@tokenoftrust/storefront-runner 2.0.2 → 2.0.4

package/apps/storefront/src/components/admin/AdminPublishTab.astro

@@ -1,2983 +0,0 @@
----
-/**
- * Publish tab — the go-live surface (handoffs 2026-08-05-admin-golive-surface
- * + 2026-08-05-domain-connect-ux). Replaces the terminal runbook for a
- * permissioned operator:
- *
- *   - OPEN CHANGE QUEUE from GET /api/changes ({ current, changes }) with
- *     per-change reconcile/compliance state, preview link, head sha, and age.
- *   - ACCEPT TO PREVIEW (POST /api/changes/integrate — the accept-to-preview
- *     split; advances the shared `preview` aggregate, does NOT go live) and
- *     REJECT (with a note) per change. Going live is the aggregate card's
- *     exact-digest PUBLISH (POST /api/changes/ship), never a per-change accept.
- *   - LIVE STATE: the current live version (live-channel pointer) + the
- *     static-republish dispatch status for static-publish tenants (fired /
- *     skipped / sink-unbound notice).
- *   - DOMAIN section (static-publish tenants): apex connect + rollback via the
- *     www-domain dispatch endpoints — typed-confirmation connect (owner-only),
- *     always-visible rollback with the captured-records timestamp, in-flight
- *     run + legible failures.
- *
- * PERMISSIONS (server-authoritative; mirrored here for UX only):
- *   - Ship actions require an owner/admin session (`resolveOwnerSession`'s
- *     OWNER_CAPABILITIES) — others see the queue read-only with a sign-in note.
- *   - Non-premium tenants see the go-live control as a PAYWALL UPSELL — never
- *     hidden, never "coming soon" (recorded product direction). The
- *     entitlement signal is the existing premium model: a custom-domain
- *     tenant is premium/pilot; a `<label>.tokenoftrust.store` self-serve store
- *     is not. TODO(paywall workstream): replace with the real billing
- *     entitlement when one exists.
- */
-import { readViewerSession } from "@/lib/auth/route";
-import { withBase } from "@/lib/basePath";
-import { readEnv } from "@/lib/env";
-import { resolveViewerShipCapability } from "@/lib/change";
-import { resolveLiveVersion } from "@/lib/change/views/live-version";
-import { isPublicSiteCurrent, staticLiveManifestUrl } from "@/lib/change/views/live-digest";
-import { isHostedStoreDomain, isInternalTestTenant } from "@tot/public-runtime";
-import { mintPreviewShareToken } from "@/lib/preview/previewShareLink";
-
-const { envelope } = Astro.props;
-const { tenant, basePath } = Astro.locals;
-
-// Viewer capability, mirrored from the same session model the API routes gate
-// on (resolveOwnerSession admits capability owner|admin). UX-only: the server
-// re-authorizes every action. Checked against `envelope.targetTenant`, not the
-// routed `tenant.appDomain` — a ToT-staff viewer operating a store other than
-// the one that served this admin route must be checked against the tenant
-// they SELECTED, else a real grant on the selected tenant reads as "none".
-const viewerSession = await readViewerSession(Astro);
-// Session capability counts only when the session's resource IS the selected tenant.
-const sessionCapability =
-  viewerSession && viewerSession.resource === envelope.targetTenant
-    ? viewerSession.capability
-    : undefined;
-const viewerCapability =
-  Astro.locals.viewer?.capability ?? sessionCapability ?? "none";
-// A signed-in DEVELOPER (not owner/admin) may hold an explicit, owner-revocable
-// ship-on-behalf grant. Resolve it LIVE from the MCP subject-capability store —
-// NEVER the coarse role, NEVER a client header — so a ship-granted developer sees
-// the queue + Go-live/Reject. This MIRRORS the server (resolveShipSession /
-// effectiveShipCapability); the server re-authorizes every action. UX-only.
-let viewerCanShip = viewerCapability === "owner" || viewerCapability === "admin";
-if (!viewerCanShip && Astro.locals.viewer?.email) {
-  const shipGrant = await resolveViewerShipCapability(
-    Astro.locals.viewer.email,
-    envelope.targetTenant,
-  );
-  if (shipGrant === "ship-on-behalf") viewerCanShip = true;
-}
-const viewerIsOwner = viewerCapability === "owner";
-// Apex/domain cutover is granted to owner OR admin (decision: apex-cutover =
-// owner+admin). This MIRRORS the server, whose `apexCutover` = `isOwner` over
-// OWNER_CAPABILITIES {owner, admin} (see change/route.ts decideIsOwner +
-// change/shipCapabilities.ts) — this UI gate was wrongly owner-only, stricter
-// than the gate the server actually enforces. UX-only: the server re-authorizes.
-const viewerCanApexCutover = viewerCapability === "owner" || viewerCapability === "admin";
-
-// Entitlement: the existing premium signal (custom-domain tenant = premium).
-// TODO(paywall workstream): swap for the real billing entitlement.
-const goLiveEntitled = !isHostedStoreDomain(tenant.appDomain);
-const internalTestTenant = isInternalTestTenant(tenant);
-
-const staticPublishEnabled = Boolean(
-  tenant.staticPublish && tenant.staticPublish.enabled !== false,
-);
-// Presence-only signal for the dispatch sink (never the value).
-const dispatchConfigured = Boolean((await readEnv("WWW_PUBLISH_DISPATCH_TOKEN"))?.trim());
-
-// "What does the public site actually serve right now?" — the read-back half of
-// the static-publish seam (resolveLiveVersion's staticLiveDigest), computed here
-// so it's ALWAYS visible rather than only living in GET /api/changes JSON. This is
-// the exact gap that can let tokenoftrust.com's published public site
-// sit two days stale behind several accepted-but-unpublished changes with nothing
-// in the console calling it out — going live and staying live for the PUBLIC
-// static target are two different facts, and this card makes the second one
-// honest instead of assumed. Best-effort: resolveLiveVersion never throws.
-// BUDGETED: resolveLiveVersion chains several TENANT_CACHE reads (resolvePreviewTenant,
-// resolveChannelVersion, readSiteVersion) that are pathologically slow + variable on the
-// preview worker (measured 2-10s EACH, spiking together — a KV/storage-latency issue, not
-// this code). It runs in blocking SSR frontmatter, so it gated the whole admin document
-// stream. It's best-effort display chrome ("what does live/ serve right now"), and the
-// client-side GET /api/changes already returns `current`, so cap it: on timeout the card
-// renders from the client fetch instead of blocking first paint.
-const liveVersion = staticPublishEnabled
-  ? await Promise.race([
-      resolveLiveVersion(tenant.appDomain),
-      new Promise<null>((resolve) => setTimeout(() => resolve(null), 1500)),
-    ])
-  : null;
-const publicSiteDigest = liveVersion?.staticLiveDigest ?? null;
-// The actual verdict: does the public target's manifest sha match what was last
-// promoted to "live" here? Both are real tenant Gitea shas — a direct,
-// honest comparison, not a heuristic. See liveDigest.ts's isPublicSiteCurrent.
-const publicSiteVerdict = publicSiteDigest
-  ? isPublicSiteCurrent(liveVersion?.versionId ?? null, publicSiteDigest)
-  : null;
-
-const changesEndpoint = withBase(basePath || "", "/api/changes");
-// The branch-integration lifecycle SPLIT of accept from publish:
-//   - integrateEndpoint = "accept = integrate into the protected preview
-//     aggregate" (POST /api/changes/integrate → TenantIntegrationQueue.enqueue).
-//     This is the candidate-queue "Accept to preview" action — it advances the
-//     shared aggregate, it does NOT go live. Returns an IntegrateOutcome
-//     (queueState/runState/statusMessage), never a bare merged:true.
-//   - shipEndpoint = the exact-digest go-live (POST /api/changes/ship →
-//     AggregateShipOrchestrator.plan/ship). The aggregate card's "Publish"
-//     action: it ships the reviewed pinned SHA + digest, double-gated
-//     (paywall + human confirm). The read-only plan is served on GET /api/changes
-//     (`plan`), so the confirm surface never has to POST to preview it.
-const integrateEndpoint = withBase(basePath || "", "/api/changes/integrate");
-const shipEndpoint = withBase(basePath || "", "/api/changes/ship");
-// Build-on-demand for a synthetic not-built PR row: materialize the PR's
-// hosted preview (INERT — flips no live channel). Gated server-side by buildGate
-// (the ship-on-behalf floor); the endpoint resolves the head sha via forge PR-read
-// when the row supplies only the PR number.
-const buildEndpoint = withBase(basePath || "", "/api/preview/build");
-// The ship-operations workspace woven into this tab: versions/promotion
-// history, per-candidate diff, and rollback (through the ONE rollback
-// orchestrator). Read endpoints mirror the change-queue's auth/scope.
-const versionsEndpoint = withBase(basePath || "", "/api/changes/versions");
-const rollbackEndpoint = withBase(basePath || "", "/api/changes/rollback");
-// Branch retention: GET dry-run classification / POST guarded delete.
-const branchesEndpoint = withBase(basePath || "", "/api/changes/branches");
-// The client builds `${diffEndpointBase}/<changeId>/diff` per candidate.
-const diffEndpointBase = changesEndpoint;
-// The live store's root on THIS surface (basePath-aware): where the published
-// digest actually serves. Rendered into "already live" copy + the publish
-// ceremony's "View your live store" CTA.
-const liveHref = withBase(basePath || "", "/");
-
-// LIVE-SITE ENTRY POINTS — surfaced explicitly so "where does my store actually
-// serve?" is never a mystery (it was). Two public URLs, always shown + clickable:
-//   1. Hosted store — THIS worker at the request host + tenant base path
-//      (e.g. storefront.tokenoftrust.store/tokenoftrust.com/).
-//   2. Public site — the static target's canonical URL, derived from the SAME
-//      manifest URL the freshness read-back probes (WWW_PUBLISH_VERIFY_URL or
-//      https://<canonicalDomain>/manifest.json), minus the /manifest.json tail
-//      (e.g. published.tokenoftrust.com). Only for static-publish tenants; a
-//      hosted-only tenant has no separate public site. Computed PURELY (no probe)
-//      so the URL shows even when the freshness probe above timed out.
-const requestHost = Astro.request.headers.get("host") ?? Astro.url.host;
-const liveStoreUrl = `${Astro.url.protocol}//${requestHost}${liveHref}`;
-const publicManifestUrl = staticPublishEnabled
-  ? staticLiveManifestUrl({
-      canonicalDomain: tenant.canonicalDomain,
-      // Per-tenant override first (never bleeds across stores), then the global env
-      // escape hatch, then the canonical-apex default — mirrors resolveLiveVersion.
-      explicitUrl: tenant.staticPublish?.verifyUrl ?? (await readEnv("WWW_PUBLISH_VERIFY_URL")) ?? null,
-    })
-  : null;
-const publicSiteUrl = publicManifestUrl
-  ? publicManifestUrl.replace(/\/manifest\.json$/, "/")
-  : null;
-const stripScheme = (u: string): string => u.replace(/^https?:\/\//, "");
-
-// r08 — a signed, tenant-scoped, expiring `?__preview` capability link an owner can
-// copy and hand to a non-technical stakeholder (view-only, no sign-in required).
-// Minted server-side so the signing secret never reaches the browser (mirrors
-// preview/dashboard.astro). Signs the tenant_id claim: the shared-preview
-// middleware verifies against `tenant.tenant_id` and the candidate renderer accepts
-// tenant_id too, so ONE token authorizes BOTH the shared next-release preview AND
-// per-candidate `preview/pr/<N>` links. Only minted for a ship-capable viewer, and
-// absent when signing isn't configured — the copy buttons then stay hidden rather
-// than offering a dead link. TTL 24h so a link copied late in a long session still
-// works; a reload re-mints a fresh one.
-const previewShareToken = viewerCanShip ? await mintPreviewShareToken(tenant.tenant_id) : null;
-
-const domainStatusEndpoint = withBase(basePath || "", "/api/domain/status");
-const domainDispatchEndpoint = withBase(basePath || "", "/api/domain/dispatch");
-// The machine-verifiable apex-cutover readiness gate — the SAME server gate the
-// `tot go-live` CLI reads, so the admin display and the CLI never diverge.
-const domainReadinessEndpoint = withBase(basePath || "", "/api/domain/readiness");
----
-
-<!-- agent-hook:publish-tab -->
-<section
-  id="publish"
-  class="band publish-tab"
-  aria-labelledby="admin-tab-publish publish-title"
-  data-admin-panel
-  data-agent-scope="publish"
-  role="tabpanel"
-  data-changes-endpoint={changesEndpoint}
-  data-integrate-endpoint={integrateEndpoint}
-  data-ship-endpoint={shipEndpoint}
-  data-build-endpoint={buildEndpoint}
-  data-versions-endpoint={versionsEndpoint}
-  data-rollback-endpoint={rollbackEndpoint}
-  data-branches-endpoint={branchesEndpoint}
-  data-diff-endpoint-base={diffEndpointBase}
-  data-domain-status-endpoint={domainStatusEndpoint}
-  data-domain-dispatch-endpoint={domainDispatchEndpoint}
-  data-domain-readiness-endpoint={domainReadinessEndpoint}
-  data-repo={tenant.appDomain}
-  data-app-domain={tenant.appDomain}
-  data-canonical-domain={tenant.canonicalDomain ?? ""}
-  data-preview-share-token={previewShareToken ?? ""}
-  data-live-href={liveHref}
-  data-can-ship={viewerCanShip ? "true" : "false"}
-  data-is-owner={viewerIsOwner ? "true" : "false"}
-  data-entitled={goLiveEntitled ? "true" : "false"}
-  data-static-publish={staticPublishEnabled ? "true" : "false"}
-  data-dispatch-configured={dispatchConfigured ? "true" : "false"}
-  data-public-site-host={publicSiteUrl ? stripScheme(publicSiteUrl).replace(/\/$/, "") : ""}
->
-  <div class="section-title">
-    <div>
-      <h2 id="publish-title">Publish</h2>
-      <p>Review what's changed, then publish your next release when you're ready.</p>
-    </div>
-    <div class="actions">
-      <button class="btn" type="button" data-publish-refresh>
-        <svg><use href="#i-refresh"></use></svg>Refresh
-      </button>
-    </div>
-  </div>
-
-  {internalTestTenant && (
-    <div class="ship-gate amber">
-      <div class="ship-gate-main">
-        <span class="seal"><svg><use href="#i-alert"></use></svg></span>
-        <div>
-          <b>Internal test store</b>
-          <span>This store exists for testing only and is blocked from going live.</span>
-        </div>
-      </div>
-    </div>
-  )}
-
-  {!goLiveEntitled && (
-    <div class="ship-gate amber" data-publish-paywall>
-      <div class="ship-gate-main">
-        <span class="seal"><svg><use href="#i-card"></use></svg></span>
-        <div>
-          <b>Publishing to your live store is part of the paid plan</b>
-          <span>
-            Previewing and reviewing changes stays free. Upgrade to take changes live
-            and publish your public site.
