ccqa 1.8.2 → 1.9.0

package/dist/bin/ccqa.mjs

@@ -2252,6 +2252,7 @@ const PerspectiveSpecSchema = z.object({
 	testCondition: z.string().optional(),
 	preconditions: z.array(z.string().min(1)).optional(),
 	relatedPaths: z.array(z.string().min(1)).optional(),
+	relatedPathsUnmatched: z.number().int().nonnegative().optional(),
 	status: PerspectiveStatusSchema,
 	note: z.string().optional()
 }).strip();
@@ -3080,6 +3081,7 @@ const RunReportDataSchema = z.object({
 	promptVersion: z.string(),
 	customPromptVersion: z.string().nullable().default(null),
 	triageUserPromptHash: z.string().optional(),
+	deployedSha: z.string().optional(),
 	results: z.array(ReportSpecResultSchema)
 });
 /** Shape of the "export labels" download produced by the report's client-side JS. */
@@ -3594,7 +3596,7 @@ async function collectSpecArtifacts(args) {
 	};
 	const dir = specArtifactsDir(args.reportDir, args.feature, args.spec);
 	const relPrefix = posix.join(ARTIFACTS_SUBDIR, `${args.feature}__${args.spec}`);
-	const relFiles = await walkFiles$1(dir, "");
+	const relFiles = await walkFiles$2(dir, "");
 	relFiles.sort((a, b) => a === "output.log" ? -1 : b === "output.log" ? 1 : a.localeCompare(b));
 	const kept = [];
 	const dropped = [];
@@ -3621,7 +3623,7 @@ async function collectSpecArtifacts(args) {
 	return kept;
 }
 /** All files under `dir` as posix paths relative to it; missing dir → []. */
-async function walkFiles$1(dir, relBase) {
+async function walkFiles$2(dir, relBase) {
 	let entries;
 	try {
 		entries = await readdir(dir, { withFileTypes: true });
@@ -3631,7 +3633,7 @@ async function walkFiles$1(dir, relBase) {
 	const out = [];
 	for (const entry of entries) {
 		const rel = relBase === "" ? entry.name : `${relBase}/${entry.name}`;
-		if (entry.isDirectory()) out.push(...await walkFiles$1(join(dir, entry.name), rel));
+		if (entry.isDirectory()) out.push(...await walkFiles$2(join(dir, entry.name), rel));
 		else if (entry.isFile()) out.push(rel);
 	}
 	return out;
@@ -3876,6 +3878,22 @@ function parseGitDiffOutput(stdout) {
 	}
 	return out;
 }
+/**
+* Returns true if `path` matches the glob `pattern`.
+*
+* Supports a deliberately small glob language sufficient for relatedPaths:
+*  - `**`  matches any number of path segments (including zero)
+*  - `*`   matches any run of characters that does NOT include `/`
+*  - `?`   matches exactly one character that is not `/`
+*  - leading `./` is stripped from both sides
+*
+* Everything else is treated literally. This is intentional — relatedPaths
+* comes from Claude and we want predictable matching behavior, not full
+* minimatch semantics.
+*/
+function matchesGlob(path, pattern) {
+	return compileGlob(pattern).test(stripLeadingDotSlash(path));
+}
 /** Normalize a leading `./` away so diff paths and relatedPaths globs compare. */
 function stripLeadingDotSlash(s) {
 	return s.startsWith("./") ? s.slice(2) : s;
@@ -3948,13 +3966,13 @@ function globBase(pattern) {
 	return staticSegments.join("/") || ".";
 }
 /** Recursively collect files under `dirAbs`, skipping node_modules/.git. */
-async function walkFiles(dirAbs) {
+async function walkFiles$1(dirAbs) {
 	const entries = await readdir(dirAbs, { withFileTypes: true });
 	const out = [];
 	for (const entry of entries) {
 		const abs = join(dirAbs, entry.name);
 		if (entry.isDirectory()) {
-			if (!WALK_SKIP_DIRS.has(entry.name)) out.push(...await walkFiles(abs));
+			if (!WALK_SKIP_DIRS.has(entry.name)) out.push(...await walkFiles$1(abs));
 		} else if (entry.isFile()) out.push(abs);
 	}
 	return out;
@@ -3969,13 +3987,13 @@ async function expandPatternToFiles(cwd, pattern) {
 		const abs = resolve(cwd, pattern);
 		const st = await stat(abs).catch(() => null);
 		if (!st) throw new Error(`"${pattern}" does not exist (resolved to ${abs})`);
-		return (st.isDirectory() ? await walkFiles(abs) : [abs]).map((f) => relative(cwd, f)).sort();
+		return (st.isDirectory() ? await walkFiles$1(abs) : [abs]).map((f) => relative(cwd, f)).sort();
 	}
 	const base = globBase(pattern);
 	const baseAbs = resolve(cwd, base);
 	if (!(await stat(baseAbs).catch(() => null))?.isDirectory()) throw new Error(`"${pattern}" matches nothing — its base directory ${base} does not exist`);
 	const matcher = compileGlob(pattern);
-	const matched = (await walkFiles(baseAbs)).map((f) => relative(cwd, f)).filter((rel) => matcher.test(rel)).sort();
+	const matched = (await walkFiles$1(baseAbs)).map((f) => relative(cwd, f)).filter((rel) => matcher.test(rel)).sort();
 	if (matched.length === 0) throw new Error(`"${pattern}" matches no files under ${base}`);
 	return matched;
 }
@@ -6207,10 +6225,21 @@ var RunUsageError = class extends Error {
 		this.name = "RunUsageError";
 	}
 };
+/** An error's message, whatever was thrown. Shared so the run modules report failures alike. */
+function errMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
 //#endregion
 //#region src/run/git-context.ts
 /** The `--failure-analysis` value that selects per-spec hub-ledger baselines. */
 const LAST_GREEN = "last-green";
+/**
+* The `--changed` value that selects specs from the hub's re-run verdicts
+* (`rerun-selection.ts` acts on it). Kept here beside `LAST_GREEN` so the two
+* "not a git ref" keywords, and the rules that reject each on the flag it does
+* not belong to, sit in one place.
+*/
+const LAST_RUN = "last-run";
 /** Resolve `ref` to a full commit sha, or null when it does not exist locally. */
 async function resolveCommitSha(ref, cwd) {
 	try {
@@ -6243,6 +6272,7 @@ async function resolveAnalysisBase(flagValue, flagName, cwd) {
 	let ref;
 	let source;
 	if (flagValue === "last-green") throw new RunUsageError(`${flagName}=${LAST_GREEN} is not supported — last-green baselines are per-spec and only apply to --failure-analysis`);
+	if (flagValue === "last-run") throw new RunUsageError(`${flagName}=${LAST_RUN} is not supported — last-run selects which specs to run and only applies to --changed`);
 	if (typeof flagValue === "string") {
 		ref = flagValue;
 		source = "explicit";
@@ -6370,6 +6400,172 @@ function createLastGreenResolver(entries, cwd) {
 	};
 }
 //#endregion
+//#region src/run/deploy-head.ts
+/**
+* The commit a profile's environment is currently running, per the hub's
+* deploy log — its newest entry, or null when nothing has been recorded.
+*/
+async function deployHeadSha(hub, project, profile) {
+	const { entries } = await hub.getDeployLog(project, {
+		profile,
+		limit: 1
+	});
+	return entries[entries.length - 1]?.sha ?? null;
+}
+/**
+* The commit the profile's environment was running when this run started.
+*
+* Captured before any spec executes and asserted on both push paths
+* (`?deployedSha=` on `POST /runs` via `ccqa hub push`, and on `POST
+* /runs/open` for `--push-report`). Left to itself the hub reads its own
+* deploy-log head when the call lands — after the whole run for a single-shot
+* push, after the deterministic phase for an incremental one — so a deploy
+* landing in that window would be recorded as the run's baseline and
+* under-report what needs re-running later. Asserting the earlier commit errs
+* the other way: a spec that straddled a deploy is simply selected again.
+*
+* Best-effort by design (hence `try`): no hub, no profile, no deploy log, or a
+* hub too old to serve one all leave the run unattributed, exactly as before.
+*/
+async function tryDeployHeadSha(hubCtx, profile) {
+	try {
+		return await deployHeadSha(hubCtx.hub, hubCtx.project, profile);
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/run/dry-run.ts
+/**
+* The lines `ccqa run --dry-run` prints: one per selected spec, tagged with
+* what would have executed it.
+*
+* This exists because a selection can be wrong in a way that costs money.
+* `relatedPaths` accuracy is not yet proven, and both `--changed <ref>` and
+* `--changed=last-run` decide from it, so a human has to be able to read the
+* selection back before a live spec spends a Claude budget on it.
+*
+* Rows that would not have executed (a generate-only target, an unresolvable
+* one) are listed too, with their reason: they are part of what the selection
+* produced, and leaving them out would make the list look shorter than the
+* run's report will be.
+*/
+function formatDryRunLines(agentBrowser, routed) {
+	const tagged = [
+		...agentBrowser.map((s) => ({
+			key: specKey(s),
+			tag: s.mode
+		})),
+		...routed.external.flatMap((g) => g.specs.map((s) => ({
+			key: specKey(s),
+			tag: g.targetId
+		}))),
+		...routed.skipped.map((s) => ({
+			key: specKey(s),
+			tag: `skipped — ${s.reason}`
+		})),
+		...routed.unresolved.map((s) => ({
+			key: specKey(s),
+			tag: `unresolved — ${s.reason}`
+		}))
+	];
+	const width = Math.max(0, ...tagged.map((t) => t.key.length));
+	return tagged.map((t) => `  ${t.key.padEnd(width)}  ${t.tag}`);
+}
+//#endregion
+//#region src/run/rerun-selection.ts
+/**
+* `ccqa run --changed=last-run`: select specs from the hub's re-run verdicts
+* instead of from a git diff (ADR-0010). The baseline is not a ref at all —
+* it is each spec's own last run, positioned against the deploy log the
+* consuming deploy job feeds the hub — so this path does no git work.
+*
+* Every "I cannot answer" is an error here, never an empty selection: an
+* unanswerable question that silently runs nothing is the one failure mode
+* that makes the whole feature dangerous.
+*/
+/** First ccqa release whose hub serves `GET /projects/:project/rerun`. */
+const RERUN_MIN_HUB_VERSION = "1.9";
+/**
+* The profile `--changed=last-run` asks about. Mandatory: two environments sit
+* at different commits and the deploy log is per-profile, so "needs re-run"
+* has no profile-free answer.
+*/
+function requireRerunProfile(profile) {
+	if (profile === void 0) throw new RunUsageError(`--changed=${LAST_RUN} requires --profile <name>: the deploy log it reads is per-profile, so which specs need a re-run has no answer without one`);
+	return profile;
+}
+/**
+* Ask the hub which specs need a re-run, failing fast — before any spec runs —
+* on every condition that would otherwise degrade into "select nothing".
+*/
+async function fetchRerunReport(hubCtx, profile) {
+	let report;
+	try {
+		report = await hubCtx.hub.getRerun(hubCtx.project, { profile });
+	} catch (err) {
+		if (err instanceof HubApiError && err.status === 404) throw new RunUsageError(explainNotFound(hubCtx, err));
+		throw new RunUsageError(`--changed=${LAST_RUN}: could not ask the hub which specs need a re-run: ${errMessage(err)}`);
+	}
+	if (report.deployHead === null) throw new RunUsageError(`--changed=${LAST_RUN}: no deploy has been recorded for profile "${profile}" of project "${hubCtx.project}", so nothing can be compared against. Wire \`ccqa hub deploy record\` into the deploy job, or pass an explicit baseline (--changed=<ref>).`);
+	return {
+		...report,
+		deployHead: report.deployHead
+	};
+}
+/**
+* Which of the two 404s this was. The handler answers `no_perspectives` when
+* the route exists but the project has no document; any other code on a 404
+* means the hub does not serve this route at all.
+*/
+function explainNotFound(hubCtx, err) {
+	if (err.code === "no_perspectives") return `--changed=${LAST_RUN}: project "${hubCtx.project}" has no perspectives document on the hub, so no spec has \`relatedPaths\` to match a deploy against. Run \`ccqa perspectives\` first.`;
+	return `--changed=${LAST_RUN}: this hub does not serve re-run verdicts — it needs ccqa ${RERUN_MIN_HUB_VERSION} or newer. Upgrade the hub, or pass an explicit baseline (--changed=<ref>).`;
+}
+/** States the summary line reports, worst-known-first. */
+const SUMMARY_ORDER = [
+	"needed",
+	"unknown",
+	"neverRun",
+	"notNeeded",
+	"notEvaluated"
+];
+/** States that mean "the hub has no verdict", as opposed to a verdict of "no". */
+const UNANSWERABLE = new Set([
+	"unknown",
+	"neverRun",
+	"notEvaluated"
+]);
+/**
+* Narrow `specs` to the ones the hub says are worth running.
+*
+* `needed` is always selected. `unknown` and `neverRun` are "the question
+* cannot be answered", so they are excluded by default and opted into with
+* `--include-unknown` — fail-open on request, never silently. `notNeeded` and
+* `notEvaluated` are never selected.
+*/
+function selectSpecsNeedingRerun(specs, report, opts) {
+	const selectable = new Set(opts.includeUnknown ? [
+		"needed",
+		"unknown",
+		"neverRun"
+	] : ["needed"]);
+	const counts = /* @__PURE__ */ new Map();
+	const selected = [];
+	let excludedUnanswerable = 0;
+	for (const spec of specs) {
+		const state = report.specs[specKey(spec)]?.state ?? "unknown";
+		counts.set(state, (counts.get(state) ?? 0) + 1);
+		if (selectable.has(state)) selected.push(spec);
+		else if (UNANSWERABLE.has(state)) excludedUnanswerable++;
+	}
+	return {
+		selected,
+		summary: SUMMARY_ORDER.filter((s) => counts.has(s)).map((s) => `${counts.get(s)} ${s}`).join(", "),
+		excludedUnanswerable
+	};
+}
+//#endregion
 //#region src/report/github-format.ts
 /**
 * Build GitHub Actions `::error::` annotation lines for every failed spec in
@@ -6932,6 +7128,68 @@ function verifySessionRestores(statePath, verifyUrl) {
 		]);
 	}
 }
+/**
+* Non-destructive mid-run health probe of an already-running live session.
+* Reads the current page URL (`eval location.href` — the same read
+* {@link verifySessionRestores} makes, and it does NOT navigate, so it never
+* clobbers the page the model is working on) and detects only the unambiguous
+* signals that agent-browser's daemon was replaced/wedged mid-run:
+*
+*   - the probe exits non-zero — the daemon is wedged or was replaced
+*     (`spawnAB`'s hard timeout bounds a hung daemon, so this returns rather
+*     than hanging the run);
+*   - the page is blank/absent (`about:blank`, empty, `chrome://…`) — a
+*     restarted daemon comes up with no page and no in-memory auth-state.
+*
+* Deliberately NOT flagged: a non-blank page that left the verify URL's origin.
+* That can't be told apart from a spec legitimately roaming to another origin
+* mid-flow (e.g. Slack → a separate admin app it logs into at runtime), and a
+* false "unhealthy" would re-inject the saved state and wipe auth the spec
+* acquired live — breaking a spec that was fine. Missing a same-origin-ish
+* sign-in wall just leaves that step failing as before (no regression), so the
+* asymmetry favours only firing on a provably dead daemon. `verifyUrl` is still
+* required (it's the re-anchor target for recovery) but no longer compared here.
+*/
+function checkLiveSessionHealth(sessionName) {
+	const probe = spawnAB([
+		"--session",
+		sessionName,
+		"eval",
+		"location.href"
+	]);
+	if (probe.status !== 0) return {
+		healthy: false,
+		reason: (probe.stderr || probe.stdout || `probe exited ${probe.status}`).trim()
+	};
+	const href = unwrapEvalString(probe.stdout);
+	if (!href || href === "about:blank" || href.startsWith("chrome://") || href.startsWith("chrome-error://")) return {
+		healthy: false,
+		reason: `blank/absent page (${href || "empty"})`
+	};
+	return { healthy: true };
+}
+/**
+* Recover a live session whose daemon was replaced mid-run (detected by
+* {@link checkLiveSessionHealth}). The restart drops the in-memory auth-state
+* injected at run start, so the session fell to a sign-in wall. Re-boot +
+* re-attach the saved state ({@link loadStateIntoSession} is idempotent —
+* `state load` is load-only, never writes back) and then navigate to
+* `verifyUrl`, a known signed-in page, so the retrying model has an
+* authenticated anchor to continue from instead of a login screen. Returns the
+* injection result; the trailing `open` is best-effort (a failed nav still
+* leaves the state attached for the model's own next navigation).
+*/
+function recoverLiveSession(sessionName, statePath, verifyUrl) {
+	const injected = loadStateIntoSession(sessionName, statePath);
+	if (!injected.ok) return injected;
+	spawnAB([
+		"--session",
+		sessionName,
+		"open",
+		verifyUrl
+	]);
+	return { ok: true };
+}
 /** Take the last non-empty line of `agent-browser eval` stdout and JSON-unquote it. */
 function unwrapEvalString(stdout) {
 	const lines = stdout.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
@@ -7025,6 +7283,80 @@ function resolvePromptLocalPath(name, cwd) {
 	return join(cwd ?? process.cwd(), PROMPT_LOCAL_PATHS[name]);
 }
 //#endregion
+//#region src/run/github-run.ts
+/**
+* The GitHub Actions run URL for the current job, built from the standard
+* Actions environment variables. Returns null unless all three are present,
+* so nothing is ever invented for a local run — the same "only when in CI"
+* contract the report envelope's `runId` (GITHUB_RUN_ID) already follows.
+*/
+function githubRunUrl(env = process.env) {
+	const server = env["GITHUB_SERVER_URL"];
+	const repo = env["GITHUB_REPOSITORY"];
+	const runId = githubRunId(env);
+	if (!server || !repo || !runId) return null;
+	return `${server}/${repo}/actions/runs/${runId}`;
+}
+/** The current GitHub Actions run id (GITHUB_RUN_ID); null outside Actions. */
+function githubRunId(env = process.env) {
+	return env["GITHUB_RUN_ID"] ?? null;
+}
+//#endregion
+//#region src/cli/deploy-paths.ts
+/**
+* What `ccqa hub deploy record` reports as a deploy's changed paths.
+*
+* The hub has no checkout, so this is the one thing only the deploy job can
+* answer (ADR-0010). Everything here exists to keep that answer honest in the
+* direction that matters: over-reporting makes a spec re-run once too often,
+* under-reporting makes it silently skip a real regression.
+*/
+/**
+* How many paths one deploy sends. A monorepo-wide refactor can list tens of
+* thousands, and the hub bounds the request body, so the list is cut here.
+*
+* The cap is deliberately far above the hub's own retention bound: whenever it
+* bites, the hub still receives more paths than it retains and marks the entry
+* `truncated`, which reads as "touched everything". A cap at or below the
+* hub's would instead present a cut-down list as a complete one — a confident
+* "no re-run needed" built on paths that were never sent.
+*/
+const MAX_SENT_CHANGED_PATHS = 5e3;
+/** Cut `paths` to `MAX_SENT_CHANGED_PATHS`; see the constant for why the bound is where it is. */
+function capDeployPaths(paths) {
+	return paths.slice(0, MAX_SENT_CHANGED_PATHS);
+}
+/**
+* The files that differ between two commits, as a deploy must report them.
+*
+* **Two-dot** (`git diff A B`), never three-dot: three-dot resolves the merge
+* base first, so redeploying an ancestor — a rollback — reports an empty diff
+* and the rollback becomes invisible. `getChangedFiles` in
+* `src/drift/affected.ts` is three-dot, which is right for the PR question it
+* answers and wrong for this one.
+*
+* `--no-renames` is likewise deliberate: with rename detection a rename is one
+* entry naming only the destination, so a file moved *out* of a spec's
+* `relatedPaths` would no longer match it. Off, the rename appears as a delete
+* plus an add and both paths are reported.
+*
+* Paths are re-rooted to `cwd` on the same rule as `--changed`, because
+* `relatedPaths` are written as the directory hosting `.ccqa/` sees them.
+*/
+async function changedPathsBetween(previous, sha, cwd) {
+	const [{ stdout: rootOut }, { stdout: diffOut }] = await Promise.all([execFileP("git", ["rev-parse", "--show-toplevel"], { cwd }), execFileP("git", [
+		"diff",
+		"--name-status",
+		"--no-renames",
+		previous,
+		sha
+	], {
+		cwd,
+		maxBuffer: 32 * 1024 * 1024
+	})]);
+	return rerootChangedFiles(parseGitDiffOutput(diffOut), rootOut.trim(), cwd).map((f) => f.path);
+}
+//#endregion
 //#region src/cli/hub.ts
 /**
 * `ccqa hub` — the client side of the ccqa hub (a results/secret control
@@ -7202,6 +7534,45 @@ const promptRm = new Command("rm").description("Delete a prompt from the hub.").
 	info(`deleted prompt "${name}" from the hub`);
 }));
 const promptCommand = new Command("prompt").description("Manage prompt assets (per-flow user/agent guidance, triage user guidance, analysis custom prompt) stored on the hub (fetched automatically by `ccqa run` at run time).").addCommand(promptPush).addCommand(promptLs).addCommand(promptRm);
+const deployRecord = new Command("record").description("Tell the hub what a deploy shipped, so it can answer which specs need a re-run (`ccqa run --changed=last-run`). Run this from the deploy job, after the deploy succeeds. The changed paths are computed locally with a two-dot `git diff <previous> <sha>`; a job that has only curl and git can POST the same body directly (see docs/hub.md).").requiredOption("--profile <name>", "Environment this deploy landed in (e.g. 'stg'). Required: dev and stg sit at different commits, so the deploy log is per-profile.").requiredOption("--sha <sha>", "Commit that was deployed.").option("--previous <sha>", "Commit this deploy replaced. Defaults to the profile's current deploy-log head on the hub. With neither, the deploy is recorded as touching everything.").option("--ref <ref>", "Ref that was deployed (branch or tag). Recorded for display only.").option(...hubUrlOption).option(...hubTokenOption).option("--project <name>", "Project whose deploy log this entry joins. Defaults to the current directory's name.").option("--cwd <path>", "Directory the git diff and the default --project name are resolved against.").action(withHubErrors(async (opts) => {
+	const cwd = resolveCwd(opts.cwd);
+	const project = resolveProject(opts);
+	const hub = connect(opts);
+	const previous = opts.previous ?? await deployHeadSha(hub, project, opts.profile);
+	const runUrl = githubRunUrl();
+	const changedPaths = previous === null ? null : await diffOrTouchEverything(previous, opts.sha, cwd);
+	const entry = await hub.recordDeploy(project, opts.profile, {
+		sha: opts.sha,
+		previousSha: previous,
+		changedPaths,
+		...opts.ref ? { ref: opts.ref } : {},
+		...runUrl ? { runUrl } : {}
+	});
+	header("hub deploy record", entry.sha.slice(0, 12));
+	meta("project", project);
+	meta("profile", opts.profile);
+	meta("previous", previous ? previous.slice(0, 12) : "(none — treated as touching everything)");
+	meta("changed paths", changedPaths === null ? "(not reported)" : String(changedPaths.length));
+	if (entry.truncated) meta("truncated", "yes — the hub treats this deploy as touching everything");
+	if (entry.gapBefore) warn("this deploy does not chain onto the log head, so a gap is recorded — specs whose baseline sits behind it report 'unknown' rather than 'not needed'");
+	info(`recorded deploy #${entry.index}`);
+}));
+/**
+* The two-dot diff, or `null` when git can't produce one (a shallow checkout
+* that never fetched `previous`, a rolled-back sha that isn't local). `null`
+* makes the hub treat the deploy as touching everything: fail-open and
+* self-limiting — everything re-runs once, then it settles — whereas silently
+* sending an empty list would claim the deploy changed nothing.
+*/
+async function diffOrTouchEverything(previous, sha, cwd) {
+	try {
+		return capDeployPaths(await changedPathsBetween(previous, sha, cwd));
+	} catch (err) {
+		warn(`could not diff ${previous.slice(0, 12)}..${sha.slice(0, 12)} (${errMessage(err)}); recording the deploy as touching everything`);
+		return null;
+	}
+}
+const deployCommand = new Command("deploy").description("Report deploys to the hub, the input behind `ccqa run --changed=last-run`.").addCommand(deployRecord);
 const pushCommand = new Command("push").description("Upload the report directory of a finished `ccqa run --report` to the hub as a run. Run this after `ccqa run` (use `if: always()` in CI so failing runs are pushed too).").option("--report <dir>", `Report directory to push. Default: ${DEFAULT_REPORT_DIR}/`).option("--project <name>", "Logical project name for the run. Defaults to the current directory's name.").option("--branch <name>", "Branch label. Defaults to $GITHUB_HEAD_REF / $GITHUB_REF_NAME / current git branch.").option("--profile <name>", "Profile (environment) the run executed against. Recorded for display; runs are not scoped by profile.").option(...hubUrlOption).option(...hubTokenOption).option("--cwd <path>", "Directory the report dir is resolved against (defaults to the current directory).").action(withHubErrors(async (opts) => {
 	const cwd = resolveCwd(opts.cwd);
 	const reportDir = join(cwd, opts.report ?? "ccqa-report");
@@ -7214,16 +7585,19 @@ const pushCommand = new Command("push").description("Upload the report directory
 		hint("run `ccqa run --report` first, then push its report directory");
 		process.exit(2);
 	}
-	if (!RunReportDataSchema.safeParse(report).success) {
+	const parsed = RunReportDataSchema.safeParse(report);
+	if (!parsed.success) {
 		error(`report.json in ${reportDir} is not a valid ccqa report`);
 		process.exit(2);
 	}
+	const deployedSha = parsed.data.deployedSha;
 	const branch = opts.branch ?? await detectBranch(cwd);
 	const archive = await packDirToTarGz(reportDir);
 	const run = await connect(opts).pushRun(archive, {
 		project,
 		...branch ? { branch } : {},
-		...opts.profile ? { profile: opts.profile } : {}
+		...opts.profile ? { profile: opts.profile } : {},
+		...deployedSha ? { deployedSha } : {}
 	});
 	header("hub push", run.id);
 	meta("project", run.project);
@@ -7233,7 +7607,7 @@ const pushCommand = new Command("push").description("Upload the report directory
 	meta("specs", `${run.specs.passed}/${run.specs.total} passed`);
 	info(`${resolveBaseUrl(opts)}/#/runs/${run.id}`);
 }));
-const hubCommand = new Command("hub").description("Client for a ccqa hub: push run results and manage sessions/variables/prompts used by `ccqa run`. See docs/hub.md.").addCommand(pushCommand).addCommand(sessionCommand$1).addCommand(varCommand).addCommand(promptCommand);
+const hubCommand = new Command("hub").description("Client for a ccqa hub: push run results and manage sessions/variables/prompts used by `ccqa run`. See docs/hub.md.").addCommand(pushCommand).addCommand(deployCommand).addCommand(sessionCommand$1).addCommand(varCommand).addCommand(promptCommand);
 /** Loose check that a fetched session is agent-browser storage-state, mirroring loadStorageState. */
 function isStorageStateShape(state) {
 	return typeof state === "object" && state !== null && Array.isArray(state.cookies) && Array.isArray(state.origins);
@@ -7514,6 +7888,7 @@ async function runLiveExecutor(input) {
 	const stepResults = [];
 	let overallFailed = false;
 	const statePath = input.statePath ?? null;
+	const verifyUrl = input.verifyUrl ?? null;
 	const promptPrefix = buildLiveSystemPromptPrefix({
 		title: input.spec.title,
 		allSteps: input.steps,
@@ -7545,12 +7920,25 @@ async function runLiveExecutor(input) {
 		const systemPrompt = promptPrefix + buildLiveSystemPromptStepSection(step$1) + suffixBlock + langDirective;
 		const userPrompt = buildLiveUserPrompt(step$1);
 		let attempt = 0;
+		let recoveredOnce = false;
 		let lastOutcome = null;
-		while (attempt <= retries) {
-			if (attempt > 0) info(`  retry ${attempt}/${retries} for ${step$1.id}`);
+		for (;;) {
 			lastOutcome = await executeStepAttempt(step$1, paths, systemPrompt, userPrompt);
 			if (lastOutcome.status === "passed") break;
+			if (!recoveredOnce && statePath && verifyUrl) {
+				const health = checkLiveSessionHealth(input.sessionName);
+				if (!health.healthy) {
+					warn(`session lost mid-step for ${step$1.id} (${health.reason}); re-injecting auth-state and retrying`);
+					const rec = recoverLiveSession(input.sessionName, statePath, verifyUrl);
+					if (!rec.ok) warn(`session recovery failed: ${rec.error}`);
+					recoveredOnce = true;
+					attempt++;
+					continue;
+				}
+			}
+			if (attempt >= retries) break;
 			attempt++;
+			info(`  retry ${attempt}/${retries} for ${step$1.id}`);
 		}
 		const outcome = lastOutcome;
 		stepResults.push({
@@ -8101,6 +8489,7 @@ async function resolveSessionState(names, hubCtx, profile, verify = verifySessio
 	const profileFlag = profile ? ` --profile ${profile}` : "";
 	const loaded = [];
 	const broken = [];
+	let verifyUrl;
 	for (const name of names) {
 		let state;
 		try {
@@ -8115,6 +8504,7 @@ async function resolveSessionState(names, hubCtx, profile, verify = verifySessio
 		}
 		const embedded = state[SESSION_VERIFY_URL_KEY];
 		if (typeof embedded === "string") {
+			verifyUrl ??= embedded;
 			const memoKey = `${resolvedProfile}/${name}`;
 			if (!verifiedSessions.has(memoKey)) {
 				const tmp = await writeMergedTempState(mergeStorageStates([state]));
@@ -8139,6 +8529,7 @@ async function resolveSessionState(names, hubCtx, profile, verify = verifySessio
 	return {
 		ok: true,
 		statePath,
+		...verifyUrl ? { verifyUrl } : {},
 		cleanup: () => removeTempStateDir(statePath)
 	};
 }
@@ -8167,6 +8558,7 @@ async function runOneSpec(args) {
 	meta("session", sessionName);
 	opts.teardown?.trackSession(sessionName);
 	let statePath = null;
+	let verifyUrl = null;
 	let cleanupSession = null;
 	if (spec.session && spec.session.length > 0) {
 		const resolution = await resolveSessionState(spec.session, opts.hubContext ?? null, opts.profile);
@@ -8181,6 +8573,7 @@ async function runOneSpec(args) {
 			};
 		}
 		statePath = resolution.statePath;
+		verifyUrl = resolution.verifyUrl ?? null;
 		cleanupSession = resolution.cleanup;
 		meta("state", spec.session.join(", "));
 	}
@@ -8196,6 +8589,7 @@ async function runOneSpec(args) {
 			runDir,
 			sessionName,
 			statePath,
+			verifyUrl,
 			systemPromptSuffix: userPromptSuffix,
 			model: opts.model,
 			language: opts.language,
@@ -10137,25 +10531,6 @@ function createIncrementalReport(reportDir, envelope, sink) {
 	};
 }
 //#endregion
-//#region src/run/github-run.ts
-/**
-* The GitHub Actions run URL for the current job, built from the standard
-* Actions environment variables. Returns null unless all three are present,
-* so nothing is ever invented for a local run — the same "only when in CI"
-* contract the report envelope's `runId` (GITHUB_RUN_ID) already follows.
-*/
-function githubRunUrl(env = process.env) {
-	const server = env["GITHUB_SERVER_URL"];
-	const repo = env["GITHUB_REPOSITORY"];
-	const runId = githubRunId(env);
-	if (!server || !repo || !runId) return null;
-	return `${server}/${repo}/actions/runs/${runId}`;
-}
-/** The current GitHub Actions run id (GITHUB_RUN_ID); null outside Actions. */
-function githubRunId(env = process.env) {
-	return env["GITHUB_RUN_ID"] ?? null;
-}
-//#endregion
 //#region src/prompts/agent-update.ts
 /**
 * Build the prompts used by `--update-agent-prompt` to refresh
@@ -10551,9 +10926,12 @@ function dedupeSpecs(specs) {
 */
 async function executeRun(targets, opts) {
 	if (opts.changed && targets.length > 0) throw new RunUsageError("--changed and an explicit spec target cannot be combined");
+	const rerunProfile = opts.changed === "last-run" ? requireRerunProfile(opts.profile) : null;
+	if (opts.includeUnknown && rerunProfile === null) warn(`--include-unknown is ignored: it only applies to --changed=${LAST_RUN}`);
+	const forExecution = opts.dryRun !== true;
