holger-ui 0.1.4

//! egui presentation for the holger UI, built from [facett] components.
//!
//! One [`UiData`] drives everything; each tab issues at most one blocking core
//! call per click (the nornir-viz idiom). The repo list is rendered with a
//! `facett::table::Table` facet; the rest is plain themed egui. Selection +
//! every visible value live in [`UiData`]'s views, which expose `state_json()`
//! — so the same screen can be asserted headlessly.

use eframe::egui;
use egui::{RichText, Ui};
use facett::effects::IceDrip; // Skade-Vinter ice-drip winter decor (icicles + melt-droplets + frost)
use facett::graph3d::{DecorPolicy, Graph3D, Layout3D, RabbitLogo3D};
use facett::look::Theme as LookTheme; // the unified facett look & feel (one preset/frame)
use facett::menu::{menu_bar, CommandPalette}; // the facett overlay menu system — Ctrl-K palette + menu bar
use facett::table::Table;
use facett::Facet;
use facett_helix::{EventKind, HelixView, Kind, PlanDag, Status}; // the TIME-HELIX DAG view
use serde_json::{json, Value};
use std::collections::{HashMap, VecDeque};
use traits::ArtifactId;

use crate::data::{LineageEvent, LineageNode, NodeKind, UiData};

/// Command palette + menu dispatch (build_commands / dispatch_command / run_command /
/// apply_repo_row_nav + the id→enum maps) — a child module so it can reach
/// `HolgerUiApp`'s private state while keeping `app` focused on rendering.
mod command;

/// The dependency-graph view types (GraphNodeKind palette, repo→kind classifier,
/// the Móðguðr verdict-graph renderer) — a child module; the `Graph3D`-building
/// methods (`build_graph` / `graph_tab`) stay here and use these.
mod graph;
use graph::{render_security_graph, repo_node_kind, GraphNodeKind};

/// The holger-ui version, shown on the startup splash + in `state_json` (so the
/// robot can assert a version string is presented). Sourced from the crate's
/// `Cargo.toml` at compile time.
pub const HOLGER_UI_VERSION: &str = env!("CARGO_PKG_VERSION");

/// **Introspection / emit marker** — record one functional-status row for the
/// nornir test matrix. Wraps `nornir_testmatrix::functional_status` behind the
/// `testmatrix` feature (a compiled-out `#[inline]` no-op otherwise, with no
/// nornir dep in a release build). Each Tools pane's run button emits one so
/// `nornir test --features testmatrix` SEES each operator surface fire. Mirrors
/// the reference emitter in `korp-collectors/src/lib.rs`.
#[inline]
pub(crate) fn functional_status(component: &str, check: &str, ok: bool, detail: &str) {
    #[cfg(feature = "testmatrix")]
    nornir_testmatrix::functional_status(component, check, ok, detail);
    #[cfg(not(feature = "testmatrix"))]
    {
        let _ = (component, check, ok, detail);
    }
}

/// The recovered holger+znippy splash logo (low-poly steel Norse warrior resting
/// on a sword + a round shield bearing the znippy lightning-rabbit). Embedded at
/// compile time via `include_bytes!` so it ships INSIDE the binary — no runtime
/// file dependency (this is an airgap product). Decoded once on the first splash
/// frame into an egui texture (see [`HolgerUiApp::splash_logo_texture`]).
const HOLGER_LOGO_PNG: &[u8] = include_bytes!("../assets/holger-znippy-logo.png");

/// holger-ui's look roster. facett ships OS-specific presets (Windows + macOS,
/// each light+dark) but they are visually interchangeable here, so holger
/// collapses them to just **dark** and **light**, plus facett's non-OS `device`
/// look. Each entry is `(switcher label, facett Theme constructor)`; the index
/// into this slice is the persisted `look_preset`.
pub const LOOKS: &[(&str, fn() -> LookTheme)] = &[
    ("dark", LookTheme::windows_dark),
    ("light", LookTheme::windows_light),
    ("device", LookTheme::device),
];

/// The switcher roster as plain labels (`dark`, `light`, `device`).
pub fn look_names() -> Vec<String> {
    LOOKS.iter().map(|(n, _)| n.to_string()).collect()
}

/// The default look for holger-ui: `dark`. facett's `from_os` resolves every OS
/// to its dark variant, so the collapsed roster's first-launch default is dark.
/// Pure → unit-testable with no window.
pub fn default_look_preset() -> usize {
    LOOKS.iter().position(|(n, _)| *n == "dark").unwrap_or(0)
}

#[derive(Clone, Copy, PartialEq, Eq, Debug)]
pub(crate) enum Tab {
    Status,
    Repos,
    Browse,
    Archive,
    Artifact,
    Graph,
    Helix,
    Lineage,
    Tools,
    Upload,
}

/// How the Lineage tab renders the live cache-fill graph: the rotating spatial
/// FILL (facett-graph3d) or its temporal companion (facett-helix).
#[derive(Clone, Copy, PartialEq, Eq, Debug)]
pub(crate) enum LineageMode {
    /// The primary rotating 3D fill — nodes pop in and the graph grows as the
    /// cache fills (facett-graph3d).
    Graph3d,
    /// The time companion — each arrival wound onto a per-ecosystem coil
    /// (facett-helix).
    Helix,
}

/// The four Tools-menu functions (a mirror of the holger CLI tools).
#[derive(Clone, Copy, PartialEq, Eq, Debug)]
pub(crate) enum ToolsFn {
    HolgerDs,
    Migrate,
    Security,
    Deploy,
    Airgap,
    /// Tool #6 — the shared-framework **demo appliance**: start a demo registry
    /// container THROUGH the shared job manager `jera` (a durable `BOOT_CONTAINER`
    /// job), mirroring korp's Tools-menu container demos. Read-path-safe to declare +
    /// dispatch; the LIVE boot needs the `containers` feature.
    Demo,
}

/// The holger UI application: a [`UiData`] handle + the tab's input fields.
pub struct HolgerUiApp {
    data: UiData,
    tab: Tab,
    repo: String,
    namespace: String,
    name: String,
    version: String,
    upload_path: String,
    notice: Option<String>,
    /// Demo: static **Skade Vinter** showcase mode (the icy winter scene — replaces
    /// the old red "silent running" theme). Read-only; the whole UI re-themes to
    /// `Theme::skade_vinter()` and the ice-drip decor overlays. Manual toggle until
    /// the server reports its profile over the gRPC Admin service.
    static_mode: bool,
    /// The Skade-Vinter ice-drip decor (icicles + falling melt-droplets + frost
    /// shimmer) overlaid while in static mode. Time-driven; off otherwise.
    ice: IceDrip,
    /// Splash start time (egui seconds); shows the rabbit logo briefly then
    /// auto-dismisses. Paired with `splash_done`.
    splash_since: Option<f64>,
    splash_done: bool,
    /// The spinning znippy rabbit shown on the startup splash (a small animated
    /// accent beneath the recovered hero logo).
    logo: RabbitLogo3D,
    /// The decoded recovered holger+znippy hero logo, lazily loaded as an egui
    /// texture on the first splash frame from the compiled-in [`HOLGER_LOGO_PNG`]
    /// (decode-once, then cached for the rest of the splash). `None` until decoded.
    logo_texture: Option<egui::TextureHandle>,
    /// Selected Tools function.
    tool: ToolsFn,
    /// Móðguðr (Tools#3) view mode: `false` = the verdict table, `true` = the
    /// dependency-graph view (nodes coloured by verdict).
    security_graph: bool,
    /// The 3D repo graph (rebuilt when the underlying data signature changes).
    graph: Option<Graph3D>,
    /// Node-kind labels parallel to the graph's nodes — the HOLGER NEON PALETTE
    /// mapping, surfaced in `state_json` so the robot asserts the graph as DATA.
    graph_kinds: Vec<&'static str>,
    /// Signature of the data the graph was built from — `(repo_count, selected
    /// repo, artifact-file count)`. The graph rebuilds when this changes (a new
    /// selection lights a different subgraph; a loaded archive adds artifact nodes).
    graph_sig: (usize, Option<usize>, usize),
    /// The TIME-HELIX DAG view (facett-helix) shown on the Helix tab — a plan/dep
    /// DAG wound along a synthesized time axis. Rebuilt when [`Self::helix_sig`]
    /// changes; `HelixView::demo()` when there is no real dep-graph data (or in the
    /// hands-free demo tour) so the tab is never blank.
    helix: Option<HelixView>,
    /// Signature of the data the helix was built from — `(demo?, dep-graph
    /// repository, node count, edge count)`. The helix rebuilds when this changes
    /// (e.g. a Móðguðr scan populates a new repo's dependency graph).
    helix_sig: (bool, String, usize, usize),
    /// Lineage tab render mode — the rotating 3D fill or the time-helix companion.
    lineage_mode: LineageMode,
    /// The rotating 3D cache-fill graph (facett-graph3d), rebuilt as the lineage
    /// view grows (`lineage_sig` changes); `None` until first built.
    lineage_graph: Option<Graph3D>,
    /// The time-helix companion (facett-helix) for the lineage view; `None` until built.
    lineage_helix: Option<HelixView>,
    /// Signature of the lineage data the widgets were built from — `(node, edge,
    /// event count)`. When it changes (an arrival landed) the widgets rebuild so the
    /// new node pops in; the injected clock keeps rotation/traverse continuous.
    lineage_sig: (usize, usize, usize),
    /// The LIVE feed sender the Lineage tab drips demo arrivals through (the same
    /// `mpsc` seam a real [`ChannelAuditLog`](crate::data::ChannelAuditLog) tee
    /// uses); `self.data.lineage` holds the paired receiver.
    lineage_tx: std::sync::mpsc::Sender<LineageEvent>,
    /// Remaining demo arrivals to drip one-per-frame so the graph visibly fills and
    /// rotates when no real audit feed is wired.
    lineage_demo: VecDeque<LineageEvent>,
    /// When set, drip one demo arrival per frame while the Lineage tab is open.
    lineage_autofill: bool,
    /// Active look — an index into [`LOOKS`] (`dark` / `light` / `device`). The app applies
    /// this preset every frame; `apply` installs the full egui Style AND publishes
    /// the derived legacy palette so the facett Table facets re-theme coherently
    /// (COH-1). Replaces the old `facett::Theme::sci_fi()` call.
    look_preset: usize,
    /// The session's mTLS client identity (the cert+key the UI connected with).
    /// Tool #5 Airgap feeds these into the populate args when `auth=mtls`, so a
    /// real push reuses the operator's connect-time identity instead of failing
    /// with "--auth mtls needs --client-cert and --client-key".
    session_client_cert: Option<std::path::PathBuf>,
    session_client_key: Option<std::path::PathBuf>,
    /// 🎬 **Demo mode** (hands-free guided tour). `Some` when launched with
    /// `holger-ui --demo`: each frame the app applies the next due
    /// [`DemoStep`](crate::demo::DemoStep), driving the same `pub` hooks a human
    /// click runs (tab/tool switch, repo + graph-node selection, look re-theme),
    /// with the egui frame clock so the animations between beats render.
    demo: Option<DemoRun>,
    /// The facett **command palette** (Ctrl-K / Ctrl-Shift-P): a fuzzy launcher over
    /// every tab, tool, and *repository* (owned-String command ids let the per-repo
    /// commands be built at runtime). Pure data between frames; drawn last so it
    /// overlays everything. Its `invoked` id is dispatched by [`dispatch_command`].
    palette: CommandPalette,
    /// **About** popup open flag (shared common-framework identity surface). Toggled
    /// by the `Help · About holger` menu / palette command; the modal renders holger's
    /// logo + wordmark + version + the shared framework it is built on.
    about_open: bool,
    /// The About popup's holger logo, decoded once from the compiled-in PNG on first
    /// open (`crate::about::logo_texture`); `None` if never opened OR the embedded
    /// bytes don't decode (an un-pulled LFS blob — the popup then shows text identity).
    about_logo: Option<egui::TextureHandle>,
    /// Whether the one-shot About logo decode has been attempted (so a failed decode
    /// isn't retried every frame).
    about_logo_tried: bool,
}