-          </span>
-        </div>
-      </div>
-      <a class="btn primary" href="mailto:success@tokenoftrust.com?subject=Upgrade%20store%20publishing">
-        Upgrade to publish
-      </a>
-    </div>
-  )}
-
-  {goLiveEntitled && !viewerCanShip && (
-    <div class="ship-gate amber">
-      <div class="ship-gate-main">
-        <span class="seal"><svg><use href="#i-shield"></use></svg></span>
-        <div>
-          <b>Read-only view</b>
-          <span>Going live requires an owner or admin sign-in for this store.</span>
-        </div>
-      </div>
-    </div>
-  )}
-
-  <!-- State-driven "next action" hero (r01) — the SINGLE top-of-tab state
-       element. ONE sentence + ONE primary CTA, derived by lib/publish/publishHero.ts
-       from the SAME /api/changes read the queue + aggregate already fetch (no extra
-       read). It ABSORBS the two former standalone banners: the merge-doctor health
-       summary (B1) and the platform-fault "Report to support" escalation (B3) are
-       folded into the hero's state model, expressed through this one element — a
-       merge conflict/platform blocker turns the hero red/urgent instead of rendering
-       a separate banner. Rendered by renderHero() in adminPublishTab.ts; starts
-       hidden until the first /api/changes read resolves. The r03 stale-public-site
-       alarm sits alongside it in this region (a distinct top-level signal that
-       deep-links into Live Site), so there is ONE hero/alert region, not floating
-       banners. Urgency is never color-only: the tone drives the icon + an explicit
-       "Action needed" label. -->
-  <div class="publish-hero-region" data-publish-hero-region>
-    <div class="publish-hero" data-publish-hero data-tone="calm" hidden role="status" aria-live="polite">
-      <div class="publish-hero-main">
-        <span class="publish-hero-icon" data-publish-hero-icon aria-hidden="true">
-          <svg><use href="#i-check"></use></svg>
-        </span>
-        <div class="publish-hero-copy">
-          <span class="publish-hero-kicker" data-publish-hero-kicker hidden>Action needed</span>
-          <b class="publish-hero-headline" data-publish-hero-headline></b>
-          <span class="publish-hero-detail" data-publish-hero-detail></span>
-        </div>
-      </div>
-      <div class="publish-hero-actions">
-        <button class="btn primary publish-hero-cta" type="button" data-publish-hero-cta hidden></button>
-        <a class="btn primary publish-hero-cta" data-publish-hero-cta-link hidden href="mailto:success@tokenoftrust.com"></a>
-      </div>
-    </div>
-
-    <!-- r03: stale-public-site alarm, LIFTED to top-level. The "public site is
-         behind the live pointer" verdict (resolveLiveVersion / isPublicSiteCurrent)
-         used to sit buried inside the collapsible Live Site section; when the public
-         target is behind, surface it here as a top-level amber alarm that deep-links
-         into Live Site (where the full breakdown stays nested). SSR-driven from the
-         same publicSiteVerdict the Live Site chip reads — shown only for a
-         static-publish tenant whose public target is confirmed behind. -->
-    {staticPublishEnabled && publicSiteVerdict && publicSiteVerdict.status === "behind" && (
-      <div class="risk-alert amber publish-stale-site" data-publish-stale-site role="status" aria-live="polite">
-        <div class="risk-alert-main">
-          <svg><use href="#i-alert"></use></svg>
-          <div>
-            <b>Public site is behind — re-publish to catch it up</b>
-            <span>
-              Your public site is still serving an older release
-              (<code class="publish-mono">{publicSiteVerdict.publishedSha.slice(0, 12)}</code>)
-              while your live pointer has moved on to
-              (<code class="publish-mono">{publicSiteVerdict.livePointerSha.slice(0, 12)}</code>).
-              Re-publish, or open the publishing details for the full breakdown.
-            </span>
-          </div>
-        </div>
-        <a class="btn" href="#publish-live-site" data-publish-stale-site-link>Open publishing details</a>
-      </div>
-    )}
-  </div>
-
-  <div class="grid cols-3">
-    <div class="metric">
-      <span>Live version</span>
-      <strong>
-        <!-- The human version label ("v42") links straight to the live store; the
-             raw SHA is demoted to the Technical details disclosure below. -->
-        <a class="live-version-link" data-publish-live-version-link href={liveHref}
-           target="_blank" rel="noopener" hidden>—</a>
-        <span data-publish-live-version-none>—</span>
-      </strong>
-      <small data-publish-live-source>What shoppers see right now</small>
-      <details class="metric-tech" data-publish-live-tech hidden>
-        <summary>Technical details</summary>
-        <span class="publish-mono subtle" data-publish-live-sha>—</span>
-      </details>
-    </div>
-    <div class="metric">
-      <span>Published</span>
-      <strong data-publish-live-at>—</strong>
-      <small>When the live version last changed</small>
-      <small data-publish-live-shipped-by></small>
-    </div>
-    <div class="metric">
-      <span>Open changes</span>
-      <strong data-publish-queue-count>—</strong>
-      <small>Waiting for review or go-live</small>
-    </div>
-  </div>
-
-  {staticPublishEnabled && !dispatchConfigured && (
-    <div class="risk-alert" data-publish-sink-unbound>
-      <div class="risk-alert-main">
-        <svg><use href="#i-alert"></use></svg>
-        <div>
-          <b>Automatic public-site republish is not yet enabled on this environment</b>
-          <span>
-            Going live updates the hosted store immediately; the public-site republish
-            job is dispatched once publishing is enabled here.
-          </span>
-        </div>
-      </div>
-    </div>
-  )}
-
-  <div class="panel" id="publish-queue">
-    <details class="publish-queue-details" open>
-    <summary class="panel-head">
-      <h3><svg><use href="#i-export"></use></svg>What needs your approval?</h3>
-      <span class="chip" data-publish-queue-chip>Loading</span>
-    </summary>
-    <div class="panel-body grid">
-      <p class="note publish-status" data-publish-status role="status" aria-live="polite"></p>
-      <!-- rux1: forge-listing degraded strip. Shown ONLY when GET /api/changes
-           reports `degraded` (the open-PR listing failed) — distinct from the
-           genuine empty queue, so a forge blip never reads as "No open changes". -->
-      <div class="risk-alert" data-publish-degraded hidden role="alert">
-        <div class="risk-alert-main">
-          <svg><use href="#i-alert"></use></svg>
-          <div>
-            <b>Some open changes may not be shown</b>
-            <span>
-              We couldn't reach the pull-request list, so open changes that haven't been
-              built yet may be missing from the queue below. Built candidates are
-              unaffected. Refresh to try again.
-            </span>
-          </div>
-        </div>
-      </div>
-      <p class="note publish-pr-callout" data-publish-pr-callout hidden role="status" aria-live="polite"></p>
-      <div class="table-wrap">
-        <table class="publish-table">
-          <thead>
-            <tr>
-              <th>Change</th>
-              <th>Status</th>
-              <th>Checks</th>
-              <th>Head</th>
-              <th>Updated</th>
-              <th class="action">Actions</th>
-            </tr>
-          </thead>
-          <tbody data-publish-queue-body>
-            <tr data-publish-placeholder>
-              <td colspan="6"><span class="subtle">Loading the change queue…</span></td>
-            </tr>
-          </tbody>
-        </table>
-      </div>
-      {staticPublishEnabled && (
-        <p class="note" data-publish-dispatch-status>
-          {dispatchConfigured
-            ? "Public-site republish: dispatched automatically when a change goes live."
-            : "Public-site republish: not yet enabled on this environment."}
-        </p>
-      )}
-    </div>
-    </details>
-  </div>
-
-  <!-- "See all" history: changes that LEFT the queue by being rejected. Rejecting
-       is otherwise a black hole — this collapsed panel keeps them visible (and their
-       preview reachable) so a reject is recoverable-from-history. Collapsed by
-       default (a reference, not a work surface); the whole panel is hidden by the
-       client when there are none, so it never adds empty chrome. Excludes shipped
-       (merged) changes — those live in the Live Site / versions panel. -->
-  <div class="panel" id="publish-closed" data-publish-closed-panel hidden>
-    <details class="closed-changes-details">
-    <summary class="panel-head">
-      <h3><svg><use href="#i-undo"></use></svg>Closed &amp; rejected changes</h3>
-      <span class="chip" data-publish-closed-chip>0</span>
-    </summary>
-    <div class="panel-body grid">
-      <p class="note subtle">
-        Changes you rejected. They're not in your next release and won't go live —
-        kept here so nothing you closed silently disappears. Open a preview to review
-        what it was.
-      </p>
-      <div class="table-wrap">
-        <table class="publish-table">
-          <thead>
-            <tr>
-              <th>Change</th>
-              <th>Closed</th>
-              <th>Head</th>
-            </tr>
-          </thead>
-          <tbody data-publish-closed-body></tbody>
-        </table>
-      </div>
-    </div>
-    </details>
-  </div>
-
-  <!-- b11: the AGGREGATE card — the protected `preview` aggregate the accepted
-       candidates integrate into, its combined evidence (the last integration
-       run's honest state), and the exact-digest Publish (b09/b10 ship the
-       reviewed pinned SHA + digest, never a rebuild). -->
-  <div class="panel agg-console" id="publish-next-release" data-publish-aggregate>
-    <details class="agg-console-details" open>
-    <summary class="panel-head">
-      <h3><svg><use href="#i-box"></use></svg>Next release</h3>
-      <!-- r11 — the human release name (aggregate.name), shown beside the heading.
-           Client-populated by renderAggregate; hidden (falls back to just "Next
-           release") when the release has no name. -->
-      <span class="agg-release-name" data-aggregate-name hidden></span>
-      <!-- One-click hop to the current preview build. Shown only when a
-           genuinely-built revision exists (renderAggregate toggles it via
-           classifyBuildLink), so it can never lead to a 404. The click is
-           stop-propagated in adminPublishTab.ts so opening the preview never
-           also toggles this collapsible. -->
-      <a class="btn btn-compact" data-aggregate-open-preview target="_blank" rel="noopener" hidden>Open preview</a>
-      <!-- r08 — copy a shareable, view-only preview link for the next release to hand
-           to a non-technical stakeholder (no sign-in). Unhidden by the client only
-           when a share token was minted; the click is stop-propagated so copying
-           never also toggles this collapsible. -->
-      <button class="btn btn-compact" type="button" data-aggregate-copy-preview hidden>
-        <svg><use href="#i-copy"></use></svg><span data-copy-preview-label>Copy preview link</span>
-      </button>
-      <span class="chip" data-aggregate-chip>Loading</span>
-    </summary>
-    <div class="panel-body grid">
-      <p class="note publish-status" data-aggregate-status role="status" aria-live="polite"></p>
-
-      <!-- Keep the primary action beside the release status. The detail table can
-           be long; publishing must never be buried beneath it. -->
-      <div class="check-row agg-launch">
-        <div>
-          <b>
-            {staticPublishEnabled
-              ? "Publish this release to the hosted and public sites"
-              : "Publish this release to your live store"}
-          </b>
-          <p data-aggregate-publish-detail>
-            {publicSiteUrl ? (
-              <>
-                Publishes the exact build you reviewed to the hosted store, then
-                automatically republishes <code>{stripScheme(publicSiteUrl).replace(/\/$/, "")}</code>.
-              </>
-            ) : (
-              <>Publishes the exact build you reviewed — no rebuild.</>
-            )}
-          </p>
-        </div>
-        <button class="btn primary agg-publish-btn" type="button" data-aggregate-publish disabled>
-          <svg><use href="#i-export"></use></svg>
-          {staticPublishEnabled ? "Publish to both live sites" : "Publish live"}
-        </button>
-      </div>
-
-      <!-- Only visible after an actually failed aggregate rebuild. -->
-      <div class="check-row" data-aggregate-retry-row hidden>
-        <div>
-          <b>Retry the build</b>
-          <p>
-            Your change was added, but rebuilding the preview failed. Retry rebuilds it
-            and re-runs your store's checks — nothing new is added.
