gh-glance 0.16.2 → 0.17.1

package/index.mjs

@@ -292,7 +292,7 @@ const ANIMATE = !process.env.GH_GLANCE_NO_ANIMATION;
 // legitimate mixed-direction Arabic and Hebrew titles render correctly, and
 // preserving real RTL text is a stated property of this function.
 // eslint-disable-next-line no-control-regex -- matching control characters is the entire purpose
-const CONTROL_CHARS = /[--Ÿ]+/g;
+const CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]+/g;
 const BIDI_OVERRIDES = /[‪-‮⁦-⁩]/g;
 
 // Titles are rendered at whatever length GitHub returns, and ink memoizes
@@ -307,7 +307,7 @@ const MAX_FIELD_LENGTH = 300;
 function safe(value) {
   // Coerce first, sanitize always. Returning a non-string early skipped both the
   // control-character strip and the length clamp, so an array or an object with a
-  // toString() came through untouched -- `safe(["x"])` returned the escape
+  // toString() came through untouched -- `safe(["\x1b[2Jx"])` returned the escape
   // verbatim. GitHub returns strings for every field this is called on today, so
   // the guarantee was being provided by the upstream schema rather than by the
   // function that claims to provide it.
@@ -1005,7 +1005,7 @@ function ghApiArgs(args, etag = null) {
   ];
 }
 
-async function ghApi(args, { operation, signal, etag = null, run = runGh } = {}) {
+async function ghApi(args, { operation, signal, etag = null, run = runGh, includeHeaders = false } = {}) {
   const argv = ghApiArgs(args, etag);
   try {
     const parsed = parseGhApiResponse(await run(argv, { operation, signal }));
@@ -1014,6 +1014,7 @@ async function ghApi(args, { operation, signal, etag = null, run = runGh } = {})
       etag: parsed.headers.etag ?? null,
       rateLimit: pickRateLimit(parsed.headers),
       body: parsed.body,
+      ...(includeHeaders ? { headers: parsed.headers } : {}),
     };
   } catch (error) {
     const parsed = parseGhApiResponse(error?.stdout);
@@ -1490,6 +1491,72 @@ function actionsWorkflowsArgs() {
   ];
 }
 
+const ACTIONS_SETUP_TTL_MS = 5 * 60_000;
+
+function actionsSetupArgs({ host, repository }) {
+  return [`repos/${repository}/actions/workflows?per_page=100&page=1`, "--hostname", host,
+    "--jq", "{total_count, workflows: [.workflows[] | {id, name, state}]}"];
+}
+
+function parseActionsSetup(body, headers = {}) {
+  const unusable = () => { throw new Error("Actions setup response is unusable"); };
+  let value;
+  try { value = JSON.parse(body); } catch { return unusable(); }
+  if (!isRecord(value) || !Number.isSafeInteger(value.total_count) || value.total_count < 0 ||
+      !Array.isArray(value.workflows) || value.workflows.length > 100 ||
+      value.total_count < value.workflows.length || (value.total_count > 0 && value.workflows.length === 0)) return unusable();
+  const ids = new Set();
+  const workflows = value.workflows.map((entry) => {
+    if (!isRecord(entry) || !Number.isSafeInteger(entry.id) || entry.id <= 0 || ids.has(entry.id) ||
+        typeof entry.name !== "string" || !safe(entry.name).trim() ||
+        typeof entry.state !== "string" || !entry.state.trim()) return unusable();
+    ids.add(entry.id);
+    return { id: entry.id, name: safe(entry.name), state: entry.state };
+  });
+  const hasNextPage = /rel=["']?next\b/i.test(headers.link ?? "");
+  if (value.total_count === 0 && hasNextPage) return unusable();
+  const complete = value.total_count === workflows.length && !hasNextPage;
+  const disabled = workflows.filter(({ state }) => ["disabled_manually", "disabled_inactivity"].includes(state)).length;
+  const active = workflows.filter(({ state }) => state === "active").length;
+  const title = !complete ? "Workflows found; setup check incomplete"
+    : workflows.length === 0 ? "No workflows found"
+      : disabled === workflows.length ? "All listed workflows are disabled" : "Workflows found";
+  return { total: value.total_count, workflows, complete, disabled, active,
+    other: workflows.length - disabled - active, title };
+}
+
+function actionsSetupFresh(result, nowMs) {
+  return result != null && nowMs >= result.checkedAt && nowMs - result.checkedAt < ACTIONS_SETUP_TTL_MS;
+}
+
+function actionsSetupRetryAt(nowMs, holdUntil = 0) {
+  return Math.max(nowMs + 30_000, Number.isFinite(holdUntil) ? holdUntil : 0);
+}
+
+function actionsPageUrl(target = dashboardTarget()) {
+  const validated = dashboardTarget(target);
+  return validated.host && validated.repository
+    ? `https://${validated.host}/${validated.repository}/actions` : null;
+}
+
+function actionsSetupPresentation(state, nowMs) {
+  const result = state.result;
+  const notes = [];
+  if (result) {
+    notes.push(`${state.saved ? "Saved setup check" : "Setup checked"}: ${new Date(result.checkedAt).toISOString()}`,
+      `${result.workflows.length} of ${result.total} workflows listed: ${result.active} active, ${result.disabled} disabled, ${result.other} other state.`,
+      actionsSetupFresh(result, nowMs)
+        ? `Press s to check again after ${new Date(result.checkedAt + ACTIONS_SETUP_TTL_MS).toISOString()}.`
+        : "Setup check expired; press s to check again.");
+  }
+  if (state.error) notes.push(state.error,
+    `Press s to retry${state.retryAt ? ` after ${new Date(state.retryAt).toISOString()}` : ""}.`);
+  if (state.message) notes.push(state.message);
+  return { title: state.busy ? "Checking Actions setup" : state.error ? "Setup check unavailable"
+    : state.message ? state.title ?? "Actions setup" : result?.title,
+  action: state.action ?? (state.error ? "s Retry; g Actions; ? Details" : "s Setup; g Actions; ? Details"), notes };
+}
+
 function parseActionsRuns(runsBody) {
   return parseJsonOutput(runsBody).map((run) => ({
     databaseId: run.databaseId,
@@ -2214,6 +2281,7 @@ const OPERATION_COSTS = Object.freeze({
   // Separately admitted, like a later list page: only fetched when a run has
   // no name of its own, and settled against its own reservation.
   "catalog:actions-workflows": { core: 1, graphql: 0 },
+  "setup:actions-workflows": { core: 1, graphql: 0 },
   "tab:security-endpoint": { core: 1, graphql: 0 },
   "failure-context:repository": { core: 0, graphql: GRAPHQL_OBSERVER_POINTS },
   // Each page past the first reserves its own envelope, so a denial there is a
@@ -3207,8 +3275,8 @@ function claimIdentityBootstrap(root, { credentialKey, host, resource = "core",
   }, { now, kill });
 }
 
-function readIdentityQuotaState(registry, scope, now) {
-  const loaded = readGovernorState(scope.path, now);
+function readIdentityQuotaState(registry, scope, now, options = {}) {
+  const loaded = readGovernorState(scope.path, now, options);
   const known = Object.values(registry.identities).some((identity) => identity.quotaKey === scope.quotaKey) ||
     Object.values(registry.attempts).some((attempt) => attempt.imported && attempt.quotaKey === scope.quotaKey);
   return loaded.ok && loaded.missing && known ? { ok: false, reason: "corrupt" } : loaded;
@@ -3234,9 +3302,9 @@ function importIdentityDebts(root, state, credentialKey, identity, now) {
         notBefore: attempt.startedAt, status: "started", epochs: { core: null, graphql: null },
         startedAt: attempt.startedAt, completedAt: null, outcome: null,
       };
-      if (!loaded.value.importMarkers[id] &&
-          !transferReceiptToDebt(loaded.value, legacyControl, now, id)) {
-        return { ok: false, reason: "accounting-overflow" };
+      if (!loaded.value.importMarkers[id]) {
+        const failure = transferReceiptToDebt(loaded.value, legacyControl, now, id);
+        if (failure) return failure;
       }
       if (Object.keys(loaded.value.importMarkers).length >= IDENTITY_MAX_ATTEMPTS &&
           !loaded.value.importMarkers[id]) return { ok: false, reason: "identity-capacity" };
@@ -3451,7 +3519,8 @@ function startIdentityControl(coordinator, now = Date.now()) {
       if (Object.keys(registry.attempts).length >= IDENTITY_MAX_ATTEMPTS) return { ok: false, reason: "identity-capacity" };
       const priorControl = state.controlReceipts.core;
       if (priorControl) {
-        if (!retireControlReceiptToDebt(state, "core", now)) return { ok: false, reason: "accounting-overflow" };
+        const failure = retireControlReceiptToDebt(state, "core", now);
+        if (failure) return failure;
       }
       const id = governorId();
       registry.attempts[id] = { credentialKey: identity.credentialKey, host: identity.host, resource: "core", startedAt: now,
@@ -3506,8 +3575,9 @@ function settleIdentityControl(coordinator, control, stdout, now = Date.now(),
         reservation.actualCosts = { core: cost, graphql: 0 };
         reservation.accountedCosts = { core: cost, graphql: 0 };
         loaded.value.controlReceipts.core = null;
-      } else if (!retireControlReceiptToDebt(loaded.value, "core", now)) {
-        return { ok: false, reason: "accounting-overflow" };
+      } else {
+        const failure = retireControlReceiptToDebt(loaded.value, "core", now);
+        if (failure) return failure;
       }
       return writeGovernorQuotaState(scope.path, loaded.value, now);
     });
@@ -3776,6 +3846,7 @@ function identityCoordinationMessage(reason) {
   if (reason === "throttle-paused") return "Paused after repeated rate limits; refresh to retry";
   if (retryableCoordination(reason)) return "Coordinating with your other panes";
   if (reason === "identity-capacity") return "Coordination state full; retrying after the current window";
+  if (reason === "debt-journal-full") return "Coordination journal full; retrying after older requests settle";
   return "Verified identity unavailable; waiting to retry";
 }
 
@@ -3821,6 +3892,9 @@ const GOVERNOR_MAX_LEASES = 128;
 const GOVERNOR_MAX_INTENTS = 512;
 const GOVERNOR_MAX_RESERVATIONS = 512;
 const GOVERNOR_MAX_DEBT_GROUPS = 128;
+// Quiescent groups merge once the journal is this full, so retirement never
+// waits on a probe publication that a full journal would itself block.
+const DEBT_JOURNAL_COMPACT_AT = GOVERNOR_MAX_DEBT_GROUPS / 2;
 const GOVERNOR_MAX_LEDGER_BYTES = 2 * 1024 * 1024;
 const GOVERNOR_LOCK_WAIT_MS = 250;
 // How old an unreadable lock record may be before it counts as abandoned. A
@@ -4458,10 +4532,8 @@ function migrateLegacyGovernorReceipts(legacy, nowMs) {
   if (RATE_RESOURCES.some((resource) => units[resource] > 0)) {
     const nonce = governorId();
     state.debtGroups[nonce] = {
-      nonce, ownerNonce: null, ownerPid: null, ownerBirth: null, bootId: coordinationBootId(),
-      unknownChild: true, sealed: true, quiescent: false,
-      units, counts, at: nowMs, barrierAt: null,
-      barrierRevisions: { core: 0, graphql: 0 },
+      ...newDebtGroup({ nonce, bootId: coordinationBootId(), unknownChild: true, at: nowMs }),
+      units, counts,
     };
     for (const resource of RATE_RESOURCES) {
       state.debt[resource].unresolvedUnits = units[resource];
@@ -4528,25 +4600,57 @@ function debtGroupTarget(state, receipt, groupId = null) {
   return state.debtGroups[UNKNOWN_DEBT_GROUP_ID] ? governorId() : UNKNOWN_DEBT_GROUP_ID;
 }
 
