;
-      const originalText = button.textContent;
-      button.textContent = "Building…";
-      button.dataset.building = "true";
-      // rux7: record the in-flight build so a poll re-render preserves the
-      // spinner/disabled state on the freshly-rendered button (cleared in finally).
       if (change.prNumber != null) inflightBuilds.add(change.prNumber);
+      if (button) {
+        button.disabled = true;
+        button.dataset.building = "true";
+        button.textContent = "Building…";
+      }
       setStatus(statusEl, "Building preview for " + label + "…");
+
+      let progress: BuildProgress = initialBuildProgress();
+      if (buildoffEls) {
+        buildoffOpenedFrom = button || null;
+        buildoffEls.flightTitle.textContent = "Building preview for " + label;
+        setBuildRail(progress.stageState);
+        buildLog.reset();
+        buildoffEls.live.textContent = "Starting…";
+        buildoffEls.elapsed.textContent = "0:00";
+        if (buildoffEls.failure) buildoffEls.failure.hidden = true;
+        if (buildoffEls.review) buildoffEls.review.hidden = true;
+        showBuildoffPhase("flight");
+        buildoff.hidden = false;
+        const startedAt = Date.now();
+        stopBuildoffTimer();
+        buildoffTimer = setInterval(() => {
+          const s = Math.floor((Date.now() - startedAt) / 1000);
+          buildoffEls.elapsed.textContent = Math.floor(s / 60) + ":" + String(s % 60).padStart(2, "0");
+        }, 1000);
+        buildoffEls.hide.onclick = () => { buildoff.hidden = true; }; // stream keeps running
+        buildoffEls.done.onclick = () => closeBuildoff();
+      }
+
+      const applyEvent = (ev: any) => {
+        if (ev && ev.event === "phase") buildLog.pushEvent(ev);
+        progress = reduceBuildProgress(progress, ev);
+        if (buildoffEls) {
+          setBuildRail(progress.stageState);
+          buildoffEls.live.textContent = progress.liveLabel;
+        }
+      };
+
+      const renderOutcome = (result: BuildResult) => {
+        stopBuildoffTimer();
+        buildLog.finish(result as StreamTerminalResult);
+        if (result.ok) {
+          setStatus(
+            statusEl,
+            "Built preview for " + label + " — it now appears as a built change in the queue.",
+            "ok",
+          );
+        } else if (result.outcome === "blocked") {
+          setStatus(
+            statusEl,
+            "Build did not complete for " + label + ": " + (buildFailureDetail(result) || "blocked"),
+            "err",
+          );
+        } else {
+          setStatus(
+            statusEl,
+            (result.errors && result.errors.join("; ")) || result.error || "Build failed",
+            "err",
+          );
+        }
+        if (!buildoffEls) return;
+        if (result.ok) {
+          buildoffEls.seal.dataset.state = "ok";
+          buildoffEls.outcomeTitle.textContent = "Preview built";
+          buildoffEls.outcomeDetail.textContent =
+            label + " is materialized — it now appears as a built change in the queue, ready to review.";
+          if (buildoffEls.failure) buildoffEls.failure.hidden = true;
+          if (buildoffEls.review) {
+            if (result.previewUrl) {
+              buildoffEls.review.href = result.previewUrl;
+              buildoffEls.review.hidden = false;
+            } else {
+              buildoffEls.review.hidden = true;
+            }
+          }
+        } else {
+          buildoffEls.seal.dataset.state = "err";
+          buildoffEls.outcomeTitle.textContent =
+            result.outcome === "blocked" ? "A check blocked this build" : "The build didn't finish";
+          buildoffEls.outcomeDetail.textContent =
+            result.outcome === "blocked"
+              ? label + " built, but a check blocked it. Here's exactly what stopped it — copy it for your AI agent to fix:"
+              : label + " couldn't be built. Here's what the build reported — copy it for your AI agent to diagnose:";
+          if (buildoffEls.review) buildoffEls.review.hidden = true;
+          buildFailureCopyText = assembleBuildFailureCopy({
+            tenant: appDomain || repo,
+            prNumber: change.prNumber,
+            changeId: change.changeId,
+            result,
+          });
+          if (buildoffEls.failure) {
+            buildoffEls.failure.hidden = false;
+            buildoffEls.failureDetail.textContent = buildFailureDetail(result) || "(no detail was reported)";
+          }
+          // Re-surface the dialog if it was dismissed to the background — a failure
+          // needs the operator's eyes, unlike a clean success they already walked away from.
+          if (buildoff.hidden) buildoff.hidden = false;
+        }
+        showBuildoffPhase("outcome");
+        if (!buildoff.hidden) buildoffEls.done.focus();
+      };
+
       try {
         const res = await fetch(ds.buildEndpoint, {
           method: "POST",
           headers: {
             "content-type": "application/json",
+            accept: "text/event-stream",
             // Mirror of the server-side capability model (UX); the server
             // re-derives capability (buildGate) and stays authoritative.
             "x-tot-capability": "ship-on-behalf",
           },
           body: JSON.stringify({
             pr: change.prNumber,
+            // A row for an ALREADY-KNOWN candidate must carry its real changeId, or
+            // the server falls back to synthesizing "pr-<N>" and writes/reads a
+            // SEPARATE phantom record — the real candidate's ReviewEnvironment never
+            // advances no matter how many times "Run checks" is clicked. Omit it only
+            // for a genuinely not-yet-built row (change.changeId is null there).
+            changeId: change.changeId || undefined,
             headSha: change.headSha || undefined,
             baseSha: change.baseSha || undefined,
           }),
         });
-        const data = await res.json().catch(() => ({}));
-        if (res.ok && data.ok) {
-          setStatus(
-            statusEl,
-            "Built preview for " + label +
-              " — it now appears as a built change in the queue.",
-            "ok",
-          );
-        } else if (data && data.ok === false) {
-          // reconcileCandidate returned a blocked/failed candidate (e.g. a safety
-          // finding with no override) — the honest reason, never a false success.
-          setStatus(
-            statusEl,
-            "Build did not complete for " + label + ": " +
-              ((data.errors && data.errors.join("; ")) || data.error || "blocked"),
-            "err",
-          );
+        const ct = res.headers.get("content-type") || "";
+        if (res.body && ct.indexOf("text/event-stream") !== -1) {
+          const reader = res.body.getReader();
+          const decoder = new TextDecoder();
+          let buf = "";
+          for (;;) {
+            const { value, done } = await reader.read();
+            if (done) break;
+            buf += decoder.decode(value, { stream: true });
+            const parsed = parseSseChunk(buf);
+            buf = parsed.rest;
+            for (const ev of parsed.events) applyEvent(ev);
+            if (progress.terminal) break;
+          }
+          if (!progress.terminal) {
+            // Stream ended without a terminal result — treat as an honest failure.
+            applyEvent({
+              event: "result",
+              data: JSON.stringify({ ok: false, outcome: "failed", errors: ["the build stream ended unexpectedly"] }),
+            });
+          }
+          renderOutcome(progress.result as BuildResult);
         } else {
-          setStatus(statusEl, data.error || "Build failed (" + res.status + ")", "err");
+          // Non-streaming fallback: read the JSON body the endpoint returns to
+          // non-streaming callers and normalize it into the same outcome shape.
+          const data = await res.json().catch(() => ({}) as any);
+          renderOutcome({
+            ok: !!data.ok,
+            outcome: data.outcome || (data.ok ? "ok" : res.status === 422 ? "blocked" : "failed"),
+            tenantId: data.tenantId,
+            changeId: data.changeId,
+            headSha: data.headSha,
+            previewUrl: data.previewUrl,
+            errors: data.errors,
+            error: data.error,
+            findings: data.findings,
+          });
         }
       } catch {
         setStatus(statusEl, "Build failed — network error", "err");
+        if (buildoffEls) {
+          stopBuildoffTimer();
+          buildoffEls.seal.dataset.state = "err";
+          buildoffEls.outcomeTitle.textContent = "The build didn't finish";
+          buildoffEls.outcomeDetail.textContent =
+            "Network error mid-build — refresh the queue to see the honest state.";
+          if (buildoffEls.failure) buildoffEls.failure.hidden = true;
+          if (buildoffEls.review) buildoffEls.review.hidden = true;
+          if (buildoff.hidden) buildoff.hidden = false;
+          showBuildoffPhase("outcome");
+        }
       } finally {
         if (change.prNumber != null) inflightBuilds.delete(change.prNumber);
-        button.disabled = false;
-        button.textContent = originalText;
-        delete button.dataset.building;
+        if (button) {
+          button.disabled = false;
+          delete button.dataset.building;
+        }
         loadQueue();
       }
     };
 
