// The console's HTTP server: hand-written HTML from Go templates, no
// JavaScript, no build step, no external resources. Auth model: OAuth at
// Keymail is the ONE-TIME sign-up ceremony; returning sign-ins are a
// single-use confirmation link the console delivers into the user's Keymail
// Apps inbox with its stored grant.
package console

import (
	"context"
	"crypto/ed25519"
	"crypto/subtle"
	"crypto/x509"
	"embed"
	"encoding/json"
	"errors"
	"fmt"
	"html/template"
	"log"
	"math"
	mrand "math/rand/v2"
	"net"
	"net/http"
	netmail "net/mail"
	"net/url"
	"os"
	"regexp"
	"slices"
	"sort"
	"strings"
	"sync"
	"sync/atomic"
	"time"

	"github.com/aws/aws-sdk-go-v2/service/costexplorer"
	"github.com/carlosframework/platform/internal/appconfig"
	"github.com/carlosframework/platform/internal/applog"
	"github.com/carlosframework/platform/internal/boxid"
	"github.com/carlosframework/platform/internal/dbreads"
	"github.com/carlosframework/platform/internal/dnsrec"
	"github.com/carlosframework/platform/internal/domains"
	"github.com/carlosframework/platform/internal/economics"
	"github.com/carlosframework/platform/internal/edgesfile"
	"github.com/carlosframework/platform/internal/geo"
	"github.com/carlosframework/platform/internal/hostclaim"
	"github.com/carlosframework/platform/internal/hostops"
	"github.com/carlosframework/platform/internal/infraview"
	"github.com/carlosframework/platform/internal/lease"
	"github.com/carlosframework/platform/internal/mail"
	"github.com/carlosframework/platform/internal/moves"
	"github.com/carlosframework/platform/internal/objstore"
	"github.com/carlosframework/platform/internal/plans"
	"github.com/carlosframework/platform/internal/provision"
	"github.com/carlosframework/platform/internal/publicrelease"
	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/release"
	"github.com/carlosframework/platform/internal/status"
	"github.com/carlosframework/platform/internal/svcrole"
	"github.com/carlosframework/platform/internal/telemetry"
	"github.com/carlosframework/platform/internal/usage"
	"github.com/carlosframework/platform/internal/version"
)

//go:embed templates/*.html
var tmplFS embed.FS

var templates = template.Must(template.New("").Funcs(template.FuncMap{
	"fmtTime": func(t time.Time) string { return t.UTC().Format("2006-01-02 15:04 UTC") },
	// until renders a future horizon the way the cards speak: "~4h", never a
	// timestamp — the safety-delay strip's "goes live ~4h" and Task 6's
	// summary strip both read it this way.
	"until": untilText,
	// ago renders a past instant the way a person scanning a dashboard reads
	// one — "2h4m ago" — at humanAge's deliberately coarse resolution. The
	// absolute stamp stays available where precision matters (title attrs,
	// the Activity tab); a zero time is unknown, so it dashes out.
	"ago": func(t time.Time) string {
		if t.IsZero() {
			return "—"
		}
		return humanAge(time.Since(t)) + " ago"
	},
	// trashCooloffDays is the deletion policy's restore window, in the unit
	// the Settings page speaks. One source: release.TrashCooloff.
	"trashCooloffDays": func() int { return int(release.TrashCooloff.Hours() / 24) },
	// temporaryCooloffDays is a temporary app's restore window, in days: the
	// delete confirmation shows it for an app with an expiry (temporary static
	// sites spec §5, "the delete confirmation in the browser").
	"temporaryCooloffDays": func() int { return int(release.TemporaryCooloff.Hours() / 24) },
	// The fleet template's em-dash helpers: fleet.json's null-propagation
	// rule (internal/status/fleet.go) means these *string/*int/*bool fields
	// are unknown, not zero, and unknown must render as a titled em-dash —
	// never a blank cell or a guessed value — same rule index.html's JS
	// enforces client-side (see asText/asBool there).
	"strOrDash": func(v *string) string {
		if v == nil {
			return "—"
		}
		return *v
	},
	"intOrDash": func(v *int) string {
		if v == nil {
			return "—"
		}
		return fmt.Sprint(*v)
	},
	"boolWord": func(v *bool, whenTrue, whenFalse string) string {
		if v == nil {
			return "—"
		}
		if *v {
			return whenTrue
		}
		return whenFalse
	},
	"emptyOrDash": func(s string) string {
		if s == "" {
			return "—"
		}
		return s
	},
	// pct renders a fraction (0..1, as CPU/Mem/Disk readings and unit CPU
	// fractions are stored — internal/metrics.HostSample/UnitSample) as a
	// whole-percent string; nil means no reading, never zero, so it renders
	// the same em-dash every other "unknown" field on this console does.
	"pct": func(v *float64) string {
		if v == nil {
			return "—"
		}
		return fmt.Sprintf("%.0f%%", *v*100)
	},
	// alertVal renders one AlertRow's value in ITS OWN rule's unit —
	// see alertValueText. LoadMetrics only ever returns firing rules, so an
	// alert row always carries a value; there is no nil case to dash out.
	"alertVal": alertValueText,
	// healthSlug: the Running tab's health-filter links and the hidden
	// carried-filter field both need a health word's URL form (listquery.go).
	"healthSlug": healthSlug,
	"healthTone": healthTone,
	"instanceRowPage": func(p page, row InstanceRow) any {
		return struct {
			Page page
			Row  InstanceRow
		}{p, row}
	},
	// logLines: the Logs tab's window folded into the terminal pane's lines
	// (logsview.go). The padding is computed across the whole window, so it
	// has to be one call over all the records, not one per row.
	"logLines": logLines,
	// sortedKV: the Analytics tab's three top-key tables (analyticsview.go).
	// A Go template ranges a map in key order, which would sort a top-pages
	// table alphabetically — the one order that hides which page is the
	// popular one. This puts the biggest first and leaves the overflow
	// bucket last, wherever its count happens to land.
	"sortedKV": sortedKV,
	// geoCountries and geoAttributions: the Analytics tab's Countries table
	// and the credit its sources require (geoip spec §9, §13).
	"geoCountries":    geoCountries,
	"geoLabel":        geoLabel,
	"geoAttributions": geoAttributions,
	// bytesOrDash renders a byte count in the smallest unit that keeps it
	// readable; nil (no reading, from a unit that reported CPU but not
	// memory/IO that tick) is "—", never a fabricated 0 B.
	"bytesOrDash": func(v *int64) string {
		if v == nil {
			return "—"
		}
		b := float64(*v)
		switch {
		case b >= 1<<30:
			return fmt.Sprintf("%.1f GB", b/(1<<30))
		case b >= 1<<20:
			return fmt.Sprintf("%.1f MB", b/(1<<20))
		case b >= 1<<10:
			return fmt.Sprintf("%.1f KB", b/(1<<10))
		default:
			return fmt.Sprintf("%d B", *v)
		}
	},
	// loadOrDash renders a 1-minute load average: an absolute number of
	// runnable tasks, not a fraction, so pct (which multiplies by 100 and
	// stamps a %) would be a lie about the same *float64. nil is the same
	// em-dash every unknown on this console gets.
	"loadOrDash": func(v *float64) string {
		if v == nil {
			return "—"
		}
		return fmt.Sprintf("%.2f", *v)
	},
	// mapGet reads one named field out of Fleet.Instances — a map so a
	// template range would iterate it key-sorted, alphabetically, which
	// scrambles the static/resident/hibernating/awake/asleep order the
	// public page and the design spec both fix; indexing by name keeps that
	// order explicit in the template instead.
	"mapGet": func(m map[string]*int, k string) *int { return m[k] },
	// icon inlines one vendored Lucide SVG by slug — see icons.go for the
	// set, the licence, and why template.HTML is safe there and nowhere
	// else. Chrome is drawn; emoji stay content.
	"icon": icon,
	// join renders fleetPageBox.Tags back into the tag form's editable
	// text input, comma-separated — the exact grammar SetFleetBoxTags
	// expects back, so an owner opening the form sees the same string they'd
	// type to leave it unchanged.
	"join": strings.Join,
	// fleetName reads the fleet out of a placement target ("fleet/pi" -> "pi")
	// so the Placement section can NAME the fleet and link to its page rather
	// than printing the raw Region value at a customer. A target that does not
	// parse yields "", which the template's own {{if}} already handles as
	// "not placed" — the same reading appPlacement itself takes.
	"fleetName": func(target string) string { f, _ := registry.FleetPlacement(target); return f },

	// ---- /fleet/economics (Task 13): server-side arithmetic mirroring
	// internal/economics/compute.go, so the page's initial render needs no
	// JS to show real numbers — see economics.html's inline script for the
	// live-recompute twin of every function below (same names, JS-cased).

	// usd renders a signed dollar figure — negative (a box or account
	// running at a loss under the active scenario) as "-$N.NN", never a
	// bare minus glued to the sign the reader expects at the front.
	"usd": func(v float64) string {
		if math.IsNaN(v) || math.IsInf(v, 0) {
			return "—"
		}
		if v < 0 {
			return fmt.Sprintf("-$%.2f", -v)
		}
		return fmt.Sprintf("$%.2f", v)
	},
	// pctf is pct (above) for a plain, never-nil float64 — margin and
	// utilization fractions (economics.AccountEconomics.MarginFrac,
	// BoxEconomics.Utilization) are always populated, never a *float64
	// "no reading yet" case pct exists to dash out.
	"pctf": func(v float64) string { return fmt.Sprintf("%.0f%%", v*100) },
	// marginMultiple renders cost-plus's margin knob the way an operator
	// thinks about markup, not the accounting fraction it's stored as:
	// multiple = 1/(1-margin), so the default 0.8 reads "5.0× cost" per the
	// brief. Out of Validate's legal [0,1) range is "—", never a divide by
	// zero or a negative multiple.
	"marginMultiple": func(margin float64) string {
		if margin < 0 || margin >= 1 {
			return "—"
		}
		return fmt.Sprintf("%.1f×", 1/(1-margin))
	},
	// marginCell renders MarginFrac as pctf normally, but an em-dash for a
	// pooled row (FreeTierPos=="pooled") — Task 6's carried ruling: a
	// pool/try/""-tier account's revenue is pooled, not individually priced
	// (buildEconomicsView's tier override), so its MarginFrac is genuinely
	// 0 — but "0%" reads as an account LOSING money, not one that simply
	// isn't priced on its own. The JS twin (econ_maths_js's marginCell)
	// mirrors this exactly.
	"marginCell": func(frac float64, pos string) string {
		if pos == "pooled" {
			return "—"
		}
		return fmt.Sprintf("%.0f%%", frac*100)
	},
	// tierWord renders a fleet-pool tier (store.go's validAccountTiers) for
	// display: "" (never assigned) reads "unassigned" rather than a blank
	// chip label; every other value (try/pool/hosted/fleet/dedicated)
	// passes through unchanged. Feeds both a tier chip's visible text and
	// its "chip-tier-<word>" class (economics_accounts.html, Task 6).
	"tierWord": func(tier string) string {
		if tier == "" {
			return "unassigned"
		}
		return tier
	},
	// tierKnown reports whether acct has a real console account row at all
	// (present as a key in EconomicsView.Tiers, via the comma-ok form —
	// html/template's "index" can't distinguish absent from an explicit ""
	// tier, which is exactly the distinction this exists for). A usage-only
	// account (fleet or edge traffic with no matching accounts-table row —
	// e.g. a fleet-only account whose owner never signed up) is absent from
	// the map entirely: economics_accounts.html renders its tier chip but
	// WITHOUT the per-row tier-set form, since POSTing that form's account
	// sqid to /fleet/economics/tier can only ever fail with "No such
	// account." (handleEconomicsTierSave's AccountBySqid lookup) — fix
	// round, Task 6 review, IMPORTANT 2.
	"tierKnown": func(tiers map[string]string, acct string) bool {
		_, ok := tiers[acct]
		return ok
	},
	"add": func(vs ...float64) float64 {
		var sum float64
		for _, v := range vs {
			sum += v
		}
		return sum
	},
	"sub": func(a, b float64) float64 { return a - b },
	"mul": func(a, b float64) float64 { return a * b },
	"div": func(a, b float64) float64 {
		if b == 0 {
			return 0
		}
		return a / b
	},
	// project is economics.Project (compute.go), exposed so the headline
	// tiles' month-to-date figures can carry a "projected for the month"
	// second line — the spec's "month-to-date with projection" promise. Only
	// ever called from economics.html's tiles when Period=="mtd" and
	// CoveredDays>0; the JS twin (economics.html's econ_maths_js define) is
	// the exact transliteration a knob change re-runs.
	"project": func(mtd float64, coveredDays, periodDays int) float64 {
		return economics.Project(mtd, coveredDays, periodDays)
	},
	// marginOf is economics.PriceAccount's margin formula
	// ((revenue-cost)/revenue, 0 when revenue is 0), applied to the
	// dashboard's period TOTALS rather than one account — the "achieved
	// margin" headline tile.
	"marginOf": func(revenue, cost float64) float64 {
		if revenue <= 0 {
			return 0
		}
		return (revenue - cost) / revenue
	},
	// sumAcctCost/sumAcctRevenue/sumBoxIdle fold EconomicsView.Accounts /
	// .Boxes into the headline tiles' period totals: total cost is every
	// account's allocated+metered cost, PLUS every box's unallocated idle
	// headroom (never smeared across tenants — economics.AllocateBox's own
	// doc comment), PLUS fixed overheads (overheadUSD below); total revenue
	// is simply the sum of what every account would owe.
	"sumAcctCost": func(accts []economics.AccountEconomics) float64 {
		var sum float64
		for _, a := range accts {
			sum += a.CostUSD
		}
		return sum
	},
	"sumAcctRevenue": func(accts []economics.AccountEconomics) float64 {
		var sum float64
		for _, a := range accts {
			sum += a.RevenueUSD
		}
		return sum
	},
	"sumBoxIdle": func(boxes []BoxEconomics) float64 {
		var sum float64
		for _, b := range boxes {
			sum += b.IdleUSD
		}
		return sum
	},
	// overheadUSD prorates the rate card's fixed monthly LineItems
	// (domains, DNS, ...) over the period being viewed, by the same
	// hours-over-HoursPerMonth proration economics.AllocateBox uses for a
	// box's EBS line — periodDays rather than CoveredDays, deliberately:
	// overhead is a standing monthly bill that runs whether or not usage
	// was fully sampled, so it prorates by calendar days in the period, not
	// by how much of it the sweep actually covered.
	"overheadUSD": func(sc economics.Scenario, periodDays int) float64 {
		var monthly float64
		for _, li := range sc.RateCard.Overheads {
			monthly += li.USDMonth
		}
		return monthly * float64(periodDays) * 24 / economics.HoursPerMonth
	},
	// sumMeter totals one named meter (usage.Meter* — "egress_gb",
	// "requests_1k", "storage_gb_month", ...) across every account in
	// EconomicsView.Meters, for the model-side breakdown's S3/egress lines.
	"sumMeter": func(meters map[string]map[string]float64, meter string) float64 {
		var sum float64
		for _, mm := range meters {
			sum += mm[meter]
		}
		return sum
	},
	// sumBoxesEC2/sumBoxesEBS split each box's total cost (BoxEconomics
	// carries the sum, not the two components) back into the rate card's
	// two box-cost lines for the model-side breakdown, using the same
	// box-then-default spec lookup economics.AllocateBox performs.
	"sumBoxesEC2": func(boxes []BoxEconomics, rc economics.RateCard) float64 {
		var sum float64
		for _, b := range boxes {
			spec, ok := rc.Boxes[b.Box]
			if !ok {
				spec = rc.Boxes[""]
			}
			sum += spec.HourUSD * b.Hours
		}
		return sum
	},
	"sumBoxesEBS": func(boxes []BoxEconomics, rc economics.RateCard) float64 {
		var sum float64
		for _, b := range boxes {
			spec, ok := rc.Boxes[b.Box]
			if !ok {
				spec = rc.Boxes[""]
			}
			sum += spec.EBSGB * rc.EBSGBMonthUSD * (b.Hours / economics.HoursPerMonth)
		}
		return sum
	},
	// periodMonth/billForMonth resolve which of EconomicsView.Bills (this
	// month + last, always both if present regardless of period —
	// loadRecentBills's doc comment) corresponds to the period on screen,
	// so the breakdown reconciles against the RIGHT bill: "last" looks at
	// last calendar month's, "mtd"/"7d" both look at this one.
	"periodMonth": func(period string) string {
		now := time.Now().UTC()
		if period == "last" {
			firstOfThisMonth := time.Date(now.Year(), now.Month(), 1, 0, 0, 0, 0, time.UTC)
			return usage.MonthOf(firstOfThisMonth.AddDate(0, -1, 0))
		}
		return usage.MonthOf(now)
	},
	"billForMonth": func(bills []economics.Bill, month string) *economics.Bill {
		for i := range bills {
			if bills[i].Month == month {
				return &bills[i]
			}
		}
		return nil
	},
	// billServiceChecked is the "counts as CARLOS" default rule, ONE place
	// for both the checkbox render and the delta sum below: an EMPTY
	// Scenario.BillServices counts every service (an old scenario, or one
	// nobody has ever unchecked anything on), a NON-empty one counts only
	// what's named. The inline JS mirrors this exact rule (billServiceChecked)
	// when a knob or checkbox changes.
	"billServiceChecked": func(billServices []string, service string) bool {
		if len(billServices) == 0 {
			return true
		}
		for _, s := range billServices {
			if s == service {
				return true
			}
		}
		return false
	},
	// sumBillServicesChecked totals a bill's Services map, restricted to the
	// ones billServiceChecked keeps — the breakdown's bill-side total.
	"sumBillServicesChecked": func(services map[string]float64, billServices []string) float64 {
		var sum float64
		for name, v := range services {
			if len(billServices) == 0 {
				sum += v
				continue
			}
			for _, s := range billServices {
				if s == name {
					sum += v
					break
				}
			}
		}
		return sum
	},
	// scenarioJSON marshals one economics.Scenario for the save-scenario
	// form's hidden field — the value the door at /fleet/economics/scenarios
	// parses back (handleEconomicsScenarioSave). html/template still
	// attribute-escapes this like any other string substitution; that's
	// correct and wanted here (a form value), unlike DataJSON's <script>
	// embed which needs the OPPOSITE (unescaped) treatment — see
	// economicsPayload's doc comment for why that one stays a raw
	// template.JS.
	"scenarioJSON": func(sc economics.Scenario) (string, error) {
		raw, err := json.Marshal(sc)
		return string(raw), err
	},
	// econPeriodURL: /fleet/economics/accounts's period-switch nav
	// (economics_accounts.html) — see econlistquery.go's doc comment on the
	// func itself for why it preserves Q/Pos but drops Cursor.
	"econPeriodURL": econPeriodURL,
}).ParseFS(tmplFS, "templates/*.html"))

const (
	sessionCookie = "carlos_console_session"
	authCookie    = "carlos_console_auth"
	welcomeCookie = "carlos_console_welcome"
	authFlowTTL   = 10 * time.Minute
)

// Config is everything the server reads its world through.
type Config struct {
	HostClaimOps      *hostops.Controller
	HostClaimRecovery *hostops.Recovery
	ClaimMoveRecovery func(context.Context, *hostops.MoveRecoveryGrant) error
	ClaimAuthority    *hostops.ProductionAuthority
	ClaimPurge        *ClaimPurgeCoordinator
	ClaimPlacement    *ClaimPlacementCoordinator
	HostConsoleID     string

	HostClaim      bool
	WakeRetryReset *WakeRetryResetDoor
	// RunKeysEnabled admits keyed run creates (CARLOS_RUN_KEYS=on; service
	// runs spec § 3). Off, a create that carries an Idempotency-Key is
	// refused 503 keys_not_ready before anything is written, because a box
	// binary older than the record's run_keys would drop the key on its
	// next record write. It is turned on once every box runs a build that
	// carries run_keys through.
	RunKeysEnabled bool
	// SeedScratchDir is <console data>/scratch/seeds: --from restores and
	// import spools. Start-up removes the pool's own leftovers from it.
	// Empty: the seed doors answer 507.
	SeedScratchDir string
	// SeedData is the home region's data bucket, where seeds/ lives (the
	// bucket HibernateBucket names, at its root). nil: the seed doors
	// answer 503.
	SeedData   release.Store
	DBVersions lease.VersionedStore
	Origin     string // the console's public origin — the OAuth client_id
	Keymail    string // keymail base URL
	// Registry is the path to the platform registry DB. Read-mostly (routes,
	// domains, alerts), but fleets.go's fleet/box/placement doors (customer
	// fleets plan, Task 7) genuinely write through it via openRegistry
	// (view.go) — the same cached handle every reader here already uses.
	Registry string
	Releases release.Store // the deployment bucket
	// SystemFeed is where `carlos system update` fetches a public release
	// from. Zero value = the vendor feed; tests point it at a stub.
	SystemFeed publicrelease.Feed
	// Bucket is that same deployment bucket's NAME — CARLOS_DEPLOYMENT_BUCKET,
	// the one bucket relationship this console can state as fact.
	// /fleet/architecture draws the box -> bucket edge from it (archgraph.go's
	// ArchInput.Bucket). It rides on Config rather than being read from the
	// environment in the handler because it is a deployment fact, and a
	// handler reaching for os.Getenv would hide it from every reader of this
	// struct. "" is legal — a local CARLOS_DEPLOYMENT_DIR deployment has no
	// bucket name to draw — and simply draws no bucket node.
	Bucket string
	// RegionHA is CARLOS_REGION_HA as strconv.ParseBool reads it (region HA
	// spec 1 §8 step 2): with it off the console chooses no executor at
	// create and relocation has no console half. A deployment fact, on
	// Config for the same reason Bucket is.
	RegionHA bool
	// HomeRegion NAMES the deployment's home placement (CONSOLE_HOME_REGION,
	// e.g. "ie") for consumer pickers (issue #346). It is a NAME, not a
	// scope: records for the home keep region "" (the unconstrained value
	// reconcile has always matched) and the create door normalizes this
	// code to "" on the way in — so the fleet's boxes never see the code
	// and nothing about placement changes when it is set. "" is legal: the
	// regions endpoint then reports no home row and an empty default.
	HomeRegion string
	// AppRegions is CONSOLE_APP_REGIONS=on (nearest-region spec §5.6). Off
	// never stops the create door's fill for rows already holding a region.
	AppRegions bool
	// GeoIP is the optional CONSOLE_GEOIP_DB locator; nil = IP step off.
	GeoIP geo.Locator
	// GeoIPReader is the same reader as GeoIP when it is a Swappable (the
	// CONSOLE_GEOIP_DB override, or the follower of this box's edge, geoip
	// spec §11.3): the /geo endpoint and attribution need its snapshots,
	// which a bare Locator cannot give. nil = no GeoIP on this console.
	GeoIPReader *geo.Swappable
	// GeoipStagingDir is where `carlos system geoip publish` uploads are
	// staged (geoip spec §4.2): cleared when the server is constructed, so a
	// crash never leaves an upload behind for good. "" = the OS temp dir,
	// not cleared (tests).
	GeoipStagingDir string
	// The GeoIP feed (geoip spec §10.1): CONSOLE_GEOIP_FEED and, for
	// GeoLite2, the MaxMind account and key. BoxLabel is this console's
	// box, named in feed.json so only that box's mirror alerts on feed
	// failure.
	GeoipFeed           string
	GeoipMaxMindAccount string
	GeoipMaxMindKey     string
	BoxLabel            string
	// HibernateBucket/Region/Prefix name the region data bucket the
	// `carlos db` door reads (apidb.go; spec 2026-09-02 §6, Option A): the
	// same CARLOS_HIBERNATE_* triple the activator on this box writes
	// instances/<host>/ with, read through activator.ConfigFromEnv so the
	// two cannot parse it differently. Read-only, in-region, LTX files by
	// coordinate only. An empty bucket disables the door (503) rather than
	// failing it open.
	HibernateBucket string
	HibernateRegion string
	HibernatePrefix string
	// Region is this console's own placement (CARLOS_REGION, the value the
	// box agent beside it reconciles with), compared against an instance
	// record's Region before any S3 call. Empty on the home region, whose
	// records keep region "" too (see HomeRegion).
	Region string
	// DBForward is CARLOS_DB_FORWARD=1: a carlos db read of an instance in
	// another region is forwarded to a capable box there (db region
	// forward spec). It also needs Key to be the deployment root's.
	DBForward  bool
	ReleasePub ed25519.PublicKey // pinned channel-pointer verification key
	// Key signs channel pointers for promote/rollback (CARLOS_RELEASE_KEY).
	// nil is a legal deployment: the console runs read-only, the promotion
	// UI renders disabled, and the mutation handlers refuse with 503.
	Key ed25519.PrivateKey
	// AppClient fetches app-internal instance reports (INSTANCES.md); nil
	// uses a default client with the contract's short timeout.
	AppClient *http.Client
	// AppScheme is the scheme apps' public hosts are reached on — "https"
	// (the default) everywhere but tests.
	AppScheme string
	// EdgeIPs is this deployment's edge address list (PLATFORM_EDGE_IPS,
	// read at console start) — surfaced in the Domains section's
	// point-your-DNS-here guidance. nil is legal: guidance then says
	// "this deployment's edge IP" instead of inventing an address.
	EdgeIPs []string
	// SecretsPub is the deployment's CARLOS_SECRETS_PUBKEY, served (never
	// used) by the CLI config door so `carlos secrets set` can seal
	// client-side with `carlos auth login` alone. Public material by
	// design — it only encrypts; the console cannot decrypt anything with
	// or without it. Optional: "" omits the field from the API response
	// and the CLI falls back to requiring the env var.
	SecretsPub string
	// AppsDomain is the deployment's platform apps domain
	// (PLATFORM_APPS_DOMAIN, the same variable the edge and the host
	// agent read; flagship: "oncarlos.com"). The CLI's instances-manifest
	// door pins a member-written manifest's domain to
	// <account-sqid>.<AppsDomain> — never a domain the request names. ""
	// follows the litestream convention: the member-facing enable door
	// does not exist, and the handler refuses with a pointer at the
	// operator's store-mode `carlos instances enable`.
	AppsDomain              string
	AppsDomainAliasAccounts []string
	// RedirectHosts are request hosts this console answers with a permanent
	// redirect to Origin (CONSOLE_REDIRECT_HOSTS, comma-separated) — retired
	// hostnames after a canonical-origin move. Opt-in per host: hostnames
	// that must keep serving the API in place (CLI bearer tokens are
	// host-agnostic, and POSTs through an unexpected redirect are how
	// clients break) simply aren't listed.
	RedirectHosts []string
	// DenyDomains are hostnames (and every host under them) the /domains
	// door refuses to attach — CONSOLE_DENY_DOMAINS, comma-separated. The
	// deployment's own names, in other words: the edge's reserved tunnel
	// hostname, retired console origins, anything platform-managed that is
	// not already derivable from this config. Empty is legal. The console's
	// own hostnames are refused regardless (consoleHosts, apidomains.go).
	DenyDomains []string
	// TunnelHost is the fleet hub's reserved hostname (CARLOS_TUNNEL_HOST).
	// The /domains door refuses it, and everything under it, to everyone.
	// It is kept apart from DenyDomains because the operator's platform
	// door (#209) lifts DenyDomains and must never lift this: the edge
	// Allows the name and no registry route backs it, so a claim on it
	// would take the fleet's own address.
	TunnelHost string
	// ReservePlatformDomains (CONSOLE_RESERVE_PLATFORM_DOMAINS) is the
	// opt-in for a deployment that hosts apps for other people, such as the
	// flagship or carloku. With it set, the /domains door also refuses
	// everything under AppsDomain and under the console's own hostnames,
	// because on a shared platform those names belong to the operator and
	// not to a tenant. It is off by default. A self-hosted deployment
	// usually keeps its console, its apps and its custom domains in one
	// zone that one person owns, and the reserved rules refused ordinary
	// names there. See deniedDomains.
	ReservePlatformDomains bool
	// MovesEnabled is the Phase 1 moves switch (moves.Enabled, from
	// CARLOS_MOVES_PHASE1). Off, the console behaves exactly as it did
	// before Phase 1: the legacy move door answers and nothing new is
	// reachable.
	MovesEnabled bool
	// AWSAccount (CARLOS_AWS_ACCOUNT) is the deployment's AWS account id,
	// the trust anchor the move door checks every box's signed identity
	// record against (boxid.Verifier.Account). Unset, no box verifies and
	// no region can take a move. Only the Phase 1 move door reads it.
	AWSAccount string
	// DomainProof (CONSOLE_DOMAIN_PROOF) is the opt-in for proof of control
	// on custom hostnames (#215). With it set, a member's attach is stored
	// pending until a TXT record at _carlos-challenge.<host> carries the
	// account's token, and a pending claim is neither routed nor certified.
	// Off by default, and off means exactly the behaviour before #215:
	// every claim is written verified and no TXT lookup is ever made. That
	// default keeps the 2026-08-26/27 scope ruling (first-writer-wins plus
	// DNS-pointing-as-evidence) until a deployment chooses otherwise, and it
	// keeps a fleet that still runs pre-#215 boxes safe: such a box would
	// read a pending claim as live. Roll the fleet before turning it on.
	DomainProof bool
	// LookupTXT resolves the ownership-proof records the /domains doors
	// check (#215: domains.ChallengeName). nil means net.DefaultResolver;
	// tests set it so no attach ever reaches a real resolver.
	LookupTXT func(ctx context.Context, name string) ([]string, error)
	// StoreProvisioner is the backend the object-storage doors provision
	// through (issue #55), built at boot from CARLOS_STORE_BACKEND. nil is an
	// ordinary deployment shape, not a broken one: members may still DECLARE
	// a store — a declaration is a request an operator fulfils, and a member
	// cannot see whether a backend exists — while the operator doors that
	// create buckets and mint keys refuse. The console holds the identity
	// that MINTS app credentials and never an app's own.
	StoreProvisioner objstore.Provisioner
	// StoreScanner is the virus-scanning engine, built at boot from
	// CARLOS_STORE_SCANNER. nil is the ordinary shape — scanning is opt-in and
	// off by default — and it means the sweep never runs and the operator
	// doors that enable an engine refuse. It does NOT stop a member RECORDING
	// a request, for the same reason a nil StoreProvisioner does not stop a
	// declaration: a member cannot see whether their deployment has one.
	//
	// Teardown needs it too. A store with scanning enabled must have its
	// engine released before its bucket goes, so a nil scanner over an enabled
	// record is a refusal rather than a skip.
	StoreScanner objstore.Scanner
	// ScanSeedFromDeprecatedEnv says the retired CARLOS_STORE_SCANNER supplied
	// this deployment's clamd address. The first scan-pass tick then seeds
	// system/antivirus.json enabled, once, carrying forward an intent the
	// operator already expressed.
	//
	// Read at the first tick rather than at boot because cmd/console builds
	// the Scanner before it opens the release store, so there is nowhere to
	// write when the decision is made.
	ScanSeedFromDeprecatedEnv bool
	// ScanBudget bounds how much scanning ONE app gets per tick
	// (CARLOS_STORE_SCAN_BUDGET, default 60s). The arithmetic matters and is
	// stated in the spec: an hourly tick at 60s is 24 minutes of scanning per
	// app per day, so at a few hundred objects a minute over INSTREAM a
	// million-object bucket takes months. The default is honest for small and
	// medium stores; a deployment with large ones raises it or shortens the
	// tick.
	ScanBudget time.Duration
	// ScanInterval is the floor before a COMPLETED sweep is started again
	// (CARLOS_STORE_SCAN_INTERVAL, default 24h). A sweep still in flight
	// ignores it — that is how a bucket bigger than one budget finishes.
	ScanInterval time.Duration
	// ScanMaxSigAge is how old an engine's signature database may be before
	// `store scan status` warns (CARLOS_CLAMD_MAX_SIG_AGE, default 168h). A
	// clean verdict from three-month-old signatures is not the same claim as
	// a fresh one, and an audit answer that cannot tell them apart is worth
	// less than it looks.
	ScanMaxSigAge time.Duration
	// CallbackSigner retains the deployment master because callbacks are signed
	// after grant. nil is a supported deployment shape; callback enrollment and
	// key delivery refuse rather than ever falling back to unsigned delivery.
	CallbackSigner *CallbackSigner
	// CallbackTransport is the scan callback test seam. nil uses the production
	// transport, including ordinary TLS certificate and hostname verification.
	CallbackTransport http.RoundTripper
	// StoreDeployment is the deployment-wide half of every store: which
	// backend, which region and endpoint buckets are made in, and the prefix
	// minted bucket names carry. Threaded into every walk so this config is
	// the single place that knows where this deployment's object estate
	// lives — a walk that guessed would create the next bucket somewhere
	// else, and the record would say so afterwards.
	StoreDeployment objstore.Deployment
	// StoreMaxPerApp caps how many ENVIRONMENT stores one app may have
	// (CARLOS_STORE_MAX_PER_APP; 0 = storeMaxPerAppDefault). The app's own
	// store is not one of them and is never capped.
	//
	// It exists because #412 made a store something a signup path can mint:
	// a bucket plus an IAM user per instance is a bigger footprint than an
	// instance, and IAM's limits are per cloud account, so the automatic
	// path needs a bar it stops at. Enforced on the MANUAL door too
	// (handleAPIStoreCreate) — a ceiling only the automatic path respected
	// would be a ceiling anyone could step over by hand.
	StoreMaxPerApp int
	// PlanCatalog is the deployment's plan catalog (CARLOS_PLAN_CATALOG,
	// plans-caps-packs spec §4.1). nil means plans are off: no account has
	// limits, no limits record is published, and the plan door answers 409.
	PlanCatalog *plans.Catalog
	// TemporaryApps turns on POST /api/cli/apps/{account}/new-temporary
	// (temporary static sites spec §3). Off by default, and only switched on
	// after every box runs a binary that carries the tmp- reservation and
	// every registry has been scanned clean (the rollout steps). The expiry
	// pass runs either way, so apps created while it was on still expire.
	TemporaryApps bool
	// StoreOperators are the addresses allowed to drive the GRANT door, and
	// only that one (CARLOS_STORE_OPERATORS). Its own list rather than
	// console ownership on purpose: granting CREATES backend estate and
	// spends real money in the DEPLOYMENT's cloud account, so the authority
	// belongs to whoever runs the deployment, not to a tenant who owns an
	// account inside it. Empty is fail-closed — nobody may grant.
	//
	// The other two store verbs are deliberately NOT gated on this list.
	// Rotate and finish are the member's: they re-key an estate that already
	// exists, cost nothing, and only the member knows when every host has
	// picked the new pair up. Destroy is the account OWNER's, in the browser,
	// behind the typed bucket name and a passkey — it spends no money and
	// destroys only that account's own data.
	StoreOperators []string
	// DelegationZone is CARLOS_ACME_DELEGATION_ZONE — this deployment's own
	// zone that a wildcard-enabled claim's _acme-challenge CNAME must
	// delegate to (the edge's newWildcardFromEnv reads the same variable for
	// the same reason: claim-derived-wildcards spec §4). Deliberately
	// independent of AppsDomain — #167's blind spot was conflating the two.
	// "" is a legal deployment: wildcard enable then refuses every request
	// with "deployment has no delegation zone configured" rather than
	// guessing. Normalized (lowercase, trimmed) into Server.delegationZone at
	// construction, same as RedirectHosts is normalized into `redirects`.
	DelegationZone string
	// SteeringHost is the deployment's DNS-steering hostname — the
	// edge.<apps-domain> name the steering converger keeps one latency A
	// record per armed edge on (multi-region ingress spec, Part 4). Set only
	// where the deployment actually steers: cmd/console derives it from
	// CARLOS_STEERING_ZONE_ID (the same variable the converger reads, so the
	// console cannot advertise a hostname no pass maintains) plus
	// PLATFORM_APPS_DOMAIN. "" — every deployment today — leaves custom-domain
	// guidance byte-for-byte what it has always been. Normalized (lowercase,
	// trimmed, no trailing dot) into Server.steeringHost at construction.
	SteeringHost string
	// MailProvisioner is the backend the email doors provision against. nil
	// disables every email door — a deployment with no SES estate is a valid
	// deployment, and the doors must 404 rather than panic.
	MailProvisioner mail.Provisioner
	// DNSWriter publishes durable records for platform sending domains. nil
	// means platform domains behave like custom ones: records are emitted for
	// the member instead of published.
	DNSWriter dnsrec.Writer
	// MailDeployment carries the region, the platform suffix, the DMARC rua
	// and the SNS topic.
	MailDeployment mail.Deployment
	// MailOperators are the addresses allowed to drive the email pause/cap
	// door (CARLOS_MAIL_OPERATORS, apimail.go): pausing or resuming a
	// tenant's sending, and raising its daily cap above what its tier
	// grants automatically. Its own list rather than StoreOperators' or
	// console ownership, for the same reason StoreOperators is its own
	// list (that field's doc comment): the authority here is specific to
	// this deployment's shared SENDING REPUTATION, not to spending its
	// cloud bill, and the two should be grantable to different people.
	// Empty is fail-closed — nobody may pause, resume or raise a cap
	// through this door. Automatic abuse enforcement (mailcounts.go) is
	// unaffected either way: it calls mail.SetPaused directly, never
	// through this door.
	MailOperators []string
	// ConsoleMail is the console's own email sender (consolemail.go), the
	// invite fallback when Keymail cannot deliver. nil: no email fallback.
	ConsoleMail ConsoleMailer
	// ConsoleName is how this console names itself in the emails it sends
	// (CARLOS_CONSOLE_NAME). Empty reads "the CARLOS platform".
	ConsoleName string
	// RelayRegions are the AWS regions this deployment runs a STUN/TURN
	// relay in (CARLOS_RELAY_REGIONS, comma-separated), IN THE ORDER an
	// enabled app's CARLOS_RELAY lists them — the order every browser will
	// try them in, so it is the operator's list verbatim, not a set. Empty
	// is a legal deployment and the one this platform has had until now:
	// `carlos relay enable` refuses with a sentence naming the variable,
	// and no relay background loop starts at all.
	//
	// These are AWS region names (eu-west-1), not placement codes (ie,
	// fleet/x): they are the vocabulary of the relay hostnames
	// (relay.<region>.<platform domain>) and of the per-region master
	// secrets, and an app may sit in several placements at once (relay
	// spec §5, step 3).
	RelayRegions []string
	// RelayOperators are the addresses allowed to drive `carlos relay
	// rotate` (CARLOS_RELAY_OPERATORS) — the operator verb that moves a
	// region's issuer pointer to a freshly staged master and re-issues
	// every enabled app's key. Its own list for the same reason
	// StoreOperators is: rotating a region's master is an authority over
	// the DEPLOYMENT's key material, not over any one tenant's app, and a
	// deployment may want to grant it to different people. Empty is
	// fail-closed — nobody may rotate.
	RelayOperators []string
	// SystemOperators are the addresses allowed to roll the platform's own
	// binary (CARLOS_SYSTEM_OPERATORS, discussion #176): `carlos system
	// status`, `update` from the signed release feed, its job, and
	// `rollback`. Owners of the ops account have all of that already; this
	// list is for a person who should roll releases without owning the
	// account, which would also hand them member removal and ownership
	// transfer. Its own list rather than StoreOperators',
	// because that one reads tenant bytes through grants and scanning, and
	// rolling releases should not.
	//
	// The upload door stays the owner's. The console signs whatever it is
	// uploaded with the deployment key and every box runs it, so a listed
	// operator chooses WHICH upstream-signed release the fleet runs, and
	// only an owner can put an unreleased build on it. Empty is the
	// owner-only console that existed before the list.
	SystemOperators []string
	// WorkerHeads lists the deployment's maintenance worker heads (#132)
	// for the layout door's revert interlock (layoutRevertBlocked). Nil
	// means no reader is wired, which is every console today: the head
	// store has no key or reader on main yet.
	WorkerHeads func(ctx context.Context) ([]release.WorkerHead, error)
	// PlatformDomain is the domain relay hostnames are built under
	// (CARLOS_PLATFORM_DOMAIN; flagship: "oncarlos.com"), so an enabled
	// app is handed stun:relay.<region>.<PlatformDomain>:3478 and its two
	// TURN siblings. Optional: unset falls back to AppsDomain, with a
	// leading "apps." label stripped when the apps domain is a subdomain
	// of the platform's own — see relayDomain(). Set it explicitly
	// wherever the two differ by anything but that label; the relay's DNS
	// names are operator-managed and this console cannot discover them.
	PlatformDomain string
	// SidecarAccounts is the operator allowlist of account sqids that may
	// still enable and create native sidecars (CARLOS_SIDECAR_ACCOUNTS,
	// normalized by cmd/console: trimmed, lower-cased, each a valid sqid).
	// Empty is no gate at all, every deployment's shape before the list
	// existed. Set, every other account meets sidecarsPaused on the two
	// doors that bring a sidecar into being (sidecarsgate.go).
	SidecarAccounts []string
}