+const ACCOUNTING_OVERFLOW = Object.freeze({ ok: false, reason: "accounting-overflow" });
+
+// The one shape normalizeGovernorState accepts for a group; every site that
+// creates a group starts from it so a new field cannot be missed in one copy.
+function newDebtGroup({ nonce = governorId(), bootId, unknownChild, at, quiescent = false, barrierAt = null }) {
+  return {
+    nonce, ownerNonce: null, ownerPid: null, ownerBirth: null, bootId,
+    unknownChild, sealed: true, quiescent,
+    units: { core: 0, graphql: 0 }, counts: { core: 0, graphql: 0 },
+    at, barrierAt, barrierRevisions: { core: 0, graphql: 0 },
+  };
+}
+
+// When age alone settles an unresolved group. Only a sealed group ages out;
+// an owner acknowledgement can settle either kind earlier.
+function debtGroupSettlesAt(group) {
+  return group.sealed ? group.at + IDENTITY_UNCERTAIN_MAX_MS : Number.POSITIVE_INFINITY;
+}
+
+function hasLiveProbeClaim(state, at) {
+  return RATE_RESOURCES.some((resource) => state.probeClaims[resource]?.leaseUntil > at);
+}
+
+// A journal with no free slot is a capacity condition, not an arithmetic one.
+// A retry can succeed once an unresolved group ages out or a live claim ends
+// and lets compaction run; the probe interval bounds the wait so a pane never
+// shows a retry hours away.
+function debtJournalFullFailure(state, nowMs) {
+  const unblockAt = Math.min(
+    ...Object.values(state.debtGroups).filter((group) => !group.quiescent).map(debtGroupSettlesAt),
+    ...RATE_RESOURCES.map((resource) => state.probeClaims[resource]?.leaseUntil ?? Number.POSITIVE_INFINITY),
+    nowMs + BUDGET_PROBE_MS,
+  );
+  return { ok: false, reason: "debt-journal-full", retryAt: Math.max(unblockAt, nowMs + 1000) };
+}
+
+// Returns null when the charge is recorded, otherwise the failure to report.
 function transferReceiptToDebt(state, receipt, nowMs, groupId = null) {
   const units = Object.fromEntries(RATE_RESOURCES.map((resource) => [resource,
     reservationCost(receipt, resource, state.leases, nowMs)]));
-  if (RATE_RESOURCES.every((resource) => units[resource] === 0)) return true;
+  if (RATE_RESOURCES.every((resource) => units[resource] === 0)) return null;
   const id = debtGroupTarget(state, receipt, groupId);
-  if (id === null) return false;
+  if (id === null) return debtJournalFullFailure(state, nowMs);
   const incomingBootId = receipt.receipt?.bootId ?? coordinationBootId();
   const dedicated = id === groupId;
-  const group = state.debtGroups[id] ?? {
-    nonce: governorId(), ownerNonce: null, ownerPid: null, ownerBirth: null,
-    bootId: incomingBootId,
-    unknownChild: !dedicated || !receipt.receipt, sealed: true, quiescent: false,
-    units: { core: 0, graphql: 0 }, counts: { core: 0, graphql: 0 },
-    at: nowMs, barrierAt: null,
-    barrierRevisions: { core: 0, graphql: 0 },
-  };
-  if (group.quiescent) return false;
+  const group = state.debtGroups[id] ?? newDebtGroup({
+    bootId: incomingBootId, unknownChild: !dedicated || !receipt.receipt, at: nowMs,
+  });
+  if (group.quiescent) return ACCOUNTING_OVERFLOW;
   if (receipt.receipt && dedicated) {
-    if (group.ownerNonce !== null && group.ownerNonce !== receipt.receipt.ownerNonce) return false;
+    if (group.ownerNonce !== null && group.ownerNonce !== receipt.receipt.ownerNonce) return ACCOUNTING_OVERFLOW;
     group.ownerNonce = receipt.receipt.ownerNonce;
     group.ownerPid = receipt.receipt.ownerPid;
     group.ownerBirth = receipt.receipt.ownerBirth;
@@ -4561,7 +4665,7 @@ function transferReceiptToDebt(state, receipt, nowMs, groupId = null) {
         !Number.isSafeInteger(group.units[resource] + amount) ||
         !Number.isSafeInteger(state.debt[resource].unresolvedCount + (amount > 0 ? 1 : 0)) ||
         !Number.isSafeInteger(state.debt[resource].revision + 1) ||
-        !Number.isSafeInteger(group.counts[resource] + (amount > 0 ? 1 : 0))) return false;
+        !Number.isSafeInteger(group.counts[resource] + (amount > 0 ? 1 : 0))) return ACCOUNTING_OVERFLOW;
   }
   for (const resource of RATE_RESOURCES) {
     const amount = units[resource];
@@ -4575,7 +4679,7 @@ function transferReceiptToDebt(state, receipt, nowMs, groupId = null) {
   // which reconcileBootDebt may treat the group as settled.
   group.at = Math.max(group.at, nowMs);
   state.debtGroups[id] = group;
-  return true;
+  return null;
 }
 
 function makeDebtGroupQuiescent(state, group, at) {
@@ -4602,23 +4706,25 @@ function makeDebtGroupQuiescent(state, group, at) {
   return true;
 }
 
+// Returns null when the receipt is retired, otherwise the failure to report.
 function retireControlReceiptToDebt(state, resource, at) {
   const control = state.controlReceipts[resource];
-  if (!control) return true;
+  if (!control) return null;
   // A control receipt without an issued dispatch cannot have started HTTP.
   // Removing it also fences a late owner before it can issue a child.
   if (control.receipt.dispatches.length === 0) {
     state.controlReceipts[resource] = null;
-    return true;
+    return null;
   }
   const generation = control.receipt.generation;
-  if (!transferReceiptToDebt(state, control, at, generation)) return false;
+  const failure = transferReceiptToDebt(state, control, at, generation);
+  if (failure) return failure;
   const group = state.debtGroups[generation];
   if (group && !group.unknownChild && group.ownerPid !== null &&
       group.ownerBirth !== null && group.bootId !== null &&
-      !makeDebtGroupQuiescent(state, group, at)) return false;
+      !makeDebtGroupQuiescent(state, group, at)) return ACCOUNTING_OVERFLOW;
   state.controlReceipts[resource] = null;
-  return true;
+  return null;
 }
 
 // A reboot proves an unknown owner's children are gone. So does age: a group's
@@ -4630,16 +4736,49 @@ function reconcileBootDebt(state, at) {
   for (const group of Object.values(state.debtGroups)) {
     if (group.quiescent) continue;
     const priorBoot = bootId !== null && group.bootId !== null && group.bootId !== bootId;
-    const outlivedWindow = group.sealed && at - group.at >= IDENTITY_UNCERTAIN_MAX_MS;
+    const outlivedWindow = at >= debtGroupSettlesAt(group);
     if (!priorBoot && !outlivedWindow) continue;
     if (!makeDebtGroupQuiescent(state, group, at)) {
-      return { ok: false, reason: "accounting-overflow" };
+      return ACCOUNTING_OVERFLOW;
     }
     changed = true;
   }
   return { ok: true, changed };
 }
 