+    const buildPreview = async (change?: any, button?: any) => {
+      if (!window.confirm(buildPreviewPlan(change) + "\n\nBuild the preview now?")) return;
+      await streamBuild(change, button);
+    };
+
     // ---- rux6: unified review pane -----------------------------------------
     // "One review moment": expanding a candidate row reveals a single pane with
     // the live preview (iframed SAME-ORIGIN — the /<tenant>/preview/pr/<N> route
@@ -2264,12 +3190,14 @@ export function initAdminPublishTab(): void {
       const checks = (change.evidence && change.evidence.checks) || [];
       const promotable = Boolean(change.evidence && change.evidence.promotable);
       container.append(
-        promotable ? chip("Checks passed", "green") : chip("Checks blocked", "amber"),
+        promotable
+          ? chip("Checks passed", "green", CHIP_GLYPH.green)
+          : chip("Checks blocked", "amber", CHIP_GLYPH.amber),
       );
       for (const c of checks) {
         const tone = c.status === "pass" ? "green" : c.status === "fail" ? "red" : "amber";
         const label = (c.label || c.id || "check") + (c.status && c.status !== "pass" ? " · " + c.status : "");
-        const el = chip(label, tone);
+        const el = chip(label, tone, CHIP_GLYPH[tone]);
         if (c.detail) el.title = c.detail;
         container.append(el);
       }
@@ -2320,6 +3248,30 @@ export function initAdminPublishTab(): void {
       const detailCol = document.createElement("div");
       detailCol.className = "review-detail";
 