/// Live wrapper around a [`DemoWalk`](crate::demo::DemoWalk): the script plus the
/// egui-time origin it measures `elapsed_ms` from. FC-7: the walk is time-injected;
/// this only records the frame-time origin and rebases it each loop.
struct DemoRun {
    walk: crate::demo::DemoWalk,
    /// egui `input.time` (seconds) captured on the first demo frame; `None` until.
    origin: Option<f64>,
}

impl HolgerUiApp {
    /// Build the app over a connected data layer and prime the first views.
    pub fn new(mut data: UiData) -> Self {
        data.refresh_status();
        // Server truth for the static "silent running" mode: a server that
        // accepts no writes drives the UI read-only by default (the checkbox
        // below stays a manual override the operator can flip either way).
        data.refresh_profile();
        data.refresh_repos();
        // The runnable demo default for Tool #5 is a dry-run plan: it validates
        // with no creds and shows the plan immediately (the operator unticks
        // dry-run to actually push).
        data.airgap.dry_run = true;
        let static_mode = data.profile.read_only;
        let repo = data
            .repos
            .selected_repo()
            .map(|r| r.name.clone())
            .unwrap_or_default();
        // Wire the live lineage feed: connect the view-model to the receiver and keep
        // the sender for the Lineage tab's demo drip. A real deployment installs a
        // `ChannelAuditLog` tee on the server's `Arc<dyn AuditLog>` with the same
        // channel, so every fetch/put streams straight into `data.lineage`.
        let (lineage_tx, lineage_rx) = crate::data::channel();
        data.lineage.connect(lineage_rx);
        Self {
            data,
            tab: Tab::Status,
            repo,
            namespace: String::new(),
            name: String::new(),
            version: String::new(),
            upload_path: String::new(),
            notice: None,
            static_mode,
            ice: IceDrip::new(16, 0x5CADE_u64).enabled(true).with_period(2.8),
            splash_since: None,
            splash_done: false,
            logo: RabbitLogo3D::new("holger"),
            logo_texture: None,
            tool: ToolsFn::HolgerDs,
            security_graph: false,
            graph: None,
            graph_kinds: Vec::new(),
            graph_sig: (usize::MAX, None, usize::MAX),
            helix: None,
            helix_sig: (false, String::new(), usize::MAX, usize::MAX),
            lineage_mode: LineageMode::Graph3d,
            lineage_graph: None,
            lineage_helix: None,
            lineage_sig: (usize::MAX, usize::MAX, usize::MAX),
            lineage_tx,
            lineage_demo: crate::data::demo_events().into_iter().collect(),
            lineage_autofill: true,
            look_preset: default_look_preset(),
            session_client_cert: None,
            session_client_key: None,
            demo: None,
            palette: CommandPalette::default(),
            about_open: false,
            about_logo: None,
            about_logo_tried: false,
        }
    }

    /// 🎬 Arm **demo mode**: install the hands-free guided-tour walk and skip the
    /// splash so the tour starts immediately. `beat_ms` is the pause between beats.
    /// The live render loop then applies one due beat per frame off the egui clock.
    pub fn enable_demo(&mut self, beat_ms: u64) {
        self.skip_splash();
        self.demo = Some(DemoRun { walk: crate::demo::DemoWalk::tour(beat_ms), origin: None });
    }

    /// 🎬 The headless-test hook: apply every beat due at `elapsed_ms` against the
    /// real app hooks (deterministic, no egui clock). Returns the labels applied.
    /// The live [`demo_tick`](Self::demo_tick) is the same logic fed by frame time.
    pub fn demo_drive_to(&mut self, elapsed_ms: u64) -> Vec<String> {
        let mut applied = Vec::new();
        // Pull due beats one at a time so each `apply` runs in cursor order.
        loop {
            let step = match self.demo.as_mut() {
                Some(run) => run.walk.due(elapsed_ms),
                None => None,
            };
            match step {
                Some(s) => {
                    self.apply_demo_action(s.action);
                    applied.push(s.label);
                }
                None => break,
            }
        }
        applied
    }

    /// `true` when demo mode is armed (for the live repaint loop).
    pub fn demo_active(&self) -> bool {
        self.demo.is_some()
    }

    /// 🎬 Per-frame live drive: emit any beat due at the current egui frame time,
    /// looping forever (rebasing the clock each pass) so a left-running demo window
    /// stays alive. Applies the beat through the real `pub` hooks, then requests a
    /// repaint so the motion between beats keeps animating.
    fn demo_tick(&mut self, ctx: &egui::Context, now: f64) {
        let elapsed_ms = {
            let Some(run) = self.demo.as_mut() else { return };
            if run.walk.is_done() {
                run.walk.rewind();
                run.origin = Some(now);
            }
            let origin = *run.origin.get_or_insert(now);
            ((now - origin).max(0.0) * 1000.0) as u64
        };
        let applied = self.demo_drive_to(elapsed_ms);
        if !applied.is_empty() {
            self.notice = applied.last().map(|l| format!("🎬 demo: {l}"));
        }
        // Keep painting so the next beat lands and the animations in between render.
        ctx.request_repaint_after(std::time::Duration::from_millis(120));
    }

    /// Apply one [`DemoAction`](crate::demo::DemoAction) through the exact `pub`
    /// hook a human click would run.
    fn apply_demo_action(&mut self, action: crate::demo::DemoAction) {
        use crate::demo::DemoAction::*;
        match action {
            Goto(t) => self.tab = t,
            SelectRepo(i) => self.select_repo(i),
            SelectGraphNode(i) => self.select_graph_node(i),
            SelectTool(tf) => {
                self.tab = Tab::Tools;
                self.tool = tf;
            }
            SecurityGraph(on) => {
                self.tab = Tab::Tools;
                self.tool = ToolsFn::Security;
                self.security_graph = on;
            }
            Look(i) => {
                self.set_look_preset(i);
            }
        }
    }

    /// Record the session's mTLS client identity (the `--cert`/`--key` the UI
    /// connected with), so Tool #5 Airgap can reuse it for an `auth=mtls` push.
    pub fn set_session_client_identity(
        &mut self,
        cert: Option<std::path::PathBuf>,
        key: Option<std::path::PathBuf>,
    ) {
        self.session_client_cert = cert;
        self.session_client_key = key;
    }

    /// Toggle the Tool #5 Airgap dry-run flag (test/automation hook for driving
    /// the validate() happy/red path without the egui checkbox).
    pub fn airgap_set_dry_run(&mut self, dry_run: bool) {
        self.data.airgap.dry_run = dry_run;
    }

    /// Set the Artifact-tab query fields (test hook: the tab's text edits live in
    /// an egui Grid and aren't individually label-addressable for TypeInto, so a
    /// deterministic setter drives the same state the operator would type).
    pub fn set_artifact_query(&mut self, repository: &str, name: &str, version: &str) {
        self.repo = repository.to_string();
        self.name = name.to_string();
        self.version = version.to_string();
    }

    /// Select repository row `i` — the exact path the Repos-tab row click runs.
    /// A test hook because the repo name is rendered BOTH as the selectable row
    /// and in the facett capability Table, so a label-addressed click is
    /// ambiguous; this drives the same selection deterministically.
    pub fn select_repo(&mut self, i: usize) {
        self.data.select_repo(i);
        if let Some(r) = self.data.repos.repos.get(i) {
            self.repo = r.name.clone();
        }
    }


    // ── look & feel (unified `facett::look::Theme`) ─────────────────────────────

    /// The active look's [`LookTheme`].
    pub fn look_theme(&self) -> LookTheme {
        LOOKS[self.look_preset.min(LOOKS.len() - 1)].1()
    }

    /// The active look's holger label (`dark` / `light` / `device`) — what the
    /// switcher shows and `state_json` reports, not facett's internal theme name.
    pub fn look_name(&self) -> &'static str {
        LOOKS[self.look_preset.min(LOOKS.len() - 1)].0
    }

    /// Switch the active look (clamped); returns the new look's label.
    pub fn set_look_preset(&mut self, idx: usize) -> String {
        self.look_preset = idx.min(LOOKS.len() - 1);
        self.look_name().to_string()
    }

    /// Apply the active preset to `ctx` — installs the full egui Style and
    /// publishes the derived legacy palette so the facett Table facets follow
    /// (COH-1). Re-applying takes effect next frame, no restart.
    pub fn apply_look(&self, ctx: &egui::Context) {
        self.look_theme().apply(ctx);
    }

    /// The look state the operator sees, as observable JSON for headless robot
    /// tests: the active preset name, the full preset roster, and the resolved
    /// legacy palette (the colours every facett view actually paints with). This
    /// is what proves "the active preset + a coherent palette" without a screen.
    pub fn look_state_json(&self) -> Value {
        let theme = self.look_theme();
        let pal = theme.to_legacy_palette();
        let hex = |c: egui::Color32| format!("#{:02x}{:02x}{:02x}", c.r(), c.g(), c.b());
        json!({
            "preset": self.look_name(),
            "preset_index": self.look_preset,
            "presets": look_names(),
            "dark": theme.is_dark(),
            "palette": {
                "bg": hex(pal.bg),
                "text": hex(pal.text),
                "text_dim": hex(pal.text_dim),
                "accent": hex(pal.accent),
                "panel_bg": hex(pal.panel_bg),
                "node_fill": hex(pal.node_fill),
            },
        })
    }

    /// The whole app's observable state — what a robot driver asserts on
    /// ("see what the user sees as data", the nornir `Observable::state_json`
    /// contract). Active tab, static mode, selected tool, splash/graph state,
    /// the repo count behind the views, and the active look.
    pub fn state_json(&self) -> Value {
        let tab = match self.tab {
            Tab::Status => "status",
            Tab::Repos => "repos",
            Tab::Browse => "browse",
            Tab::Archive => "archive",
            Tab::Artifact => "artifact",
            Tab::Graph => "graph",
            Tab::Helix => "helix",
            Tab::Lineage => "lineage",
            Tab::Tools => "tools",
            Tab::Upload => "upload",
        };
        let tool = match self.tool {
            ToolsFn::HolgerDs => "holger-ds",
            ToolsFn::Migrate => "migrate",
            ToolsFn::Security => "security",
            ToolsFn::Deploy => "deploy",
            ToolsFn::Airgap => "airgap",
            ToolsFn::Demo => "demo",
        };
        json!({
            "tab": tab,
            "static_mode": self.static_mode,
            "write_enabled": !self.static_mode,
            "tool": tool,
            "splash_done": self.splash_done,
            // The version presented on the splash (under the wordmark) — asserted
            // by the robot so "the splash shows a version string" is checked.
            "version": HOLGER_UI_VERSION,
            "repo_count": self.data.repos.repos.len(),
            "graph_built": self.graph.is_some(),
            "graph": self.graph_state_json(),
            // The command palette as data: open flag, query, the full command id set,
            // current fuzzy hits, and the last-invoked id — so a robot asserts the
            // Ctrl-K launcher (and per-repo commands) without a screen.
            "palette": self.palette.state_json(&self.build_commands()),
            // The data-layer views behind each tab, so the robot can assert what
            // the user sees on Status/Repos/Browse/Archive/Artifact as DATA.
            "status": self.data.status.state_json(),
            // Server-reported operating profile (server truth for static mode).
            "profile": self.data.profile.state_json(),
            "repos": self.data.repos.state_json(),
            "browse": self.data.browse.state_json(),
            "archive": self.data.archive.state_json(),
            "artifact": self.data.artifact.state_json(),
            // The Upload tab is chrome (writable gate + notice), not a data-layer
            // view, so its observable state is assembled here.
            "upload": {
                "writable": self.data.repos.upload_enabled(),
                "notice": self.notice,
            },
            // Operator Tools panes (the data-layer views) so the robot asserts
            // them: Tool #1 holger-ds config + run result, Tool #3 security
            // verdict, Tool #5 airgap populate plan + run.
            "holger_ds": self.data.holger_ds.state_json(),
            "security": self.data.security.state_json(),
            "dep_graph": self.data.dep_graph.state_json(),
            "airgap": self.data.airgap_state_json(),
            "migrate": self.data.migrate.state_json(),
            // Tool #4 Deploy (Skíðblaðnir) — config + last deploy result.
            "deploy": self.data.deploy.state_json(),
            // The live artifact-lineage (proxy-cache-fill) graph as DATA — nodes/
            // edges/time-events — plus which render mode the Lineage tab is showing.
            "lineage": self.data.lineage.state_json(),
            "lineage_mode": match self.lineage_mode {
                LineageMode::Graph3d => "graph3d",
                LineageMode::Helix => "helix",
            },
            // The effective look: the icy Skade-Vinter showcase while static, else
            // the operator's selected preset.
            "look": if self.static_mode { "skade_vinter".to_string() } else { self.look_name().to_string() },
            // The About identity surface (shared common-framework parity): open flag +
            // holger's identity (wordmark/version/logo) + the shared framework it is
            // built on — asserted by the robot without pixels.
            "about": crate::about::state_json(self.about_open),
            // Tool #6 Demo appliance — the last jera-dispatched demo-container result
            // (job id + spec + status), or null until the operator runs it. Proof the
            // Tools demo goes THROUGH the shared job manager, not a bespoke spawn.
            "demo_appliance": self.data.demo_appliance.as_ref().map(|d| d.state_json()),
        })
    }