+// Quiescent groups are frozen until a probe publication retires them, and a
+// publication needs a claim that first charges its control receipt to a group.
+// With the journal full of quiescent groups that charge has nowhere to go, so
+// the only operation that drains the journal is the one it blocks. Merging the
+// frozen groups keeps the totals and frees the slots. A claim compares the
+// snapshot it took against the groups it finds at publication, so the shape may
+// only change while no claim is live.
+function compactQuiescentDebtGroups(state, at) {
+  if (Object.keys(state.debtGroups).length < DEBT_JOURNAL_COMPACT_AT || hasLiveProbeClaim(state, at)) {
+    return { ok: true, changed: false };
+  }
+  const quiescent = Object.entries(state.debtGroups).filter(([, group]) => group.quiescent);
+  let changed = false;
+  for (const [bootId, entries] of Map.groupBy(quiescent, ([, group]) => group.bootId)) {
+    if (entries.length < 2) continue;
+    const groups = entries.map(([, group]) => group);
+    const merged = newDebtGroup({ bootId, unknownChild: true, quiescent: true,
+      at: Math.max(...groups.map((group) => group.at)),
+      barrierAt: Math.max(0, ...groups.map((group) => group.barrierAt ?? 0)) });
+    for (const resource of RATE_RESOURCES) {
+      merged.units[resource] = groups.reduce((sum, group) => sum + group.units[resource], 0);
+      merged.counts[resource] = groups.reduce((sum, group) => sum + group.counts[resource], 0);
+      if (!Number.isSafeInteger(merged.units[resource]) ||
+          !Number.isSafeInteger(merged.counts[resource])) return ACCOUNTING_OVERFLOW;
+      merged.barrierRevisions[resource] = Math.max(...groups.map((group) => group.barrierRevisions[resource]));
+    }
+    for (const [id] of entries) delete state.debtGroups[id];
+    state.debtGroups[merged.nonce] = merged;
+    changed = true;
+  }
+  return { ok: true, changed };
+}
+
 function compactGovernorReceipts(state, nowMs) {
   const sealed = new Set();
   const full = Object.keys(state.reservations).length >= GOVERNOR_MAX_RESERVATIONS;
@@ -4663,18 +4802,16 @@ function compactGovernorReceipts(state, nowMs) {
     const trial = structuredClone(state);
     for (const reservation of candidates) {
       const groupId = reservation.receipt?.generation ?? null;
-      if (debtGroupTarget(trial, reservation, groupId) === null) return { ok: true, changed: false };
-      if (!transferReceiptToDebt(trial, reservation, nowMs, groupId)) {
-        return { ok: false, reason: "accounting-overflow" };
-      }
+      const failure = transferReceiptToDebt(trial, reservation, nowMs, groupId);
+      if (failure?.reason === "debt-journal-full") return { ok: true, changed: false };
+      if (failure) return failure;
     }
   }
   if (full) {
     for (const [id, reservation] of Object.entries(state.reservations)) {
       if (reservation.status !== "completed" || reservation.receipt) continue;
-      if (!transferReceiptToDebt(state, reservation, nowMs)) {
-        return { ok: false, reason: "accounting-overflow" };
-      }
+      const failure = transferReceiptToDebt(state, reservation, nowMs);
+      if (failure) return failure;
       delete state.reservations[id];
       changed = true;
     }
@@ -4695,9 +4832,9 @@ function compactGovernorReceipts(state, nowMs) {
   for (const generation of sealed) {
     for (const [id, reservation] of Object.entries(state.reservations)) {
       if (reservation.receipt?.generation !== generation) continue;
-      if (!(reservation.status === "started" && reservation.receipt.dispatches.length === 0) &&
-          !transferReceiptToDebt(state, reservation, nowMs, generation)) {
-        return { ok: false, reason: "accounting-overflow" };
+      if (!(reservation.status === "started" && reservation.receipt.dispatches.length === 0)) {
+        const failure = transferReceiptToDebt(state, reservation, nowMs, generation);
+        if (failure) return failure;
       }
       delete state.reservations[id];
       state.ownerGenerations[reservation.leaseId] = governorId();
@@ -4706,7 +4843,7 @@ function compactGovernorReceipts(state, nowMs) {
     if (group && !group.unknownChild && group.ownerPid !== null &&
         group.ownerBirth !== null && group.bootId !== null &&
         !makeDebtGroupQuiescent(state, group, nowMs)) {
-      return { ok: false, reason: "accounting-overflow" };
+      return ACCOUNTING_OVERFLOW;
     }
   }
   retireOwnerGenerations(state);
@@ -4792,7 +4929,7 @@ function writeGovernorState(path, state) {
   try {
     if (state?.version === GOVERNOR_STATE_VERSION) {
       if (!Number.isSafeInteger(state.revision) || state.revision === Number.MAX_SAFE_INTEGER) {
-        return { ok: false, reason: "accounting-overflow" };
+        return ACCOUNTING_OVERFLOW;
       }
       state.revision += 1;
     }
@@ -4822,7 +4959,7 @@ function writeGovernorQuotaState(path, state, nowMs) {
   const normalized = normalizeGovernorState(state, nowMs, { prune: false });
   if (!normalized) return { ok: false, reason: "corrupt" };
   if (!governorAccountingSafe(normalized, nowMs)) {
-    return { ok: false, reason: "accounting-overflow" };
+    return ACCOUNTING_OVERFLOW;
   }
   return writeGovernorState(path, normalized);
 }
@@ -5136,17 +5273,19 @@ function mutateGovernor(scope, nowMs, mutate) {
     const loaded = readGovernorState(scope.path, at, { persistMigration: false });
     if (!loaded.ok) return loaded;
     const state = loaded.value;
-    if (!governorAccountingSafe(state, at)) return { ok: false, reason: "accounting-overflow" };
+    if (!governorAccountingSafe(state, at)) return ACCOUNTING_OVERFLOW;
     const oldBootReconciled = reconcileBootDebt(state, at);
     if (!oldBootReconciled.ok) return oldBootReconciled;
     const compacted = compactGovernorReceipts(state, at);
     if (!compacted.ok) return compacted;
     const bootReconciled = reconcileBootDebt(state, at);
     if (!bootReconciled.ok) return bootReconciled;
+    const journal = compactQuiescentDebtGroups(state, at);
+    if (!journal.ok) return journal;
     // A mutator can reject without writing. Keep an untouched migration so
     // that even that path upgrades the file once before releasing the lock.
     const migration = loaded.migrated || compacted.changed ||
-      oldBootReconciled.changed || bootReconciled.changed
+      oldBootReconciled.changed || bootReconciled.changed || journal.changed
       ? structuredClone(state) : null;
     const returnAfterMigration = (result) => {
       if (migration === null) return result;
@@ -5155,7 +5294,7 @@ function mutateGovernor(scope, nowMs, mutate) {
     };
     const value = mutate(state, at);
     if (value?.ok === false && value.write !== true) return returnAfterMigration(value);
-    if (!governorAccountingSafe(state, at)) return returnAfterMigration({ ok: false, reason: "accounting-overflow" });
+    if (!governorAccountingSafe(state, at)) return returnAfterMigration(ACCOUNTING_OVERFLOW);
     const normalized = normalizeGovernorState(state, at);
     if (!normalized) return returnAfterMigration({ ok: false, reason: "corrupt" });
     const written = writeGovernorState(scope.path, normalized);
@@ -5387,9 +5526,8 @@ function claimProbe(scope, leaseId, nowMs, resource) {
     if (resource === "graphql" && state.controlReceipts.graphql) {
       // The old claim's lease has expired. Keep an issued child charged as
       // debt, and fence the old capability so a new observer can make progress.
-      if (!retireControlReceiptToDebt(state, "graphql", at)) {
-        return { ok: false, reason: "accounting-overflow" };
-      }
+      const failure = retireControlReceiptToDebt(state, "graphql", at);
+      if (failure) return failure;
     }
     const nonce = randomUUID();
     const startedReservationIds = Object.entries(state.reservations)
@@ -5408,7 +5546,7 @@ function claimProbe(scope, leaseId, nowMs, resource) {
     const debtUnits = quiescentGroups.reduce((sum, group) => sum + group.units[resource], 0);
     const debtCount = quiescentGroups.reduce((sum, group) => sum + group.counts[resource], 0);
     if (!Number.isSafeInteger(debtUnits) || !Number.isSafeInteger(debtCount)) {
-      return { ok: false, reason: "accounting-overflow" };
+      return ACCOUNTING_OVERFLOW;
     }
     const debtSnapshot = {
       units: debtUnits,
@@ -5615,7 +5753,7 @@ function publishProbe(scope, leaseId, nonce, budgets, nowMs, resource) {
     }
     if (changedResources.length === 0) return { ok: false, reason: "corrupt" };
     if (!retireClaimedQuiescentDebt(state, resource, claim)) {
-      return { ok: false, reason: "accounting-overflow" };
+      return ACCOUNTING_OVERFLOW;
     }
     const completedBeforeClaim = Object.entries(state.reservations)
       .filter(([, reservation]) =>
@@ -5735,9 +5873,8 @@ function failProbeClaim(scope, leaseId, nonce, nowMs, resource) {
       const control = state.controlReceipts.graphql;
       if (control.receipt.dispatches.length === 0) state.controlReceipts.graphql = null;
       else if (control.receipt.dispatches.every((dispatch) => dispatch.terminalAt !== null)) {
-        if (!retireControlReceiptToDebt(state, "graphql", at)) {
-          return { ok: false, reason: "accounting-overflow" };
-        }
+        const failure = retireControlReceiptToDebt(state, "graphql", at);
+        if (failure) return failure;
       }
     }
     state.observers[resource] = {
@@ -6041,7 +6178,7 @@ function acknowledgeSealedGeneration(scope, capability, sealedNonce, nowMs) {
           reservation.receipt?.generation === capability.generation)) {
       return { ok: false, reason: "quiescence-unverified" };
     }
-    if (!makeDebtGroupQuiescent(state, group, at)) return { ok: false, reason: "accounting-overflow" };
+    if (!makeDebtGroupQuiescent(state, group, at)) return ACCOUNTING_OVERFLOW;
     return { value: { status: "acknowledged", nonce: group.nonce } };
   });
 }
@@ -6300,13 +6437,16 @@ function governorHealth(result, nowMs = Date.now()) {
   if (!result?.ok) return { status: `unavailable (${result?.reason ?? "unknown"})`, leases: 0, resources: {} };
   const state = result.value;
   let status = "healthy";
-  if (RATE_RESOURCES.some((resource) => state.probeClaims[resource]?.leaseUntil > nowMs)) status = "waiting for probe";
+  if (hasLiveProbeClaim(state, nowMs)) status = "waiting for probe";
   else if (RATE_RESOURCES.some((resource) => !state.budgets[resource] ||
     nowMs - state.budgets[resource].observedAt > budgetSnapshotTtl(resource))) status = "stale";
   else if (RATE_RESOURCES.some((resource) => state.budgets[resource].blockUntil > nowMs)) status = "blocked";
+  const groups = Object.values(state.debtGroups);
   return {
     status,
     leases: Object.keys(state.leases).length,
+    debtGroups: groups.length,
+    quiescentGroups: groups.filter((group) => group.quiescent).length,
     resources: Object.fromEntries(RATE_RESOURCES.flatMap((resource) => {
       const budget = state.budgets[resource];
       return budget ? [[resource, {
@@ -6345,12 +6485,15 @@ function doctorCachedQuotaScope(host, { root = identityRegistryRoot(), nowMs = D
   try {
     if (!lstatSync(path).isFile()) return { ok: false, reason: "unsafe quota path", path };
   } catch (error) {
-    return { ok: false, reason: error?.code === "ENOENT" ? "cached quota missing" : "cached quota unreadable", path };
+    if (error?.code !== "ENOENT") return { ok: false, reason: "cached quota unreadable", path };
   }
-  const result = readGovernorState(path, nowMs, { persistMigration: false });
+  // The runtime's own guard classifies the file: a missing ledger for a quota
+  // key the registry still lists is corrupt, never a fresh start, so doctor
+  // reports the same reason the panes act on.
+  const result = readIdentityQuotaState(registry, { path, quotaKey }, nowMs, { persistMigration: false });
   return result.ok && !result.missing
     ? { ok: true, result, path, quotaKey }
-    : { ok: false, reason: result.missing ? "cached quota missing" : result.reason, path };
+    : { ok: false, reason: result.ok ? "cached quota missing" : result.reason, path };
 }
 
 async function retryGovernorMutation(run, { now, wait, deadline, signal }) {
@@ -6977,6 +7120,10 @@ async function openInBrowser(tabKey, item, signal, _governor = null, { run = nul
   // Returning quietly here is how a dead Enter key looks: the row has no usable
   // page, and the user is entitled to know that rather than press it again.
   if (!url) throw new Error("This row has no page to open yet; refresh and try again");
+  return openBrowserUrl(url, signal, { run });
+}
+
+async function openBrowserUrl(url, signal, { run = null } = {}) {
   const opener = pick(BROWSER_OPENERS, process.platform, null);
   if (!opener) throw new Error(`Opening a browser is not supported on ${process.platform}`);
   const [command, ...prefix] = opener;
@@ -8003,7 +8150,7 @@ function mapWebhookInvalidations({ event, payload, config, enterpriseHost = null
     ? config.targets.map((target) => ({ ...target, resources: TAB_KEYS }))
     : config.webhook.targets;
   let targets = mappedTargets.filter((target) =>
-    (!selectedHost || target.host === selectedHost) && (event === "installation" || names.has(target.repo)));
+    (!selectedHost || target.host === selectedHost) && (event === "installation" || names.has(target.repo.toLowerCase())));
   if (["installation", "installation_repositories"].includes(event)) {
     targets = targets.filter((target) => {
       const provider = config.providers[target.provider];
@@ -8013,7 +8160,10 @@ function mapWebhookInvalidations({ event, payload, config, enterpriseHost = null
   }
   if (!selectedHost && event !== "installation") {
     const hostsByRepo = new Map();
-    for (const target of targets) hostsByRepo.set(target.repo, (hostsByRepo.get(target.repo) ?? new Set()).add(target.host));
+    for (const target of targets) {
+      const repo = target.repo.toLowerCase();
+      hostsByRepo.set(repo, (hostsByRepo.get(repo) ?? new Set()).add(target.host));
+    }
     if ([...hostsByRepo.values()].some((hosts) => hosts.size !== 1)) return { ok: false, reason: "target" };
   }
   if (targets.length === 0) return ["installation", "installation_repositories"].includes(event)
@@ -11196,6 +11346,11 @@ async function runDoctor({ probeEndpoints = false } = {}) {
     .filter(Boolean).sort((left, right) => right.at - left.at)[0] ?? null;
   const lastFailedRecovery = [...(recoveryJournal?.entries ?? [])].reverse()
     .find((entry) => entry.code !== "clear") ?? null;
+  const ledgerPath = cachedQuota?.path ?? diagnosticScope?.path ?? null;
+  // The journal cannot speak for a ledger that cannot be read, so the cached
+  // read's own reason counts too; both use the governor's reason vocabulary.
+  const hardRecovery = Boolean(ledgerPath) &&
+    [currentRecovery?.code, cachedQuota?.reason].some((reason) => HARD_STORAGE_REASONS.includes(reason));
   const retryDates = RATE_RESOURCES.flatMap((resource) => {
     const active = recoveryJournal?.current[resource];
     const observer = (probeEndpoints ? governorResult : cachedQuota?.result)?.value?.observers[resource];
@@ -11252,11 +11407,16 @@ async function runDoctor({ probeEndpoints = false } = {}) {
     "",
     ...section("API governor"),
     field("cached scope", probeEndpoints ? "verified by probe" : cachedQuota?.ok ? "read-only cached identity" : `unavailable (${cachedQuota?.reason ?? "unknown"})`),
-    ...(cachedQuota?.path && !cachedQuota.ok
-      ? [field("state file", `${join(dirname(cachedQuota.path), "quota-[redacted].json")} (quota fingerprint withheld)`)]
+    // The user has to find the file to move it.
+    ...(ledgerPath && cachedQuota?.ok === false || hardRecovery
+      ? [field("state file", `${join(dirname(ledgerPath), "quota-[redacted].json")} (quota fingerprint withheld)`)]
       : []),
+    ...(hardRecovery ? [field("repair", LEDGER_REPAIR_ADVICE)] : []),
     field("status", governor.status),
     field("live leases", governor.leases),
+    field("debt groups", governor.debtGroups == null
+      ? "unavailable"
+      : `${governor.debtGroups}/${GOVERNOR_MAX_DEBT_GROUPS} (${governor.quiescentGroups} quiescent)`),
     ...RATE_RESOURCES.map((resource) => {
       const detail = governor.resources[resource];
       return field(
@@ -11571,8 +11731,10 @@ const KEY_TABLE = [
   ["Enter", "Open the selected item or accept a prompt"],
   ["r", "Refresh the current tab when a safe grant is available"],
   ["R", "Resynchronize the current tab, ignoring cached validators and backoff"],
+  ["s", "Actions: read-only setup check (standalone only; saved for five minutes)"],
+  ["g", "Actions: open the selected repository Actions page"],
   ["w", "Adjust table column widths"],
-  ["?", "Show the keys (any key closes it)"],
+  ["?", "Open / close contextual help; n / p changes page"],
   ["q / Esc / Ctrl+C", "Quit (Esc leaves width mode)"],
 ];
 const KEY_COL = Math.max(...KEY_TABLE.map(([k]) => k.length)) + 3;
@@ -11594,6 +11756,8 @@ const HELP_PRIORITY = [
   "Tab / Shift+Tab",
   "PgUp / PgDn",
   "R",
+  "s",
+  "g",
 ];
 