+      const summaryValues = [
+        ["Intent", change.intent],
+        ["User-visible effect", change.description],
+        ["Verification", change.verification],
+        ["Risk / rollback", change.riskRollback],
+      ].filter((entry) => typeof entry[1] === "string" && entry[1].trim());
+      if ((typeof change.title === "string" && change.title.trim()) || summaryValues.length) {
+        const summarySection = document.createElement("div");
+        summarySection.className = "review-section";
+        const summaryTitle = document.createElement("b");
+        summaryTitle.textContent = change.title && change.title.trim()
+          ? change.title.trim()
+          : "About this change";
+        summarySection.append(summaryTitle);
+        for (const [label, value] of summaryValues) {
+          const line = document.createElement("div");
+          const labelEl = document.createElement("strong");
+          labelEl.textContent = label + ": ";
+          line.append(labelEl, document.createTextNode(value.trim()));
+          summarySection.append(line);
+        }
+        detailCol.append(summarySection);
+      }
+
       const evSection = document.createElement("div");
       evSection.className = "review-section";
       const evTitle = document.createElement("b");
@@ -2352,18 +3304,33 @@ export function initAdminPublishTab(): void {
         change.status === "ready" &&
         Boolean(change.evidence && change.evidence.promotable) &&
         change.mergeable === false;
-      accept.textContent = needsPreviewUpdate ? "Update change" : "Accept to preview";
-      accept.disabled = !canShip || (!needsPreviewUpdate && !change.mergeable);
-      accept.title = !canShip
-        ? "Requires a ship-on-behalf grant on your account — ask the store owner"
-        : needsPreviewUpdate
-          ? "Preview changed while you worked — update this change, then integrate it"
-          : !change.mergeable
-            ? "This change is not ready to integrate"
-            : "Integrate this change into the preview aggregate (does not go live)";
-      accept.addEventListener("click", () =>
-        needsPreviewUpdate ? openConflictRecovery(change, accept) : integrateCandidate(change, accept),
-      );
+      const needsChecks = !Boolean(change.evidence && change.evidence.promotable) &&
+        (change.status === "queued" || change.status === "reconciling");
+      if (needsChecks) {
+        const build = document.createElement("button");
+        build.type = "button";
+        build.className = "btn primary";
+        build.textContent = "Run checks";
+        build.disabled = !canShip || (change.prNumber != null && inflightBuilds.has(change.prNumber));
+        build.title = "Re-run this PR's preview build and checks (does not merge or go live)";
+        build.addEventListener("click", () => buildPreview(change, build));
+        actionRow.append(build);
+      }
+      // Only ONE primary action at a time — see the queue-row fix above.
+      if (!needsChecks) {
+        accept.textContent = needsPreviewUpdate ? "Update change" : "Add to release";
+        accept.disabled = !canShip || (!needsPreviewUpdate && !change.mergeable);
+        accept.title = !canShip
+          ? "Requires a ship-on-behalf grant on your account — ask the store owner"
+          : needsPreviewUpdate
+            ? "Preview changed while you worked — update this change, then add it"
+            : !change.mergeable
+              ? "This change isn't ready to add yet"
+              : "Add this change to your next release (doesn't go live yet)";
+        accept.addEventListener("click", () =>
+          needsPreviewUpdate ? openConflictRecovery(change, accept) : integrateCandidate(change, accept),
+        );
+      }
       const reject = document.createElement("button");
       reject.type = "button";
       reject.className = "btn";
@@ -2373,7 +3340,7 @@ export function initAdminPublishTab(): void {
         ? "Close this change without publishing"
         : "Requires an owner or admin sign-in";
       reject.addEventListener("click", () => rejectChange(change, reject));
-      actionRow.append(accept, reject);
+      actionRow.append(...(needsChecks ? [] : [accept]), reject);
       detailCol.append(actionRow);
 