// Server is the console's http.Handler.
type Server struct {
	claimLossPageMu   sync.Mutex
	claimLossPageDone chan struct{}

	// noCapacity limits the no-capacity alert to once per region an hour
	// in this process (region HA spec 2 §7, H27, nocapacity.go).
	noCapacity noCapacityAlerts
	// Enabled claim runtime (ConfigureClaimRuntime). Unset flag-off.
	claimRuntimeConfigured bool
	claimOwner             hostops.RegistrationOwner
	claimMutationObserver  func(hostops.MutationEvent) // fixture recorder only
	claimBackendObserver   func(backendEvent)          // fixture recorder only
	claimEntries           claimInventory
	claimWorkers           map[string]func(context.Context)
	// The console's move pass (movesrecovery.go): its clock (nil is
	// time.Now; a TEST SEAM) and when each close was first seen due.
	movesClock    func() time.Time
	moveCloseMu   sync.Mutex
	moveCloseSeen map[string]time.Time
	// moveReleaseFault, when set, fails the pass's claim release just before
	// it is made (a TEST SEAM: a release that fails after its log entry is
	// queued, movesrecovery.go).
	moveReleaseFault func() error
	// moveLogSettleHook, when set, runs as the drainer settles an
	// unconfirmed declared_lost row, after it read the claim (a TEST SEAM:
	// a declaration that commits in between, movesrecovery.go).
	moveLogSettleHook func()
	// moveFenceCall, when set, runs as the pass calls the grant's
	// ReleaseFencedTarget, with the fence it names (a TEST SEAM: which
	// passes call the target's fence, movesrecovery.go).
	moveFenceCall func(hostclaim.FenceRef)
	dbHandleKey   []byte
	seedScratch   *seedScratch
	// seedCopies counts --from copies and import uploads running detached
	// from their request (apiinstanceseed.go, apiinstanceimport.go), so a
	// test can wait for one to finish.
	seedCopies sync.WaitGroup
	cfg        Config
	store      *Store
	// appRegionOf and beforeClaimInsert are TEST SEAMS (nil in
	// production): a store failure on the app-region read (C20), and a
	// competing insert landing after the region was resolved.
	appRegionOf       func(accountID int64, app string) (string, string, error)
	beforeClaimInsert func()
	// claims folds the deployment's domain claims for the read paths — the
	// Settings render and the domains list door — reading only the claims
	// whose bucket stamp moved since the last fold (#173). Process-lifetime
	// and safe for concurrent handlers; see domains.ClaimCache.
	claims    domains.ClaimCache
	km        *Keymail
	mux       *http.ServeMux
	instances *instanceFetcher
	secure    bool       // Secure cookies iff the origin is https
	cli       *cliLimits // rate limits on the CLI-identity endpoints (authcli.go)
	// boxCerts are AWS's instance-identity signing certificates by AWS
	// region (boxid.EmbeddedCerts), loaded once at construction. The Phase
	// 1 move door verifies each box's identity record with them; nil (a
	// load failure, logged) verifies nothing.
	boxCerts map[string]*x509.Certificate
	// dbReplica opens the read side of one instance's replica for the
	// `carlos db` door (apidb.go). NewServer points it at a small cache of
	// lease.ReadReplicaClient values; tests point it at a file replica.
	dbReplica func(ctx context.Context, prefix string) (replicaReader, error)
	dbClients dbReplicaCache
	// dbStreams bounds the db door's active file streams, and dbStreamIdle
	// is how long one may go without moving a byte (apidb.go).
	dbStreams    *dbStreamLimits
	dbStreamIdle time.Duration
	// dbReads bounds open forwarded reads per person and per console, held
	// by each read's request (spec §5.7, J5); dbf is its timing.
	dbReads *dbStreamLimits
	dbf     dbForwardTimes
	// cliRoles is pattern -> allowed roles, recorded by cliRoute as it
	// registers each /api/cli/ door (authcli.go). Written once, during
	// registerCLIRoutes, before the server serves anything, and only read
	// afterwards. It exists for two readers: the coverage tests, which
	// assert that every door names its roles and that the closed ones stay
	// closed, and the services API, which hands an operator the door list
	// for the role they just granted so they can see what they gave away
	// without reading a spec.
	cliRoles map[string]svcrole.Set
	// redirects is cfg.RedirectHosts, normalized (lowercase, no port) into a
	// lookup set — ServeHTTP checks it before the mux sees the request.
	redirects map[string]bool
	// cliNotified, when non-nil, is signalled after each CLI-token issuance
	// notification attempt. Tests only — the send is off the request
	// goroutine, and a test that asserted on it without this would be racing.
	cliNotified chan struct{}
	// storeWalks serialises the object-storage walks per app (storelock.go).
	// objstore's own teardown reasoning assumes this exists — "The console
	// door serialises these verbs per app" (objstore/walk.go:560) — and until
	// #381 nothing did.
	storeWalks *storeWalkLocks
	// doorPublish is the door-key publication lock per app, keyed
	// "<sqid>/<app>" (apidoorkeys.go): one publisher per app at a time, so a
	// renewal can never land an older key set after a revoke. Built lazily
	// under doorPublishMu, so the zero Server needs no setup.
	doorPublishMu sync.Mutex
	doorPublish   map[string]*sync.Mutex
	// sendApp is how the alert watcher (alertwatch.go) delivers keymail:
	// km.SendApp in production, a capture in tests. A field rather than a
	// direct call so an alertPass assertion needs no keymail server.
	sendApp func(ctx context.Context, token, to, subject, body string) (string, error)
	// Invite delivery (handleInvite): Keymail federation first, then the
	// console's own email. Fields so tests can substitute and shrink them.
	sendFederated  func(ctx context.Context, to, subject, body string) (string, error)
	consoleMail    ConsoleMailer
	consoleNameCfg string
	// limits are email sign-in's rate limits (emailsignin_limits.go): in
	// memory, one console process per deployment.
	limits emailLimits
	// flowLocks serialise /auth/continue per sign-in flow (flowLock).
	flowLocks [256]sync.Mutex
	// challengeSem bounds the sign-in and step-up sends in flight
	// (sendChallengeAsync). challengeSent, when non-nil, is signalled after
	// each one finishes or is dropped. Tests only, as cliNotified.
	challengeSem       chan struct{}
	challengeSent      chan struct{}
	inviteTimeout      time.Duration
	inviteKeymailShare time.Duration
	// inviteRate is each account's invites created in the last hour
	// (maxInvitesPerHour). In memory: a restart forgets it, and the pending
	// cap still holds.
	inviteRate inviteWindow
	// metricsCache holds the result of LoadMetrics's last successful bucket
	// sweep (metricsview.go). Concurrent callers within metricsCacheTTL share
	// it outright; callers arriving later still get it immediately (stale-
	// while-revalidate, up to metricsStaleServeCeiling) so the operator
	// dashboard and every owner's app-metrics page don't each re-sweep 48h of
	// chunks per request.
	metricsCache metricsCache
	// economicsCache holds LoadEconomics's last successful sweep per period
	// ("mtd", "last", "7d" — economicsview.go). Same shape as metricsCache,
	// keyed by period so a cold sweep for one period never blocks a caller
	// asking for another.
	economicsCache economicsCache
	// storeSizer is the storage pass's test seam for sizing a provisioned
	// tenant object store: nil means "use the real S3 sizer"
	// (sizeProvisionedStore, economicspass.go); tests inject a fake so a
	// sweep can be proven to degrade ("unswept") without live AWS.
	storeSizer func(ctx context.Context, p *objstore.Provisioned) (int64, error)

	// storeListerFor is the scan pass's test seam for listing a provisioned
	// bucket, the same shape and for the same reason as storeSizer above: the
	// sweep is driven against a MemProvisioner's buckets with no S3 and no
	// credentials.
	storeListerFor func(ctx context.Context, p *objstore.Provisioned) (objstore.ObjectLister, error)

	// scanQueue is which apps have on-demand scan work waiting (spec §7.1).
	//
	// SOFT STATE, and never the queue itself: the items are objects in each
	// app's own prefix, and this only says where to look. Losing it costs
	// latency, not items — the boot rebuild finds anything stranded and the
	// hourly sweep reaches every object regardless.
	//
	// Built in NewServer rather than lazily, because both writers reach it
	// without coordination: the enqueue door bumps it from a request
	// goroutine while the drain reads it from its own. A nil map assigned on
	// first use would be the race, and a Server that always has one cannot
	// have it.
	scanQueue    *objstore.QueueIndex
	scanDelivery *scanDeliveryPool
	// scanWaits is the in-process wake the status door's long-poll selects on
	// (scandrain.go). Zero value is usable, which is why it is a value rather
	// than a pointer: a Server built by a test that never starts the drain
	// still answers scanWait and scanNotify rather than panicking.
	scanWaits scanWaiters
	// ceCosts is billPass's test/fake seam for Cost Explorer (cepull.go,
	// economicspass.go): nil means "use the real, lazily-built CE client"
	// (s.realCECosts); tests inject a fake so a pull can be proven to
	// succeed, or to degrade quietly, without live AWS billing IAM.
	ceCosts func(ctx context.Context, start, end time.Time) (map[string]float64, error)
	// ceClientOnce/ceClient/ceWarnOnce/ceDisabled cache s.realCECosts'
	// Cost Explorer client and its process-lifetime disabled state — see
	// cepull.go's doc comment for why a mutex isn't needed here.
	ceClientOnce sync.Once
	ceClient     *costexplorer.Client
	ceWarnOnce   sync.Once
	ceDisabled   bool
	// The infrastructure inventory seam (infrapass.go), built exactly like
	// the Cost Explorer seam above it: tests set inventory to a fake, the
	// real path lazily constructs an awsinv.Provider once. infraDisabled
	// latches an auth-shaped failure off for the process — a deployment
	// with no inventory IAM grant answers "ungranted" once, not hourly.
	// Unlike ceDisabled above, this one IS reached from more than the
	// single-goroutine hourly ticker: loadInventory reads it to serve an
	// HTTP handler, and the refresh door (a later task) calls infraPass
	// directly from another — so it is atomic.Bool, not a plain bool.
	inventory     func(ctx context.Context) (infraview.Inventory, error)
	infraOnce     sync.Once
	infraProvider infraview.Provider
	infraDisabled atomic.Bool
	// infraRefreshing single-flights concurrent refresh-door callers
	// against EACH OTHER only — it says nothing about the ticker, which is
	// why infraDisabled above needs its own atomicity and this field
	// cannot stand in for that fix.
	infraRefreshing atomic.Bool
	// shipSem bounds how many `carlos ship` uploads (apicli.go,
	// handleAPIShip) may run AT ONCE, as opposed to s.cli.ship, which
	// bounds them over TIME. A rate limiter is a counter; it says nothing
	// about concurrency, and a ship holds a goroutine plus a substantial
	// buffer open for as long as the client trickles bytes in — a handful
	// of slow uploads run in parallel is a resource-exhaustion path the
	// counter alone does nothing to close. Always initialized (never nil):
	// unlike cliNotified below this is load-bearing in production, not a
	// test hook.
	shipSem chan struct{}
	// shipStarted, when non-nil, is signalled after a ship request
	// acquires shipSem, before it does any (possibly slow, possibly
	// blocking) reading of the request body. Tests only, same reasoning as
	// cliNotified: without this a test racing to fill shipSem would have no
	// way to know the earlier requests actually hold it yet.
	shipStarted chan struct{}
	// delegationZone and lookupCNAME are the wildcard-capability door's two
	// seams (apidomains.go). delegationZone is cfg.DelegationZone, shape-
	// validated and normalized once here (normalizeDelegationZone);
	// lookupCNAME takes the request's own ctx — the same ctx-first idiom
	// internal/edge/wildcard.go already uses for its DNS lookups — and
	// defaults to net.DefaultResolver.LookupCNAME. Tests stub it directly on
	// a constructed Server, the same way they override fx.srv.cfg.DenyDomains
	// post-construction.
	delegationZone string
	lookupCNAME    func(ctx context.Context, host string) (string, error)
	// lookupTXT is cfg.LookupTXT, defaulted to net.DefaultResolver: the
	// one TXT seam for both ownership proofs, an instance catch-all's
	// (domains.CatchallProofName) and a claim's (#215, domainProver).
	// Stubbed by tests the same way lookupCNAME is.
	lookupTXT func(ctx context.Context, name string) ([]string, error)
	// steeringHost is cfg.SteeringHost, normalized once here — see
	// dnsTargets, the one reader.
	steeringHost string
	// snsVerify is the SES ingest door's test seam (sesevents.go) — nil
	// means "do the real signature verification", which fetches the signing
	// certificate over the network. The seam covers signature verification
	// ONLY: it never substitutes for the TopicArn or SigningCertURL checks,
	// which every caller — production and test alike — runs for real.
	snsVerify func(snsEnvelope) error
	// mailPushTarget is the email-events push's test seam (mailpush.go):
	// nil means "the app's own platform host, over https", which is the
	// only place production ever sends. A test points it at an httptest
	// server instead. The path still goes through the same validation.
	mailPushTarget func(acct, app, path string) string
	// snsCerts caches a verified signing certificate's RSA public key by URL
	// (sesevents.go) — otherwise every request bearing the deployment's
	// TopicArn, which is not a secret, triggers a fresh outbound HTTPS fetch
	// and full chain verification. Zero value is ready to use.
	snsCerts snsCertCache
	// refusedTopics bounds the SES ingest door's refusal log (sesevents.go's
	// logRefusedTopic): the door is unauthenticated and internet-reachable,
	// so the diagnostic has to be rate-limited rather than omitted. Zero
	// value is ready to use.
	refusedTopicsMu sync.Mutex
	refusedTopics   map[string]time.Time
	// edgeFold caches the deployment's folded live edge addresses — every
	// box's control/edges/<box>.json joined against its status snapshot —
	// so the guidance strings can name every armed edge rather than only
	// the ones this console's own PLATFORM_EDGE_IPS lists. Cached because
	// dnsTargets is on the request path and is called once PER CLAIM inside
	// the domains-list loop: an uncached fold would put a LoadBoxes sweep
	// plus one Get per edges file behind every row of every listing. Zero
	// value is ready to use.
	edgeFold edgeFoldCache
	// edgeProof is the mesh-key cache and the seen latch behind clientIP's
	// loopback check (edgeproof.go). Zero value is ready to use.
	edgeProof edgeProofState
	// foldEdgeIPs is edgeFoldCache's test seam: nil means the real fold
	// over cfg.Releases (s.realFoldEdgeIPs). Tests inject a counter so the
	// TTL can be proven without a bucket, the same way storeSizer and
	// ceCosts stand in for AWS above.
	foldEdgeIPs func(ctx context.Context) []string
	// The `carlos system` promote's in-memory registries (apisystem.go):
	// systemJobs is the running/finished update jobs an operator polls,
	// systemRunning is "<component>/<channel>" -> the id of the job holding
	// that channel's one in-flight slot, and systemUploads is the single
	// upload slot a `--file` promote parks its bytes in between the PUT that
	// carries them and the job that consumes them. All three are
	// process-lifetime and deliberately NOT durable: a console restart loses
	// a job's step list, and re-running the promote is the recovery, because
	// every step of it is idempotent.
	systemMu   sync.Mutex
	systemJobs map[string]*systemJob
	// geoip is the single writer of control/geoip/ (geoip spec §3); nil
	// when this console has no deployment bucket.
	geoip         *geoipPublisher
	systemRunning map[string]string
	systemUploads map[string]systemUpload

	// The relay writer's three fields (relayops.go). relayHolder is this
	// PROCESS's identity in control/relay-writer.json, drawn once at
	// construction; relayHeld is whether the lease is currently ours, read
	// before every relay bucket write by requireRelayLease; relayAppLocks
	// serialises operations on one app ("<sqid>/<app>" -> *sync.Mutex)
	// inside the holder, which is the second half of spec §5's one-writer
	// rule — the lease keeps two CONSOLES apart, this keeps two handlers
	// of the same console apart.
	relayHolder   string
	relayHeld     atomic.Bool
	relayAppLocks sync.Map
	// appLocks and acctLocks are the temporary-app lifecycle locks
	// (applocks.go). Zero values are ready.
	appLocks  keyedLocks
	acctLocks keyedLocks
	// relayNow is the relay paths' clock seam: nil means time.Now. Tests
	// drive lease expiry with it; nothing in production sets it.
	relayNow func() time.Time

	// recordView is the record view the run and seed sweeps read through
	// (recordview.go), set by SetRecordView when CARLOS_CHANGE_INDEX=read
	// arms it; nil (disarmed) is every sweep walking the bucket as before
	// the index.
	recordView *provision.RecordView
	// viewUse is the last recordWalkStore outcome, so a switch between the
	// view and the bucket is logged once, not on every pass.
	viewUse atomic.Int32
	// lastOrphanFull is when the run sweep's orphan housekeeping last swept
	// every app with records (runsweep.go); zero until the first, which is
	// therefore full. Only the run sweep's one goroutine touches it.
	lastOrphanFull time.Time
}

// edgeFoldTTL is how long one fold of the deployment's edges files stands
// for. Edges arm and retire on the scale of a deployment, not a request, and
// every box republishes its own file on a 5min+jitter loop — so a minute is
// far below the rate at which the answer can actually change while still
// keeping the domains-list door off the bucket for all but one request a
// minute.
const edgeFoldTTL = time.Minute

// edgeFoldTimeout bounds one fold, mirroring the agent's own closure.
// dnsTargets takes no context of its own (it is called from deep inside view
// assembly), so without this a hung store would stall the domains-list door
// indefinitely rather than degrading to the configured list.
const edgeFoldTimeout = 30 * time.Second

// edgeFoldCache is the folded set plus the instant it was folded. The mutex
// is held ACROSS the refresh deliberately: it is what makes concurrent
// callers share one fold instead of stampeding the bucket, and the fold is
// bounded by edgeFoldTimeout so the worst case is a bounded wait, not a
// wedge.
type edgeFoldCache struct {
	mu  sync.Mutex
	at  time.Time
	ips []string
}

// consoleName is what the console's emails call it: the operator's
// CARLOS_CONSOLE_NAME, else today's wording.
func (s *Server) consoleName() string {
	if n := strings.TrimSpace(s.consoleNameCfg); n != "" {
		return n
	}
	return "the CARLOS platform"
}

// brandName is the console's own name in its page chrome (the header, the
// tab title, the front page): CARLOS_CONSOLE_NAME when the deployment sets
// one, so carloku.com reads "Carloku" throughout, else "CARLOS console".
func (s *Server) brandName() string {
	if n := strings.TrimSpace(s.consoleNameCfg); n != "" {
		return n
	}
	return "CARLOS console"
}

// chrome fills the deployment's names on any page before it renders.
func (s *Server) chrome(p *page) {
	p.Brand = s.brandName()
	p.ConsoleName = s.consoleName()
}

// dnsTargets is what every custom-domain guidance string in this console is
// built from (view.go's domainGuidance): the deployment's edge addresses and
// its steering hostname, read from ONE place so the app page, the Settings
// page and the /domains API can never disagree about where a member should
// point DNS.
func (s *Server) dnsTargets() DNSTargets {
	return DNSTargets{EdgeIPs: s.edgeIPs(), SteeringHost: s.steeringHost}
}

// edgeIPs is the deployment's edge addresses as this console will tell a
// member to point at: the operator's configured list UNIONED with the live
// fold, configured addresses first.
//
// Union, not replacement, in both directions. A console whose bucket read
// fails still offers PLATFORM_EDGE_IPS rather than none — an empty guidance
// string is worse than a partial one. And a multi-region deployment's other
// edges appear even though this console's env var predates them, which is
// the whole point: the same set the domains reconcile pass now judges
// "pointing" against, so guidance and verdict cannot disagree.
func (s *Server) edgeIPs() []string {
	out := append([]string(nil), s.cfg.EdgeIPs...)
	for _, ip := range s.foldedEdgeIPs() {
		if ip != "" && !slices.Contains(out, ip) {
			out = append(out, ip)
		}
	}
	return out
}