 function helpLines(maxRows) {
@@ -15042,7 +15206,7 @@ function createAcquisitionEngine({
       ledger.debt[resource].unresolvedUnits + ledger.debt[resource].quiescentUnits +
         reservationCost(ledger.controlReceipts[resource], resource, ledger.leases, now()))]));
     if (Object.values(units).some((value) => !Number.isSafeInteger(value) || value < 0)) {
-      return { ok: false, reason: "accounting-overflow" };
+      return ACCOUNTING_OVERFLOW;
     }
     return transact((state) => {
       const activeKeys = new Set(Object.values(state.subscriptions)
@@ -15623,6 +15787,14 @@ function coordinationNotice(reason) {
 const RECOVERY_JOURNAL_MAX_ENTRIES = 128;
 const RECOVERY_JOURNAL_MAX_BYTES = 128 * 1024;
 const RECOVERY_ENTRY_MAX_BYTES = 1024;
+// Reasons that no retry can clear: the ledger itself must be repaired. The
+// runtime keeps them sticky and doctor names the manual remedy for them.
+const HARD_STORAGE_REASONS = Object.freeze(["corrupt", "unwritable", "capacity", "accounting-overflow"]);
+// A source failure on a tab may be superseded by these coordination causes.
+const STICKY_OVER_SOURCE_REASONS = Object.freeze([...HARD_STORAGE_REASONS, "receipt-retry", "interrupted-request"]);
+const LEDGER_REPAIR_ADVICE = "quit every gh-glance pane, then move the state file, its .recovery.json and " +
+  "registry.json out of that directory and relaunch; a fresh ledger starts, and at most the receipt and " +
+  "debt units below (when shown) may be spent twice this hour";
 const RECOVERY_COPY = Object.freeze({
   busy: ["Coordinating with your other panes", "Retry automatically", "Other pane; retry"],
   stale: ["Coordinating with your other panes", "Retry automatically", "Other pane; retry"],
@@ -15632,6 +15804,7 @@ const RECOVERY_COPY = Object.freeze({
   corrupt: ["Local coordination is corrupt", "Run gh-glance --doctor; preserve the reported state file", "State corrupt; doctor"],
   capacity: ["Local coordination is full", "Run gh-glance --doctor; preserve the reported state file", "State full; doctor"],
   "accounting-overflow": ["Local coordination accounting overflow", "Run gh-glance --doctor; preserve the reported state file", "Overflow; doctor"],
+  "debt-journal-full": ["Local coordination journal is full", "Retry automatically; older requests settle within an hour", "Journal full; retry"],
   "reservations-invalid": ["Local coordination reservation invalid", "Run gh-glance --doctor; preserve the reported state file", "Reservation; doctor"],
   "external-factor-invalid": ["Local coordination budget invalid", "Run gh-glance --doctor; preserve the reported state file", "Budget invalid; doctor"],
   "pacing-invalid": ["Local coordination pacing invalid", "Run gh-glance --doctor; preserve the reported state file", "Pacing invalid; doctor"],
@@ -15715,8 +15888,8 @@ function shouldClearRecoveryCause(cause, { sourceSuccess = false, tab = null, sc
 
 function recoveryRetryAt(decision, budget, observer, nowMs) {
   if (budget?.blockUntil > nowMs) return budget.blockUntil;
-  if (["reservations-invalid", "external-factor-invalid", "pacing-invalid", "budget-resource",
-    "accounting-overflow", "corrupt", "unwritable", "capacity"].includes(decision?.reason)) return null;
+  if ([...HARD_STORAGE_REASONS, "reservations-invalid", "external-factor-invalid", "pacing-invalid",
+    "budget-resource"].includes(decision?.reason)) return null;
   const resetHold = ["budget-reset", "reset", "rate-limit"].includes(decision?.reason);
   if (decision?.mode === "probe" && !resetHold) {
     return observer?.nextAt > nowMs ? observer.nextAt : null;
@@ -15760,12 +15933,14 @@ function cleanupQueueForResource(queue, resource) {
   return count;
 }
 
-function presentRecovery(cause, { nowMs = Date.now(), cols = 80 } = {}) {
+function presentRecovery(cause, { nowMs = Date.now(), cols = 80, hasSnapshot } = {}) {
   if (!cause) return [];
   const width = Math.max(1, Number.isSafeInteger(cols) ? cols - 1 : 79);
   const resource = cause.resource === "graphql" ? "GraphQL" : cause.resource === "core" ? "Core" : "GitHub";
-  const age = Number.isFinite(cause.sourceAt) && cause.sourceAt <= nowMs
-    ? `cached ${formatDuration(nowMs - cause.sourceAt)}` : "cached age unavailable";
+  const age = hasSnapshot === false ? "Not checked yet"
+    : Number.isFinite(cause.sourceAt) && cause.sourceAt <= nowMs
+      ? `cached ${formatDuration(nowMs - cause.sourceAt)}`
+      : hasSnapshot === true ? "Last-check time unavailable" : "cached age unavailable";
   const retry = Number.isFinite(cause.retryAt)
     ? `; next ${statusInterval(cause.retryAt, nowMs)}` : "";
   const summary = cause.code === "legacy-unresolved" && Number.isSafeInteger(cause.debtUnits)
@@ -15800,6 +15975,189 @@ function presentRecovery(cause, { nowMs = Date.now(), cols = 80 } = {}) {
     `${cause.action}${retry}`.slice(0, width), age.slice(0, width)];
 }
 
+// Presentation consumes source observations, never receipt or cache-load clocks.
+function dashboardPresentation({ tab, rows = null, hasSnapshot = rows !== null,
+  sourceAt = null, nowMs = Date.now(), overdue = false, onDemand = false,
+  requestState = "idle", error = false, recovery = null, disconnected = false,
+  securityNotes = [], securityAllUnavailable = false, target = null, diagnostic = null } = {}) {
+  const label = TABS.find((candidate) => candidate.key === tab)?.label ?? "Repository";
+  const empty = { actions: "No workflow runs found", issues: "No open issues",
+    prs: "No open pull requests", security: "No alerts returned by the checked sources" };
+  const lastEmpty = { actions: "Last check found no workflow runs.", issues: "Last check found no open issues.",
+    prs: "Last check found no open pull requests.", security: "Last check returned no alerts from the checked sources." };
+  const sourceCheck = !hasSnapshot ? "Not checked yet"
+    : !Number.isFinite(sourceAt) || sourceAt > nowMs ? "Last-check time unavailable"
+      : (() => {
+        const date = new Date(sourceAt);
+        const today = new Date(nowMs);
+        const day = date.toDateString() === today.toDateString() ? ""
+          : `${date.getFullYear()}-${String(date.getMonth() + 1).padStart(2, "0")}-${String(date.getDate()).padStart(2, "0")} `;
+        return `Checked ${day}${String(date.getHours()).padStart(2, "0")}:${String(date.getMinutes()).padStart(2, "0")}`;
+      })();
+  const showTable = Array.isArray(rows) && rows.length > 0;
+  const failed = Boolean(error || disconnected);
+  const held = Boolean(recovery) || requestState === "waiting";
+  let state = "ready";
+  let title = showTable ? label : empty[tab] ?? label;
+  let explanation = tab === "actions"
+    ? "Actions shows automated jobs. A push starts a run only when a workflow has a matching trigger."
+    : "GitHub returned this result for the selected repository.";
+  let action = "Press r to refresh.";
+  if (failed) {
+    state = "failed";
+    title = `Could not ${hasSnapshot ? "refresh" : "load"} ${label}`;
+  } else if (held) {
+    state = "waiting";
+    title = hasSnapshot ? `Waiting to update ${label}` : `Waiting to check ${label}`;
+  } else if (!hasSnapshot) {
+    state = requestState === "loading" ? "loading" : "waiting";
+    title = state === "loading" ? `Checking ${label}…` : `Waiting to check ${label}`;
+    explanation = `Fetching this repository's ${tab === "actions" ? "workflow runs" : label.toLowerCase()}.`;
+  } else if (overdue && !onDemand) {
+    state = "overdue";
+    title = `${label} needs an update`;
+  } else if (onDemand) {
+    state = "saved";
+    title = `Saved ${label} view`;
+    action = "Press r to check again. This view checks when opened or refreshed.";
+  }
+  if ((failed || held || state === "overdue" || state === "saved") && hasSnapshot && !showTable) {
+    explanation = lastEmpty[tab] ?? "Showing the last checked result.";
+  } else if ((failed || held) && !hasSnapshot) {
+    explanation = "No successful check is available yet.";
+  }
+  if (recovery) {
+    explanation = `${recovery.summary}. ${explanation}`;
+    action = recovery.action + (Number.isFinite(recovery.retryAt)
+      ? `; next ${statusInterval(recovery.retryAt, nowMs)}` : "");
+  }
+  if (tab === "security" && securityAllUnavailable) {
+    if (!failed && !held) title = "No alert sources available";
+    explanation = `${recovery ? `${recovery.summary}. ` : ""}No alert source returned data for this check.`;
+  }
+  return { state, title, explanation, sourceCheck, action, showTable, target,
+    notes: [...(diagnostic ? [diagnostic] : []), ...(tab === "security" ? securityNotes : [])] };
+}
+
+// Panels contain sanitized display text. Width follows terminal cells, including
+// wide Unicode characters; combining marks stay with the preceding character.
+function panelCellWidth(char) {
+  const code = char.codePointAt(0);
+  return /\p{Mark}/u.test(char) || code === 0x200d || code === 0xfe0f ? 0
+      : code >= 0x1100 && (code <= 0x115f || code === 0x2329 || code === 0x232a ||
+        code >= 0x2e80 && code <= 0xa4cf || code >= 0xac00 && code <= 0xd7a3 ||
+        code >= 0xf900 && code <= 0xfaff || code >= 0xfe10 && code <= 0xfe6f ||
+        code >= 0xff00 && code <= 0xff60 || code >= 0xffe0 && code <= 0xffe6 || code >= 0x1f300) ? 2 : 1;
+}
+
+function wrapPanelText(text, width) {
+  const limit = Math.max(1, width);
+  const lines = [];
+  let line = "";
+  let cells = 0;
+  for (const char of safe(text)) {
+    const size = panelCellWidth(char);
+    if (cells + size > limit && line) {
+      const space = line.lastIndexOf(" ");
+      if (space > 0 && char !== " ") {
+        lines.push(line.slice(0, space));
+        line = line.slice(space + 1);
+        // The retained word contains the same glyphs already measured above.
+        cells = [...line].reduce((sum, glyph) => sum + panelCellWidth(glyph), 0);
+      } else { lines.push(line.trimEnd()); line = ""; cells = 0; }
+    }
+    if (!line && char === " ") continue;
+    line += char;
+    cells += size;
+  }
+  if (line) lines.push(line.trimEnd());
+  return lines;
+}
+
+function contextualPanelLayout(view, { cols, rows } = {}) {
+  const width = Math.max(1, cols - 5);
+  const capacity = Math.max(1, rows - 6);
+  const title = wrapPanelText(view.title, width);
+  // Keep a short required remedy before explanation when the body is cramped.
+  const action = capacity < 8 && /gh-glance --doctor/.test(view.action)
+    ? "gh-glance --doctor" : view.action;
+  const lines = [view.title, action, view.sourceCheck, ...view.notes, view.explanation]
+    .flatMap((line) => wrapPanelText(line, width));
+  // A long title cannot consume the only row available for the recovery action.
+  if (title.length >= capacity && capacity > 1) {
+    return [...title.slice(0, capacity - 1), ...wrapPanelText(action, width).slice(0, 1)];
+  }
+  return lines.slice(0, capacity);
+}
+
+// Selection is already resolved for acquisition. Displaying it must not ask gh
+// to resolve it again, or imply that the selected account can access it.
+function dashboardTarget({ repository = effectiveRuntimeRepository(), host = effectiveRuntimeHost() } = {}) {
+  // These identifiers have a strict ASCII grammar. Validate the entire value
+  // instead of applying the shorter retention limit for remote display fields.
+  const slug = typeof repository === "string" && REPO_PATTERN.exec(repository)?.[0] === repository
+    ? repository : null;
+  const selectedHost = normalizeHost(host);
+  return { repository: slug, host: selectedHost,
+    label: slug ? selectedHost && selectedHost !== "github.com" ? `${selectedHost}/${slug}` : slug
+      : "Repository unresolved" };
+}
+
+function clampHelpPage(index, count) {
+  return Math.max(0, Math.min(Number.isSafeInteger(index) ? index : 0, Math.max(0, count - 1)));
+}
+
+function contextHelpPages({ view, target, tab, remoteSetup = false }, keys = keyTableLines(), width = 75, height = 18) {
+  const cols = Math.max(1, Math.trunc(width));
+  const rows = Math.max(1, Math.trunc(height));
+  const controlRows = cols >= 48 ? 1 : 2;
+  const capacity = rows - controlRows;
+  if (capacity < 1) return [[...wrapPanelText("q Quit", cols)].slice(0, rows)];
+  const meaning = {
+    actions: "Actions shows automated jobs. A push starts a run only when a workflow has a matching trigger.",
+    issues: "Issues shows open issues in the selected repository.",
+    prs: "Pull requests shows open requests to merge changes into the selected repository.",
+    security: "Security shows alerts returned by the checked sources; unavailable sources can hide alerts.",
+  };
+  const title = remoteSetup ? "No GitHub remote found" : view.title;
+  const action = remoteSetup ? "Close help with ?, then Enter to start gh repo create; or restart with gh-glance --repo owner/name."
+    : view.action;
+  // Wrap validated identity in bounded chunks so the remote-field sanitizer
+  // cannot clip a long accepted target or consume its tail with a label prefix.
+  const targetLines = [["Target", target.repository ?? target.label], ["Host", target.host ?? "unresolved"]]
+    .flatMap(([label, value]) => {
+      const text = `${label}: ${value}`;
+      const wrapped = [];
+      for (let offset = 0; offset < text.length; offset += MAX_FIELD_LENGTH) {
+        wrapped.push(...wrapPanelText(text.slice(offset, offset + MAX_FIELD_LENGTH), cols));
+      }
+      return wrapped;
+    });
+  const context = [title, action, view.sourceCheck,
+    ...targetLines,
+    "Target selection does not confirm access.",
+    ...(!target.repository ? ["Restart with gh-glance --repo owner/name."] : []),
+    meaning[tab] === view.explanation ? null : meaning[tab], view.explanation, ...view.notes,
+    "Other keys close help without performing their usual action.",
+    "Keys (after closing help)", ...keys].filter(Boolean);
+  const lines = context.flatMap((line) => wrapPanelText(line, cols));
+  const chunks = [];
+  // Narrow pages need room for navigation and quit. A compact first page keeps
+  // the immediate state/remedy visible; all complete text follows unabridged.
+  const priority = [title, action].flatMap((line) => wrapPanelText(line, cols));
+  if (priority.length > capacity && capacity >= 2) {
+    const shortAction = /gh-glance --doctor/.test(action) ? "gh-glance --doctor"
+      : /gh auth/.test(action) ? "gh auth status" : remoteSetup ? "? then Enter"
+        : /^Press r/.test(action) ? "Close ?, then r" : action;
+    chunks.push([wrapPanelText(title, cols)[0], wrapPanelText(shortAction, cols)[0]]);
+  }
+  for (let offset = 0; offset < lines.length; offset += capacity) chunks.push(lines.slice(offset, offset + capacity));
+  return chunks.map((chunk, index) => [...chunk,
+    ...(controlRows === 1
+      ? [`${index + 1}/${chunks.length} n next p prev ? close q/Esc/^C quit`]
+      : [`${index + 1}/${chunks.length} n/p ?close`, "q/Esc/^C quit"])]);
+}
+
 function recoveryJournalPath(scope) {
   return `${scope.path}.recovery.json`;
 }
@@ -16406,6 +16764,7 @@ const KEY_HINTS = [
   { label: "Refresh", keys: "r" },
   { label: "Width", keys: "w" },
   { label: "Quit", keys: "q" },
+  { label: "Help", keys: "?" },
 ];
 