       pane.append(previewCol, detailCol);
@@ -2439,6 +3406,7 @@ export function initAdminPublishTab(): void {
 
       // Authority: honest label of whether the diff describes the exact head.
       const authority = diff.authority || {};
+      const authTone = authority.authoritative ? "green" : authority.stale ? "amber" : "";
       const authChip = chip(
         authority.authoritative
           ? "Reviewed at head"
@@ -2447,7 +3415,8 @@ export function initAdminPublishTab(): void {
             : authority.missing
               ? "No evidence yet"
               : "Head",
-        authority.authoritative ? "green" : authority.stale ? "amber" : "",
+        authTone,
+        CHIP_GLYPH[authTone],
       );
       head.append(authChip);
 
@@ -2472,7 +3441,7 @@ export function initAdminPublishTab(): void {
         const reason = document.createElement("p");
         reason.className = "note publish-diff-blocked";
         reason.textContent =
-          diff.blockedReason || "This candidate has no renderable version to diff yet.";
+          diff.blockedReason || "This change has no preview to compare yet.";
         td.append(reason);
         return;
       }
@@ -2512,6 +3481,43 @@ export function initAdminPublishTab(): void {
     // Hosted and static-publish stores both render the same instant "Roll back" UX
     // below — every rollback is an instant KV pointer flip.
 
+    // r10: the post-publish "Undo" deep-link. focusRollbackTarget stashes the
+    // version-id to undo, opens the Live Site + Rollback disclosures, forces a fresh
+    // versions read, and scrolls the panel into view; renderVersions then applies the
+    // pending focus once that row exists (applyRollbackFocus) — highlighting it and
+    // focusing its "Roll back" button so the operator lands pre-targeted.
+    let pendingRollbackFocus: string | null = null;
+    const openLiveSiteRollback = () => {
+      const liveSite: any = root.querySelector(".live-site-details");
+      if (liveSite) liveSite.open = true;
+      const versionsDetails: any = versionsPanel && versionsPanel.querySelector(".versions-details");
+      if (versionsDetails) versionsDetails.open = true;
+    };
+    const applyRollbackFocus = () => {
+      if (!pendingRollbackFocus || !versionsBody) return;
+      let target: any = null;
+      versionsBody.querySelectorAll("tr[data-version-id]").forEach((r: any) => {
+        if (r.dataset.versionId === pendingRollbackFocus) target = r;
+      });
+      if (!target) return; // not rendered yet — a pending fetch will re-run this
+      pendingRollbackFocus = null;
+      target.scrollIntoView({ block: "center", behavior: "smooth" });
+      target.classList.remove("publish-row-highlight");
+      void target.offsetWidth; // restart the flash if re-applied
+      target.classList.add("publish-row-highlight");
+      window.setTimeout(() => target.classList.remove("publish-row-highlight"), 2600);
+      const btn: any = target.querySelector("button");
+      if (btn) btn.focus();
+    };
+    const focusRollbackTarget = (versionId?: string) => {
+      if (!versionId) return;
+      pendingRollbackFocus = versionId;
+      openLiveSiteRollback();
+      loadVersions({ force: true }); // fresh read: the replaced version is now a prior row
+      const panel = document.getElementById("publish-live-site");
+      if (panel) panel.scrollIntoView({ block: "start", behavior: "smooth" });
+    };
+
     const renderVersions = (view?: any) => {
       if (!versionsBody) return;
       const versions = Array.isArray(view.versions) ? view.versions : [];
@@ -2535,7 +3541,12 @@ export function initAdminPublishTab(): void {
 