-          </p>
-        </div>
-        <button class="btn" type="button" data-aggregate-retry-build>
-          <svg><use href="#i-refresh"></use></svg>Retry build
-        </button>
-      </div>
-
-      <!-- AI-assembled release summary — a plain-language "what am I about to
-           publish?" ahead of the technical trust chain. Rendered ONLY when the
-           server supplies data.releaseSummary; otherwise it stays hidden and the
-           panel degrades to today's behavior (graceful fallback). -->
-      <div class="agg-summary" data-aggregate-summary hidden>
-        <div class="agg-summary-head">
-          <span class="agg-summary-glyph" aria-hidden="true">
-            <svg viewBox="0 0 24 24" fill="currentColor"><path d="M12 2l1.9 4.7L18.5 8.6l-4.6 1.9L12 15.2l-1.9-4.7L5.5 8.6l4.6-1.9L12 2z"></path><path d="M18.5 14l.9 2.2 2.3.9-2.3.9-.9 2.2-.9-2.2-2.3-.9 2.3-.9.9-2.2z"></path></svg>
-          </span>
-          <span class="agg-summary-label">What&rsquo;s in this release</span>
-          <span class="agg-ai-chip">
-            <svg viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M12 2l1.9 4.7L18.5 8.6l-4.6 1.9L12 15.2l-1.9-4.7L5.5 8.6l4.6-1.9L12 2z"></path></svg>
-            AI summary
-          </span>
-        </div>
-        <p class="agg-summary-lead" data-aggregate-summary-lead></p>
-        <ul class="agg-summary-points" data-aggregate-summary-points></ul>
-      </div>
-
-      <!-- Chain of custody: the build that was verified → its combined evidence →
-           the digest that ships. Collapsed by default — this is verification
-           detail for a developer, not something a merchant needs to read to
-           decide whether to publish; the plain-language summary above and the
-           Publish button below are the actual decision surface. -->
-      <details class="agg-chain-details">
-        <summary>Technical details</summary>
-        <div class="agg-chain">
-          <div class="agg-stop">
-            <span class="agg-stop-label">Aggregate build</span>
-            <span class="agg-stop-val"><strong class="publish-mono" data-aggregate-sha>—</strong></span>
-            <p class="agg-stop-cap" data-aggregate-run-link>The current green preview build for this store.</p>
-          </div>
-          <div class="agg-link" aria-hidden="true">
-            <span class="agg-flowlabel">verified by</span>
-            <span class="agg-arrow"><svg viewBox="0 0 34 10" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M1 5h29m0 0-4-4m4 4-4 4"></path></svg></span>
-          </div>
-          <div class="agg-stop">
-            <span class="agg-stop-label">Combined evidence</span>
-            <span class="agg-stop-val"><strong data-aggregate-evidence>—</strong></span>
-            <p class="agg-stop-cap" data-aggregate-evidence-detail>The last integration run's verdict.</p>
-          </div>
-          <div class="agg-link" aria-hidden="true">
-            <span class="agg-flowlabel">produces</span>
-            <span class="agg-arrow"><svg viewBox="0 0 34 10" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M1 5h29m0 0-4-4m4 4-4 4"></path></svg></span>
-          </div>
-          <div class="agg-stop">
-            <span class="agg-stop-label">Reviewed digest</span>
-            <span class="agg-stop-val"><strong class="publish-mono agg-digest" data-aggregate-digest>—</strong></span>
-            <p class="agg-stop-cap">The content digest that will be published — exactly what you reviewed.</p>
-          </div>
-        </div>
-      </details>
-
-      <!-- Included PRs — the batch this aggregate composes (b01 includedPrs). u14:
-           the "missing middle" — this is the STAGED delta vs live. The title + note
-           narrate how far ahead of the live site the staged preview is, and each row
-           carries an Undo (per-change revert) to roll the staged preview backward. -->
-      <div class="aggregate-prs agg-staged" data-aggregate-prs-wrap hidden>
-        <div class="agg-staged-head">
-          <b data-aggregate-prs-title>Included changes</b>
-          <!-- Scope-of-change risk measure across the whole staged batch (total
-               files + lines). Populated by renderAggregate from data.stagedScope;
-               hidden when no staged change carries size stats. -->
-          <span class="agg-scope" data-aggregate-scope hidden></span>
-        </div>
-        <!-- Staged → live delta strip: staged aggregate sha ahead of the live
-             pointer. Populated by renderAggregate; hidden when nothing is ahead. -->
-        <div class="agg-delta-strip" data-aggregate-delta-strip hidden>
-          <span class="agg-delta-node">
-            <span class="agg-stop-label">Staged preview</span>
-            <span class="sha-token" data-agg-delta-staged>—</span>
-          </span>
-          <span class="agg-delta-mid" aria-hidden="true">
-            <span class="agg-delta-count" data-agg-delta-count></span>
-            <svg viewBox="0 0 26 10" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><path d="M1 5h21m0 0-4-4m4 4-4 4"></path></svg>
-          </span>
-          <span class="agg-delta-node">
-            <span class="agg-stop-label">Live site</span>
-            <span class="sha-token ghost" data-agg-delta-live>—</span>
-          </span>
-        </div>
-        <p class="note" data-aggregate-delta-note hidden></p>
-        <!-- ONE table, one row per change — merges what used to be two separate
-             "Included changes" lists (this staged-delta section + the Publish
-             plan's own duplicate) into a single source of truth. Populated by
-             renderAggregate, enriched with the plan's per-change title/description/
-             file+line counts when available. -->
-        <div class="table-wrap">
-          <table class="publish-table agg-included-table">
-            <thead>
-              <tr>
-                <th>Change</th>
-                <th>Head</th>
-                <th>Files</th>
-                <th>Lines</th>
-                <th>Added</th>
-                <th class="action">Actions</th>
-              </tr>
-            </thead>
-            <tbody data-aggregate-prs></tbody>
-          </table>
-        </div>
-      </div>
-
-      <!-- The exact-digest Publish plan (b09 plan()): pinned SHA + digest +
-           rollback target + paywall verdict + run link. Shown inline (from
-           GET /api/changes `plan`) so the confirm never POSTs to preview.
-           Publish is refused until the plan is `ok`. Its own included-changes
-           list was merged into the single table above — see data-aggregate-prs. -->
-      <div class="aggregate-plan agg-manifest" data-aggregate-plan hidden>
-        <div class="aggregate-plan-head agg-manifest-head">
-          <b><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M9 11l3 3L22 4"></path><path d="M21 12v7a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h11"></path></svg>Publish plan</b>
-          <span class="chip" data-aggregate-plan-chip></span>
-        </div>
-        <details class="agg-chain-details">
-          <summary>Technical details</summary>
-          <dl class="aggregate-plan-grid" data-aggregate-plan-grid></dl>
-        </details>
-
-        <p class="note" data-aggregate-plan-note></p>
-      </div>
-
-    </div>
-    </details>
-  </div>
-
-  <!-- Branch retention panel removed entirely — old candidate branches now
-       clean themselves up automatically (auto-swept after each successful
-       accept/publish, see adminPublishTab.ts autoSweepBranches). There is
-       nothing here for anyone to look at or act on day-to-day, so there is no
-       panel at all, not even a collapsed one. -->
-
-  <!-- Publish next release — the collapsed destination/status panel below the
-       staged release. Its summary answers the operational question first: either
-       live already matches the staged release, or there is an action to advance it.
-       The disclosure contains destination links, freshness, rollback, and domain
-       controls for operators who need the detail. -->
-  <div class="panel" id="publish-live-site" data-publish-live-site>
-    <details class="live-site-details">
-      <summary class="panel-head">
-        <h3><svg><use href="#i-export"></use></svg>Publish next release</h3>
-        <span class="chip" data-live-release-state>Checking release…</span>
-        <button
-          class="btn primary btn-compact live-release-publish"
-          type="button"
-          data-live-release-publish
-          hidden
-        >Publish next release</button>
-      </summary>
-      <div class="panel-body grid">
-        <ul class="live-site-links">
-          <li>
-            <span class="live-site-link-label">Hosted store</span>
-            <a class="live-site-link-url publish-mono" href={liveHref} target="_blank" rel="noopener">{stripScheme(liveStoreUrl)}</a>
-            <span class="live-site-link-note">Updates immediately when you publish the reviewed release above.</span>
-          </li>
-          {publicSiteUrl && (
-            <li>
-              <span class="live-site-link-label">Public site</span>
-              <a class="live-site-link-url publish-mono" href={publicSiteUrl} target="_blank" rel="noopener">{stripScheme(publicSiteUrl)}</a>
-              <span class="live-site-link-note">Republishes automatically after the hosted release is published.</span>
-            </li>
-          )}
-        </ul>
-
-        <!-- Public-site freshness read-back (static-publish seam's staticLiveDigest):
-             what the external target (CloudFront/S3) is HONESTLY observed serving
-             right now, vs the control-plane's live pointer — the two can diverge on a
-             stale/failed republish. Answers "did going live actually reach the public
-             site?" without a manual curl. -->
-        {staticPublishEnabled && publicSiteDigest && publicSiteVerdict && (
-          <div
-            class={`risk-alert ${publicSiteVerdict.status === "current" ? "public-site-ok" : "amber"}`}
-            data-publish-public-site
-          >
-            <div class="risk-alert-main">
-              <svg><use href={publicSiteVerdict.status === "current" ? "#i-check" : "#i-alert"}></use></svg>
-              <div>
-                {publicSiteVerdict.status === "current" ? (
-                  <>
-                    <b>Public site matches the currently published release</b>
-                    <span>
-                      <code>{stripScheme(publicSiteUrl ?? tenant.appDomain).replace(/\/$/, "")}</code> is serving
-                      (<code class="publish-mono">{liveVersion?.versionId?.slice(0, 12)}</code>)
-                      — the same release as the hosted store. Staged preview changes are
-                      a separate next release: use <b>Publish to both live sites</b> above
-                      to advance the hosted store and republish this public site.
-                    </span>
-                  </>
-                ) : publicSiteVerdict.status === "behind" ? (
-                  <>
-                    <b>Public site is behind the hosted store's live pointer</b>
-                    <span>
-                      <code>{tenant.appDomain}</code>'s public target is still serving{" "}
-                      <code class="publish-mono">{publicSiteVerdict.publishedSha.slice(0, 12)}</code>, but
-                      the hosted store's live pointer has since moved to{" "}
-                      <code class="publish-mono">{publicSiteVerdict.livePointerSha.slice(0, 12)}</code>.
-                      The republish job hasn't caught up yet (or a go-live happened before it was enabled) —
-                      check the workflow run, or trigger a fresh go-live to re-dispatch it.
-                    </span>
-                  </>
-                ) : (
-                  <>
-                    <b>Couldn't verify the public site is current</b>
-                    <span>
-                      Checked <code class="publish-mono">{publicSiteDigest.url}</code>: {publicSiteVerdict.reason}.
-                      This does NOT mean the hosted store's own "Live version" above is wrong, only that the
-                      separate public static target couldn't be confirmed current.
-                    </span>
-                  </>
-                )}
-              </div>
-            </div>
-          </div>
-        )}
-
-        <!-- Rollback options — CONTAINED within Live Site as a subsection (was a sibling
-             panel). The full published-version history + one-click rollback through the
-             single rollback orchestrator; collapsed by default (most people never open
-             it — the live version is already the metric up top). Keeps its
-             data-publish-versions + data-versions-* hooks verbatim. -->
-        <div class="live-site-subsection" data-publish-versions>
-          <details class="versions-details">
-            <summary class="live-site-subhead">
-              <h4><svg><use href="#i-refresh"></use></svg>Rollback options</h4>
-              <span class="chip" data-versions-chip>Loading</span>
-            </summary>
-            <div class="grid">
-              <p class="note publish-status" data-versions-status role="status" aria-live="polite"></p>
-              <p class="note" data-versions-rollback-note hidden></p>
-              <!-- u14: orients the owner between the staged aggregate above and live versions
-                   below — "N staged change(s) not yet published; Publish live creates the next
-                   version here." Owned by renderAggregate (its own element, so its timing never
-                   races renderVersions). -->
-              <p class="note" data-versions-orientation hidden></p>
-              <div class="table-wrap">
-                <table class="publish-table versions-table">
-                  <thead>
-                    <tr>
-                      <th>Version</th>
-                      <th>Digest</th>
-                      <th>Promoted</th>
-                      <th>Preview</th>
-                      <th>State</th>
-                      <th class="action">Actions</th>
-                    </tr>
-                  </thead>
-                  <tbody data-versions-body>
-                    <tr data-versions-placeholder>
-                      <td colspan="6"><span class="subtle">Loading published versions…</span></td>
-                    </tr>
-                  </tbody>
-                </table>
-              </div>
-            </div>
-          </details>
-        </div>
-
-        <!-- Public domain (apex connect / rollback) — CONTAINED within Live Site as a
-             subsection. Keeps its data-publish-domain + data-domain-* hooks verbatim so
-             the client controller is unchanged; only the wrapper/heading are lighter to
-             read as a nested section rather than a sibling panel. -->
-        {staticPublishEnabled && (
-          <div class="live-site-subsection" data-publish-domain>
-            <div class="live-site-subhead">
-              <h4><svg><use href="#i-shield"></use></svg>Public domain</h4>
-              <span class="chip" data-domain-state-chip>Loading</span>
-            </div>
-            <div class="grid">
-              <div class="grid cols-3">
-                <div class="field">
-                  <label>Serving from</label>
-                  <strong data-domain-state>—</strong>
-                  <p data-domain-since>Current host for {tenant.appDomain}</p>
-                </div>
-                <div class="field">
-                  <label>Rollback records</label>
-                  <strong data-domain-capture>None captured</strong>
-                  <p>DNS records captured before connect — rollback restores these.</p>
-                </div>
-                <div class="field">
-                  <label>Last run</label>
-                  <strong data-domain-run>None</strong>
-                  <p data-domain-run-detail>Connect and rollback runs appear here.</p>
-                </div>
-              </div>
-
-              <p class="note publish-status" data-domain-status role="status" aria-live="polite"></p>
-
-              <!-- u9: apex-cutover readiness — the itemized preconditions the server gate
-                   requires before a connect is permitted. Populated from
-                   /api/domain/readiness (the SAME gate `tot go-live` reads). -->
-              <div class="domain-readiness" data-domain-readiness hidden>
-                <div class="domain-readiness-head">
-                  <b>Cutover readiness</b>
-                  <span class="chip" data-domain-readiness-chip>Checking…</span>
-                </div>
-                <ul class="domain-readiness-list" data-domain-readiness-list></ul>
-                <p class="note" data-domain-readiness-note></p>
-              </div>
-
-              <div class="check-row">
-                <div>
-                  <b>Connect {tenant.appDomain} to the storefront</b>
-                  <p>
-                    Updates two DNS names — <code>{tenant.appDomain}</code> and <code>www.{tenant.appDomain}</code> —
-                    to serve the published site. Takes effect in about a minute. Type the
-                    domain to confirm.