 function activeKeyHints({
@@ -16428,6 +16787,7 @@ function activeKeyHints({
 const REMOTE_SETUP_HINTS = [
   { label: "Create remote", keys: "Ent" },
   { label: "Quit", keys: "q" },
+  { label: "Help", keys: "?" },
 ];
 
 const REMOTE_SETUP_LINES = [
@@ -16451,7 +16811,6 @@ const WIDE_STATE_WIDTH = REFRESH_STATUS_WIDTH + 1 + 12;
 // StatusBar receives the drawable frame width, which is one column narrower
 // than the terminal. A 44-cell threshold preserves the 45-column contract.
 const WIDE_STATE_MIN_COLS = 44;
-const NOTICE_ROWS = 1;
 
 const REFRESH_STATUS_GLYPHS = Object.freeze({
   unicode: Object.freeze({
@@ -16473,7 +16832,7 @@ const REFRESH_STATUS_GLYPHS = Object.freeze({
 });
 
 function isMandatoryHint(hint) {
-  return hint?.label === "Refresh" || hint?.label === "Quit";
+  return hint?.label === "Refresh" || hint?.label === "Quit" || hint?.label === "Help";
 }
 
 function refreshStatus({
@@ -16597,7 +16956,7 @@ function statusBarLayout({
   for (const [index, hint] of mandatory.entries()) {
     // A full label is optional; every essential key is not. Reserve one
     // separator and the key itself for each action still to come before taking
-    // the current action's long form. This keeps both r and q at the 24-column
+    // the current action's long form. This keeps r, q and ? at the 24-column
     // terminal minimum, whose drawable frame is 23 cells wide.
     const remainingMinimum = mandatory.slice(index + 1).reduce(
       (total, candidate) => total + 1 + [...candidate.keys].length,
@@ -17006,10 +17365,13 @@ function App({ onCreateRemote = () => {} } = {}) {
   // The `?` overlay. Renders only on a keypress, so consecutive idle frames are
   // still byte-identical and the redraw suppression is untouched.
   const [showHelp, setShowHelp] = useState(false);
+  const [helpPage, setHelpPage] = useState(0);
   // Set once, ICON_HINT_AFTER_MS into a first load that is still running. Never
   // reset: it only gates a line that a resolved tab stops rendering anyway, and
   // clearing it would cost a second state write for no visible difference.
   const [iconHintDue, setIconHintDue] = useState(false);
+  const [actionsSetup, setActionsSetup] = useState({});
+  const actionsSetupRef = useRef(null);
   const [errors, setErrors] = useState({ actions: null, issues: null, prs: null, security: null });
   const [failureContext, setFailureContext] = useState(null);
   const [loading, setLoading] = useState({ actions: false, issues: false, prs: false, security: false });
@@ -17064,6 +17426,9 @@ function App({ onCreateRemote = () => {} } = {}) {
   // transient, and they are the ones worth the space. Derived here at render
   // time rather than cached alongside the notes, because the unchanged-payload
   // short-circuit can skip parse() entirely and a cached string would go stale.
+  // Each unsuccessful source contributes one note; successful sources contribute
+  // none (truncation is separate). Count before collapsing disabled-source notes.
+  const securityAllUnavailable = securityNotes.length === ALERT_SOURCES.length;
   const NOT_ENABLED = /not enabled/i;
   const disabledNotes = securityNotes.filter((n) => NOT_ENABLED.test(n));
   const otherNotes = securityNotes.filter((n) => !NOT_ENABLED.test(n));
@@ -17074,19 +17439,173 @@ function App({ onCreateRemote = () => {} } = {}) {
           ...otherNotes,
         ]
       : securityNotes;
-  // Counts the lines actually rendered, not the notes collected -- getting this
-  // wrong by one row is what makes ink repaint the whole frame.
-  const extraLines =
-    (activeRecovery || tabError || activeGovernorDecision?.coordinationError ||
-      activeGovernorDecision?.mode === "paused" || activeGovernorDecision?.disconnected ||
-      data[tab.key] !== null && !runtimeIdentityCoordinator?.current()
-      ? 3 : NOTICE_ROWS) +
-    (tab.key === "security" && !remoteSetup ? securityLines.length : 0);
-  // Reserve lines for: the tab bar and the divider under it (2), the panel's
-  // top and bottom edges (2), the column header and its separator (2), and
-  // the status line (1), plus a 1-line safety margin. Slack is absorbed by
-  // the spacer in the tree below.
-  const bodyRows = Math.max(1, rows - 8 - extraLines);
+  const admittedCadenceRef = useRef({});
+  // Last *successful* poll per tab, wall-clock. Wall-clock on purpose: a laptop
+  // sleeping is exactly the gap this is meant to report, and a monotonic clock
+  // does not advance across suspend. Never written on the failure path, or a
+  // persistently failing tab would report itself fresh forever.
+  const lastOkRef = useRef(
+    Object.fromEntries(
+      TABS.flatMap((candidate) => {
+        const cachedTab = cachedEntry?.tabs[candidate.key];
+        const cachedAge = collectorCachedSourceAge(cachedTab);
+        const lastOk = cachedAge === null ? cachedTab?.lastOk : Date.now() - cachedAge;
+        return lastOk == null ? [] : [[candidate.key, lastOk]];
+      }),
+    ),
+  );
+  const collectorSourceAgeRef = useRef(Object.fromEntries(TABS.flatMap((candidate) => {
+    const cachedTab = cachedEntry?.tabs[candidate.key];
+    const ageMs = collectorCachedSourceAge(cachedTab);
+    return ageMs === null ? [] : [[candidate.key, { ageMs, measuredAt: performance.now() }]];
+  })));
+  const statusDisconnected = runtime.connect !== null
+    ? activeGovernorDecision?.disconnected === true
+    : data[tab.key] !== null && !runtimeIdentityCoordinator?.current();
+  const items = data[tab.key];
+  const displayError = formatTabErrorForWidth(tabError, failureContext, Math.max(1, cols - 5));
+  const coordinationError = activeGovernorDecision?.coordinationError && !remoteSetup;
+  const coordinationReason = activeFailure ?? activeGovernorDecision?.reason ?? "unavailable";
+  const noticeReason = activeRecovery?.code ??
+    (tabError?.kind === "fetch" ? tabError.verdict : null) ??
+    (coordinationError || activeGovernorDecision?.mode === "paused" ? coordinationReason : null) ??
+    (statusDisconnected ? runtime.connect === null ? "identity-unavailable"
+      : activeGovernorDecision?.reason === "app-auth" ? "app-auth" : "disconnected" : null);
+  // A continuous fault stays sustained when its explanation becomes more
+  // specific. Only losing the fault (or switching tabs) restarts the debounce.
+  const coordinationCondition = !remoteSetup && noticeReason ? tab.key : null;
+  useEffect(() => {
+    setVisibleCoordinationCondition(null);
+    if (coordinationCondition === null) return;
+    const timer = setTimeout(
+      () => setVisibleCoordinationCondition(coordinationCondition),
+      COORDINATION_NOTICE_AFTER_MS,
+    );
+    return () => clearTimeout(timer);
+  }, [coordinationCondition]);
+  const showCoordinationNotice = coordinationCondition !== null &&
+    visibleCoordinationCondition === coordinationCondition;
+  const noticeResource = activeResource;
+  const noticeSourceAt = collectorSourceAgeRef.current[tab.key]
+    ? now.getTime() - collectorSourceAgeRef.current[tab.key].ageMs -
+      Math.max(0, performance.now() - collectorSourceAgeRef.current[tab.key].measuredAt)
+    : lastOkRef.current[tab.key] ?? null;
+  const noticeCause = activeRecovery ?? (noticeReason ? recoveryCause({
+    reason: noticeReason === "other" ? "network-outage" : noticeReason,
+    resource: noticeResource, sourceAt: noticeSourceAt,
+    retryAt: activeGovernorDecision?.retryAt ?? activeGovernorDecision?.resetMs ??
+      activeGovernorDecision?.notBefore ?? null,
+    origin: tabError ? "source" : "coordination", tab: tabError ? tab.key : null,
+  }) : null);
+  const recoveryLines = showCoordinationNotice && noticeCause
+    ? presentRecovery(noticeCause, { nowMs: now.getTime(), cols, hasSnapshot: items !== null })
+    : [!remoteSetup && displayError ? displayError : ""];
+  const noticeTone = showCoordinationNotice ? ATTENTION : displayError ? ERROR_TEXT : undefined;
+  // Data can be arbitrarily old without anything on screen saying so: a failing
+  // poll only surfaces on the tab you have selected, and after a laptop sleep
+  // every pane is plausible and wrong. Threshold-gated and minute-granular on
+  // purpose -- see STALE_AFTER_MS.
+  // Read from the ref written on every successful poll, not from meta.at, which
+  // only moves when the *payload* changes -- see lastOkRef. Reading a ref during
+  // render lags by one render, which is harmless here because `now` advances on
+  // its own and the label is minute-granular by design.
+  const collectorAge = collectorSourceAgeRef.current[tab.key];
+  const sourceAgeMs = collectorAge
+    ? collectorAge.ageMs + Math.max(0, performance.now() - collectorAge.measuredAt)
+    : null;
+  const lastOk = sourceAgeMs === null ? lastOkRef.current[tab.key] : now.getTime() - sourceAgeMs;
+  const staleFor = sourceAgeMs ?? (lastOk == null ? null : now.getTime() - lastOk);
+  const staleAt = freshnessDeadline({
+    lastOk,
+    refreshMs: runtime.refreshMs,
+    grantedMs: admittedCadenceRef.current[tab.key]?.grantedMs,
+    governorDecision: activeGovernorDecision,
+    currentEpochs: governorEpochs,
+  });
+  const staleLabel =
+    staleFor != null && staleAt != null && now.getTime() > staleAt
+      ? formatDuration(staleFor)
+      : null;
+  // A quiet dashboard's display clock can precede a newly completed request.
+  // Compare source clocks with actual render time, without adding a timer.
+  const presentationNow = Date.now();
+  const selectedTarget = dashboardTarget();
+  const presentation = dashboardPresentation({
+    tab: tab.key, rows: items, hasSnapshot: items !== null,
+    sourceAt: sourceAgeMs === null ? lastOk : presentationNow - sourceAgeMs,
+    nowMs: presentationNow, overdue: Boolean(staleLabel),
+    onDemand: runtime.background === "on-demand" && tab.key !== "actions" &&
+      items !== null && !loading[tab.key] && !activeRequestStatus,
+    requestState: loading[tab.key] || activeRequestStatus ? "loading"
+      : items === null && waiting[tab.key] ? "waiting" : "idle",
+    error: tabError || activeFailure, recovery: noticeCause, diagnostic: displayError,
+    disconnected: statusDisconnected, securityNotes: securityLines, securityAllUnavailable,
+    target: selectedTarget.label,
+  });
+  const setupView = tab.key === "actions" ? actionsSetupPresentation(actionsSetup, presentationNow) : null;
+  if (tab.key === "actions") {
+    const url = actionsPageUrl(selectedTarget);
+    if (runtime.connect !== null && setupView.title && (statusDisconnected || noticeCause || tabError)) {
+      setupView.action = `${statusDisconnected ? "Restore connection;" : presentation.action} g Actions; ? Help`;
+    }
+    const showSetupPanel = !presentation.showTable && !remoteSetup &&
+      ((presentation.state === "ready" && !showCoordinationNotice) || runtime.connect !== null);
+    presentation.notes.push(...(setupView.title && !showSetupPanel ? [setupView.title] : []), ...setupView.notes,
+      "Close help with ?, then press s for a read-only setup check or g to open Actions.",
+      ...(url ? [url] : ["Restart with gh-glance --repo owner/name."]));
+    if (showSetupPanel) {
+      if (setupView.title) {
+        presentation.notes.push(`Runs: ${presentation.title}`, presentation.action);
+        presentation.title = setupView.title;
+      }
+      if (setupView.title) presentation.sourceCheck = `Runs: ${presentation.sourceCheck}`;
+      if (setupView.title || presentation.state === "ready") presentation.action = setupView.action;
+    }
+  }
+  if (USING_NERD_ICONS && iconHintDue && items === null && !tabError) {
+    presentation.notes.push("Icons blank? GH_GLANCE_ICONS=unicode");
+  }
+  const panelLines = presentation.showTable ? [] : contextualPanelLayout(presentation, { cols, rows });
+
+  const tableVisible = Array.isArray(items) && items.length > 0;
+  const tableNoticeCapacity = Math.max(0, rows - 9);
+  const needsTableContext = ["failed", "overdue", "waiting"].includes(presentation.state);
+  const shortAction = /gh-glance --doctor/.test(presentation.action) ? "gh-glance --doctor"
+    : /gh auth/.test(presentation.action) ? "Run gh auth status" : presentation.action;
+  const tableNotices = needsTableContext
+    ? tableNoticeCapacity < 4
+      ? tableNoticeCapacity === 1 ? [shortAction]
+        : showCoordinationNotice && noticeCause
+          ? [noticeCause.summary, shortAction, presentation.sourceCheck]
+          : [shortAction, presentation.sourceCheck, presentation.title]
+      : [presentation.title, presentation.sourceCheck, ...recoveryLines.filter(Boolean)]
+    : recoveryLines;
+  const noticeLines = [...new Set([...(showCoordinationNotice ? tableNotices : []),
+    ...(setupView?.title ? [setupView.title, setupView.action, ...setupView.notes] : []),
+    ...tableNotices])].slice(0, tableNoticeCapacity);
+  const visibleSecurityLines = tab.key === "security"
+    ? securityLines.slice(0, Math.max(0, tableNoticeCapacity - noticeLines.length)) : [];
+  const extraLines = !showHelp && !remoteSetup && tableVisible
+    ? noticeLines.length + visibleSecurityLines.length : 0;
+  // Tab strip, divider, frame edges, footer and terminal guard use six rows.
+  // Table headers alone need two more. The same budget drives navigation.
+  const bodyRows = Math.max(1, rows - 6 - (tableVisible && !showHelp ? 2 : 0) - extraLines);
+  let helpPages = [];
+  if (showHelp) {
+    const fullDiagnostic = formatTabError(tabError, failureContext);
+    const helpView = { ...presentation, notes: [
+      ...(fullDiagnostic ? [fullDiagnostic] : []),
+      ...presentation.notes.filter((note) => note !== displayError),
+    ] };
+    helpPages = contextHelpPages({ view: helpView, target: selectedTarget,
+      tab: tab.key, remoteSetup }, keyTableLines(), cols - 5, bodyRows);
+  }
+  const visibleHelpPage = clampHelpPage(helpPage, helpPages.length);
+  const helpPageRef = useRef({ index: 0, count: 0 });
+  helpPageRef.current = { index: visibleHelpPage, count: helpPages.length };
+  useEffect(() => {
+    if (helpPage !== visibleHelpPage) setHelpPage(visibleHelpPage);
+  }, [helpPage, visibleHelpPage]);
 