// foldedEdgeIPs answers the cached fold, refreshing it when it has aged past
// edgeFoldTTL.
//
// A refresh that comes back with NOTHING leaves the previous answer standing:
// an empty fold is a bucket that could not be read this minute far more often
// than it is a deployment that lost every edge, and emptying the set would
// silently narrow the guidance every member is shown. The timestamp still
// moves, so a persistent outage costs one bounded attempt per TTL rather than
// one per request.
func (s *Server) foldedEdgeIPs() []string {
	c := &s.edgeFold
	c.mu.Lock()
	defer c.mu.Unlock()
	if !c.at.IsZero() && time.Since(c.at) < edgeFoldTTL {
		return c.ips
	}
	fold := s.foldEdgeIPs
	if fold == nil {
		fold = s.realFoldEdgeIPs
	}
	ctx, cancel := context.WithTimeout(context.Background(), edgeFoldTimeout)
	defer cancel()
	ips := fold(ctx)
	c.at = time.Now()
	if len(ips) > 0 {
		c.ips = ips
	}
	return c.ips
}

// realFoldEdgeIPs folds the deployment bucket's edges files. env is nil here,
// not cfg.EdgeIPs: edgeIPs above does the union, so the configured list is
// added exactly once and the cache holds only what was actually read from the
// bucket — which is what lets an empty fold be recognised as a failed read.
// Sorted so a listing's guidance sentence does not reshuffle between calls on
// the store's arbitrary iteration order.
func (s *Server) realFoldEdgeIPs(ctx context.Context) []string {
	if s.cfg.Releases == nil {
		return nil
	}
	ips := edgesfile.EdgeIPs(ctx, s.cfg.Releases, nil, time.Now())
	slices.Sort(ips)
	return ips
}

// normalizeSteeringHost lowercases, trims and shape-validates the steering
// hostname (Config.SteeringHost). Same posture as normalizeDelegationZone
// below and for the same reason: a value that is not a legal hostname
// degrades to "" — guidance keeps the A-record form, which always works —
// rather than being pasted verbatim into a sentence every member of this
// deployment is shown. Loud, because a deployment that armed steering and
// typo'd the variable would otherwise mislead silently.
func normalizeSteeringHost(raw string) string {
	h := strings.ToLower(strings.TrimSpace(strings.TrimSuffix(strings.TrimSpace(raw), ".")))
	if h != "" && !provision.ValidHostShape(h) {
		log.Printf("console: steering hostname %q is not a valid domain — custom-domain guidance keeps the A-record form", raw)
		return ""
	}
	return h
}

// normalizeDelegationZone lowercases, trims, and shape-validates raw (from
// CARLOS_ACME_DELEGATION_ZONE): a value that isn't a legal hostname degrades
// to "" — delegation off — rather than being handed to lookupCNAME verbatim
// or failing boot. Mirrors the edge's own validation of the same variable
// (internal/edge/wildcard.go's newWildcardFromEnv), so a zone the edge would
// refuse never gets ACCEPTED here only to make every wildcard-enable request
// dial a garbage DNS query. "" already has a well-defined, honest answer —
// every enable request refuses with "deployment has no delegation zone
// configured" — so a badly-typed zone gets exactly that, not a crash or a
// distinguishable error.
func normalizeDelegationZone(raw string) string {
	zone := strings.ToLower(strings.TrimSpace(raw))
	if zone != "" && !provision.ValidHostShape(zone) {
		log.Printf("console: CARLOS_ACME_DELEGATION_ZONE %q is not a valid domain — delegation off, wildcard-enable requests refuse with \"no delegation zone configured\" until it's fixed", raw)
		return ""
	}
	return zone
}

// NewServer wires a server over an opened Store, loading (or minting) the
// console's Keymail signing key.
func NewServer(cfg Config, st *Store) (*Server, error) {
	if cfg.HostClaim && !st.claimGated() {
		return nil, fmt.Errorf("CARLOS_HOST_CLAIM: %s", "the console database must be opened gated (console.OpenGated)")
	}
	if cfg.HostClaim && cfg.HibernateBucket != "" && cfg.dbClaimRegion() == "" {
		return nil, fmt.Errorf("CARLOS_HOST_CLAIM: %s", "region is required")
	}
	cfg.Origin = strings.TrimSuffix(cfg.Origin, "/")
	// originHost is what a RedirectHosts entry must never equal: redirecting
	// the console's own origin to itself is a loop, not a retirement.
	originHost := ""
	if u, err := url.Parse(cfg.Origin); err == nil {
		originHost = normalizeHost(u.Host)
	}
	// An origin with no host in it is fatal ONCE there are hosts to retire,
	// never before: it is both the loop guard's only reference — an origin
	// that parsed to nothing silently permits the very entry the guard exists
	// to refuse — and the prefix every Location is built on, where "" would
	// hand back the request's own path (a redirect to the retired host) or a
	// scheme-relative "//host/…" whose destination the request chooses.
	// Deployments with nothing to retire keep whatever origin they had.
	if len(cfg.RedirectHosts) > 0 && originHost == "" {
		return nil, fmt.Errorf("console: CONSOLE_REDIRECT_HOSTS is set, but CONSOLE_ORIGIN %q has no host to redirect to — it needs a scheme, e.g. https://console.example.com", cfg.Origin)
	}
	redirects := make(map[string]bool, len(cfg.RedirectHosts))
	for _, h := range cfg.RedirectHosts {
		h = normalizeHost(h)
		if h == "" {
			continue
		}
		if h == originHost {
			return nil, fmt.Errorf("console: CONSOLE_REDIRECT_HOSTS lists %q, which is this console's own origin host — that config would redirect-loop", h)
		}
		redirects[h] = true
	}
	km := NewKeymail(cfg.Keymail, cfg.Origin)
	key, err := st.SigningKey()
	if err != nil {
		return nil, err
	}
	km.SetSigningKey(key)
	s := &Server{
		cfg:       cfg,
		store:     st,
		km:        km,
		mux:       http.NewServeMux(),
		instances: newInstanceFetcher(cfg.AppClient, cfg.AppScheme),
		secure:    strings.HasPrefix(cfg.Origin, "https://"),
		cli:       newCLILimits(),
		redirects: redirects,
		// Two concurrent ships at a time: roomy for one operator's CI plus a
		// human running `carlos ship` by hand, tight enough that a fleet of
		// slow-loris uploads against a stolen or shared token can't pile up
		// goroutines and buffers without bound.
		shipSem:            make(chan struct{}, 2),
		delegationZone:     normalizeDelegationZone(cfg.DelegationZone),
		steeringHost:       normalizeSteeringHost(cfg.SteeringHost),
		lookupCNAME:        net.DefaultResolver.LookupCNAME,
		lookupTXT:          cfg.LookupTXT,
		storeWalks:         newStoreWalkLocks(),
		consoleMail:        cfg.ConsoleMail,
		consoleNameCfg:     cfg.ConsoleName,
		challengeSem:       make(chan struct{}, challengeSendSlots),
		inviteTimeout:      20 * time.Second,
		inviteKeymailShare: 12 * time.Second,
		// This process's identity in the relay writer lease. Random rather
		// than derived from the host: two consoles on one box during a
		// deploy overlap are two writers, and they must be able to tell
		// each other apart (relayops.go).
		relayHolder: relayHolderID(),
		scanQueue:   objstore.NewQueueIndex(),
	}
	s.seedScratch = startSeedScratch(cfg.SeedScratchDir)
	if s.lookupTXT == nil {
		s.lookupTXT = net.DefaultResolver.LookupTXT
	}
	if certs, err := boxid.EmbeddedCerts(); err != nil {
		log.Printf("console: AWS identity certificates did not load (%v), so no box verifies for a move", err)
	} else {
		s.boxCerts = certs
	}
	if s.km != nil {
		s.sendApp = s.km.SendApp
		s.sendFederated = s.km.SendFederated
	}
	// No goroutine is started here: StartAlertWatcher is serve()'s job, so a
	// test that constructs a Server gets a Server and nothing else.
	s.registerRoute("GET /{$}", s.handleHome)
	s.registerRoute("POST /auth/continue", s.handleContinue)
	s.registerRoute("GET /auth/email/link", s.handleEmailLinkPage)
	s.registerRoute("POST /auth/email/link", s.handleEmailLink)
	s.registerRoute("POST /auth/email/code", s.handleEmailCode)
	s.registerRoute("POST /auth/email/stepup/code", s.handleStepUpEmailCode)
	s.registerRoute("GET /auth/signin", s.handleSignin)
	s.registerRoute("GET /auth/callback", s.handleCallback)
	// Passkey step-up (stepup.go): where a re-authentication lands, on its own
	// route so a step-up code and a sign-in code are never interchangeable.
	s.registerRoute("GET /auth/stepup/callback", s.handleStepUpCallback)
	s.registerRoute("GET /auth/confirm", s.handleConfirm)
	s.registerRoute("POST /auth/signout", s.handleSignout)
	s.registerRoute("GET /fleet", s.handleFleet)
	s.registerRoute("GET /fleet/store", s.handleStoreApprovalsPage)
	s.registerRoute("POST /fleet/store/{account}/{decision}", s.handleStoreDecisionPage)
	s.registerRoute("POST /a/{sqid}/store/apply", s.handleStoreApplyPage)
	s.registerRoute("GET /fleet/metrics", s.handleFleetMetrics)
	s.registerRoute("GET /fleet/economics", s.handleEconomics)
	// The deployment's map (archpage.go), same operatorOnly gate. BOTH are
	// registered WITHOUT a method prefix, for the reason spelled out below
	// the economics doors: a "GET /path" pattern answers a POST with 405 +
	// Allow, which distinguishes this route from an unrouted one to anyone
	// who merely guessed the URL — the exact probe the gate exists to
	// prevent. Each handler checks r.Method itself, first thing.
	s.registerRoute("/fleet/architecture", s.handleArchitecture)
	s.registerRoute("/fleet/architecture/refresh", s.handleArchitectureRefresh)
	// Per-account table (Task 14): same gate, its own search/filter/cursor
	// controls (econlistquery.go) over the same LoadEconomics rows.
	s.registerRoute("GET /fleet/economics/accounts", s.handleEconomicsAccounts)
	// Unit economics (Task 12): scenario/bill writes, operator-only, same
	// gate shape as handleFleet above. GET /fleet/economics is handled
	// above by handleEconomics (Task 13). Registered WITHOUT a method
	// prefix, deliberately: a
	// "POST /path" pattern answers a GET with 405 + Allow, which leaks that
	// the route exists to someone who merely guessed the URL — the exact
	// probe handleFleet's 404-to-everyone gate exists to prevent. Each
	// handler below checks r.Method itself, before anything else, so a
	// wrong-method request is byte-identical to an unknown route.
	s.registerRoute("/fleet/economics/scenarios", s.handleEconomicsScenarioSave)
	s.registerRoute("/fleet/economics/bill", s.handleEconomicsBillSave)
	s.registerRoute("/api/economics/bill", s.handleAPIEconomicsBill)
	s.registerRoute("/api/economics/backhaul", s.handleAPIEconomicsBackhaul)
	// Account tier (economics-v2, Task 4): same bare-registration/method-
	// first reasoning as the two doors above.
	s.registerRoute("/fleet/economics/tier", s.handleEconomicsTierSave)
	// CLI identity: the device-code login `carlos auth login` drives, the
	// approval page, and the tokens an owner can see and kill (authcli.go).
	// The db door's production replica reader (apidb.go); tests repoint it.
	if cfg.HostClaim {
		s.dbHandleKey = dbHandleSecret(key)
	}
	s.dbReplica = s.cachedReadReplica
	s.dbStreams = newDBStreamLimits(dbMaxStreams, dbMaxStreamsPerPrincipal)
	s.dbStreamIdle = dbStreamIdleDefault
	s.dbReads = newDBStreamLimits(dbreads.OpenPerConsole, dbreads.OpenPerPerson)
	s.dbf = defaultDBForwardTimes()
	s.registerCLIRoutes()
	// The email API's ten doors (apimail.go, tenant-email task 17) —
	// registered separately from registerCLIRoutes because this task's file
	// scope is server.go and apimail.go only.
	s.registerEmailRoutes()
	// Account-scoped and explicit: /a/<sqid>/apps/<app> rather than
	// account-by-session, so a link a teammate opens lands where you meant.
	s.registerRoute("GET /a/{sqid}/{$}", s.handleAccountHome)
	s.registerRoute("GET /a/{sqid}/fleet", s.handleAccountFleetTab)
	s.registerRoute("GET /a/{sqid}/fleet/byo", s.handleFleetBYO)
	s.registerRoute("GET /a/{sqid}/team", s.handleTeam)
	s.registerRoute("GET /a/{sqid}/settings", s.handleAccountSettings)
	s.registerRoute("POST /a/{sqid}/errors/level", s.handleAccountErrorLevel)
	s.registerRoute("POST /a/{sqid}/analytics/setting", s.handleAccountAnalyticsSetting)
	// Go 1.22's mux prefers this literal over apps/{app} below — exactly why
	// "new" must be a reserved app name (claimApp): an app so named could
	// never be viewed.
	s.registerRoute("GET /a/{sqid}/apps/new", s.handleNewAppForm)
	s.registerRoute("POST /a/{sqid}/apps/new", s.handleNewApp)
	s.registerRoute("POST /a/{sqid}/apps/new/region", s.handleNewAppRegion)
	s.registerRoute("GET /a/{sqid}/apps/{app}", s.handleApp)
	s.registerRoute("GET /a/{sqid}/apps/{app}/releases", s.handleAppReleases)
	s.registerRoute("GET /a/{sqid}/apps/{app}/deployments", s.handleAppReleases)
	s.registerRoute("GET /a/{sqid}/apps/{app}/account-review", s.handleAppAccountReview)
	s.registerRoute("GET /a/{sqid}/apps/{app}/instances", s.handleAppInstances)
	s.registerRoute("GET /a/{sqid}/apps/{app}/instances/{host}", s.handleAppInstance)
	s.registerRoute("POST /a/{sqid}/apps/{app}/restart", s.handleAppRestart)
	s.registerRoute("POST /a/{sqid}/apps/{app}/instances/{host}/restart", s.handleInstanceRestart)
	s.registerRoute("POST /a/{sqid}/apps/{app}/instances/{host}/retry", s.handleInstanceRetry)
	s.registerRoute("POST /a/{sqid}/apps/{app}/instances/{host}/updates", s.handleBrowserUpdates)
	s.registerRoute("POST /a/{sqid}/apps/{app}/instances/{host}/updates/install", s.handleBrowserUpdateNow)
	s.registerRoute("GET /a/{sqid}/apps/{app}/logs", s.handleAppLogs)
	s.registerRoute("GET /a/{sqid}/apps/{app}/logs/data", s.handleAppLogsData)
	// The Errors tab and its two setting doors (errorsview.go): the tab is
	// member-readable like every other app tab; the level is the owner's,
	// at app and account level, and both POSTs go through the console gate
	// (CSRF, then owner, then the byte-identical 404).
	s.registerRoute("GET /a/{sqid}/apps/{app}/errors", s.handleAppErrors)
	s.registerRoute("POST /a/{sqid}/apps/{app}/errors/level", s.handleAppErrorLevel)
	// Availability (errorsview.go): the Errors tab's sibling for the
	// failures that are the instance's, not the request's — edge 502/503/504
	// by cause and the platform's lifecycle events. Member-readable, no
	// setting of its own.
	s.registerRoute("GET /a/{sqid}/apps/{app}/availability", s.handleAppAvailability)
	// The Analytics tab (analyticsview.go) and the switch beside it. The tab
	// is member-readable like every other app tab; the switch rides the same
	// gate the errors level does at both levels, and bumps the serial where
	// the errors level does not: a box acts on whether the edge counts.
	s.registerRoute("GET /a/{sqid}/apps/{app}/analytics", s.handleAppAnalytics)
	s.registerRoute("POST /a/{sqid}/apps/{app}/analytics/setting", s.handleAppAnalyticsSetting)
	s.registerRoute("GET /a/{sqid}/apps/{app}/activity", s.handleAppActivity)
	s.registerRoute("GET /a/{sqid}/apps/{app}/settings", s.handleAppSettings)
	s.registerRoute("GET /a/{sqid}/apps/{app}/settings/{section}", s.handleAppSettings)
	// The pipeline settings page (pipelinepage.go, release pipelines v2 §5):
	// GET renders the current (or default) channel list as an editable
	// form; POST goes through the same guarded path the API PUT does.
	s.registerRoute("GET /a/{sqid}/apps/{app}/pipeline", s.handlePipelineSettings)
	s.registerRoute("POST /a/{sqid}/apps/{app}/pipeline", s.handlePipelineSettingsSave)
	s.registerRoute("POST /a/{sqid}/apps/{app}/promote", s.handlePromote)
	s.registerRoute("POST /a/{sqid}/apps/{app}/rollback", s.handleRollback)
	s.registerRoute("POST /a/{sqid}/apps/{app}/production", s.handleProduction)
	s.registerRoute("POST /a/{sqid}/apps/{app}/fasttrack", s.handleFastTrack)
	// The pending-change doors (pendinghandlers.go, release pipelines v2 §4):
	// confirm is member-gated with the passkey step-up LAST, reject is the
	// proposer's or an owner's and deliberately carries no step-up — refusing
	// authority is not exercising it.
	s.registerRoute("POST /a/{sqid}/apps/{app}/pending/{id}/confirm", s.handlePendingConfirm)
	s.registerRoute("POST /a/{sqid}/apps/{app}/pending/{id}/reject", s.handlePendingReject)
	s.registerRoute("POST /a/{sqid}/apps/{app}/canary", s.handleNewCanary)
	s.registerRoute("POST /a/{sqid}/apps/{app}/canary/retire", s.handleRetireCanary)
	// The app Settings writes (appsettings.go): owner-only, and delete/move
	// behind passkey step-up besides.
	s.registerRoute("POST /a/{sqid}/apps/{app}/place", s.handleAppPlace)
	// The password-gate form (appsettings.go's handleAppGate): member-gated,
	// unlike the owner-only writes above it.
	s.registerRoute("POST /a/{sqid}/apps/{app}/gate", s.handleAppGate)
	// The Deploys card's form (appswap.go): member-gated, like the gate.
	s.registerRoute("POST /a/{sqid}/apps/{app}/swap", s.handleAppSwap)
	s.registerRoute("POST /a/{sqid}/apps/{app}/rename", s.handleAppRename)
	s.registerRoute("POST /a/{sqid}/apps/{app}/keep", s.handleAppKeep)
	s.registerRoute("POST /a/{sqid}/apps/{app}/delete", s.handleAppDelete)
	s.registerRoute("POST /a/{sqid}/apps/{app}/move", s.handleAppMoveAccount)
	// The control-plane flag's two directions, both browser-only and both
	// owner-only. Clearing is passkey-gated, setting is not — the asymmetry
	// is spec §6's, and there is deliberately no API sibling for either
	// (controlplane.go).
	s.registerRoute("POST /a/{sqid}/apps/{app}/control-plane/clear", s.handleAppControlPlaneClear)
	s.registerRoute("POST /a/{sqid}/apps/{app}/control-plane/set", s.handleAppControlPlaneSet)
	// Custom domain attach/detach (appdomains.go, #82): owner-only, no
	// passkey step-up (spec §6) — detach's guard is the typed-host confirm.
	s.registerRoute("POST /a/{sqid}/apps/{app}/domains/attach", s.handleAppDomainAttach)
	s.registerRoute("POST /a/{sqid}/apps/{app}/domains/detach", s.handleAppDomainDetach)

	// Customer fleets (Task 9): the owner's own remote boxes and what's
	// placed on them — member-readable, owner-gated for rotate/detach
	// (fleets.go).
	s.registerRoute("GET /a/{sqid}/fleets/{fleet}", s.handleFleetPage)
	s.registerRoute("POST /a/{sqid}/fleets/{fleet}/rotate", s.handleFleetRotateBoxPage)
	s.registerRoute("POST /a/{sqid}/fleets/{fleet}/detach", s.handleFleetDetachBoxPage)
	s.registerRoute("POST /a/{sqid}/fleets/{fleet}/tags", s.handleFleetTagBoxPage)
	s.registerRoute("POST /a/{sqid}/fleets/{fleet}/place", s.handleFleetPlacePage)
	// The object store's destroy door (appsettings.go, issue #55): the account
	// owner, the bucket name typed out, and a passkey. It is the only console
	// route that destroys a customer's objects outside the app trash, and
	// unlike the trash there is no cooloff behind it.
	s.registerRoute("POST /a/{sqid}/apps/{app}/store/destroy", s.handleStoreDestroy)
	s.registerRoute("POST /a/{sqid}/invite", s.handleInvite)
	s.registerRoute("POST /a/{sqid}/invite/revoke", s.handleRevokeInvite)
	// Owner-only account administration, every one of them behind passkey
	// step-up as well as ownership and CSRF (ownership.go, spec §7a).
	s.registerRoute("POST /a/{sqid}/members/remove", s.handleRemoveMember)
	s.registerRoute("POST /a/{sqid}/members/transfer", s.handleTransferOwnership)
	s.registerRoute("POST /a/{sqid}/delete", s.handleDeleteAccount)
	// The service-credential pane's writes (svcpage.go, issue #220):
	// owner-only, and create/rotate behind passkey step-up besides. Revoke
	// deliberately is NOT — it is the emergency control, and it must not sit
	// behind a round trip that fails closed. See svcpage.go's doc comment.
	s.registerRoute("POST /a/{sqid}/services/new", s.handleServiceCreatePage)
	s.registerRoute("POST /a/{sqid}/services/rotate", s.handleServiceRotatePage)
	s.registerRoute("POST /a/{sqid}/services/revoke", s.handleServiceRevokePage)
	s.registerRoute("GET /a/{sqid}/trash", s.handleTrash)
	s.registerRoute("POST /a/{sqid}/trash/restore", s.handleRestoreApp)
	s.registerRoute("POST /a/{sqid}/trash/delete", s.handlePurgeApp)
	// GET only shows the invitation; joining is the POST its button sends
	// (discussion #219, item 4).
	s.registerRoute("GET /invite/{token}", s.handleInvitePage)
	s.registerRoute("POST /invite/{token}", s.handleAcceptInvite)
	s.registerRoute("GET /accounts/new", s.handleNewAccountForm)
	s.registerRoute("POST /accounts/new", s.handleNewAccount)
	// The pre-accounts URLs, kept as redirects so old links and bookmarks
	// still land somewhere sensible rather than 404ing.
	s.registerRoute("GET /apps", s.handleLegacyApps)
	s.registerRoute("GET /apps/{app}", s.handleLegacyApp)
	// "ok <build>" — the build comes from THIS PROCESS (ldflags, at link
	// time), which is the whole point: X-Carlos-Version is stamped by the
	// edge from the route row, so it reports the version adoption INTENDED
	// from the moment the symlink moves, whether or not anything restarted.
	// `carlos deploy` polls this instead for any app declaring a build probe.
	//
	// "ok" stays the first token: internal/vet and the edge health probe read
	// this endpoint and check status, not body, but keeping the prefix means
	// a human or a script eyeballing it sees what it always saw.
	s.registerRoute("GET /healthz", func(w http.ResponseWriter, r *http.Request) {
		fmt.Fprintln(w, "ok", version.Build)
	})
	// SES event ingest (sesevents.go, tenant-email spec §9): UNAUTHENTICATED,
	// like healthz above — SNS is not a signed-in member, so there is no
	// session, no CSRF and no owner check ahead of it. Its whole security
	// model lives inside handleSESEvents: a TopicArn allowlist, a
	// label-aware SigningCertURL host check, and a verified signature,
	// all run before any field of the message is trusted.
	s.registerRoute("POST /api/ses/events", s.handleSESEvents)
	// Catch up on accounts minted outside this database — `carlos accounts
	// create` writes the bucket manifest and the registry row and never opens
	// console state. Startup is the natural place: the account switcher, the
	// membership gate and every /a/<sqid>/… route resolve through the accounts
	// table, so an account the console has not materialized is invisible to
	// all of them. Best-effort; a bucket hiccup must not stop the console
	// booting.
	if cfg.HostClaim {
		if err := st.migrateClaimAppIdentity(); err != nil {
			return nil, err
		}
	}
	materializeQuietly(context.Background(), cfg.Releases, st, cfg.HostClaim)
	// The pre-accounts backfill: operators become owners of ops, every granted
	// app name is claimed there, and non-operator grant holders are left out
	// and REPORTED — a per-app grant was never authority over ops. Additive and
	// idempotent, so it is cheap enough to run on every start. The report is
	// logged rather than acted on: only an operator can decide who gets an
	// account of their own, but nobody can decide it if nobody is told.
	needAccounts, err := st.BackfillOpsMemberships(time.Now())
	if err != nil {
		return nil, err
	}
	if advice := grantHolderAdvice(needAccounts); advice != "" {
		log.Print(advice)
	}
	logRegionConfig(cfg)
	s.registerClaimWorkers()
	if cfg.Releases != nil {
		s.geoip = newGeoipPublisher(cfg.Releases, cfg.GeoipStagingDir)
	}
	return s, nil
}

// PublishMovesConsole writes control/moves-console.json: the moves
// protocol this console speaks and the fingerprint of its
// CARLOS_SECRETS_PUBKEY (empty when unset), so a box can check the console
// it is moving for (moves Task 13). Only with the moves switch on (index
// D13: off publishes nothing). Called once per start, by the console's
// main, never by NewServer, so constructing a Server in a test writes
// nothing. A later start replaces the record. Best-effort: a failure is
// logged and returned, and the console serves regardless.
func (s *Server) PublishMovesConsole(ctx context.Context) error {
	if !s.cfg.MovesEnabled || s.cfg.Releases == nil {
		return nil
	}
	fp, _ := appconfig.PublicFingerprint(s.cfg.SecretsPub)
	body, err := json.Marshal(moves.ConsoleRecord{V: 1, Protocol: moves.ProtocolVersion, SecretsKeyFP: fp, At: time.Now().UTC()})
	if err == nil {
		err = moves.PutReplace(ctx, s.cfg.Releases, moves.ConsoleKey, body)
	}
	if err != nil {
		log.Printf("console: could not publish %s: %v", moves.ConsoleKey, err)
		return err
	}
	return nil
}

// StartGeoipJobs runs the orphan sweep and D1 expiry at startup and then
// daily (geoip spec §3, D1), until ctx ends. It is the recorded worker
// "StartGeoipJobs" (claim_workers.go) and, like every worker, blocks: cmd/console
// starts it through RunClaimWorker, never NewServer, so constructing a Server in
// a test never starts a goroutine. Every goroutine it starts is joined before it
// returns, so a test that bounds it with a context leaves nothing behind. No
// publisher (no bucket) means GeoIP is off here and it returns at once.
func (s *Server) StartGeoipJobs(ctx context.Context) {
	if s.geoip == nil {
		return
	}
	var wg sync.WaitGroup
	defer wg.Wait()
	if f, ok := newGeoipFeeder(s.cfg, s.geoip); ok {
		log.Printf("console: geoip feed %s armed (first check in 5 minutes, then daily)", f.spec.Name)
		wg.Add(1)
		go func() { defer wg.Done(); f.run(ctx) }()
	} else {
		// Off the startup path, and bounded: a stalled bucket must not
		// hold the console's start (code review R4-1).
		wg.Add(1)
		go func() { defer wg.Done(); retryClearFeedStatus(ctx, s.cfg.Releases, 30*time.Second, 10*time.Minute) }()
	}
	for {
		s.geoipPass(ctx)
		t := time.NewTimer(24*time.Hour + mrand.N(time.Hour))
		select {
		case <-ctx.Done():
			t.Stop()
			return
		case <-t.C:
		}
	}
}

// geoipPass is one synchronous orphan sweep and D1 expiry check. Each is
// bounded: these hold the publish slot, and a stalled bucket must not leave
// publish and off answering 409 forever.
func (s *Server) geoipPass(ctx context.Context) {
	sctx, cancel := context.WithTimeout(ctx, 2*time.Minute)
	if err := s.geoip.Sweep(sctx); err != nil {
		log.Printf("console: geoip sweep: %v", err)
	}
	cancel()
	ectx, cancel := context.WithTimeout(ctx, 2*time.Minute)
	if _, err := s.geoip.ExpireIfDue(ectx, time.Now()); err != nil {
		log.Printf("console: geoip expiry check: %v", err)
	}
	cancel()
}

// ServeHTTP checks the host-based redirect BEFORE the mux on purpose: it's
// purely host-based, touches no session/account state, so it sits in front
// of the console's security gates without weakening them (the gates
// ordering rule concerns account-existence leaks; a host-level redirect
// reveals nothing).
func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	if s.redirects[normalizeHost(r.Host)] {
		code := http.StatusMovedPermanently
		if r.Method != http.MethodGet && r.Method != http.MethodHead {
			code = http.StatusPermanentRedirect // 308 keeps the method
		}
		http.Redirect(w, r, s.cfg.Origin+redirectTarget(r.URL), code)
		return
	}
	s.mux.ServeHTTP(w, r)
}

// redirectTarget is the path and query to hang off Origin: the request's own
// RequestURI, but only where that is the rooted path a browser sends. A
// request target may legally be rootless — `GET mailto:x@evil.com HTTP/1.1`
// parses to an opaque URL whose RequestURI is "x@evil.com" — and pasting that
// onto the origin spells https://console.example.com@evil.com, an open
// redirect wearing the console's own hostname in the userinfo. The console
// serves nothing at a rootless URL, so anything unrooted goes to the front
// door instead.
func redirectTarget(u *url.URL) string {
	if uri := u.RequestURI(); strings.HasPrefix(uri, "/") {
		return uri
	}
	return "/"
}

// normalizeHost reduces a request Host header (or a configured origin/
// redirect host) to the bare, lowercase hostname the RedirectHosts
// comparison keys on. net.SplitHostPort errors when there's no port to
// strip — a bare hostname, or an unbracketed IPv6 literal — and then the
// only thing left to remove is the brackets it would have taken off with the
// port, so that "[::1]" and "[::1]:8080" key the same.
func normalizeHost(host string) string {
	host = strings.ToLower(strings.TrimSpace(host))
	if h, _, err := net.SplitHostPort(host); err == nil {
		return h
	}
	return strings.TrimSuffix(strings.TrimPrefix(host, "["), "]")
}

// ---- pages ------------------------------------------------------------------

// page is the one bag every template reads from; unused fields are ignored.
type page struct {
	RegionPicker *regionPickerView // new-app page: nil = no picker

	AccountStore      *accountStoreView
	StoreQueue        *storeQueueView
	StorePending      *int
	StoreQueueUnknown bool

	// RegionLine is the Instances tab's app-region note (C7 or C8, spec
	// §10); "" shows nothing. RegionLineWarn marks C8.
	RegionLine     string
	RegionLineWarn bool

	InstanceDetail         *instanceDetail
	InstanceGroups         []instanceGroup
	InstanceChannels       []string
	InstanceUnknownChannel bool
	InstanceListURL        string
	DeploymentTargets      []deploymentTarget