-                  </p>
-                  {!viewerCanApexCutover && (
-                    <p><span class="chip amber">Owner/admin only</span> Connecting the domain requires an owner or admin sign-in.</p>
-                  )}
-                </div>
-                <div class="domain-connect-controls">
-                  <input
-                    type="text"
-                    placeholder={tenant.appDomain}
-                    autocomplete="off"
-                    spellcheck="false"
-                    aria-label="Type the domain to confirm"
-                    data-domain-confirm
-                    disabled={!viewerCanApexCutover}
-                  />
-                  <label class="domain-rehearsal">
-                    <input type="checkbox" data-domain-rehearsal disabled={!viewerCanApexCutover} />
-                    Rehearsal (dry run, no DNS change)
-                  </label>
-                  <button
-                    class="btn primary"
-                    type="button"
-                    data-domain-connect
-                    data-owner-locked={!viewerCanApexCutover ? "true" : undefined}
-                    disabled={!viewerCanApexCutover}
-                  >
-                    <svg><use href="#i-check"></use></svg>Connect domain
-                  </button>
-                </div>
-              </div>
-
-              <div class="check-row">
-                <div>
-                  <b>Roll back to the previous host</b>
-                  <p data-domain-rollback-detail>
-                    Restores the DNS records captured before connect. Available once records
-                    have been captured.
-                  </p>
-                </div>
-                <button class="btn" type="button" data-domain-rollback disabled={!viewerCanShip}>
-                  <svg><use href="#i-refresh"></use></svg>Roll back
-                </button>
-              </div>
-            </div>
-          </div>
-        )}
-      </div>
-    </details>
-  </div>
-
-  <!-- Accept-to-preview LIFTOFF — the plan confirm + live integration flight +
-       outcome ceremony. One dialog, three phases (plan → flight → outcome).
-       The flight's stage rail advances ONLY on real signals (the in-flight POST
-       plus GET /api/changes polling — includedPrs / activeRun / aggregateSha);
-       nothing is simulated. Replaces the old window.confirm() plan popup. -->
-  <div class="liftoff-backdrop" data-liftoff hidden>
-    <div class="liftoff-card" role="dialog" aria-modal="true" aria-labelledby="liftoff-title" tabindex="-1">
-      <div class="liftoff-phase" data-liftoff-plan>
-        <p class="liftoff-kicker">Add to release</p>
-        <h3 class="liftoff-title" id="liftoff-title" data-liftoff-title>Add to your next release</h3>
-        <dl class="liftoff-grid" data-liftoff-grid></dl>
-        <p class="note">
-          Adds this change to your next release, then rebuilds the preview and re-runs your
-          store's checks. <b>Nothing goes live</b> — publishing your release stays a
-          separate, explicit step.
-        </p>
-        <div class="liftoff-actions">
-          <button class="btn" type="button" data-liftoff-cancel>Cancel</button>
-          <button class="btn primary" type="button" data-liftoff-proceed>
-            <svg><use href="#i-check"></use></svg>Add to release
-          </button>
-        </div>
-      </div>
-
-      <div class="liftoff-phase" data-liftoff-flight hidden>
-        <p class="liftoff-kicker">Adding to your release</p>
-        <h3 class="liftoff-title" data-liftoff-flight-title>Adding…</h3>
-        <ol class="liftoff-stages">
-          <li data-liftoff-stage="merge">
-            <span class="liftoff-dot"></span>
-            <div><b>Add</b><span>add this change to your next release</span></div>
-          </li>
-          <li data-liftoff-stage="build">
-            <span class="liftoff-dot"></span>
-            <div><b>Build</b><span>rebuild the preview with your change in it</span></div>
-          </li>
-          <li data-liftoff-stage="evidence">
-            <span class="liftoff-dot"></span>
-            <div><b>Check</b><span>re-run your store's checks on the preview</span></div>
-          </li>
-          <li data-liftoff-stage="green">
-            <span class="liftoff-dot"></span>
-            <div><b>Ready</b><span>your next release is ready to review and publish</span></div>
-          </li>
-        </ol>
-        <p class="liftoff-live" data-liftoff-live role="status" aria-live="polite">Working…</p>
-        <div class="stream-log" data-liftoff-log role="log" aria-live="polite"></div>
-        <div class="liftoff-meta">
-          <span class="publish-mono" data-liftoff-elapsed>0:00</span>
-          <button class="btn" type="button" data-liftoff-hide>Continue in background</button>
-        </div>
-      </div>
-
-      <div class="liftoff-phase liftoff-outcome-phase" data-liftoff-outcome hidden>
-        <div class="liftoff-seal" data-liftoff-seal aria-hidden="true"></div>
-        <h3 class="liftoff-title" data-liftoff-outcome-title></h3>
-        <p class="note" data-liftoff-outcome-detail></p>
-        <!-- Merge-conflict recovery (shown ONLY for reason "merge_failed") — decision
-             `automate-first-conflict-recovery` (u4): the refusal LEADS with one primary
-             action ("Update this change automatically" → /resolve strategy:"merge",
-             then auto-re-integrate). The three option cards appear only when diff3 hits
-             a genuine same-line overlap (RefreshResult.unresolved); the old terminal +
-             AI-agent guidance is demoted VERBATIM into the collapsed "Do it manually
-             instead" expert section (nothing removed). Decision logic lives in the
-             tested `resolveConflict.ts`; this glue mirrors it (verified on preview). -->
-        <div class="liftoff-conflict" data-liftoff-conflict hidden>
-          <p class="note liftoff-conflict-summary" data-conflict-summary hidden></p>
-
-          <!-- PRIMARY ACTION — always first when a candidate is refused not-mergeable. -->
-          <div class="liftoff-conflict-primary" data-conflict-primary>
-            <p class="note" data-conflict-primary-note>
-              We can rebuild your change on top of the store's current version and
-              re-integrate it for you — no terminal, no re-submit.
-            </p>
-            <button class="btn primary" type="button" data-conflict-auto>Update this change automatically</button>
-            <p class="note liftoff-conflict-primary-status" data-conflict-primary-status role="status" aria-live="polite" hidden></p>
-          </div>
-
-          <!-- OPTION CARDS — revealed only on a genuine same-line overlap diff3 can't
-               safely auto-pick. Static nodes mirror CONFLICT_OPTION_CARDS. -->
-          <div class="liftoff-conflict-cards" data-conflict-cards hidden>
-            <p class="note" data-conflict-cards-intro>
-              Some of the same lines were changed on both sides, so there's no single safe
-              answer. Pick how to resolve the overlap:
-            </p>
-            <ul class="liftoff-conflict-files publish-mono" data-conflict-files></ul>
-            <div class="liftoff-conflict-card-grid" role="group" aria-label="Resolve the overlap">
-              <button class="liftoff-option-card" type="button" data-conflict-card data-strategy="merge" data-recommended="1">
-                <b>Combine both</b>
-                <span>Recommended — weave both sets of edits together</span>
-              </button>
-              <button class="liftoff-option-card" type="button" data-conflict-card data-strategy="ours">
-                <b>Keep my change</b>
-                <span>Use your edits on the conflicting lines</span>
-              </button>
-              <button class="liftoff-option-card" type="button" data-conflict-card data-strategy="theirs">
-                <b>Keep the store's current version</b>
-                <span>Use the store's edits on the conflicting lines</span>
-              </button>
-            </div>
-            <p class="note liftoff-conflict-cards-status" data-conflict-cards-status role="status" aria-live="polite" hidden></p>
-          </div>
-
-          <!-- EXPERT FALLBACK — the ORIGINAL terminal + AI-agent guidance, verbatim,
-               collapsed. Nothing deleted; just demoted from primary to fallback. -->
-          <details class="liftoff-conflict-expert" data-conflict-expert>
-            <summary>Do it manually instead</summary>
-            <p class="note" data-conflict-intro>
-              From the store checkout that submitted this change, bring it up to date and
-              re-submit — the open PR updates in place. Once the new build is ready,
-              finish here with <b>Add to release</b>, or from the terminal with
-              <code>tot accept --tenant &lt;store&gt; --pr &lt;N&gt;</code>.
-              Check <code>git status</code> first — abort any half-finished rebase from an
-              earlier attempt. Then <code>tot pr</code>: this change should be marked
-              <code>(active)</code>, proving you're in the right checkout and branch.
-              If git reports an authentication failure, run <code>tot login</code> and retry.
-            </p>
-            <pre class="liftoff-commands publish-mono" data-conflict-commands></pre>
-            <div class="liftoff-conflict-actions">
-              <button class="btn" type="button" data-conflict-copy-prompt>Copy prompt for your AI agent</button>
-              <button class="btn" type="button" data-conflict-copy>Copy commands</button>
-            </div>
-            <p class="liftoff-conflict-raw publish-mono" data-conflict-raw></p>
-          </details>
-        </div>
-        <div class="liftoff-actions">
-          <a class="btn" data-liftoff-review target="_blank" rel="noopener" hidden>Review the preview build</a>
-          <!-- Fail-visible next step: when the merge LANDED but the preview build
-               failed, this offers Rebuild (not a dead "did not land"); on an
-               indeterminate outcome it offers Re-check. Hidden on success/conflict
-               (conflict recovery owns its own primary action). -->
-          <button class="btn primary" type="button" data-liftoff-rebuild hidden>Rebuild the preview build</button>
-          <button class="btn primary" type="button" data-liftoff-done>Done</button>
-        </div>
-      </div>
-
-      <div class="liftoff-confetti" data-liftoff-confetti aria-hidden="true"></div>
-    </div>
-  </div>
-
-  <!-- Publish-live ceremony — the go-live counterpart of the accept liftoff
-       (same shell/styles). Plan states the exact digest + no-rebuild contract;
-       flight is a single honest in-flight state (one POST, no staged theater);
-       outcome celebrates with a real "View your live store" link. Replaces the
-       raw window.confirm() publish popup. -->
-  <div class="liftoff-backdrop" data-shipoff hidden>
-    <div class="liftoff-card" role="dialog" aria-modal="true" aria-labelledby="shipoff-title" tabindex="-1">
-      <div class="liftoff-phase" data-shipoff-plan>
-        <p class="liftoff-kicker">Publish live</p>
-        <h3 class="liftoff-title" id="shipoff-title">Publish the reviewed build to your live store</h3>
-        <dl class="liftoff-grid" data-shipoff-grid></dl>
-        <p class="note">
-          Publishes this <b>exact reviewed digest</b> — no rebuild, nothing rides along.
-          Your live store updates in about a second; rolling back re-publishes the prior
-          version from the archive.
-        </p>
-        <div class="liftoff-actions">
-          <button class="btn" type="button" data-shipoff-cancel>Cancel</button>
-          <button class="btn primary" type="button" data-shipoff-proceed>
-            <svg><use href="#i-export"></use></svg>Publish live
-          </button>
-        </div>
-      </div>
-
-      <div class="liftoff-phase" data-shipoff-flight hidden>
-        <p class="liftoff-kicker">Publishing</p>
-        <h3 class="liftoff-title">Promoting the reviewed digest…</h3>
-        <p class="liftoff-live" data-shipoff-live role="status" aria-live="polite">
-          Pinning the exact reviewed build to your live channel…
-        </p>
-        <div class="stream-log" data-shipoff-log role="log" aria-live="polite"></div>
-        <div class="liftoff-meta">
-          <span class="publish-mono" data-shipoff-elapsed>0:00</span>
-          <button class="btn" type="button" data-shipoff-hide>Continue in background</button>
-        </div>
-      </div>
-
-      <div class="liftoff-phase liftoff-outcome-phase" data-shipoff-outcome hidden>
-        <div class="liftoff-seal" data-shipoff-seal aria-hidden="true"></div>
-        <h3 class="liftoff-title" data-shipoff-outcome-title></h3>
-        <p class="note" data-shipoff-outcome-detail></p>
-        <!-- Failure detail + "Copy for your AI agent" — shown ONLY when the publish did
-             not complete. Mirrors the build-flight failure affordance. -->
-        <div class="liftoff-conflict" data-shipoff-failure hidden>
-          <pre class="liftoff-commands publish-mono" data-shipoff-failure-detail></pre>
-          <div class="liftoff-conflict-actions">
-            <button class="btn" type="button" data-shipoff-copy>Copy for your AI agent</button>
-          </div>
-        </div>
-        <div class="liftoff-actions">
-          <a class="btn primary" data-shipoff-view target="_blank" rel="noopener" hidden>View live</a>
-          <!-- r10 — right at the post-publish moment: jump straight to the rollback
-               row for the version this release just replaced, pre-targeted, so a
-               publish that looked wrong is one click from being undone. Reuses the
-               existing Live Site rollback action; shown only on a successful ship. -->
-          <button class="btn" type="button" data-shipoff-undo hidden>
-            <svg><use href="#i-undo"></use></svg>Undo this release
-          </button>
-          <button class="btn" type="button" data-shipoff-done>Done</button>
-        </div>
-      </div>
-
-      <div class="liftoff-confetti" data-shipoff-confetti aria-hidden="true"></div>
-    </div>
-  </div>
-
-  <!-- Build/check flight — the real-time counterpart of the accept liftoff for the
-       "Build preview" / "Run checks" action. `POST /api/preview/build` streams its
-       lifecycle phases over SSE (Accept: text/event-stream); this dialog reflects them
-       live on the SAME stage-rail + "Continue in background" pattern as the liftoff.