    /// Toggle the **About** popup (test/automation hook + the `Help · About` command
    /// path). Returns the new open state.
    pub fn toggle_about(&mut self) -> bool {
        self.about_open = !self.about_open;
        self.about_open
    }

    /// Dispatch the **Tool #6 demo appliance** — the same hook the pane's "Start demo
    /// appliance…" button runs: records the demo container bring-up as a jera job (and
    /// boots it live under the `containers` feature). Test/automation hook so a robot
    /// drives the exact dispatch a click would, then asserts the observable job id.
    pub fn run_demo_tool(&mut self) {
        self.tab = Tab::Tools;
        self.tool = ToolsFn::Demo;
        self.data.run_demo();
    }

    fn status_tab(&mut self, ui: &mut Ui) {
        if ui.button("⟳ refresh").clicked() {
            self.data.refresh_status();
        }
        ui.separator();
        let s = &self.data.status;
        if let Some(err) = &s.error {
            ui.colored_label(egui::Color32::RED, format!("error: {err}"));
        }
        egui::Grid::new("status_grid").striped(true).show(ui, |ui| {
            ui.label("status");
            ui.label(if s.status.is_empty() { "—" } else { &s.status });
            ui.end_row();
            ui.label("version");
            ui.label(if s.version.is_empty() { "—" } else { &s.version });
            ui.end_row();
            ui.label("uptime (s)");
            ui.label(s.uptime_seconds.to_string());
            ui.end_row();
        });
    }

    fn repos_tab(&mut self, ui: &mut Ui) {
        if ui.button("⟳ refresh").clicked() {
            self.data.refresh_repos();
        }
        ui.separator();
        if let Some(err) = &self.data.repos.error {
            ui.colored_label(egui::Color32::RED, format!("error: {err}"));
        }

        // Selection row (collect first so we don't hold a borrow across the click).
        let entries: Vec<(usize, String)> = self
            .data
            .repos
            .repos
            .iter()
            .enumerate()
            .map(|(i, r)| (i, r.name.clone()))
            .collect();
        let selected = self.data.repos.selected;
        // A scrolling dropdown of ALL repositories — one compact control that scales
        // past a wrapped row when a server carries many repos (egui's ComboBox popup
        // scroll-bounds the list). Quick per-repo actions sit NEXT to it as buttons:
        // attaching a context menu to the combo response fought egui's popup layer and
        // suppressed the dropdown, so the actions are plain buttons instead.
        let current = selected
            .and_then(|i| entries.get(i))
            .map(|(_, n)| n.clone())
            .unwrap_or_else(|| "(select a repository)".to_string());
        let mut pick = None;
        let mut row_action: Option<&str> = None;
        ui.horizontal(|ui| {
            ui.label(format!("repository ({}):", entries.len()));
            egui::ComboBox::from_id_salt("repos-dropdown")
                .selected_text(current)
                .show_ui(ui, |ui| {
                    for (i, name) in &entries {
                        if ui.selectable_label(selected == Some(*i), name).clicked() {
                            pick = Some(*i);
                        }
                    }
                });
            ui.add_enabled_ui(selected.is_some(), |ui| {
                if ui.button("Browse").clicked() {
                    row_action = Some("row:browse");
                }
                if ui.button("Scan").clicked() {
                    row_action = Some("row:scan");
                }
                if ui.button("Archive").clicked() {
                    row_action = Some("row:archive");
                }
                if ui.button("Copy").clicked() {
                    row_action = Some("row:copy");
                }
            });
        });
        if let Some(i) = pick {
            self.data.select_repo(i);
            self.repo = entries[i].1.clone();
        }
        // The quick-action buttons run on the currently selected repo: Browse / Scan /
        // Archive open the matching tab; Copy puts the name on the clipboard.
        if let Some(action) = row_action {
            if let Some(i) = self.data.repos.selected {
                if action == "row:copy" {
                    ui.ctx().copy_text(entries[i].1.clone());
                } else {
                    self.apply_repo_row_nav(i, action);
                }
            }
        }

        ui.separator();
        // facett Table facet for the repo×capability grid.
        let mut table = Table::new(
            "repositories",
            vec![
                "name".into(),
                "type".into(),
                "writable".into(),
                "archive".into(),
            ],
        );
        for r in &self.data.repos.repos {
            table.push_row(vec![
                r.name.clone(),
                r.repo_type.clone(),
                r.writable.to_string(),
                r.has_archive.to_string(),
            ]);
        }
        if let Some(sel) = self.data.repos.selected {
            table.select_row(sel);
        }
        table.ui(ui);
    }

    fn browse_tab(&mut self, ui: &mut Ui) {
        // Snapshot the selected repo name to a local String before mutating
        // `self.data` (the refresh borrows it mutably).
        let target = self
            .data
            .repos
            .selected_repo()
            .map(|r| r.name.clone());
        // Auto-load on first view / when the selected repo changes — the pane used
        // to require a manual ⟳ refresh, so it looked empty until clicked. The guard
        // (browse.repository != selected) converges: refresh_browse stamps the repo,
        // so it fires once per selection, not every frame.
        if let Some(repo) = &target {
            if self.data.browse.repository != *repo {
                self.data.refresh_browse(repo, None);
            }
        }
        ui.label(format!(
            "browsing repo: {}",
            target.clone().unwrap_or_else(|| "(none selected)".into())
        ));
        let do_refresh = ui
            .add_enabled(target.is_some(), egui::Button::new("⟳ refresh"))
            .clicked();
        if do_refresh {
            if let Some(repo) = target {
                self.data.refresh_browse(&repo, None);
            }
        }
        ui.separator();
        if let Some(err) = &self.data.browse.error {
            ui.colored_label(egui::Color32::RED, format!("error: {err}"));
        }

        // facett Table facet for the artifact listing.
        let mut table = Table::new(
            "browse",
            vec![
                "name".into(),
                "version".into(),
                "size".into(),
                "type".into(),
            ],
        );
        for e in &self.data.browse.entries {
            table.push_row(vec![
                e.name.clone(),
                e.version.clone(),
                e.size_bytes.to_string(),
                e.content_type.clone(),
            ]);
        }
        table.ui(ui);

        // Pagination footer: count + a load-more button when the listing has a
        // continuation token.
        ui.separator();
        let loaded = self.data.browse.entries.len();
        let has_more = !self.data.browse.next_page_token.is_empty();
        ui.horizontal(|ui| {
            ui.label(format!(
                "{loaded} shown{}",
                if has_more { " (more available)" } else { "" }
            ));
            if has_more && ui.button("load more").clicked() {
                self.data.load_more_browse();
            }
        });
    }

    fn archive_tab(&mut self, ui: &mut Ui) {
        // Snapshot the selected repo name to a local String before mutating
        // `self.data` (refresh_archive borrows it mutably).
        let target = self
            .data
            .repos
            .selected_repo()
            .map(|r| r.name.clone());
        // Auto-load on first view / repo change (same as Browse — was manual-only).
        if let Some(repo) = &target {
            if self.data.archive.repository != *repo {
                self.data.refresh_archive(repo, None);
            }
        }
        ui.label(format!(
            "archive of repo: {}",
            target.clone().unwrap_or_else(|| "(none selected)".into())
        ));
        let do_refresh = ui
            .add_enabled(target.is_some(), egui::Button::new("⟳ refresh"))
            .clicked();
        if do_refresh {
            if let Some(repo) = target {
                self.data.refresh_archive(&repo, None);
            }
        }
        ui.separator();
        if let Some(err) = &self.data.archive.error {
            ui.colored_label(egui::Color32::RED, format!("error: {err}"));
        }

        // Archive stats (file count / total uncompressed bytes / archive name).
        let a = &self.data.archive;
        egui::Grid::new("archive_stats").striped(true).show(ui, |ui| {
            ui.label("files");
            ui.label(a.file_count.to_string());
            ui.end_row();
            ui.label("uncompressed bytes");
            ui.label(a.total_uncompressed_bytes.to_string());
            ui.end_row();
            ui.label("archive");
            ui.label(if a.archive_path.is_empty() {
                "—"
            } else {
                &a.archive_path
            });
            ui.end_row();
        });
        ui.separator();

        // facett Table facet for the raw archive file paths (single column).
        let mut table = Table::new("archive", vec!["path".into()]);
        for path in &self.data.archive.files {
            table.push_row(vec![path.clone()]);
        }
        table.ui(ui);
    }

    fn artifact_tab(&mut self, ui: &mut Ui) {
        egui::Grid::new("artifact_inputs").show(ui, |ui| {
            ui.label("repository");
            ui.text_edit_singleline(&mut self.repo);
            ui.end_row();
            ui.label("namespace");
            ui.text_edit_singleline(&mut self.namespace);
            ui.end_row();
            ui.label("name");
            ui.text_edit_singleline(&mut self.name);
            ui.end_row();
            ui.label("version");
            ui.text_edit_singleline(&mut self.version);
            ui.end_row();
        });
        if ui.button("fetch").clicked() {
            let id = ArtifactId {
                namespace: if self.namespace.is_empty() {
                    None
                } else {
                    Some(self.namespace.clone())
                },
                name: self.name.clone(),
                version: self.version.clone(),
            };
            let repo = self.repo.clone();
            self.data.fetch_artifact(&repo, id);
        }
        ui.separator();
        let a = &self.data.artifact;
        if let Some(err) = &a.error {
            ui.colored_label(egui::Color32::RED, format!("error: {err}"));
        } else if a.repository.is_empty() {
            ui.label("enter an artifact id and fetch");
        } else if a.found {
            ui.label(format!(
                "✔ {} / {} {} — {} bytes ({})",
                a.repository, a.name, a.version, a.size_bytes, a.content_type
            ));
        } else {
            ui.colored_label(egui::Color32::YELLOW, "not found");
        }
    }

    fn upload_tab(&mut self, ui: &mut Ui) {
        let writable = self.data.repos.upload_enabled();
        let target = self.data.repos.selected_repo().map(|r| r.name.clone());
        ui.label(format!(
            "target repo: {}",
            target.clone().unwrap_or_else(|| "(none selected)".into())
        ));
        if !writable {
            ui.colored_label(
                egui::Color32::YELLOW,
                "selected repo is read-only — pick a writable repo on the Repos tab",
            );
        }
        egui::Grid::new("upload_inputs").show(ui, |ui| {
            ui.label("name");
            ui.text_edit_singleline(&mut self.name);
            ui.end_row();
            ui.label("version");
            ui.text_edit_singleline(&mut self.version);
            ui.end_row();
            ui.label("file path");
            ui.text_edit_singleline(&mut self.upload_path);
            ui.end_row();
        });
        let do_upload = ui
            .add_enabled(writable, egui::Button::new("upload"))
            .clicked();
        if do_upload {
            if let Some(repo) = target {
                match std::fs::read(&self.upload_path) {
                    Ok(bytes) => {
                        let id = ArtifactId {
                            namespace: None,
                            name: self.name.clone(),
                            version: self.version.clone(),
                        };
                        self.notice = Some(match self.data.put_artifact(&repo, &id, &bytes) {
                            Ok(()) => format!("uploaded {} bytes to {repo}", bytes.len()),
                            Err(e) => format!("upload failed: {e}"),
                        });
                    }
                    Err(e) => self.notice = Some(format!("read failed: {e}")),
                }
            }
        }
        if let Some(n) = &self.notice {
            ui.separator();
            ui.label(n);
        }
    }