       if (!versions.length) {
         const tr = document.createElement("tr");
-        const td = cell(subtle("No versions have been promoted to live yet."));
+        const td = cell(
+          subtle(
+            "Nothing published yet. When you publish your next release it becomes your first live " +
+              "version — and any earlier versions you can roll back to will appear here.",
+          ),
+        );
         td.colSpan = 6;
         tr.append(td);
         versionsBody.append(tr);
@@ -2544,14 +3555,33 @@ export function initAdminPublishTab(): void {
 
       for (const v of versions) {
         const tr = document.createElement("tr");
-
-        // Version identity: the tenant Gitea SHA (content authority) + source.
+        // r10: tag the row with its version id so the post-publish "Undo" can deep-
+        // link straight to the replaced version's rollback row (applyRollbackFocus).
+        tr.dataset.versionId = v.versionId;
+
+        // Version identity: the merchant-facing "v42" counter is the primary label;
+        // the tenant Gitea SHA is demoted to a "Technical details" disclosure below
+        // (r02 — a raw SHA is meaningless to a merchant). Falls back to the short SHA
+        // only when a version carries no number (an unpromoted seed), never faked.
         const idCell = document.createElement("td");
         const strong = document.createElement("strong");
-        strong.className = "publish-mono";
-        strong.textContent = shortSha(v.versionId);
+        // r11 — the human release name leads when present; the "v42" counter falls
+        // back when it's null (and rides along as a subtle secondary when a name shows).
+        const releaseName = v.name || null;
+        strong.textContent = releaseName || (v.number != null ? "v" + v.number : shortSha(v.versionId));
         idCell.append(strong);
+        if (releaseName && v.number != null) idCell.append(subtle("v" + v.number));
         if (v.source) idCell.append(subtle(v.source === "commit" ? "From a commit" : "Content hash"));
+        const tech = document.createElement("details");
+        tech.className = "ver-tech";
+        const techSummary = document.createElement("summary");
+        techSummary.textContent = "Technical details";
+        tech.append(techSummary);
+        const shaSpan = document.createElement("span");
+        shaSpan.className = "publish-mono subtle";
+        shaSpan.textContent = shortSha(v.versionId);
+        tech.append(shaSpan);
+        idCell.append(tech);
 
         // "What shipped" — the SAME human summary the staged Publish console shows,
         // now describing the RELEASE: a plain-language lead + an openable list of the
@@ -2621,7 +3651,13 @@ export function initAdminPublishTab(): void {
         tr.append(revCell);
 
         // State: current live vs prior.
-        tr.append(cell(v.isCurrent ? chip("Current live", "green") : chip("Prior", "")));
+        tr.append(
+          cell(
+            v.isCurrent
+              ? chip("Current live", "green", CHIP_GLYPH.green)
+              : chip("Prior", "", CHIP_GLYPH[""]),
+          ),
+        );
 
         // Action: roll back to a PRIOR version (never the current one).
         const act = document.createElement("td");
@@ -2642,6 +3678,10 @@ export function initAdminPublishTab(): void {
 
         versionsBody.append(tr);
       }
+
+      // r10: land a pending post-publish "Undo" on the replaced version's row now
+      // that the rows exist.
+      applyRollbackFocus();
     };
 
     // Published versions only change when something is published, which moves the
@@ -2776,8 +3816,8 @@ export function initAdminPublishTab(): void {
           : "Previous host (pantheon)";
       }
       if (stateChip) {
-        stateChip.textContent = connected ? "Connected" : "Not connected";
-        stateChip.className = "chip " + (connected ? "green" : "amber");
+        const tone = connected ? "green" : "amber";
+        paintChip(stateChip, connected ? "Connected" : "Not connected", tone, CHIP_GLYPH[tone]);
       }
       if (sinceEl) {
         sinceEl.textContent = domain.since
@@ -2875,8 +3915,8 @@ export function initAdminPublishTab(): void {
 