 	const cwd = opts.cwd ?? process.cwd();
 	const wantsLastGreen = opts.failureAnalysis === LAST_GREEN;
-	const [head, fixedBase] = await Promise.all([getGitHead(cwd), opts.failureAnalysis && !wantsLastGreen ? resolveAnalysisBase(opts.failureAnalysis, "--failure-analysis", cwd) : null]);
+	const [head, fixedBase] = await Promise.all([getGitHead(cwd), forExecution && opts.failureAnalysis && !wantsLastGreen ? resolveAnalysisBase(opts.failureAnalysis, "--failure-analysis", cwd) : null]);
 	const git = {
 		head,
 		base: wantsLastGreen ? {
@@ -10573,19 +10951,16 @@ async function executeRun(targets, opts) {
 		});
 		meta("analysis-base", `${fixedBase.ref} (${fixedBase.sha.slice(0, 12)}, ${fixedBase.source})`);
 	}
-	let projectForProfile;
-	try {
-		if (opts.profile !== void 0) {
-			projectForProfile = resolveProjectOrThrow(opts.project, cwd);
-			await resolveProfileEnv({
-				profile: opts.profile,
-				project: projectForProfile,
-				cwd,
-				hubUrl: opts.hubUrl,
-				hubToken: opts.hubToken,
-				hubHeader: opts.hubHeader
-			});
-		} else await resolveProfileEnv({
+	if (forExecution) try {
+		if (opts.profile !== void 0) await resolveProfileEnv({
+			profile: opts.profile,
+			project: resolveProjectOrThrow(opts.project, cwd),
+			cwd,
+			hubUrl: opts.hubUrl,
+			hubToken: opts.hubToken,
+			hubHeader: opts.hubHeader
+		});
+		else await resolveProfileEnv({
 			profile: void 0,
 			project: "",
 			cwd
@@ -10594,7 +10969,7 @@ async function executeRun(targets, opts) {
 		if (err instanceof RunUsageError) throw err;
 		if (err instanceof ProjectNameError) throw new RunUsageError(err.message);
 		if (err instanceof HubConnectionError || err instanceof HubApiError) throw new RunUsageError(err.message);
-		throw new RunUsageError(`failed to load profile "${opts.profile}": ${err instanceof Error ? err.message : String(err)}`);
+		throw new RunUsageError(`failed to load profile "${opts.profile}": ${errMessage(err)}`);
 	}
 	let hubCtx = null;
 	try {
@@ -10610,11 +10985,15 @@ async function executeRun(targets, opts) {
 	}
 	if (wantsLastGreen && hubCtx == null) throw new RunUsageError(`--failure-analysis=${LAST_GREEN} requires a hub connection (--hub-url/--hub-token or CCQA_HUB_URL/CCQA_HUB_TOKEN)`);
 	const ledgerHub = wantsLastGreen ? hubCtx : null;
-	const [customPrompt, triageUserPrompt, ledgerEntries] = await Promise.all([
-		fetchCustomPrompt(hubCtx),
-		fetchTriageUserPrompt(hubCtx),
-		ledgerHub ? fetchLastGreenLedger(ledgerHub, opts.profile, cwd) : null
+	if (rerunProfile !== null && hubCtx == null) throw new RunUsageError(`--changed=${LAST_RUN} requires a hub connection (--hub-url/--hub-token or CCQA_HUB_URL/CCQA_HUB_TOKEN)`);
+	const [customPrompt, triageUserPrompt, ledgerEntries, rerunReport, fetchedDeployHead] = await Promise.all([
+		forExecution ? fetchCustomPrompt(hubCtx) : null,
+		forExecution ? fetchTriageUserPrompt(hubCtx) : null,
+		forExecution && ledgerHub ? fetchLastGreenLedger(ledgerHub, opts.profile, cwd) : null,
+		rerunProfile !== null && hubCtx ? fetchRerunReport(hubCtx, rerunProfile) : null,
+		forExecution && hubCtx && opts.profile && rerunProfile === null ? tryDeployHeadSha(hubCtx, opts.profile) : null
 	]);
+	const deployedSha = rerunReport?.deployHead.sha ?? fetchedDeployHead;
 	if (ledgerEntries) diffProvider = createDiffProvider({
 		resolveBase: createLastGreenResolver(ledgerEntries, cwd),
 		cwd
@@ -10638,11 +11017,19 @@ async function executeRun(targets, opts) {
 	let specs = dedupeSpecs((await Promise.all((targets.length ? targets : [void 0]).map((t) => resolveSpecTargets(t, enumerateAll, cwd)))).flat());
 	if (opts.changed) {
 		const before = specs.length;
-		specs = await collectChangedSpecs(specs, {
+		let unanswerable = 0;
+		if (rerunReport) {
+			const selection = selectSpecsNeedingRerun(specs, rerunReport, { includeUnknown: opts.includeUnknown === true });
+			specs = selection.selected;
+			unanswerable = selection.excludedUnanswerable;
+			meta("rerun-base", `deploy ${rerunReport.deployHead.sha.slice(0, 12)} (profile ${rerunReport.profile})`);
+			meta("rerun-states", selection.summary);
+		} else specs = await collectChangedSpecs(specs, {
 			cwd,
 			base: opts.changed
 		});
 		meta("changed-scoped", `${specs.length} of ${before} spec${before === 1 ? "" : "s"}`);
+		if (specs.length === 0 && unanswerable > 0) hint(`${unanswerable} spec(s) were excluded because the hub could not tell whether they need a re-run; pass --include-unknown to run them anyway`);
 	}
 	if (specs.length === 0) {
 		warn("no specs to run");
@@ -10671,6 +11058,16 @@ async function executeRun(targets, opts) {
 	} else if (opts.out && liveSpecs.length > 1) warn("--out is ignored when running multiple live specs");
 	if (detSpecs.length === 0 && opts.evidence === false) warn("--no-evidence is ignored: it only applies to agent-browser 'mode: deterministic' specs, and this run has none");
 	blank();
+	if (opts.dryRun) {
+		for (const line of formatDryRunLines(withMode, dispatch)) emitRaw(line + "\n");
+		blank();
+		info("dry run: nothing was executed and no report was written");
+		return {
+			exitCode: 0,
+			report: null,
+			reportDir: null
+		};
+	}
 	const det = await runDeterministicSpecs(detSpecs, opts, cwd, reportDir);
 	if (opts.pushReport && hubCtx == null) warn("--push-report requires --hub-url/--hub-token (or CCQA_HUB_URL/CCQA_HUB_TOKEN); skipping push");
 	let hubRunId = null;
@@ -10684,6 +11081,7 @@ async function executeRun(targets, opts) {
 			...branch ? { branch } : {},
 			...opts.profile ? { profile: opts.profile } : {},
 			...git.head ? { gitHead: git.head } : {},
+			...deployedSha ? { deployedSha } : {},
 			...ciRunId ? { ciRunId } : {},
 			...runUrl ? { runUrl } : {},
 			kind: "run"
@@ -10709,6 +11107,7 @@ async function executeRun(targets, opts) {
 		git,
 		customPromptVersion: customPrompt?.customPromptVersion ?? null,
 		triageUserPromptHash,
+		deployedSha,
 		opts
 	}), hubSink);
 	let completedNormally = false;
@@ -10774,6 +11173,7 @@ async function executeRun(targets, opts) {
 			git,
 			customPromptVersion,
 			triageUserPromptHash,
+			deployedSha,
 			opts
 		});
 		completedNormally = true;
@@ -10783,6 +11183,7 @@ async function executeRun(targets, opts) {
 				git,
 				customPromptVersion,
 				triageUserPromptHash,
+				deployedSha,
 				opts
 			});
 			const streamedKeys = new Set(incrementalReport.rows().map((r) => `${r.feature}/${r.spec}`));
@@ -11058,7 +11459,7 @@ async function analyzeDeterministicSummaries(summaries, cwd, reportDir, { pass,
 * final report.json stays byte-identical (existing e2e goldens compare it).
 */
 function buildReportEnvelope(args) {
-	const { git, customPromptVersion, triageUserPromptHash, opts } = args;
+	const { git, customPromptVersion, triageUserPromptHash, deployedSha, opts } = args;
 	const runUrl = githubRunUrl();
 	return {
 		schemaVersion: 1,
@@ -11078,17 +11479,19 @@ function buildReportEnvelope(args) {
 		language: opts.language ?? null,
 		promptVersion: "8",
 		customPromptVersion,
-		...triageUserPromptHash !== null ? { triageUserPromptHash } : {}
+		...triageUserPromptHash !== null ? { triageUserPromptHash } : {},
+		...deployedSha !== null ? { deployedSha } : {}
 	};
 }
 /** Write the unified JSON (+ optional GitHub-annotation) report for one run. Returns the report data. */
 async function writeUnifiedReport(args) {
-	const { reportDir, results, git, customPromptVersion, triageUserPromptHash, opts } = args;
+	const { reportDir, results, git, customPromptVersion, triageUserPromptHash, deployedSha, opts } = args;
 	const data = {
 		...buildReportEnvelope({
 			git,
 			customPromptVersion,
 			triageUserPromptHash,
+			deployedSha,
 			opts
 		}),
 		results
@@ -11100,9 +11503,6 @@ async function writeUnifiedReport(args) {
 	if (opts.format === "github") for (const line of emitGithubAnnotations(data)) emitRaw(line + "\n");
 	return data;
 }
-function errMessage(err) {
-	return err instanceof Error ? err.message : String(err);
-}
 /**
 * Raw-byte budget for the files inlined in one incremental `PATCH`. Base64
 * inflates by ~4/3 and the rows ride in the same body, so this keeps the
@@ -11343,7 +11743,7 @@ function installTeardownSignalHandlers(teardown) {
 }
 //#endregion
 //#region src/cli/run.ts
-const runCommand = addHubOptions(addProfileOption(addLanguageOption(new Command("run").argument("[targets...]", "Specs to run, space-separated: each '<feature>/<spec>', '<feature>', or omit for all. Duplicates are de-duped.").description("Run specs, on any target. Agent-browser specs replay the recorded test.spec.ts under vitest (default), or, with spec.yaml `mode: live`, have Claude drive agent-browser live per step. External-target specs (playwright, runn) run through the target's configured `runCommand`. A structured report (report.json + evidence) is always written; use --push-report to also stream it to a hub.").option("--report [dir]", `Directory for the structured run results (report.json + evidence PNGs) that are always written. Default: ${DEFAULT_REPORT_DIR}/. Pass this only to change the location.`).option("--push-report", "Incrementally push the run report to the hub as the run progresses (open → patch per spec → finalize). Requires --hub-url/--hub-token (or CCQA_HUB_URL/CCQA_HUB_TOKEN). Without it, hub credentials are used only to fetch variables/sessions/prompts, not to push.").option("--changed [base]", "Restrict execution to specs whose relatedPaths intersect the git diff against [base]. Without a value the base comes from $GITHUB_BASE_REF (pull_request CI); elsewhere pass it explicitly (e.g. --changed=origin/main). Cannot be combined with an explicit spec id.").option("--failure-analysis [base]", "Classify each failure (TEST_DRIFT / SPEC_CHANGE / PRODUCT_BUG) against the source diff since [base]. Without a value the base comes from $GITHUB_BASE_REF (pull_request CI); elsewhere pass it explicitly (e.g. --failure-analysis=origin/main), or pass 'last-green' to diff each spec against the commit where it last passed (per-spec baselines from the hub; requires a hub connection). Off by default — no Claude calls without it.").option("--cwd <path>", "Working directory containing the .ccqa/ tree (monorepo support). Defaults to the current directory.").option("--format <fmt>", "Additional output format alongside HTML when --report is set: 'text' (default), 'json' (writes report.json), 'github' (GitHub Actions annotations on stdout).", (raw) => {
+const runCommand = addHubOptions(addProfileOption(addLanguageOption(new Command("run").argument("[targets...]", "Specs to run, space-separated: each '<feature>/<spec>', '<feature>', or omit for all. Duplicates are de-duped.").description("Run specs, on any target. Agent-browser specs replay the recorded test.spec.ts under vitest (default), or, with spec.yaml `mode: live`, have Claude drive agent-browser live per step. External-target specs (playwright, runn) run through the target's configured `runCommand`. A structured report (report.json + evidence) is always written; use --push-report to also stream it to a hub.").option("--report [dir]", `Directory for the structured run results (report.json + evidence PNGs) that are always written. Default: ${DEFAULT_REPORT_DIR}/. Pass this only to change the location.`).option("--push-report", "Incrementally push the run report to the hub as the run progresses (open → patch per spec → finalize). Requires --hub-url/--hub-token (or CCQA_HUB_URL/CCQA_HUB_TOKEN). Without it, hub credentials are used only to fetch variables/sessions/prompts, not to push.").option("--changed [base]", "Restrict execution to specs whose relatedPaths intersect the git diff against [base]. Without a value the base comes from $GITHUB_BASE_REF (pull_request CI); elsewhere pass it explicitly (e.g. --changed=origin/main), or pass 'last-run' to run the specs the hub says need one — each spec's own last run compared against the deploy log (requires a hub connection and --profile; no git diff involved). Cannot be combined with an explicit spec id.").option("--include-unknown", "(--changed=last-run only) Also run specs whose re-run need the hub cannot answer ('unknown') and specs that have never run ('neverRun'). Off by default: an unanswerable question is reported, not guessed.").option("--dry-run", "Print the specs this invocation would run, then exit 0 without executing anything and without writing a report. Works with every selection mode.").option("--failure-analysis [base]", "Classify each failure (TEST_DRIFT / SPEC_CHANGE / PRODUCT_BUG) against the source diff since [base]. Without a value the base comes from $GITHUB_BASE_REF (pull_request CI); elsewhere pass it explicitly (e.g. --failure-analysis=origin/main), or pass 'last-green' to diff each spec against the commit where it last passed (per-spec baselines from the hub; requires a hub connection). Off by default — no Claude calls without it.").option("--cwd <path>", "Working directory containing the .ccqa/ tree (monorepo support). Defaults to the current directory.").option("--format <fmt>", "Additional output format alongside HTML when --report is set: 'text' (default), 'json' (writes report.json), 'github' (GitHub Actions annotations on stdout).", (raw) => {
 	if (REPORT_FORMATS.includes(raw)) return raw;
 	throw new Error(`--format must be one of ${REPORT_FORMATS.join(" | ")}`);
 }, "text").option("-m, --model <name>", "Claude model alias ('sonnet'|'opus'|'haiku') or full ID. Overrides CCQA_MODEL.").option("--no-evidence", `(deterministic only) Skip step-boundary evidence capture (PNG + meta JSON written to ${DEFAULT_REPORT_DIR}/${EVIDENCE_SUBDIR}/ by default).`).option("--retry <n>", "(live only) Retry each failed step up to N more times before recording failure. Default 0.", (raw) => {
@@ -11366,6 +11766,7 @@ function parseConcurrency$1(raw) {
 function headerTarget(targets, opts) {
 	if (targets.length === 1) return targets[0];
 	if (targets.length > 1) return `${targets.length} targets`;
+	if (opts.changed === "last-run") return "(needs re-run)";
 	return opts.changed ? "(changed)" : "(all specs)";
 }
 /**
@@ -12863,6 +13264,97 @@ For each test case above, write a 1–2 sentence factual \`summary\` of what it
 `;
 }
 //#endregion
+//#region src/cli/related-paths-check.ts
+/**
+* Data-quality check on `relatedPaths`: how many of a spec's patterns match no
+* file at all.
+*
+* A pattern that matches nothing is the failure mode that makes re-run
+* selection lie in the *dangerous* direction — too narrow a list produces a
+* confident "no re-run needed" for a spec whose code did change (ADR-0010).
+* It costs one file listing and no model call, so `ccqa perspectives` records
+* the count and the hub UI can warn next to the verdict.
+*
+* Patterns are interpreted relative to the directory hosting `.ccqa/`, the
+* same rule `--changed` applies. A pattern deliberately written repo-root
+* relative to reach a monorepo sibling package therefore counts as unmatched;
+* that is a false alarm, which is the harmless direction here.
+*/
+/** Directories the fallback walk never descends into: enormous, and never what `relatedPaths` target. */
+const SKIP_DIRS = new Set([".git", "node_modules"]);
+/**
+* The files a `relatedPaths` pattern could possibly match, as cwd-relative
+* posix paths, listed once and shared by every spec.
+*
+* Tracked files, via `git ls-files`. That is not just the cheap way (a walk of
+* a large monorepo takes an order of magnitude longer and drags in `dist/`,
+* `.next/`, `coverage/`, past report directories) — it is the *correct*
+* universe: `relatedPaths` are only ever matched against `git diff` output,
+* both by `--changed` and by a deploy's `changedPaths`, and that output only
+* ever names tracked files. A pattern whose sole match is an untracked build
+* artifact can never match a real change, so counting it as matched would be a
+* miss in precisely the direction this check exists to catch.
+*
+* Falls back to a directory walk outside a git checkout, where the question
+* still has a useful approximate answer.
+*/
+async function listCheckoutFiles(cwd) {
+	try {
+		const { stdout } = await execFileP("git", ["ls-files", "-z"], {
+			cwd,
+			maxBuffer: 64 * 1024 * 1024
+		});
+		return stdout.split("\0").filter((p) => p.length > 0);
+	} catch {
+		return walkFiles(cwd);
+	}
+}
+/**
+* Every file under `cwd` as a cwd-relative posix path — the non-git fallback
+* for `listCheckoutFiles`. Symlinks are listed but not followed, so a link loop
+* cannot hang the walk. An unreadable directory is skipped rather than fatal:
+* the count is a warning signal, not a gate. Exported for tests, which cannot
+* otherwise reach this branch deterministically.
+*/
+async function walkFiles(cwd) {
+	const out = [];
+	const stack = [cwd];
+	while (stack.length > 0) {
+		const dir = stack.pop();
+		let entries;
+		try {
+			entries = await readdir(dir, { withFileTypes: true });
+		} catch {
+			continue;
+		}
+		for (const entry of entries) {
+			const abs = join(dir, entry.name);
+			if (entry.isDirectory()) {
+				if (!SKIP_DIRS.has(entry.name)) stack.push(abs);
+			} else out.push(relative(cwd, abs).split(sep).join("/"));
+		}
+	}
+	return out;
+}
+/** How many of `patterns` match none of `files`. */
+function countUnmatchedPatterns(patterns, files) {
+	return patterns.filter((pattern) => !files.some((file) => matchesGlob(file, pattern))).length;
+}
+/**
+* A perspective entry's `relatedPaths` fields — the list and its zero-match
+* count — produced together, so the two writers of the document (the full
+* `ccqa perspectives` build and the per-spec update after `ccqa record`) cannot
+* record one without the other. Empty for a spec that declares no paths: there
+* is nothing to check, which is not the same as "checked, all matched".
+*/
+function relatedPathsFields(paths, files) {
+	if (paths.length === 0) return {};
+	return {
+		relatedPaths: [...paths],
+		relatedPathsUnmatched: countUnmatchedPatterns(paths, files)
+	};
+}
+//#endregion
 //#region src/cli/perspectives.ts
 const perspectivesCommand = addHubOptions(addLanguageOption(new Command("perspectives").description("Generate/update the project's perspectives document on the hub — a factual inventory of existing test coverage (no severity, no gap analysis)").option("--instruction <text>", "Hint to steer how summaries are written").option("--apply", "Auto-apply without [y/N] confirmation", false).option("--check", "Verify the hub document still matches the local specs (mechanical fields only) and exit 1 when it is stale. No Claude calls — cheap enough for CI.", false).option("-m, --model <name>", "Claude model alias ('sonnet'|'opus'|'haiku') or full ID").option("--project <name>", "Hub project to store the document under (default: cwd directory name)"))).action(withHubErrors(async (opts) => {
 	if (opts.check) await runPerspectivesCheck(opts);
@@ -12880,7 +13372,8 @@ async function runPerspectivesCheck(opts) {
 	const hub = requireHubOrExit(opts);
 	const project = resolveProject(opts);
 	header("perspectives", `check (project: ${project})`);
-	const skeleton = await buildSkeleton(await listFeatureTree());
+	const [tree, checkoutFiles] = await Promise.all([listFeatureTree(), listCheckoutFiles(process.cwd())]);
+	const skeleton = await buildSkeleton(tree, checkoutFiles);
 	const localCount = skeleton.reduce((n, f) => n + f.specs.length, 0);
 	const existingDoc = await hub.getPerspectives(project);
 	if (existingDoc === null) {
@@ -12962,7 +13455,8 @@ async function runPerspectives(opts) {
 	const hub = requireHubOrExit(opts);
 	const project = resolveProject(opts);
 	header("perspectives", `project: ${project}`);
-	const skeleton = await buildSkeleton(await listFeatureTree());
+	const [tree, checkoutFiles] = await Promise.all([listFeatureTree(), listCheckoutFiles(process.cwd())]);
+	const skeleton = await buildSkeleton(tree, checkoutFiles);
 	const allSpecs = skeleton.flatMap((f) => f.specs);
 	if (allSpecs.length === 0) {
 		info("no test cases found under .ccqa/features — nothing to inventory.");
@@ -13018,8 +13512,11 @@ async function cleanupLegacyLocalFiles() {
 * relatedPaths transcribed from each spec, status derived mechanically from
 * on-disk artifacts. `summary` is left empty here; Claude fills it later.
 * Specs whose spec.yaml is missing or unparsable are skipped.
+*
+* `checkoutFiles` is the one shared file listing every spec's `relatedPaths`
+* zero-match count is computed against.
 */
-async function buildSkeleton(tree) {
+async function buildSkeleton(tree, checkoutFiles) {
 	const config = await loadProjectConfig(process.cwd()).catch(() => null);
 	return (await Promise.all(tree.map(async (feature) => {
 		const specs = await Promise.all(feature.specs.filter((s) => s.hasSpecFile).map(async (s) => {
@@ -13027,14 +13524,13 @@ async function buildSkeleton(tree) {
 			const meta = readSpecMeta(s.specName, specYaml);
 			const plugin = resolveSpecTarget(specYaml, config);
 			const status = await deriveStatus(feature.featureName, s.specName, meta.mode, plugin);
-			const entry = {
+			return {
 				specName: s.specName,
 				title: meta.title,
 				summary: "",
+				...relatedPathsFields(s.relatedPaths ?? [], checkoutFiles),
 				status
 			};
-			if (s.relatedPaths) entry.relatedPaths = s.relatedPaths;
-			return entry;
 		}));
 		return {
 			featureName: feature.featureName,
@@ -13288,6 +13784,7 @@ async function doSync(ctx, opts) {
 	const status = await deriveStatus(featureName, specName, meta$1.mode, plugin);
 	const relatedPaths = extractRelatedPaths(specYaml);
 	const previous = findSpec(doc, featureName, specName);
+	const checkoutFiles = listCheckoutFiles(process.cwd());
 	const written = (await requestSummaries([{
 		featureName,
 		specName,
@@ -13301,6 +13798,7 @@ async function doSync(ctx, opts) {
 		specName,
 		title: meta$1.title,
 		summary: written?.summary ?? previous?.summary ?? "",
+		...relatedPathsFields(relatedPaths, await checkoutFiles),
 		status
 	};
 	const startScreen = written?.startScreen ?? previous?.startScreen;
@@ -13309,7 +13807,6 @@ async function doSync(ctx, opts) {
 	if (testCondition) entry.testCondition = testCondition;
 	const preconditions = written?.preconditions ?? previous?.preconditions;
 	if (preconditions && preconditions.length > 0) entry.preconditions = preconditions;
-	if (relatedPaths.length > 0) entry.relatedPaths = relatedPaths;
 	if (previous?.note) entry.note = previous.note;
 	upsertSpec(doc, featureName, entry);
 	doc.generatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -14426,6 +14923,10 @@ const bootstrapCommand = new Command("bootstrap").description("Open a headed bro
 const sessionCommand = new Command("session").description("Manage saved browser sessions (cookies + localStorage) for `session:` specs. Use `ccqa hub session ls` to list sessions stored on the hub.").addCommand(bootstrapCommand);
 //#endregion
 //#region src/hub/api/respond.ts
+/** The message of an unknown throwable, for a log line or an error body. */
+function errMsg(err) {
+	return err instanceof Error ? err.message : String(err);
+}
 var HttpError = class extends Error {
 	status;
 	code;
@@ -14451,7 +14952,7 @@ function sendError(res, err) {
 	}
 	sendJson(res, 500, { error: {
 		code: "internal_error",
-		message: err instanceof Error ? err.message : String(err)
+		message: errMsg(err)
 	} });
 }
 function sendBytes(res, status, bytes, contentType) {
@@ -14477,6 +14978,24 @@ function readBody(req, maxBytes) {
 		req.on("error", rejectPromise);
 	});
 }
+/**
+* Read a JSON request body and validate it against `schema`. Both a body that
+* isn't JSON and one that doesn't fit the schema are the client's fault, so
+* both are 400 `invalid_body` — a bare `JSON.parse` would surface a malformed
+* body as a 500. `label` names the body in the message ("deploy body").
+*/
+async function readJsonBody(req, maxBytes, schema, label) {
+	const raw = await readBody(req, maxBytes);
+	let parsed;
+	try {
+		parsed = JSON.parse(raw.toString("utf8"));
+	} catch {
+		throw new HttpError(400, "invalid_body", `${label} must be valid JSON`);
+	}
+	const result = schema.safeParse(parsed);
+	if (!result.success) throw new HttpError(400, "invalid_body", `${label} is invalid: ${result.error.issues[0]?.message ?? "schema mismatch"}`);
+	return result.data;
+}
 //#endregion
 //#region src/hub/api/handlers/health.ts
 /** GET /api/v1/health — unauthenticated liveness probe. `queueDepth` is the number of learning jobs waiting. */
@@ -14532,7 +15051,10 @@ z.object({
 	ciRunId: z.string().nullable(),
 	runUrl: z.string().nullable().optional(),
 	reportCreatedAt: z.string(),
-	createdAt: z.string()
+	createdAt: z.string(),
+	deployedSha: z.string().nullable().optional(),
+	deployedShaSource: z.enum(["hub-deploy-log", "client"]).nullable().optional(),
+	deployedShaAmbiguous: z.boolean().optional()
 });
 /**
 * One failing spec's triage: the AI's prediction (read-only, sourced from
@@ -14581,10 +15103,129 @@ z.object({ error: z.object({
 	code: z.string(),
 	message: z.string()
 }) });
-z.object({
+/**
+* One spec's record of a single run, as stored in a ledger bucket. Identical
+* to `LastGreenEntry` plus the commit the environment was running at the time
+* — without it a bucket entry can be ordered in wall-clock time but not
+* *positioned* against the deploy log, which is the only ordering re-run
+* selection may use (ADR-0010).
+*/
+const SpecLedgerEntrySchema = z.object({
 	gitHead: z.string(),
 	runId: z.string(),
 	at: z.string()
+}).extend({
+	deployedSha: z.string().nullable().optional(),
+	deployedShaAmbiguous: z.boolean().optional()
+});
+z.object({
+	green: z.record(z.string(), SpecLedgerEntrySchema).default({}),
+	run: z.record(z.string(), SpecLedgerEntrySchema).default({}),
+	red: z.record(z.string(), SpecLedgerEntrySchema).default({})
+});
+/** One deploy, as the consumer's deploy job reported it (ADR-0010). */
+const DeployEntrySchema = z.object({
+	index: z.number().int().nonnegative(),
+	sha: z.string(),
+	previousSha: z.string().nullable(),
+	at: z.string(),
+	ref: z.string().optional(),
+	runUrl: z.string().optional(),
+	changedPaths: z.array(z.string()).nullable(),
+	truncated: z.boolean().default(false),
+	gapBefore: z.boolean().default(false)
+});
+z.object({
+	nextIndex: z.number().int().nonnegative().default(0),
+	entries: z.array(DeployEntrySchema).default([])
+});
+/**
+* One spec's entry in the derived touch index: the newest deploy known to have
+* touched it, folded in at write time from the deploy's full `changedPaths` so
+* that list can be dropped afterwards rather than retained per deploy.
+*
+* Folded against the `relatedPaths` in force when the deploy landed, so it can
+* disagree with a match against a spec's current `relatedPaths`. It is
+* therefore only consulted where the retained log cannot answer (a truncated
+* entry), never in place of matching the current paths.
+*/
+const SpecTouchSchema = z.object({
+	lastTouchedIndex: z.number().int().nonnegative(),
+	lastTouchedSha: z.string(),
+	lastTouchedAt: z.string(),
+	matchedPaths: z.array(z.string())
+});
+z.record(z.string(), SpecTouchSchema);
+/**
+* Whether a spec's last result is still trustworthy. Deliberately named for
+* the action rather than for a freshness adjective: "needs re-run" (mechanical,
+* no model call) is a different question from drift (does the spec still
+* describe the product), and the two must not be conflated — see ADR-0010.
+*/
+const RerunStateSchema = z.enum([
+	"needed",
+	"notNeeded",
+	"unknown",
+	"neverRun",
+	"notEvaluated"
+]);
+/**
+* Why a spec is `unknown`. Always carried, so the view can name the missing
+* input ("no deploy log for this profile") instead of shrugging. `unknown` is
+* never rendered as "not needed".
+*/
+const RerunUnknownReasonSchema = z.enum([
+	"noRelatedPaths",
+	"noDeployLog",
+	"unknownDeployedSha",
+	"ambiguousDeployedSha",
+	"deployedShaNotInLog",
+	"gapInRange",
+	"truncatedInRange"
+]);
+/** Where a deploy sits in a profile's log, as the view names it. */
+const DeployRefSchema = z.object({
+	index: z.number().int().nonnegative(),
+	sha: z.string(),
+	at: z.string()
+});
+/**
+* One spec's re-run verdict plus the three ledger coordinates the view shows
+* alongside it. The coordinates are always present (null when the spec has no
+* such entry); `reason`, `touchedBy` and `touchedByDeploy` appear only in the
+* states named below.
+*/
+const SpecRerunSchema = z.object({
+	state: RerunStateSchema,
+	reason: RerunUnknownReasonSchema.optional(),
+	lastRun: SpecLedgerEntrySchema.nullable(),
+	lastGreen: SpecLedgerEntrySchema.nullable(),
+	lastRed: SpecLedgerEntrySchema.nullable(),
+	touchedBy: z.array(z.string()).optional(),
+	touchedByDeploy: DeployRefSchema.nullable().optional()
+});
+z.object({
+	project: z.string(),
+	profile: z.string(),
+	deployHead: DeployRefSchema.nullable(),
+	specs: z.record(z.string(), SpecRerunSchema)
+});
+/** Body of `POST /projects/:project/deploys?profile=` — what the deploy job shipped. */
+const RecordDeployRequestSchema = z.object({
+	sha: z.string().min(1),
+	previousSha: z.string().min(1).nullable().optional(),
+	changedPaths: z.array(z.string()).nullable().optional(),
+	ref: z.string().optional(),
+	runUrl: z.string().optional()
+});
+z.object({
+	entries: z.array(DeployEntrySchema),
+	nextIndex: z.number().int().nonnegative()
+});
+z.object({
+	entries: z.record(z.string(), SpecLedgerEntrySchema),
+	lastRun: z.record(z.string(), SpecLedgerEntrySchema).default({}),
+	lastRed: z.record(z.string(), SpecLedgerEntrySchema).default({})
 });
 /**
 * A triage-learning job. Grading failing specs in the hub UI produces the
@@ -14624,13 +15265,56 @@ const CreateLearningJobRequestSchema = z.object({
 	runLimit: z.number().int().positive().max(1e3).optional()
 });
 //#endregion
-//#region src/hub/api/validate.ts
+//#region src/hub/core/spec-ledger.ts
+const BUCKET_NAMES = [
+	"green",
+	"run",
+	"red"
+];
+function emptyLedger() {
+	return {
+		green: {},
+		run: {},
+		red: {}
+	};
+}
 /**
-* Validators for URL path parameters that flow into the storage layer's file
-* path construction (secret store scope/name, artifact relative paths).
-* Router params come from `decodeURIComponent`-ed path segments, so a client
-* can put `..`, `/`, or `\` in them — these guards reject anything that
-* could escape the intended directory before it ever reaches disk I/O.
+* Documents written before the ledger grew `run` and `red` are a flat
+* `Record<specKey, entry>` of greens. A spec key is "feature/spec" and always
+* contains a '/', so it can never collide with a bucket name and the two
+* shapes are unambiguous. The first `merge` rewrites the file in the new
+* shape; nothing else migrates it.
+*/
+function toLedger(raw) {
+	if (raw === null || typeof raw !== "object") return emptyLedger();
+	const doc = raw;
+	if (!BUCKET_NAMES.some((name) => name in doc)) return {
+		green: doc,
+		run: {},
+		red: {}
+	};
+	return {
+		green: doc["green"] ?? {},
+		run: doc["run"] ?? {},