   // Read at fetch time rather than being a hook dependency, so dragging the
   // pane wider doesn't cancel and restart in-flight requests -- the next tick
@@ -17109,28 +17628,8 @@ function App({ onCreateRemote = () => {} } = {}) {
     ANIMATE && tab.key === "actions" && (data.actions ?? []).some((r) => r.status === "in_progress");
 
   const inFlightRef = useRef({});
-  const admittedCadenceRef = useRef({});
   const rawRef = useRef({});
   const entityRef = useRef(new Map());
-  // Last *successful* poll per tab, wall-clock. Wall-clock on purpose: a laptop
-  // sleeping is exactly the gap this is meant to report, and a monotonic clock
-  // does not advance across suspend. Never written on the failure path, or a
-  // persistently failing tab would report itself fresh forever.
-  const lastOkRef = useRef(
-    Object.fromEntries(
-      TABS.flatMap((candidate) => {
-        const cachedTab = cachedEntry?.tabs[candidate.key];
-        const cachedAge = collectorCachedSourceAge(cachedTab);
-        const lastOk = cachedAge === null ? cachedTab?.lastOk : Date.now() - cachedAge;
-        return lastOk == null ? [] : [[candidate.key, lastOk]];
-      }),
-    ),
-  );
-  const collectorSourceAgeRef = useRef(Object.fromEntries(TABS.flatMap((candidate) => {
-    const cachedTab = cachedEntry?.tabs[candidate.key];
-    const ageMs = collectorCachedSourceAge(cachedTab);
-    return ageMs === null ? [] : [[candidate.key, { ageMs, measuredAt: performance.now() }]];
-  })));
   // Keep server source timestamps separate from client-local age estimates.
   // An SSH receipt's age is measured on the client and cannot prove a new
   // source observation when a cached snapshot is delivered again.
@@ -17426,6 +17925,25 @@ function App({ onCreateRemote = () => {} } = {}) {
   const [openRequests] = useState(() => createOpenRequestRegistry());
   useEffect(() => () => openRequests.abortAll(), [openRequests]);
 
+  function openActionsPage() {
+    const target = dashboardTarget();
+    const url = actionsPageUrl(target);
+    if (!url) {
+      setActionsSetup((state) => ({ ...state, message: "Restart with gh-glance --repo owner/name." }));
+      return;
+    }
+    const accessKey = runtimeIdentityCoordinator?.current()?.accessKey;
+    openRequests.start(`actions-page:${url}`, ({ signal }) => openBrowserUrl(url, signal))?.then(() => {
+      if (actionsPageUrl() === url && runtimeIdentityCoordinator?.current()?.accessKey === accessKey) {
+        setActionsSetup((state) => ({ ...state, message: null, title: null, action: null }));
+      }
+    }).catch((err) => {
+      if (err?.name === "AbortError" || actionsPageUrl() !== url ||
+          runtimeIdentityCoordinator?.current()?.accessKey !== accessKey) return;
+      setActionsSetup((state) => ({ ...state, title: "Actions page unavailable", action: "g Retry; ? Details", message: `Could not open Actions: ${shortErr(err)}. Press g to retry.` }));
+    });
+  }
+
   function openSelected() {
     const { items, key: currentKey, tabKey } = navRef.current;
     const item = items.find((i) => itemKey(i) === currentKey);
@@ -17480,13 +17998,19 @@ function App({ onCreateRemote = () => {} } = {}) {
         flushWidthPreferences();
         exit();
       } else if (showHelpRef.current) {
-        // Any key dismisses -- except quit, handled above, which must never be
-        // swallowed by a modal in a full-screen app. Deliberately does not fall
-        // through to the binding the key would normally trigger: closing the
-        // overlay is the whole intent of that press.
-        setShowHelp(false);
+        // Paging belongs to the modal. Every other ordinary key closes it and
+        // is consumed; quit remains global and width mode retains its ownership.
+        if (input === "n" || input === "p") {
+          setHelpPage(clampHelpPage(helpPageRef.current.index + (input === "n" ? 1 : -1),
+            helpPageRef.current.count));
+        } else setShowHelp(false);
       } else if (input === "?") {
+        setHelpPage(0);
         setShowHelp(true);
+      } else if (input === "s" && TABS[activeIndexRef.current].key === "actions") {
+        void actionsSetupRef.current?.();
+      } else if (input === "g" && TABS[activeIndexRef.current].key === "actions") {
+        openActionsPage();
       } else if (input === "w") {
         enterWidthMode();
       } else if (key.downArrow || input === "j") {
@@ -17510,7 +18034,7 @@ function App({ onCreateRemote = () => {} } = {}) {
         // which is exactly when the key is most likely to be pressed.
         const request = manualRefreshRequest(refreshIntent(input));
         if (request) fetchTabRef.current?.(TABS[activeIndexRef.current].key, request);
-      } else if (input >= "1" && input <= String(TABS.length)) {
+      } else if (input.length === 1 && input >= "1" && input <= String(TABS.length)) {
         setActiveIndex(Number(input) - 1);
       } else if (key.tab && key.shift) {
         setActiveIndex((i) => (i - 1 + TABS.length) % TABS.length);
@@ -17615,14 +18139,16 @@ function App({ onCreateRemote = () => {} } = {}) {
         reason, resource, at, retryAt, sourceAt: lastOkRef.current[key] ?? null,
         origin, tab: origin === "source" ? key : null,
       });
-      const hardFailure = ["corrupt", "unwritable", "capacity", "accounting-overflow"].includes(candidate.code);
+      const hardFailure = HARD_STORAGE_REASONS.includes(candidate.code);
+      // Contention does not prove that previously unreadable storage recovered.
+      // The existing healthy-control/source-success paths clear that remedy.
+      if (!hardFailure && HARD_STORAGE_REASONS.includes(previous?.code)) return;
       if (!hardFailure && previous?.code === "receipt-retry" &&
           terminalizationBacklogForResource(terminalizationBacklog, scope?.hash, resource) > 0) return;
       if (!hardFailure && previous?.code === "request-queue" &&
           cleanupQueueForResource(cleanupQueue, resource) > 0) return;
       if (previous?.origin === "source" && previous.tab === key && origin === "coordination" &&
-          !["corrupt", "unwritable", "capacity", "accounting-overflow",
-            "receipt-retry", "interrupted-request"].includes(candidate.code)) return;
+          !STICKY_OVER_SOURCE_REASONS.includes(candidate.code)) return;
       if (previous?.code === candidate.code && previous?.retryAt === candidate.retryAt &&
           previous?.origin === candidate.origin && previous?.tab === candidate.tab &&
           at - previous.at < 60_000) return;
@@ -17715,6 +18241,7 @@ function App({ onCreateRemote = () => {} } = {}) {
     // scheduler out, and the Enter hint hands off to `gh repo create`.
     function enterRemoteSetup() {
       if (!runtimeHasNoRepositoryTarget()) return false;
+      retireSetup();
       const failure = toTabError(new Error(NO_REMOTE_ERROR_TEXT));
       setErrors(Object.fromEntries(TABS.map((t) => [t.key, failure])));
       return true;
@@ -17734,8 +18261,11 @@ function App({ onCreateRemote = () => {} } = {}) {
       if (!refreshed?.ok && !tabReady) {
         const resource = RATE_RESOURCES.find((candidate) => tabRequestCost(key)[candidate] > 0 &&
           snapshot.value.observers[candidate]?.outcome !== "healthy");
+        // A rejected mutation writes nothing, so the observer's stored nextAt
+        // predates the failure; a failure that names its own retry time wins.
         pauseCoordination(key, refreshed?.reason, "observer", false,
-          resource ? snapshot.value.observers[resource]?.nextAt : null);
+          Number.isFinite(refreshed?.retryAt) ? refreshed.retryAt
+            : resource ? snapshot.value.observers[resource]?.nextAt : null);
         return;
       }
       publishGovernorEpochs(snapshot);
@@ -18110,7 +18640,7 @@ function App({ onCreateRemote = () => {} } = {}) {
         .finally(() => {
           inFlightRef.current[key] = false;
           delete inFlightStartedAt[key];
-          if (!currentAccess() && !Object.values(inFlightRef.current).some(Boolean) && runtimeIdentityCoordinator?.current()?.quotaKey !== settlementScope.quotaKey) releaseLease(settlementScope, leaseId);
+          if (!currentAccess() && !setupFlight && !Object.values(inFlightRef.current).some(Boolean) && runtimeIdentityCoordinator?.current()?.quotaKey !== settlementScope.quotaKey) releaseLease(settlementScope, leaseId);
           manualInFlight.delete(key);
           onSettled?.();
           if (!cancelled) {
@@ -18136,6 +18666,23 @@ function App({ onCreateRemote = () => {} } = {}) {
     }
 