       const chip = readinessBox.querySelector("[data-domain-readiness-chip]");
       if (chip) {
-        chip.textContent = domainReady ? "Ready" : "Not ready";
-        chip.className = "chip " + (domainReady ? "green" : "amber");
+        const tone = domainReady ? "green" : "amber";
+        paintChip(chip, domainReady ? "Ready" : "Not ready", tone, CHIP_GLYPH[tone]);
       }
       const list = readinessBox.querySelector("[data-domain-readiness-list]");
       if (list) {
@@ -3040,8 +4080,8 @@ export function initAdminPublishTab(): void {
         "  classification: " + row.classificationLabel,
         "  reason:         " + row.reason,
         "",
-        "This deletes the Git BRANCH only — it never evicts a hosted preview build",
-        "(that is Retire, a separate action above). The server re-classifies this",
+        "This deletes the Git BRANCH only. Reject already closes the PR and removes",
+        "its hosted candidate artifacts. The server re-classifies this",
         "branch fresh before deleting; a moved tip or a branch that is no longer",
         "integrated/closed-or-rejected is refused, not silently skipped.",
       ].join("\n");
@@ -3065,6 +4105,33 @@ export function initAdminPublishTab(): void {
       return { ok: res.ok && data.ok, status: res.status, data };
     };
 
+    // Old branches should clean themselves up — a non-developer shouldn't need to
+    // find and click "Sweep dead branches" for routine housekeeping. Runs silently
+    // (no confirm dialog, no visible status) after a successful accept/publish;
+    // the manual sweep in the advanced panel below still exists for anyone who
+    // wants to trigger or inspect it directly.
+    const autoSweepBranches = async () => {
+      if (!canShip) return;
+      try {
+        const res = await fetch(ds.branchesEndpoint, { headers: { accept: "application/json" } });
+        if (!res.ok) return;
+        const view = await res.json().catch(() => null);
+        if (!view) return;
+        const rows = Array.isArray(view.rows) ? view.rows : [];
+        const sweepable = Array.isArray(view.sweepableRefs) ? view.sweepableRefs : [];
+        if (!sweepable.length) return;
+        const rowsByRef = new Map<string, any>(rows.map((r: any): [string, any] => [r.ref, r]));
+        for (const ref of sweepable) {
+          const row = rowsByRef.get(ref);
+          if (!row) continue;
+          await postDeleteRef(row.ref, row.sha).catch(() => {});
+        }
+        loadBranches(); // refresh the advanced panel if it happens to be open
+      } catch {
+        // Best-effort — a manual sweep in the advanced panel still works.
+      }
+    };
+
     const cleanupBranch = async (row?: any, button?: any) => {
       if (!window.confirm(buildCleanupPlan(row) + "\n\nDelete this branch?")) return;
       button.disabled = true;
@@ -3433,6 +4500,44 @@ export function initAdminPublishTab(): void {
     // IntersectionObserver is the single visibility signal — a panel inside a
     // hidden admin-tab (display:none) never intersects, so nothing fetches until
     // the operator opens the Publish tab and scrolls the panel into view.
+    // r05 — restore each collapsible section's open/closed state from localStorage
+    // (per store, so one store's layout never bleeds into another) and persist it on
+    // every toggle. When nothing is stored the section keeps its SSR default. Native
+    // <details> carry no aria-expanded of their own, so we mirror it onto the summary
+    // and keep it in sync — a later a11y bundle asserts against it.
+    const setupCollapsePersistence = () => {
+      let storage: Storage | null;
+      try {
+        storage = typeof window !== "undefined" ? window.localStorage : null;
+      } catch {
+        storage = null; // localStorage access can throw (private mode / disabled)
+      }
+      const sections: Array<{ id: CollapseSectionId; selector: string }> = [
+        { id: "review-queue", selector: ".publish-queue-details" },
+        { id: "closed-changes", selector: ".closed-changes-details" },
+        { id: "next-release", selector: ".agg-console-details" },
+        { id: "live-site", selector: ".live-site-details" },
+        { id: "rollback", selector: ".versions-details" },
+      ];
+      for (const { id, selector } of sections) {
+        const details: any = root.querySelector(selector);
+        if (!details) continue;
+        const summary = details.querySelector("summary");
+        const syncAria = () => {
+          if (summary) summary.setAttribute("aria-expanded", details.open ? "true" : "false");
+        };
+        if (storage) {
+          const stored = readPersistedOpen(storage, appDomain, id);
+          if (stored !== null) details.open = stored; // otherwise keep the SSR default
+        }
+        syncAria();
+        details.addEventListener("toggle", () => {
+          if (storage) writePersistedOpen(storage, appDomain, id, details.open);
+          syncAria();
+        });
+      }
+    };
+
     const revealDomainOnce = (() => {
       let done = false;
       return () => {
@@ -3515,5 +4620,6 @@ export function initAdminPublishTab(): void {
       }
     });
 
+    setupCollapsePersistence();
     observeVisibility();
 }