+		red: doc["red"] ?? {}
+	};
+}
+/** Fold `from` into `into` in place, per bucket and key, newest `at` winning. */
+function mergeLedgerInto(into, from) {
+	for (const name of BUCKET_NAMES) for (const [key, entry] of Object.entries(from[name])) {
+		const prev = into[name][key];
+		if (!prev || prev.at <= entry.at) into[name][key] = entry;
+	}
+	return into;
+}
+//#endregion
+//#region src/hub/api/validate.ts
+/**
+* Validators for URL path parameters that flow into the storage layer's file
+* path construction (secret store scope/name, artifact relative paths).
+* Router params come from `decodeURIComponent`-ed path segments, so a client
+* can put `..`, `/`, or `\` in them — these guards reject anything that
+* could escape the intended directory before it ever reaches disk I/O.
 */
 const SAFE_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 /** Validate a single URL path parameter (e.g. `:profile`, `:name`) as a bare name. Throws 400 if unsafe. */
@@ -14638,6 +15322,13 @@ function requireSafeSegment(value, paramName) {
 	if (value.length === 0 || value.length > 128 || !SAFE_SEGMENT.test(value) || value === "." || value === ".." || value.includes("/") || value.includes("\\")) throw new HttpError(400, "invalid_param", `invalid ${paramName}: must be a bare name (letters, digits, '.', '_', '-'; no path separators or '..')`);
 	return value;
 }
+/**
+* The `?profile=` query param, defaulting to "default". Shared by every
+* profile-scoped route so the default and the validation rule have one home.
+*/
+function requireProfileParam(url) {
+	return requireSafeSegment(url.searchParams.get("profile") ?? "default", "profile");
+}
 /** Validate a `*path`-captured relative path (multiple segments allowed) as safe to join under a root dir. Throws 400 if unsafe. */
 function requireSafeRelPath(relPath, paramName) {
 	const segments = relPath.split("/");
@@ -14657,7 +15348,7 @@ const DEFAULT_MAX_PUSH_BYTES = 32 * 1024 * 1024;
 function createPushRunHandler(config) {
 	const maxPushBytes = config.maxPushBytes ?? DEFAULT_MAX_PUSH_BYTES;
 	return async (ctx) => {
-		const { project, branch, profile, kind } = parseRunScope(ctx);
+		const { project, branch, profile, kind, deployedSha } = parseRunScope(ctx);
 		const body = await readBody(ctx.req, maxPushBytes);
 		const dir = await mkdtemp(join(tmpdir(), "ccqa-hub-push-"));
 		try {
@@ -14698,11 +15389,13 @@ function createPushRunHandler(config) {
 				ciRunId: report.runId,
 				runUrl: report.runUrl ?? null,
 				reportCreatedAt: report.createdAt,
-				createdAt: (/* @__PURE__ */ new Date()).toISOString()
+				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+				...await resolveDeployedSha(config.storage, project, profile, deployedSha),
+				deployedShaAmbiguous: false
 			};
 			await config.storage.artifacts.putDir(run.id, dir);
 			await config.storage.runs.create(run);
-			await updateLastGreenLedger(config.storage, run, report.results);
+			await updateSpecLedger(config.storage, run, report.results);
 			sendJson(ctx.res, 201, run);
 		} finally {
 			await rm(dir, {
@@ -14722,7 +15415,7 @@ function createPushRunHandler(config) {
 */
 function createOpenRunHandler(config) {
 	return async (ctx) => {
-		const { project, branch, profile, kind } = parseRunScope(ctx);
+		const { project, branch, profile, kind, deployedSha } = parseRunScope(ctx);
 		const gitHead = ctx.url.searchParams.get("gitHead");
 		const ciRunId = ctx.url.searchParams.get("ciRunId");
 		const runUrl = ctx.url.searchParams.get("runUrl");
@@ -14745,7 +15438,9 @@ function createOpenRunHandler(config) {
 			ciRunId: ciRunId || null,
 			runUrl: runUrl || null,
 			reportCreatedAt: now,
-			createdAt: now
+			createdAt: now,
+			...await resolveDeployedSha(config.storage, project, profile, deployedSha),
+			deployedShaAmbiguous: false
 		};
 		await config.storage.runs.create(run);
 		sendJson(ctx.res, 201, run);
@@ -14782,35 +15477,92 @@ function countSpecs(results) {
 	};
 }
 /**
-* Advance the last-green ledger for every passed spec of a terminal
-* `kind: "run"` run. Spec-level, not run-level: a run with one chronically
-* failing spec still moves the baseline of every spec that did pass.
+* Advance the spec ledger's three buckets from a terminal `kind: "run"` run.
+* Spec-level, not run-level: a run with one chronically failing spec still
+* moves the baselines of every spec that did pass.
+*
+* A skipped row did not execute, so it advances nothing — not even `run`.
+* Everything else lands in `run` (the "needs re-run" baseline) and in `green`
+* or `red` (the last outcome), which are orthogonal axes.
+*
 * Best-effort — a ledger failure must not fail the push; the ledger is an
-* accelerator for `--failure-analysis=last-green`, not part of the run
-* record. Runs without a branch or gitHead can't be placed in the ledger and
-* are skipped.
+* accelerator for `--failure-analysis=last-green` and re-run selection, not
+* part of the run record. Runs without a branch or gitHead can't be placed in
+* the ledger and are skipped.
 *
 * Ordering caveat (known approximation): `at` is the run's reportCreatedAt —
 * open time for incremental runs, report time for immutable pushes. When two
 * runs on the same branch+profile overlap, "newest at wins" can pick either
 * of the two genuinely-green commits, since the hub has no git ancestry to
 * order them properly. Accepted: CI serializes per branch in practice, and a
-* baseline can only ever point at a commit where the spec really passed.
+* baseline can only ever point at a commit where the spec really ran.
 */
-async function updateLastGreenLedger(storage, run, results) {
+async function updateSpecLedger(storage, run, results) {
 	const { gitHead, branch } = run;
 	if (run.kind !== "run" || !gitHead || !branch) return;
-	const passed = results.filter((r) => r.status === "passed");
-	if (passed.length === 0) return;
-	const entries = Object.fromEntries(passed.map((r) => [`${r.feature}/${r.spec}`, {
+	const entry = {
 		gitHead,
 		runId: run.id,
-		at: run.reportCreatedAt
-	}]));
+		at: run.reportCreatedAt,
+		deployedSha: run.deployedSha ?? null,
+		deployedShaAmbiguous: run.deployedShaAmbiguous ?? false
+	};
+	const ledger = emptyLedger();
+	for (const row of results) {
+		if (row.status === "skipped") continue;
+		const key = `${row.feature}/${row.spec}`;
+		ledger.run[key] = entry;
+		if (row.status === "passed") ledger.green[key] = entry;
+		else ledger.red[key] = entry;
+	}
+	if (Object.keys(ledger.run).length === 0) return;
+	try {
+		await storage.ledger.merge(run.project, run.profile ?? "default", branch, ledger);
+	} catch (err) {
+		console.error(`hub: spec ledger update failed for run "${run.id}": ${errMsg(err)}`);
+	}
+}
+/**
+* What commit the environment was running for this run. An explicit
+* `?deployedSha=` wins — ccqa never guesses a baseline, and a caller that
+* knows what it deployed against is more authoritative than the log head.
+*
+* Best-effort: a deploy log the hub can't read leaves the run unattributed
+* (re-run selection then answers `unknown`) rather than rejecting the run.
+*/
+async function resolveDeployedSha(storage, project, profile, explicit) {
+	if (explicit) return {
+		deployedSha: explicit,
+		deployedShaSource: "client"
+	};
 	try {
-		await storage.lastGreen.merge(run.project, run.profile ?? "default", branch, entries);
+		const head = await storage.deploys.head(project, profile ?? "default");
+		if (head) return {
+			deployedSha: head.sha,
+			deployedShaSource: "hub-deploy-log"
+		};
 	} catch (err) {
-		console.error(`hub: last-green ledger update failed for run "${run.id}": ${err instanceof Error ? err.message : String(err)}`);
+		console.error(`hub: could not read the deploy log for "${project}/${profile ?? "default"}": ${errMsg(err)}`);
+	}
+	return {
+		deployedSha: null,
+		deployedShaSource: null
+	};
+}
+/**
+* True when the deploy-log head moved while the run was open: the run
+* straddled a deploy, so which commit it exercised is not knowable and re-run
+* selection must report `unknown` instead of picking one. Only meaningful for
+* a sha the hub stamped itself — a client-asserted one is the caller's claim
+* about its own run, not the hub's observation.
+*/
+async function deployHeadMovedDuringRun(storage, run) {
+	if (run.deployedShaSource !== "hub-deploy-log" || !run.deployedSha) return false;
+	try {
+		const head = await storage.deploys.head(run.project, run.profile ?? "default");
+		return head !== null && head.sha !== run.deployedSha;
+	} catch {
+		return false;
 	}
 }
 /**
@@ -14824,16 +15576,7 @@ function createPatchRunHandler(config) {
 		const id = ctx.params.id;
 		const run = await getRunOr404(config.storage, id);
 		if (run.status !== "running") throw new HttpError(409, "conflict", "run is not running (already terminal)");
-		const raw = await readBody(ctx.req, maxPushBytes);
-		let bodyJson;
-		try {
-			bodyJson = JSON.parse(raw.toString("utf8"));
-		} catch {
-			throw new HttpError(400, "invalid_body", "request body is not valid JSON");
-		}
-		const parsed = PatchRunRequestSchema.safeParse(bodyJson);
-		if (!parsed.success) throw new HttpError(400, "invalid_body", `request body is invalid: ${parsed.error.issues[0]?.message ?? "schema mismatch"}`);
-		const { rows, evidence, done, finalStatus, reportMeta } = parsed.data;
+		const { rows, evidence, done, finalStatus, reportMeta } = await readJsonBody(ctx.req, maxPushBytes, PatchRunRequestSchema, "request body");
 		let specs = run.specs;
 		let mergedResults = [];
 		await config.storage.artifacts.updateJsonFile(id, "report.json", (current) => {
@@ -14879,10 +15622,11 @@ function createPatchRunHandler(config) {
 			status: finalStatus ?? (specs.failed > 0 ? "failed" : "passed"),
 			specs,
 			...reportMeta?.git?.head ? { gitHead: reportMeta.git.head } : {},
-			...reportMeta?.promptVersion ? { promptVersion: reportMeta.promptVersion } : {}
+			...reportMeta?.promptVersion ? { promptVersion: reportMeta.promptVersion } : {},
+			...await deployHeadMovedDuringRun(config.storage, run) ? { deployedShaAmbiguous: true } : {}
 		} : { specs };
 		const updated = await config.storage.runs.update(id, patch);
-		if (done) await updateLastGreenLedger(config.storage, updated, mergedResults);
+		if (done) await updateSpecLedger(config.storage, updated, mergedResults);
 		sendJson(ctx.res, 200, updated);
 	};
 }
@@ -14977,10 +15721,11 @@ function summarizeDrift(results) {
 	};
 }
 /**
-* Parse the `project`/`branch`/`profile`/`kind` query params shared by
-* `POST /runs` (push) and `POST /runs/open`. `project` is required; `profile`
-* is optional and recorded for display only (runs are not scoped by profile);
-* `kind` defaults to "run".
+* Parse the `project`/`branch`/`profile`/`kind`/`deployedSha` query params
+* shared by `POST /runs` (push) and `POST /runs/open`. `project` is required;
+* `profile` is optional and recorded for display only (runs are not scoped by
+* profile); `kind` defaults to "run"; `deployedSha` overrides what the hub
+* would read from the profile's deploy log.
 */
 function parseRunScope(ctx) {
 	const projectRaw = ctx.url.searchParams.get("project");
@@ -14991,11 +15736,13 @@ function parseRunScope(ctx) {
 	const profile = profileRaw ? requireSafeSegment(profileRaw, "profile") : null;
 	const kindRaw = ctx.url.searchParams.get("kind");
 	if (kindRaw !== null && kindRaw !== "run" && kindRaw !== "drift") throw new HttpError(400, "invalid_param", `invalid kind: must be "run" or "drift"`);
+	const deployedSha = boundedParam(ctx.url.searchParams.get("deployedSha"), "deployedSha", 64);
 	return {
 		project,
 		branch,
 		profile,
-		kind: kindRaw ?? "run"
+		kind: kindRaw ?? "run",
+		deployedSha
 	};
 }
 /**
@@ -15006,13 +15753,14 @@ function parseRunScope(ctx) {
 * send one. Exported for the last-green handler.
 */
 function requireBranch(raw) {
+	return boundedParam(raw, "branch", 256);
+}
+/** An opaque free-form query param: null when absent, otherwise length-capped as a sanity check. */
+function boundedParam(raw, name, max) {
 	if (raw === null || raw === "") return null;
-	if (raw.length > 256) throw new HttpError(400, "invalid_param", "branch is too long (max 256 chars)");
+	if (raw.length > max) throw new HttpError(400, "invalid_param", `${name} is too long (max ${max} chars)`);
 	return raw;
 }
-function errMsg(err) {
-	return err instanceof Error ? err.message : String(err);
-}
 //#endregion
 //#region src/hub/core/crypto.ts
 /**
@@ -15260,25 +16008,326 @@ function createListProfilesHandler(storage) {
 /**
 * GET /api/v1/projects/:project/last-green?profile=&branch=&fallbackBranch=
 *
-* Returns the last-green ledger entries for one project/profile, keyed by
-* "feature/spec". `branch` is the caller's current branch; `fallbackBranch`
-* (optional, typically the default branch) is overlaid *under* it, so a PR
-* branch with no greens of its own still inherits the default branch's
-* baselines while its own greens take precedence. One round trip serves the
-* whole run.
+* Returns the spec ledger for one project/profile, keyed by "feature/spec".
+* `branch` is the caller's current branch; `fallbackBranch` (optional,
+* typically the default branch) is overlaid *under* it, so a PR branch with no
+* entries of its own still inherits the default branch's baselines while its
+* own take precedence. One round trip serves the whole run.
+*
+* `entries` is the green bucket and keeps that exact meaning — older CLIs read
+* `entry.gitHead` from it as "the commit this spec last passed at". The
+* last-run and last-red buckets are siblings, not a redefinition.
 */
 function createGetLastGreenHandler(storage) {
 	return async (ctx) => {
 		const project = requireSafeSegment(ctx.params.project, "project");
-		const profile = requireSafeSegment(ctx.url.searchParams.get("profile") ?? "default", "profile");
+		const profile = requireProfileParam(ctx.url);
 		const branch = requireBranch(ctx.url.searchParams.get("branch"));
 		if (!branch) throw new HttpError(400, "missing_param", "branch query parameter is required");
 		const fallbackBranch = requireBranch(ctx.url.searchParams.get("fallbackBranch"));
-		const [primary, fallback] = await Promise.all([storage.lastGreen.get(project, profile, branch), fallbackBranch && fallbackBranch !== branch ? storage.lastGreen.get(project, profile, fallbackBranch) : Promise.resolve({})]);
-		sendJson(ctx.res, 200, { entries: {
-			...fallback,
-			...primary
-		} });
+		const [primary, fallback] = await Promise.all([storage.ledger.get(project, profile, branch), fallbackBranch && fallbackBranch !== branch ? storage.ledger.get(project, profile, fallbackBranch) : Promise.resolve(emptyLedger())]);
+		sendJson(ctx.res, 200, {
+			entries: {
+				...fallback.green,
+				...primary.green
+			},
+			lastRun: {
+				...fallback.run,
+				...primary.run
+			},
+			lastRed: {
+				...fallback.red,
+				...primary.red
+			}
+		});
+	};
+}
+function emptyDeployLog() {
+	return {
+		nextIndex: 0,
+		entries: []
+	};
+}
+/** Append `input` to `current`; the appended entry is always the last of `entries`. */
+function appendDeploy(current, input) {
+	const log = current ?? emptyDeployLog();
+	const head = log.entries[log.entries.length - 1];
+	const gapBefore = head ? head.sha !== input.previousSha : log.nextIndex > 0;
+	const truncated = input.changedPaths !== null && input.changedPaths.length > 500;
+	const entries = [...log.entries, {
+		...input,
+		index: log.nextIndex,
+		changedPaths: truncated ? input.changedPaths.slice(0, 500) : input.changedPaths,
+		truncated,
+		gapBefore
+	}];
+	if (entries.length > 200) {
+		entries.splice(0, entries.length - 200);
+		entries[0] = {
+			...entries[0],
+			gapBefore: true
+		};
+	}
+	return {
+		nextIndex: log.nextIndex + 1,
+		entries
+	};
+}
+/**
+* Fold one deploy into the touch index, matched against `changedPaths` as the
+* deploy job reported them — the log's retained copy may be truncated, and
+* this is the only moment the full list exists.
+*
+* A deploy that reported no paths touches every spec: fail-open, and
+* self-limiting because it makes everything re-run once and then settles.
+*/
+function foldTouchIndex(current, entry, changedPaths, targets) {
+	const out = { ...current };
+	for (const target of targets) {
+		if (target.relatedPaths.length === 0) continue;
+		const matched = changedPaths === null ? [] : matchPaths(changedPaths, target.relatedPaths);
+		if (changedPaths !== null && matched.length === 0) continue;
+		out[target.key] = {
+			lastTouchedIndex: entry.index,
+			lastTouchedSha: entry.sha,
+			lastTouchedAt: entry.at,
+			matchedPaths: matched
+		};
+	}
+	return out;
+}
+/**
+* The paths in `changedPaths` covered by `relatedPaths`, up to the sample
+* size. Uses `isPathAffectedBy`, the same matcher `ccqa drift --changed` and
+* `ccqa run --changed` use, so the hub's verdict and the CLI's cannot diverge.
+*/
+function matchPaths(changedPaths, relatedPaths) {
+	const out = [];
+	for (const path of changedPaths) {
+		if (!isPathAffectedBy(path, relatedPaths)) continue;
+		out.push(path);
+		if (out.length >= 10) break;
+	}
+	return out;
+}
+//#endregion
+//#region src/hub/core/perspectives-specs.ts
+function prop(obj, key) {
+	return obj?.[key];
+}
+/**
+* Pull the spec targets out of a stored perspectives document.
+*
+* Hand-parsed rather than run through `PerspectivesSchema`, because the
+* document on the hub was written by whatever CLI version the consumer runs:
+* a single malformed entry must cost that one spec, not fail the whole view.
+*/
+function readSpecTargets(doc) {
+	const features = prop(doc, "features");
+	if (!Array.isArray(features)) return [];
+	const out = [];
+	for (const feature of features) {
+		const featureName = prop(feature, "featureName");
+		const specs = prop(feature, "specs");
+		if (typeof featureName !== "string" || !Array.isArray(specs)) continue;
+		for (const spec of specs) {
+			const specName = prop(spec, "specName");
+			if (typeof specName !== "string") continue;
+			const related = prop(spec, "relatedPaths");
+			out.push({
+				key: `${featureName}/${specName}`,
+				relatedPaths: Array.isArray(related) ? related.filter((p) => typeof p === "string") : []
+			});
+		}
+	}
+	return out;
+}
+/**
+* The project's spec targets as stored on the hub, or null when it has no
+* perspectives document — the one condition `GET /rerun` answers with a 404,
+* and the one that leaves a deploy with nothing to fold against.
+*/
+async function loadSpecTargets(perspectives, project) {
+	const stored = await perspectives.get(project);
+	if (!stored) return null;
+	try {
+		return readSpecTargets(JSON.parse(Buffer.from(stored).toString("utf8")));
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/hub/api/handlers/deploys.ts
+/** `changedPaths` for a wide refactor can run to tens of thousands of entries. */
+const MAX_DEPLOY_BODY_BYTES = 8 * 1024 * 1024;
+/**
+* POST /api/v1/projects/:project/deploys?profile=
+*
+* The consuming deploy job tells the hub what it shipped. This is the input
+* that makes "needs re-run" answerable at all: the hub has no checkout and
+* never calls a git host, so it cannot work out what changed on its own
+* (ADR-0010). The log is per-profile because two environments sit at
+* different commits.
+*/
+function createRecordDeployHandler(storage) {
+	return async (ctx) => {
+		const project = requireSafeSegment(ctx.params.project, "project");
+		const profile = requireProfileParam(ctx.url);
+		const { sha, previousSha, changedPaths, ref, runUrl } = await readJsonBody(ctx.req, MAX_DEPLOY_BODY_BYTES, RecordDeployRequestSchema, "deploy body");
+		const entry = await storage.deploys.append(project, profile, {
+			sha,
+			previousSha: previousSha ?? null,
+			at: (/* @__PURE__ */ new Date()).toISOString(),
+			...ref ? { ref } : {},
+			...runUrl ? { runUrl } : {},
+			changedPaths: changedPaths ?? null
+		});
+		await foldIntoTouchIndex(storage, project, profile, entry, changedPaths ?? null);
+		sendJson(ctx.res, 201, entry);
+	};
+}
+/**
+* Record which specs this deploy touched, matched against the full
+* `changedPaths` before the stored entry's bounded copy is all that is left.
+*
+* Best-effort and deliberately after the append: the log is the record of what
+* shipped, the index is a derived accelerator, and losing the fold costs
+* precision on truncated entries — not correctness.
+*/
+async function foldIntoTouchIndex(storage, project, profile, entry, changedPaths) {
+	try {
+		const targets = await loadSpecTargets(storage.perspectives, project);
+		if (!targets || targets.length === 0) return;
+		await storage.deploys.updateTouchIndex(project, profile, (current) => foldTouchIndex(current, entry, changedPaths, targets));
+	} catch (err) {
+		console.error(`hub: touch-index fold failed for deploy "${entry.sha}" of "${project}/${profile}": ${errMsg(err)}`);
+	}
+}
+/** GET /api/v1/projects/:project/deploys?profile=&limit= — the retained log, oldest first. */
+function createGetDeployLogHandler(storage) {
+	return async (ctx) => {
+		const project = requireSafeSegment(ctx.params.project, "project");
+		const log = await storage.deploys.getLog(project, requireProfileParam(ctx.url));
+		const limit = Number(ctx.url.searchParams.get("limit"));
+		const entries = Number.isFinite(limit) && limit > 0 ? log.entries.slice(-Math.floor(limit)) : log.entries;
+		sendJson(ctx.res, 200, {
+			entries,
+			nextIndex: log.nextIndex
+		});
+	};
+}
+//#endregion
+//#region src/hub/core/rerun.ts
+function computeRerun(input) {
+	const { specs, ledger, log, touchIndex } = input;
+	const notEvaluated = log.entries.length === 0 && Object.keys(ledger.run).length === 0 && Object.keys(ledger.green).length === 0;
+	const positionBySha = /* @__PURE__ */ new Map();
+	log.entries.forEach((entry, i) => {
+		if (!positionBySha.has(entry.sha)) positionBySha.set(entry.sha, i);
+	});
+	const out = {};
+	for (const spec of specs) {
+		const coords = {
+			lastRun: ledger.run[spec.key] ?? null,
+			lastGreen: ledger.green[spec.key] ?? null,
+			lastRed: ledger.red[spec.key] ?? null
+		};
+		out[spec.key] = notEvaluated ? {
+			state: "notEvaluated",
+			...coords
+		} : {
+			...verdict(spec, coords.lastRun, log, positionBySha, touchIndex),
+			...coords
+		};
+	}
+	return out;
+}
+function verdict(spec, lastRun, log, positionBySha, touchIndex) {
+	if (!lastRun) return { state: "neverRun" };
+	if (spec.relatedPaths.length === 0) return unknown("noRelatedPaths");
+	if (log.entries.length === 0) return unknown("noDeployLog");
+	if (lastRun.deployedShaAmbiguous) return unknown("ambiguousDeployedSha");
+	const deployedSha = lastRun.deployedSha ?? null;
+	if (!deployedSha) return unknown("unknownDeployedSha");
+	const baselinePos = positionBySha.get(deployedSha);
+	if (baselinePos === void 0) return unknown("deployedShaNotInLog");
+	const baselineIndex = log.entries[baselinePos].index;
+	let sawGap = false;
+	let sawUnknownContents = false;
+	for (let i = log.entries.length - 1; i > baselinePos; i--) {
+		const entry = log.entries[i];
+		if (entry.changedPaths !== null && !entry.truncated) {
+			const matched = matchPaths(entry.changedPaths, spec.relatedPaths);
+			if (matched.length > 0) return {
+				state: "needed",
+				touchedBy: matched,
+				touchedByDeploy: deployRef(entry)
+			};
+		} else sawUnknownContents = true;
+		if (entry.gapBefore) sawGap = true;
+	}
+	if (!sawGap && !sawUnknownContents) return { state: "notNeeded" };
+	const touch = touchIndex[spec.key];
+	if (touch && touch.lastTouchedIndex > baselineIndex) {
+		const entry = log.entries.find((e) => e.index === touch.lastTouchedIndex);
+		return {
+			state: "needed",
+			...touch.matchedPaths.length > 0 ? { touchedBy: touch.matchedPaths } : {},
+			touchedByDeploy: entry ? deployRef(entry) : null
+		};
+	}
+	return unknown(sawGap ? "gapInRange" : "truncatedInRange");
+}
+function deployRef(entry) {
+	return {
+		index: entry.index,
+		sha: entry.sha,
+		at: entry.at
+	};
+}
+function unknown(reason) {
+	return {
+		state: "unknown",
+		reason
+	};
+}
+//#endregion
+//#region src/hub/api/handlers/rerun.ts
+/**
+* GET /api/v1/projects/:project/rerun?profile=
+*
+* Per spec: is its last result still trustworthy? Set arithmetic over the spec
+* ledger, the profile's deploy log and each spec's `relatedPaths` (ADR-0010).
+* The ledger is read across every branch: a run exercises the deployed
+* environment whatever branch its code came from.
+*/
+function createGetRerunHandler(storage) {
+	return async (ctx) => {
+		const project = requireSafeSegment(ctx.params.project, "project");
+		const profile = requireProfileParam(ctx.url);
+		const [specs, ledger, log, touchIndex] = await Promise.all([
+			loadSpecTargets(storage.perspectives, project),
+			storage.ledger.getMerged(project, profile),
+			storage.deploys.getLog(project, profile),
+			storage.deploys.getTouchIndex(project, profile)
+		]);
+		if (specs === null) throw new HttpError(404, "no_perspectives", `no perspectives stored for project "${project}" — push one with \`ccqa perspectives\` before asking which specs need a re-run`);
+		const head = log.entries[log.entries.length - 1];
+		sendJson(ctx.res, 200, {
+			project,
+			profile,
+			deployHead: head ? {
+				index: head.index,
+				sha: head.sha,
+				at: head.at
+			} : null,
+			specs: computeRerun({
+				specs,
+				ledger,
+				log,
+				touchIndex
+			})
+		});
 	};
 }
 //#endregion
@@ -15899,15 +16948,29 @@ const HTML_BODY = `
         <p id="persp-status" class="empty-note" hidden></p>
         <div id="persp-body" hidden>
           <div class="ov" id="persp-ov"></div>
+          <div class="note info persp-note" id="persp-rerun-note" hidden></div>
           <div class="toolbar">
             <label class="search"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor"><circle cx="11" cy="11" r="7"/><path d="m21 21-4.3-4.3"/></svg><input id="persp-q" type="search" data-i18n-ph="perspectives.search" aria-label="Search cases"></label>
-            <button class="fchip" data-f="all" aria-pressed="true" type="button" data-i18n="perspectives.filter.all">All</button>
-            <button class="fchip" data-f="deterministic" aria-pressed="false" type="button" data-i18n="perspectives.filter.deterministic">Deterministic</button>
-            <button class="fchip" data-f="live" aria-pressed="false" type="button" data-i18n="perspectives.filter.live">Live</button>
-            <button class="fchip" data-f="norec" aria-pressed="false" type="button" data-i18n="perspectives.filter.norec">Not recorded only</button>
+            <!-- Each chip carries the count of what it would leave behind, so
+                 data-i18n sits on the inner label span: applyStaticI18n swaps
+                 textContent, which on the button would delete the count. -->
+            <button class="fchip" data-f="all" aria-pressed="true" type="button"><span data-i18n="perspectives.filter.all">All</span><span class="fcount"></span></button>
+            <button class="fchip" data-f="deterministic" aria-pressed="false" type="button"><span data-i18n="perspectives.filter.deterministic">Deterministic</span><span class="fcount"></span></button>
+            <button class="fchip" data-f="live" aria-pressed="false" type="button"><span data-i18n="perspectives.filter.live">Live</span><span class="fcount"></span></button>
+            <button class="fchip" data-f="norec" aria-pressed="false" type="button"><span data-i18n="perspectives.filter.norec">Not recorded only</span><span class="fcount"></span></button>
+            <button class="fchip" id="persp-chip-rerun" data-f="rerun" aria-pressed="false" type="button" hidden><span data-i18n="perspectives.filter.rerun">Needs re-run only</span><span class="fcount"></span></button>
+            <div class="spacer"></div>
+            <span class="muted persp-head" id="persp-deploy-head" hidden></span>
+            <div class="sw-wrap" id="persp-profile-wrap">
+              <button class="sw-btn" id="persp-profile-switch" type="button" aria-haspopup="menu" aria-expanded="false">
+                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor"><path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/></svg>
+                <span class="k" data-i18n="app.profile">profile</span> <span class="v" id="persp-profile-current">default</span> <span class="chev">▾</span>
+              </button>
+              <div class="proj-menu right" id="persp-profile-menu" role="menu" hidden></div>
+            </div>
           </div>
           <div class="tblcard"><div class="table-wrap"><table>
-            <thead><tr><th data-i18n="perspectives.col.case">Case</th><th data-i18n="perspectives.col.mode">Mode</th><th data-i18n="perspectives.col.status">Status</th><th></th></tr></thead>
+            <thead><tr><th data-i18n="perspectives.col.case">Case</th><th data-i18n="perspectives.col.mode">Mode</th><th data-i18n="perspectives.col.status">Status</th><th id="persp-th-result" data-i18n="perspectives.col.lastResult" hidden>Last result</th><th id="persp-th-rerun" data-i18n="perspectives.col.rerun" hidden>Needs re-run</th><th></th></tr></thead>
             <tbody id="persp-tbody"></tbody>
           </table></div></div>
           <p class="empty-note" id="persp-no-hit" hidden data-i18n="perspectives.noHit">No matching cases.</p>
@@ -16091,6 +17154,11 @@ const CSS = `
     --fail: #dc2626; --fail-bg: #fef2f2; --fail-border: #fecaca;
     --info: #2563eb; --info-bg: #eff6ff; --info-border: #bfdbfe;
     --amber: #a16207; --amber-bg: #fefce8; --amber-border: #fde68a;
+    /* Fill counterpart of --amber. The token above is tuned for *text* on
+       --amber-bg, so at swatch size it reads brown; a filled area needs the
+       actual yellow the badge is understood to mean. Same value in both
+       themes, since a fill has no contrast-on-background constraint. */
+    --amber-fill: #eab308;
     --violet: #7c3aed; --violet-bg: #f5f3ff; --violet-border: #ddd6fe;
     --radius: 10px; --radius-md: 8px; --radius-sm: 6px;
     --shadow: 0 10px 38px -10px rgba(0,0,0,0.20), 0 4px 12px -4px rgba(0,0,0,0.10);
@@ -16108,6 +17176,7 @@ const CSS = `
     --fail: #f87171; --fail-bg: rgba(248,113,113,0.10); --fail-border: rgba(248,113,113,0.25);
     --info: #60a5fa; --info-bg: rgba(96,165,250,0.10); --info-border: rgba(96,165,250,0.25);
     --amber: #eab308; --amber-bg: rgba(234,179,8,0.10); --amber-border: rgba(234,179,8,0.25);
+    --amber-fill: #eab308;
     --violet: #a78bfa; --violet-bg: rgba(167,139,250,0.10); --violet-border: rgba(167,139,250,0.25);
     --shadow: 0 10px 38px -10px rgba(0,0,0,0.6), 0 4px 12px -4px rgba(0,0,0,0.4);
   }
@@ -16551,30 +17620,39 @@ const CSS = `
   .prompt-diff pre { margin: 0; padding: 12px 14px; border: 1px solid var(--border); border-radius: var(--radius-sm); background: var(--surface-2);
     font-family: var(--mono); font-size: 11px; line-height: 1.5; color: var(--fg-dim); white-space: pre-wrap; word-break: break-word; max-height: 480px; overflow-y: auto; }
 