     const leaseId = governorId();
+    let setupFlight = null;
+    let setupGeneration = 0;
+    let setupPartition = null;
+    let setupState = {};
+    function publishSetup(next) {
+      setupState = next;
+      if (!cancelled) setActionsSetup(next);
+    }
+    function retireSetup() {
+      setupGeneration += 1;
+      if (setupFlight) {
+        setupFlight.retired = true;
+        setupFlight.controller.abort();
+      }
+      setupPartition = null;
+      publishSetup({});
+    }
     const pending = new Map();
     const cleanupQueue = new Set();
     let lastWallAt = Date.now();
@@ -18258,6 +18805,7 @@ function App({ onCreateRemote = () => {} } = {}) {
       }
     }
 
+    actionsSetupRef.current = () => publishSetup({ title: "Standalone only", action: "g Actions; ? Help", message: "Setup checks are available in standalone mode. Press g to open Actions." });
     if (runtime.connect !== null) {
       const repository = effectiveRuntimeRepository({ remoteUrls: runtimeRemoteUrls });
       const host = effectiveRuntimeHost({ remoteUrls: runtimeRemoteUrls });
@@ -18651,13 +19199,14 @@ function App({ onCreateRemote = () => {} } = {}) {
     }
 
     function retireCurrentScope() {
+      retireSetup();
       if (!cleanupScope || !registeredScopeHash) return;
       for (const key of [...pending.keys()]) cancelPending(key, cleanupScope);
       for (const subscription of acquisitionSubscriptions.values()) {
         acquisitionEngine.unsubscribe(subscription.id);
       }
       acquisitionSubscriptions.clear();
-      if (!Object.values(inFlightRef.current).some(Boolean)) releaseLease(cleanupScope, leaseId);
+      if (!setupFlight && !Object.values(inFlightRef.current).some(Boolean)) releaseLease(cleanupScope, leaseId);
     }
 
     // discardData separates the two reasons this runs. An account *change* must
@@ -18733,6 +19282,7 @@ function App({ onCreateRemote = () => {} } = {}) {
         const activeTab = TABS[activeIndexRef.current].key;
         const kept = maintainControlLease(scope, leaseId, runtime.refreshMs, activeTab, nowMs);
         if (kept.ok) return scope;
+        retireSetup();
         registeredScopeHash = null;
         if (governorRef.current?.leaseId === leaseId) governorRef.current = null;
         return null;
@@ -19126,6 +19676,85 @@ function App({ onCreateRemote = () => {} } = {}) {
       } else await transport;
       return { persisted: true, retry: false, kind, key };
     }
+    actionsSetupRef.current = async () => {
+      if (cancelled || setupFlight) return;
+      const nowMs = Date.now();
+      const target = dashboardTarget();
+      if (remoteSetupRef.current || !actionsPageUrl(target)) {
+        publishSetup({ message: "Restart with gh-glance --repo owner/name." });
+        return;
+      }
+      const capturedScope = ensureScope(nowMs);
+      if (!capturedScope) {
+        publishSetup({ ...setupState, error: "Setup check unavailable while account coordination recovers.",
+          retryAt: actionsSetupRetryAt(nowMs) });
+        return;
+      }
+      const partition = JSON.stringify(["standalone", target.host, target.repository, capturedScope.accessKey]);
+      if (setupPartition !== partition) { retireSetup(); setupPartition = partition; }
+      if (setupState.retryAt > nowMs) { publishSetup({ ...setupState }); return; }
+      if (actionsSetupFresh(setupState.result, nowMs)) {
+        publishSetup({ ...setupState, saved: true, error: null, message: null });
+        return;
+      }
+      const generation = setupGeneration;
+      const flight = { controller: new AbortController(), scope: { ...capturedScope, identityProvider: null }, retired: false };
+      setupFlight = flight;
+      const setupSignal = AbortSignal.any([controller.signal, flight.controller.signal]);
+      const current = () => !cancelled && !setupSignal.aborted && generation === setupGeneration &&
+        setupPartition === partition && identity()?.accessKey === capturedScope.accessKey &&
+        actionsPageUrl() === actionsPageUrl(target) && !remoteSetupRef.current;
+      publishSetup({ ...setupState, busy: true, error: null, saved: false, message: null });
+      try {
+        const admitted = await runAdmittedOperation({ scope: capturedScope, leaseId,
+          operation: "setup:actions-workflows", priority: "manual", signal: setupSignal,
+          waitMs: GOVERNOR_ADMISSION_WAIT_MS,
+          run: async (signal) => {
+            const response = await ghApi(actionsSetupArgs(target), {
+              operation: "setup:actions-workflows", signal, includeHeaders: true,
+            });
+            return { ...response, observation: parseActionsSetup(response.body, response.headers), checkedAt: Date.now() };
+          },
+        });
+        if (!current()) return;
+        if (!admitted.ok) {
+          const error = admitted.error;
+          const failedAt = Date.now();
+          let snapshot = inspectGovernor(capturedScope, failedAt);
+          const throttle = classifyThrottle({ ...error?.apiResponse, stderr: errText(error) });
+          let holdUntil = 0;
+          if (classify(error) === "rate-limited" || throttle.kind !== "none") {
+            const budget = snapshot.value?.budgets?.core;
+            const resetMs = throttle.kind === "primary" ? throttle.resetMs
+              : throttle.kind === "secondary" ? transportCooldownDeadline({ ...throttle, at: failedAt })
+                : budget?.resetMs ?? null;
+            holdUntil = resetMs ?? 0;
+            handleRateLimitBlocks("actions", [{ resource: "core", resetMs,
+              epoch: budget?.epoch ?? null }], failedAt);
+            snapshot = inspectGovernor(capturedScope, failedAt);
+          }
+          const retryAt = actionsSetupRetryAt(failedAt, Math.max(
+            holdUntil, snapshot.value?.budgets?.core?.blockUntil ?? 0, admitted.decision?.retryAt ?? 0,
+            admitted.decision?.value?.retryAt ?? 0, admitted.decision?.value?.notBefore ?? 0,
+            admitted.decision?.value?.resetMs ?? 0,
+            error?.retryAt ?? 0, failedAt + githubAppResponseRetryAfter(error?.apiResponse, failedAt)));
+          publishSetup({ ...setupState, busy: false, error: shortErr(error), retryAt });
+          return;
+        }
+        publishSetup({ result: { ...admitted.value.observation, checkedAt: admitted.value.checkedAt }, busy: false });
+        if (terminalizationBacklogForResource(terminalizationBacklog, capturedScope.hash, "core") > 0) {
+          recordRuntimeRecovery("actions", "receipt-retry");
+        }
+      } finally {
+        if (setupFlight === flight) setupFlight = null;
+        if ((cancelled || (flight.retired && flight.scope.hash !== scope?.hash)) &&
+            !Object.values(inFlightRef.current).some(Boolean)) {
+          releaseLease(flight.scope, leaseId);
+        }
+        if (current() && setupState.busy) publishSetup({ ...setupState, busy: false });
+      }
+    };
+
     fetchTabRef.current = (key, { force = false, kind = force ? "manual" : "active" } = {}) => {
       if (kind === "tab-switch") {
         // A newly active subscription is not evidence of quiet: the tab you
@@ -19513,7 +20142,9 @@ function App({ onCreateRemote = () => {} } = {}) {
         acquisitionEngine.unsubscribe(subscription.id);
       }
       acquisitionSubscriptions.clear();
-      if (cleanupScope && registeredScopeHash) releaseLease(cleanupScope, leaseId);
+      retireSetup();
+      actionsSetupRef.current = null;
+      if (cleanupScope && registeredScopeHash && !setupFlight) releaseLease(cleanupScope, leaseId);
       if (governorRef.current?.leaseId === leaseId) governorRef.current = null;
       if (contextCoordinatorRef.current === coordinator) contextCoordinatorRef.current = null;
       // `cancelled` stops state updates from a promise that already resolved;
@@ -19551,9 +20182,6 @@ function App({ onCreateRemote = () => {} } = {}) {
     TABS.map((t) => [t.key, data[t.key] == null && !errors[t.key] && loading[t.key]]),
   );
   const anyFirstLoad = Object.values(firstLoad).some(Boolean);
-  const statusDisconnected = runtime.connect !== null
-    ? activeGovernorDecision?.disconnected === true
-    : data[tab.key] !== null && !runtimeIdentityCoordinator?.current();
   let semanticStatus = refreshStatus({
     widthMode: resizeRef.current.active,
     remoteSetup,
@@ -19593,45 +20221,6 @@ function App({ onCreateRemote = () => {} } = {}) {
     return () => clearTimeout(timer);
   }, [anyFirstLoad, iconHintDue]);
 
-  const items = data[tab.key];
-  const displayError = formatTabErrorForWidth(tabError, failureContext, Math.max(1, cols - 5));
-  const coordinationError = activeGovernorDecision?.coordinationError && !remoteSetup;
-  const coordinationReason = activeFailure ?? activeGovernorDecision?.reason ?? "unavailable";
-  const noticeReason = activeRecovery?.code ??
-    (tabError?.kind === "fetch" ? tabError.verdict : null) ??
-    (coordinationError || activeGovernorDecision?.mode === "paused" ? coordinationReason : null) ??
-    (statusDisconnected ? runtime.connect === null ? "identity-unavailable"
-      : activeGovernorDecision?.reason === "app-auth" ? "app-auth" : "disconnected" : null);
-  // A continuous fault stays sustained when its explanation becomes more
-  // specific. Only losing the fault (or switching tabs) restarts the debounce.
-  const coordinationCondition = !remoteSetup && noticeReason ? tab.key : null;
-  useEffect(() => {
-    setVisibleCoordinationCondition(null);
-    if (coordinationCondition === null) return;
-    const timer = setTimeout(
-      () => setVisibleCoordinationCondition(coordinationCondition),
-      COORDINATION_NOTICE_AFTER_MS,
-    );
-    return () => clearTimeout(timer);
-  }, [coordinationCondition]);
-  const showCoordinationNotice = coordinationCondition !== null &&
-    visibleCoordinationCondition === coordinationCondition;
-  const noticeResource = activeResource;
-  const noticeSourceAt = collectorSourceAgeRef.current[tab.key]
-    ? now.getTime() - collectorSourceAgeRef.current[tab.key].ageMs -
-      Math.max(0, performance.now() - collectorSourceAgeRef.current[tab.key].measuredAt)
-    : lastOkRef.current[tab.key] ?? null;
-  const noticeCause = activeRecovery ?? (noticeReason ? recoveryCause({
-    reason: noticeReason === "other" ? "network-outage" : noticeReason,
-    resource: noticeResource, sourceAt: noticeSourceAt,
-    retryAt: activeGovernorDecision?.retryAt ?? activeGovernorDecision?.resetMs ??
-      activeGovernorDecision?.notBefore ?? null,
-    origin: tabError ? "source" : "coordination", tab: tabError ? tab.key : null,
-  }) : null);
-  const noticeLines = showCoordinationNotice && noticeCause
-    ? presentRecovery(noticeCause, { nowMs: now.getTime(), cols })
-    : [!remoteSetup && displayError ? displayError : ""];
-  const noticeTone = showCoordinationNotice ? ATTENTION : displayError ? ERROR_TEXT : undefined;
   const spin = SPINNER[frame % SPINNER.length];
 
   const counts = Object.fromEntries(
@@ -19673,37 +20262,12 @@ function App({ onCreateRemote = () => {} } = {}) {
     TABS.map((t) => [t.key, Boolean(errors[t.key]) && errors[t.key]?.verdict !== "no-remote"]),
   );
 