    /// The Tools menu — Holger's operator surface, a mirror of the CLI tools.
    fn tools_tab(&mut self, ui: &mut Ui) {
        ui.heading("Tools");
        ui.label("Operator tools — a mirror of the holger CLI, with facett views.");
        ui.separator();
        ui.horizontal_wrapped(|ui| {
            // Tool #1 holger-ds publishes+fetches a synthetic corpus — a WRITE,
            // so it is gated in static mode exactly like #2-#5 (was ungated).
            let h = ui.add_enabled(
                !self.static_mode,
                egui::Button::selectable(self.tool == ToolsFn::HolgerDs, "1 · holger-ds"),
            );
            if h.clicked() {
                self.tool = ToolsFn::HolgerDs;
            }
            let m = ui.add_enabled(
                !self.static_mode,
                egui::Button::selectable(self.tool == ToolsFn::Migrate, "2 · migrate / suck"),
            );
            if m.clicked() {
                self.tool = ToolsFn::Migrate;
            }
            let s = ui.add_enabled(
                !self.static_mode,
                egui::Button::selectable(self.tool == ToolsFn::Security, "3 · security · Móðguðr"),
            );
            if s.clicked() {
                self.tool = ToolsFn::Security;
            }
            let d = ui.add_enabled(
                !self.static_mode,
                egui::Button::selectable(self.tool == ToolsFn::Deploy, "4 · deploy · Skíðblaðnir"),
            );
            if d.clicked() {
                self.tool = ToolsFn::Deploy;
            }
            // Tool #5 — Airgap populate. Read-path-safe to *plan*; the actual
            // build/push is a write, so the button is disabled in static mode.
            let g = ui.add_enabled(
                !self.static_mode,
                egui::Button::selectable(self.tool == ToolsFn::Airgap, "5 · airgap populate"),
            );
            if g.clicked() {
                self.tool = ToolsFn::Airgap;
            }
            // Tool #6 — the shared-framework demo appliance (start a demo registry
            // container THROUGH jera). Declaring + dispatching is read-path-safe, but
            // it stands up infra, so it is gated in static read-only mode like #2-#5.
            let dm = ui.add_enabled(
                !self.static_mode,
                egui::Button::selectable(self.tool == ToolsFn::Demo, "6 · demo appliance"),
            );
            if dm.clicked() {
                self.tool = ToolsFn::Demo;
            }
        });
        ui.separator();
        let red = egui::Color32::from_rgb(255, 120, 120);
        match self.tool {
            ToolsFn::HolgerDs => {
                ui.heading("holger-ds — artifact-delivery benchmark");
                ui.label("Scalable synthetic publish+fetch throughput, measured over the REAL package protocol.");
                ui.label("Targets: this holger (self-host) · or an EXTERNAL Nexus/Artifactory base URL (resourced fairly).");
                let ds = &mut self.data.holger_ds;
                ui.horizontal(|ui| {
                    ui.label("scale:");
                    for s in ["micro", "small", "large"] {
                        if ui.selectable_label(ds.scale == s, s).clicked() {
                            ds.scale = s.to_string();
                        }
                    }
                });
                ui.horizontal(|ui| {
                    ui.label("external target (blank = self-host):");
                    ui.text_edit_singleline(&mut ds.target);
                });
                ui.separator();
                ui.label(RichText::new(ds.cli_command()).monospace());
                // Actually run the benchmark over the package protocol. micro is
                // inline + quick; the result lands in the pane + state_json.
                // It publishes a synthetic corpus (a write), so it is disabled in
                // static read-only mode.
                let run = ui
                    .add_enabled(
                        !self.static_mode,
                        egui::Button::new("Run benchmark… (over the package protocol)"),
                    )
                    .on_hover_text("Builds a synthetic crate corpus and bombards Holger's native HTTP door — measured over the real package protocol.")
                    .on_disabled_hover_text("disabled in static read-only mode (publish is a write)");
                if run.clicked() {
                    self.data.run_holger_ds();
                    let ok = self
                        .data
                        .holger_ds
                        .result
                        .as_ref()
                        .map(|r| r.error.is_none())
                        .unwrap_or(false);
                    functional_status(
                        "holger-ui/tools/holger-ds",
                        "benchmark_ran",
                        ok,
                        &self.data.holger_ds.scale,
                    );
                }
                let ds = &self.data.holger_ds;
                if !ds.status.is_empty() {
                    ui.separator();
                    if let Some(res) = &ds.result {
                        if let Some(err) = &res.error {
                            ui.colored_label(egui::Color32::from_rgb(255, 120, 120), format!("error: {err}"));
                        } else {
                            ui.colored_label(
                                egui::Color32::from_rgb(90, 220, 140),
                                RichText::new(format!("● {:.1} MB/s · {:.0} ops/s", res.mbs, res.ops_per_sec)).strong(),
                            );
                            ui.label(format!(
                                "scale {} · target {} · {} files / {} crates · {} ops",
                                res.scale, res.target, res.files, res.crates, res.ops
                            ));
                        }
                    } else {
                        ui.label(&ds.status);
                    }
                }
            }
            ToolsFn::Migrate => {
                ui.heading("Migrate — \"suck\" Nexus / Artifactory → znippy");
                ui.label("Pulls an upstream registry into one or many znippy archives. Owned by the holger agent (single home).");
                if self.static_mode {
                    ui.colored_label(red, "disabled in static mode");
                } else {
                    let m = &mut self.data.migrate;
                    ui.horizontal(|ui| {
                        ui.label("source:");
                        ui.selectable_value(&mut m.source, "nexus".to_string(), "nexus");
                        ui.selectable_value(&mut m.source, "artifactory".to_string(), "artifactory");
                    });
                    egui::Grid::new("migrate_inputs").show(ui, |ui| {
                        ui.label("registry url");
                        ui.text_edit_singleline(&mut m.url);
                        ui.end_row();
                        ui.label("output .znippy");
                        ui.text_edit_singleline(&mut m.output);
                        ui.end_row();
                        ui.label("repository (blank = all)");
                        ui.text_edit_singleline(&mut m.repository);
                        ui.end_row();
                    });
                    ui.separator();
                    ui.label(RichText::new(m.cli_command()).monospace());
                    // Actually invoke the agent connector (nexus/artifactory →
                    // znippy) and report the outcome in the pane.
                    let run = ui
                        .button("Run migrate… (via holger-agent)")
                        .on_hover_text("Lists the upstream registry's repositories and sucks them into the output .znippy via the holger agent connector.");
                    if run.clicked() {
                        self.data.run_migrate();
                        let ok = self
                            .data
                            .migrate
                            .result
                            .as_ref()
                            .map(|r| r.error.is_none() && r.ran)
                            .unwrap_or(false);
                        functional_status(
                            "holger-ui/tools/migrate",
                            "suck_ran",
                            ok,
                            &self.data.migrate.source,
                        );
                    }
                    let m = &self.data.migrate;
                    if !m.status.is_empty() {
                        ui.separator();
                        match &m.result {
                            Some(r) if r.error.is_some() => {
                                ui.colored_label(red, format!("error: {}", r.error.as_deref().unwrap_or_default()));
                            }
                            Some(r) if r.ran => {
                                ui.colored_label(
                                    egui::Color32::from_rgb(90, 220, 140),
                                    RichText::new(format!("● migrated {} repositorie(s) → {}", r.repositories, r.output)).strong(),
                                );
                            }
                            _ => {
                                ui.label(&m.status);
                            }
                        }
                    }
                }
            }
            ToolsFn::Security => {
                ui.heading("Security — Móðguðr");
                ui.label("Vuln / license / provenance verdict (Engine A). Maps the selected repo's archive listing to modgunn and folds per-artifact verdicts into a Pass/Warn/Block report.");
                if self.static_mode {
                    ui.colored_label(red, "not available in static (validate-then-switch only)");
                } else {
                    let target = self
                        .data
                        .repos
                        .selected_repo()
                        .map(|r| (r.name.clone(), r.repo_type.clone()));
                    ui.label(format!(
                        "target repo: {}",
                        target.as_ref().map(|(n, _)| n.as_str()).unwrap_or("(none selected)")
                    ));
                    let do_scan = ui
                        .add_enabled(target.is_some(), egui::Button::new("Scan selected repo"))
                        .clicked();
                    if do_scan {
                        if let Some((name, ty)) = target {
                            self.data.run_security_scan(&name, &ty);
                            functional_status(
                                "holger-ui/tools/security",
                                "scan_ran",
                                self.data.security.error.is_none() && self.data.security.loaded,
                                &name,
                            );
                        }
                    }
                    ui.separator();
                    let s = &self.data.security;
                    if let Some(err) = &s.error {
                        ui.colored_label(egui::Color32::RED, format!("error: {err}"));
                    } else if s.loaded {
                        let (label, color) = match s.decision.as_str() {
                            "block" => ("● BLOCK", egui::Color32::from_rgb(255, 80, 80)),
                            "warn" => ("● WARN", egui::Color32::from_rgb(240, 200, 90)),
                            _ => ("● PASS", egui::Color32::from_rgb(90, 220, 140)),
                        };
                        ui.colored_label(color, RichText::new(label).strong());
                        ui.label(format!(
                            "ecosystem {} · scanned {} · pass {} · warn {} · block {} · skipped {}",
                            s.ecosystem, s.scanned, s.pass, s.warn, s.block, s.skipped
                        ));
                        if !s.source.is_empty() {
                            ui.label(RichText::new(format!("advisories: {}", s.source)).weak());
                        }
                        // Móðguðr view mode: the verdict table, or the dependency
                        // graph (every component as a node coloured by verdict).
                        ui.horizontal(|ui| {
                            ui.selectable_value(&mut self.security_graph, false, "Table");
                            ui.selectable_value(&mut self.security_graph, true, "Graph");
                        });
                        if self.security_graph {
                            render_security_graph(&self.data.dep_graph, ui);
                        } else {
                            let mut table = Table::new(
                                "security_findings",
                                vec!["name".into(), "version".into(), "decision".into(), "advisories".into()],
                            );
                            for f in &s.findings {
                                table.push_row(vec![
                                    f.name.clone(),
                                    f.version.clone(),
                                    f.decision.clone(),
                                    f.ids.join(", "),
                                ]);
                            }
                            table.ui(ui);
                        }
                    } else {
                        ui.label("pick a repo on the Repos tab, then Scan.");
                    }
                }
            }
            ToolsFn::Deploy => {
                use holger_airgap::Target;
                ui.heading("Deploy — Skíðblaðnir");
                ui.label("Deploy the SELECTED repo's sealed znippy bundle to a test target via the airgap engine (push-only carry of the already-sealed archive).");
                if self.static_mode {
                    ui.colored_label(red, "disabled in static mode");
                } else {
                    // The bundle to deploy is the selected repo's sealed archive.
                    let target = self.data.repos.selected_repo().map(|r| r.name.clone());
                    ui.label(format!(
                        "bundle repo: {}",
                        target.as_deref().unwrap_or("(none selected)")
                    ));
                    let dep = &mut self.data.deploy;
                    ui.horizontal(|ui| {
                        ui.label("target:");
                        ui.selectable_value(&mut dep.target, Target::Holger, "holger");
                        ui.selectable_value(&mut dep.target, Target::Nexus, "nexus");
                        ui.selectable_value(&mut dep.target, Target::Artifactory, "artifactory");
                    });
                    let tgt = self.data.deploy.target;
                    let do_deploy = ui
                        .add_enabled(target.is_some(), egui::Button::new("Deploy to test…"))
                        .on_hover_text("Reads the selected repo's sealed znippy bundle (archive_info) and plans an airgap push-only deploy to the chosen test target.")
                        .clicked();
                    if do_deploy {
                        if let Some(name) = target {
                            self.data.run_deploy(&name, tgt);
                            let ok = self
                                .data
                                .deploy
                                .result
                                .as_ref()
                                .map(|r| r.error.is_none() && r.ran)
                                .unwrap_or(false);
                            functional_status(
                                "holger-ui/tools/deploy",
                                "deploy_planned",
                                ok,
                                &name,
                            );
                        }
                    }
                    let dep = &self.data.deploy;
                    if !dep.status.is_empty() {
                        ui.separator();
                        match &dep.result {
                            Some(r) if r.error.is_some() => {
                                ui.colored_label(red, format!("error: {}", r.error.as_deref().unwrap_or_default()));
                            }
                            Some(r) if r.ran => {
                                ui.colored_label(
                                    egui::Color32::from_rgb(90, 220, 140),
                                    RichText::new(format!("● deploy planned · {} files → {}", r.file_count, r.target)).strong(),
                                );
                                ui.label(RichText::new(&r.plan).monospace());
                            }
                            _ => {
                                ui.label(&dep.status);
                            }
                        }
                    }
                }
            }
            ToolsFn::Airgap => {
                use holger_airgap::{Auth, Scale, Stack, Target};
                ui.heading("Airgap populate");
                ui.label("Build→carry→push a software stack into the target via the documented populate driver. Plan is pure Rust; execution delegates to distribution/airgap/populate.");
                if self.static_mode {
                    ui.colored_label(red, "disabled in static mode");
                } else {
                    // Reuse the session's connect-time mTLS identity for an
                    // auth=mtls push (so the operator isn't told to re-supply certs).
                    let sess_cert = self.session_client_cert.clone();
                    let sess_key = self.session_client_key.clone();
                    let ag = &mut self.data.airgap;
                    ui.horizontal(|ui| {
                        ui.label("scale:");
                        ui.selectable_value(&mut ag.scale, Scale::Micro, "micro");
                        ui.selectable_value(&mut ag.scale, Scale::Small, "small");
                        ui.selectable_value(&mut ag.scale, Scale::Large, "large");
                    });
                    ui.horizontal(|ui| {
                        ui.label("stack:");
                        ui.selectable_value(&mut ag.stack, None, "preset");
                        for s in [Stack::Airflow, Stack::Cargo, Stack::Npm, Stack::Maven, Stack::Docker, Stack::All] {
                            ui.selectable_value(&mut ag.stack, Some(s), s.as_arg());
                        }
                    });
                    ui.horizontal(|ui| {
                        ui.label("target:");
                        ui.selectable_value(&mut ag.target, Target::Holger, "holger");
                        ui.selectable_value(&mut ag.target, Target::Nexus, "nexus");
                        ui.selectable_value(&mut ag.target, Target::Artifactory, "artifactory");
                    });
                    ui.horizontal(|ui| {
                        ui.label("auth:");
                        ui.selectable_value(&mut ag.auth, Auth::Mtls, "mtls");
                        ui.selectable_value(&mut ag.auth, Auth::Oidc, "oidc");
                    });
                    ui.horizontal(|ui| {
                        ui.checkbox(&mut ag.dry_run, "dry-run (plan only)")
                            .on_hover_text("Plan only — no build/push. Untick to actually populate (needs creds).");
                    });
                    // Feed the session's client cert/key into an mTLS push so it
                    // doesn't fail "needs --client-cert and --client-key". If none
                    // were supplied at connect-time, validate() surfaces a clear
                    // message below (unless dry-run, which needs no creds).
                    if ag.auth == Auth::Mtls && !ag.dry_run {
                        if ag.client_cert.is_none() {
                            ag.client_cert = sess_cert;
                        }
                        if ag.client_key.is_none() {
                            ag.client_key = sess_key;
                        }
                    }
                    ui.separator();
                    // The pure-Rust plan (the dry-run surface) + clear validation.
                    // Compute owned values so the `ag` mutable borrow is released
                    // before the run button calls back into `self.data`.
                    let plan_or_err: Result<String, String> = match ag.validate() {
                        Ok(()) => Ok(ag.plan()),
                        Err(e) => Err(e.to_string()),
                    };
                    let dry = ag.dry_run;
                    match plan_or_err {
                        Ok(plan) => {
                            ui.label(RichText::new(plan).monospace());
                            let label = if dry {
                                "Run populate… (dry-run plan)"
                            } else {
                                "Run populate… (delegates to driver)"
                            };
                            if ui.button(label).clicked() {
                                self.data.run_airgap();
                                let ok = self
                                    .data
                                    .airgap_run
                                    .as_ref()
                                    .map(|r| r.error.is_none() && r.success)
                                    .unwrap_or(false);
                                functional_status(
                                    "holger-ui/tools/airgap",
                                    "populate_ran",
                                    ok,
                                    if dry { "dry-run" } else { "execute" },
                                );
                            }
                        }
                        Err(e) => {
                            ui.colored_label(red, format!("cannot run: {e}"));
                            ui.label("tick dry-run to plan without creds, or connect the UI with --cert/--key for an mTLS push.");
                        }
                    }
                    // Surface the last run's result/plan in the pane.
                    if let Some(run) = &self.data.airgap_run {
                        ui.separator();
                        if let Some(err) = &run.error {
                            ui.colored_label(red, format!("run error: {err}"));
                        } else {
                            let color = if run.success {
                                egui::Color32::from_rgb(90, 220, 140)
                            } else {
                                egui::Color32::from_rgb(240, 200, 90)
                            };
                            ui.colored_label(color, RichText::new(format!("● {}", run.status)).strong());
                            if !run.log.is_empty() {
                                ui.label(RichText::new(&run.log).monospace());
                            }
                        }
                    }
                }
            }
            ToolsFn::Demo => {
                ui.heading("Demo appliance — start a demo registry (via jera)");
                ui.label(
                    "Stands up a pinned demo artifact registry THROUGH the shared job manager jera \
                     (a durable BOOT_CONTAINER job, routed through draupnir's OCI engine) — the same \
                     Tools-menu container-demo pattern korp uses. holger can then proxy / migrate from it.",
                );
                if self.static_mode {
                    ui.colored_label(red, "disabled in static mode");
                } else {
                    let spec = crate::infra::demo_registry_spec();
                    egui::Grid::new("demo_infra").striped(true).show(ui, |ui| {
                        ui.label("image");
                        ui.label(RichText::new(&spec.image).monospace());
                        ui.end_row();
                        ui.label("name");
                        ui.label(RichText::new(&spec.name).monospace());
                        ui.end_row();
                        ui.label("port");
                        ui.label(spec.ports.iter().map(|p| p.to_string()).collect::<Vec<_>>().join(", "));
                        ui.end_row();
                        ui.label("url (once up)");
                        ui.label(RichText::new(crate::infra::demo_url()).monospace());
                        ui.end_row();
                    });
                    ui.separator();
                    let run = ui
                        .button("Start demo appliance… (as a jera job)")
                        .on_hover_text(
                            "Records the container bring-up as a durable jera BOOT_CONTAINER job. \
                             Build with --features containers to actually boot it through draupnir's OCI engine.",
                        );
                    if run.clicked() {
                        self.data.run_demo();
                        let ok = self
                            .data
                            .demo_appliance
                            .as_ref()
                            .map(|d| !d.job_id.is_empty() && d.error.is_none())
                            .unwrap_or(false);
                        functional_status(
                            "holger-ui/tools/demo",
                            "demo_dispatched",
                            ok,
                            &spec.image,
                        );
                    }
                    if let Some(d) = &self.data.demo_appliance {
                        ui.separator();
                        if let Some(err) = &d.error {
                            ui.colored_label(red, format!("dispatch error: {err}"));
                        } else {
                            ui.colored_label(
                                egui::Color32::from_rgb(90, 220, 140),
                                RichText::new(format!("● {} · jera job {}", d.status, d.job_id)).strong(),
                            );
                            ui.label(format!("{} → {}", d.image, d.url));
                        }
                    }
                }
            }
        }
    }