	Title              string
	Address            string // signed-in address, "" when signed out
	CSRF               string // the session token, double-submitted on the signout POST
	Error              string
	Welcome            bool // one-shot "account created" banner
	BrowserRestartCopy BrowserRestartCopy
	StatusCopy         StatusCopy

	AccountReview AccountReview
	MismatchCopy  MismatchCopy

	ActiveNav string // account nav section this page sits in: "apps" | "fleet" | "team" | "settings"

	ActiveTab string // app pages: "overview" | "releases" | "instances" | "activity" | "settings"
	AppName   string // app pages: the {app} segment, for the tab bar and eyebrow

	// The signed-out front page and "Check your email" (emailsignin.go).
	// Prefill is the address the form starts with; Next the safe local path
	// carried as a hidden field; Banner a note above the form (an invite, a
	// terminal); NoMail shows home.no_mail; CheckSent is check.sent, filled;
	// CodeError a refusal of a typed code. SigninCopy is the approved copy,
	// set by render.
	Prefill, Next, Banner string
	NoMail                bool
	CheckSent, CodeError  string
	SigninCopy            signinView
	// Brand and ConsoleName are the deployment's names (render fills them):
	// Brand in the page chrome, ConsoleName in prose ("Welcome to ...").
	Brand       string
	ConsoleName string
	// The emailed link's confirm page: the token and the login-CSRF nonce
	// its form POSTs; StepUpLink when the link re-confirms a session
	// rather than signing in.
	LinkToken, LinkNonce string
	StepUpLink           bool
	// ConfirmNote is the team page's note on actions that ask you to
	// confirm it's you (team.confirm_note).
	ConfirmNote string
	// InvitePlaceholder and InviteNote are the team page's invite form
	// hints (team.invite_placeholder, team.invite_note).
	InvitePlaceholder, InviteNote string

	Msg string // generic message page body

	Flash    string // one-shot success notice (cookie-carried across a redirect)
	FlashErr string // one-shot error notice

	Apps          []appRow      // account home
	Detail        *AppView      // /a/{sqid}/apps/{app}
	Versions      []VersionView // app page: shipped releases, newest first
	Tags          []release.Tag // releases tab: every tag this app has cut, changelog and all
	RetentionKeep int           // releases tab: >0 when an ambient retention policy is set (spec 2026-08-10-releases-retention-design.md §7)
	// ReleaseSummary is the Releases tab's lede strip: what is live and
	// what is next, folded from Detail.Channels once the tab has them.
	ReleaseSummary ReleaseSummary
	// PromoteChannels is the per-row promote select's option list: the
	// ladder rungs (edge, beta, stable) so a fresh app with zero channels
	// still has somewhere to promote its first release, unioned with any
	// channels (including canary/*) the app already has.
	PromoteChannels []string
	Instances       *InstanceReport // app page: the app's self-report, nil when unpolled
	Events          []Event         // app page: recent console actions, newest first
	ActivityCopy    activityCopy    // app activity: reviewed labels and validation copy
	CanPromote      bool            // a signing key is configured on this host

	// Pending is the app page's pending-changes card (release pipelines v2
	// §4, pendinghandlers.go): every unexpired, unexecuted change this app
	// has, oldest first — a proposed promote, policy edit or fast-track,
	// with its quorum progress and the confirm/reject buttons that post to
	// Task 8's routes.
	Pending []PendingChangeView

	// The pipeline settings page (pipelinepage.go), GET/POST
	// /a/{sqid}/apps/{app}/pipeline: PipelineRows is the current (or
	// mid-edit draft) channel list as editable form rows, indexed ch.<i>.*;
	// PipelineIsDefault is whether it's still the untouched one-channel
	// default a fresh app is created with, which is when the two starter
	// templates (Edge → Production, Full ladder) are worth offering.
	PipelineRows      []PipelineFormRow
	PipelineIsDefault bool
	SettingsSection   string // app Settings sub-page selected by the URL
	SettingsRenameTo  string // retained draft after a General form refusal
	SettingsDomain    string // retained Domains attach draft
	SettingsChannel   string // retained Domains attach draft
	SettingsNav       []SettingsSectionLink

	// App page: how a canary channel gets a URL, rendered as commands the
	// reader can actually run from where they are reading. Computed
	// server-side (attachCommands) because the host shape comes from the
	// app's instances manifest. AttachEnable is non-empty only when
	// instances are PROVEN off, so the copy leads with the enable step.
	AttachCmd    string
	AttachEnable string

	// The account chrome every /a/{sqid}/… page carries.
	Account  *Account  // the account being viewed
	Role     string    // the viewer's role in it: owner | member
	Base     string    // "/a/<sqid>" — what every form on the page posts under
	Nav      string    // "/a/<name-or-sqid>" — what LINKS use; forms keep posting to Base
	Accounts []Account // the switcher: every account the viewer belongs to
	Members  []Account // team page: memberships (Name carries the address)
	Invites  []Invite  // team page, owners only: pending invitations
	HasApps  bool      // account settings: an account with apps cannot be deleted

	// The Trash (ownership.go): the account's deleted-but-restorable apps on
	// /a/{sqid}/trash, and the count the account home links with. Zero hides
	// the link entirely — an empty trash is not a place worth sending anyone.
	Trashed []TrashedAppView
	TrashN  int

	// ExpiresAt is when a temporary app moves to the Trash; zero for a
	// permanent one. appnav shows it with the Keep button.
	ExpiresAt time.Time

	// The picker: /a/{seg}/ where seg matches more than one of the viewer's
	// accounts, as a name, a sqid, or one of each.
	PickerSeg      string    // the ambiguous segment the picker is disambiguating
	PickerAccounts []Account // every account of the viewer's that segment matches

	Fleet *status.Fleet // /fleet: nil means no snapshot published yet

	// /fleet, below the published boxes table: the per-host PRIVATE detail
	// read straight out of status/boxes/ (HostRows, view.go). Raw numbers
	// render here and nowhere public — this page is session-gated to
	// operators, fleet.json is not. Nil renders no section at all: no boxes
	// yet, no bucket handle, or a boxes read that failed are all "no detail
	// to show", never a reason to fail the page.
	Hosts []HostRow

	// /fleet/metrics: the operator dashboard (Task 11), both from LoadMetrics
	// (metricsview.go) and both nil-safe to render — no boxes and no firing
	// alerts are the normal, healthy, empty state, not an error.
	Metrics      []BoxMetricsView
	MetricAlerts []AlertRow

	// /fleet/architecture (archgraph.go): the deployment's map. Arch is nil
	// on every other page, and the template's {{with .Arch}} is what keeps
	// this page's blocks off them.
	//
	// There is no pre-rendered SVG here: an estate is drawn as one picture
	// per region band and the number of bands is a property of the estate,
	// so the template ranges over Arch.CARLOS.Bands / Arch.Rest.Bands and
	// each band renders itself.
	//
	// ArchBoxesUnread is why the box list is empty: an empty Boxes with a
	// failed fleet/host read behind it must say "could not be read", never
	// "no box has reported". The distinction cannot be made from Boxes
	// alone — both cases are len 0 — so the handler carries it here.
	Arch            *ArchView
	ArchBoxesUnread bool

	// /fleet/economics: the operator unit-economics dashboard (Task 13),
	// from LoadEconomics (economicsview.go). nil only on a rendering path
	// this handler never takes (handleEconomics always loads one before
	// rendering) — every field on it is itself nil-safe, matching Metrics
	// above.
	Economics *EconomicsView

	// /fleet/economics/accounts: the per-account table (Task 14) —
	// EconAccounts is the computed page (rows, counts, links, pager),
	// EconQuery is the parsed request so the search box and filter links
	// re-render what the viewer asked for. Economics (above) is ALSO set on
	// this page: the template embeds the same econ-data payload so the
	// shared knob drawer recomputes this page's rows too.
	EconAccounts econAccountsPage
	EconQuery    econAccountQuery

	// App page, "Resources": this app's OWN instances' unit readings (Task
	// 12), one row per route host. Nil renders no section at all — metrics
	// are decoration on this page and must never be the reason it fails.
	AppMetrics []InstanceMetrics

	// App Overview: the dashboard's vital statistics (overview.go), derived
	// from reads the page does anyway.
	Overview OverviewStats

	// App Overview: the same reads drawn as the pipeline they describe
	// (flow.go). Zero-valued (Show false) renders nothing at all.
	Flow FlowView

	// App Instances: the one table — routes joined with their readings.
	InstanceRows  []InstanceRow
	CanRestartApp bool

	// App Instances: the search/health-filter/cursor controls (Task 8) —
	// InstancePage is the computed page (rows, counts, links, pager),
	// InstanceQuery is the parsed request so the form and links re-render
	// what the viewer asked for.
	InstancePage  instancePage
	InstanceQuery instanceQuery

	// App Logs (apilogs.go's sibling page): the merged timeline plus the
	// filter state the form re-renders with. Empty LogRows with LogsErr ""
	// is the normal nothing-logged-yet state, never an error.
	LogRows       []applog.Record
	LogStream     string
	LogSince      string
	LogHost       string
	LogLevel      string
	LogGrep       string
	LogLegacyGrep string
	LogFollow     bool
	LogHosts      []string
	LogCopy       appLogsCopy
	LogWidenURL   string
	LogCursor     string
	LogTruncated  bool
	LogsErr       string

	// App Errors (errorsview.go's page, apierrors.go's sibling): the
	// assembled window plus the filter state the form re-renders with. Empty
	// ErrWin with ErrsErr "" is the normal nothing-failed-yet state, never an
	// error.
	ErrWin    errorsWindow
	ErrSince  string // "1h" | "24h" | "168h", or any duration a URL named
	ErrSource string
	ErrLevel  string // "" = the setting
	ErrHost   string
	ErrFP     string // expanded group
	ErrsErr   string
	// ErrLevelSetting is the resolved log level for the two SETTINGS pages
	// (app and account), which is where the level is changed rather than
	// read past. Zero everywhere else.
	//
	// ErrLevelUnread says the resolve FAILED, so the zero Resolved beside it
	// must not be shown as if the defaults were the setting: a form
	// pre-selecting "error" over a level that is really "warn" invites an
	// owner to save a change they did not mean to make. The section then
	// says it could not be read, and offers no form at all.
	ErrLevelSetting telemetry.Resolved
	ErrLevelUnread  bool

	// AnalyticsSetting is the same resolved object, under the name the
	// Analytics section of those two pages reads it by — telemetry.Resolve
	// returns both halves at once, so the pages fill these from the ONE call
	// they already make. AnalyticsUnread carries the same refusal to show
	// defaults as if they were the setting.
	AnalyticsSetting telemetry.Resolved
	AnalyticsUnread  bool

	// SwapPolicy is the app's swap policy for the settings page's Deploys
	// card (zero-downtime spec §4.1, §9.2). SwapUnread says the read failed,
	// and the card then offers no form, for ErrLevelUnread's reason.
	SwapPolicy appconfig.SwapPolicy
	SwapUnread bool

	// App Analytics (analyticsview.go's tab, apianalytics.go's sibling): the
	// assembled window plus the range the form re-renders with. A zero
	// AnalyticsWin with AnalyticsErr "" is the normal nothing-counted-yet
	// state, never an error — and the window carries its own resolved
	// setting, because the tab has to say whether counting is on.
	AnalyticsWin   analyticsWindow
	AnalyticsRange string // "today" | "7d" | "30d"
	AnalyticsErr   string

	// Action confirm interstitial (confirm.go): what is about to happen,
	// carried fields and all. Nil everywhere except the confirm page.
	Confirm *ConfirmView

	// App Settings (appsettings.go): what the tab knows beyond the AppView.
	Settings *SettingsView

	// /a/{sqid}/fleets/{fleet} (Task 9): the owner's own remote boxes,
	// joined to their heartbeats, and the account's apps placed on this
	// fleet. FleetDetail carries only Name/Account/Bucket — registry.Fleet
	// has no TokenHash on it at all (that lives on FleetBox, never echoed
	// here — see fleets.go's package doc comment), so putting it straight
	// on the page is safe.
	FleetDetail *registry.Fleet
	FleetBoxes  []fleetPageBox
	FleetApps   []fleetPagePlacedApp
	// FleetPlaceableApps is the fleet page's "Place an app here" form: the
	// account's apps that are not already placed on THIS fleet
	// (fleetPlaceableApps). Empty means the form renders nothing to choose,
	// so the form itself is withheld — never an empty select.
	FleetPlaceableApps []string

	// App Instances tab, "Placement" (Task 6): where this app runs
	// ("fleet/<name>", or "" for the shared fleet), and the account's own
	// fleets as the owner's move options. AppPlacementKnown false means the
	// read FAILED — the section then says so instead of claiming the shared
	// fleet, and the move form is withheld rather than pre-selecting a guess.
	AppPlacement      string
	AppPlacementKnown bool
	OwnedFleetNames   []string

	// /a/{sqid}/fleet (accountfleet.go): the account-level Fleet TAB, which
	// is neither of the two pages above — the shared platform fleet as this
	// account sees it (built from the PUBLIC status/fleet.json aggregate,
	// never the raw per-box snapshots) and an index of the account's own
	// fleets. Set only by handleAccountFleetTab; every other page leaves
	// SharedFleet nil and renders no such section.
	// FleetsKnown says the AccountFleets read SUCCEEDED, so an empty slice
	// may be rendered as "no fleets yet" rather than "unknown" — the twin of
	// sharedFleetCard.PlacementKnown, and load-bearing for the same reason:
	// nil is otherwise both answers at once.
	SharedFleet   *sharedFleetCard
	AccountFleets []accountFleetCard
	FleetsKnown   bool
	// RotatedLabel/RotatedToken are set only on the response to a rotate
	// POST, to show the fresh bearer token exactly once — never stored,
	// never re-derivable from a later view of this same page.
	RotatedLabel string
	RotatedToken string

	// The service-credential pane on /a/{sqid}/settings (svcpage.go, issue
	// #220). Filled ONLY for an owner, which is why the pane needs no new
	// template condition — it sits inside the {{if .IsOwner}} block that
	// already exists. A member therefore sees the page WITHOUT the section
	// rather than with an empty one: an empty section reads as "this account
	// has no service credentials", a different and possibly false statement.
	//
	// Services carries no secret and never can: only a credential's sha256 is
	// stored, so there is nothing in a listed row to leak. ServicesUnknown
	// says the listing READ FAILED, so the pane can say so instead of
	// rendering an empty table as "none" — nil is otherwise both answers at
	// once.
	Services        []CLIToken
	ServicesUnknown bool
	ServiceRoles    []string // the mint form's role choices, from svcrole.All
	ServiceRungs    []string // the mint form's rung choices, deploy only
	ServiceApps     []string // the mint form's scope choices: this account's apps
	// ServiceSecret is the once-only block, set ONLY on the response to the
	// create or rotate POST that produced it — never redirected to, never
	// flashed (a flash is a cookie, and a credential does not belong in one).
	ServiceSecret *ServiceSecretView
}

type SettingsSectionLink struct {
	Key, Label, Href string
	Current          bool
}

type appLogsCopy struct {
	Instance, AllInstances, Search, AllLevels, Follow, Pause, Widen, FollowError, Refreshed string
}

// IsOwner is the template's one permission question.
func (p page) IsOwner() bool { return p.Role == RoleOwner }

// appRow is one line of the "your apps" table: the app, where it's running,
// whether anything the REGISTRY tracks needs attention, and what its owned
// routes report serving.
// The verdict here is registry-scope by design — process liveness only
// exists in the per-app metrics sweep, which is too heavy to run across a
// whole account's list. So the healthy word is "Deployed", never "All
// good": the list claims exactly what it knows, and the app's Overview
// (which has the sweep) gives the full verdict. Publishing per-app liveness
// into the aggregate feed so this list can say more is a filed follow-up.
type appRow struct {
	App          string
	URL          string // apex host, "" when no routes
	Verdict      string // ok | attention | notdeployed | unknown
	VerdictLabel string // Deployed | Needs attention | Not deployed yet | Can't tell right now
	Deployment   DeploymentStatus
	CanaryN      int // count of canary/* channels
}

func (s *Server) render(w http.ResponseWriter, status int, name string, p page) {
	p.StatusCopy = approvedStatusCopy
	p.BrowserRestartCopy = approvedBrowserRestartCopy
	p.MismatchCopy = approvedMismatchCopy
	p.SigninCopy = approvedSigninView
	s.chrome(&p)
	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	w.WriteHeader(status)
	if err := templates.ExecuteTemplate(w, name, p); err != nil {
		log.Printf("console: render %s: %v", name, err)
	}
}

func (s *Server) renderMessage(w http.ResponseWriter, r *http.Request, status int, title, msg string) {
	p := s.basePage(r)
	p.Title = title
	p.Msg = msg
	s.render(w, status, "message", p)
}

// basePage fills the fields the layout chrome needs (signed-in address and
// the signout CSRF token).
func (s *Server) basePage(r *http.Request) page {
	addr, raw, ok := s.session(r)
	if !ok {
		return page{}
	}
	return page{Address: addr, CSRF: raw}
}

// ---- session plumbing -------------------------------------------------------

func (s *Server) session(r *http.Request) (address, rawToken string, ok bool) {
	c, err := r.Cookie(sessionCookie)
	if err != nil || c.Value == "" {
		return "", "", false
	}
	addr, ok := s.store.SessionAddress(c.Value, time.Now())
	if !ok {
		return "", "", false
	}
	return addr, c.Value, true
}

func (s *Server) setCookie(w http.ResponseWriter, name, value string, maxAge int) {
	http.SetCookie(w, &http.Cookie{
		Name: name, Value: value, Path: "/",
		MaxAge: maxAge, HttpOnly: true, Secure: s.secure,
		SameSite: http.SameSiteLaxMode,
	})
}

func (s *Server) clearCookie(w http.ResponseWriter, name string) {
	s.setCookie(w, name, "", -1)
}

// ---- flash notices ----------------------------------------------------------

const flashCookie = "carlos_console_flash"

// setFlash parks a one-shot notice ("ok" or "err") in a cookie for the page
// after the redirect — no query-string flashes an outsider could spoof into
// a link.
func (s *Server) setFlash(w http.ResponseWriter, kind, msg string) {
	s.setCookie(w, flashCookie, url.QueryEscape(kind+"|"+msg), 300)
}

// takeFlash reads and clears the notice.
func (s *Server) takeFlash(w http.ResponseWriter, r *http.Request) (flash, flashErr string) {
	c, err := r.Cookie(flashCookie)
	if err != nil || c.Value == "" {
		return "", ""
	}
	s.clearCookie(w, flashCookie)
	v, err := url.QueryUnescape(c.Value)
	if err != nil {
		return "", ""
	}
	kind, msg, _ := strings.Cut(v, "|")
	if kind == "err" {
		return "", msg
	}
	return msg, ""
}

// ---- auth handlers ----------------------------------------------------------

func (s *Server) handleHome(w http.ResponseWriter, r *http.Request) {
	if addr, _, ok := s.session(r); ok {
		s.redirectToCurrentAccount(w, r, addr, http.StatusFound)
		return
	}
	s.renderHome(w, r, homeForm{Next: r.URL.Query().Get("next")})
}

// redirectToCurrentAccount sends a signed-in user to the account they were
// last in — else their first membership by creation order, else a personal
// account minted on the spot. Nobody signed in ever has nowhere to land.
func (s *Server) redirectToCurrentAccount(w http.ResponseWriter, r *http.Request, addr string, code int) {
	sqid, err := s.currentAccount(r.Context(), addr)
	if err != nil {
		log.Printf("console: landing for %s: %v", addr, err)
		s.renderMessage(w, r, http.StatusInternalServerError, "Error", "Could not open your account. Please try again.")
		return
	}
	seg := sqid
	if accts, err := s.store.AccountsFor(addr); err == nil {
		for i := range accts {
			if accts[i].Sqid == sqid {
				seg = preferredSeg(accts, &accts[i])
				break
			}
		}
	}
	http.Redirect(w, r, "/a/"+url.PathEscape(seg)+"/", code)
}

// currentAccount resolves the three landing cases in order: MRU history (only
// if still a member — an account you were removed from must not strand you),
// first membership, or mint.
func (s *Server) currentAccount(ctx context.Context, addr string) (string, error) {
	a, err := s.memberAccount(addr)
	if err != nil {
		return "", err
	}
	if a != nil {
		return a.Sqid, nil
	}
	m, err := s.mintAccount(ctx, addr, addr)
	if err != nil {
		return "", err
	}
	return m.Sqid, nil
}

// memberAccount is currentAccount's first two cases WITHOUT the mint: the MRU
// account if the viewer is still a member of it, else their first membership
// by creation order, else nil. Split out because pages that merely want the
// header's account context — /accounts/new — must not create an account as a
// side effect of being looked at. Only landing mints.
func (s *Server) memberAccount(addr string) (*Account, error) {
	if id, err := s.store.LastAccount(addr); err != nil {
		return nil, err
	} else if id != 0 {
		if role, err := s.store.Role(id, addr); err != nil {
			return nil, err
		} else if role != "" {
			a, err := s.store.AccountByID(id)
			if err != nil {
				return nil, err
			}
			if a != nil {
				a.Role = role
				return a, nil
			}
		}
	}
	accts, err := s.store.AccountsFor(addr)
	if err != nil {
		return nil, err
	}
	if len(accts) > 0 {
		return &accts[0], nil
	}
	return nil, nil
}

// mintAccount creates an account owned by addr: the next free id allocated in
// the bucket, its frozen sqid, and the console DB rows.
//
// The bucket write comes FIRST and is no longer best-effort, because it is now
// the allocator: the id is claimed by a create-only manifest write, which is
// what stops two boxes minting the same integer at the same moment. A console
// row whose manifest never landed would be an account that vanishes on the
// next rebuild — worse than a "new account" button that reports the outage.
//
// The name is NOT validated here: auto-mint names personal accounts by
// keymail address, and landing must never refuse to mint (spec §1).
func (s *Server) mintAccount(ctx context.Context, name, ownerAddr string) (*Account, error) {
	now := time.Now()
	id, sqid, err := domains.MintAccount(ctx, s.cfg.Releases, name, ownerAddr, now)
	if err != nil {
		return nil, err
	}
	if err := s.store.CreateAccount(id, sqid, name, ownerAddr, now); err != nil {
		// The manifest already landed, so the id is claimed and there is now an
		// account in the bucket with no console row and no owner. It is
		// unreachable rather than dangerous (no membership means no access, and
		// materialization gives it no members either), and the next mint simply
		// takes the id after it. But without this line the only trace is a 500
		// in the user's browser: name the sqid so the stranded account can be
		// found and either adopted with `console member -add … -role owner` or
		// deleted from the bucket.
		log.Printf("console: minted account %s (id %d, %q) into the bucket but could not record it "+
			"locally: %v — accounts/%s/account.json is stranded with no owner", sqid, id, name, err, sqid)
		return nil, err
	}
	if err := s.store.SetLastAccount(ownerAddr, id); err != nil {
		log.Printf("console: set last account for %s: %v", ownerAddr, err)
	}
	return &Account{ID: id, Sqid: sqid, Name: name, Role: RoleOwner, CreatedAt: now}, nil
}

// account is the gate on every /a/{seg}/… route: a session, and a segment
// that resolves — as a sqid OR a name, symmetrically — to an account the
// viewer belongs to. Resolution and membership proof are deliberately the
// same lookup (the membership set IS the resolution scope), so an unknown
// account, someone else's account, and a name that resolves to nothing all
// answer with the BYTE-IDENTICAL http.NotFound an unrouted URL gets —
// account existence is not probeable, matching /fleet's operator gate.
// Several matches (a shared name, or a name colliding with a sqid) render
// the picker on GET and the same 404 otherwise — forms always post to sqid
// paths, so an ambiguous mutation has no legitimate author.
//
// Signed-out users are sent to the front page instead, which reveals nothing
// either way because it happens for every segment, real or not.
func (s *Server) account(w http.ResponseWriter, r *http.Request) (addr, raw string, acct *Account, role string, ok bool) {
	addr, raw, sok := s.session(r)
	if !sok {
		http.Redirect(w, r, "/", http.StatusFound)
		return "", "", nil, "", false
	}
	accts, err := s.store.AccountsFor(addr)
	if err != nil {
		log.Printf("console: account lookup: %v", err)
		http.NotFound(w, r)
		return "", "", nil, "", false
	}
	seg := r.PathValue("sqid")
	matches := matchAccounts(accts, seg)
	switch len(matches) {
	case 1:
		a := matches[0]
		return addr, raw, a, a.Role, true
	case 0:
		http.NotFound(w, r)
		return "", "", nil, "", false
	default:
		if r.Method != http.MethodGet {
			http.NotFound(w, r)
			return "", "", nil, "", false
		}
		p := s.basePage(r)
		p.Title = "Which " + seg + "?"
		p.PickerSeg = seg
		for _, m := range matches {
			p.PickerAccounts = append(p.PickerAccounts, *m)
		}
		s.render(w, http.StatusOK, "picker", p)
		return "", "", nil, "", false
	}
}

// owner is account plus the owner-only gate. A member who probes an
// owner-only action gets the same 404 a non-member does: the difference
// between "not yours" and "not allowed" is not information this hands out.
func (s *Server) owner(w http.ResponseWriter, r *http.Request) (addr, raw string, acct *Account, ok bool) {
	addr, raw, acct, role, ok := s.account(w, r)
	if !ok {
		return "", "", nil, false
	}
	if role != RoleOwner {
		http.NotFound(w, r)
		return "", "", nil, false
	}
	return addr, raw, acct, true
}

// handleLegacyApps / handleLegacyApp keep the pre-accounts URLs alive as
// redirects into the current account.
func (s *Server) handleLegacyApps(w http.ResponseWriter, r *http.Request) {
	addr, _, ok := s.session(r)
	if !ok {
		http.Redirect(w, r, "/", http.StatusFound)
		return
	}
	s.redirectToCurrentAccount(w, r, addr, http.StatusFound)
}

func (s *Server) handleLegacyApp(w http.ResponseWriter, r *http.Request) {
	addr, _, ok := s.session(r)
	if !ok {
		http.Redirect(w, r, "/", http.StatusFound)
		return
	}
	sqid, err := s.currentAccount(r.Context(), addr)
	if err != nil {
		http.NotFound(w, r)
		return
	}
	http.Redirect(w, r, "/a/"+url.PathEscape(sqid)+"/apps/"+url.PathEscape(r.PathValue("app")), http.StatusFound)
}

// handleNewAccountForm is the "New account" screen: its own gated page at its
// own URL, linked from the switcher, rather than a text box wedged into the
// header. It takes no account parameter of any kind — there is nothing here
// to point at another account, so it cannot become a way to probe one — and
// it deliberately does NOT record an MRU: you are not "in" an account here,
// and moving the pointer would send the next sign-in somewhere never chosen.
func (s *Server) handleNewAccountForm(w http.ResponseWriter, r *http.Request) {
	addr, raw, ok := s.session(r)
	if !ok {
		http.Redirect(w, r, "/", http.StatusFound)
		return
	}
	p := page{Title: "New account", Address: addr, CSRF: raw}
	p.Flash, p.FlashErr = s.takeFlash(w, r)
	if accts, err := s.store.AccountsFor(addr); err != nil {
		log.Printf("console: switcher: %v", err)
	} else {
		p.Accounts = accts
	}
	for i := range p.Accounts {
		p.Accounts[i].Seg = preferredSeg(p.Accounts, &p.Accounts[i])
	}
	// The header chrome wants an account to name in the switcher's trigger.
	// memberAccount, not currentAccount: looking at this page must never mint.
	// A user with no memberships at all simply gets the wordmark header.
	if a, err := s.memberAccount(addr); err != nil {
		log.Printf("console: new-account chrome: %v", err)
	} else if a != nil {
		p.Account = a
		p.Role = a.Role
		p.Base = "/a/" + url.PathEscape(a.Sqid)
		if len(p.Accounts) == 0 {
			p.Nav = p.Base
		} else {
			p.Nav = "/a/" + url.PathEscape(preferredSeg(p.Accounts, a))
		}
	}
	s.render(w, http.StatusOK, "newaccount", p)
}

// handleNewAccount creates an account for any signed-in user.
func (s *Server) handleNewAccount(w http.ResponseWriter, r *http.Request) {
	addr, raw, ok := s.session(r)
	if !ok {
		http.Redirect(w, r, "/", http.StatusFound)
		return
	}
	if subtle.ConstantTimeCompare([]byte(r.FormValue("csrf")), []byte(raw)) != 1 {
		s.renderMessage(w, r, http.StatusForbidden, "Refused", "Cross-site request blocked.")
		return
	}
	name := strings.TrimSpace(r.FormValue("name"))
	if !domains.ValidAccountName(name) {
		// Back to the screen the mistake was made on, not off to some other
		// account: the form is a page now, and a page can show its own error.
		s.setFlash(w, "err", "Account names appear in URLs: 1–63 characters of a-z, 0-9 and hyphen, no leading or trailing hyphen.")
		http.Redirect(w, r, "/accounts/new", http.StatusSeeOther)
		return
	}
	// Plans 3a: one free account per person, checked at creation only (spec
	// §8.1). A person's first account, minted on landing, is never refused.
	defer s.planPersonLock(addr)()
	if err := s.checkNewFreeAccount(addr); err != nil {
		var planCap *planCapError
		if errors.As(err, &planCap) {
			s.setFlash(w, "err", planCap.Browser())
			http.Redirect(w, r, "/accounts/new", http.StatusSeeOther)
			return
		}
		log.Printf("console: create account for %s: plan cap: %v", addr, err)
		s.renderMessage(w, r, http.StatusInternalServerError, "Error", "Could not create the account. Please try again.")
		return
	}
	a, err := s.mintAccount(r.Context(), name, addr)
	if err != nil {
		log.Printf("console: create account for %s: %v", addr, err)
		s.renderMessage(w, r, http.StatusInternalServerError, "Error", "Could not create the account. Please try again.")
		return
	}
	s.setFlash(w, "ok", "Created account "+name+" — you're its owner.")
	http.Redirect(w, r, "/a/"+url.PathEscape(a.Sqid)+"/", http.StatusSeeOther)
}