-       On a FAILURE the outcome shows the full detail the build reported plus a "Copy
-       for your AI agent" button (mirrors the merge-conflict copy affordance). Progress
-       reduction + copy assembly live in the tested buildStream.ts; this glue mirrors
-       it (verified on preview). -->
-  <div class="liftoff-backdrop" data-buildoff hidden>
-    <div class="liftoff-card" role="dialog" aria-modal="true" aria-labelledby="buildoff-title" tabindex="-1">
-      <div class="liftoff-phase" data-buildoff-flight>
-        <p class="liftoff-kicker">Building preview</p>
-        <h3 class="liftoff-title" id="buildoff-title" data-buildoff-flight-title>Building…</h3>
-        <ol class="liftoff-stages">
-          <li data-buildoff-stage="resolve">
-            <span class="liftoff-dot"></span>
-            <div><b>Locate commit</b><span>find the pull request's latest commit</span></div>
-          </li>
-          <li data-buildoff-stage="read">
-            <span class="liftoff-dot"></span>
-            <div><b>Read &amp; validate</b><span>read your store's files and check them</span></div>
-          </li>
-          <li data-buildoff-stage="publish">
-            <span class="liftoff-dot"></span>
-            <div><b>Publish version</b><span>materialize this version's hosted preview</span></div>
-          </li>
-          <li data-buildoff-stage="check">
-            <span class="liftoff-dot"></span>
-            <div><b>Run checks</b><span>compute the evidence for this version</span></div>
-          </li>
-        </ol>
-        <p class="liftoff-live" data-buildoff-live role="status" aria-live="polite">Starting…</p>
-        <div class="stream-log" data-buildoff-log role="log" aria-live="polite"></div>
-        <div class="liftoff-meta">
-          <span class="publish-mono" data-buildoff-elapsed>0:00</span>
-          <button class="btn" type="button" data-buildoff-hide>Continue in background</button>
-        </div>
-      </div>
-
-      <div class="liftoff-phase liftoff-outcome-phase" data-buildoff-outcome hidden>
-        <div class="liftoff-seal" data-buildoff-seal aria-hidden="true"></div>
-        <h3 class="liftoff-title" data-buildoff-outcome-title></h3>
-        <p class="note" data-buildoff-outcome-detail></p>
-        <!-- Failure detail + "Copy for your AI agent" — shown ONLY when the build did
-             not succeed. The detail is the honest reason the build reported (errors +
-             blocking findings); the copy button hands a framed brief to a coding agent. -->
-        <div class="liftoff-conflict" data-buildoff-failure hidden>
-          <pre class="liftoff-commands publish-mono" data-buildoff-failure-detail></pre>
-          <div class="liftoff-conflict-actions">
-            <button class="btn" type="button" data-buildoff-copy>Copy for your AI agent</button>
-          </div>
-        </div>
-        <div class="liftoff-actions">
-          <a class="btn" data-buildoff-review target="_blank" rel="noopener" hidden>Open the preview</a>
-          <button class="btn primary" type="button" data-buildoff-done>Done</button>
-        </div>
-      </div>
-    </div>
-  </div>
-
-  <!-- Retry-build flight — the real-time counterpart for the aggregate "Retry build"
-       action (`POST /api/changes/rebuild`), which re-runs ONLY the aggregate rebuild +
-       combined evidence against the last merged commit (no new merge). It streams its
-       reading/publishing/checking phases over SSE into the SAME shared scrolling
-       live-log console; "Continue in background" hides it while the stream keeps
-       running, and on a FAILURE the outcome shows the honest detail + a "Copy for your
-       AI agent" button — the same affordances as the build/ship flights. -->
-  <div class="liftoff-backdrop" data-rebuildoff hidden>
-    <div class="liftoff-card" role="dialog" aria-modal="true" aria-labelledby="rebuildoff-title" tabindex="-1">
-      <div class="liftoff-phase" data-rebuildoff-flight>
-        <p class="liftoff-kicker">Retrying the build</p>
-        <h3 class="liftoff-title" id="rebuildoff-title">Rebuilding your next release preview…</h3>
-        <p class="liftoff-live" data-rebuildoff-live role="status" aria-live="polite">Starting…</p>
-        <div class="stream-log" data-rebuildoff-log role="log" aria-live="polite"></div>
-        <div class="liftoff-meta">
-          <span class="publish-mono" data-rebuildoff-elapsed>0:00</span>
-          <button class="btn" type="button" data-rebuildoff-hide>Continue in background</button>
-        </div>
-      </div>
-
-      <div class="liftoff-phase liftoff-outcome-phase" data-rebuildoff-outcome hidden>
-        <div class="liftoff-seal" data-rebuildoff-seal aria-hidden="true"></div>
-        <h3 class="liftoff-title" data-rebuildoff-outcome-title></h3>
-        <p class="note" data-rebuildoff-outcome-detail></p>
-        <div class="liftoff-conflict" data-rebuildoff-failure hidden>
-          <pre class="liftoff-commands publish-mono" data-rebuildoff-failure-detail></pre>
-          <div class="liftoff-conflict-actions">
-            <button class="btn" type="button" data-rebuildoff-copy>Copy for your AI agent</button>
-          </div>
-        </div>
-        <div class="liftoff-actions">
-          <button class="btn primary" type="button" data-rebuildoff-done>Done</button>
-        </div>
-      </div>
-    </div>
-  </div>
-</section>
-
-<script>
-  import { initAdminPublishTab } from "@/lib/publish/adminPublishTab";
-  initAdminPublishTab();
-</script>
-
-<style>
-  .publish-table {
-    min-width: 900px;
-  }
-
-  /* r06 — responsive change queue. On a narrow screen the min-width:900px queue
-     table forces horizontal scroll, unusable on a phone. Below ~700px, restack the
-     existing rows into labeled cards — CSS-only, no DOM/JS change: the table, rows
-     and cells become blocks, the visual header is hidden (kept for assistive tech),
-     and each cell gains its column label via a ::before drawn from the fixed thead
-     order. Scoped to #publish-queue so the aggregate/versions tables are untouched.
-     Full-width colspan rows (empty state, sign-in notice, the inline review pane)
-     stay unlabeled and full width. */
-  @media (max-width: 700px) {
-    #publish-queue .publish-table,
-    #publish-queue .publish-table tbody,
-    #publish-queue .publish-table tr,
-    #publish-queue .publish-table td {
-      display: block;
-      min-width: 0;
-      width: auto;
-    }
-    #publish-queue .publish-table thead {
-      position: absolute;
-      width: 1px;
-      height: 1px;
-      overflow: hidden;
-      clip: rect(0 0 0 0);
-      clip-path: inset(50%);
-      white-space: nowrap;
-    }
-    #publish-queue .publish-table tbody tr {
-      margin: 0 0 12px;
-      padding: 10px 12px;
-      border: 1px solid var(--admin-line);
-      border-radius: var(--admin-radius-sm);
-      background: var(--admin-surface, #fff);
-    }
-    #publish-queue .publish-table tbody td {
-      padding: 4px 0;
-      text-align: left;
-      border: 0;
-    }
-    #publish-queue .publish-table tbody td:not([colspan])::before {
-      display: block;
-      margin-bottom: 2px;
-      font-size: 11px;
-      font-weight: 600;
-      text-transform: uppercase;
-      letter-spacing: 0.04em;
-      opacity: 0.6;
-    }
-    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(1)::before {
-      content: "Change";
-    }
-    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(2)::before {
-      content: "Status";
-    }
-    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(3)::before {
-      content: "Checks";
-    }
-    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(4)::before {
-      content: "Head";
-    }
-    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(5)::before {
-      content: "Updated";
-    }
-    #publish-queue .publish-table tbody td:not([colspan]):nth-of-type(6)::before {
-      content: "Actions";
-    }
-  }
-
-  /* Collapsible panels (What needs your approval, Next release, Live Site): the
-     panel-head IS the summary. Kill the native marker, add a rotating chevron, and
-     make the whole head a click target. Mirrors the Rollback options (.versions-details). */
-  .publish-queue-details > summary.panel-head,
-  .closed-changes-details > summary.panel-head,
-  .agg-console-details > summary.panel-head,
-  .live-site-details > summary.panel-head,
-  .versions-details > summary.live-site-subhead {
-    cursor: pointer;
-    list-style: none;
-    user-select: none;
-  }
-  .publish-queue-details > summary.panel-head::-webkit-details-marker,
-  .closed-changes-details > summary.panel-head::-webkit-details-marker,
-  .agg-console-details > summary.panel-head::-webkit-details-marker,
-  .live-site-details > summary.panel-head::-webkit-details-marker,
-  .versions-details > summary.live-site-subhead::-webkit-details-marker {
-    display: none;
-  }
-  .publish-queue-details > summary.panel-head h3::before,
-  .closed-changes-details > summary.panel-head h3::before,
-  .agg-console-details > summary.panel-head h3::before,
-  .live-site-details > summary.panel-head h3::before,
-  .versions-details > summary.live-site-subhead h4::before {
-    content: "";
-    width: 7px;
-    height: 7px;
-    margin-right: 2px;
-    border-right: 2px solid currentColor;
-    border-bottom: 2px solid currentColor;
-    transform: rotate(-45deg);
-    transition: transform 0.15s ease;
-    opacity: 0.6;
-  }
-  .publish-queue-details[open] > summary.panel-head h3::before,
-  .closed-changes-details[open] > summary.panel-head h3::before,
-  .agg-console-details[open] > summary.panel-head h3::before,
-  .live-site-details[open] > summary.panel-head h3::before,
-  .versions-details[open] > summary.live-site-subhead h4::before {
-    transform: rotate(45deg);
-  }
-
-  /* The collapsed release summary owns one mutually exclusive state affordance:
-     a green current-state chip or the action that advances live. Both classes set
-     display, so explicitly preserve the semantic hidden state. */
-  [data-live-release-state][hidden],
-  .live-release-publish[hidden] {
-    display: none;
-  }
-
-  /* Live Site — the two clickable public entry points, previously undiscoverable. */
-  .live-site-links {
-    list-style: none;
-    margin: 0;
-    padding: 0;
-    display: grid;
-    gap: 12px;
-  }
-  .live-site-links > li {
-    display: grid;
-    grid-template-columns: minmax(96px, auto) 1fr;
-    align-items: baseline;
-    gap: 4px 12px;
-  }
-  .live-site-link-label {
-    font-weight: 600;
-    font-size: 13px;
-    color: var(--admin-fg, inherit);
-  }
-  .live-site-link-url {
-    word-break: break-all;
-    font-size: 13px;
-  }
-  .live-site-link-note {
-    grid-column: 2;
-    font-size: 12px;
-    opacity: 0.7;
-  }
-
-  /* r13 — Rollback + Public domain nested INSIDE Live Site read as a subsection,
-     not a sibling panel: a single left rule + generous spacing rather than a boxed
-     card, so the Live Site panel doesn't stack boxes-in-boxes. */
-  .live-site-subsection {
-    border-left: 2px solid var(--admin-line);
-    padding-left: 16px;
-    margin-top: 18px;
-    display: grid;
-    gap: 12px;
-  }
-  /* r13 — the Public-domain status trio (Serving from / Rollback records / Last run)
-     were full `.field` cards (border + fill) nested inside the Live Site panel — the
-     genuine boxes-in-boxes. Flatten them to plain label/value blocks (hooks kept);
-     the subsection's left rule + grid gap carry the separation instead. */
-  .live-site-subsection .field {
-    border: 0;
-    background: transparent;
-    padding: 0;
-  }
-  .live-site-subhead {
-    display: flex;
-    align-items: center;
-    justify-content: space-between;
-    gap: 12px;
-  }
-  .live-site-subhead h4 {
-    margin: 0;
-    display: flex;
-    align-items: center;
-    gap: 8px;
-    font-size: 14px;
-  }
-
-  .publish-mono {
-    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-    font-size: 12px;
-  }
-
-  /* r11 — the human release name beside the "Next release" heading. */
-  .agg-release-name {
-    font-size: 13px;
-    font-weight: 600;
-    color: var(--admin-muted);
-  }
-  .agg-release-name[hidden] {
-    display: none;
-  }
-
-  /* r02 — the humanized "Live version" metric: "v42" as a link to the live store,
-     with the raw SHA tucked into a "Technical details" disclosure. */
-  .live-version-link {
-    color: inherit;
-    text-decoration: none;
-    border-bottom: 1px solid color-mix(in srgb, currentColor 35%, transparent);
-  }
-  .live-version-link:hover {
-    border-bottom-color: currentColor;
-  }
-  .metric-tech,
-  .ver-tech {
-    margin-top: 4px;