-  /* perspectives — coverage strip, filter toolbar, and the one-table-per-project
+  /* perspectives — summary row, filter toolbar, and the one-table-per-project
      view (feature section rows + expandable case detail rows). Reuses the
-     existing badge/chip primitives above; --pass/--amber cover the "runnable"
-     vs "not recorded" coloring so no new tokens are needed. */
-  .ov { display: flex; align-items: center; gap: 28px; padding: 14px 18px; border: 1px solid var(--border); border-radius: var(--radius); background: var(--surface); margin-bottom: 16px; flex-wrap: wrap; }
-  .ov .num { display: flex; flex-direction: column; }
-  .ov .num b { font-size: 24px; line-height: 1.15; font-weight: 650; font-variant-numeric: tabular-nums; }
-  .ov .num span { font-size: 12px; color: var(--muted); }
-  .ov .sep { width: 1px; align-self: stretch; background: var(--border); }
-  .ov .breakdown { display: flex; gap: 20px; }
-  .covwrap { flex: 1; min-width: 220px; display: flex; flex-direction: column; gap: 6px; }
-  .covbar { height: 8px; border-radius: 999px; overflow: hidden; display: flex; background: var(--surface-3); }
-  .covbar .ok { background: var(--pass); }
-  .covbar .no { background: var(--amber); opacity: 0.75; }
-  .covleg { display: flex; gap: 16px; font-size: 12px; color: var(--muted); }
-  .covleg i { display: inline-block; width: 8px; height: 8px; border-radius: 2px; margin-right: 5px; }
-  .covleg .lg-ok i { background: var(--pass); }
-  .covleg .lg-no i { background: var(--amber); opacity: 0.75; }
+     existing badge/chip primitives above, so no new tokens are needed.
+
+     The summary row answers the question this tab exists for — which cases
+     need re-running — as one inventory line plus one bar segmented by re-run
+     state. The mode and recorded-ness counts moved onto the filter chips,
+     which is where a count says something actionable. */
+  .ov { display: flex; flex-direction: column; gap: 10px; padding: 14px 18px; border: 1px solid var(--border); border-radius: var(--radius); background: var(--surface); margin-bottom: 16px; }
+  .ov-inv { font-size: 13px; color: var(--muted); }
+  .ov-inv b { color: var(--fg); font-size: 15px; font-weight: 650; font-variant-numeric: tabular-nums; }
+  .rrbar { height: 8px; border-radius: 999px; overflow: hidden; display: flex; background: var(--surface-3); }
+  .rrleg { display: flex; flex-wrap: wrap; gap: 4px 18px; font-size: 12px; color: var(--muted); }
+  .rrleg span { display: inline-flex; align-items: center; gap: 6px; }
+  .rrleg i { width: 8px; height: 8px; border-radius: 50%; flex: none; }
+  .rrleg b { color: var(--fg); font-weight: 600; font-variant-numeric: tabular-nums; }
+  /* One class per re-run state, worn by both the bar segment and its legend
+     dot. "unknown" takes the info hue: it must never be mistaken for a pass,
+     and the two neutral states are two different greys so adjacent segments
+     stay separable. */
+  .sg-needed { background: var(--amber-fill); }
+  .sg-unknown { background: var(--info); }
+  .sg-notneeded { background: var(--pass); }
+  .sg-neverrun { background: var(--muted-2); }
+  .sg-noteval { background: var(--muted); }
 