// handleInvite creates a single-use invitation and delivers its link:
// Keymail federation first (into the invitee's main inbox, as the console
// itself, no grant involved), then the console's own email, then the link
// shown to the owner to pass on. The invite row exists whichever way it
// went, so a failed delivery is a flash, not a rollback.
func (s *Server) handleInvite(w http.ResponseWriter, r *http.Request) {
	addr, raw, acct, ok := s.owner(w, r)
	if !ok {
		return
	}
	if subtle.ConstantTimeCompare([]byte(r.FormValue("csrf")), []byte(raw)) != 1 {
		s.renderMessage(w, r, http.StatusForbidden, "Refused", "Cross-site request blocked.")
		return
	}
	back := func(kind, msg string) {
		s.setFlash(w, kind, msg)
		http.Redirect(w, r, "/a/"+url.PathEscape(acct.Sqid)+"/team", http.StatusSeeOther)
	}
	to := strings.ToLower(strings.TrimSpace(r.FormValue("address")))
	// ValidAddress alone lets through "a@x.com,b@y.com" and "x<v@y.com>",
	// which an email To header reads as two recipients or a display name.
	// One bare address only.
	if parsed, err := netmail.ParseAddress(to); !ValidAddress(to) || err != nil || parsed.Address != to {
		back("err", copyText("team.bad_address"))
		return
	}
	if role, err := s.store.Role(acct.ID, to); err != nil {
		back("err", "Could not check that address. Please try again.")
		return
	} else if role != "" {
		back("err", to+" is already a member of this account.")
		return
	}
	// Volume limits (each invite is a send as the platform): first the
	// account's waiting invites, then its last hour. Both refuse before a row
	// exists or any delivery is tried.
	if n, err := s.store.CountPendingInvites(acct.ID, time.Now()); err != nil {
		log.Printf("console: count pending invites: %v", err)
		back("err", "Could not create the invitation. Please try again.")
		return
	} else if n >= maxPendingInvites {
		back("err", inviteFlashTooManyPending())
		return
	}
	if !s.inviteRate.take(acct.ID) {
		back("err", inviteFlashTooManyPerHour())
		return
	}
	tok, err := s.store.CreateInvite(acct.ID, to, addr, time.Now())
	if err != nil {
		s.inviteRate.giveBack(acct.ID)
		log.Printf("console: create invite: %v", err)
		back("err", "Could not create the invitation. Please try again.")
		return
	}
	link := s.cfg.Origin + "/invite/" + url.PathEscape(tok)
	subject, body := inviteMessage(addr, acct.Name, to, link, s.consoleName())
	ctx, cancel := context.WithTimeout(r.Context(), s.inviteTimeout)
	defer cancel()
	switch ch, err := s.deliver(ctx, to, subject, body, s.inviteKeymailShare); {
	case err != nil:
		log.Printf("console: invite to %s not delivered: %v", to, err)
		back("err", inviteFlashFailed(to, link))
	case ch == deliveredKeymail:
		back("ok", inviteFlashKeymail(to))
	default:
		back("ok", inviteFlashEmail(to))
	}
}

// inviteMessage is the subject and body for an invitation, whichever channel
// carries it (Keymail federation or the console's own email).
func inviteMessage(inviter, account, to, link, console string) (subject, body string) {
	return "You've been invited to an account on " + console,
		copyText("email.invite.body", "inviter", inviter, "account", account,
			"console", console, "to", to, "link", link)
}

func inviteFlashKeymail(to string) string {
	return "Invited " + to + ". The link is in their Keymail inbox."
}
func inviteFlashEmail(to string) string { return "Invited " + to + ". We emailed them the link." }
func inviteFlashFailed(to, link string) string {
	return "Invited " + to + ", but we couldn't deliver the link. Send it to them yourself: " + link
}

// The two volume refusals. DRAFTS under copy review: the approved text goes
// here and in TestInviteCopyHelpers.
func inviteFlashTooManyPending() string {
	return "This account already has 20 invites waiting. Revoke some before you send more."
}
func inviteFlashTooManyPerHour() string {
	return "This account has sent 20 invites in the last hour. Try again later."
}

// Invite volume limits. Every invite is a message sent as the platform, to
// an address of the owner's choosing, from an account anyone signed in can
// create.
const (
	maxPendingInvites = 20
	maxInvitesPerHour = 20
)

// inviteWindow is a per-account sliding hour of invite creations. The zero
// value is ready to use.
type inviteWindow struct {
	mu   sync.Mutex
	now  func() time.Time // nil: time.Now
	sent map[int64][]time.Time
}

// take records one invite for acct and reports true, or reports false
// without recording when acct already has maxInvitesPerHour in the last hour.
// Check and record are one step, so concurrent invites cannot both slip
// under the limit.
func (w *inviteWindow) take(acct int64) bool {
	w.mu.Lock()
	defer w.mu.Unlock()
	now := time.Now()
	if w.now != nil {
		now = w.now()
	}
	cutoff := now.Add(-time.Hour)
	kept := w.sent[acct][:0]
	for _, t := range w.sent[acct] {
		if t.After(cutoff) {
			kept = append(kept, t)
		}
	}
	if len(kept) >= maxInvitesPerHour {
		w.sent[acct] = kept
		return false
	}
	if w.sent == nil {
		w.sent = map[int64][]time.Time{}
	}
	w.sent[acct] = append(kept, now)
	return true
}

// giveBack undoes the latest take for acct: the row it was for was never
// created.
func (w *inviteWindow) giveBack(acct int64) {
	w.mu.Lock()
	defer w.mu.Unlock()
	if ts := w.sent[acct]; len(ts) > 0 {
		w.sent[acct] = ts[:len(ts)-1]
	}
}

func (s *Server) handleRevokeInvite(w http.ResponseWriter, r *http.Request) {
	_, raw, acct, ok := s.owner(w, r)
	if !ok {
		return
	}
	if subtle.ConstantTimeCompare([]byte(r.FormValue("csrf")), []byte(raw)) != 1 {
		s.renderMessage(w, r, http.StatusForbidden, "Refused", "Cross-site request blocked.")
		return
	}
	tok := r.FormValue("token")
	// Scoped to THIS account: an owner of one account must not be able to
	// revoke another account's invite by pasting its token.
	pending, err := s.store.PendingInvites(acct.ID)
	if err != nil {
		s.renderMessage(w, r, http.StatusInternalServerError, "Error", "Could not read the invitations.")
		return
	}
	for _, inv := range pending {
		if inv.Token == tok {
			if err := s.store.RevokeInvite(tok); err != nil {
				log.Printf("console: revoke invite: %v", err)
			} else {
				s.setFlash(w, "ok", "Revoked the invitation to "+inv.Address+".")
			}
			break
		}
	}
	http.Redirect(w, r, "/a/"+url.PathEscape(acct.Sqid)+"/team", http.StatusSeeOther)
}

// invitationGone is every refusal of an invite link, on the page and on the
// accept alike.
func (s *Server) invitationGone(w http.ResponseWriter, r *http.Request) {
	s.renderMessage(w, r, http.StatusGone, "Invitation unavailable",
		"That invitation has expired, was already used, or was sent to a different address. Ask for a fresh one.")
}

// handleInvitePage is where an invite link lands: it says which account the
// invitation is for and offers a button that joins it. It changes nothing.
// Joining used to happen right here, on the GET, which made any page able to
// add a signed-in person to the inviter's account and switch them into it
// with a link or a redirect: SameSite=Lax sends the session cookie on a
// top-level navigation (discussion #219, item 4). Links already sent keep
// working; they land on this page.
//
// It requires a session as the invited address: the link reaches one
// address and is worthless to anyone else. Signed out, it is the front page
// with the invited address filled in and next set back to this link, so
// either sign-in door returns here (spec 8). An unknown or spent token gets
// the plain front page.
func (s *Server) handleInvitePage(w http.ResponseWriter, r *http.Request) {
	token := r.PathValue("token")
	addr, raw, ok := s.session(r)
	if !ok {
		invited, found := s.store.PendingInviteAddress(token, time.Now())
		if !found {
			s.renderHome(w, r, homeForm{})
			return
		}
		s.renderHome(w, r, homeForm{
			Prefill: invited,
			Next:    "/invite/" + url.PathEscape(token),
			Banner:  copyText("home.invite_prompt", "address", invited),
		})
		return
	}
	inv, err := s.store.PendingInviteFor(token, addr, time.Now())
	if err != nil {
		s.invitationGone(w, r)
		return
	}
	a, err := s.store.AccountByID(inv.AccountID)
	if err != nil || a == nil {
		s.renderMessage(w, r, http.StatusInternalServerError, "Error", "Could not read the invitation. Try again.")
		return
	}
	p := s.basePage(r)
	p.Title = "Join " + a.Name + "?"
	p.AppName = a.Name
	p.Confirm = &ConfirmView{
		Title:     "Join " + a.Name + "?",
		Lines:     []string{inv.InvitedBy + " invited you to join " + a.Name + " as a member."},
		Action:    "/invite/" + url.PathEscape(token),
		Fields:    [][2]string{{"csrf", raw}},
		Button:    "Join " + a.Name,
		CancelURL: "/",
	}
	s.render(w, http.StatusOK, "confirm_action", p)
}

// handleAcceptInvite is the confirm page's button: it consumes the invite and
// makes the account the person's current one. Session, then CSRF, then the
// invite's own gates (AcceptInvite: unused, addressed to this session,
// unexpired), which play the owner check's part. No passkey step: joining
// gives the joiner nothing over anybody else, and it is their own choice.
func (s *Server) handleAcceptInvite(w http.ResponseWriter, r *http.Request) {
	addr, raw, ok := s.session(r)
	if !ok {
		http.Redirect(w, r, "/", http.StatusFound)
		return
	}
	if subtle.ConstantTimeCompare([]byte(r.FormValue("csrf")), []byte(raw)) != 1 {
		s.renderMessage(w, r, http.StatusForbidden, "Refused", "Cross-site request blocked.")
		return
	}
	now := time.Now()
	accountID, err := s.store.AcceptInvite(r.PathValue("token"), addr, now)
	if err != nil {
		s.invitationGone(w, r)
		return
	}
	a, err := s.store.AccountByID(accountID)
	if err != nil || a == nil {
		s.renderMessage(w, r, http.StatusInternalServerError, "Error", "Joined, but could not open the account. Try the front page.")
		return
	}
	if err := s.store.SetLastAccount(addr, accountID); err != nil {
		log.Printf("console: set last account: %v", err)
	}
	s.setFlash(w, "ok", "You've joined "+a.Name+".")
	http.Redirect(w, r, "/a/"+url.PathEscape(a.Sqid)+"/", http.StatusSeeOther)
}

// handleContinue is the front page's one form (spec 4): it finds the door
// from the address alone. A Keymail address goes to Keymail's sign-in; any
// other gets an emailed link and code. Every email-bound outcome renders the
// same "Check your email" page and sets the same flow cookie, whether a
// message was sent or the request was refused, so neither the page nor any
// later code typed on it reveals an account or a rate limit.
//
// The order is load-bearing: the per-IP submission cap is noted first; the
// Keymail host's own addresses go to Keymail whatever the cap (that costs no
// lookup); Keymail's lookup is asked only under the cap; an email-bound
// address with no ready mailer is told so before any send limit (spec 4.2);
// and a request over the submission cap or the send limits is refused: no
// email, and no challenge the mailbox could redeem (signinChallenge).
func (s *Server) handleContinue(w http.ResponseWriter, r *http.Request) {
	if !s.sameOrigin(r) {
		s.renderMessage(w, r, http.StatusForbidden, "Refused", "Cross-site request blocked.")
		return
	}
	now := time.Now()
	s.store.PurgeExpired(now) // housekeeping on the write path
	flow := s.requestFlow(r)
	if flow == "" {
		s.renderMessage(w, r, http.StatusInternalServerError, "Error", "Could not start the sign-in flow. Please try again.")
		return
	}
	typed := strings.TrimSpace(r.FormValue("address"))
	next := safeNext(r.FormValue("next"))
	addr, ok := canonicalAddress(typed)
	if !ok {
		s.renderHome(w, r, homeForm{Prefill: typed, Next: next, Error: copyText("home.bad_address"), flow: flow})
		return
	}
	ip := s.clientIP(r)
	underCap := s.limits.submit(ip)
	if !underCap {
		log.Printf("console: sign-in submissions from %s over the hourly cap; no lookup, no send", ip)
	}
	if s.keymailAddress(r.Context(), addr, underCap) {
		s.setFlow(w, flow)
		target := "/auth/signin"
		if next != "" {
			target += "?next=" + url.QueryEscape(next)
		}
		http.Redirect(w, r, target, http.StatusSeeOther)
		return
	}
	if !s.mailReady(r.Context()) {
		s.renderHome(w, r, homeForm{Prefill: addr, Next: next, NoMail: true, flow: flow})
		return
	}
	link, code, sent, err := s.signinChallenge(flow, addr, next, ip, underCap, now)
	if err != nil {
		log.Printf("console: sign-in challenge for %s: %v", addr, err)
		s.renderMessage(w, r, http.StatusInternalServerError, "Error", "Could not start the sign-in flow. Please try again.")
		return
	}
	if sent {
		console := s.consoleName()
		s.sendChallengeAsync(addr,
			copyText("email.signin.subject", "console", console),
			copyText("email.signin.body", "console", console, "address", addr,
				"link", s.cfg.Origin+"/auth/email/link?t="+link, "code", code))
	}
	s.renderCheck(w, flow, addr, next)
}

// signinChallenge is the front door's limits and challenge write for one
// flow, under that flow's lock, so overlapping submissions from one browser
// take turns. Accepted (under the submission cap and every send limit), it
// records a new sign-in challenge for the flow, replacing the flow's earlier
// ones, and returns its link and code to send. Refused, it sends nothing and
// leaves the flow's live challenge, if any, untouched, so the email already
// sent keeps working. Over the submission cap it writes nothing at all: that
// throttle is the requester's own IP and says nothing about anyone else, so
// the code box may answer "used up" there. Refused by the send limits (which
// the submission cap bounds to 30 an hour per IP), a flow with no live
// challenge gets one nobody is ever told the link or code of, so a code
// typed next answers exactly as it would against a sent one.
func (s *Server) signinChallenge(flow, addr, next, ip string, underCap bool, now time.Time) (link, code string, sent bool, err error) {
	mu := s.flowLock(flow)
	mu.Lock()
	defer mu.Unlock()
	if !underCap {
		return "", "", false, nil
	}
	c := EmailChallenge{Purpose: ChallengeSignIn, Address: addr, Next: next, FlowHash: hashToken(flow)}
	if !s.limits.signinSend(addr, ip) {
		log.Printf("console: sign-in email to %s from %s refused by its limits; not sent", addr, ip)
		return "", "", false, s.store.HoldEmailChallenge(c, now)
	}
	link, code, err = s.store.CreateEmailChallenge(c, now)
	if err != nil {
		return "", "", false, err
	}
	return link, code, true, nil
}

// ValidAddress is the console's one shape check on a keymail address:
// <local>@<host>, no whitespace. Exported because the box-side verbs
// (`console member`) must reject a typo with the SAME rule the web surface
// uses — a membership created from the command line for an address the sign-in
// form would refuse is a grant nobody can ever claim.
//
// The rule itself now lives in internal/domains, next to the account manifest's
// `owner` field, so `carlos accounts create -owner` can apply it too. The carlos
// binary must never open the console's database, but it must not invent a
// second definition of a valid address either: an address one tool accepts and
// another refuses is exactly how an owner ends up recorded and unable to sign
// in. Delegating keeps one rule with two doors, not two rules.
func ValidAddress(a string) bool { return domains.ValidAddress(a) }

// handleSignin starts the one-time OAuth ceremony: state + PKCE verifier in
// a short-lived cookie, browser off to Keymail's consent page.
func (s *Server) handleSignin(w http.ResponseWriter, r *http.Request) {
	state, err := NewVerifier()
	if err != nil {
		s.renderMessage(w, r, http.StatusInternalServerError, "Error", "Could not start the sign-in flow. Please try again.")
		return
	}
	verifier, err := NewVerifier()
	if err != nil {
		s.renderMessage(w, r, http.StatusInternalServerError, "Error", "Could not start the sign-in flow. Please try again.")
		return
	}
	s.setCookie(w, authCookie, state+"."+verifier, int(authFlowTTL.Seconds()))
	// Where to land afterwards. Only a safe local path is kept; a stale one
	// from an earlier attempt must not leak into this one.
	if n := safeNext(r.URL.Query().Get("next")); n != "" {
		s.setCookie(w, nextCookie, n, int(authFlowTTL.Seconds()))
	} else {
		s.clearCookie(w, nextCookie)
	}
	http.Redirect(w, r, s.km.AuthorizeURL(state, ChallengeS256(verifier)), http.StatusSeeOther)
}

// handleCallback finishes the ceremony: verify state, exchange the code
// (with PKCE verifier and the console's sign_pub), and either sign the user
// up (new address) or in. The grant token is stored per user — it is the
// instrument of future confirmation-link sign-ins.
func (s *Server) handleCallback(w http.ResponseWriter, r *http.Request) {
	q := r.URL.Query()
	if e := q.Get("error"); e != "" {
		s.renderHome(w, r, homeForm{Error: "Sign-in was cancelled at Keymail (" + e + ")."})
		return
	}
	c, err := r.Cookie(authCookie)
	if err != nil || c.Value == "" {
		s.renderMessage(w, r, http.StatusBadRequest, "Sign-in flow expired",
			"This sign-in attempt is stale or was started elsewhere. Please start again.")
		return
	}
	state, verifier, ok := strings.Cut(c.Value, ".")
	if !ok || state == "" ||
		subtle.ConstantTimeCompare([]byte(state), []byte(q.Get("state"))) != 1 {
		s.renderMessage(w, r, http.StatusBadRequest, "Sign-in flow mismatch",
			"The sign-in response didn't match this browser's sign-in attempt. Please start again.")
		return
	}
	code := q.Get("code")
	if code == "" {
		s.renderMessage(w, r, http.StatusBadRequest, "Sign-in failed", "Keymail sent no authorization code. Please start again.")
		return
	}
	ctx, cancel := context.WithTimeout(r.Context(), 15*time.Second)
	defer cancel()
	address, token, err := s.km.Exchange(ctx, code, verifier)
	if err != nil {
		log.Printf("console: token exchange: %v", err)
		s.renderMessage(w, r, http.StatusBadGateway, "Sign-in failed",
			"Keymail did not accept the sign-in. Please start again.")
		return
	}
	var next string
	if nc, err := r.Cookie(nextCookie); err == nil {
		next = nc.Value
	}
	s.clearCookie(w, nextCookie)
	s.finishSignin(w, r, address, token, MethodKeymail, next)
}

// handleConfirm is the retired Apps-inbox confirmation link (spec 11):
// nothing mints those links any more, so every token gets the expired
// message and nothing is read or spent. The route stays so an old email still
// lands somewhere that explains itself.
//
// It answers 200, not the 410 of an expired email link: the claim census
// accepts only a success from a read's probe, and this route is now a read.
func (s *Server) handleConfirm(w http.ResponseWriter, r *http.Request) {
	s.renderMessage(w, r, http.StatusOK, "Link expired", copyText("link.expired"))
}

// handleSignout deletes the console session. The Keymail grant deliberately
// survives — it is how the next sign-in reaches the user; revoking it lives
// in Keymail's own Connected-apps settings.
func (s *Server) handleSignout(w http.ResponseWriter, r *http.Request) {
	_, raw, ok := s.session(r)
	if !ok {
		http.Redirect(w, r, "/", http.StatusSeeOther)
		return
	}
	// CSRF: the session token double-submitted as a hidden form field.
	if subtle.ConstantTimeCompare([]byte(r.FormValue("csrf")), []byte(raw)) != 1 {
		s.renderMessage(w, r, http.StatusForbidden, "Refused", "Cross-site request blocked.")
		return
	}
	s.store.DeleteSession(raw)
	// Presence dies with the session it was proved for (stepup.go). Belt and
	// braces — the step-up row is keyed by the session hash, which no future
	// session can reproduce — but leaving proof-of-presence lying around after
	// a deliberate sign-out is not a thing to be relaxed about.
	s.store.ClearStepUp(raw)
	s.clearCookie(w, sessionCookie)
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

// ---- fleet (operator-only) ---------------------------------------------------

// operatorOnly is the gate every /fleet page and door shares: signed in,
// and an operator. Every failure path — signed out, signed in but not an
// operator, or a store error reading the operator bit — gets exactly
// http.NotFound, the identical response an unregistered URL gets from this
// mux. Role existence is not probeable: a styled "not found" page (like
// ownedApp's) would itself reveal that /fleet is a real, gated route, so
// this deliberately skips renderMessage.
//
// One copy rather than one per handler, because the promise being kept is
// byte-identity with a missing route — a promise that only survives being
// written once. ok=false means the response is already written and the
// caller must return immediately.
func (s *Server) operatorOnly(w http.ResponseWriter, r *http.Request) (address, rawToken string, ok bool) {
	addr, raw, ok := s.session(r)
	if !ok {
		http.NotFound(w, r)
		return "", "", false
	}
	isOp, err := s.store.IsOperator(addr)
	if err != nil {
		log.Printf("console: IsOperator %s: %v", addr, err)
		http.NotFound(w, r)
		return "", "", false
	}
	if !isOp {
		http.NotFound(w, r)
		return "", "", false
	}
	return addr, raw, true
}

// handleFleet serves the private fleet view: everything status/fleet.json
// carries, server-rendered, for signed-in operators only — behind
// operatorOnly's 404-to-everyone gate above.
func (s *Server) handleFleet(w http.ResponseWriter, r *http.Request) {
	addr, raw, ok := s.operatorOnly(w, r)
	if !ok {
		return
	}
	f, err := FleetView(r.Context(), s.cfg.Releases)
	if err != nil {
		log.Printf("console: fleet view: %v", err)
		s.renderMessage(w, r, http.StatusInternalServerError, "Error", "Could not read fleet status. Please try again.")
		return
	}
	// The private host detail is an EXTRA read on a page that already has its
	// answer: a bucket that won't list the boxes costs the operator the
	// per-host block, not the whole fleet page, so this degrades with a log
	// line rather than turning a readable page into a 500.
	hosts, err := HostRows(r.Context(), s.cfg.Releases, time.Now())
	if err != nil {
		log.Printf("console: fleet hosts: %v", err)
		hosts = nil
	}
	p := page{Title: "Fleet status", Address: addr, CSRF: raw, Fleet: f, Hosts: hosts}
	if s.storeOperator(addr) {
		p.StoreQueueUnknown = true
		if s.cfg.Releases != nil {
			ctx, cancel := context.WithTimeout(r.Context(), storeTimeout)
			applications, err := s.pendingStoreApplications(ctx)
			cancel()
			if err == nil {
				n := len(applications)
				p.StorePending = &n
				p.StoreQueueUnknown = false
			}
		}
	}
	s.render(w, http.StatusOK, "fleet", p)
}

// handleFleetMetrics serves the operator host/process monitoring dashboard —
// same gate as handleFleet, same reasoning: every non-operator path is a
// plain http.NotFound so the route's existence is not probeable.
func (s *Server) handleFleetMetrics(w http.ResponseWriter, r *http.Request) {
	addr, raw, ok := s.operatorOnly(w, r)
	if !ok {
		return
	}
	boxes, alerts, err := s.LoadMetrics(r.Context())
	if err != nil {
		log.Printf("console: fleet metrics: %v", err)
		s.renderMessage(w, r, http.StatusInternalServerError, "Unavailable", "Metrics could not be read.")
		return
	}
	s.render(w, http.StatusOK, "metrics", page{Title: "Fleet metrics", Address: addr, CSRF: raw, Metrics: boxes, MetricAlerts: alerts})
}

// handleEconomics serves the operator unit-economics dashboard (Task 13) —
// handleFleetMetrics's shape verbatim: same gate (session -> IsOperator ->
// bare http.NotFound, so a non-operator's probe is byte-identical to a
// missing route), same read-only LoadEconomics call keyed off the period
// query param, same render-and-done body. Flash is threaded through because
// this page is also where the scenario-save and bill-save POST doors
// (economicspass.go's handleEconomicsScenarioSave/handleEconomicsBillSave)
// redirect back to.
func (s *Server) handleEconomics(w http.ResponseWriter, r *http.Request) {
	addr, raw, ok := s.operatorOnly(w, r)
	if !ok {
		return
	}
	view, err := s.LoadEconomics(r.Context(), r.URL.Query().Get("period"))
	if err != nil {
		log.Printf("console: economics: %v", err)
		s.renderMessage(w, r, http.StatusInternalServerError, "Unavailable", "Economics could not be read.")
		return
	}
	p := page{Title: "Fleet economics", Address: addr, CSRF: raw, Economics: view}
	p.Flash, p.FlashErr = s.takeFlash(w, r)
	s.render(w, http.StatusOK, "economics", p)
}

// handleEconomicsAccounts serves the per-account economics table (Task 14)
// — handleEconomics's gate and LoadEconomics call verbatim, joined with
// econlistquery.go's search/free-tier-position/cursor controls. view.Accounts
// (priced, CostUSD-desc from buildEconomicsView) and view.Meters (raw
// per-account readings, same account keys) are joined into econAccountRow
// here; pageEconAccounts re-sorts by account name for a stable cursor order,
// per its own doc comment.
func (s *Server) handleEconomicsAccounts(w http.ResponseWriter, r *http.Request) {
	addr, raw, ok := s.session(r)
	if !ok {
		http.NotFound(w, r)
		return
	}
	isOp, err := s.store.IsOperator(addr)
	if err != nil {
		log.Printf("console: economics accounts: is-operator: %v", err)
		http.NotFound(w, r)
		return
	}
	if !isOp {
		http.NotFound(w, r)
		return
	}
	view, err := s.LoadEconomics(r.Context(), r.URL.Query().Get("period"))
	if err != nil {
		log.Printf("console: economics accounts: %v", err)
		s.renderMessage(w, r, http.StatusInternalServerError, "Unavailable", "Economics could not be read.")
		return
	}
	rows := make([]econAccountRow, 0, len(view.Accounts))
	for _, ae := range view.Accounts {
		rows = append(rows, econAccountRow{Account: ae.Account, Name: view.Names[ae.Account], Meters: view.Meters[ae.Account], Econ: ae})
	}
	q := parseEconAccountQuery(r.URL.Query())
	// Period is the NORMALIZED value LoadEconomics actually priced rows
	// under (view.Period), not the raw query param — every link this page
	// builds (search form, pos chips, cursor pager, period nav) must carry
	// the period that produced what's on screen, or "Next 50" on a non-mtd
	// period would resume a cursor computed against a different period's
	// row order. See econAccountQuery.Period's doc comment.
	q.Period = view.Period
	pg := pageEconAccounts(rows, q, econAccountPageSize)
	p := page{Title: "Fleet economics: accounts", Address: addr, CSRF: raw, Economics: view, EconAccounts: pg, EconQuery: q}
	p.Flash, p.FlashErr = s.takeFlash(w, r)
	s.render(w, http.StatusOK, "economics_accounts", p)
}

// ---- app pages --------------------------------------------------------------

// handleAccountHome is the account's app list and switcher — the page /
// lands you on. Members and pending invitations live on /team (handleTeam).
func (s *Server) handleAccountHome(w http.ResponseWriter, r *http.Request) {
	addr, raw, acct, role, ok := s.account(w, r)
	if !ok {
		return
	}
	p := s.accountPage(w, r, addr, raw, acct, role)
	p.Title = acct.Name
	p.ActiveNav = "apps"
	if c, err := r.Cookie(welcomeCookie); err == nil && c.Value == "1" {
		p.Welcome = true
		s.clearCookie(w, welcomeCookie)
	}
	apps, err := s.store.AppsIn(acct.ID)
	if err != nil {
		s.renderMessage(w, r, http.StatusInternalServerError, "Error", "Could not read your apps. Please try again.")
		return
	}
	if len(apps) > 0 {
		views, err := Assemble(s.cfg.Registry, s.cfg.Releases, s.cfg.ReleasePub, acct.Sqid, apps, s.dnsTargets())
		if err != nil {
			log.Printf("console: assemble: %v", err)
			s.renderMessage(w, r, http.StatusInternalServerError, "Error", "Could not read platform state. Please try again.")
			return
		}
		for _, v := range views {
			p.Apps = append(p.Apps, summarize(v, acct.Sqid))
		}
	}
	// The Trash link, and only when there is something in it. Best-effort: a
	// failed count costs a link, never the page.
	if trashed, err := s.store.TrashedAppsIn(acct.ID); err != nil {
		log.Printf("console: trashed apps: %v", err)
	} else {
		p.TrashN = len(trashed)
	}
	s.render(w, http.StatusOK, "apps", p)
}

// handleTeam lists the account's members and, for owners, the invite
// machinery. The mutations it hosts all POST to their existing paths.
func (s *Server) handleTeam(w http.ResponseWriter, r *http.Request) {
	addr, raw, acct, role, ok := s.account(w, r)
	if !ok {
		return
	}
	p := s.accountPage(w, r, addr, raw, acct, role)
	p.Title = "Team"
	p.ActiveNav = "team"
	p.ConfirmNote = copyText("team.confirm_note")
	p.InvitePlaceholder = copyText("team.invite_placeholder")
	p.InviteNote = copyText("team.invite_note")
	if members, err := s.store.Members(acct.ID); err != nil {
		log.Printf("console: members: %v", err)
	} else {
		p.Members = members
	}
	if role == RoleOwner {
		if invites, err := s.store.PendingInvites(acct.ID); err != nil {
			log.Printf("console: pending invites: %v", err)
		} else {
			p.Invites = invites
		}
	}
	s.render(w, http.StatusOK, "team", p)
}

// handleAccountSettings is the account itself — identity, and its end.
// Deletion stays owner-only and zero-apps-only; the POST is unchanged.
func (s *Server) handleAccountSettings(w http.ResponseWriter, r *http.Request) {
	addr, raw, acct, role, ok := s.account(w, r)
	if !ok {
		return
	}
	p := s.accountPage(w, r, addr, raw, acct, role)
	p.Title = "Account settings"
	p.ActiveNav = "settings"
	n, err := s.store.AppCount(acct.ID)
	if err != nil {
		s.renderMessage(w, r, http.StatusInternalServerError, "Error", "Could not read your apps. Please try again.")
		return
	}
	p.HasApps = n > 0
	p.AccountStore = s.accountStorePane(r.Context(), acct)
	// The service-credential pane (svcpage.go), owners only — see page's
	// Services field for why a member gets no section rather than an empty
	// one.
	if role == RoleOwner {
		s.servicePane(&p, acct)
	}
	// The account's own Errors log level. Resolved with an EMPTY app name on
	// purpose: AppKey(sqid, "") names a key no app ever writes, so the app
	// layer contributes nothing and what comes back is the account setting
	// or the default — which is exactly what this page sets. A failed read
	// is said rather than defaulted (see ErrLevelUnread), and never fails
	// the page.
	if res, err := telemetry.Resolve(r.Context(), s.cfg.Releases, acct.Sqid, ""); err != nil {
		log.Printf("console: account telemetry %s: %v", acct.Sqid, err)
		p.ErrLevelUnread = true
	} else {
		p.ErrLevelSetting = res
	}
	// The analytics switch is the OTHER half of that same resolved object —
	// one settings file, one read — under the name its own section uses.
	p.AnalyticsSetting, p.AnalyticsUnread = p.ErrLevelSetting, p.ErrLevelUnread
	s.render(w, http.StatusOK, "account_settings", p)
}