    /// The current graph data signature — `(repo_count, selected repo, artifact
    /// file count for the selected repo)`. The graph rebuilds when this changes.
    fn graph_data_sig(&self) -> (usize, Option<usize>, usize) {
        let n = self.data.repos.repos.len();
        let sel = self.data.repos.selected;
        // Artifact nodes come from the selected repo's *already-loaded* archive
        // listing (no new gRPC call) — count them so a refresh re-grows the graph.
        let sel_name = self.data.repos.selected_repo().map(|r| r.name.as_str());
        let arch_n = if sel_name.is_some() && sel_name == Some(self.data.archive.repository.as_str())
        {
            self.data.archive.files.len()
        } else {
            0
        };
        (n, sel, arch_n)
    }

    /// Build the holger graph: server → repositories → (artifacts / upstreams).
    /// Nodes are coloured by [`GraphNodeKind`] (the HOLGER NEON PALETTE); edges are
    /// server→repo, repo→artifact, repo→upstream. Returns the graph plus a parallel
    /// vec of node-kind labels for `state_json`.
    fn build_graph(&self) -> (Graph3D, Vec<&'static str>) {
        let mut nodes: Vec<(String, egui::Color32)> = Vec::new();
        let mut kinds: Vec<&'static str> = Vec::new();
        let mut edges: Vec<(usize, usize)> = Vec::new();

        // Node 0: the holger server (the anchor).
        nodes.push(("holger".into(), GraphNodeKind::Server.color()));
        kinds.push(GraphNodeKind::Server.label());

        // Repositories (indices 1..=repo_count), each edged from the server.
        let repos = &self.data.repos.repos;
        for (i, r) in repos.iter().enumerate() {
            let kind = repo_node_kind(r);
            nodes.push((r.name.clone(), kind.color()));
            kinds.push(kind.label());
            edges.push((0, i + 1));
        }

        // Upstream/proxy target nodes for every proxy-flavoured repository.
        for (i, r) in repos.iter().enumerate() {
            if repo_node_kind(r) == GraphNodeKind::Upstream {
                let up = nodes.len();
                nodes.push((format!("{}↑upstream", r.name), GraphNodeKind::Upstream.color()));
                kinds.push(GraphNodeKind::Upstream.label());
                edges.push((i + 1, up));
            }
        }

        // Artifact nodes for the *selected* repo from its already-loaded archive
        // listing (LAW 2: real data when present; no new gRPC call). Each archive
        // file becomes a gold→lime artifact node edged from its repository.
        if let Some(sel) = self.data.repos.selected {
            let sel_name = self.data.repos.selected_repo().map(|r| r.name.as_str());
            if sel_name.is_some() && sel_name == Some(self.data.archive.repository.as_str()) {
                for path in &self.data.archive.files {
                    let art = nodes.len();
                    nodes.push((path.clone(), GraphNodeKind::Artifact.color()));
                    kinds.push(GraphNodeKind::Artifact.label());
                    edges.push((sel + 1, art));
                }
            }
        }

        // `with_decor(DecorPolicy::Full)` turns ON the beauty: neon glow + click
        // shockwave + subgraph lighting/dim, all from the facett kernel (no
        // hand-rolled widgets). Under the `device` theme the operator can still
        // dial it down; the explicit override keeps the sellpoint gorgeous here.
        let mut g = Graph3D::new(nodes, edges, Layout3D::Force)
            .with_title("holger")
            .with_decor(DecorPolicy::Full);
        g.layout();
        (g, kinds)
    }

    /// Feed the graph a node selection (the same effect a click in the 3D view
    /// has) — lights that node's subgraph and dims the rest. Used by keyboard /
    /// programmatic selection and by the robot-UI test. No-op if no graph is built
    /// or the index is out of range.
    pub fn select_graph_node(&mut self, idx: usize) {
        if let Some(g) = &mut self.graph {
            g.select(Some(idx));
        }
    }