   .search { flex: 1; min-width: 200px; max-width: 340px; display: flex; align-items: center; gap: 7px; border: 1px solid var(--border-strong); border-radius: var(--radius-sm); padding: 0 10px; height: 32px; background: var(--surface); }
   .search svg { width: 15px; height: 15px; flex: none; color: var(--muted-2); }
   .search input { border: none; outline: none; font: inherit; font-size: 13px; width: 100%; background: transparent; color: var(--fg); }
   .fchip { border: 1px solid var(--border-strong); background: var(--surface); border-radius: 999px; padding: 5px 12px; font-size: 12.5px; color: var(--muted); }
   .fchip[aria-pressed="true"] { background: var(--accent); color: var(--accent-fg); border-color: var(--accent); }
+  .fchip .fcount { margin-left: 6px; font-variant-numeric: tabular-nums; color: var(--muted-2); }
+  .fchip[aria-pressed="true"] .fcount { color: var(--accent-fg); opacity: 0.7; }
 
   .chip.live { background: var(--info-bg); color: var(--info); border-color: var(--info-border); }
   .badge.ok { background: var(--pass-bg); color: var(--pass); border-color: var(--pass-border); }
@@ -16582,27 +17660,73 @@ const CSS = `
   .badge.norec { background: var(--amber-bg); color: var(--amber); border-color: var(--amber-border); }
   .badge.norec .d { background: var(--amber); }
 