// accountPage fills the chrome every account-scoped page shares — the
// switcher, the base URL its forms post to, the viewer's role — and records
// the MRU, so signing in lands you back on the account you were last in.
func (s *Server) accountPage(w http.ResponseWriter, r *http.Request, addr, raw string, acct *Account, role string) page {
	if err := s.store.SetLastAccount(addr, acct.ID); err != nil {
		log.Printf("console: set last account: %v", err)
	}
	p := page{
		Address: addr, CSRF: raw,
		Account: acct, Role: role, Base: "/a/" + url.PathEscape(acct.Sqid),
		CanPromote: s.cfg.Key != nil,
	}
	p.Flash, p.FlashErr = s.takeFlash(w, r)
	if accts, err := s.store.AccountsFor(addr); err != nil {
		log.Printf("console: switcher: %v", err)
	} else {
		p.Accounts = accts
	}
	// The dropdown's trigger names the current account, so the menu must
	// contain it — a list that lost it (a failed query) would open onto a
	// menu with no "you are here" row at all. The gate already proved the
	// membership, so this is a display fallback, not a permission decision.
	if len(p.Accounts) == 0 {
		p.Accounts = []Account{*acct}
	}
	for i := range p.Accounts {
		p.Accounts[i].Seg = preferredSeg(p.Accounts, &p.Accounts[i])
	}
	p.Nav = "/a/" + url.PathEscape(preferredSeg(p.Accounts, acct))
	return p
}

// accountApp gates the per-app pages and mutations: membership in the
// account (any role — a member can deploy), and an app that account actually
// claims. An app that is not this account's and one that does not exist look
// identical on purpose.
func (s *Server) accountApp(w http.ResponseWriter, r *http.Request) (addr, raw string, acct *Account, role, app string, ok bool) {
	addr, raw, acct, role, ok = s.account(w, r)
	if !ok {
		return "", "", nil, "", "", false
	}
	app = r.PathValue("app")
	has, err := s.store.HasAppIn(acct.ID, app)
	if err != nil {
		s.renderMessage(w, r, http.StatusInternalServerError, "Error", "Could not read your apps. Please try again.")
		return "", "", nil, "", "", false
	}
	if !has {
		s.renderMessage(w, r, http.StatusNotFound, "Not found", "No such app here.")
		return "", "", nil, "", "", false
	}
	return addr, raw, acct, role, app, true
}

// appPage gates an app page, assembles its platform view, and fills the
// chrome every app tab shares. Callers add their own tab's data on top.
func (s *Server) appPage(w http.ResponseWriter, r *http.Request, tab string) (page, *Account, bool) {
	addr, raw, acct, role, app, ok := s.accountApp(w, r)
	if !ok {
		return page{}, nil, false
	}
	// The account manifest is re-attempted on view: minting writes it, but a
	// bucket hiccup there is deliberately non-fatal, and this is where it gets
	// another chance. Best-effort — a page view never fails on it.
	s.ensureAccountManifest(r.Context(), acct)
	views, err := Assemble(s.cfg.Registry, s.cfg.Releases, s.cfg.ReleasePub, acct.Sqid, []string{app}, s.dnsTargets())
	if err != nil || len(views) != 1 {
		log.Printf("console: assemble %s: %v", app, err)
		s.renderMessage(w, r, http.StatusInternalServerError, "Error", "Could not read platform state. Please try again.")
		return page{}, nil, false
	}
	p := s.accountPage(w, r, addr, raw, acct, role)
	p.Title = app
	p.AppName = app
	p.ActiveTab = tab
	p.ActiveNav = "apps"
	p.Detail = &views[0]
	if life, err := s.store.AppLife(acct.ID, app); err != nil {
		log.Printf("console: app lifecycle %s/%s: %v", acct.Sqid, app, err)
	} else if life != nil && life.Temporary() {
		p.ExpiresAt = time.Unix(life.ExpiresAt, 0).UTC()
	}
	if review, all, err := s.appAccountReview(addr, acct, app); err != nil {
		log.Printf("console: account review %s/%s: %v", acct.Sqid, app, err)
	} else {
		p.AccountReview = review
		p.AccountReview.NoInstances = review.Owned == 0 && hasPublishedChannel(p.Detail.Channels)
		for _, group := range review.Groups {
			for _, host := range group.Hosts {
				p.Detail.Mismatched = append(p.Detail.Mismatched, MismatchedRoute{Host: host, Account: group.Account.Sqid})
			}
		}
		p.Detail.AllMismatched = all
		if all {
			p.Detail.RouteAccount = review.Groups[0].Account.Sqid
		}
	}
	s.applyPipelineView(r.Context(), p.Detail, acct)
	return p, acct, true
}

func hasPublishedChannel(channels []ChannelView) bool {
	for _, channel := range channels {
		if channel.Err == "" && channel.Version != "" {
			return true
		}
	}
	return false
}

// applyPipelineView is the one place a single app's view becomes
// pipeline-aware (release pipelines v2 §2, §5) — deliberately not inside
// Assemble (AppView.Pipeline's own doc comment: the account home page calls
// Assemble for a whole app list and never reads Ladder or Pipeline, so a
// pipeline GET per app there would be a bucket read nobody looks at; appPage
// is the one place every app-scoped handler funnels through).
//
// It corrects each ChannelView's BakedUntil from the pipeline's OWN window
// (holdWindow) in place of the legacy per-app table Assemble already
// computed — the fix for the Task 9 review's disagreement between the
// Channels table and the pipeline card, both of which read Channels — and
// then rebuilds Ladder from those corrected channels, so the two can never
// disagree again by construction. Best-effort and view-only, like every
// other read in this family: an unreadable pipeline degrades the render to
// the legacy ladder rather than failing the page.
func (s *Server) applyPipelineView(ctx context.Context, view *AppView, acct *Account) {
	ctx, cancel := context.WithTimeout(ctx, pipelineStoreTimeout)
	defer cancel()
	pipe, err := release.GetPipeline(ctx, s.cfg.Releases, s.cfg.ReleasePub, acct.Sqid, view.App)
	if err != nil {
		log.Printf("console: app page %s/%s: read pipeline: %v", acct.Sqid, view.App, err)
		return
	}
	if pipe == nil {
		return
	}
	view.Pipeline = pipe
	now := time.Now()
	for i := range view.Channels {
		view.Channels[i].BakedUntil = time.Time{}
		if view.Channels[i].Err != "" || view.Channels[i].FastTrack {
			continue
		}
		if d := holdWindow(pipe, view.Channels[i].Name); d > 0 {
			if until := view.Channels[i].PromotedAt.Add(d); now.Before(until) {
				view.Channels[i].BakedUntil = until
			}
		}
	}
	view.Ladder = assembleLadder(view.Channels, view.Routes, pipe, now)
}

// appResourceMetrics sweeps the app's own instances only. The allowlist is
// built HERE, from the routes this account's app owns and nothing else —
// that slice is the entire tenant boundary on the metrics read, so it must
// never be widened to "all routes" or taken from the request. A failed
// sweep costs the section, never the page.
//
// The account comparison is load-bearing and not redundant with the
// accountApp gate above: Assemble groups routes by app NAME, and app
// names are unique per ACCOUNT, not globally (Store.AppAccounts) — two
// accounts may each own an app called "api", and both accounts' routes
// arrive in this one AppView. Comparing each route's own account is what
// keeps one tenant's cgroup readings off the other's page. It fails
// closed: a route stamped with an account the console record disagrees
// with (the half-migrated state AccountMismatch describes) yields no
// metrics rather than someone else's.
func (s *Server) appResourceMetrics(ctx context.Context, view *AppView, acct *Account) []InstanceMetrics {
	hosts := make([]string, 0, len(view.Routes))
	hib := make(map[string]bool, len(view.Routes))
	unitByHost := make(map[string]string, len(view.Routes))
	for _, rt := range view.Routes {
		if rt.Account != acct.Sqid {
			continue
		}
		hosts = append(hosts, rt.Host)
		hib[rt.Host] = rt.Hibernate
		if rt.Unit != "" {
			unitByHost[rt.Host] = rt.Unit
		}
	}
	am, err := s.OwnerAppMetrics(ctx, hosts, unitByHost)
	if err != nil {
		log.Printf("console: app metrics %s: %v", view.App, err)
		return nil
	}
	for i := range am {
		am[i].Hibernate = hib[am[i].Host]
	}
	return am
}

// handleApp is the Overview dashboard: the vital statistics, from reads the
// app pages already do — no self-report poll here, so the landing tab never
// waits on a tenant's own HTTP endpoint.
func (s *Server) handleApp(w http.ResponseWriter, r *http.Request) {
	p, acct, ok := s.appPage(w, r, "overview")
	if !ok {
		return
	}
	app := p.Detail.App
	versions, err := Versions(s.cfg.Releases, acct.Sqid, app)
	if err != nil {
		log.Printf("console: versions %s: %v", app, err)
		p.FlashErr = "Could not list this app's releases."
	}
	p.Versions = versions
	metrics := s.appResourceMetrics(r.Context(), p.Detail, acct)
	// The Database tile's sizes are best-effort: a slow status read costs the
	// tile its number (the em-dash), never the page.
	joinCtx, cancelJoin := context.WithTimeout(r.Context(), instanceStoreTimeout)
	dbJoin := loadBoxJoin(joinCtx, s.cfg.Releases, time.Now())
	cancelJoin()
	p.Overview = assembleOverview(p.Detail, acct.Sqid, metrics, versions, dbJoin)
	// The diagram is drawn from the SAME tenant-filtered rows the Running tab
	// renders, so the two can never disagree about which addresses exist or
	// how they are doing — see flow.go's package comment for why it is not
	// built from Detail.Routes.
	p.InstanceRows = assembleInstanceRows(p.Detail, acct, metrics)
	var latest, latestAt string
	if len(versions) > 0 {
		latest, latestAt = versions[0].Version, versions[0].BuiltAt
	}
	p.Flow = assembleFlow(p.Detail, p.InstanceRows, latest, latestAt, p.Nav+"/apps/"+p.AppName+"/instances")
	if events, err := s.store.Events(acct.ID, app, overviewActivityCap); err != nil {
		log.Printf("console: events %s: %v", app, err)
	} else {
		p.Events = events
	}
	if pcs, err := s.store.PendingChangesForContext(r.Context(), acct.ID, app, time.Now()); err != nil {
		log.Printf("console: pending changes %s/%s: %v", acct.Sqid, app, err)
	} else if len(pcs) > 0 {
		// One pipeline read for the whole card: the rows show the quorum
		// EXECUTION will require, not the one they were proposed under.
		p.Pending = s.pendingChangeViews(pcs, s.pendingPipeline(r.Context(), acct, app))
	}
	s.render(w, http.StatusOK, "app_overview", p)
}

// overviewActivityCap bounds the Overview's recent-activity strip; the
// Activity tab has the room this strip never will.
const overviewActivityCap = 5

// handleAppReleases is the deploy surface: every shipped release, the
// channels they promote onto, and the canaries riding ahead.
func (s *Server) handleAppReleases(w http.ResponseWriter, r *http.Request) {
	p, acct, ok := s.appPage(w, r, "releases")
	if !ok {
		return
	}
	if strings.HasSuffix(r.URL.Path, "/deployments") {
		p.DeploymentTargets = assembleDeploymentTargets(p.Detail, acct.Sqid)
		if pcs, err := s.store.PendingChangesForContext(r.Context(), acct.ID, p.AppName, time.Now()); err != nil {
			log.Printf("console: pending changes %s/%s: %v", acct.Sqid, p.AppName, err)
		} else if len(pcs) > 0 {
			p.Pending = s.pendingChangeViews(pcs, s.pendingPipeline(r.Context(), acct, p.AppName))
		}
		s.render(w, http.StatusOK, "app_deployments", p)
		return
	}
	p.ReleaseSummary = assembleReleaseSummary(p.Detail.Channels, p.Detail.Routes, acct.Sqid)
	p.PromoteChannels = promoteChannelOptions(p.Detail.Channels, p.Detail.Pipeline)
	versions, err := Versions(s.cfg.Releases, acct.Sqid, p.AppName)
	if err != nil {
		log.Printf("console: versions %s: %v", p.AppName, err)
		p.FlashErr = "Could not list this app's releases."
	}
	// Versions itself never reads ListTags (view.go), and neither does
	// assembleChannels any more — a full tag sweep thrown away by every
	// OTHER app-page tab and the account home page's whole app list would
	// be a needless read on every one of those renders (release versioning
	// spec, 2026-08-08; view.go's tagByRelease doc comment has the full
	// story). This tab is the one place that sweep pays for itself: ONE
	// ListTags read serves the Tags section below (raw records, changelog
	// and all, capped at tagsCap — ListTags' own semver-descending order),
	// the Releases table's pill (view.go's tagIndex, the pure fold with no
	// read of its own), and the Channels table's pill, backfilled onto
	// Assemble's already-built ChannelView rows since assembleChannels
	// itself leaves Tag "". A failed read degrades this tab's tag
	// decoration only; the page still renders.
	if tags, terr := release.ListTags(context.Background(), s.cfg.Releases, acct.Sqid, p.AppName); terr != nil {
		log.Printf("console: tags %s: %v", p.AppName, terr)
	} else {
		byRelease := tagIndex(tags)
		for i := range versions {
			versions[i].Tag = byRelease[versions[i].Version]
		}
		for i := range p.Detail.Channels {
			p.Detail.Channels[i].Tag = byRelease[p.Detail.Channels[i].Version]
		}
		if len(tags) > tagsCap {
			tags = tags[:tagsCap]
		}
		p.Tags = tags
	}
	p.Versions = versions
	// Read-only in v1: the policy is set via `carlos releases retention`;
	// this line just keeps the page honest about why old versions vanish.
	if ret, err := release.GetRetention(r.Context(), s.cfg.Releases, acct.Sqid, p.AppName); err != nil {
		log.Printf("console: retention %s: %v", p.AppName, err)
	} else if ret != nil {
		p.RetentionKeep = ret.Keep
	}
	// The "how do I give this a URL" copy — not shared chrome (it's computed
	// per app page, not carried by appPage), but the same fill the Instances
	// tab's empty state shows: attachHint below.
	p.AttachCmd, p.AttachEnable = s.attachHint(r.Context(), acct.Sqid, p.AppName, "canary/<name>")
	s.render(w, http.StatusOK, "app_releases", p)
}

// attachHint is the "give this channel a URL" advice shown on both the
// Releases tab (the canary form's copy, channel "canary/<name>") and the
// Instances tab's empty state (channel "stable" — the Running tab's empty
// state should not be steering members onto a canary) — one bucket read and
// one command shape per caller. Bounded and best-effort like every other
// store read behind an app page: an unreadable instances manifest costs the
// concrete host shape, never the page.
func (s *Server) attachHint(ctx context.Context, sqid, app, channel string) (cmd, enable string) {
	mctx, mcancel := context.WithTimeout(ctx, instanceStoreTimeout)
	defer mcancel()
	domain, absent := s.instanceDomainFor(mctx, sqid, app)
	return attachCommands(app, channel, domain, s.cfg.AppsDomain, sqid, absent)
}

// handleAppInstances is what the app is actually running: one row per
// instance — host, the channel it follows, what it is running right now, and
// its readings — plus the app's own self-report below, for apps that manage
// internal instances of their own.
func (s *Server) handleAppInstances(w http.ResponseWriter, r *http.Request) {
	p, acct, ok := s.appPage(w, r, "instances")
	if !ok {
		return
	}
	p.Instances = s.instances.Report(r.Context(), ownedInstanceRoutes(p.Detail.Routes, acct.Sqid))
	p.AppMetrics = s.appResourceMetrics(r.Context(), p.Detail, acct)
	q := parseInstanceQuery(r.URL.Query())
	rows := assembleInstanceRows(p.Detail, acct, p.AppMetrics)
	for _, row := range rows {
		if row.Restartable {
			p.CanRestartApp = true
			break
		}
	}
	pg := pageInstanceRows(rows, q, instancePageSize)
	p.InstanceRows = pg.Rows
	p.InstancePage = pg
	p.InstanceQuery = q
	p.InstanceChannels = instanceChannels(rows)
	p.InstanceUnknownChannel = q.Channel != "" && !hasInstanceChannel(p.InstanceChannels, q.Channel)
	p.InstanceGroups = groupInstanceRows(pg.Rows, p.Detail.Channels, pg.Matching)
	p.InstanceListURL = p.Nav + "/apps/" + p.AppName + "/instances" + instanceQuerySuffix(q)
	// Placement (Task 6): where this app runs, and where else it could. Soft
	// like everything else on this tab — a failed read costs the section's
	// certainty (AppPlacementKnown) and a flash, never the page.
	placement, fleets, known, warn := s.appPlacementSection(acct, p.AppName)
	p.AppPlacement = placement
	p.OwnedFleetNames = fleets
	p.AppPlacementKnown = known
	if warn != "" && p.FlashErr == "" {
		p.FlashErr = warn
	}
	// The app-region note (spec §10). Available is nil for a fleet app and
	// for a policy, edges or stored region that could not be read, so those
	// show nothing: unreadable never reads as available. Pooled is excluded
	// by name.
	if d := s.appDefault(r.Context(), acct, p.AppName); d.Available != nil && d.Reason != "pooled" {
		switch {
		case !*d.Available:
			p.RegionLine, p.RegionLineWarn = fmt.Sprintf(regionCopy.CantStart, d.Name), true
		case d.Region != s.cfg.HomeRegion:
			p.RegionLine = fmt.Sprintf(regionCopy.StartsIn, d.Name)
		default:
			// A home app is told where it starts only when the home has a
			// sibling to be told apart from.
			if files, err := s.liveEdges(r.Context()); err == nil && eligibleCount(s.regionCands(files)) >= 2 {
				p.RegionLine = fmt.Sprintf(regionCopy.StartsIn, d.Name)
			}
		}
	}
	// The empty state keys off the app's UNFILTERED rows, not the filtered
	// page: a filter that matches nothing shows "no matches" (below), never
	// the attach-onboarding copy — that copy is only true when the app has
	// no instances at all.
	if len(rows) == 0 {
		p.AttachCmd, p.AttachEnable = s.attachHint(r.Context(), acct.Sqid, p.AppName, "stable")
	}
	s.render(w, http.StatusOK, "app_instances", p)
}

// appLogsPageCap bounds the Logs tab to what a page can usefully show; the
// CLI (`carlos logs`) is the door for more, and the page says so.
const appLogsPageCap = 200

// appErrorsPageCap bounds the Errors tab the same way, on both of its
// shapes: the number of GROUPS in the table, and the number of OCCURRENCE
// cards in an expanded group. readErrors collects up to logsCollectCap
// records per family, so without this a busy app's tab is a page nobody can
// read and a render nobody asked for. `carlos errors` is the door for more.
const appErrorsPageCap = 200

// handleAppLogs renders the app's merged log timeline — the same window the
// CLI reads (apilogs.go), tailed to the newest appLogsPageCap records, with
// stream and window filters as plain GET params so a view is a URL.
func (s *Server) handleAppLogs(w http.ResponseWriter, r *http.Request) {
	p, acct, ok := s.appPage(w, r, "logs")
	if !ok {
		return
	}
	q := r.URL.Query()
	p.LogCopy = appLogsCopy{
		Instance: "Instances", AllInstances: "All instances", Search: "Search logs",
		AllLevels: "All levels", Follow: "Follow live", Pause: "Pause",
		Widen:       "Show the last 24 hours",
		FollowError: "Live updates failed. Follow live again to retry.", Refreshed: "Updated",
	}
	p.LogStream = q.Get("stream")
	p.LogSince = q.Get("since")
	if p.LogSince == "" {
		p.LogSince = "1h"
	}
	p.LogHost = q.Get("host")
	p.LogLevel = q.Get("level")
	p.LogGrep = q.Get("text")
	p.LogLegacyGrep = q.Get("grep")
	p.LogFollow = q.Get("follow") == "1"
	widen, _ := url.ParseQuery(q.Encode())
	widen.Set("since", "24h")
	widen.Del("cursor")
	widen.Del("follow")
	p.LogWidenURL = p.Nav + "/apps/" + url.PathEscape(p.AppName) + "/logs?" + widen.Encode()
	now := time.Now()
	f, _, bad := browserLogsFilterFromQuery(r, now)
	// Cursor is a data-endpoint concern. A hand-written page URL carrying one
	// must not turn the page's normal one-hour default into an all-history read.
	if f.Since.IsZero() {
		f.Since = now.Add(-logsDefaultWindow)
	}
	if bad != "" {
		p.LogsErr = bad
	}
	seenHosts := map[string]bool{}
	if p.LogHost != "" {
		seenHosts[p.LogHost] = true
		p.LogHosts = append(p.LogHosts, p.LogHost)
	}
	for _, rt := range p.Detail.Routes {
		if rt.Account == acct.Sqid && !seenHosts[rt.Host] {
			seenHosts[rt.Host] = true
			p.LogHosts = append(p.LogHosts, rt.Host)
		}
	}
	if s.cfg.Releases != nil {
		ctx, cancel := context.WithTimeout(r.Context(), instanceStoreTimeout)
		recs, _, err := provision.ListRecords(ctx, s.cfg.Releases, acct.Sqid, p.AppName, instanceListMax)
		cancel()
		if err == nil {
			for _, rec := range recs {
				if !seenHosts[rec.Host] {
					seenHosts[rec.Host] = true
					p.LogHosts = append(p.LogHosts, rec.Host)
				}
			}
		}
	}
	sort.Strings(p.LogHosts)

	if s.cfg.Releases != nil && bad == "" {
		ctx, cancel := context.WithTimeout(r.Context(), instanceStoreTimeout)
		defer cancel()
		recs, trimmed, err := applog.ReadWindow(ctx, s.cfg.Releases, acct.Sqid, p.AppName, f, logsCollectCap)
		if err != nil {
			log.Printf("console: app logs %s/%s: %v", acct.Sqid, p.AppName, err)
			p.LogsErr = "The logs could not be read just now — try again in a moment."
		}
		p.LogTruncated = trimmed
		if len(recs) > appLogsPageCap {
			recs = recs[len(recs)-appLogsPageCap:]
			p.LogTruncated = true
		}
		p.LogRows = recs
		if n := len(recs); n > 0 {
			p.LogCursor = applog.EncodeCursor(recs[n-1])
		}
	}
	s.render(w, http.StatusOK, "app_logs", p)
}

type appLogsDataLine struct {
	Time   string `json:"time"`
	Stream string `json:"stream"`
	Host   string `json:"host,omitempty"`
	Msg    string `json:"msg"`
	Fields string `json:"fields,omitempty"`
	Tone   string `json:"tone,omitempty"`
}

type appLogsDataResponse struct {
	Lines     []appLogsDataLine `json:"lines"`
	Truncated bool              `json:"truncated"`
	Gap       bool              `json:"gap,omitempty"`
	Cursor    string            `json:"cursor,omitempty"`
}

// handleAppLogsData is the browser's follow endpoint. It uses the session and
// app-membership gate, then the API reader's filter/cursor semantics; browser
// JavaScript never receives or manufactures a bearer credential.
func (s *Server) handleAppLogsData(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Cache-Control", "no-store")
	_, _, acct, _, app, ok := s.accountApp(w, r)
	if !ok {
		return
	}
	now := time.Now()
	f, limit, bad := browserLogsFilterFromQuery(r, now)
	if bad != "" {
		jsonError(w, http.StatusBadRequest, bad)
		return
	}
	if s.cfg.Releases == nil {
		jsonError(w, http.StatusServiceUnavailable, "could not read the logs")
		return
	}
	cursorText := r.URL.Query().Get("cursor")
	cur, hasCursor := applog.DecodeCursor(cursorText)
	if cursorText != "" && !hasCursor {
		writeJSON(w, http.StatusOK, appLogsDataResponse{Lines: []appLogsDataLine{}, Gap: true})
		return
	}
	if hasCursor {
		if !f.Since.IsZero() && cur.TS.Before(f.Since) {
			writeJSON(w, http.StatusOK, appLogsDataResponse{Lines: []appLogsDataLine{}, Gap: true})
			return
		}
		cursorSince := cur.TS.Add(-time.Second)
		if f.Since.IsZero() || cursorSince.After(f.Since) {
			f.Since = cursorSince
		}
	}
	limit = min(limit, appLogsPageCap)
	ctx, cancel := context.WithTimeout(r.Context(), instanceStoreTimeout)
	defer cancel()
	recs, trimmed, err := applog.ReadWindow(ctx, s.cfg.Releases, acct.Sqid, app, f, logsCollectCap)
	if err != nil {
		log.Printf("console: app logs data %s/%s: %v", acct.Sqid, app, err)
		jsonError(w, http.StatusBadGateway, "could not read the logs")
		return
	}
	resp := appLogsDataResponse{Gap: trimmed && hasCursor}
	if hasCursor {
		var after []applog.Record
		for _, rec := range recs {
			if cur.Before(rec) {
				after = append(after, rec)
			}
		}
		if len(after) > limit {
			after = after[:limit]
			resp.Truncated = true
		}
		recs = after
	} else if len(recs) > limit {
		recs = recs[len(recs)-limit:]
		resp.Truncated = true
	}
	for _, line := range logLines(recs) {
		resp.Lines = append(resp.Lines, appLogsDataLine{
			Time: line.Time, Stream: line.Stream, Host: line.Host,
			Msg: line.Msg, Fields: line.Fields, Tone: line.Tone,
		})
	}
	if n := len(recs); n > 0 {
		resp.Cursor = applog.EncodeCursor(recs[n-1])
	} else {
		resp.Cursor = cursorText
	}
	if resp.Lines == nil {
		resp.Lines = []appLogsDataLine{}
	}
	writeJSON(w, http.StatusOK, resp)
}

// browserLogsFilterFromQuery keeps the CLI's filter parser as the one source
// of validation while making the console's search box literal. A stale
// console URL carrying grep continues to use its original regular expression.
func browserLogsFilterFromQuery(r *http.Request, now time.Time) (applog.Filter, int, string) {
	text := r.URL.Query().Get("text")
	if text == "" {
		return logsFilterFromQuery(r, now)
	}
	r2 := r.Clone(r.Context())
	u := *r.URL
	q := u.Query()
	q.Set("grep", regexp.QuoteMeta(text))
	q.Del("text")
	u.RawQuery = q.Encode()
	r2.URL = &u
	return logsFilterFromQuery(r2, now)
}

// handleAppActivity is the console's own audit trail for this app.
func (s *Server) handleAppActivity(w http.ResponseWriter, r *http.Request) {
	p, acct, ok := s.appPage(w, r, "activity")
	if !ok {
		return
	}
	p.ActivityCopy = activityText
	if events, err := s.store.Events(acct.ID, p.AppName, activityCap); err != nil {
		log.Printf("console: events %s: %v", p.AppName, err)
	} else {
		// Only link targets this account's assembled view proves still exist.
		// Deleted instances and same-named routes owned by another account stay
		// plain text; an activity link must never cross the membership boundary.
		instances := make(map[string]bool)
		for _, route := range p.Detail.Routes {
			if route.Account == acct.Sqid && !route.Platform {
				instances[route.Host] = true
			}
		}
		for i := range events {
			if events[i].TargetType == "release" && events[i].Target != "" {
				events[i].TargetURL = p.Nav + "/apps/" + url.PathEscape(p.AppName) + "/releases#version-" + url.QueryEscape(events[i].Target)
			}
			if events[i].TargetType == "channel" && events[i].Target != "" {
				events[i].TargetURL = p.Nav + "/apps/" + url.PathEscape(p.AppName) + "/deployments"
			}
			if events[i].TargetType == "instance" && instances[events[i].Target] {
				events[i].TargetURL = p.Nav + "/apps/" + url.PathEscape(p.AppName) +
					"/instances/" + url.PathEscape(events[i].Target)
			}
		}
		p.Events = events
	}
	s.render(w, http.StatusOK, "app_activity", p)
}

// handleAppSettings is the app's own record and the controls over it:
// identity (and renaming it, while that is still only a record), domains,
// the account-move repair, and deletion.
func (s *Server) handleAppSettings(w http.ResponseWriter, r *http.Request) {
	p, acct, ok := s.appPage(w, r, "settings")
	if !ok {
		return
	}
	section := r.PathValue("section")
	if section == "" {
		section = "general"
	}
	if !appSettingsSections[section] {
		http.NotFound(w, r)
		return
	}
	if section == "pipeline" {
		s.handlePipelineSettingsPage(w, r, p, acct)
		return
	}
	setAppSettingsSection(&p, section)
	s.populateAppSettings(r, &p, acct)
	s.render(w, http.StatusOK, "app_settings", p)
}

func setAppSettingsSection(p *page, section string) {
	p.SettingsSection = section
	for _, item := range []struct{ key, label string }{
		{"general", "General"},
		{"domains", "Domains"},
		{"pipeline", "Release pipeline"},
		{"environments", "Environments"},
		{"storage", "Storage"},
		{"email", "Email"},
		{"features", "Feature flags"},
		{"advanced", "Advanced"},
		{"delete", "Delete"},
	} {
		href := p.Nav + "/apps/" + url.PathEscape(p.AppName) + "/settings"
		if item.key != "general" {
			href += "/" + item.key
		}
		p.SettingsNav = append(p.SettingsNav, SettingsSectionLink{
			Key: item.key, Label: item.label, Href: href, Current: item.key == section,
		})
	}
}

func (s *Server) populateAppSettings(r *http.Request, p *page, acct *Account) {
	p.Settings = s.assembleSettings(r.Context(), p, acct)
	// The Errors log level this app resolves to, and where it comes from —
	// the one setting the tab itself cannot change. A failed read is said
	// rather than defaulted (see ErrLevelUnread), and never fails a page
	// that is mostly about something else.
	if res, err := telemetry.Resolve(r.Context(), s.cfg.Releases, acct.Sqid, p.AppName); err != nil {
		log.Printf("console: telemetry %s/%s: %v", acct.Sqid, p.AppName, err)
		p.ErrLevelUnread = true
	} else {
		p.ErrLevelSetting = res
	}
	// The analytics switch is the OTHER half of that same resolved object —
	// one settings file, one read — under the name its own section uses.
	p.AnalyticsSetting, p.AnalyticsUnread = p.ErrLevelSetting, p.ErrLevelUnread
	s.loadSwapPolicy(r.Context(), p, acct)
}

func (s *Server) renderAppSettingsForm(w http.ResponseWriter, r *http.Request, status int, section, msg string, drafts map[string]string) {
	p, acct, ok := s.appPage(w, r, "settings")
	if !ok {
		return
	}
	setAppSettingsSection(&p, section)
	p.FlashErr = msg
	p.SettingsRenameTo = drafts["rename"]
	p.SettingsDomain = drafts["domain"]
	p.SettingsChannel = drafts["channel"]
	s.populateAppSettings(r, &p, acct)
	s.render(w, status, "app_settings", p)
}