    /// The graph's observable state for `state_json`: the selected node + its lit
    /// subgraph (highlighted neighbours), plus the node-kind palette mapping —
    /// asserted as DATA by the robot. `null` when the Graph tab hasn't built one.
    fn graph_state_json(&self) -> Value {
        let Some(g) = &self.graph else {
            return Value::Null;
        };
        let inner = g.state_json();
        let sel = inner["selected_node"].as_u64().map(|i| i as usize);
        let sel_label = sel.and_then(|i| g.nodes.get(i)).map(|n| n.label.clone());
        let sel_kind = sel.and_then(|i| self.graph_kinds.get(i)).copied();
        let neigh_len = inner["highlighted_neighbours"]
            .as_array()
            .map(|a| a.len())
            .unwrap_or(0);
        json!({
            "nodes": inner["nodes"],
            "edges": inner["edges"],
            "effects_policy": inner["effects_policy"],
            "palette": inner["palette"],
            "kinds": self.graph_kinds,
            "selected_node": sel,
            "selected_label": sel_label,
            "selected_kind": sel_kind,
            "highlighted_neighbours": inner["highlighted_neighbours"].clone(),
            "highlighted_count": neigh_len,
            "dimmed_alpha": inner["dimmed_alpha"],
        })
    }

    /// The 3D holger graph (server → repositories → artifacts/upstreams),
    /// force-directed, neon-lit. Click a repo node to light its subgraph.
    fn graph_tab(&mut self, ui: &mut Ui) {
        ui.horizontal(|ui| {
            if ui.button("⟳ rebuild").clicked() {
                self.graph = None;
            }
            ui.label("repo graph — neon 3D (holger → repos → artifacts/upstreams); click a node to light its subgraph");
        });
        ui.separator();
        let sig = self.graph_data_sig();
        if self.graph.is_none() || self.graph_sig != sig {
            // Preserve the operator's current selection across a data-driven rebuild.
            let prev_sel = self.graph.as_ref().and_then(|g| {
                g.state_json()["selected_node"].as_u64().map(|i| i as usize)
            });
            let (mut g, kinds) = self.build_graph();
            if let Some(s) = prev_sel {
                if s < kinds.len() {
                    g.select(Some(s));
                }
            }
            self.graph = Some(g);
            self.graph_kinds = kinds;
            self.graph_sig = sig;
        }
        let now = ui.input(|i| i.time);
        if let Some(g) = &mut self.graph {
            g.set_clock(now);
            g.ui(ui);
        }
        ui.ctx().request_repaint();
    }

    /// The Helix tab — the facett-helix **TIME-HELIX DAG view**: holger's
    /// repository/artifact dependency DAG wound onto a coil that advances along a
    /// synthesized time axis. Real data comes from the Móðguðr (Tools#3) scan's
    /// [`DepGraphData`](crate::data::DepGraphData); with none loaded (or in the
    /// hands-free demo tour) it falls back to `HelixView::demo()` so the tab is
    /// never blank. The view is cached and rebuilt only when [`Self::helix_data_sig`]
    /// changes (a fresh scan), preserving the traverse cursor between frames.
    fn helix_tab(&mut self, ui: &mut Ui) {
        ui.horizontal(|ui| {
            if ui.button("⟳ rebuild").clicked() {
                self.helix = None;
            }
            ui.label(
                "time-helix — the dependency DAG wound along a time axis; scan a repo on \
                 Tools · Móðguðr to wind its real graph (else a demo scene plays)",
            );
        });
        ui.separator();
        let sig = self.helix_data_sig();
        if self.helix.is_none() || self.helix_sig != sig {
            self.helix = Some(self.build_helix());
            self.helix_sig = sig;
        }
        let now = ui.input(|i| i.time);
        if let Some(h) = &mut self.helix {
            h.set_clock(now);
            h.ui(ui);
        }
        ui.ctx().request_repaint();
    }

    /// The Helix data signature — `(demo?, dep-graph repository, node count, edge
    /// count)`. The helix rebuilds when this changes (a Móðguðr scan lands a new
    /// repo's dependency graph, or the demo tour toggles). Demo mode is folded in so
    /// leaving/entering the hands-free tour re-seeds the scene.
    fn helix_data_sig(&self) -> (bool, String, usize, usize) {
        let g = &self.data.dep_graph;
        (self.demo.is_some(), g.repository.clone(), g.nodes.len(), g.edges.len())
    }

    /// Build the [`HelixView`] from holger's data. Móðguðr's [`DepGraphData`] is a
    /// single repository's scanned artifacts (+ optional warehouse-sourced dep
    /// edges) but carries **no per-version timestamp**, so a time axis is
    /// synthesized from node order: the repository root is a `Crate` at `t = 0` and
    /// each artifact is a `Task` at `t = index + 1`, laned by its verdict
    /// (pass/warn/block). Warehouse edges become intra-coil deps; artifacts with no
    /// edge are hung off the root so the coil is one connected structure. Advisory
    /// ids ride in as `Cve` events. With no scan loaded (or during the demo tour) it
    /// returns the self-contained `HelixView::demo()` multi-coil scene.
    fn build_helix(&self) -> HelixView {
        let g = &self.data.dep_graph;
        if self.demo.is_some() || g.nodes.is_empty() {
            return HelixView::demo();
        }
        let mut dag = PlanDag::new();
        // The repository root anchors the coil at t = 0 (a Crate lane).
        let root = dag.add_idea(g.repository.clone(), "repo", 0.0, Kind::Crate);
        // Each scanned artifact becomes a Task node along the synthesized time axis,
        // laned (angular strand) by its verdict decision.
        let mut ids: Vec<facett_helix::NodeId> = Vec::with_capacity(g.nodes.len());
        for (i, n) in g.nodes.iter().enumerate() {
            let t = (i + 1) as f64;
            let label = if n.version.is_empty() {
                n.name.clone()
            } else {
                format!("{} {}", n.name, n.version)
            };
            let nid = dag.add_idea(label, n.decision.clone(), t, Kind::Task);
            // Verdict → run status (block = Blocked, warn = Active, pass = default).
            match n.decision.as_str() {
                "block" => {
                    dag.set_status(nid, Status::Blocked);
                }
                "warn" => {
                    dag.set_status(nid, Status::Active);
                }
                _ => {}
            }
            // Advisory ids ride in as a security (Cve) event on the node.
            if !n.ids.is_empty() {
                dag.add_event(nid, t, EventKind::Cve, n.ids.join(", "));
            }
            ids.push(nid);
        }
        // Warehouse-sourced dependency edges become intra-coil deps.
        let mut linked = vec![false; ids.len()];
        for (from, to) in &g.edges {
            if let (Some(&fa), Some(&ta)) = (ids.get(*from), ids.get(*to)) {
                if dag.add_dep(fa, ta) {
                    linked[*from] = true;
                }
            }
        }
        // Artifacts with no resolved edge hang off the root so the coil is one graph.
        for (i, nid) in ids.iter().enumerate() {
            if !linked[i] {
                dag.add_dep(*nid, root);
            }
        }
        HelixView::from_dag(format!("holger · {}", g.repository), dag)
    }

    /// The **Lineage** tab — the live proxy-cache-filling facet. As holger caches
    /// and serves artifacts, this fills and rotates: the [`LineageView`](crate::data::LineageView)
    /// (fed live via a connected `mpsc` channel — the same seam a real
    /// `ChannelAuditLog` audit tee uses) is rendered two ways, toggled here:
    /// **3D fill** (facett-graph3d, nodes clustered by ecosystem, slowly rotating and
    /// growing) and **time helix** (facett-helix, each arrival wound onto a per-
    /// ecosystem coil). With no real feed wired, a demo backlog drips one arrival per
    /// frame so the graph visibly builds; the widgets rebuild when the lineage data
    /// signature changes and the injected clock keeps the motion continuous.
    fn lineage_tab(&mut self, ui: &mut Ui) {
        ui.horizontal(|ui| {
            if ui.button("⟳ rebuild").clicked() {
                self.lineage_graph = None;
                self.lineage_helix = None;
            }
            ui.selectable_value(&mut self.lineage_mode, LineageMode::Graph3d, "◉ 3D fill");
            ui.selectable_value(&mut self.lineage_mode, LineageMode::Helix, "🌀 time helix");
            ui.separator();
            ui.checkbox(&mut self.lineage_autofill, "▶ auto-fill")
                .on_hover_text("drip cache arrivals through the live feed so the graph fills + rotates");
            if ui.button("＋ arrival").clicked() {
                self.drip_lineage_event();
            }
        });
        let l = &self.data.lineage;
        ui.label(
            RichText::new(format!(
                "cache fill — {} artifacts · {} events · {} bytes · {} pending",
                l.artifact_count(),
                l.total_events,
                l.total_bytes,
                self.lineage_demo.len(),
            ))
            .weak(),
        );
        ui.separator();

        // Live: drip one demo arrival (if any), then drain the feed into the view.
        if self.lineage_autofill {
            self.drip_lineage_event();
        }
        self.data.lineage.pump();

        // Rebuild the facett widgets when the lineage data grew (a node pops in).
        let sig = (
            self.data.lineage.nodes.len(),
            self.data.lineage.edges.len(),
            self.data.lineage.events.len(),
        );
        if self.lineage_sig != sig {
            self.lineage_graph = None;
            self.lineage_helix = None;
            self.lineage_sig = sig;
        }

        let now = ui.input(|i| i.time);
        match self.lineage_mode {
            LineageMode::Graph3d => {
                if self.lineage_graph.is_none() {
                    self.lineage_graph = Some(self.build_lineage_graph());
                }
                if let Some(g) = &mut self.lineage_graph {
                    g.set_clock(now);
                    g.ui(ui);
                }
            }
            LineageMode::Helix => {
                if self.lineage_helix.is_none() {
                    self.lineage_helix = Some(self.build_lineage_helix());
                }
                if let Some(h) = &mut self.lineage_helix {
                    h.set_clock(now);
                    h.ui(ui);
                }
            }
        }
        // Keep the fill animating (rotation + one arrival per frame) while open.
        ui.ctx().request_repaint();
    }

    /// Send the next demo arrival through the LIVE lineage feed (the same path a
    /// real audit tee uses); no-op once the backlog is drained. `pump()` then folds
    /// it into the view on this or the next frame.
    fn drip_lineage_event(&mut self) {
        if let Some(ev) = self.lineage_demo.pop_front() {
            let _ = self.lineage_tx.send(ev);
        }
    }

    /// Build the rotating 3D cache-fill graph from the live [`LineageView`]: every
    /// node (artifacts coloured by ecosystem cluster; repo/upstream by kind) with the
    /// lineage edges (requested-by / proxied-from) mapped to node indices. Spin is on
    /// so the graph slowly rotates; `DecorPolicy::Full` lights the neon glow.
    fn build_lineage_graph(&self) -> Graph3D {
        let l = &self.data.lineage;
        let mut nodes: Vec<(String, egui::Color32)> = Vec::with_capacity(l.nodes.len());
        let mut index: HashMap<&str, usize> = HashMap::with_capacity(l.nodes.len());
        for (i, n) in l.nodes.iter().enumerate() {
            nodes.push((n.label.clone(), lineage_node_color(n)));
            index.insert(n.id.as_str(), i);
        }
        let mut edges: Vec<(usize, usize)> = Vec::with_capacity(l.edges.len());
        for e in &l.edges {
            if let (Some(&a), Some(&b)) = (index.get(e.from.as_str()), index.get(e.to.as_str())) {
                edges.push((a, b));
            }
        }
        let mut g = Graph3D::new(nodes, edges, Layout3D::Force)
            .with_title("holger · cache fill")
            .with_decor(DecorPolicy::Full);
        g.view.spin = true; // slowly rotating spatial fill (spin moved into Graph3DView)
        g.layout();
        g
    }

    /// Build the time-helix companion from the live [`LineageView`]: each arrival is
    /// an idea wound onto its ecosystem's coil at its arrival index along the time
    /// axis, chained to the previous arrival on the same lane so each ecosystem forms
    /// one connected coil. Falls back to `HelixView::demo()` before any arrival.
    fn build_lineage_helix(&self) -> HelixView {
        let l = &self.data.lineage;
        if l.events.is_empty() {
            return HelixView::demo();
        }
        let mut dag = PlanDag::new();
        let mut last_on_lane: HashMap<&'static str, facett_helix::NodeId> = HashMap::new();
        for (i, ev) in l.events.iter().enumerate() {
            let lane = ev.ecosystem.label();
            let label = short_artifact(&ev.artifact);
            let nid = dag.add_idea(label, lane, i as f64, Kind::Crate);
            if let Some(prev) = last_on_lane.get(lane) {
                dag.add_dep(nid, *prev);
            }
            last_on_lane.insert(lane, nid);
        }
        HelixView::from_dag("holger · cache fill", dag)
    }
}