-    font-size: 12px;
-  }
-  .metric-tech > summary,
-  .ver-tech > summary {
-    cursor: pointer;
-    color: var(--muted, #64716d);
-    font-size: 11px;
-    list-style: none;
-  }
-  .metric-tech > summary::-webkit-details-marker,
-  .ver-tech > summary::-webkit-details-marker {
-    display: none;
-  }
-  .ver-tech {
-    margin-top: 6px;
-  }
-
-  /* r08 — the "Copy preview link" affordance (icon + text, never color-only). */
-  .publish-copy-preview {
-    display: inline-flex;
-    align-items: center;
-    gap: 5px;
-  }
-  .publish-copy-preview svg {
-    width: 14px;
-    height: 14px;
-  }
-
-  .publish-actions {
-    white-space: nowrap;
-  }
-
-  .publish-actions .btn {
-    margin-left: 6px;
-  }
-
-  /* The per-row orphan "Delete this branch" action — a deliberate, destructive,
-     one-at-a-time HUMAN delete, styled distinct from the neutral "Clean up" and the
-     bulk "Sweep dead branches" so it never reads as a routine cleanup. */
-  .btn.branch-delete-orphan {
-    border-color: var(--admin-danger, #b3261e);
-    color: var(--admin-danger, #b3261e);
-  }
-
-  .btn.branch-delete-orphan:not(:disabled):hover {
-    background: var(--admin-danger, #b3261e);
-    color: #fff;
-  }
-
-  .publish-status {
-    min-height: 0;
-  }
-
-  .publish-status:empty {
-    display: none;
-  }
-
-  .publish-status[data-state="ok"] {
-    color: var(--admin-green);
-  }
-
-  .publish-status[data-state="err"] {
-    color: var(--admin-red);
-  }
-
-  /* Public-site status card, verified-current tone — .risk-alert defaults to an
-     amber/warning look (admin.astro), wrong for "this is fine, confirmed fresh". */
-  .risk-alert.public-site-ok {
-    border-color: var(--admin-green);
-    background: var(--admin-green-soft);
-  }
-
-  .risk-alert.public-site-ok svg {
-    color: var(--admin-green);
-  }
-
-  /* ── State-driven hero (r01) ─────────────────────────────────────────────
-     The single top-of-tab state element. One row: an icon whose tone conveys
-     urgency (never color alone — a "Action needed" kicker rides the two blocker
-     tones), the one-sentence state + supporting detail, and one primary CTA laid
-     out to the trailing edge (like the paywall gate). Tone is set by
-     renderHero() via [data-tone]. */
-  .publish-hero-region {
-    display: grid;
-    gap: 12px;
-  }
-  .publish-hero {
-    display: flex;
-    align-items: center;
-    justify-content: space-between;
-    gap: 16px;
-    flex-wrap: wrap;
-    padding: 14px 16px;
-    border: 1px solid var(--admin-line-strong);
-    border-left-width: 4px;
-    border-radius: var(--admin-radius, 12px);
-    background: var(--admin-surface);
-  }
-  .publish-hero[hidden] {
-    display: none;
-  }
-  .publish-hero-main {
-    display: flex;
-    align-items: center;
-    gap: 13px;
-    min-width: 0;
-  }
-  .publish-hero-icon {
-    flex: none;
-    width: 34px;
-    height: 34px;
-    display: grid;
-    place-items: center;
-    border-radius: 9px;
-    background: var(--admin-surface-soft);
-  }
-  .publish-hero-icon svg {
-    width: 19px;
-    height: 19px;
-  }
-  .publish-hero-copy {
-    display: grid;
-    gap: 2px;
-    min-width: 0;
-  }
-  .publish-hero-kicker {
-    font-size: 10.5px;
-    font-weight: 760;
-    letter-spacing: 0.08em;
-    text-transform: uppercase;
-    color: var(--admin-red);
-  }
-  .publish-hero-kicker[hidden] {
-    display: none;
-  }
-  .publish-hero-headline {
-    font-size: 15.5px;
-    line-height: 1.3;
-    color: var(--admin-ink);
-  }
-  .publish-hero-detail {
-    font-size: 13px;
-    color: var(--admin-muted);
-    line-height: 1.45;
-  }
-  .publish-hero-detail:empty {
-    display: none;
-  }
-  .publish-hero-actions {
-    flex: none;
-    display: flex;
-    gap: 8px;
-  }
-  .publish-hero-cta[hidden] {
-    display: none;
-  }
-
-  /* Tones — the accent rail + icon colour. Blocker/warn borrow the admin
-     red/amber tokens; ready/attention the teal; calm stays neutral. */
-  .publish-hero[data-tone="blocker"] {
-    border-left-color: var(--admin-red);
-    background: var(--admin-red-soft);
-  }
-  .publish-hero[data-tone="blocker"] .publish-hero-icon svg {
-    color: var(--admin-red);
-  }
-  .publish-hero[data-tone="warn"] {
-    border-left-color: var(--admin-amber);
-    background: var(--admin-surface-soft);
-  }
-  .publish-hero[data-tone="warn"] .publish-hero-icon svg {
-    color: var(--admin-amber);
-  }
-  .publish-hero[data-tone="attention"] {
-    border-left-color: var(--admin-teal, #0f9d8f);
-  }
-  .publish-hero[data-tone="attention"] .publish-hero-icon svg {
-    color: var(--admin-teal, #0f9d8f);
-  }
-  .publish-hero[data-tone="ready"] {
-    border-left-color: var(--admin-green);
-    background: var(--admin-green-soft);
-  }
-  .publish-hero[data-tone="ready"] .publish-hero-icon svg {
-    color: var(--admin-green);
-  }
-  .publish-hero[data-tone="calm"] {
-    border-left-color: var(--admin-line-strong);
-  }
-  .publish-hero[data-tone="calm"] .publish-hero-icon svg {
-    color: var(--admin-green);
-  }
-
-  /* r03 stale-public-site alarm — lays its "Open Live Site" deep-link to the
-     trailing edge, like the paywall gate. Inherits the amber .risk-alert look. */
-  .risk-alert.publish-stale-site {
-    display: flex;
-    align-items: center;
-    justify-content: space-between;
-    gap: 12px;
-    flex-wrap: wrap;
-  }
-  .risk-alert.publish-stale-site .btn {
-    flex: none;
-  }
-
-  /* Per-row finding: the ownership-tag chip leads the row's action cell (what's
-     wrong, in operator words), and the mapped action button gets a subtle ring so
-     the operator sees which button resolves it. Tone (red/amber/neutral) rides the
-     shared .chip convention; primed emphasis is added to the EXISTING button. */
-  .publish-actions .publish-finding-chip {
-    vertical-align: middle;
-  }
-
-  .publish-actions .btn.publish-cta-primed {
-    box-shadow: 0 0 0 2px var(--admin-amber);
-  }
-
-  /* ?pr=N deep link: "not in the queue" callout + row flash */
-  .publish-pr-callout {
-    border: 1px solid var(--admin-line-strong);
-    border-left: 3px solid var(--admin-amber);
-    background: var(--admin-surface-soft);
-    padding: 8px 12px;
-    border-radius: var(--admin-radius-sm);
-    color: var(--admin-ink);
-  }
-
-  @keyframes publish-row-flash {
-    0%,
-    25% {
-      background-color: var(--admin-teal-soft);
-    }
-    100% {
-      background-color: transparent;
-    }
-  }
-
-  .publish-row-highlight > td {
-    animation: publish-row-flash 2.4s ease-out;
-  }
-
-  @media (prefers-reduced-motion: reduce) {
-    .publish-row-highlight > td {
-      animation: none;
-      background-color: var(--admin-teal-soft);
-    }
-  }
-
-  .publish-error-detail {
-    color: var(--admin-red);
-    font-size: 12px;
-  }
-
-  /* ── Accept-to-preview LIFTOFF ─────────────────────────────────────────── */
-  .liftoff-backdrop {
-    position: fixed;
-    inset: 0;
-    z-index: 60;
-    display: grid;
-    place-items: center;
-    padding: 24px;
-    background: color-mix(in srgb, var(--admin-ink) 32%, transparent);
-    backdrop-filter: blur(6px);
-    -webkit-backdrop-filter: blur(6px);
-  }
-
-  /* `display: grid` above beats the UA's [hidden] rule — restate it, or the
-     invisible backdrop click-blocks the entire page (caught by live test). */
-  .liftoff-backdrop[hidden] {
-    display: none;
-  }
-
-  .liftoff-card {
-    position: relative;
-    width: min(520px, 100%);
-    max-height: min(84vh, 640px);
-    overflow: auto;
-    border: 1px solid var(--admin-line-strong);
-    border-radius: var(--admin-radius, 12px);
-    background: var(--admin-surface);
-    box-shadow: 0 24px 80px rgba(8, 32, 30, 0.35);
-    padding: 24px 26px;
-    animation: liftoff-in 0.22s ease-out;
-  }
-
-  @keyframes liftoff-in {
-    from { transform: translateY(10px) scale(0.985); opacity: 0; }
-    to { transform: none; opacity: 1; }
-  }
-
-  /* In-flight shimmer: a live gradient beam along the card's top edge. */
-  .liftoff-card::before {
-    content: "";
-    position: absolute;
-    inset: 0 0 auto 0;
-    height: 3px;
-    border-radius: inherit;
-    opacity: 0;
-    background: linear-gradient(90deg, transparent, var(--admin-teal, #0f9d8f), #f4b942, var(--admin-teal, #0f9d8f), transparent);
-    background-size: 220% 100%;
-    transition: opacity 0.3s ease;
-  }
-
-  .liftoff-card[data-mode="flight"]::before {
-    opacity: 1;
-    animation: liftoff-beam 1.6s linear infinite;
-  }
-
-  @keyframes liftoff-beam {
-    from { background-position: 200% 0; }
-    to { background-position: -20% 0; }
-  }
-
-  .liftoff-kicker {
-    margin: 0 0 2px;
-    font-size: 11px;
-    font-weight: 700;
-    letter-spacing: 0.08em;
-    text-transform: uppercase;
-    color: var(--admin-teal, #0f9d8f);
-  }
-
-  .liftoff-title {
-    margin: 0 0 14px;
-    font-size: 19px;
-    line-height: 1.25;
-  }
-
-  .liftoff-grid {
-    display: grid;
-    grid-template-columns: auto 1fr;
-    gap: 6px 16px;
-    margin: 0 0 12px;
-    padding: 12px 14px;
-    border: 1px solid var(--admin-line-strong);
-    border-radius: var(--admin-radius-sm);
-    background: var(--admin-surface-soft);
-  }
-
-  .liftoff-grid dt {
-    color: var(--admin-muted);
-    font-size: 12px;
-  }
-
-  .liftoff-grid dd {
-    margin: 0;
-    font-size: 13px;
-  }
-
-  .liftoff-actions {
-    display: flex;
-    justify-content: flex-end;
-    gap: 8px;
-    margin-top: 16px;
-  }
-
-  /* Merge-conflict guidance (outcome phase, reason "merge_failed" only) —
-     directions, not mood: the terminal recovery front and center, the forge's
-     raw refusal kept small underneath for support/diagnosis. Left-aligned
-     inside the centered outcome phase: commands and prose read as
-     instructions, not ceremony. */
-  .liftoff-conflict {
-    margin-top: 10px;
-    text-align: left;
-  }
-
-  .liftoff-commands {
-    margin: 10px 0 8px;
-    padding: 10px 12px;
-    border: 1px solid var(--admin-line-strong);
-    border-radius: var(--admin-radius-sm);
-    background: var(--admin-surface-soft);
-    font-size: 12px;
-    line-height: 1.55;
-    overflow-x: auto;
-    white-space: pre;
-  }
-
-  .liftoff-conflict-actions {
-    display: flex;
-    justify-content: flex-end;
-    gap: 8px;
-    flex-wrap: wrap;
-  }
-
-  .liftoff-conflict-raw {
-    margin: 10px 0 0;
-    font-size: 11px;
-    color: var(--admin-muted);
-    overflow-wrap: anywhere;
-  }
-
-  /* Automate-first recovery: the primary action leads, option cards appear
-     only on a genuine overlap, the terminal guidance is a collapsed fallback. */
-  .liftoff-conflict-summary {
-    margin: 0 0 10px;
-  }
-  .liftoff-conflict-primary {
-    display: flex;
-    flex-direction: column;
-    align-items: flex-start;
-    gap: 8px;
-    margin-bottom: 12px;
-  }
-  .liftoff-conflict-primary .btn.primary {
-    align-self: flex-start;
-  }
-  .liftoff-conflict-primary-status[data-state="err"],
-  .liftoff-conflict-cards-status[data-state="err"] {
-    color: var(--admin-danger, #b3261e);
-  }
-  .liftoff-conflict-cards {
-    margin: 4px 0 12px;
-    padding: 12px;
-    border: 1px solid var(--admin-line-strong);
-    border-radius: var(--admin-radius-sm);
-    background: var(--admin-surface-soft);
-  }
-  .liftoff-conflict-files {
-    list-style: none;
-    margin: 8px 0 12px;
-    padding: 8px 10px;
-    border-radius: var(--admin-radius-sm);
-    background: var(--admin-surface, #fff);
-    font-size: 12px;
-    line-height: 1.6;
-    overflow-x: auto;
-  }
-  .liftoff-conflict-card-grid {
-    display: grid;
-    grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
-    gap: 8px;
-  }
-  .liftoff-option-card {
-    display: flex;
-    flex-direction: column;
-    gap: 4px;
-    text-align: left;
-    padding: 12px;
-    border: 1px solid var(--admin-line-strong);
-    border-radius: var(--admin-radius-sm);
-    background: var(--admin-surface, #fff);
-    cursor: pointer;
-    font: inherit;
-    color: inherit;
-  }
-  .liftoff-option-card:hover:not(:disabled) {
-    border-color: var(--admin-accent, #0f9d8f);
-  }
-  .liftoff-option-card:disabled {
-    opacity: 0.55;
-    cursor: default;
-  }
-  .liftoff-option-card[data-recommended="1"] {
-    border-color: var(--admin-accent, #0f9d8f);
-    box-shadow: inset 0 0 0 1px var(--admin-accent, #0f9d8f);
-  }
-  .liftoff-option-card b {
-    font-size: 13px;
-  }
-  .liftoff-option-card span {
-    font-size: 11px;
-    color: var(--admin-muted);
-  }
-  .liftoff-conflict-expert {
-    margin-top: 10px;
-    border-top: 1px solid var(--admin-line, #e5e5e5);
-    padding-top: 8px;
-  }
-  .liftoff-conflict-expert > summary {
-    cursor: pointer;