// activityCap bounds the activity tab's own listing.
const activityCap = 50 // the activity tab has the room the overview strip never did

// audit best-effort-records an owner action: a failed audit line is logged,
// never surfaced, and never fails the action it records.
func (s *Server) audit(acct *Account, app, addr, action, detail string) {
	if err := s.store.RecordEvent(acct.ID, app, addr, action, detail, time.Now()); err != nil {
		log.Printf("console: audit %s %s: %v", action, app, err)
	}
}

// auditActivity records server-derived structure separately from optional
// caller context. Authorisation and mutation must already have succeeded.
func (s *Server) auditActivity(acct *Account, app, addr string, activity Activity) {
	if err := s.store.RecordActivity(acct.ID, app, addr, activity, time.Now()); err != nil {
		log.Printf("console: audit %s %s: %v", activity.Action, app, err)
	}
}

// ensureAccountManifest is the view-time backfill for account identity: write
// accounts/<sqid>/account.json only when none exists. An existing manifest is
// what every box has already materialized — a page view must never clobber
// it, because rewriting a different id there would re-home every platform
// domain the account owns. It also covers the accounts that predate this
// feature (the built-in ops account, and any minted while the bucket was
// unreachable). Best-effort: failures are logged, never fail the page — which
// a bucketless console (s.cfg.Releases == nil) is the extreme case of: there
// is nothing to read OR backfill, so every appPage view on such a console
// panicked here until #82 Task 5's Settings-without-a-bucket coverage caught
// it; nil is now just another "nothing to do" the caller never sees.
func (s *Server) ensureAccountManifest(ctx context.Context, acct *Account) {
	if s.cfg.Releases == nil {
		return
	}
	key := AccountManifestKey(acct.Sqid)
	_, _, err := s.cfg.Releases.Get(ctx, key)
	if err == nil {
		return // already there — nothing to backfill
	}
	if !errors.Is(err, os.ErrNotExist) {
		log.Printf("console: account manifest %s: %v", key, err)
		return
	}
	if err := WriteAccountManifest(ctx, s.cfg.Releases, acct.ID, acct.Sqid, acct.Name, acct.CreatedAt); err != nil {
		log.Printf("console: backfill account manifest %s: %v", key, err)
		return
	}
	log.Printf("console: backfilled account manifest for %s (%s)", acct.Sqid, acct.Name)
}

// claimOutcome is how one claim attempt ended: the shared vocabulary of the
// two claim doors (the browser form's handleNewApp, the CLI API's
// handleAPICreateApp), each of which maps every outcome onto its own wire
// shape. The distinct failure outcomes exist because the browser door has
// always named which step failed ("that name" / "the release store" / "the
// app") and collapsing them here would change its copy.
type claimOutcome int

const (
	claimOK                claimOutcome = iota
	claimInvalid                        // not a ValidApp name
	claimReserved                       // the literal name the console's own routes shadow (e.g. "new")
	claimTaken                          // any flavour of "not free" — table row, grant, bucket objects, lost race
	claimCheckFailed                    // a database lookup failed
	claimStoreFailed                    // the release-store listing failed
	claimCreateFailed                   // the insert itself failed
	claimApexHeld                       // another app already holds the name's platform apex (apex.go)
	claimTemporaryReserved              // a tmp- name at a permanent door (temporary static sites spec ruling 7)
)

// normalizeAppName is the one normalization both claim doors apply before
// claimApp sees the name.
func normalizeAppName(name string) string {
	return strings.ToLower(strings.TrimSpace(name))
}

// validBuildProbe bounds the deploy watch's probe path to what it actually
// dials: an absolute path, no query, no fragment, no protocol-relative
// "//host/..." escape, and printable ASCII only (no control characters, no
// bytes a Go net/http client would refuse or mangle). The watch appends its
// own cache-busting query parameter (deploy.go), so a probe carrying one
// would produce a URL with two — and a probe starting "//" (or a full URL)
// would silently point the watch at another host entirely, which is the one
// mistake here that could report a DIFFERENT deployment's build as this
// one's. The client mirror (validBuildProbe, apps.go) must stay
// byte-identical to this rule — a typo the server refuses must cost nothing
// against the create verb's own scarce per-day budget, and a typo the
// server ACCEPTS but the client refuses would just be a confusing false
// refusal.
//
// This is no longer only a create-time gate: the SAME rule is what keeps the
// deploy watch on-host. runDeploy re-checks the echoed probe with the client
// mirror before dialing it (deploy.go), so loosening this "just for creates"
// silently loosens the watch too — and the shape that matters there is a
// value not starting with "/": "https://" + host + "@evil.example/x" parses
// host as USERINFO and evil.example as the HOST, which is this comment's
// "a DIFFERENT deployment's build" failure arriving by a second route.
func validBuildProbe(p string) bool {
	if !strings.HasPrefix(p, "/") || strings.HasPrefix(p, "//") || strings.ContainsAny(p, "?#") {
		return false
	}
	if len(p) > 256 {
		return false
	}
	for i := 0; i < len(p); i++ {
		if p[i] < 0x21 || p[i] > 0x7e {
			return false
		}
	}
	return true
}

// ownerExempt reports whether the #79 owner exemption covers prefix, given
// the account's own app prefix. It is an allowlist of exactly one prefix: a
// prefix it has never been told about is NOT exempt, so a third prefix added
// to claimApp's list is refused for an owner until someone deliberately names
// it here. See the call site for why that default matters.
func ownerExempt(prefix, ownPrefix string) bool { return prefix == ownPrefix }

// reservedAppName reports whether no app in acct may take name, by create or
// by rename.
//
// "new" is the literal path segment GET /a/{sqid}/apps/new resolves to —
// Go 1.22's mux prefers it over apps/{app}, so an app named "new" could
// never be viewed.
//
// The console's own mail identity hangs off consoleMailApp in the ops
// account (consolemail.go). The mail layer refuses to tear that domain down
// whatever app holds the name, but an app wearing it would still read as
// the domain's owner everywhere else.
func reservedAppName(acct *Account, name string) bool {
	return name == "new" || (acct.Sqid == release.OpsAccount && name == consoleMailApp)
}

// claimApp is the permanent claim every existing door makes: claimAppWith
// with a zero expiresAt.
func (s *Server) claimApp(ctx context.Context, acct *Account, name, addr, placement string, ownerClaim bool, rq regionReq) (outcome claimOutcome, placed string, held *apexHold) {
	return s.claimAppWith(ctx, acct, name, addr, placement, ownerClaim, rq, time.Time{})
}

// claimAppWith claims an app name for acct — once, ever. A name is refused when
// the apps table has it, when ANY owner exists for it (CLI-granted apps stay
// claim-proof), or when the release store already holds anything under
// apps/<name>/. This is the ONLY place the claim checks live: both doors
// call it, so they cannot drift apart. Authentication, rate limits, the
// audit row and the response are the callers' business.
//
// placement is an ALREADY-VALIDATED "" or "fleet/<name>" string — the
// caller (handleAPICreateApp) checks grammar and fleet ownership itself,
// the same inline checks placeAppTarget's target uses, BEFORE calling this,
// so an invalid or foreign placement never reaches here at all and never
// costs a claim attempt. handleNewApp (the browser door) has no placement
// concept and always passes "".
//
// placed, the second return, is what actually ended up stored: placement
// itself on a successful write, "" on a failed one (or when placement was
// "" to begin with — nothing was ever asked for). On a successful claim the
// placement is stamped as a SEPARATE store write, after CreateAppIn — not
// threaded into that INSERT — because CreateAppIn has many other, unrelated
// callers; a failure of this second write is logged and does NOT undo the
// claim (the same best-effort shape ensureAccountManifest below already
// uses): an app that exists but isn't placed is recoverable with `carlos
// apps place`, while failing the whole request after the row is already
// committed would leave the caller unable to tell whether retrying `apps
// create` means "taken" or "try again". `placed` is what lets the CALLER
// (handleAPICreateApp, echoed to the wire as "placement") make that failure
// OBSERVABLE instead of silently trusting the request — a caller that never
// checks the echo cannot tell "placed" from "claim succeeded, placement
// silently didn't".
//
// ownerClaim exempts the ACCOUNT-QUALIFIED prefix check below, and nothing
// else. The guard exists so a stranger cannot inherit objects somebody else
// shipped — but apps/<sqid>/<app>/ is namespaced BY ACCOUNT, so objects under
// a given sqid can only be that account's. An OWNER of that account claiming
// a name under its own prefix is adopting their own release history, which is
// the whole of issue #79: an app first shipped direct-to-bucket (direct mode
// skips the claim) could otherwise never be given a row, and so stayed
// invisible to the console forever with no recovery but deleting its history.
//
// It is OWNER, not member: adopting existing release history is an ownership
// act. It is FALSE for every service principal — a service has no role at
// all, and an account-scoped one legitimately reaches this function, so
// without an explicit pin the exemption would hand every CI credential the
// same power.
//
// held is set only with claimApexHeld: who holds the name's platform apex, so
// a door can say so without asking again.
//
// A zero expiresAt is the permanent claim every existing door makes, and it
// refuses a tmp- name: nothing permanent may be created in that namespace
// (spec ruling 7). A non-zero one is /new-temporary's claim: it refuses any
// other name, runs with ownerClaim false whatever the caller's role (spec
// §3, so any object under the prefix refuses), and inserts the row with its
// expiry in the same statement that claims the name.
func (s *Server) claimAppWith(ctx context.Context, acct *Account, name, addr, placement string, ownerClaim bool, rq regionReq, expiresAt time.Time) (outcome claimOutcome, placed string, held *apexHold) {
	if !release.ValidApp(name) {
		return claimInvalid, "", nil
	}
	// Reserved before any store write, same as an invalid name.
	if reservedAppName(acct, name) {
		return claimReserved, "", nil
	}
	temporary := !expiresAt.IsZero()
	if release.IsTemporaryName(name) != temporary {
		if temporary {
			return claimInvalid, "", nil
		}
		return claimTemporaryReserved, "", nil
	}
	if temporary {
		ownerClaim = false
	}
	// Taken means taken IN THIS ACCOUNT — app names are unique per account,
	// never globally, so another account's "blog" is not a conflict.
	if has, err := s.store.HasAppIn(acct.ID, name); err != nil {
		log.Printf("console: claim check failed: account=%q app=%q op=%q err=%v", acct.Sqid, name, "HasAppIn", err)
		return claimCheckFailed, "", nil
	} else if has {
		return claimTaken, "", nil
	}
	// The pre-accounts checks still apply to the OPS account, where every
	// CLI-granted and pre-accounts app lives: a name with grants or bucket
	// objects there stays claim-proof.
	if acct.ID == OpsAccountID {
		if has, err := s.store.HasOwners(name); err != nil {
			log.Printf("console: claim check failed: account=%q app=%q op=%q err=%v", acct.Sqid, name, "HasOwners", err)
			return claimCheckFailed, "", nil
		} else if has {
			return claimTaken, "", nil
		}
	}
	// The account's own prefix, plus — for ops only — the legacy unqualified
	// one an unmigrated app's objects are still at. This one legacy read
	// OUTLIVES the retired read-fallback, and deliberately: it is explicit
	// rather than a resolution path, and a name whose legacy objects still
	// exist is not free. Handing it out would put a stranger's app in the way
	// of the `accounts migrate -from legacy` that is still owed to those
	// objects. For a non-ops account the legacy prefix belongs to somebody
	// else's app and must NOT block the name.
	ownPrefix := release.AppPrefix(acct.Sqid, name)
	adoptingExistingApp := false
	prefixes := []string{ownPrefix}
	if acct.ID == OpsAccountID {
		prefixes = append(prefixes, release.LegacyAppPrefix(name))
	}
	// The release-store deadline lives HERE, not in the doors, so both doors
	// give the bucket the same ten seconds the browser form always has —
	// and the database checks above stay outside it, as they always were.
	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
	defer cancel()
	// A name whose platform apex another app of the account already holds is
	// not free either, whatever the tables say: the new app would never get
	// its own URL (apex.go).
	if hold, err := s.apexHolder(ctx, acct, name); err != nil {
		if apexBucketFailure(err) {
			return claimStoreFailed, "", nil
		}
		log.Printf("console: claim check failed: account=%q app=%q op=%q err=%v", acct.Sqid, name, "apexHolder", err)
		return claimCheckFailed, "", nil
	} else if hold != nil {
		return claimApexHeld, "", hold
	}
	for _, prefix := range prefixes {
		keys, err := s.cfg.Releases.List(ctx, prefix)
		if err != nil {
			return claimStoreFailed, "", nil
		}
		if s.cfg.HostClaim && prefix == ownPrefix {
			free, err := s.claimAdmissionNameFree(ctx, acct.Sqid, name)
			if err != nil {
				return claimStoreFailed, "", nil
			}
			if free {
				continue
			}
		}
		if len(keys) == 0 {
			continue
		}
		// The owner exemption is an ALLOWLIST: it NAMES the one prefix it
		// covers — the account's own, apps/<sqid>/<app>/ — rather than
		// excluding the one it doesn't. The two forms are identical over
		// today's two prefixes; they differ in what happens to a THIRD one
		// added later. Written as an exclusion, any prefix appended to the
		// slice above would be exempted for an owner by default, fail-open
		// in a guard whose whole job is refusing. Written this way a new
		// prefix is refused until someone deliberately adds it here.
		//
		// The legacy unqualified prefix (ops only) is therefore outside the
		// exemption and still refuses whoever is asking: those objects are
		// owed an `accounts migrate -from legacy`, and a name handed out
		// over them puts an app in that migration's way.
		if ownerClaim && ownerExempt(prefix, ownPrefix) {
			adoptingExistingApp = true
			continue
		}
		return claimTaken, "", nil
	}
	region, source := s.resolveNewAppRegion(ctx, rq, adoptingExistingApp)
	if s.beforeClaimInsert != nil {
		s.beforeClaimInsert()
	}
	created, err := s.createClaimAppRow(ctx, acct, name, func(st *Store) (bool, error) {
		if temporary {
			return st.CreateTemporaryAppInRegion(acct.ID, name, addr, region, source, time.Now(), expiresAt)
		}
		return st.CreateAppInRegion(acct.ID, name, addr, region, source, time.Now())
	})
	if err != nil {
		return claimCreateFailed, "", nil
	}
	if !created { // lost a claim race after the checks
		return claimTaken, "", nil
	}
	// Spec §6.5: one line per creation, in every switch state (codex
	// plan-R6 1). Only reached once the row is ours.
	log.Printf("console: app region %s/%s: %s (%s)", acct.Sqid, name, s.homeRegionOut(region), source)
	if placement != "" {
		if err := s.store.SetAppPlacementContext(ctx, acct.ID, name, placement); err != nil {
			// Best-effort, like ensureAccountManifest below: the claim itself
			// already succeeded and must not be undone by this — see this
			// function's doc comment for why. `placed` stays "" so the
			// caller's echo tells the truth about it.
			log.Printf("console: claim %s/%s: set placement %s: %v", acct.Sqid, name, placement, err)
		} else {
			placed = placement
		}
	}
	// The app→account linkage needs no manifest of its own any more: it IS the
	// bucket key path (apps/<sqid>/<app>/…), written by the first ship. The
	// account's own manifest is what the agent materializes, and minting
	// already wrote it.
	s.ensureAccountManifest(ctx, acct)
	// Existing objects belong to an app whose console record is being
	// restored. Preserve its pipeline, including absence (the legacy ladder).
	// Only a new app gets the default edge pipeline (pipelines v2 spec §2).
	if !adoptingExistingApp {
		if _, err := release.SetPipeline(ctx, s.cfg.Releases, s.cfg.Key, acct.Sqid, name, release.DefaultPipelineChannels(), addr); err != nil {
			log.Printf("console: claim %s/%s: set default pipeline: %v", acct.Sqid, name, err)
		}
	}
	return claimOK, placed, nil
}

// handleNewAppForm is the create-app page; the claim itself stays on
// POST /a/{sqid}/apps/new (handleNewApp).
func (s *Server) handleNewAppForm(w http.ResponseWriter, r *http.Request) {
	addr, raw, acct, role, ok := s.account(w, r)
	if !ok {
		return
	}
	p := s.accountPage(w, r, addr, raw, acct, role)
	p.Title = "Create an app"
	p.ActiveNav = "apps"
	p.RegionPicker = s.newAppPicker(r.Context(), s.personIP(r))
	s.render(w, http.StatusOK, "app_new", p)
}

// handleNewApp is the browser door onto claimApp: the account page's New app
// form. Any member may claim a FREE name — creation grants nothing promotion
// doesn't already gate — and unlike the CLI door it carries no rate limit: a
// session behind CSRF is not the stolen-credential shape the API budget
// exists for, and this form is the escape hatch when that budget is honestly
// spent.
//
// An OWNER may additionally claim a name whose objects already exist under
// this account's own prefix (#79, claimApp's ownerClaim). A plain member
// cannot: adopting existing release history is an ownership act.
func (s *Server) handleNewApp(w http.ResponseWriter, r *http.Request) {
	addr, raw, acct, role, ok := s.account(w, r)
	if !ok {
		return
	}
	if subtle.ConstantTimeCompare([]byte(r.FormValue("csrf")), []byte(raw)) != 1 {
		s.renderMessage(w, r, http.StatusForbidden, "Refused", "Cross-site request blocked.")
		return
	}
	home := "/a/" + url.PathEscape(acct.Sqid) + "/"
	formPage := home + "apps/new"
	fail := func(msg string) {
		s.setFlash(w, "err", msg)
		http.Redirect(w, r, formPage, http.StatusSeeOther)
	}
	name := normalizeAppName(r.FormValue("name"))
	// The region is resolved inside claimApp, once it knows the claim is not
	// an adoption; the timezone and the address only ever feed that guess.
	rq, regionOK := s.pickedRegion(r.Context(), r)
	if !regionOK {
		fail(regionCopy.Unavailable)
		return
	}
	// The browser door never places at create time, so the second return
	// (what actually stuck) is always "" here and there is nothing to echo
	// it to — this form has no placement concept at all.
	defer s.planLock(acct)()
	if err := s.checkCreateApp(r.Context(), acct, name); err != nil {
		var planCap *planCapError
		if errors.As(err, &planCap) {
			fail(planCap.Browser())
			return
		}
		log.Printf("console: create %s/%s: plan cap: %v", acct.Sqid, name, err)
		fail("Could not create the app. Please try again.")
		return
	}
	outcome, _, held := s.claimApp(r.Context(), acct, name, addr, "", role == RoleOwner, rq)
	switch outcome {
	case claimInvalid:
		fail("Invalid app name — lowercase letters, digits, and dashes, starting with a letter.")
	case claimReserved:
		fail("That name is reserved.")
	case claimTemporaryReserved:
		fail("Names starting with tmp- are kept for temporary sites. Choose another name.")
	case claimTaken:
		fail("That name is taken.")
	case claimApexHeld:
		fail("That name is not free: " + apexHeldSentence(s.apexHost(acct.Sqid, name), held) + ".")
	case claimCheckFailed:
		fail("Could not check that name. Please try again.")
	case claimStoreFailed:
		fail("Could not check the release store. Please try again.")
	case claimCreateFailed:
		fail("Could not create the app. Please try again.")
	case claimOK:
		detail := "created app " + name
		if s.appRegionsOn() {
			region, _, _ := s.store.AppRegion(acct.ID, name)
			files, _ := s.liveEdges(r.Context())
			detail = fmt.Sprintf(regionCopy.AuditCreated, name, s.placeOf(region, s.regionCands(files)))
		}
		s.audit(acct, name, addr, "create", detail)
		s.setFlash(w, "ok", "Created app "+name+" — it's yours.")
		http.Redirect(w, r, home+"apps/"+url.PathEscape(name), http.StatusSeeOther)
	}
}

// tagSuffix names what a stable promotion's tag ended up as, or why it
// carries none (release versioning spec, 2026-08-08) — shared between the
// fresh-promote and no-op flashes in handlePromote below it, because
// PromoteOnLadder's stableTag runs on EVERY landing on stable, no-op
// included: a repeat promotion can heal a release that ended up nameless
// from a previous attempt's failed write, and the flash must say so exactly
// as loudly as the promotion that cut the tag the first time would have.
// "" off stable and for a version that carries no tag either way.
func tagSuffix(res release.PromoteResult) string {
	suffix := ""
	if res.Tag != "" {
		suffix += " — tagged " + res.Tag
	}
	if res.TagWarning != "" {
		suffix += " (" + res.TagWarning + ")"
	}
	return suffix
}

// handlePromote points a channel at a shipped version. It is the app's ONE
// promote door — the releases table posts to it, and so does every step of the
// ladder section — which is what makes the ladder and the passkey gate below
// worth anything: a hand-written POST meets exactly the doors a button does.
func (s *Server) handlePromote(w http.ResponseWriter, r *http.Request) {
	addr, raw, acct, role, app, ok := s.accountApp(w, r)
	if !ok {
		return
	}
	if subtle.ConstantTimeCompare([]byte(r.FormValue("csrf")), []byte(raw)) != 1 {
		s.renderMessage(w, r, http.StatusForbidden, "Refused", "Cross-site request blocked.")
		return
	}
	if s.cfg.Key == nil {
		s.renderMessage(w, r, http.StatusServiceUnavailable, "Promotions disabled",
			"No signing key on this host — the console is running read-only.")
		return
	}
	back := func(kind, msg string) {
		s.setFlash(w, kind, msg)
		dest := "/a/" + url.PathEscape(acct.Sqid) + "/apps/" + url.PathEscape(app)
		if tab := releaseBackTab(r); tab != "" {
			dest += "/" + tab
		}
		http.Redirect(w, r, dest, http.StatusSeeOther)
	}
	channel := strings.TrimSpace(r.FormValue("new_channel"))
	if channel == "" {
		channel = strings.TrimSpace(r.FormValue("channel"))
	}
	if !release.ValidChannel(channel) {
		back("err", "Invalid channel name.")
		return
	}
	version := strings.TrimSpace(r.FormValue("version"))
	ctx, cancel := context.WithTimeout(r.Context(), 15*time.Second)
	defer cancel()
	if !release.ValidVersion(version) {
		back("err", "Invalid version.")
		return
	}
	if _, err := release.GetManifest(ctx, s.cfg.Releases, acct.Sqid, app, version); err != nil {
		back("err", "Version "+version+" is not a shipped release of "+app+".")
		return
	}
	// Which gate this promotion meets is the pipeline's answer (release
	// pipelines v2 §5), so the pipeline is read before any of them. An
	// unreadable one refuses: "not safely nil" must never fall back to the
	// legacy ladder under the app that opted out of it.
	pipe, perr := release.GetPipeline(ctx, s.cfg.Releases, s.cfg.ReleasePub, acct.Sqid, app)
	if perr != nil {
		log.Printf("console: promote %s/%s: read pipeline: %v", acct.Sqid, app, perr)
		back("err", "Could not read the pipeline for "+app+". Nothing has been changed.")
		return
	}
	// The stable rung's owner gate fires BEFORE the confirm card: a member
	// probing an owner-only promote must meet the byte-identical 404, never a
	// card that concedes the action would otherwise proceed. promoteGate
	// re-checks this for owners on the confirmed POST; the duplication is the
	// point — the confirm step must sit strictly between owner 404 and
	// requireFreshAuth without weakening either.
	//
	// Legacy path only. A PIPELINED app's channel named "stable" is an
	// app-defined channel that happens to share a rung's name, and its gates
	// are the ones its pipeline declares (spec §7: the unconditional
	// stable-passkey becomes legacy-path-only) — reading the rung table for
	// it would impose an owner rule the account never asked for and cannot
	// remove.
	if rung, _ := release.Rung(channel); pipe == nil && rung == release.RungStable && role != RoleOwner {
		http.NotFound(w, r)
		return
	}
	if !confirmed(r) {
		s.confirmPromote(w, r, addr, raw, acct, role, app, channel, version, pipe)
		return
	}
	// The channel's own gate, LAST — after membership, after the app check,
	// after CSRF, and after every refusal that costs nothing. Order is
	// load-bearing: a non-member must meet the byte-identical 404 before
	// step-up is ever mentioned, or the redirect into Keymail would confirm
	// what the 404 is there to hide.
	if !s.promoteGate(w, r, addr, raw, role, channel, pipe) {
		return
	}
	// An approvals rule turns the promotion into a proposal — but only now,
	// with the proposer's presence just proved by promoteGate's step-up,
	// which is what earns their own confirmation its place in the quorum
	// (spec §4). Order is checked first, so a proposal that could never
	// execute never goes out for signatures.
	//
	// `pipe != nil` is already implied by a nonzero rule — channelRules
	// answers the zero ChannelRules for a nil pipeline — and is written out
	// anyway, because VersionStage below DEREFERENCES the pipeline it is
	// handed and would panic on nil.
	if rules := channelRules(pipe, channel); pipe != nil && rules.PromoteApprovals >= 1 {
		stage, serr := release.VersionStage(ctx, s.cfg.Releases, s.cfg.ReleasePub, acct.Sqid, app, version, pipe)
		if serr != nil {
			log.Printf("console: promote %s/%s: stage: %v", acct.Sqid, app, serr)
			back("err", "Could not work out where "+version+" sits in the pipeline. Nothing has been changed.")
			return
		}
		if aerr := release.PipelinePromotionAllowed(pipe, stage, channel); aerr != nil {
			back("err", "Promote refused: "+aerr.Error())
			return
		}
		// Pin the target channel's head at propose time (spec §4: a head
		// that moved underneath a proposal invalidates it); "" when the
		// channel has no pointer yet. An unreadable head refuses — a pin
		// that cannot be read cannot be recorded.
		head, herr := s.channelHead(ctx, acct, app, channel)
		if herr != nil {
			log.Printf("console: promote %s/%s: read channel %s: %v", acct.Sqid, app, channel, herr)
			back("err", "Could not read channel "+channel+". Nothing has been changed.")
			return
		}
		kind, msg := s.proposeThenExecute(ctx, acct, app, kindPromote,
			promotePayload{Version: version, Channel: channel, ObservedHead: head}, rules.PromoteApprovals, addr)
		back(kind, msg)
		return
	}
	// PromoteOnLadder, not Promote: the ladder is enforced here, not merely
	// drawn. It also records the promotion on the pointer it moves — what
	// moved, from which rung to which, and which member said so.
	res, err := release.PromoteOnLadder(ctx, s.cfg.Releases, s.cfg.Key, acct.Sqid, app, channel, version,
		release.PromoteOptions{Actor: addr})
	if err != nil {
		log.Printf("console: promote %s %s -> %s: %v", app, version, channel, err)
		// The ladder's own refusals are the useful text here — they name the
		// rung this build is on and the one it would have to come through.
		back("err", "Promote refused: "+err.Error())
		return
	}
	if res.NoOp {
		back("ok", channel+" already serves "+version+tagSuffix(res)+" — nothing to do.")
		return
	}
	s.auditActivity(acct, app, addr, Activity{Action: "promote", TargetType: "channel", Target: channel, Detail: "promoted " + version + " to " + channel})
	msg := "Promoted " + version + " to " + channel + tagSuffix(res) + "."
	// Whether this app bakes at all is the production flag's business (bake
	// controls spec §2): a non-production app's boxes adopt a held channel
	// immediately, so the window note below would be a lie for them. Read the
	// flag before the checkbox, which may still turn it on in this same
	// request.
	flag, ferr := release.GetProduction(ctx, s.cfg.Releases, s.cfg.ReleasePub, acct.Sqid, app)
	if ferr != nil {
		log.Printf("console: production flag %s: %v", app, ferr)
	}
	// An unreadable flag fails TOWARD baking, exactly as the adopt path does
	// (spec §4) — so the note is still the truth about what the boxes will do.
	baking := ferr != nil || (flag != nil && flag.Production)
	// The spec §7 prompt: promote-to-stable asked "is this app in production
	// now?" and the human said yes — in the same passkey-confirmed action.
	// Turning ON is any member's anyway, so no extra gate; flips only when
	// the flag is actually off, so a stray field on a repeat is a no-op.
	// Both failure paths SAY so. The human ticked a box in a passkey-confirmed
	// action; a log line they will never read is not an answer, and a silent
	// skip leaves them believing the app bakes when it does not.
	if r.FormValue("enable_bake") == "1" {
		switch {
		case ferr != nil:
			// The read failed, so the flip was never attempted: writing over a
			// flag nobody could read is the repair path's job (the app page's
			// re-declare control), not a promote's side effect. baking is true
			// here only because an unreadable flag fails TOWARD baking — which
			// settles nothing about what this app has declared.
			msg += " The production flag could not be read, so the safety delay was not enabled — use the toggle on the app's Versions tab."
		case baking:
			// Already on: a stray checkbox on a repeat is a no-op, as before.
		default:
			if tmsg, _ := s.temporaryRefusal(acct, app, "turn its safety delay on"); tmsg != "" {
				msg += " " + tmsg
				break
			}
			if err := s.claimAppMutation(ctx, acct, app, "protection", func(ctx context.Context) error {
				return release.SetProduction(ctx, s.cfg.Releases, s.cfg.Key, acct.Sqid, app, true, addr)
			}); err != nil {
				log.Printf("console: enable_bake %s: %v", app, err)
				msg += " Turning the safety delay on failed — use the toggle on the app's Versions tab."
			} else {
				s.audit(acct, app, addr, "production", "enabled the safety delay (production: on, at stable promote)")
				msg += " Safety delay enabled."
				baking = true
			}
		}
	}
	// One announcement (carlos-deploy §3), placed after the optional flag flip
	// rather than beside the promote's own audit row above, so it covers BOTH
	// of this handler's box-consumed writes — the pointer and, when the
	// checkbox was ticked, the production flag — in a single bump.
	s.bumpSerial(ctx)
	// Whether the boxes will actually hold this, said the same way the CLI
	// door's `held` field says it (channelHeld, apicli.go): the window comes
	// from the pipeline when there is one, and a PIPELINED app never consults
	// the production flag at all — its bake policy is the pipeline's alone
	// (spec §3), which is exactly what adopt.go does.
	if holdWindow(pipe, channel) > 0 && (pipe != nil || baking) {
		msg += " It goes live everywhere after the safety delay — rollbacks skip it."
	}
	back("ok", msg)
}