/// The neon colour for a lineage node: artifacts take their ecosystem cluster
/// colour; repository and upstream nodes reuse the HOLGER NEON PALETTE kinds so the
/// Lineage graph reads coherently against the Graph tab.
fn lineage_node_color(n: &LineageNode) -> egui::Color32 {
    match n.kind {
        NodeKind::Repo => GraphNodeKind::Repository.color(),
        NodeKind::Upstream => GraphNodeKind::Upstream.color(),
        NodeKind::Artifact => {
            let [r, g, b] = n.ecosystem.color();
            egui::Color32::from_rgb(r, g, b)
        }
    }
}

/// Trim a long artifact id / archive path to a compact helix label (basename +
/// version), so the coil stays legible as it fills.
fn short_artifact(artifact: &str) -> String {
    let tail = artifact.rsplit('/').next().unwrap_or(artifact);
    if tail.len() > 28 {
        tail[tail.len() - 28..].to_string()
    } else {
        tail.to_string()
    }
}

impl HolgerUiApp {
    /// Render the whole app from a parent `ui`. eframe drives this through the
    /// `eframe::App::ui` impl below; the `egui_kittest` robot harness drives it
    /// through [`HolgerUiApp::draw_ui`].
    fn render(&mut self, ui: &mut egui::Ui) {
        // Unified look & feel. In the static **Skade Vinter** showcase the whole UI
        // re-themes to the icy winter palette via the COH-1 bridge — `apply` installs
        // the full egui Style, publishes the derived legacy palette so every facett
        // Table follows, and publishes the Full effects policy so the ice-drip decor
        // lights up. Normal operation keeps the operator's selected preset.
        let ctx = ui.ctx().clone();
        // 🎬 Demo mode: apply the next due tour beat FIRST (off the egui frame
        // clock) so this frame paints the result — a real, animated walk.
        if self.demo.is_some() {
            let now = ui.input(|i| i.time);
            self.demo_tick(&ctx, now);
        }
        if self.static_mode {
            LookTheme::skade_vinter().apply(&ctx);
        } else {
            self.apply_look(&ctx);
        }
        // Write tabs are unavailable in static (read-only) mode.
        if self.static_mode && self.tab == Tab::Upload {
            self.tab = Tab::Status;
        }

        // Startup splash: the recovered holger+znippy hero logo (compiled-in PNG)
        // + wordmark + version, with the spinning znippy rabbit as a small accent
        // beneath. Shows ~2.6s then auto-dismisses (click to skip).
        if !self.splash_done {
            let now = ui.input(|i| i.time);
            let since = *self.splash_since.get_or_insert(now);
            let clicked = ui.input(|i| i.pointer.any_click());
            if now - since > 2.6 || clicked {
                self.splash_done = true;
            } else {
                self.logo.set_clock(now);
                let logo_tex = self.splash_logo_texture(&ctx);
                egui::CentralPanel::default().show_inside(ui, |ui| {
                    ui.vertical_centered(|ui| {
                        ui.add_space(12.0);
                        // The recovered logo is the splash hero — scaled to fit
                        // (portrait 1024×1536), centered, above the wordmark.
                        if let Some(tex) = &logo_tex {
                            let [w, h] = tex.size();
                            let max_h = (ui.available_height() * 0.55).clamp(180.0, 420.0);
                            let scale = (max_h / h as f32).min(1.0);
                            let size = egui::vec2(w as f32 * scale, h as f32 * scale);
                            ui.add(egui::Image::new((tex.id(), size)).fit_to_exact_size(size));
                        }
                        ui.add_space(8.0);
                        ui.heading("holger");
                        ui.label(
                            RichText::new(format!("v{HOLGER_UI_VERSION}"))
                                .monospace()
                                .strong(),
                        );
                        ui.label("airgap artifact server · znippy-backed");
                    });
                    self.logo.ui(ui);
                });
                ui.ctx().request_repaint();
                return;
            }
        }

        // A classic grouped menu bar (View / Operate / Repositories / Action / Look)
        // — the same command set as the Ctrl-K palette, surfaced as pull-down menus.
        // Group names avoid the tab labels so the top-level buttons stay unambiguous.
        // A pick routes through the one dispatcher a click/palette-invoke also uses.
        let mut menubar_pick = None;
        egui::Panel::top("menubar").show_inside(ui, |ui| {
            let commands = self.build_commands();
            menubar_pick = menu_bar(ui, &commands);
        });
        if let Some(id) = menubar_pick {
            self.dispatch_command(&id);
        }

        egui::Panel::top("tabs").show_inside(ui, |ui| {
            ui.horizontal(|ui| {
                ui.heading("holger");
                ui.label(RichText::new(format!("v{HOLGER_UI_VERSION}")).monospace().weak());
                ui.separator();
                ui.selectable_value(&mut self.tab, Tab::Status, "Status");
                ui.selectable_value(&mut self.tab, Tab::Repos, "Repos");
                ui.selectable_value(&mut self.tab, Tab::Browse, "Browse");
                ui.selectable_value(&mut self.tab, Tab::Archive, "Archive");
                ui.selectable_value(&mut self.tab, Tab::Artifact, "Artifact");
                ui.selectable_value(&mut self.tab, Tab::Graph, "Graph");
                ui.selectable_value(&mut self.tab, Tab::Helix, "Helix");
                ui.selectable_value(&mut self.tab, Tab::Lineage, "Lineage");
                ui.selectable_value(&mut self.tab, Tab::Tools, "Tools");
                if self.static_mode {
                    ui.add_enabled(false, egui::Button::new(RichText::new("Upload").strikethrough()))
                        .on_disabled_hover_text("read-only in static mode");
                } else {
                    ui.selectable_value(&mut self.tab, Tab::Upload, "Upload");
                }
                ui.separator();
                ui.checkbox(&mut self.static_mode, "⚓ static").on_hover_text(
                    "demo: Skade Vinter static showcase (icy winter scene, read-only) — \
                     defaulted from the server-reported profile (gRPC Admin ServerProfile); \
                     this checkbox is a manual override",
                );
                ui.separator();
                if ui
                    .button("⌘ K")
                    .on_hover_text("Command palette — jump to any tab, tool, or repo (Ctrl-K)")
                    .clicked()
                {
                    self.palette.open();
                }
                if ui
                    .button("ℹ About")
                    .on_hover_text("About holger — identity, version, and the shared framework it is built on")
                    .clicked()
                {
                    self.about_open = true;
                }
            });
            if self.static_mode {
                // Frost badge for the winter showcase. When the server reported a
                // read-only profile, show its label (server truth); otherwise this
                // is a manual override, so fall back to the showcase text.
                let badge = if self.data.profile.read_only && !self.data.profile.label.is_empty() {
                    format!("❄ SKAÐI · {}", self.data.profile.label)
                } else {
                    "❄ SKAÐI · SKADE VINTER — STATIC SHOWCASE · READ-ONLY".to_string()
                };
                ui.label(
                    RichText::new(badge)
                        .color(egui::Color32::from_rgb(180, 222, 245))
                        .strong(),
                );
            }
            // The look switcher — dark / light / device (OS presets collapsed).
            ui.horizontal(|ui| {
                ui.label("look:")
                    .on_hover_text("Unified facett look & feel — re-themes every view");
                let names = look_names();
                let mut pick = None;
                for (i, name) in names.iter().enumerate() {
                    if ui.selectable_label(self.look_preset == i, name).clicked() {
                        pick = Some(i);
                    }
                }
                if let Some(i) = pick {
                    self.set_look_preset(i);
                }
            });
        });
        egui::CentralPanel::default().show_inside(ui, |ui| match self.tab {
            Tab::Status => self.status_tab(ui),
            Tab::Repos => self.repos_tab(ui),
            Tab::Browse => self.browse_tab(ui),
            Tab::Archive => self.archive_tab(ui),
            Tab::Artifact => self.artifact_tab(ui),
            Tab::Graph => self.graph_tab(ui),
            Tab::Helix => self.helix_tab(ui),
            Tab::Lineage => self.lineage_tab(ui),
            Tab::Tools => self.tools_tab(ui),
            Tab::Upload => self.upload_tab(ui),
        });

        // Skade Vinter: overlay the ice-drip decor over the whole viewport — icicles
        // hang from the top edge, melt-droplets fall under gravity and fade, frost
        // shimmers along the edge. Time-driven; only while in the winter showcase.
        if self.static_mode {
            let now = ui.input(|i| i.time) as f32;
            self.ice.set_clock(now);
            let screen = ui.ctx().content_rect();
            let painter = ui.ctx().layer_painter(egui::LayerId::new(
                egui::Order::Foreground,
                egui::Id::new("skade_vinter_ice"),
            ));
            self.ice.paint(&painter, screen);
            ui.ctx().request_repaint();
        }

        // The About identity popup (shared common-framework surface). Decoded once on
        // first open, then the ONE shared render body (also driven by the robot test)
        // draws holger's logo + wordmark + version + the framework it is built on.
        if self.about_open {
            // Decode-once (guarded): an un-pulled LFS logo yields `None`, and the popup
            // shows its text identity without the hero image (never a panic).
            if !self.about_logo_tried {
                self.about_logo = crate::about::logo_texture(&ctx);
                self.about_logo_tried = true;
            }
            let logo = self.about_logo.clone();
            crate::about::draw_about_window(&ctx, &mut self.about_open, logo.as_ref());
        }

        // The command palette overlays everything (Ctrl-K / Ctrl-Shift-P). Built +
        // drawn LAST so its foreground scrim + search box land above the tabs, the
        // content, and the winter decor. A pick runs the same hook a click would.
        let commands = self.build_commands();
        if let Some(id) = self.palette.ui(&ctx, &commands) {
            self.dispatch_command(&id);
        }
    }

    /// Robot/harness entry: render the whole app from a bare `Context` (no eframe
    /// `Frame`), so `egui_kittest` / `nornir-robotui` can drive the real app:
    /// `Harness::builder().build_state(|ctx, app| app.draw_ui(ctx), app)`.
    pub fn draw_ui(&mut self, ctx: &egui::Context) {
        egui::CentralPanel::default().show(ctx, |ui| self.render(ui));
    }

    /// Skip the startup splash so headless/robot tests start on the tabs.
    pub fn skip_splash(&mut self) {
        self.splash_done = true;
    }

    /// The recovered hero logo as an egui texture — decode-once from the
    /// compiled-in [`HOLGER_LOGO_PNG`] (no runtime file read), then cached in
    /// `self.logo_texture` for the rest of the splash. Returns `None` only if the
    /// embedded PNG fails to decode (it never should — it's validated at build).
    fn splash_logo_texture(&mut self, ctx: &egui::Context) -> Option<egui::TextureHandle> {
        if let Some(tex) = &self.logo_texture {
            return Some(tex.clone());
        }
        let rgba = image::load_from_memory(HOLGER_LOGO_PNG).ok()?.to_rgba8();
        let size = [rgba.width() as usize, rgba.height() as usize];
        let color = egui::ColorImage::from_rgba_unmultiplied(size, rgba.as_raw());
        let tex = ctx.load_texture("holger-znippy-logo", color, egui::TextureOptions::LINEAR);
        self.logo_texture = Some(tex.clone());
        Some(tex)
    }
}

impl eframe::App for HolgerUiApp {
    fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
        self.render(ui);
    }
}

#[cfg(test)]
#[allow(deprecated)] // ctx.style()/run + CentralPanel::show are the headless-render path (mirrors facett's harness)
mod look_tests {
    //! Robot-UI cell for the unified facett look & feel (the "all consumers,
    //! holger too" migration). Runs only under `--features gui` (where `app`
    //! compiles). It drives the *real* holger-ui app's look surface headlessly and
    //! asserts its observable state — the active preset + a coherent palette — and
    //! that switching the preset actually re-themes every facett view via the
    //! published legacy palette (COH-1). No display, no GPU.
    //!
    //! LAW: inject real input + assert real output. We inject a concrete preset
    //! index (a "click" on the look switcher) and assert the rendered palette
    //! changes accordingly and that egui picked up the new style — never just
    //! "didn't panic".