-    font-size: 12px;
-    color: var(--admin-muted);
-    user-select: none;
-  }
-
-  .liftoff-stages {
-    list-style: none;
-    margin: 6px 0 4px;
-    padding: 0;
-    display: grid;
-    gap: 0;
-  }
-
-  .liftoff-stages li {
-    position: relative;
-    display: flex;
-    gap: 12px;
-    align-items: flex-start;
-    padding: 9px 0;
-  }
-
-  /* Connecting rail between the dots. */
-  .liftoff-stages li + li::before {
-    content: "";
-    position: absolute;
-    left: 10px;
-    top: -8px;
-    height: 16px;
-    width: 2px;
-    background: var(--admin-line-strong);
-  }
-
-  .liftoff-stages li > div {
-    display: grid;
-    gap: 1px;
-  }
-
-  .liftoff-stages b {
-    font-size: 13px;
-  }
-
-  .liftoff-stages span:not(.liftoff-dot) {
-    font-size: 12px;
-    color: var(--admin-muted);
-  }
-
-  .liftoff-dot {
-    flex: none;
-    width: 21px;
-    height: 21px;
-    margin-top: 1px;
-    border-radius: 50%;
-    border: 2px solid var(--admin-line-strong);
-    display: grid;
-    place-items: center;
-    font-size: 12px;
-    font-weight: 700;
-    color: #fff;
-    background: transparent;
-    transition: all 0.25s ease;
-  }
-
-  .liftoff-stages li[data-state="active"] .liftoff-dot {
-    border-color: var(--admin-teal, #0f9d8f);
-    box-shadow: 0 0 0 0 color-mix(in srgb, var(--admin-teal, #0f9d8f) 45%, transparent);
-    animation: liftoff-pulse 1.3s ease-out infinite;
-  }
-
-  .liftoff-stages li[data-state="active"] b {
-    color: var(--admin-teal, #0f9d8f);
-  }
-
-  @keyframes liftoff-pulse {
-    from { box-shadow: 0 0 0 0 color-mix(in srgb, var(--admin-teal, #0f9d8f) 45%, transparent); }
-    to { box-shadow: 0 0 0 10px transparent; }
-  }
-
-  .liftoff-stages li[data-state="done"] .liftoff-dot {
-    border-color: var(--admin-green);
-    background: var(--admin-green);
-  }
-
-  .liftoff-stages li[data-state="done"] .liftoff-dot::after {
-    content: "✓";
-  }
-
-  .liftoff-stages li[data-state="fail"] .liftoff-dot {
-    border-color: var(--admin-red);
-    background: var(--admin-red);
-  }
-
-  .liftoff-stages li[data-state="fail"] .liftoff-dot::after {
-    content: "✕";
-  }
-
-  .liftoff-live {
-    margin: 8px 0 0;
-    min-height: 18px;
-    font-size: 13px;
-    color: var(--admin-ink);
-  }
-
-  /* The shared scrolling live-log console — a "CI build log" window reused across
-     the build / integrate / rebuild / ship flight dialogs. Fixed height, scrolls,
-     newest line auto-scrolled into view by the client (see makeLogConsole). */
-  .stream-log {
-    margin: 10px 0 0;
-    max-height: 150px;
-    overflow-y: auto;
-    padding: 8px 10px;
-    border: 1px solid var(--admin-border, rgba(0, 0, 0, 0.12));
-    border-radius: 8px;
-    background: var(--admin-code-bg, rgba(0, 0, 0, 0.04));
-    font-family: ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, monospace;
-    font-size: 12px;
-    line-height: 1.5;
-    color: var(--admin-ink);
-    -webkit-overflow-scrolling: touch;
-  }
-  .stream-log:empty {
-    display: none;
-  }
-  .stream-log-line {
-    white-space: pre-wrap;
-    word-break: break-word;
-  }
-
-  .liftoff-meta {
-    display: flex;
-    justify-content: space-between;
-    align-items: center;
-    margin-top: 14px;
-    color: var(--admin-muted);
-  }
-
-  .liftoff-outcome-phase {
-    text-align: center;
-    padding-top: 6px;
-  }
-
-  .liftoff-outcome-phase .liftoff-actions {
-    justify-content: center;
-  }
-
-  .liftoff-seal {
-    width: 56px;
-    height: 56px;
-    margin: 4px auto 12px;
-    border-radius: 50%;
-    display: grid;
-    place-items: center;
-    font-size: 28px;
-    font-weight: 700;
-    color: #fff;
-  }
-
-  .liftoff-seal[data-state="ok"] {
-    background: var(--admin-green);
-    animation: liftoff-seal-pop 0.45s cubic-bezier(0.2, 1.6, 0.4, 1);
-  }
-
-  .liftoff-seal[data-state="ok"]::after {
-    content: "✓";
-  }
-
-  .liftoff-seal[data-state="err"] {
-    background: var(--admin-red);
-  }
-
-  .liftoff-seal[data-state="err"]::after {
-    content: "✕";
-  }
-
-  @keyframes liftoff-seal-pop {
-    from { transform: scale(0.4); opacity: 0; }
-    60% { transform: scale(1.12); }
-    to { transform: none; opacity: 1; }
-  }
-
-  .liftoff-confetti {
-    pointer-events: none;
-    position: absolute;
-    inset: 0;
-    overflow: hidden;
-    border-radius: inherit;
-  }
-
-  .liftoff-confetti i {
-    position: absolute;
-    top: -12px;
-    width: 7px;
-    height: 11px;
-    border-radius: 2px;
-    opacity: 0;
-    animation-name: liftoff-confetti-fall;
-    animation-timing-function: ease-in;
-    animation-fill-mode: forwards;
-  }
-
-  @keyframes liftoff-confetti-fall {
-    0% { opacity: 1; transform: translate(0, 0) rotate(0deg); }
-    100% {
-      opacity: 0.9;
-      transform: translate(var(--liftoff-drift, 0px), 660px) rotate(var(--liftoff-spin, 240deg));
-    }
-  }
-
-  @media (prefers-reduced-motion: reduce) {
-    .liftoff-card,
-    .liftoff-card[data-mode="flight"]::before,
-    .liftoff-stages li[data-state="active"] .liftoff-dot,
-    .liftoff-seal[data-state="ok"] {
-      animation: none;
-    }
-  }
-
-  .domain-connect-controls {
-    display: grid;
-    gap: 8px;
-    justify-items: end;
-    min-width: 220px;
-  }
-
-  .domain-connect-controls input[type="text"] {
-    width: 100%;
-    min-height: 36px;
-    padding: 0 10px;
-    border: 1px solid var(--admin-line-strong);
-    border-radius: var(--admin-radius-sm);
-    background: var(--admin-surface);
-    color: var(--admin-ink);
-    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-    font-size: 12px;
-  }
-
-  .domain-rehearsal {
-    display: inline-flex;
-    align-items: center;
-    gap: 6px;
-    color: var(--admin-muted);
-    font-size: 12px;
-  }
-
-  @media (max-width: 720px) {
-    .domain-connect-controls {
-      justify-items: stretch;
-      min-width: 0;
-      width: 100%;
-    }
-  }
-
-  /* Apex-cutover readiness itemization */
-  .domain-readiness {
-    margin: 0.75rem 0;
-    padding: 0.75rem 1rem;
-    border: 1px solid var(--hairline, rgba(0, 0, 0, 0.12));
-    border-radius: 0.5rem;
-  }
-  .domain-readiness-head {
-    display: flex;
-    align-items: center;
-    gap: 0.5rem;
-    margin-bottom: 0.5rem;
-  }
-  .domain-readiness-list {
-    list-style: none;
-    margin: 0;
-    padding: 0;
-    display: grid;
-    gap: 0.25rem;
-  }
-  .domain-readiness-list li {
-    display: grid;
-    gap: 0.1rem;
-    font-size: 0.9em;
-  }
-  .domain-readiness-item-head {
-    display: flex;
-    align-items: baseline;
-    gap: 0.4rem;
-  }
-  .domain-readiness-mark {
-    font-weight: 700;
-    width: 1em;
-    flex: 0 0 auto;
-  }
-  .domain-readiness-list li.ok .domain-readiness-mark {
-    color: var(--good, #1a7f37);
-  }
-  .domain-readiness-list li.blocked .domain-readiness-mark {
-    color: var(--bad, #b42318);
-  }
-  /* detail + remedy sit on their OWN lines, indented under the label (past the
-     mark) so neither runs together with the bold label above it. */
-  .domain-readiness-detail,
-  .domain-readiness-remedy {
-    margin: 0;
-    padding-left: 1.4em;
-  }
-  .domain-readiness-detail {
-    opacity: 0.75;
-  }
-  .domain-readiness-remedy {
-    color: var(--accent, #0b6bcb);
-    opacity: 0.95;
-  }
-
-  /* Aggregate card + ship plan */
-  .aggregate-prs {
-    display: grid;
-    gap: 6px;
-  }
-
-  .aggregate-prs-list {
-    list-style: none;
-    margin: 0;
-    padding: 0;
-    display: grid;
-    gap: 4px;
-  }
-
-  .aggregate-prs-list li {
-    display: flex;
-    align-items: center;
-    gap: 8px;
-    font-size: 13px;
-  }
-
-  /* Provenance ("integrated <age> by <email>") sits after the sha, subtle. */
-  .aggregate-pr-meta {
-    font-size: 12px;
-  }
-
-  /* The per-change Undo (revert) button is pushed to the row's trailing edge
-     and kept compact so the batch reads as a list, not a stack of buttons. */
-  .aggregate-prs-list .btn-compact {
-    margin-left: auto;
-    padding: 2px 10px;
-    font-size: 12px;
-  }
-
-  .aggregate-plan {
-    padding: 0.75rem 1rem;
-    border: 1px solid var(--hairline, rgba(0, 0, 0, 0.12));
-    border-radius: 0.5rem;
-    display: grid;
-    gap: 8px;
-  }
-
-  .aggregate-plan-head {
-    display: flex;
-    align-items: center;
-    gap: 0.5rem;
-  }
-
-  .aggregate-plan-grid {
-    display: grid;
-    grid-template-columns: max-content 1fr;
-    gap: 4px 16px;
-    margin: 0;
-  }
-
-  .aggregate-plan-grid dt {
-    color: var(--admin-muted);
-    font-size: 12px;
-  }
-
-  .aggregate-plan-grid dd {
-    margin: 0;
-    font-size: 13px;
-    overflow-wrap: anywhere;
-  }
-
-  /* ── Preview-aggregate console — the go-live surface ─────────────────────
-     Everything here is scoped under [data-publish-aggregate] / .agg-* so it
-     never leaks into the other panels (candidate queue, versions, branches)
-     that share .panel / .field / .check-row / .chip. */
-  .agg-console .panel-body {
-    gap: 16px;
-  }
-
-  [data-publish-aggregate] .sha-token {
-    display: inline-flex;
-    align-items: center;
-    padding: 2px 8px;
-    border: 1px solid var(--admin-line-strong);
-    border-radius: 5px;
-    background: var(--admin-surface-soft);
-    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-    font-size: 12.5px;
-    color: var(--admin-ink);
-  }
-  [data-publish-aggregate] .sha-token.ghost {
-    background: transparent;
-    color: var(--admin-muted);
-    border-style: dashed;
-  }
-
-  /* AI-assembled release summary */
-  .agg-summary {
-    display: grid;
-    gap: 11px;
-    padding: 15px 16px;
-    border: 1px solid var(--admin-line);
-    border-radius: var(--admin-radius);
-    background:
-      linear-gradient(180deg, var(--admin-teal-soft), transparent 62%),
-      var(--admin-surface);
-  }
-  .agg-summary[hidden] {
-    display: none;
-  }
-  .agg-summary-head {
-    display: flex;
-    align-items: center;
-    gap: 10px;
-  }
-  .agg-summary-glyph {
-    flex: none;
-    width: 26px;
-    height: 26px;
-    display: grid;
-    place-items: center;
-    border-radius: 7px;
-    background: var(--admin-surface);
-    color: var(--admin-teal-dark);
-    border: 1px solid color-mix(in srgb, var(--admin-teal) 30%, transparent);
-  }
-  /* The sparkle glyphs are filled shapes; opt out of the global stroked-svg rule. */
-  .agg-summary-glyph svg,
-  .agg-ai-chip svg {
-    fill: currentColor;
-    stroke: none;
-  }
-  .agg-summary-glyph svg {
-    width: 15px;
-    height: 15px;
-  }
-  .agg-summary-label {
-    flex: 1;
-    font-size: 11px;
-    font-weight: 760;
-    letter-spacing: 0.08em;
-    text-transform: uppercase;
-    color: var(--admin-muted);
-  }
-  .agg-ai-chip {
-    display: inline-flex;
-    align-items: center;
-    gap: 5px;
-    padding: 3px 9px;
-    border-radius: 999px;
-    background: var(--admin-teal-soft);
-    color: #007973;
-    font-size: 10px;
-    font-weight: 760;
-    letter-spacing: 0.06em;
-    text-transform: uppercase;
-  }
-  .agg-ai-chip svg {
-    width: 10px;
-    height: 10px;
-  }
-  .agg-summary-lead {
-    margin: 0;
-    font-size: 15px;
-    line-height: 1.55;
-    color: var(--admin-ink);
-    max-width: 68ch;
-  }
-  .agg-summary-points {
-    list-style: none;
-    margin: 0;
-    padding: 0;
-    display: grid;
-    gap: 7px;
-  }
-  .agg-summary-points[hidden] {
-    display: none;
-  }
-  .agg-summary-points li {
-    display: flex;
-    align-items: flex-start;
-    gap: 9px;
-    font-size: 13px;
-    color: var(--admin-muted);
-    line-height: 1.45;
-  }
-  .agg-summary-points .agg-tick {
-    flex: none;
-    margin-top: 1px;
-    width: 16px;
-    height: 16px;
-    border-radius: 50%;
-    display: grid;
-    place-items: center;
-    background: var(--admin-green-soft);
-    color: var(--admin-green);
-  }
-  .agg-summary-points .agg-tick svg {
-    width: 10px;
-    height: 10px;
-  }
-  .agg-summary-points b {
-    color: var(--admin-ink);
-    font-weight: 640;
-  }
-
-  /* Chain of custody: build → evidence → digest */
-  .agg-chain {
-    display: grid;
-    grid-template-columns: 1fr auto 1fr auto 1fr;
-    align-items: stretch;
-    padding: 16px;
-    border: 1px solid var(--admin-line);
-    border-radius: var(--admin-radius);
-    background: var(--admin-surface-soft);
-  }
-  .agg-stop {
-    display: flex;
-    flex-direction: column;
-    gap: 7px;
-    padding: 2px 12px;
-    min-width: 0;
-  }
-  .agg-stop:first-child {
-    padding-left: 2px;
-  }
-  .agg-stop:last-child {
-    padding-right: 2px;
-  }
-  .agg-stop-label {
-    font-size: 10.5px;
-    font-weight: 760;
-    letter-spacing: 0.08em;
-    text-transform: uppercase;
-    color: var(--admin-muted);
-  }
-  .agg-stop-val {