+  /* "Needs re-run" (ADR-0010). Four distinct looks on purpose: rr-unknown must
+     never be mistaken for rr-notneeded, so it takes the info hue rather than a
+     dimmed green, and every badge is paired with a .cellsub saying what the
+     verdict rests on. */
+  .badge.rr-needed { background: var(--amber-bg); color: var(--amber); border-color: var(--amber-border); }
+  .badge.rr-needed .d { background: var(--amber); }
+  .badge.rr-notneeded { background: var(--pass-bg); color: var(--pass); border-color: var(--pass-border); }
+  .badge.rr-notneeded .d { background: var(--pass); }
+  .badge.rr-unknown { background: var(--info-bg); color: var(--info); border-color: var(--info-border); }
+  .badge.rr-unknown .d { background: var(--info); }
+  .badge.rr-none { background: var(--surface-3); color: var(--muted); border-color: var(--border); }
+  .badge.rr-none .d { background: var(--muted); }
+  .cellsub { display: block; margin-top: 3px; max-width: 260px; color: var(--muted); font-size: 11.5px; line-height: 1.45; }
+  .cellsub a { color: var(--muted); text-decoration: none; border-bottom: 1px dotted var(--border-strong); }
+  .cellsub a:hover { color: var(--fg); }
+  .persp-note { margin-bottom: 12px; }
+  .persp-head { font-size: 12px; white-space: nowrap; }
+  /* The Perspectives toolbar carries search + five chips + the profile
+     selector, so it wraps instead of overflowing on a narrow window. */
+  #view-perspectives .toolbar { flex-wrap: wrap; }
+  .proj-menu.right { left: auto; right: 0; }
+  .d-note { margin-top: 12px; max-width: 900px; }
+
   .tblcard { background: var(--surface); border: 1px solid var(--border); border-radius: var(--radius); overflow: hidden; }
+  /* Badges across a case row must land on one line. Some of these cells carry
+     only a badge, others a badge plus a sub-line (sha · when) or a two-line
+     explanation, so middle-aligning the cells put each badge at a different
+     height. Top-aligning them fixes where the first line starts; a 24px first
+     line in the cell and a 24px badge box, both centred, fix where the text
+     inside it sits — so a badge's Y offset no longer depends on what follows
+     it. Sub-lines re-declare their own tighter leading. */
+  #persp-tbody td { vertical-align: top; }
+  #persp-tbody tr.row > td { line-height: 24px; }
+  #persp-tbody tr.row > td .chip, #persp-tbody tr.row > td .badge { vertical-align: top; min-height: 24px; line-height: 18px; }
   /* Feature section rows must read as headings, not as just another data row —
      larger, darker, extra padding, and a strong top rule marking the break. */
   tr.grp td { background: var(--surface-2); border-top: 2px solid var(--border-strong); border-bottom: 1px solid var(--border); padding: 12px 12px 10px; font-family: var(--mono); font-size: 15px; font-weight: 700; color: var(--fg); }
   tr.grp td .gcount { color: var(--muted); font-weight: 500; font-size: 12px; font-family: var(--font); margin-left: 10px; }
   td.c-title { font-weight: 500; max-width: 460px; }
-  td.c-title .csum { display: block; font-weight: 400; color: var(--muted); font-size: 12.5px; margin-top: 1px; }
+  td.c-title .csum { display: block; font-weight: 400; color: var(--muted); font-size: 12.5px; line-height: 1.45; margin-top: 1px; }
   td.c-chev { width: 28px; color: var(--muted-2); text-align: right; }
   .chev-i { display: inline-block; transition: transform 0.15s; font-size: 11px; }
   tr.row[aria-expanded="true"] .chev-i { transform: rotate(90deg); }
   tr.detail { display: none; }
   tr.detail.open { display: table-row; }
-  tr.detail > td { background: var(--surface-2); padding: 14px 16px 16px; }
-
-  .d-grid { display: grid; grid-template-columns: 120px 1fr; gap: 7px 14px; font-size: 13px; max-width: 860px; }
+  /* The panel is the row continuing, not a card under it: same surface, and no
+     rule between a case and its own panel. The rule below the panel stays —
+     that one separates this case from the next. The hover tint is dropped
+     while open for the same reason; tinting only the top half would split the
+     two apart again. */
+  tr.detail > td { background: var(--surface); padding: 2px 16px 18px; }
+  #persp-tbody tr.row[aria-expanded="true"] > td { border-bottom: 0; }
+  #persp-tbody tr.row[aria-expanded="true"]:hover { background: var(--surface); }
+
+  .d-grid { display: grid; grid-template-columns: 156px 1fr; gap: 9px 14px; font-size: 13px; max-width: 900px; }
   .d-grid dt { color: var(--muted); font-size: 12px; padding-top: 1px; }
   .d-grid dd { color: var(--fg-dim); }
   .d-grid dd ul { list-style: none; display: flex; flex-direction: column; gap: 3px; margin: 0; padding: 0; }
   .d-grid dd li::before { content: "\\2022 "; color: var(--muted-2); }
-  .d-grid code { font-size: 12px; background: var(--surface); border: 1px solid var(--border); border-radius: 4px; padding: 1px 5px; }
-  .notebox { margin-top: 12px; max-width: 860px; }
+  .d-grid code { font-size: 12px; background: var(--surface-2); border: 1px solid var(--border); border-radius: 4px; padding: 1px 5px; }
+  /* Prose gets a measure so it stops wrapping mid-phrase in a narrow column;
+     paths wrap as whole chips, never inside a path. */
+  .d-prose { max-width: 62ch; line-height: 1.5; }
+  .d-paths { display: flex; flex-wrap: wrap; gap: 6px; }
+  .d-paths code { white-space: nowrap; }
+  .d-prose + .d-paths { margin-top: 6px; }
+  .notebox { margin-top: 14px; max-width: 900px; }
   .notebox .nlabel { font-size: 12px; color: var(--muted); margin-bottom: 4px; }
   .notebox textarea { width: 100%; min-height: 54px; resize: vertical; font: inherit; font-size: 13px; color: var(--fg-dim); background: var(--surface); border: 1px solid var(--border-strong); border-radius: var(--radius-sm); padding: 8px 10px; }
   .notebox .nact { margin-top: 6px; display: flex; align-items: center; gap: 8px; }
@@ -16684,6 +17808,8 @@ const CLIENT_JS = `
       "perspectives.search": "Search cases…",
       "perspectives.filter.all": "All", "perspectives.filter.deterministic": "Deterministic",
       "perspectives.filter.live": "Live", "perspectives.filter.norec": "Not recorded only",
+      "perspectives.filter.rerun": "Needs re-run only",
+      "perspectives.col.lastResult": "Last result", "perspectives.col.rerun": "Needs re-run",
       "perspectives.col.case": "Case", "perspectives.col.mode": "Mode", "perspectives.col.status": "Status",
       "perspectives.noHit": "No matching cases.",
       "perspectives.updated": "Last updated:",
@@ -16691,9 +17817,7 @@ const CLIENT_JS = `
       "perspectives.loadFailed": "Loading perspectives failed",
       "perspectives.mode.deterministic": "deterministic", "perspectives.mode.live": "live",
       "perspectives.status.runnable": "runnable", "perspectives.status.notRecorded": "not recorded",
-      "perspectives.metric.features": "Features", "perspectives.metric.cases": "Test cases",
-      "perspectives.metric.deterministic": "Deterministic", "perspectives.metric.live": "Live",
-      "perspectives.cov.runnable": "runnable", "perspectives.cov.notRecorded": "not recorded",
+      "perspectives.ov.cases": "cases", "perspectives.ov.features": "features",
       "perspectives.d.preconditions": "Preconditions", "perspectives.d.startScreen": "Start screen",
       "perspectives.d.testCondition": "Condition", "perspectives.d.spec": "spec",
       "perspectives.d.relatedPaths": "Related code",
@@ -16701,6 +17825,47 @@ const CLIENT_JS = `
       "perspectives.note.placeholder": "Notes about this case…",
       "perspectives.note.saved": "Saved",
       "perspectives.note.error": "Could not save — retry",
+      "perspectives.d.lastRed": "Most recent failure",
+      "perspectives.d.changedSince": "Changes since the last run",
+      "perspectives.d.cannotJudge": "Why this cannot be judged",
+      "perspectives.result.never": "never run",
+      "perspectives.result.openRun": "Open this run in the hub",
+      "perspectives.result.ci": "CI",
+      "perspectives.rerun.state.needed": "Re-run needed",
+      "perspectives.rerun.state.notNeeded": "Not needed",
+      "perspectives.rerun.state.unknown": "Unknown",
+      "perspectives.rerun.state.neverRun": "Never run",
+      "perspectives.rerun.state.notEvaluated": "Not evaluated",
+      "perspectives.rerun.vsDeploy": "judged against deploy",
+      "perspectives.rerun.noDeployHead": "no deploy recorded for this profile",
+      "perspectives.rerun.changedByDeploy": "deploy {sha} changed its related code",
+      "perspectives.rerun.changesSome": "yes (as of deploy {sha})",
+      "perspectives.rerun.changesNone": "none (as of deploy {sha})",
+      "perspectives.rerun.touchedCount": "{n} deployed path(s) matched its related code",
+      "perspectives.rerun.touchedUnknown": "a deploy since the last run touched its related code",
+      "perspectives.rerun.neverRunHint": "no result recorded for this profile yet",
+      "perspectives.rerun.notEvaluatedHint": "no run and no deploy has ever been recorded for this profile",
+      "perspectives.rerun.why.noRelatedPaths": "no related code declared",
+      "perspectives.rerun.why.noDeployLog": "no deploy log for this profile",
+      "perspectives.rerun.why.unknownDeployedSha": "the last run's deployed commit is unknown",
+      "perspectives.rerun.why.ambiguousDeployedSha": "a deploy landed while the last run was executing",
+      "perspectives.rerun.why.deployedShaNotInLog": "the last run's commit predates the retained deploy log",
+      "perspectives.rerun.why.gapInRange": "deploys are missing from the range",
+      "perspectives.rerun.why.truncatedInRange": "a deploy in range did not report what it changed",
+      "perspectives.rerun.why.unrecognized": "this hub reported a reason this UI does not recognise",
+      "perspectives.rerun.fix.noRelatedPaths": "This case declares no related code, so no deploy can be matched against it. Add relatedPaths to its spec.yaml.",
+      "perspectives.rerun.fix.noDeployLog": "Nothing has been recorded in this profile's deploy log. Wire ccqa hub deploy record into the deploy job for this environment so ccqa knows what shipped.",
+      "perspectives.rerun.fix.unknownDeployedSha": "The last run did not record which commit the environment was running, so it cannot be positioned in the deploy log. Runs record it once this profile has a deploy log.",
+      "perspectives.rerun.fix.ambiguousDeployedSha": "A deploy landed while the last run was executing, so which commit it exercised is not knowable. Re-run this case to get a clean baseline.",
+      "perspectives.rerun.fix.deployedShaNotInLog": "The last run's deployed commit is older than the retained deploy log, so its position is lost. Re-run this case to re-anchor it.",
+      "perspectives.rerun.fix.gapInRange": "A deploy in range did not chain onto its predecessor, so deploys are missing from the range. Have the deploy job report the commit it replaced.",
+      "perspectives.rerun.fix.truncatedInRange": "A deploy in range did not report what it changed, so its contents are not knowable. Have the deploy job send the changed paths of a two-dot diff.",
+      "perspectives.rerun.fix.unrecognized": "This hub reported a reason this UI does not recognise. Upgrade the UI to see what it means.",
+      "perspectives.rerun.unsupported": "This hub does not report which cases need a re-run. Upgrade the hub to enable it.",
+      "perspectives.rerun.loadFailed": "Loading re-run data failed",
+      "perspectives.rerun.noDeployLogBanner": "No deploy has been recorded for profile {profile}, so no case can be judged. Wire ccqa hub deploy record into the deploy job for this environment.",
+      "perspectives.rerun.deployHead": "deploy head",
+      "perspectives.dq.unmatched": "{n} of this case's related-code patterns matched no file when perspectives were generated — a not-needed verdict may rest on paths that no longer exist.",
       "prompt.card.record": "Recording browser actions",
       "prompt.card.live": "Live run (AI-driven)",
       "prompt.card.playwright": "Playwright test generation",
@@ -16782,6 +17947,8 @@ const CLIENT_JS = `
       "perspectives.search": "ケースを検索…",
       "perspectives.filter.all": "すべて", "perspectives.filter.deterministic": "決定的",
       "perspectives.filter.live": "ライブ", "perspectives.filter.norec": "未recordのみ",
+      "perspectives.filter.rerun": "要再実行のみ",
+      "perspectives.col.lastResult": "前回結果", "perspectives.col.rerun": "再実行の要否",
       "perspectives.col.case": "ケース", "perspectives.col.mode": "モード", "perspectives.col.status": "状態",
       "perspectives.noHit": "該当するケースがありません。",
       "perspectives.updated": "最終更新:",
@@ -16789,9 +17956,7 @@ const CLIENT_JS = `
       "perspectives.loadFailed": "テスト観点の読み込みに失敗しました",
       "perspectives.mode.deterministic": "決定的", "perspectives.mode.live": "ライブ",
       "perspectives.status.runnable": "実行可能", "perspectives.status.notRecorded": "未record",
-      "perspectives.metric.features": "機能", "perspectives.metric.cases": "テストケース",
-      "perspectives.metric.deterministic": "決定的", "perspectives.metric.live": "ライブ",
-      "perspectives.cov.runnable": "実行可能", "perspectives.cov.notRecorded": "未record",
+      "perspectives.ov.cases": "ケース", "perspectives.ov.features": "機能",
       "perspectives.d.preconditions": "前提条件", "perspectives.d.startScreen": "開始画面",
       "perspectives.d.testCondition": "実行条件", "perspectives.d.spec": "spec",
       "perspectives.d.relatedPaths": "関連コード",
@@ -16799,6 +17964,47 @@ const CLIENT_JS = `
       "perspectives.note.placeholder": "このケースについてのメモ…",
       "perspectives.note.saved": "保存しました",
       "perspectives.note.error": "保存に失敗しました — 再試行してください",
+      "perspectives.d.lastRed": "直近の失敗",
+      "perspectives.d.changedSince": "前回実行以降の変更",
+      "perspectives.d.cannotJudge": "判定できない理由",
+      "perspectives.result.never": "未実行",
+      "perspectives.result.openRun": "ハブでこの実行を開く",
+      "perspectives.result.ci": "CI",
+      "perspectives.rerun.state.needed": "要再実行",
+      "perspectives.rerun.state.notNeeded": "不要",
+      "perspectives.rerun.state.unknown": "不明",
+      "perspectives.rerun.state.neverRun": "未実行",
+      "perspectives.rerun.state.notEvaluated": "未評価",
+      "perspectives.rerun.vsDeploy": "判定基準: デプロイ",
+      "perspectives.rerun.noDeployHead": "このプロファイルにはデプロイの記録がありません",
+      "perspectives.rerun.changedByDeploy": "デプロイ {sha} が関連コードを変更",
+      "perspectives.rerun.changesSome": "あり（デプロイ {sha} 時点）",
+      "perspectives.rerun.changesNone": "なし（デプロイ {sha} 時点）",
+      "perspectives.rerun.touchedCount": "関連コードに一致したデプロイ差分 {n} 件",
+      "perspectives.rerun.touchedUnknown": "前回実行以降のデプロイが関連コードを変更しています",
+      "perspectives.rerun.neverRunHint": "このプロファイルでの実行記録がまだありません",
+      "perspectives.rerun.notEvaluatedHint": "このプロファイルには実行もデプロイも記録がありません",
+      "perspectives.rerun.why.noRelatedPaths": "関連コードが未宣言です",
+      "perspectives.rerun.why.noDeployLog": "このプロファイルのデプロイ記録がありません",
+      "perspectives.rerun.why.unknownDeployedSha": "前回実行時にデプロイされていたcommitが不明です",
+      "perspectives.rerun.why.ambiguousDeployedSha": "前回実行の途中でデプロイが発生しました",
+      "perspectives.rerun.why.deployedShaNotInLog": "前回実行のcommitが保持中のデプロイログより古いです",
+      "perspectives.rerun.why.gapInRange": "対象範囲のデプロイ記録が欠けています",
+      "perspectives.rerun.why.truncatedInRange": "対象範囲に変更内容を報告していないデプロイがあります",
+      "perspectives.rerun.why.unrecognized": "このUIが認識できない理由がハブから返されました",
+      "perspectives.rerun.fix.noRelatedPaths": "このケースは関連コードを宣言していないため、デプロイと突き合わせられません。spec.yaml に relatedPaths を追加してください。",
+      "perspectives.rerun.fix.noDeployLog": "このプロファイルのデプロイログに記録がありません。何がデプロイされたかをccqaに伝えるため、この環境のデプロイジョブに ccqa hub deploy record を組み込んでください。",
+      "perspectives.rerun.fix.unknownDeployedSha": "前回実行は環境で動いていたcommitを記録していないため、デプロイログ上の位置を決められません。このプロファイルにデプロイログができれば、以降の実行では記録されます。",
+      "perspectives.rerun.fix.ambiguousDeployedSha": "前回実行の途中でデプロイが発生したため、どのcommitを検証したのか確定できません。基準を取り直すには再実行してください。",
+      "perspectives.rerun.fix.deployedShaNotInLog": "前回実行のデプロイcommitが保持中のデプロイログより古く、位置を特定できません。再実行して基準を取り直してください。",
+      "perspectives.rerun.fix.gapInRange": "対象範囲のデプロイが直前のデプロイと連結しておらず、記録が欠けています。デプロイジョブから置き換え前のcommitも送ってください。",
+      "perspectives.rerun.fix.truncatedInRange": "対象範囲に変更内容を報告していないデプロイがあり、何が変わったのか確定できません。デプロイジョブから two-dot diff の変更パスを送ってください。",
+      "perspectives.rerun.fix.unrecognized": "このUIが認識できない理由がハブから返されました。内容を表示するにはUIを更新してください。",
+      "perspectives.rerun.unsupported": "このハブは再実行の要否を返しません。利用するにはハブを更新してください。",
+      "perspectives.rerun.loadFailed": "再実行の要否の読み込みに失敗しました",
+      "perspectives.rerun.noDeployLogBanner": "プロファイル {profile} にデプロイの記録がないため、どのケースも判定できません。この環境のデプロイジョブに ccqa hub deploy record を組み込んでください。",
+      "perspectives.rerun.deployHead": "最新デプロイ",
+      "perspectives.dq.unmatched": "このケースの関連コードのうち {n} 件のパターンが、テスト観点の生成時にどのファイルにも一致しませんでした。不要という判定が、すでに存在しないパスに基づいている可能性があります。",
       "prompt.card.record": "ブラウザ操作の記録",
       "prompt.card.live": "ライブ実行（AI操作）",
       "prompt.card.playwright": "Playwrightテスト生成",
@@ -17015,6 +18221,10 @@ const CLIENT_JS = `
     return days + "d ago";
   }
 
+  function shortSha(sha) {
+    return sha ? String(sha).slice(0, 7) : "";
+  }
+
   function statusBadge(status) {
     var span = el("span", "badge " + status);
     span.appendChild(el("span", "d"));
@@ -17071,6 +18281,41 @@ const CLIENT_JS = `
     return svg;
   }
 
+  // Round caps so the "i"/"!" dot (a zero-length segment) actually paints as a
+  // filled dot instead of vanishing under a butt cap at small sizes.
+  function svgRounded() {
+    var svg = svgIcon();
+    svg.setAttribute("stroke-linecap", "round");
+    svg.setAttribute("stroke-linejoin", "round");
+    return svg;
+  }
+
+  // The two note glyphs, matching the inline SVGs the static .note markup uses.
+  function svgInfo() {
+    var svg = svgRounded();
+    var c = document.createElementNS(SVG_NS, "circle");
+    c.setAttribute("cx", "12"); c.setAttribute("cy", "12"); c.setAttribute("r", "10");
+    svg.appendChild(c);
+    svg.appendChild(svgPath("M12 16v-4M12 8h.01"));
+    return svg;
+  }
+  function svgWarn() {
+    var svg = svgRounded();
+    svg.appendChild(svgPath("M12 9v4M12 17h.01"));
+    svg.appendChild(svgPath("M10.3 3.9 1.8 18a2 2 0 0 0 1.7 3h17a2 2 0 0 0 1.7-3L13.7 3.9a2 2 0 0 0-3.4 0z"));
+    return svg;
+  }
+
+  // Fill an element as a .note box (the static ones live in HTML_BODY). kind is
+  // "info" or "warn"; the text is always textContent, never innerHTML.
+  function fillNote(box, kind, text, extraClass) {
+    clear(box);
+    box.className = "note " + kind + (extraClass ? " " + extraClass : "");
+    box.appendChild(kind === "warn" ? svgWarn() : svgInfo());
+    box.appendChild(el("span", null, text));
+    return box;
+  }
+
   // ── view routing ────────────────────────────────────────────────────
 
   var VIEWS = ["projects", "runs", "detail", "perspectives", "secrets", "prompts", "jobs"];
@@ -18384,16 +19629,7 @@ const CLIENT_JS = `
     var span = el("span", "info");
     span.tabIndex = 0;
     span.setAttribute("role", "note");
-    var svg = svgIcon();
-    // Round caps so the "i" dot (a zero-length segment) actually paints as a
-    // filled dot instead of vanishing under a butt cap at small sizes.
-    svg.setAttribute("stroke-linecap", "round");
-    svg.setAttribute("stroke-linejoin", "round");
-    var c = document.createElementNS(SVG_NS, "circle");
-    c.setAttribute("cx", "12"); c.setAttribute("cy", "12"); c.setAttribute("r", "10");
-    svg.appendChild(c);
-    svg.appendChild(svgPath("M12 16v-4M12 8h.01"));
-    span.appendChild(svg);
+    span.appendChild(svgInfo());
     span.appendChild(el("span", "tip", hintText));
     return span;
   }
@@ -18467,7 +19703,16 @@ const CLIENT_JS = `
   // whole document is fetched once per view-open and filtered/rendered
   // client-side — small enough that there is no pagination.
 