-  // Data can be arbitrarily old without anything on screen saying so: a failing
-  // poll only surfaces on the tab you have selected, and after a laptop sleep
-  // every pane is plausible and wrong. Threshold-gated and minute-granular on
-  // purpose -- see STALE_AFTER_MS.
-  // Read from the ref written on every successful poll, not from meta.at, which
-  // only moves when the *payload* changes -- see lastOkRef. Reading a ref during
-  // render lags by one render, which is harmless here because `now` advances on
-  // its own and the label is minute-granular by design.
-  const collectorAge = collectorSourceAgeRef.current[tab.key];
-  const sourceAgeMs = collectorAge
-    ? collectorAge.ageMs + Math.max(0, performance.now() - collectorAge.measuredAt)
-    : null;
-  const lastOk = sourceAgeMs === null ? lastOkRef.current[tab.key] : now.getTime() - sourceAgeMs;
-  const staleFor = sourceAgeMs ?? (lastOk == null ? null : now.getTime() - lastOk);
-  const staleAt = freshnessDeadline({
-    lastOk,
-    refreshMs: runtime.refreshMs,
-    grantedMs: admittedCadenceRef.current[tab.key]?.grantedMs,
-    governorDecision: activeGovernorDecision,
-    currentEpochs: governorEpochs,
-  });
-  const staleLabel =
-    staleFor != null && staleAt != null && now.getTime() > staleAt
-      ? formatDuration(staleFor)
-      : null;
   if (staleLabel && (["watching", "shared"].includes(semanticStatus.kind) ||
       activeFailure && semanticStatus.kind === "paused" &&
       activeGovernorDecision?.cause)) {
     semanticStatus = refreshStatus({
       stale: true,
-      disconnected: data[tab.key] !== null && !runtimeIdentityCoordinator?.current(),
+      disconnected: statusDisconnected,
     });
   }
 
@@ -19713,6 +20277,7 @@ function App({ onCreateRemote = () => {} } = {}) {
     semanticStatus = refreshStatus({ onDemand: true });
   }
 
+
   // A settled on-demand view has no data wake to advance its visible age.
   // Tick only its display clock; source timestamps and acquisition stay idle.
   const showCachedAge = semanticStatus.kind === "cached" && staleFor !== null;
@@ -19763,7 +20328,7 @@ function App({ onCreateRemote = () => {} } = {}) {
   // Bottom-right of the frame, lazygit style: how much of the tab you can
   // currently see out of how much there is.
   const countLabel =
-    items == null
+    !tableVisible
       ? null
       : tabOffset > 0
         ? `${tabOffset + 1}-${tabOffset + visibleItems.length} of ${counts[tab.key]}`
@@ -19777,22 +20342,9 @@ function App({ onCreateRemote = () => {} } = {}) {
   // terminal is doing the clipping.
   const frameCols = Math.max(1, cols - 1);
 
-  // Name the repository in the top edge when it was chosen explicitly, because
-  // then it is not the one you would guess from the working directory. Nothing
-  // on screen said which repo a pane was watching, and the documented workflow is
-  // several panes side by side plus `--repo` from anywhere -- so telling them
-  // apart meant quitting and running --doctor. Only the explicit cases are shown:
-  // resolving the *inferred* repo would cost a subprocess call at startup for a
-  // label that, by definition, names the directory you are already sitting in.
-  //
-  // GH_REPO is read straight from the environment and never went through
-  // parseRepoTarget, so unlike runtime.repo it is unvalidated -- safe() before it
-  // is drawn, on the same rule as every other string this app does not own.
-  // Dropped before the tab name rather than with it: PanelEdge drops its whole
-  // label when it cannot seat one, so a single concatenated string would take the
-  // tab name down with the target at ordinary widths.
-  const target = runtime.repo ?? safe(process.env.GH_REPO ?? "");
-  const withTarget = target ? `${tab.label} · ${target}` : tab.label;
+  // The existing resolver also supplies inferred targets without another lookup.
+  // Complete target and host remain reachable in help when this edge is short.
+  const withTarget = `${tab.label} · ${selectedTarget.label}`;
   const topLabel = frameCols - 3 - withTarget.length >= 0 ? withTarget : tab.label;
 
   // Fixed columns deliberately do not shrink, so BRANCH and TIME stay readable
@@ -19822,8 +20374,8 @@ function App({ onCreateRemote = () => {} } = {}) {
   // avoid, and it was reachable simply by dragging a sidebar narrow. The guard
   // sits after usableSize(), which substitutes DEFAULT_COLS for a 0 reported
   // mid-resize, so a transient zero cannot be mistaken for a genuinely tiny pane.
-  const tooNarrow = frameCols < MIN_COMPACT_WIDTH;
-  const fullHeaderVisible = !compact && !showHelp && !tooNarrow && !remoteSetup;
+  const tooNarrow = tableVisible && frameCols < MIN_COMPACT_WIDTH;
+  const fullHeaderVisible = tableVisible && !compact && !showHelp && !tooNarrow && !remoteSetup;
   const selectedWidthKey = selectedWidthKeyByTab[tab.key] ?? null;
   const selectedWidthColumn = effectiveHeader?.find(
     (column) => column.key === selectedWidthKey,
@@ -19913,23 +20465,22 @@ function App({ onCreateRemote = () => {} } = {}) {
       // recovers immediately -- this is a render-time branch and touches no state.
       // Short enough to survive at the widths it actually appears at -- a message
       // about the pane being too narrow that is itself truncated would be a joke.
-      // Clamped to bodyRows so it can never push the frame past `rows` and
-      // trigger the full repaint the height reservation exists to prevent, and
-      // truncate-end so it degrades rather than wraps in a narrow pane. Every
-      // glyph in KEY_TABLE is plain ASCII, which is what keeps it safe here.
+      // Help is cell-wrapped and paginated within bodyRows, with navigation
+      // and quit reserved on every page. Rendering never adds another wrap.
       showHelp &&
-        helpLines(bodyRows)
+        (helpPages[visibleHelpPage] ?? [])
           .map((line, i) => e(Text, { key: `help${i}`, wrap: "truncate-end" }, line)),
       !showHelp &&
         tooNarrow &&
         e(Text, { dimColor: true, wrap: "truncate-end" }, "too narrow"),
-      ...noticeLines.map((line, index) =>
+      ...(showHelp || !tableVisible ? [] : noticeLines).map((line, index) =>
         e(Text, { key: `recovery:${index}`, color: noticeTone, wrap: "truncate-end" }, line)),
       !showHelp &&
         !tooNarrow &&
         !remoteSetup &&
+        tableVisible &&
         tab.key === "security" &&
-        securityLines.map((note, i) =>
+        visibleSecurityLines.map((note, i) =>
           e(Text, { key: i, dimColor: true, wrap: "truncate-end" }, note),
         ),
       !showHelp &&
@@ -19952,6 +20503,7 @@ function App({ onCreateRemote = () => {} } = {}) {
       !showHelp &&
         !tooNarrow &&
         !remoteSetup &&
+        tableVisible &&
         e(MemoHeaderCells, {
           cells: header,
           selectedWidthKey: resizeRef.current.active ? selectedWidthKey : null,
@@ -19978,49 +20530,23 @@ function App({ onCreateRemote = () => {} } = {}) {
           }),
         );
       }),
-      // Distinguishes "still fetching" from "resolved and empty" in the body,
-      // which is the difference between a dashboard that looks hung and one
-      // that looks correct. Driven by "never resolved" rather than by the
-      // loading flag, which also covers a manual refresh and made a
-      // settled-empty tab swap its message. Suppressed entirely when a tab has
-      // an error and has never resolved: the error line directly above already
-      // says what happened, and "no runs" underneath it reads as a fact about the
-      // repository rather than the absence of an answer.
-      !showHelp &&
-        !tooNarrow &&
-        !remoteSetup &&
-        visibleItems.length === 0 &&
-        !(tabError && items == null) &&
-        e(
-          Text,
-          { dimColor: true },
-          firstLoad[tab.key]
-            ? `${showSpinner ? spin : SPINNER[0]} loading ${tab.label.toLowerCase()}…` +
-              // Appended only once a first fetch has been running for
-              // ICON_HINT_AFTER_MS, so an ordinary start never shows it: the
-              // remedy is for someone looking at a pane of blank boxes, and by
-              // then they have been looking long enough to want an explanation.
-              // Suppressed once icons are already ASCII, since then there is
-              // nothing to fix.
-              (USING_NERD_ICONS && iconHintDue ? "   (icons blank? GH_GLANCE_ICONS=unicode)" : "")
-            : semanticStatus.kind === "paused" || waiting[tab.key]
-              ? "waiting for API budget…"
-            : tab.key === "security" && securityNotes.length === ALERT_SOURCES.length
-              ? "no alert sources available"
-              : `no ${tab.countLabel}`,
-        ),
+      !showHelp && !remoteSetup && !tableVisible &&
+        panelLines.map((line, index) => e(Text, {
+          key: `context:${index}`, wrap: "truncate-end",
+          bold: index === 0, color: index === 0 ? TITLE_COLOR : undefined,
+        }, line)),
       // Pushes the panel's bottom edge down to the foot of the pane, so the
       // frame stays put instead of closing up under the column headers on a
       // tab that only has a handful of rows.
       e(Box, { flexGrow: 1 }),
     ),
-    e(PanelEdge, { width: frameCols, top: false, label: countLabel, labelColor: BORDER_COLOR }),
+    e(PanelEdge, { width: frameCols, top: false, label: showHelp ? null : countLabel, labelColor: BORDER_COLOR }),
     e(StatusBar, {
       status: semanticStatus,
       detail: activeGovernorDecision,
       spin: showSpinner ? spin : null,
-      stale: semanticStatus.kind === "cached" && staleFor != null
-        ? formatDuration(Math.max(0, staleFor)) : staleLabel,
+      stale: semanticStatus.kind === "cached" && Number.isFinite(staleFor) && staleFor >= 0
+        ? formatDuration(staleFor) : staleLabel,
       nowMs: now.getTime(),
       interactive,
       cols: frameCols,
@@ -20375,6 +20901,9 @@ export {
   GOVERNOR_MAX_LEASES,
   GOVERNOR_MAX_INTENTS,
   GOVERNOR_MAX_RESERVATIONS,
+  GOVERNOR_MAX_DEBT_GROUPS,
+  DEBT_JOURNAL_COMPACT_AT,
+  UNKNOWN_DEBT_GROUP_ID,
   GOVERNOR_LOCK_ORPHAN_MS,
   GOVERNOR_LOCK_WAIT_MS,
   GOVERNOR_PROBE_DRAIN_MS,
@@ -20390,6 +20919,7 @@ export {
   normalizeGovernorState,
   serializeGovernorState,
   readGovernorState,
+  readIdentityQuotaState,
   writeGovernorState,
   writeGovernorQuotaState,
   pidIsDead,
@@ -20465,6 +20995,12 @@ export {
   ghApi,
   actionsRunsArgs,
   actionsWorkflowsArgs,
+  actionsSetupArgs,
+  parseActionsSetup,
+  actionsSetupFresh,
+  actionsSetupRetryAt,
+  actionsPageUrl,
+  openBrowserUrl,
   parseActionsBodies,
   parseActionsRuns,
   parseWorkflowCatalog,
@@ -20633,6 +21169,12 @@ export {
   collectorSourceAdvanced,
   cleanupQueueForResource,
   presentRecovery,
+  dashboardPresentation,
+  contextualPanelLayout,
+  dashboardTarget,
+  contextHelpPages,
+  clampHelpPage,
+  wrapPanelText,
   recordRecoveryTransition,
   safeRecordRecoveryTransition,
   readRecoveryTransitions,