-    display: flex;
-    align-items: center;
-    gap: 8px;
-    font-size: 15px;
-    font-weight: 680;
-  }
-  .agg-stop-val strong {
-    font-size: 15px;
-  }
-  .agg-stop-cap {
-    margin: 0;
-    font-size: 12px;
-    color: var(--admin-muted);
-    line-height: 1.45;
-  }
-  .agg-stop-cap a {
-    white-space: nowrap;
-  }
-  .agg-digest {
-    padding: 2px 8px;
-    border: 1px solid color-mix(in srgb, var(--admin-teal) 55%, var(--admin-line-strong));
-    border-radius: 5px;
-    background: var(--admin-teal-soft);
-    color: #007973;
-  }
-  [data-publish-aggregate] [data-aggregate-evidence][data-state="passed"] {
-    color: var(--admin-green);
-  }
-  [data-publish-aggregate] [data-aggregate-evidence][data-state="failed"] {
-    color: var(--admin-red);
-  }
-  .agg-link {
-    display: flex;
-    flex-direction: column;
-    align-items: center;
-    justify-content: center;
-    gap: 6px;
-    padding: 0 2px;
-    align-self: center;
-  }
-  .agg-flowlabel {
-    font-size: 9px;
-    font-weight: 720;
-    letter-spacing: 0.06em;
-    text-transform: uppercase;
-    color: var(--admin-muted-2);
-  }
-  .agg-arrow {
-    display: grid;
-    place-items: center;
-    color: var(--admin-teal);
-  }
-  .agg-arrow svg {
-    width: 32px;
-    height: 10px;
-  }
-
-  /* Staged → live delta strip */
-  .agg-delta-strip {
-    display: flex;
-    align-items: center;
-    gap: 12px;
-    flex-wrap: wrap;
-    padding: 10px 13px;
-    border: 1px solid var(--admin-line);
-    border-radius: var(--admin-radius-sm);
-    background: var(--admin-surface-soft);
-  }
-  .agg-delta-strip[hidden] {
-    display: none;
-  }
-  .agg-delta-node {
-    display: flex;
-    flex-direction: column;
-    gap: 3px;
-  }
-  .agg-delta-mid {
-    display: flex;
-    align-items: center;
-    gap: 8px;
-    color: var(--admin-teal);
-  }
-  .agg-delta-mid svg {
-    width: 24px;
-    height: 10px;
-  }
-  .agg-delta-count {
-    padding: 2px 9px;
-    border-radius: 999px;
-    background: var(--admin-teal-soft);
-    color: #007973;
-    font-size: 11.5px;
-    font-weight: 720;
-  }
-
-  /* Publish plan → launch manifest */
-  [data-publish-aggregate] .agg-manifest {
-    display: block;
-    padding: 0;
-    overflow: hidden;
-    background:
-      linear-gradient(180deg, var(--admin-surface-tint), transparent 46px),
-      var(--admin-surface);
-  }
-  .agg-manifest-head {
-    padding: 12px 15px;
-    border-bottom: 1px dashed var(--admin-line-strong);
-  }
-  .agg-manifest-head b {
-    display: flex;
-    align-items: center;
-    gap: 8px;
-    font-size: 13px;
-  }
-  .agg-manifest-head b svg {
-    width: 15px;
-    height: 15px;
-    color: var(--admin-teal);
-  }
-  [data-publish-aggregate] .agg-manifest .aggregate-plan-grid {
-    padding: 8px 15px 12px;
-  }
-  [data-publish-aggregate] .agg-manifest > .note {
-    margin: 0;
-    padding: 11px 15px;
-    border-top: 1px dashed var(--admin-line-strong);
-    background: var(--admin-surface-soft);
-  }
-
-  /* Openable "Included changes" — reused by the Published Versions "What
-     shipped" per-version disclosure (.ver-changes below); the staged-delta
-     table above no longer uses the <details> wrap itself, only the row/diff
-     classes it shares with changeSummaryItem. */
-  .agg-included-details > summary {
-    list-style: none;
-    cursor: pointer;
-    display: flex;
-    align-items: center;
-    gap: 10px;
-    padding: 11px 15px;
-    font-size: 12px;
-    color: var(--admin-muted);
-  }
-  .agg-included-details > summary::-webkit-details-marker {
-    display: none;
-  }
-  .agg-included-details > summary::marker {
-    content: "";
-  }
-  .agg-included-details > summary:focus-visible {
-    outline: 2px solid var(--admin-teal);
-    outline-offset: -2px;
-  }
-  .agg-included-lead {
-    font-size: 11px;
-    font-weight: 740;
-    letter-spacing: 0.03em;
-    text-transform: uppercase;
-    color: var(--admin-ink);
-  }
-  .agg-included-badge {
-    padding: 1px 8px;
-    border-radius: 999px;
-    background: var(--admin-surface-tint);
-    color: #3f4d49;
-    font-size: 11.5px;
-    font-weight: 720;
-  }
-  .agg-chev {
-    margin-left: auto;
-    display: inline-flex;
-    color: var(--admin-muted-2);
-    transition: transform 0.18s ease;
-  }
-  .agg-chev svg {
-    width: 14px;
-    height: 14px;
-  }
-  .agg-included-details[open] > summary .agg-chev {
-    transform: rotate(90deg);
-  }
-  @media (prefers-reduced-motion: reduce) {
-    .agg-chev {
-      transition: none;
-    }
-  }
-  .agg-included-list {
-    list-style: none;
-    margin: 0;
-    padding: 0 15px 14px;
-    display: grid;
-    gap: 8px;
-  }
-  .agg-included-item {
-    display: grid;
-    gap: 5px;
-    padding: 11px 12px;
-    border: 1px solid var(--admin-line);
-    border-radius: var(--admin-radius-sm);
-    background: var(--admin-surface-soft);
-  }
-  .agg-included-top {
-    display: flex;
-    align-items: center;
-    gap: 10px;
-    flex-wrap: wrap;
-  }
-  .agg-included-pr {
-    font-weight: 720;
-    font-size: 13px;
-  }
-  .agg-included-title {
-    font-weight: 600;
-    font-size: 13.5px;
-  }
-  .agg-included-desc {
-    margin: 0;
-    color: var(--admin-muted);
-    font-size: 12.5px;
-    line-height: 1.5;
-  }
-  .agg-included-meta {
-    display: flex;
-    align-items: center;
-    gap: 6px;
-    flex-wrap: wrap;
-    color: var(--admin-muted-2);
-    font-size: 11.5px;
-  }
-  .agg-included-meta > span + span::before {
-    content: "·";
-    padding-right: 6px;
-    color: var(--admin-line-strong);
-  }
-  .agg-included-meta .sha-token {
-    font-size: 11px;
-    padding: 1px 6px;
-  }
-
-  /* Published-versions "what shipped": the release summary lead + openable
-     per-change list, inline in the Version cell. Reuses the .agg-included-*
-     item markup; only the container chrome is retuned for a table cell. */
-  .ver-summary {
-    margin: 6px 0 0;
-    color: var(--admin-muted);
-    font-size: 12.5px;
-    line-height: 1.5;
-    max-width: 48ch;
-  }
-  .ver-changes {
-    margin-top: 8px;
-    border: 1px solid var(--admin-line);
-    border-radius: var(--admin-radius-sm);
-    background: var(--admin-surface-soft);
-  }
-  .ver-changes > summary {
-    padding: 8px 10px;
-  }
-  .ver-changes .agg-included-list {
-    padding: 0 10px 10px;
-  }
-
-  /* Branch-retention "what this branch changes": the PR title + one-line
-     description + scope meta, inline under the branch ref. */
-  .branch-pr-title {
-    margin: 6px 0 0;
-    font-weight: 600;
-    font-size: 13px;
-    color: var(--admin-ink);
-    max-width: 46ch;
-  }
-  .branch-pr-desc {
-    margin: 3px 0 0;
-    color: var(--admin-muted);
-    font-size: 12.5px;
-    line-height: 1.5;
-    max-width: 46ch;
-  }
-  .branch-pr-meta {
-    margin-top: 5px;
-  }
-  .branch-pr-ai {
-    color: var(--admin-teal-dark);
-    font-weight: 640;
-  }
-
-  /* Scope-of-change: lines added/removed (green/red), + the top-level readout */
-  .agg-lines {
-    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-    font-variant-numeric: tabular-nums;
-    white-space: nowrap;
-  }
-  .agg-add {
-    color: var(--admin-green);
-  }
-  .agg-del {
-    color: var(--admin-red);
-  }
-
-  /* "View diff" disclosure for a trivial change (the diff IS its summary). */
-  .agg-diff {
-    margin-top: 2px;
-  }
-  .agg-diff > summary {
-    cursor: pointer;
-    font-size: 11.5px;
-    font-weight: 640;
-    color: var(--admin-teal-dark);
-    width: max-content;
-  }
-  .agg-diff[open] > summary {
-    margin-bottom: 6px;
-  }
-  .agg-diff-file {
-    margin-top: 6px;
-  }
-  .agg-diff-path {
-    font-size: 11px;
-    color: var(--admin-muted);
-    margin-bottom: 3px;
-  }
-  .agg-diff-patch {
-    margin: 0;
-    padding: 8px 10px;
-    border: 1px solid var(--admin-line);
-    border-radius: var(--admin-radius-sm);
-    background: var(--admin-surface);
-    font-size: 11.5px;
-    line-height: 1.5;
-    overflow-x: auto;
-    white-space: pre;
-  }
-  .agg-diff-add {
-    color: var(--admin-green);
-    background: var(--admin-green-soft);
-  }
-  .agg-diff-del {
-    color: var(--admin-red);
-    background: var(--admin-red-soft);
-  }
-  .agg-diff-hunk {
-    color: var(--admin-muted-2);
-  }
-
-  .agg-staged-head {
-    display: flex;
-    align-items: baseline;
-    justify-content: space-between;
-    gap: 12px;
-    flex-wrap: wrap;
-  }
-  .agg-scope {
-    display: inline-flex;
-    align-items: center;
-    gap: 8px;
-    padding: 3px 10px;
-    border: 1px solid var(--admin-line);
-    border-radius: 999px;
-    background: var(--admin-surface-soft);
-    font-size: 11.5px;
-    color: var(--admin-ink);
-  }
-  .agg-scope[hidden] {
-    display: none;
-  }
-  .agg-scope > span + span::before {
-    content: "·";
-    padding-right: 8px;
-    color: var(--admin-line-strong);
-  }
-  .agg-scope-label {
-    font-size: 10px;
-    font-weight: 760;
-    letter-spacing: 0.08em;
-    text-transform: uppercase;
-    color: var(--admin-muted);
-  }
-  .agg-scope-partial {
-    color: var(--admin-muted-2);
-    font-style: italic;
-    cursor: help;
-  }
-
-  /* Publish action — stack the copy above a full-width, weighted CTA */
-  [data-publish-aggregate] .agg-launch {
-    display: grid;
-    grid-template-columns: 1fr;
-    gap: 12px;
-    padding: 14px 0 2px;
-  }
-  /* Extra selector weight so the gradient/shadow beat the .btn.primary base. */
-  [data-publish-aggregate] .btn.agg-publish-btn {
-    width: 100%;
-    justify-content: center;
-    min-height: 50px;
-    gap: 9px;
-    font-size: 15px;
-    border-radius: var(--admin-radius-sm);
-    background: linear-gradient(178deg, var(--admin-teal), var(--admin-teal-dark));
-    box-shadow: 0 8px 22px color-mix(in srgb, var(--admin-teal) 26%, transparent);
-  }
-  .agg-publish-btn svg {
-    width: 18px;
-    height: 18px;
-  }
-  [data-publish-aggregate] .btn.agg-publish-btn:not(:disabled):hover {
-    filter: brightness(1.05);
-  }
-  [data-publish-aggregate] .btn.agg-publish-btn:disabled {
-    background: var(--admin-surface-tint);
-    border-color: var(--admin-line-strong);
-    color: var(--admin-muted);
-    box-shadow: none;
-    cursor: not-allowed;
-  }
-
-  @media (max-width: 760px) {
-    .agg-chain {
-      grid-template-columns: 1fr;
-      gap: 4px;
-    }
-    .agg-link {
-      flex-direction: row;
-      gap: 10px;
-      padding: 4px 12px;
-    }
-    .agg-link .agg-arrow svg {
-      transform: rotate(90deg);
-    }
-    .agg-stop {
-      padding: 8px 2px;
-    }
-  }
-
-  /* Versions + diff */
-  .versions-table {
-    min-width: 780px;
-  }
-
-  /* Unified review pane */
-  .publish-review-cell {
-    padding: 12px 14px;
-    background: var(--admin-surface-soft);
-  }
-
-  .review-pane {
-    display: grid;
-    grid-template-columns: minmax(0, 1.3fr) minmax(0, 1fr);
-    gap: 16px;
-    align-items: start;
-  }
-
-  @media (max-width: 900px) {
-    .review-pane {
-      grid-template-columns: 1fr;
-    }
-  }
-
-  .review-preview {
-    display: grid;
-    gap: 8px;
-    min-width: 0;
-  }
-
-  .review-pane-head {
-    display: flex;
-    align-items: center;
-    justify-content: space-between;
-    gap: 10px;
-  }
-
-  .review-frame {
-    width: 100%;
-    height: 420px;
-    border: 1px solid var(--admin-line-strong);
-    border-radius: var(--admin-radius-sm);
-    background: var(--admin-surface);
-  }
-
-  .review-detail {
-    display: grid;
-    gap: 14px;
-    min-width: 0;
-  }
-
-  .review-section {
-    display: grid;
-    gap: 6px;
-  }
-
-  .review-chips {
-    display: flex;
-    flex-wrap: wrap;
-    gap: 6px;
-  }
-
-  .review-actions {
-    display: flex;
-    flex-wrap: wrap;
-    gap: 8px;
-  }
-
-  .publish-diff-head {
-    display: flex;
-    flex-wrap: wrap;
-    align-items: center;
-    gap: 10px;
-    margin-bottom: 8px;
-  }
-
-  .publish-diff-blocked {
-    color: var(--admin-amber);
-  }
-
-  .publish-diff-list {
-    list-style: none;
-    margin: 0;
-    padding: 0;
-    display: grid;
-    gap: 3px;
-  }
-
-  .publish-diff-list li {
-    display: flex;
-    align-items: baseline;
-    gap: 8px;
-    font-size: 12px;
-  }
-
-  .publish-diff-mark {
-    width: 1em;
-    font-weight: 700;
-    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-  }
-
-  .publish-diff-added .publish-diff-mark {
-    color: var(--admin-green);
-  }
-
-  .publish-diff-changed .publish-diff-mark {
-    color: var(--admin-blue);
-  }
-
-  .publish-diff-removed .publish-diff-mark {
-    color: var(--admin-red);
-  }
-
-  .publish-diff-list code {
-    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-    font-size: 12px;
-    overflow-wrap: anywhere;
-  }
-</style>