-  var perspState = { doc: null, q: "", f: "all" };
+  // "rerun" is the RerunReport for the currently selected profile, or null when
+  // this hub can't answer (older hub, or the fetch failed) — in which case the
+  // two re-run columns are dropped rather than filled with blanks.
+  // "rerunSupported" is tri-state: null until the first answer, then whether
+  // this hub answers at all. Chip visibility follows it rather than the report,
+  // so switching profile doesn't drop the filter while the next one loads.
+  var perspState = {
+    doc: null, q: "", f: "all",
+    rerun: null, rerunSupported: null, runUrls: {}, rerunProfiles: []
+  };
 
   function perspectivesPath() {
     return "/api/v1/projects/" + encodeURIComponent(state.project) + "/perspectives";
@@ -18484,6 +19729,272 @@ const CLIENT_JS = `
     }, function () { throw new Error("Network unreachable — check the hub URL and your connection"); });
   }
 
+  // ── perspectives: needs re-run (ADR-0010) ─────────────────────────────
+  // "Is this case's last result still trustworthy?" — mechanical, no model
+  // call, and a different question from drift ("does the case still describe
+  // the product"). The two vocabularies stay apart on purpose: this column
+  // never says stale or fresh, and never borrows drift's wording.
+  //
+  // The verdict is per (project, profile): two environments sit at different
+  // commits, so it has no profile-free answer — hence the profile selector in
+  // this tab's toolbar.
+
+  function rerunPath() {
+    return "/api/v1/projects/" + encodeURIComponent(state.project) +
+      "/rerun?profile=" + encodeURIComponent(state.profile);
+  }
+
+  // Resolves { report } or { note } and never rejects: a hub that predates
+  // this endpoint costs the two extra columns, not the whole tab. A 404 here
+  // can only mean "no such route" — the endpoint's own 404 is "the project has
+  // no perspectives document", and this runs only after that document loaded.
+  function fetchRerun() {
+    return fetch(rerunPath(), { headers: { Authorization: "Bearer " + state.token } }).then(function (res) {
+      if (res.status === 404) return { note: t("perspectives.rerun.unsupported"), kind: "info" };
+      if (!res.ok) return { note: t("perspectives.rerun.loadFailed") + ": " + res.status + " " + res.statusText, kind: "warn" };
+      return res.json().then(function (report) { return { report: report }; }, function () {
+        return { note: t("perspectives.rerun.loadFailed"), kind: "warn" };
+      });
+    }, function () {
+      return { note: t("perspectives.rerun.loadFailed"), kind: "warn" };
+    });
+  }
+
+  // The ledger records a runId but no link, and the profile list the Secrets
+  // tab keeps is the wrong set here (a profile that only has variables has no
+  // runs and no deploys to judge). One runs page answers both: runId -> CI URL,
+  // and the profiles a run was actually recorded under. A run pushed without a
+  // profile lands in "default", exactly as the ledger stores it.
+  function fetchRunIndex() {
+    return apiFetch("/api/v1/runs?project=" + encodeURIComponent(state.project) + "&limit=200")
+      .then(function (data) {
+        var urls = {};
+        var profiles = [];
+        ((data && data.runs) || []).forEach(function (r) {
+          if (r.runUrl) urls[r.id] = r.runUrl;
+          var p = r.profile || "default";
+          if (profiles.indexOf(p) === -1) profiles.push(p);
+        });
+        return { urls: urls, profiles: profiles.sort() };
+      })
+      .catch(function () { return { urls: {}, profiles: [] }; });
+  }
+
+  // Profiles worth offering in this tab's selector: only those a run has been
+  // recorded under. The current one is always included so the menu can show
+  // what is selected even before any run exists.
+  function perspProfileNames() {
+    var names = perspState.rerunProfiles.slice();
+    if (names.indexOf(state.profile) === -1) names.push(state.profile);
+    return names.sort();
+  }
+
+  function perspSpecKey(feature, spec) {
+    return feature.featureName + "/" + spec.specName;
+  }
+
+  function rerunFor(feature, spec) {
+    var report = perspState.rerun;
+    return report && report.specs ? (report.specs[perspSpecKey(feature, spec)] || null) : null;
+  }
+
+  // A reason a newer hub added but this UI has no wording for must still say
+  // something honest instead of printing a raw i18n key (t() returns the key
+  // when it has no entry).
+  function rerunReasonText(prefix, reason) {
+    var text = t(prefix + reason);
+    return text === prefix + reason ? t(prefix + "unrecognized") : text;
+  }
+
+  // Why the question cannot be answered, in the actionable phrasing the detail
+  // panel wants: name the missing input and how to supply it. Only "unknown"
+  // carries a machine-readable reason (ADR-0010); the other two are states of
+  // the ledger, not gaps in the inputs.
+  function rerunCannotJudge(rr) {
+    if (rr.state === "unknown") return rerunReasonText("perspectives.rerun.fix.", rr.reason || "");
+    if (rr.state === "neverRun") return t("perspectives.rerun.neverRunHint");
+    if (rr.state === "notEvaluated") return t("perspectives.rerun.notEvaluatedHint");
+    // A state a newer hub invented: say the UI cannot read it rather than leave
+    // the row blank, which would look like missing data.
+    return rerunReasonText("perspectives.rerun.fix.", rr.state);
+  }
+
+  // The short justification a table cell carries under its badge. Nothing here
+  // may collapse to a bare "up to date" — notNeeded names the deploy it was
+  // judged against, and unknown names the missing input.
+  function rerunCellWhy(rr) {
+    var head = perspState.rerun && perspState.rerun.deployHead;
+    if (rr.state === "needed") {
+      if (!rr.touchedBy || !rr.touchedBy.length) return t("perspectives.rerun.touchedUnknown");
+      return t("perspectives.rerun.touchedCount").replace("{n}", String(rr.touchedBy.length));
+    }
+    if (rr.state === "notNeeded") {
+      if (!head) return t("perspectives.rerun.noDeployHead");
+      return t("perspectives.rerun.vsDeploy") + " " + shortSha(head.sha) + " · " + relTime(head.at);
+    }
+    if (rr.state === "unknown") return rerunReasonText("perspectives.rerun.why.", rr.reason || "");
+    return rerunCannotJudge(rr);
+  }
+
+  var RERUN_BADGE_CLASS = {
+    needed: "rr-needed", notNeeded: "rr-notneeded", unknown: "rr-unknown",
+    neverRun: "rr-none", notEvaluated: "rr-none"
+  };
+
+  // --- pure: rerun composition ---------------------------------------------
+  // Self-contained on purpose: no DOM, no closures. rerun-view.test.ts lifts
+  // this region out of the rendered page and runs it, because the summary bar
+  // is where an overstatement would do the most damage and the suite has no
+  // browser to click through.
+
+  // Bar segments in drawing order: what to act on first, then what needs no
+  // action, then what was never measured. "unknown" keeps its own place and
+  // its own colour — folding it into "notNeeded" would turn "we cannot say"
+  // into "all clear", which is the one thing ADR-0010 forbids.
+  var RERUN_ORDER = ["needed", "unknown", "notNeeded", "neverRun", "notEvaluated"];
+  var RERUN_SEG_CLASS = {
+    needed: "sg-needed", unknown: "sg-unknown", notNeeded: "sg-notneeded",
+    neverRun: "sg-neverrun", notEvaluated: "sg-noteval"
+  };
+
+  // One verdict per case, bucketed. A case with no verdict at all — this hub
+  // does not answer the question, the fetch failed, or the case was added
+  // after the report was computed — is not evaluated, never "not needed". A
+  // state this UI does not know reads as unknown for the same reason: an
+  // answer we cannot interpret is not evidence that nothing is needed.
+  function rerunComposition(verdicts) {
+    var counts = { needed: 0, unknown: 0, notNeeded: 0, neverRun: 0, notEvaluated: 0 };
+    verdicts.forEach(function (rr) {
+      if (!rr || !rr.state) { counts.notEvaluated += 1; return; }
+      var known = Object.prototype.hasOwnProperty.call(counts, rr.state);
+      counts[known ? rr.state : "unknown"] += 1;
+    });
+    return counts;
+  }
+
+  // Only states with cases in them get drawn, which keeps the legend short and
+  // stops an empty state from reading as a verdict: a "needs re-run 0" printed
+  // for a profile nothing has been evaluated on is exactly that misreading.
+  function rerunSegments(counts) {
+    var out = [];
+    RERUN_ORDER.forEach(function (key) {
+      if (counts[key] > 0) out.push({ state: key, count: counts[key], cls: RERUN_SEG_CLASS[key] });
+    });
+    return out;
+  }
+  // --- end pure: rerun composition -----------------------------------------
+
+  // NB: the parameter is not named "state" — that would shadow the app-wide
+  // state object this scope closes over.
+  function rerunBadge(rerunState) {
+    var span = el("span", "badge " + (RERUN_BADGE_CLASS[rerunState] || "rr-none"));
+    span.appendChild(el("span", "d"));
+    span.appendChild(document.createTextNode(" " + t("perspectives.rerun.state." + rerunState)));
+    return span;
+  }
+
+  // One ledger entry as "<short sha> · <when>", linking to the hub's run detail
+  // and, when that run recorded one, to the CI run. Clicks must not bubble: the
+  // table row itself toggles the detail panel.
+  function ledgerLine(entry) {
+    var wrap = el("span");
+    var link = el("a", null, shortSha(entry.gitHead) || String(entry.runId).slice(0, 8));
+    link.href = "#/runs/" + encodeURIComponent(entry.runId);
+    link.title = t("perspectives.result.openRun");
+    link.addEventListener("click", function (e) { e.stopPropagation(); });
+    wrap.appendChild(link);
+    wrap.appendChild(document.createTextNode(" · " + relTime(entry.at)));
+    var ciUrl = perspState.runUrls[entry.runId];
+    if (ciUrl) {
+      wrap.appendChild(document.createTextNode(" · "));
+      var ci = el("a", null, t("perspectives.result.ci"));
+      ci.href = ciUrl;
+      ci.target = "_blank";
+      ci.rel = "noopener";
+      ci.addEventListener("click", function (e) { e.stopPropagation(); });
+      wrap.appendChild(ci);
+    }
+    return wrap;
+  }
+
+  // The last recorded outcome, as { status, entry }. The ledger advances "run"
+  // on every non-skipped result and "green"/"red" on the matching one, so the
+  // last run is whichever of those two carries the same runId.
+  //
+  // A ledger written before the "run" bucket existed carries greens only, and
+  // migrates that way — so with no "run" entry, fall back to the newer of
+  // green/red. Both are real results; ignoring them would print "never run"
+  // for a case whose last-passed coordinate is right there in the detail row.
+  function lastResult(rr) {
+    if (!rr) return null;
+    if (rr.lastRun) {
+      // "" when neither bucket carries this runId: the run is recorded but its
+      // outcome is not, so the cell shows the coordinate without a verdict.
+      var status = "";
+      if (rr.lastGreen && rr.lastGreen.runId === rr.lastRun.runId) status = "passed";
+      else if (rr.lastRed && rr.lastRed.runId === rr.lastRun.runId) status = "failed";
+      return { status: status, entry: rr.lastRun };
+    }
+    if (rr.lastGreen && rr.lastRed) {
+      return rr.lastGreen.at >= rr.lastRed.at
+        ? { status: "passed", entry: rr.lastGreen }
+        : { status: "failed", entry: rr.lastRed };
+    }
+    if (rr.lastGreen) return { status: "passed", entry: rr.lastGreen };
+    if (rr.lastRed) return { status: "failed", entry: rr.lastRed };
+    return null;
+  }
+
+  function perspResultCell(rr) {
+    var td = el("td");
+    // No verdict at all: this case is in the document but not in the report
+    // (added since it was computed). Not the same statement as "never run".
+    if (!rr) {
+      td.appendChild(el("span", "muted", "—"));
+      return td;
+    }
+    var last = lastResult(rr);
+    if (!last) {
+      td.appendChild(el("span", "muted", t("perspectives.result.never")));
+      return td;
+    }
+    td.appendChild(last.status ? statusBadge(last.status) : el("span", "muted", "—"));
+    var sub = el("span", "cellsub");
+    sub.appendChild(ledgerLine(last.entry));
+    td.appendChild(sub);
+    return td;
+  }
+
+  function perspRerunCell(rr) {
+    var td = el("td");
+    if (!rr) {
+      td.appendChild(el("span", "muted", "—"));
+      return td;
+    }
+    td.appendChild(rerunBadge(rr.state));
+    var why = rerunCellWhy(rr);
+    if (why) td.appendChild(el("span", "cellsub", why));
+    return td;
+  }
+
+  // A list of paths/globs as <code> chips. A flex row, so a list that does not
+  // fit wraps between chips instead of breaking inside a path.
+  function pathCodes(paths) {
+    var wrap = el("span", "d-paths");
+    paths.forEach(function (p) { wrap.appendChild(el("code", null, p)); });
+    return wrap;
+  }
+
+  // How many of this case's related-code patterns matched no file when the
+  // document was written. ADDITIVE field: a document from a CLI older than
+  // ADR-0010 simply has no measurement, which is not the same as a measured
+  // zero — so anything that is not a real count reads as "not measured" and
+  // shows nothing, rather than as a clean bill of health.
+  function unmatchedRelatedPathCount(spec) {
+    var raw = spec.relatedPathsUnmatched;
+    return typeof raw === "number" && isFinite(raw) && raw >= 0 ? raw : null;
+  }
+
   // The execution mode lives inside the mechanically-derived status object
   // (spec.status.mode), not at the top level of a spec entry.
   function perspMode(spec) {
@@ -18514,64 +20025,61 @@ const CLIENT_JS = `
     return span;
   }
 
-  // Overview strip: feature/case counts, deterministic/live breakdown, and a
-  // runnable-vs-not-recorded coverage bar.
+  // Summary row: the inventory as one line, then one bar segmented by re-run
+  // state — the question this tab is opened to answer. The mode and
+  // recorded-ness counts are not lost; they moved onto the filter chips, where
+  // a count states what that filter would leave behind.
+  //
+  // With no re-run data (an older hub, a failed fetch, or a profile nothing
+  // has been recorded on) every case is "not evaluated" and the bar says so in
+  // one neutral segment, rather than showing a composition that reads as
+  // "nothing to do".
   function renderPerspOverview(doc) {
     var host = document.getElementById("persp-ov");
     clear(host);
-    var allSpecs = doc.features.reduce(function (acc, f) { return acc.concat(f.specs); }, []);
-    var total = allSpecs.length;
-    var ok = allSpecs.filter(perspRunnable).length;
-    var no = total - ok;
-    var det = allSpecs.filter(function (s) { return perspMode(s) === "deterministic"; }).length;
-    var live = total - det;
-
-    function numBlock(value, labelKey) {
-      var box = el("div", "num");
-      box.appendChild(el("b", null, String(value)));
-      box.appendChild(el("span", null, t(labelKey)));
-      return box;
-    }
+    var verdicts = [];
+    doc.features.forEach(function (feature) {
+      feature.specs.forEach(function (spec) { verdicts.push(rerunFor(feature, spec)); });
+    });
 
-    host.appendChild(numBlock(doc.features.length, "perspectives.metric.features"));
-    host.appendChild(el("div", "sep"));
-    host.appendChild(numBlock(total, "perspectives.metric.cases"));
-    host.appendChild(el("div", "sep"));
-    var breakdown = el("div", "breakdown");
-    breakdown.appendChild(numBlock(det, "perspectives.metric.deterministic"));
-    breakdown.appendChild(numBlock(live, "perspectives.metric.live"));
-    host.appendChild(breakdown);
-
-    var covwrap = el("div", "covwrap");
-    var covbar = el("div", "covbar");
-    if (total > 0) {
-      var okBar = el("div", "ok");
-      okBar.style.width = (ok / total) * 100 + "%";
-      var noBar = el("div", "no");
-      noBar.style.width = (no / total) * 100 + "%";
-      covbar.appendChild(okBar);
-      covbar.appendChild(noBar);
-    }
-    covwrap.appendChild(covbar);
-    var covleg = el("div", "covleg");
-    var legOk = el("span", "lg-ok");
-    legOk.appendChild(el("i"));
-    legOk.appendChild(document.createTextNode(t("perspectives.cov.runnable") + " " + ok));
-    covleg.appendChild(legOk);
-    if (no > 0) {
-      var legNo = el("span", "lg-no");
-      legNo.appendChild(el("i"));
-      legNo.appendChild(document.createTextNode(t("perspectives.cov.notRecorded") + " " + no));
-      covleg.appendChild(legNo);
-    }
-    covwrap.appendChild(covleg);
-    host.appendChild(covwrap);
+    var inv = el("div", "ov-inv");
+    inv.appendChild(el("b", null, String(verdicts.length)));
+    inv.appendChild(document.createTextNode(" " + t("perspectives.ov.cases") + " / "));
+    inv.appendChild(el("b", null, String(doc.features.length)));
+    inv.appendChild(document.createTextNode(" " + t("perspectives.ov.features")));
+    host.appendChild(inv);
+    if (!verdicts.length) return;
+
+    var bar = el("div", "rrbar");
+    var leg = el("div", "rrleg");
+    rerunSegments(rerunComposition(verdicts)).forEach(function (seg) {
+      var fill = el("div", seg.cls);
+      fill.style.width = (seg.count / verdicts.length) * 100 + "%";
+      bar.appendChild(fill);
+      var item = el("span");
+      item.appendChild(el("i", seg.cls));
+      item.appendChild(document.createTextNode(t("perspectives.rerun.state." + seg.state)));
+      item.appendChild(el("b", null, String(seg.count)));
+      leg.appendChild(item);
+    });
+    host.appendChild(bar);
+    host.appendChild(leg);
   }
 
-  function perspMatches(spec) {
-    if (perspState.f === "deterministic" && perspMode(spec) !== "deterministic") return false;
-    if (perspState.f === "live" && perspMode(spec) !== "live") return false;
-    if (perspState.f === "norec" && perspRunnable(spec)) return false;
+  // The filter is passed in rather than read from perspState so the same
+  // predicate can answer "what would this chip yield?" for every chip. The
+  // search text always applies: a chip's count has to be the number of rows
+  // clicking it actually leaves.
+  function perspMatches(feature, spec, f) {
+    if (f === "deterministic" && perspMode(spec) !== "deterministic") return false;
+    if (f === "live" && perspMode(spec) !== "live") return false;
+    if (f === "norec" && perspRunnable(spec)) return false;
+    if (f === "rerun") {
+      var rr = rerunFor(feature, spec);
+      // Only "needed": "unknown" is not a weaker "probably needed", and
+      // folding it in here would be exactly the overstatement ADR-0010 forbids.
+      if (!rr || rr.state !== "needed") return false;
+    }
     if (perspState.q) {
       var hay = (spec.title + " " + (spec.summary || "") + " " + spec.specName).toLowerCase();
       if (hay.indexOf(perspState.q) === -1) return false;
@@ -18579,16 +20087,99 @@ const CLIENT_JS = `
     return true;
   }
 
+  function perspFilterCount(f) {
+    var doc = perspState.doc;
+    if (!doc) return 0;
+    var n = 0;
+    doc.features.forEach(function (feature) {
+      feature.specs.forEach(function (spec) { if (perspMatches(feature, spec, f)) n += 1; });
+    });
+    return n;
+  }
+
+  // --- pure: rerun detail labels -------------------------------------------
+  // Self-contained on purpose (no DOM, no closures) so rerun-view.test.ts can
+  // lift this region out of the rendered page and run it: which label the
+  // panel's evidence row wears, and whether it has a failure row at all.
+
+  // needed/notNeeded put evidence in that row, so it is labelled by the
+  // timeframe the evidence covers. The other three have no evidence to show,
+  // only a missing input to name — a different kind of content, and forcing one
+  // label over both would make one of the two read as a lie.
+  function rerunEvidenceLabelKey(rerunState) {
+    return rerunState === "needed" || rerunState === "notNeeded"
+      ? "perspectives.d.changedSince"
+      : "perspectives.d.cannotJudge";
+  }
+
+  // The failure row points at a run. With no failure there is nothing to point
+  // at, so the row is omitted rather than filled with "never failed" — the row
+  // above already carries the last result.
+  function rerunHasFailure(rr) {
+    return !!(rr && rr.lastRed);
+  }
+
+  // Which deploy the evidence line names, and how. A "needed" verdict carries
+  // the deploy that caused it (touchedByDeploy) when the hub could confirm one,
+  // and that is the deploy a reader wants — so it is named, with when it
+  // landed. Without it (an older hub, or an entry the log no longer retains)
+  // the only deploy coordinate on hand is the report's head, which is the point
+  // the judgement was made at and not a cause: it keeps the weaker wording.
+  // "at" is set only when the line names a cause, so the caller knows whether a
+  // timestamp belongs on it.
+  function rerunChangeLine(rr, deployHead) {
+    var cause = rr.state === "needed" && rr.touchedByDeploy ? rr.touchedByDeploy : null;
+    if (cause && cause.sha) return { key: "perspectives.rerun.changedByDeploy", sha: cause.sha, at: cause.at };
+    if (!deployHead) return { key: "perspectives.rerun.noDeployHead", sha: null, at: null };
+    return {
+      key: rr.state === "needed" ? "perspectives.rerun.changesSome" : "perspectives.rerun.changesNone",
+      sha: deployHead.sha,
+      at: null,
+    };
+  }
+  // --- end pure: rerun detail labels ----------------------------------------
+
+  // The evidence behind the verdict, as the value of whichever row
+  // rerunEvidenceLabelKey chose. For needed/notNeeded that is what the deploy
+  // log holds since this case last ran, named by rerunChangeLine.
+  // The label already states the timeframe, so the value never repeats it.
+  function rerunEvidenceValue(rr) {
+    var wrap = el("div");
+    if (rr.state !== "needed" && rr.state !== "notNeeded") {
+      wrap.appendChild(el("div", "d-prose", rerunCannotJudge(rr)));
+      return wrap;
+    }
+    // Both states require a non-empty deploy log, so a head-less report
+    // contradicts itself; rerunChangeLine then names what is missing rather
+    // than inventing a baseline.
+    var line = rerunChangeLine(rr, perspState.rerun && perspState.rerun.deployHead);
+    var text = t(line.key).replace("{sha}", shortSha(line.sha));
+    if (line.at) text += " · " + relTime(line.at);
+    wrap.appendChild(el("div", "d-prose", text));
+    // A touch the index proved but cannot enumerate leaves no paths to list;
+    // the line above still says a change landed, which is all that is known.
+    if (rr.state === "needed" && rr.touchedBy && rr.touchedBy.length) {
+      wrap.appendChild(pathCodes(rr.touchedBy));
+    }
+    return wrap;
+  }
+
   // Detail row: a definition list of the case's fields plus the note editor.
   // Built with createElement/textContent throughout — every field here is
   // API-derived, so none of it may go through innerHTML.
+  //
+  // The panel shows only what the table row cannot. The row already carries the
+  // title, mode, recorded state, last result and the re-run verdict, so none of
+  // those is repeated: what is left is the case's definition, the evidence the
+  // verdict rests on, its related code, and the note.
   function perspDetailContent(feature, spec) {
     var frag = document.createDocumentFragment();
     var dl = el("dl", "d-grid");
     function row(labelKey, valueNode) {
       dl.appendChild(el("dt", null, t(labelKey)));
       var dd = el("dd");
-      if (typeof valueNode === "string") dd.textContent = valueNode;
+      // Prose gets a measure; a node brings its own layout.
+      if (typeof valueNode === "string") dd.appendChild(el("div", "d-prose", valueNode));
       else dd.appendChild(valueNode);
       dl.appendChild(dd);
     }
@@ -18599,18 +20190,28 @@ const CLIENT_JS = `
     }
     if (spec.startScreen) row("perspectives.d.startScreen", spec.startScreen);
     if (spec.testCondition) row("perspectives.d.testCondition", spec.testCondition);
-    var specCode = el("code", null, spec.specName);
-    row("perspectives.d.spec", specCode);
+    // The spec id stays: it is what a user types to re-run this case, and the
+    // table shows the title, never the id.
+    row("perspectives.d.spec", el("code", null, spec.specName));
+
+    var rr = rerunFor(feature, spec);
+    if (rr) {
+      row(rerunEvidenceLabelKey(rr.state), rerunEvidenceValue(rr));
+      if (rerunHasFailure(rr)) row("perspectives.d.lastRed", ledgerLine(rr.lastRed));
+    }
     if (spec.relatedPaths && spec.relatedPaths.length) {
-      var pathsWrap = el("span");
-      spec.relatedPaths.forEach(function (p, i) {
-        if (i > 0) pathsWrap.appendChild(document.createTextNode(" "));
-        pathsWrap.appendChild(el("code", null, p));
-      });
-      row("perspectives.d.relatedPaths", pathsWrap);
+      row("perspectives.d.relatedPaths", pathCodes(spec.relatedPaths));
     }
     frag.appendChild(dl);
 