    use super::*;
    use server_lib::exposed::fast_routes::FastRoutes;
    use server_lib::LocalHolger;
    use traits::HolgerObject;

    /// Emit one functional-status row for a real check. Gated behind
    /// `--features testmatrix` (this module already requires `gui`) so release
    /// builds strip it (the dep is optional).
    #[cfg(feature = "testmatrix")]
    fn fstatus(component: &str, check: &str, ok: bool, detail: &str) {
        nornir_testmatrix::functional_status(component, check, ok, detail);
    }

    /// A holger-ui app over an empty (no-repo) LocalHolger — enough to exercise
    /// the look surface, which is independent of the data layer.
    fn app() -> HolgerUiApp {
        let routes = FastRoutes::new(Vec::new());
        let holger: std::sync::Arc<dyn HolgerObject> = std::sync::Arc::new(LocalHolger::new(routes));
        let data = UiData::new(holger).expect("runtime");
        HolgerUiApp::new(data)
    }

    /// The Ctrl-K command palette is a real, headless-addressable surface: its
    /// command set carries every tab + tool + action, and firing a command id runs
    /// the same hook a click would (tab switch, tool select). Inject a command id,
    /// assert the observable state moved — never just "didn't panic".
    #[test]
    fn command_palette_dispatches_tabs_and_tools() {
        let mut app = app();

        // The command set is exposed as data (stable ids), tabs + tools + actions.
        let s = app.state_json();
        let ids: Vec<String> = s["palette"]["commands"]
            .as_array()
            .expect("palette exposes its command set")
            .iter()
            .map(|v| v.as_str().unwrap_or("").to_string())
            .collect();
        let has = |id: &str| ids.iter().any(|i| i == id);
        assert!(has("goto:browse"), "every tab is a command: {ids:?}");
        assert!(has("tool:security"), "every tool is a command: {ids:?}");
        assert!(has("action:refresh"), "actions are commands: {ids:?}");

        // Fire a tab command → the active tab moves (same path a click runs).
        app.run_command("goto:browse");
        assert_eq!(app.state_json()["tab"], "browse", "goto:browse switches the tab");

        // Fire a tool command → Tools tab + that tool selected, and the palette
        // records the fired id on its `invoked` observable.
        app.run_command("tool:security");
        let s = app.state_json();
        let dispatched = s["tab"] == "tools" && s["tool"] == "security";
        assert!(dispatched, "tool:security → Tools/Security: {s}");
        assert_eq!(s["palette"]["invoked"], "tool:security", "palette records the fired id");

        #[cfg(feature = "testmatrix")]
        fstatus(
            "holger-ui",
            "command_palette_dispatch",
            has("goto:browse") && dispatched,
            "goto:browse→browse, tool:security→tools/security",
        );
    }

    /// The right-click repo-row menu routes through the same navigation hooks a
    /// click/palette pick does: a row action selects the row and opens its tab.
    /// Inject the action, assert the observable tab/tool moved (not just "no panic").
    #[test]
    fn repo_row_context_action_navigates() {
        let mut app = app();
        // Scan → Tools/Security (select_repo(0) no-ops on the empty test roster, but
        // the navigation still applies — the action's contract is tab movement).
        app.apply_repo_row_nav(0, "row:scan");
        let s = app.state_json();
        let scan_ok = s["tab"] == "tools" && s["tool"] == "security";
        assert!(scan_ok, "row:scan → Tools/Security: {s}");
        // Archive → Archive tab.
        app.apply_repo_row_nav(0, "row:archive");
        let archive_ok = app.state_json()["tab"] == "archive";
        assert!(archive_ok, "row:archive → Archive tab");

        #[cfg(feature = "testmatrix")]
        fstatus(
            "holger-ui",
            "repo_row_context_action",
            scan_ok && archive_ok,
            "row:scan→tools/security, row:archive→archive",
        );
    }

    /// **About (shared common-framework identity surface).** The `Help · About holger`
    /// command opens the popup, and the app's `state_json.about` reports holger's
    /// identity — wordmark, a real version string, and the shared framework it is built
    /// on (incl. jera). Inject the command, assert the observable open flag flips AND
    /// the identity is present — never just "didn't panic". RED-when-broken: if the
    /// About wiring broke (command not dispatched / identity dropped) this fails.
    #[test]
    fn about_command_opens_popup_and_reports_identity_and_framework() {
        let mut app = app();

        // The About command is in the command set (Help group), and firing it opens
        // the popup — the same path the ℹ About button / menu runs.
        let ids: Vec<String> = app.state_json()["palette"]["commands"]
            .as_array()
            .expect("palette exposes commands")
            .iter()
            .map(|v| v.as_str().unwrap_or("").to_string())
            .collect();
        assert!(ids.iter().any(|i| i == "about:open"), "About is a command: {ids:?}");
        assert_eq!(app.state_json()["about"]["open"], serde_json::json!(false), "closed initially");

        app.run_command("about:open");
        let s = app.state_json();
        let opened = s["about"]["open"] == serde_json::json!(true);
        assert!(opened, "about:open opens the popup: {}", s["about"]);
        assert_eq!(s["about"]["wordmark"], "holger", "identity wordmark");
        let version = s["about"]["version"].as_str().unwrap_or("");
        assert!(!version.is_empty(), "About presents a real version string: {}", s["about"]);
        let fw: Vec<String> = s["about"]["framework"]
            .as_array()
            .expect("framework list")
            .iter()
            .map(|v| v.as_str().unwrap_or("").to_string())
            .collect();
        let names_jera = fw.iter().any(|c| c.contains("jera"));
        assert!(names_jera, "About names the shared jera job manager: {fw:?}");

        #[cfg(feature = "testmatrix")]
        fstatus(
            "holger-ui",
            "about_command_opens_and_reports_identity",
            opened && !version.is_empty() && names_jera,
            "Help·About opens the identity popup (wordmark/version/shared-framework incl. jera)",
        );
    }

    /// **Tool #6 demo appliance dispatches THROUGH jera.** Driving the demo tool (the
    /// same hook the pane's "Start demo appliance…" button runs) records the container
    /// bring-up as a jera job; the app's `state_json.demo_appliance` carries back the
    /// job id + the pinned demo image. Inject the dispatch, assert the observable job
    /// id is non-empty + the image is the demo registry — proof it went through the
    /// shared job manager, not a bespoke spawn. RED-when-broken: no job id / no dispatch.
    #[test]
    fn demo_tool_dispatches_a_jera_job_observably() {
        let mut app = app();
        assert!(app.state_json()["demo_appliance"].is_null(), "no dispatch yet");

        app.run_demo_tool();
        let s = app.state_json();
        assert_eq!(s["tool"], "demo", "the demo tool is selected");
        let d = &s["demo_appliance"];
        let job_id = d["job_id"].as_str().unwrap_or("");
        let dispatched = d["dispatched"].as_bool().unwrap_or(false);
        assert!(!job_id.is_empty(), "the demo dispatch records a jera job id: {d}");
        assert!(dispatched, "the demo is dispatched through jera: {d}");
        assert!(
            d["image"].as_str().unwrap_or("").contains("registry"),
            "the dispatched demo container is the registry image: {d}"
        );

        #[cfg(feature = "testmatrix")]
        fstatus(
            "holger-ui",
            "demo_tool_dispatches_jera_job",
            !job_id.is_empty() && dispatched,
            "Tools·Demo starts the demo container as a jera BOOT_CONTAINER job (observable job id)",
        );
    }

    /// The look surface exposes holger's collapsed roster (`dark`, `light`,
    /// `device`) and defaults to `dark` — the value an operator would see selected
    /// on first launch.
    #[test]
    fn default_preset_is_dark_and_roster_is_collapsed() {
        let app = app();
        let s = app.look_state_json();

        // The roster the switcher renders is holger's collapsed look list.
        let presets = s["presets"].as_array().expect("look state has a presets roster");
        let names: Vec<&str> = presets.iter().map(|p| p.as_str().unwrap_or("")).collect();
        assert_eq!(
            names,
            vec!["dark", "light", "device"],
            "the look switcher lists the collapsed roster: {s}"
        );

        // The active look is the default (`dark`) and matches the index.
        assert_eq!(s["preset"], "dark", "first-launch look is dark: {s}");
        assert_eq!(s["preset_index"].as_u64(), Some(default_look_preset() as u64));

        #[cfg(feature = "testmatrix")]
        fstatus(
            "holger-ui",
            "look_default_preset_and_roster",
            names == vec!["dark", "light", "device"]
                && s["preset"] == "dark"
                && s["preset_index"].as_u64() == Some(default_look_preset() as u64),
            &format!("roster {names:?}, default = dark"),
        );
    }

    /// Injecting a preset switch (the operator clicking "device") changes the
    /// active preset AND the resolved palette the facett views paint with — proof
    /// the migration re-themes coherently, not just that it stored an index.
    #[test]
    fn switching_preset_rethemes_the_resolved_palette() {
        let mut app = app();

        // Find device + dark by name so the test is order-stable.
        let names = look_names();
        let device = names.iter().position(|n| n == "device").expect("device look exists");
        let dark = names.iter().position(|n| n == "dark").expect("dark look exists");

        // Drive: select dark, capture its palette.
        let name = app.set_look_preset(dark);
        assert_eq!(name, "dark");
        let win_state = app.look_state_json();
        let win_bg = win_state["palette"]["bg"].clone();

        // Drive: select device (a click on the switcher), capture its palette.
        let name = app.set_look_preset(device);
        assert_eq!(name, "device");
        let dev_state = app.look_state_json();

        // Observe: the active preset + a different, fully-populated palette.
        assert_eq!(dev_state["preset"], "device", "active preset switched: {dev_state}");
        let dev_bg = dev_state["palette"]["bg"].clone();
        assert_ne!(win_bg, dev_bg, "device must paint a different surface than dark");

        // The palette is coherent — every role is a real hex colour, none empty.
        let roles = ["bg", "text", "text_dim", "accent", "panel_bg", "node_fill"];
        for role in roles {
            let c = dev_state["palette"][role].as_str().unwrap_or("");
            assert!(
                c.starts_with('#') && c.len() == 7,
                "palette role `{role}` must be a #rrggbb colour, got {c:?}: {dev_state}"
            );
        }
        let all_hex = roles.iter().all(|role| {
            let c = dev_state["palette"][role].as_str().unwrap_or("");
            c.starts_with('#') && c.len() == 7
        });
        let _ = all_hex;

        #[cfg(feature = "testmatrix")]
        fstatus(
            "holger-ui",
            "look_switch_rethemes_palette",
            dev_state["preset"] == "device" && win_bg != dev_bg && all_hex,
            &format!("windows-dark bg={win_bg} != device bg={dev_bg}, all 6 roles #rrggbb={all_hex}"),
        );
    }

    /// `apply` installs the preset's full egui Style AND publishes the derived
    /// legacy palette into the context, so every facett component (the Table
    /// facets) follows with no per-view wiring (COH-1). We apply headlessly and
    /// read the published palette back through `facett::theme(ui)`.
    #[test]
    fn apply_publishes_the_coherent_legacy_palette_into_egui() {
        let mut app = app();
        let device = look_names().iter().position(|n| n == "device").unwrap();
        app.set_look_preset(device);

        let ctx = egui::Context::default();
        app.apply_look(&ctx);

        // The egui Style picked up the preset's spacing (not egui's default).
        let theme = app.look_theme();
        assert_eq!(
            ctx.style().spacing.item_spacing,
            theme.metrics.item_spacing_vec(),
            "apply installed the preset's spacing into the egui Style"
        );

        // The legacy palette every facett view reads is the device preset's.
        let mut got = String::new();
        let _ = ctx.run(egui::RawInput::default(), |ctx| {
            egui::CentralPanel::default().show(ctx, |ui| {
                got = facett::theme(ui).name.to_string();
            });
        });
        assert_eq!(got, "device", "facett views resolve the applied preset's palette");

        #[cfg(feature = "testmatrix")]
        fstatus(
            "holger-ui",
            "look_apply_publishes_legacy_palette",
            ctx.style().spacing.item_spacing == theme.metrics.item_spacing_vec() && got == "device",
            &format!("egui spacing matches preset; facett::theme resolves \"{got}\""),
        );
    }
}