// promoteGate applies the gate the TARGET CHANNEL carries. Which table it
// reads is the pipeline's answer, and the two are deliberately exclusive:
//
//	pipe == nil — the legacy ladder (pipelines spec §3's gate table). Below
//	  stable, membership — which the caller has already proved — is the gate,
//	  and this waves the promotion through. Stable is different in kind: it
//	  puts a build in front of every user of the app, so it takes an account
//	  OWNER, and a live session is not sufficient proof that the owner is the
//	  one asking.
//	pipe != nil — the channel's own declared rules (release pipelines v2 §2).
//	  A passkey rule, or an approvals rule (whose every confirmation is
//	  passkey-backed, the proposer's included), demands the step-up; a channel
//	  with neither — and every channel outside the pipeline, canary/* included
//	  — is waved through on membership. There is no owner rule on this path:
//	  the pipeline says what a channel costs, and ownership is not one of the
//	  things it can say (spec §2). That places the weight on WHO MAY WRITE A
//	  PIPELINE — any member of the account, or an admin-role service
//	  credential (handleAPIPipelinePut) — so an account that wants a channel
//	  only its owner can promote onto expresses that as a passkey plus
//	  approvals, not by naming the channel after a rung.
//
// The ORDER is the same on both paths and is the load-bearing part: the
// byte-identical 404 first, requireFreshAuth strictly last. It returns false
// when it has already written the response — either the 404 or the step-up
// redirect — and the caller must simply return.
func (s *Server) promoteGate(w http.ResponseWriter, r *http.Request, addr, raw, role, channel string, pipe *release.Pipeline) bool {
	if pipe != nil {
		rules := channelRules(pipe, channel)
		if !rules.Passkey && rules.PromoteApprovals < 1 {
			return true
		}
		return s.requireFreshAuth(w, r, addr, raw)
	}
	if rung, _ := release.Rung(channel); rung != release.RungStable {
		return true
	}
	if role != RoleOwner {
		http.NotFound(w, r)
		return false
	}
	return s.requireFreshAuth(w, r, addr, raw)
}

// handleRollback swaps a channel back to its previous version. On a pipelined
// channel it meets that channel's own rules first (see the gate below the
// confirm card): the same passkey and the same quorum a promotion onto it
// would meet, because it is the same pointer and the same blast radius.
func (s *Server) handleRollback(w http.ResponseWriter, r *http.Request) {
	addr, raw, acct, role, app, ok := s.accountApp(w, r)
	if !ok {
		return
	}
	if subtle.ConstantTimeCompare([]byte(r.FormValue("csrf")), []byte(raw)) != 1 {
		s.renderMessage(w, r, http.StatusForbidden, "Refused", "Cross-site request blocked.")
		return
	}
	if s.cfg.Key == nil {
		s.renderMessage(w, r, http.StatusServiceUnavailable, "Promotions disabled",
			"No signing key on this host — the console is running read-only.")
		return
	}
	back := func(kind, msg string) {
		s.setFlash(w, kind, msg)
		dest := "/a/" + url.PathEscape(acct.Sqid) + "/apps/" + url.PathEscape(app)
		if tab := releaseBackTab(r); tab != "" {
			dest += "/" + tab
		}
		http.Redirect(w, r, dest, http.StatusSeeOther)
	}
	channel := strings.TrimSpace(r.FormValue("channel"))
	if !release.ValidChannel(channel) {
		back("err", "Invalid channel name.")
		return
	}
	ctx, cancel := context.WithTimeout(r.Context(), 15*time.Second)
	defer cancel()
	// Which gate this rollback meets is the pipeline's answer, so it is read
	// before the confirm card — the same reasoning, and the same order, as
	// handlePromote.
	pipe, perr := release.GetPipeline(ctx, s.cfg.Releases, s.cfg.ReleasePub, acct.Sqid, app)
	if perr != nil {
		log.Printf("console: rollback %s/%s: read pipeline: %v", acct.Sqid, app, perr)
		back("err", "Could not read the pipeline for "+app+". Nothing has been changed.")
		return
	}
	// The stable rung's owner gate fires BEFORE the confirm card (Task 9
	// review, IMPORTANT 1 — mirroring handlePromote's own comment on this
	// exact point): a non-owner member probing a legacy stable rollback must
	// meet the byte-identical 404, never a card that concedes the action
	// would otherwise proceed. Legacy path only — a PIPELINED app's channel
	// named "stable" is governed by its own declared rules below, not this
	// rung table (pre-existing gap fix, Task 8/9 review).
	if rung, _ := release.Rung(channel); pipe == nil && rung == release.RungStable && role != RoleOwner {
		http.NotFound(w, r)
		return
	}
	cur, err := release.Channel(ctx, s.cfg.Releases, s.cfg.ReleasePub, acct.Sqid, app, channel)
	if err != nil {
		back("err", "Could not read channel "+channel+".")
		return
	}
	if len(cur.History) == 0 {
		back("err", "Channel "+channel+" has no previous version to roll back to.")
		return
	}
	target := cur.History[0]
	if !confirmed(r) {
		s.confirmRollback(w, r, addr, raw, acct, role, app, channel, cur.Version, target)
		return
	}
	// The card pinned where it promised to go; a channel whose history moved
	// since then must be looked at again, not rolled to wherever it points
	// now. Checked only when the pin is present: a pinless POST (the CLI
	// shape) rolls back the current head exactly as it always has.
	if pinned := strings.TrimSpace(r.FormValue("target")); pinned != "" && pinned != target {
		back("err", "Channel "+channel+" changed while you were confirming — review the rollback again.")
		return
	}
	// A pipelined channel's own rules gate a rollback exactly as they gate a
	// promotion (release pipelines v2 §2): a rollback is a pointer write, and
	// the build it puts in front of every user of the app is one the
	// channel's rules exist to govern. requireFreshAuth stays LAST, after the
	// confirm card and the pin — and a channel with no rules, or an app with
	// no pipeline, behaves exactly as it did.
	if rules := channelRules(pipe, channel); rules.Passkey || rules.PromoteApprovals >= 1 {
		if !s.requireFreshAuth(w, r, addr, raw) {
			return
		}
		if rules.PromoteApprovals >= 1 {
			// Pinned to the version this rollback lands on, and flagged
			// hotfix: a rollback is out-of-order by nature, so the order
			// re-check at execution is the one check it must not meet. The
			// pointer ends up serving the pinned build either way; what
			// differs from release.Rollback is the shape of the trail it
			// leaves — a promotion of the older build, confirmed by a
			// quorum, rather than a history pop.
			kind, msg := s.proposeThenExecute(ctx, acct, app, kindPromote,
				promotePayload{Version: target, Channel: channel, Hotfix: true, Rollback: true,
					ObservedHead: cur.Version},
				rules.PromoteApprovals, addr)
			back(kind, msg)
			return
		}
	} else if pipe == nil {
		// Pre-existing gap (Task 8 review): the legacy ladder's stable rung
		// carried NO gate at all on this door, while promoteGate takes
		// owner+passkey for a PROMOTION onto it and the API door 403s a
		// rollback of it outright — a rollback lands the same pointer write
		// in front of the same users. Mirror promoteGate's legacy-path shape
		// exactly: byte-identical 404 for a non-owner (already refused
		// above, before the confirm card), requireFreshAuth last here — the
		// re-check below is deliberate duplication of the owner condition
		// (handlePromote's own comment: the confirm step must sit strictly
		// between owner 404 and requireFreshAuth without weakening either),
		// not a second gate. Every other legacy rung is unchanged —
		// membership alone, as before.
		if rung, _ := release.Rung(channel); rung == release.RungStable {
			if !s.requireFreshAuth(w, r, addr, raw) {
				return
			}
		}
	}
	if err := release.Rollback(ctx, s.cfg.Releases, s.cfg.Key, acct.Sqid, app, channel); err != nil {
		log.Printf("console: rollback %s %s: %v", app, channel, err)
		back("err", "Rollback failed: "+err.Error())
		return
	}
	s.auditActivity(acct, app, addr, Activity{Action: "rollback", TargetType: "channel", Target: channel, Detail: "rolled back " + channel + " to " + target})
	s.bumpSerial(ctx)
	back("ok", "Rolled back "+channel+" to "+target+".")
}

// handleProduction flips the app's production flag (2026-08-04 console bake
// controls spec §7). ON is any member's to do, instantly — the safe
// direction stays cheap. OFF removes a supply-chain guard from every
// subscriber of the app, so it is the owner's, behind the passkey, and the
// fleet ratchets it in on each box's own clock.
//
// Gate order is the mandated one, and the two owner-side gates apply to the
// OFF direction ONLY: session/membership (accountApp) → CSRF → signing-key
// availability → value parse → for OFF: owner (byte-identical 404) →
// requireFreshAuth LAST. The refusals that cost nothing and reveal nothing
// come first; the 404 comes before any step-up redirect, which would
// otherwise confirm to a member-probing-as-stranger that the account exists.
func (s *Server) handleProduction(w http.ResponseWriter, r *http.Request) {
	addr, raw, acct, role, app, ok := s.accountApp(w, r)
	if !ok {
		return
	}
	if subtle.ConstantTimeCompare([]byte(r.FormValue("csrf")), []byte(raw)) != 1 {
		s.renderMessage(w, r, http.StatusForbidden, "Refused", "Cross-site request blocked.")
		return
	}
	if s.cfg.Key == nil {
		s.renderMessage(w, r, http.StatusServiceUnavailable, "Promotions disabled",
			"No signing key on this host — the console is running read-only.")
		return
	}
	back := func(kind, msg string) {
		s.setFlash(w, kind, msg)
		http.Redirect(w, r, "/a/"+url.PathEscape(acct.Sqid)+"/apps/"+url.PathEscape(app), http.StatusSeeOther)
	}
	var on bool
	switch r.FormValue("production") {
	case "on":
		on = true
	case "off":
		on = false
	default:
		back("err", "Invalid production value.")
		return
	}
	if on {
		defer s.lockApp(acct.Sqid, app)()
		if msg, _ := s.temporaryRefusal(acct, app, "mark it as production"); msg != "" {
			back("err", msg)
			return
		}
	}
	if !on {
		if role != RoleOwner {
			http.NotFound(w, r)
			return
		}
		if !s.requireFreshAuth(w, r, addr, raw) {
			return
		}
	}
	ctx, cancel := context.WithTimeout(r.Context(), 15*time.Second)
	defer cancel()
	if err := s.claimAppMutation(ctx, acct, app, "protection", func(ctx context.Context) error {
		return release.SetProduction(ctx, s.cfg.Releases, s.cfg.Key, acct.Sqid, app, on, addr)
	}); err != nil {
		log.Printf("console: production %s -> %v: %v", app, on, err)
		back("err", "Could not change the safety delay: "+err.Error())
		return
	}
	// The flag is read on every box's adopt path (it decides whether a channel
	// bakes at all), so both directions are box-consumed. OFF especially: it
	// releases held versions, and that is the direction people wait on.
	s.bumpSerial(ctx)
	if on {
		s.audit(acct, app, addr, "production", "enabled the safety delay (production: on)")
		back("ok", "Safety delay enabled — new versions now wait on beta and stable before going live.")
	} else {
		s.audit(acct, app, addr, "production", "disabled the safety delay (production: off)")
		back("ok", "Safety delay turning off — takes effect after ~72h.")
	}
}

// handleFastTrack waives the bake window for one channel's CURRENT head —
// owner + passkey, always: this is the loud instant path past the window
// (spec §5, §9), and the pointer wears the badge forever.
func (s *Server) handleFastTrack(w http.ResponseWriter, r *http.Request) {
	addr, raw, acct, role, app, ok := s.accountApp(w, r)
	if !ok {
		return
	}
	if subtle.ConstantTimeCompare([]byte(r.FormValue("csrf")), []byte(raw)) != 1 {
		s.renderMessage(w, r, http.StatusForbidden, "Refused", "Cross-site request blocked.")
		return
	}
	if s.cfg.Key == nil {
		s.renderMessage(w, r, http.StatusServiceUnavailable, "Promotions disabled",
			"No signing key on this host — the console is running read-only.")
		return
	}
	back := func(kind, msg string) {
		s.setFlash(w, kind, msg)
		http.Redirect(w, r, "/a/"+url.PathEscape(acct.Sqid)+"/apps/"+url.PathEscape(app), http.StatusSeeOther)
	}
	channel := strings.TrimSpace(r.FormValue("channel"))
	if !release.ValidChannel(channel) {
		back("err", "Invalid channel name.")
		return
	}
	if role != RoleOwner {
		http.NotFound(w, r)
		return
	}
	// The confirm card sits strictly between the owner 404 and the passkey:
	// only owners ever see it, and the confirmed replay still meets
	// requireFreshAuth below.
	if !confirmed(r) {
		s.confirmFastTrack(w, r, addr, raw, acct, role, app, channel)
		return
	}
	if !s.requireFreshAuth(w, r, addr, raw) {
		return
	}
	// A channel with no bake window has nothing to waive, and the waiver is
	// not inert on it: FastTrack re-signs the pointer, which re-stamps
	// PromotedAt — and PromotedAt is what CanaryExpired reads, so waiving a
	// canary would silently renew its TTL lease and badge a channel that
	// never bakes as "fast-tracked past the bake window", forever.
	//
	// Placed HERE, after both owner gates, and not with the cheap refusals
	// above: the window is pure vocabulary and leaks nothing on its own, but a
	// refusal that fires before the owner check would make this endpoint's
	// response vary with the channel name — and now with the app's PIPELINE —
	// for a NON-OWNER, who must see the byte-identical 404 and nothing else.
	// The mandated order (session → CSRF → owner 404 → requireFreshAuth LAST)
	// then leaves only this spot. The cost is a passkey tap spent on a
	// refusal; the alternative is an oracle.
	ctx, cancel := context.WithTimeout(r.Context(), 15*time.Second)
	defer cancel()
	// holdWindow, not HoldFor: a pipelined channel's window is its own, for a
	// name the legacy table may never have heard of — and an app that
	// declared a 0s bake on a channel has nothing to waive there either.
	// An unreadable pipeline refuses rather than falling back to the legacy
	// table, which could offer a waiver on a channel the pipeline gives no
	// window at all.
	pipe, perr := release.GetPipeline(ctx, s.cfg.Releases, s.cfg.ReleasePub, acct.Sqid, app)
	if perr != nil {
		log.Printf("console: fast-track %s/%s: read pipeline: %v", acct.Sqid, app, perr)
		back("err", "Could not read the pipeline for "+app+". Nothing has been changed.")
		return
	}
	if holdWindow(pipe, channel) == 0 {
		back("err", "Channel "+channel+" has no safety delay running — there is nothing to skip.")
		return
	}
	// The head is read here rather than only when a pin is present, because a
	// proposal has to PIN the build it waives: what gets confirmed must be a
	// specific version, not "whatever this channel carries whenever somebody
	// gets round to it".
	cur, err := release.Channel(ctx, s.cfg.Releases, s.cfg.ReleasePub, acct.Sqid, app, channel)
	if err != nil {
		back("err", "Could not read channel "+channel+".")
		return
	}
	// The card pinned the version whose window it offered to waive; if the
	// channel has moved since, the waiver must not land on the newcomer.
	// Pin-present-only, like the rollback pin: a pinless POST waives the
	// current head, which is FastTrack's own contract.
	if pinned := strings.TrimSpace(r.FormValue("version")); pinned != "" && cur.Version != pinned {
		back("err", "Channel "+channel+" changed while you were confirming — review skipping the delay again.")
		return
	}
	// change_approvals covers overriding a channel's bake as well as editing
	// its entry (spec §2: "one field covers both changing and overriding").
	// The step-up above already ran, so this proposal counts its proposer.
	if rules := channelRules(pipe, channel); rules.ChangeApprovals >= 1 {
		kind, msg := s.proposeThenExecute(ctx, acct, app, kindFastTrack,
			fastTrackPayload{Channel: channel, Version: cur.Version}, rules.ChangeApprovals, addr)
		back(kind, msg)
		return
	}
	ver, err := release.FastTrack(ctx, s.cfg.Releases, s.cfg.Key, acct.Sqid, app, channel, addr)
	if err != nil {
		log.Printf("console: fast-track %s %s: %v", app, channel, err)
		back("err", "Skipping the delay failed: "+err.Error())
		return
	}
	s.audit(acct, app, addr, "fast-track", "skipped the safety delay for "+ver+" on "+channel)
	// A waiver re-signs the pointer to say "adopt this now" — the one write
	// whose entire point is that boxes act on it immediately.
	s.bumpSerial(ctx)
	back("ok", "Skipped the delay for "+ver+" on "+channel+" — it rolls out within a couple of minutes.")
}

// ---- canaries ---------------------------------------------------------------

// canaryNameRe pins canary names to the same boring slugs as app names — the
// name becomes a channel path segment and an on-box state file name.
var canaryNameRe = regexp.MustCompile(`^[a-z][a-z0-9-]{0,31}$`)

// channelHosts lists the registry hosts whose routes follow app's channel,
// and reports whether the registry could be read at all. The two call sites
// deliberately treat that error differently: handleNewCanary's use is
// cosmetic (which URL to show in a success flash) and downgrades an error to
// "no hosts", but handleRetireCanary's use is load-bearing — a canary with
// followers must never be deleted — so it must fail CLOSED on a registry
// hiccup rather than silently reading the error as "safe to retire".
func (s *Server) channelHosts(app, channel string) ([]string, error) {
	reg, err := openRegistry(s.cfg.Registry)
	if err != nil {
		return nil, err
	}
	routes, err := reg.List()
	if err != nil {
		return nil, err
	}
	var out []string
	for _, rt := range routes {
		if rt.App == app && rt.Channel == channel {
			out = append(out, rt.Host)
		}
	}
	return out, nil
}

// handleNewCanary creates a canary: a brand-new canary/<name> channel
// pointed at a chosen shipped version. Canary channels bypass bake by
// design, so the canary serves the moment a host follows its channel.
func (s *Server) handleNewCanary(w http.ResponseWriter, r *http.Request) {
	addr, raw, acct, _, app, ok := s.accountApp(w, r)
	if !ok {
		return
	}
	if subtle.ConstantTimeCompare([]byte(r.FormValue("csrf")), []byte(raw)) != 1 {
		s.renderMessage(w, r, http.StatusForbidden, "Refused", "Cross-site request blocked.")
		return
	}
	if s.cfg.Key == nil {
		s.renderMessage(w, r, http.StatusServiceUnavailable, "Promotions disabled",
			"No signing key on this host — the console is running read-only.")
		return
	}
	back := func(kind, msg string) {
		s.setFlash(w, kind, msg)
		dest := "/a/" + url.PathEscape(acct.Sqid) + "/apps/" + url.PathEscape(app)
		if tab := releaseBackTab(r); tab != "" {
			dest += "/" + tab
		}
		http.Redirect(w, r, dest, http.StatusSeeOther)
	}
	name := strings.ToLower(strings.TrimSpace(r.FormValue("name")))
	if !canaryNameRe.MatchString(name) {
		back("err", "Invalid canary name — lowercase letters, digits, and dashes, starting with a letter.")
		return
	}
	channel := "canary/" + name
	version := strings.TrimSpace(r.FormValue("version"))
	if !release.ValidVersion(version) {
		back("err", "Invalid version.")
		return
	}
	ctx, cancel := context.WithTimeout(r.Context(), 15*time.Second)
	defer cancel()
	if _, err := release.GetManifest(ctx, s.cfg.Releases, acct.Sqid, app, version); err != nil {
		back("err", "Version "+version+" is not a shipped release of "+app+".")
		return
	}
	// New means new: an existing canary is promoted to (releases table) or
	// retired, never quietly re-created.
	if _, _, err := s.cfg.Releases.Get(ctx, release.ChannelKey(acct.Sqid, app, channel)); err == nil {
		back("err", "Canary "+name+" already exists — promote to it from the releases table, or retire it first.")
		return
	} else if !errors.Is(err, os.ErrNotExist) {
		back("err", "Could not check the release store. Please try again.")
		return
	}
	// Plain Promote, deliberately, where handlePromote uses PromoteOnLadder:
	// the target is always canary/<name>, the one rung the ladder never
	// refuses in either direction, so enforcement here could only turn the
	// "new means new" refusal above into a less useful message. Nothing
	// reachable from this handler can name another rung.
	//
	// Creating a canary is still a promotion onto the canary rung — recorded
	// like any other, so "who put this build in front of users" has an answer
	// for the rung most likely to be wired to production.
	rec := release.Promotion{To: release.RungCanary, Actor: addr}
	if err := release.Promote(ctx, s.cfg.Releases, s.cfg.Key, acct.Sqid, app, channel, version, rec); err != nil {
		log.Printf("console: canary %s %s -> %s: %v", app, version, channel, err)
		back("err", "Creating the canary failed: "+err.Error())
		return
	}
	s.auditActivity(acct, app, addr, Activity{Action: "canary-create", TargetType: "channel", Target: "canary/" + name, Detail: "created canary " + name + " at " + version})
	// A channel pointer like any other: a route already following canary/<name>
	// (attach-then-create is a real order) adopts it on the announced pass.
	s.bumpSerial(ctx)
	// Best-effort here: which URL to show in the success flash is cosmetic,
	// so a registry hiccup just falls back to the generic "attach one" copy
	// rather than failing the create that already succeeded.
	if hosts, _ := s.channelHosts(app, channel); len(hosts) > 0 {
		back("ok", "Created canary "+name+" — live at https://"+hosts[0]+" serving "+version+" (test versions have no safety delay).")
		return
	}
	domain, absent := s.instanceDomainFor(ctx, acct.Sqid, app)
	create, enable := attachCommands(app, channel, domain, s.cfg.AppsDomain, acct.Sqid, absent)
	if enable != "" {
		create = enable + " && " + create
	}
	back("ok", "Created canary "+name+" — "+channel+" serves "+version+" the moment an address follows it, no safety delay. Attach one: "+create)
}

// instanceDomainFor answers "where do this app's instance hosts live?" — the
// app's instances-manifest domain when one exists, and whether its absence is
// PROVEN. Both doors that tell a reader how to give a channel a URL ask this,
// so both name the same command.
//
// The three-way answer is load-bearing: a manifest that merely could not be
// READ is not "instances are off". The enable door writes guarded
// (PutManifestIfMatch) and answers 409 over a standing manifest under another
// domain, so telling someone to run `carlos instances enable` on the strength
// of a transient bucket error sends them at a door that will refuse them.
// Unreadable therefore renders the neutral form, never the enable step.
func (s *Server) instanceDomainFor(ctx context.Context, sqid, app string) (domain string, absent bool) {
	m, err := provision.GetManifest(ctx, s.cfg.Releases, sqid, app)
	switch {
	case err == nil:
		return m.Domain, false
	case errors.Is(err, os.ErrNotExist):
		return "", true
	default:
		log.Printf("console: instances manifest %s/%s: %v", sqid, app, err)
		return "", false
	}
}

// attachCommands renders the "give this channel a URL" advice for one app:
// the create command, plus the enable command that has to precede it when
// instances are proven off ("" otherwise).
//
// It names `carlos instances create`, deliberately NOT `carlos add`. Both
// place a route, but `carlos add` opens THIS box's registry on local disk
// (cli.go's defaultRegistry) — it cannot be run from wherever a dashboard is
// being read, and an operator who followed that hint from a browser landed on
// a box-local verb that could not work for them (2026-08-07). The API-backed
// path is the one a login credential can drive: spec §12a, and the record it
// writes materializes as a route on the box's next provision pass, carrying
// this channel through (provision.Reconcile's mint).
func attachCommands(app, channel, domain, appsDomain, sqid string, absent bool) (create, enable string) {
	// An instance host is exactly one label under the manifest's domain
	// (provision.ValidHost), so the placeholder stands in for the label only.
	host := "<host>"
	switch {
	case domain != "":
		host = "<name>." + domain
	case absent && appsDomain != "":
		// Not enabled yet: the member-facing enable door pins the manifest to
		// the account's own platform subdomain (§12a), so that is where the
		// host will have to live once they run it.
		host = "<name>." + sqid + "." + appsDomain
	}
	create = "carlos instances create --app " + app + " --host " + host + " --channel " + channel
	if absent {
		enable = "carlos instances enable --app " + app
	}
	return create, enable
}

// handleRetireCanary removes a canary's channel pointer. Shipped releases
// are untouched — retirement un-points, it never deletes bits.
func (s *Server) handleRetireCanary(w http.ResponseWriter, r *http.Request) {
	addr, raw, acct, role, app, ok := s.accountApp(w, r)
	if !ok {
		return
	}
	if subtle.ConstantTimeCompare([]byte(r.FormValue("csrf")), []byte(raw)) != 1 {
		s.renderMessage(w, r, http.StatusForbidden, "Refused", "Cross-site request blocked.")
		return
	}
	if s.cfg.Key == nil {
		s.renderMessage(w, r, http.StatusServiceUnavailable, "Promotions disabled",
			"No signing key on this host — the console is running read-only.")
		return
	}
	back := func(kind, msg string) {
		s.setFlash(w, kind, msg)
		dest := "/a/" + url.PathEscape(acct.Sqid) + "/apps/" + url.PathEscape(app)
		if tab := releaseBackTab(r); tab != "" {
			dest += "/" + tab
		}
		http.Redirect(w, r, dest, http.StatusSeeOther)
	}
	name := strings.ToLower(strings.TrimSpace(r.FormValue("name")))
	if !canaryNameRe.MatchString(name) {
		back("err", "Invalid canary name.")
		return
	}
	channel := "canary/" + name
	// A canary with followers is load-bearing: retiring its pointer would
	// strand every host on it. Fail CLOSED on a registry error — an "I
	// couldn't check" must never be read as "nobody follows this channel".
	hosts, err := s.channelHosts(app, channel)
	if err != nil {
		log.Printf("console: retire %s %s: check followers: %v", app, channel, err)
		s.renderMessage(w, r, http.StatusInternalServerError, "Error",
			"Could not verify no hosts follow this channel — try again.")
		return
	}
	if len(hosts) > 0 {
		back("err", "Canary "+name+" still has a host ("+hosts[0]+") following it — remove or repoint that route first.")
		return
	}
	ctx, cancel := context.WithTimeout(r.Context(), 15*time.Second)
	defer cancel()
	key := release.ChannelKey(acct.Sqid, app, channel)
	if _, _, err := s.cfg.Releases.Get(ctx, key); errors.Is(err, os.ErrNotExist) {
		back("err", "No canary named "+name+" here.")
		return
	} else if err != nil {
		back("err", "Could not read the release store. Please try again.")
		return
	}
	if !confirmed(r) {
		s.confirmRetireCanary(w, r, addr, raw, acct, role, app, name)
		return
	}
	if err := s.appMutation(ctx, acct, app, "canary-retire", func(ctx context.Context) error {
		return s.cfg.Releases.Delete(ctx, key)
	}); err != nil {
		log.Printf("console: retire %s %s: %v", app, channel, err)
		back("err", "Retiring the canary failed: "+err.Error())
		return
	}
	s.auditActivity(acct, app, addr, Activity{Action: "canary-retire", TargetType: "channel", Target: "canary/" + name, Detail: "retired canary " + name})
	back("ok", "Retired canary "+name+" — its channel pointer is gone; shipped releases are untouched.")
}

// promoteChannelOptions is the per-row promote select's option list.
//
// For a pipelined app (pipe != nil), it's the pipeline's own declared
// channels, IN PIPELINE ORDER — the app's promotion order comes from the
// pipeline now (spec §5), not the frozen rungs, and offering a rung name a
// pipelined app never declared would let a member promote somewhere the
// pipeline itself refuses. Any existing channel outside the pipeline
// (canary/*, a -hotfix target) is still offered after them, in existing
// order, for the same reason the legacy path offers canary/*: it is a real,
// already-published channel, whatever governs promoting onto it.
//
// For a legacy app (pipe == nil), it's the ladder rungs first (so a fresh
// app with zero channels — nothing in existing — still has somewhere to
// promote its first release), then any of the app's existing channels not
// already a rung (canary/* and the like), in their existing order. Ladder
// rungs are included whether or not the app has them yet — promoting onto a
// rung that doesn't exist is exactly how it comes to exist.
func promoteChannelOptions(existing []ChannelView, pipe *release.Pipeline) []string {
	var first []string
	if pipe != nil {
		first = make([]string, len(pipe.Channels))
		for i, c := range pipe.Channels {
			first[i] = c.Name
		}
	} else {
		first = []string{release.RungEdge, release.RungBeta, release.RungStable}
	}
	seen := make(map[string]bool, len(first))
	options := make([]string, 0, len(first)+len(existing))
	for _, name := range first {
		options = append(options, name)
		seen[name] = true
	}
	for _, ch := range existing {
		if seen[ch.Name] {
			continue
		}
		seen[ch.Name] = true
		options = append(options, ch.Name)
	}
	return options
}

// summarize folds one AppView into its "your apps" table row. Routes can
// legitimately belong to another account (RouteView.Account's doc comment)
// so both the apex-host pick and the failed-route scan are filtered to the
// viewing account first — otherwise a foreign route can pick this app's URL
// or trip its "needs attention" verdict.
func summarize(v AppView, acct string) appRow {
	var mine []RouteView
	for _, rt := range v.Routes {
		if rt.Account == acct {
			mine = append(mine, rt)
		}
	}
	deployment := observedDeployment(v.Routes, acct)
	row := appRow{App: v.App, URL: apexHost(mine), Deployment: deployment}
	attention := false
	for _, rt := range mine {
		if !rt.Platform && rt.Status == "failed" {
			attention = true
		}
	}
	for _, ch := range v.Channels {
		if ch.Err == "" && strings.HasPrefix(ch.Name, "canary/") {
			row.CanaryN++
		}
	}
	switch {
	case !deployment.HasRoutes():
		row.Verdict, row.VerdictLabel = "notdeployed", "Not deployed yet"
	case attention:
		row.Verdict, row.VerdictLabel = "attention", "Needs attention"
	case deployment.ReportableCount == 0:
		row.Verdict, row.VerdictLabel = "ok", "Deployed"
	case !deployment.HasReportedVersion():
		row.Verdict, row.VerdictLabel = "unknown", "Can't tell right now"
	case deployment.UnknownCount > 0:
		row.Verdict, row.VerdictLabel = "unknown", "Can't tell right now"
	default:
		row.Verdict, row.VerdictLabel = "ok", "Deployed"
	}
	return row
}