+    // Too-narrow relatedPaths produce a confident "not needed" — the dangerous
+    // direction — so an unmatched pattern is flagged under the paths it is about.
+    var unmatched = unmatchedRelatedPathCount(spec);
+    if (unmatched) {
+      frag.appendChild(fillNote(el("div"), "warn",
+        t("perspectives.dq.unmatched").replace("{n}", String(unmatched)), "d-note"));
+    }
+
     var notebox = el("div", "notebox");
     notebox.appendChild(el("div", "nlabel", t("perspectives.note.label")));
     var ta = el("textarea");
@@ -18650,17 +20251,23 @@ const CLIENT_JS = `
   function renderPerspTable(doc) {
     var tbody = document.getElementById("persp-tbody");
     clear(tbody);
+    // Hiding the two <th>s (rather than emitting empty cells) leaves the table
+    // exactly as it was on a hub that cannot answer the re-run question.
+    var showRerun = perspState.rerun != null;
+    document.getElementById("persp-th-result").hidden = !showRerun;
+    document.getElementById("persp-th-rerun").hidden = !showRerun;
+    var cols = showRerun ? 6 : 4;
     var hits = 0;
     doc.features.forEach(function (feature) {
-      var specs = feature.specs.filter(perspMatches);
+      var specs = feature.specs.filter(function (s) { return perspMatches(feature, s, perspState.f); });
       if (!specs.length) return;
       hits += specs.length;
 
       var grpRow = el("tr", "grp");
       var grpTd = el("td");
-      grpTd.colSpan = 4;
+      grpTd.colSpan = cols;
       grpTd.appendChild(document.createTextNode(feature.featureName));
-      grpTd.appendChild(el("span", "gcount", specs.length + " " + t("perspectives.metric.cases").toLowerCase()));
+      grpTd.appendChild(el("span", "gcount", specs.length + " " + t("perspectives.ov.cases")));
       grpRow.appendChild(grpTd);
       tbody.appendChild(grpRow);
 
@@ -18682,13 +20289,19 @@ const CLIENT_JS = `
         statusTd.appendChild(perspStatusBadge(spec));
         row.appendChild(statusTd);
 
+        if (showRerun) {
+          var rr = rerunFor(feature, spec);
+          row.appendChild(perspResultCell(rr));
+          row.appendChild(perspRerunCell(rr));
+        }
+
         var chevTd = el("td", "c-chev");
         chevTd.appendChild(el("span", "chev-i", "\\u25b6"));
         row.appendChild(chevTd);
 
         var detailRow = el("tr", "detail");
         var detailTd = el("td");
-        detailTd.colSpan = 4;
+        detailTd.colSpan = cols;
         detailRow.appendChild(detailTd);
         var built = false;
 
@@ -18718,10 +20331,44 @@ const CLIENT_JS = `
   function renderPerspectives() {
     var doc = perspState.doc;
     if (!doc) return;
+    syncPerspChips();
     renderPerspOverview(doc);
     renderPerspTable(doc);
   }
 
+  // The needs-re-run chip only exists while the hub answers the question;
+  // otherwise it would filter everything away. Drop back to "all" if it was
+  // the active filter when the answer came back "not supported".
+  //
+  // Each chip also carries what it would yield — the mode breakdown the
+  // summary row used to spend four tiles on.
+  function syncPerspChips() {
+    var chip = document.getElementById("persp-chip-rerun");
+    chip.hidden = perspState.rerunSupported !== true;
+    if (perspState.rerunSupported === false && perspState.f === "rerun") perspState.f = "all";
+    document.querySelectorAll("#view-perspectives .fchip").forEach(function (b) {
+      var f = b.getAttribute("data-f");
+      b.setAttribute("aria-pressed", String(f === perspState.f));
+      b.querySelector(".fcount").textContent = perspState.doc ? String(perspFilterCount(f)) : "";
+    });
+  }
+
+  function setPerspRerunNote(text, kind) {
+    var box = document.getElementById("persp-rerun-note");
+    box.hidden = !text;
+    if (!text) { clear(box); return; }
+    fillNote(box, kind || "info", text, "persp-note");
+  }
+
+  function setPerspDeployHead(report) {
+    var span = document.getElementById("persp-deploy-head");
+    var head = report && report.deployHead;
+    span.hidden = !head;
+    span.textContent = head
+      ? t("perspectives.rerun.deployHead") + " " + shortSha(head.sha) + " · " + relTime(head.at)
+      : "";
+  }
+
   function setPerspUpdated(doc) {
     var span = document.getElementById("persp-updated");
     if (doc && doc.generatedAt) {
@@ -18737,13 +20384,26 @@ const CLIENT_JS = `
     setPerspStatus("");
     document.getElementById("persp-body").hidden = true;
     setPerspUpdated(null);
+    setPerspRerunNote("");
+    setPerspDeployHead(null);
+    perspState.rerun = null;
+    perspState.rerunSupported = null;
+    syncPerspChips();
     fetchPerspectives()
       .then(function (doc) {
         perspState.doc = doc;
         if (!doc) { setPerspStatus(t("perspectives.empty")); return; }
         setPerspUpdated(doc);
         document.getElementById("persp-body").hidden = false;
+        // The inventory renders first: re-run data is additive to it, and a
+        // slow or absent /rerun must never hold up the table.
         renderPerspectives();
+        // Scoped to its own failure message: a fault here costs the two extra
+        // columns, and reporting it as "loading perspectives failed" would
+        // point at the inventory that in fact loaded fine.
+        return loadRerun().catch(function (err) {
+          setPerspRerunNote(t("perspectives.rerun.loadFailed") + ": " + err.message, "warn");
+        });
       })
       .catch(function (err) {
         perspState.doc = null;
@@ -18751,12 +20411,48 @@ const CLIENT_JS = `
       });
   }
 
+  function rerunScope() {
+    return state.project + "/" + state.profile;
+  }
+
+  function loadRerun() {
+    var scope = rerunScope();
+    return Promise.all([fetchRerun(), fetchRunIndex()]).then(function (results) {
+      // A second profile pick can land while this one is still in flight; the
+      // older response must not overwrite the newer scope's verdicts.
+      if (scope !== rerunScope()) return;
+      var rerun = results[0];
+      perspState.runUrls = results[1].urls;
+      perspState.rerunProfiles = results[1].profiles;
+      perspState.rerun = rerun.report || null;
+      perspState.rerunSupported = perspState.rerun != null;
+      setPerspDeployHead(perspState.rerun);
+      if (rerun.note) {
+        setPerspRerunNote(rerun.note, rerun.kind);
+      } else if (perspState.rerun && !perspState.rerun.deployHead) {
+        // Every case is "unknown" in this state, so say once, at the top, what
+        // is missing and how to supply it, rather than only per row.
+        setPerspRerunNote(t("perspectives.rerun.noDeployLogBanner").replace("{profile}", state.profile), "warn");
+      } else {
+        setPerspRerunNote("");
+      }
+      renderPerspectives();
+    });
+  }
+
+  // Switching profile re-asks only the profile-scoped question: the
+  // perspectives document itself is project-scoped and does not change.
+  function reloadRerun() {
+    perspState.rerun = null;
+    setPerspRerunNote("");
+    setPerspDeployHead(null);
+    renderPerspectives();
+    return loadRerun();
+  }
+
   function openPerspectives() {
     showView("perspectives");
     document.getElementById("persp-q").value = perspState.q;
-    document.querySelectorAll("#view-perspectives .fchip").forEach(function (b) {
-      b.setAttribute("aria-pressed", String(b.getAttribute("data-f") === perspState.f));
-    });
     loadPerspectives();
   }
 
@@ -18944,22 +20640,41 @@ const CLIENT_JS = `
     document.getElementById("project-menu").hidden ? openProjectMenu() : closeProjectMenu();
   }
 
-  // ── profile switching (Secrets-tab dropdown) ───────────────────────────
-  // Profiles scope ONLY variables + sessions (a profile is a set of env vars,
-  // like .ccqa/profiles/<name>.env). Prompts are project-wide and runs are
-  // cross-profile, so the selector lives inside the Secrets tab, not the header.
+  // ── profile switching (per-tab dropdowns) ──────────────────────────────
+  // Profiles scope variables + sessions (a profile is a set of env vars, like
+  // .ccqa/profiles/<name>.env) and, since ADR-0010, the needs-re-run verdict:
+  // two environments sit at different commits, so that question has no
+  // profile-free answer. Prompts are project-wide and runs are cross-profile,
+  // so there is still no header-level selector — Secrets and Perspectives each
+  // carry their own, sharing state.profile and differing only in which names
+  // they offer and what a pick reloads.
+
+  var PROFILE_MENUS = {
+    secrets: {
+      switchId: "sec-profile-switch", menuId: "sec-profile-menu", withNew: true,
+      names: function () { return knownProfiles; },
+      pick: function (p) { chooseProfile(p, loadSecrets); }
+    },
+    perspectives: {
+      switchId: "persp-profile-switch", menuId: "persp-profile-menu", withNew: false,
+      names: perspProfileNames,
+      pick: function (p) { chooseProfile(p, reloadRerun); }
+    }
+  };
 
   function setProfile(p) {
     state.profile = p || "default";
-    var cur = document.getElementById("sec-profile-current");
-    if (cur) cur.textContent = state.profile;
+    ["sec-profile-current", "persp-profile-current"].forEach(function (id) {
+      var cur = document.getElementById(id);
+      if (cur) cur.textContent = state.profile;
+    });
   }
 
-  // Switch profile and reload the Secrets tab under the new scope.
-  function chooseProfile(p) {
+  // Switch profile and reload the tab that asked, under the new scope.
+  function chooseProfile(p, reload) {
     setProfile(p);
     storeProfileForProject(state.project, state.profile);
-    loadSecrets();
+    reload();
   }
 
   // Fetch the profiles for the current project. "default" is always available
@@ -18973,17 +20688,20 @@ const CLIENT_JS = `
     }).catch(function () { knownProfiles = ["default"]; setProfile("default"); });
   }
 
-  function buildProfileMenu() {
-    var menu = document.getElementById("sec-profile-menu");
+  function buildProfileMenu(menuSpec) {
+    var menu = document.getElementById(menuSpec.menuId);
     clear(menu);
-    knownProfiles.forEach(function (p) {
+    menuSpec.names().forEach(function (p) {
       var mi = el("button", "mi" + (p === state.profile ? " current" : ""));
       mi.type = "button";
       mi.setAttribute("role", "menuitem");
       mi.appendChild(el("span", "name", p));
-      mi.addEventListener("click", function () { closeProfileMenu(); chooseProfile(p); });
+      mi.addEventListener("click", function () { closeProfileMenu(); menuSpec.pick(p); });
       menu.appendChild(mi);
     });
+    // Only the Secrets menu can create: a profile with no secrets is a usable
+    // secrets scope, but a profile with no runs has nothing to judge.
+    if (!menuSpec.withNew) return;
     menu.appendChild(el("div", "sep"));
     var newItem = el("button", "mi action");
     newItem.type = "button";
@@ -18994,20 +20712,26 @@ const CLIENT_JS = `
     menu.appendChild(newItem);
   }
 
-  function openProfileMenu() {
+  function openProfileMenu(which) {
     if (!state.token || !state.project) return;
-    buildProfileMenu();
-    document.getElementById("sec-profile-menu").hidden = false;
-    document.getElementById("sec-profile-switch").setAttribute("aria-expanded", "true");
+    var menuSpec = PROFILE_MENUS[which];
+    buildProfileMenu(menuSpec);
+    document.getElementById(menuSpec.menuId).hidden = false;
+    document.getElementById(menuSpec.switchId).setAttribute("aria-expanded", "true");
   }
+  // Closes both, so an outside click or Escape needs no idea which is open.
   function closeProfileMenu() {
-    var menu = document.getElementById("sec-profile-menu");
-    if (!menu) return;
-    menu.hidden = true;
-    document.getElementById("sec-profile-switch").setAttribute("aria-expanded", "false");
+    Object.keys(PROFILE_MENUS).forEach(function (which) {
+      var menuSpec = PROFILE_MENUS[which];
+      var menu = document.getElementById(menuSpec.menuId);
+      if (!menu) return;
+      menu.hidden = true;
+      document.getElementById(menuSpec.switchId).setAttribute("aria-expanded", "false");
+    });
   }
-  function toggleProfileMenu() {
-    document.getElementById("sec-profile-menu").hidden ? openProfileMenu() : closeProfileMenu();
+  function toggleProfileMenu(which) {
+    var menu = document.getElementById(PROFILE_MENUS[which].menuId);
+    if (menu.hidden) openProfileMenu(which); else closeProfileMenu();
   }
 
   // ── new-project dialog (centered modal; shares #scrim with the sheet) ──
@@ -19051,7 +20775,9 @@ const CLIENT_JS = `
       // Profiles are implicit like projects — created for real on the first
       // secret/prompt stored under them. Just add to the list and select it.
       if (knownProfiles.indexOf(name) === -1) { knownProfiles.push(name); knownProfiles.sort(); }
-      chooseProfile(name);
+      // The "new profile" item only exists in the Secrets menu, so that is the
+      // tab to reload.
+      chooseProfile(name, loadSecrets);
     } else {
       if (knownProjects.indexOf(name) === -1) { knownProjects.push(name); knownProjects.sort(); }
       chooseProject(name);
@@ -19138,13 +20864,16 @@ const CLIENT_JS = `
   });
   // Keep clicks inside the menu from bubbling to the document close-handler.
   document.getElementById("project-menu").addEventListener("click", function (e) { e.stopPropagation(); });
-  // Secrets-tab profile dropdown
-  document.getElementById("sec-profile-switch").addEventListener("click", function (e) {
-    e.stopPropagation();
-    closeProjectMenu();
-    toggleProfileMenu();
+  // Per-tab profile dropdowns (Secrets, Perspectives)
+  Object.keys(PROFILE_MENUS).forEach(function (which) {
+    var menuSpec = PROFILE_MENUS[which];
+    document.getElementById(menuSpec.switchId).addEventListener("click", function (e) {
+      e.stopPropagation();
+      closeProjectMenu();
+      toggleProfileMenu(which);
+    });
+    document.getElementById(menuSpec.menuId).addEventListener("click", function (e) { e.stopPropagation(); });
   });
-  document.getElementById("sec-profile-menu").addEventListener("click", function (e) { e.stopPropagation(); });
   // Outside click closes both menus.
   document.addEventListener("click", function () { closeProjectMenu(); closeProfileMenu(); });
 
@@ -19175,10 +20904,9 @@ const CLIENT_JS = `
   });
   document.querySelectorAll("#view-perspectives .fchip").forEach(function (b) {
     b.addEventListener("click", function () {
+      // renderPerspectives -> syncPerspChips repaints aria-pressed from
+      // perspState.f, so the handler only has to record the choice.
       perspState.f = b.getAttribute("data-f");
-      document.querySelectorAll("#view-perspectives .fchip").forEach(function (x) {
-        x.setAttribute("aria-pressed", x === b ? "true" : "false");
-      });
       renderPerspectives();
     });
   });
@@ -19613,6 +21341,9 @@ function registerRoutes(router, config, queue) {
 	router.get("/api/v1/projects", createListProjectsHandler(storage));
 	router.get("/api/v1/projects/:project/profiles", createListProfilesHandler(storage));
 	router.get("/api/v1/projects/:project/last-green", createGetLastGreenHandler(storage));
+	router.post("/api/v1/projects/:project/deploys", createRecordDeployHandler(storage));
+	router.get("/api/v1/projects/:project/deploys", createGetDeployLogHandler(storage));
+	router.get("/api/v1/projects/:project/rerun", createGetRerunHandler(storage));
 	const sessionConfig = {
 		store: storage.sessions,
 		encryptionKey: config.encryptionKey
@@ -19782,6 +21513,9 @@ function isNotFound(err) {
 *   variables/<project>/<profile>/<name>.meta.json
 *   triage/<runId>.json                         (TriageRecord[])
 *   jobs/<id>/job.json                          (LearningJob record, mutated as it runs)
+*   last-green/<project>/<profile>/<branch>.json (SpecLedger: green/run/red buckets)
+*   deploys/<project>/<profile>/log.json         (DeployLog, ring-buffered)
+*   deploys/<project>/<profile>/touch.json       (SpecTouchIndex derived from the log)
 *
 * IDs and names are validated by their callers (run ids are server-minted
 * UUIDs; project/profile/name come from validated request params) before
@@ -19845,9 +21579,22 @@ function perspectivesKindDir(root) {
 function perspectivesPath(root, project) {
 	return join(perspectivesKindDir(root), `${project}.json`);
 }
-function lastGreenPath(root, project, profile, branch) {
+function ledgerProfileDir(root, project, profile) {
+	return join(root, "last-green", project, profile);
+}
+function ledgerPath(root, project, profile, branch) {
 	const encoded = encodeURIComponent(branch);
-	return join(root, "last-green", project, profile, `${encoded.length <= 200 ? encoded : `${encoded.slice(0, 64)}-${createHash("sha256").update(branch).digest("hex").slice(0, 32)}`}.json`);
+	const name = encoded.length <= 200 ? encoded : `${encoded.slice(0, 64)}-${createHash("sha256").update(branch).digest("hex").slice(0, 32)}`;
+	return join(ledgerProfileDir(root, project, profile), `${name}.json`);
+}
+function deployScopeDir(root, project, profile) {
+	return join(root, "deploys", project, profile);
+}
+function deployLogPath(root, project, profile) {
+	return join(deployScopeDir(root, project, profile), "log.json");
+}
+function deployTouchIndexPath(root, project, profile) {
+	return join(deployScopeDir(root, project, profile), "touch.json");
 }
 //#endregion
 //#region src/hub/core/storage/file/artifact-store.ts
@@ -19889,6 +21636,28 @@ function createFileArtifactStore(root) {
 	};
 }
 //#endregion
+//#region src/hub/core/storage/file/deploy-store.ts
+function createFileDeployStore(root) {
+	const readLog = async (project, profile) => await readJson(deployLogPath(root, project, profile)) ?? emptyDeployLog();
+	return {
+		async append(project, profile, input) {
+			const log = await updateJson(deployLogPath(root, project, profile), (current) => appendDeploy(current, input));
+			return log.entries[log.entries.length - 1];
+		},
+		getLog: readLog,
+		async head(project, profile) {
+			const { entries } = await readLog(project, profile);
+			return entries[entries.length - 1] ?? null;
+		},
+		async getTouchIndex(project, profile) {
+			return await readJson(deployTouchIndexPath(root, project, profile)) ?? {};
+		},
+		async updateTouchIndex(project, profile, mutate) {
+			await updateJson(deployTouchIndexPath(root, project, profile), (current) => mutate(current ?? {}));
+		}
+	};
+}
+//#endregion
 //#region src/hub/core/storage/file/job-store.ts
 /**
 * Read one job record for a list scan, tolerating a bad entry: a missing
@@ -19936,21 +21705,19 @@ function createFileJobStore(root) {
 	};
 }
 //#endregion
-//#region src/hub/core/storage/file/last-green-store.ts
-function createFileLastGreenStore(root) {
+//#region src/hub/core/storage/file/ledger-store.ts
+function createFileSpecLedgerStore(root) {
 	return {
 		async get(project, profile, branch) {
-			return await readJson(lastGreenPath(root, project, profile, branch)) ?? {};
+			return toLedger(await readJson(ledgerPath(root, project, profile, branch)));
 		},
-		async merge(project, profile, branch, entries) {
-			await updateJson(lastGreenPath(root, project, profile, branch), (current) => {
-				const out = { ...current ?? {} };
-				for (const [key, entry] of Object.entries(entries)) {
-					const prev = out[key];
-					if (!prev || prev.at <= entry.at) out[key] = entry;
-				}
-				return out;
-			});
+		async getMerged(project, profile) {
+			const dir = ledgerProfileDir(root, project, profile);
+			const files = (await listDirOrEmpty(dir)).filter((name) => name.endsWith(".json"));
+			return (await Promise.all(files.map((name) => readJson(join(dir, name))))).reduce((acc, doc) => mergeLedgerInto(acc, toLedger(doc)), emptyLedger());
+		},
+		async merge(project, profile, branch, ledger) {
+			await updateJson(ledgerPath(root, project, profile, branch), (current) => mergeLedgerInto(toLedger(current), ledger));
 		}
 	};
 }
@@ -20209,7 +21976,8 @@ function createFileHubStorage(dataDir) {
 		prompts: createFilePromptStore(dataDir),
 		perspectives: createFilePerspectivesStore(dataDir),
 		jobs: createFileJobStore(dataDir),
-		lastGreen: createFileLastGreenStore(dataDir)
+		ledger: createFileSpecLedgerStore(dataDir),
+		deploys: createFileDeployStore(dataDir)
 	};
 }
 //#endregion