fix: the hosted app pages follow the app, search leaves decision records out, and code runs wider than prose

README.md

@@ -57,6 +57,8 @@ Every page has one title and one description. The pages read from the action tak
 
 The share image, `share.png`, is Penny's `in-sync` header in light from the action's `assets/mascot` at the pinned tag, placed on a 1200 by 630 ground and rendered with resvg on every build (`src/lib/share-image.ts`). A new release of the art changes it with no work here.
 
+The site's own search (Pagefind) leaves the decision records out: `outOfSearch` in `src/lib/site.ts` names them, and the loader sets `pagefind: false` on each. They are most of the pages and use the product's words more than the guides do, so with them in the index a search for "tick" or "drift" answered with records. Weighing them down was tried first and does not work in Pagefind: a title match is boosted apart from a page's weight. The list of records stays in the index, so "decision records" or a record's number finds it, and search engines still index every record. `test/search.test.ts` asks the built index the questions a new user types.
+
 The sitemap (`sitemap-index.xml`) and `robots.txt` follow `DOCS_SITE` and `DOCS_BASE`. The pages in `UNLISTED` in `src/lib/site.ts` (the 404 and the style check) carry `noindex` and stay out of the sitemap. `test/built-site.test.ts` checks all of this in `dist/`.
 
 The `lighthouse` job in CI builds with the production address and runs Lighthouse three times on each URL in `lighthouserc.json`, as a phone. It fails when a median score for performance, accessibility, best practices or SEO is under 90 on any of them, and keeps the reports as the `lighthouse` artifact. To run it locally you need Chrome:

src/content/docs/get-started.mdx

@@ -87,9 +87,10 @@ accept, everything the pull request holds, and what to do when there is none.
 ## Tick
 
 Tick a stack's box on the dashboard issue, or in the console on the repo's Dashboard tab. The app
-picks the tick up within about a second, judges it with the action's own tick rule, opens the
-deployment record and starts your workflow. Your runner previews the stack again and deploys only
-when the change is the one you ticked.
+picks a tick on the issue up within about a second. A tick in the console holds five seconds
+first, with an **Undo** button. The app then judges the tick with the action's own tick rule,
+opens the deployment record and starts your workflow. Your runner previews the stack again and
+deploys only when the change is the one you ticked.
 
 <a href={ROUTES.usingTheDashboard}>Using the dashboard</a> explains the rows and the boxes, and
 <a href={page("hosted-app/using-the-app")}>Using the app</a> the console.

src/content/docs/hosted-app/install.mdx

@@ -57,6 +57,10 @@ count toward your plan. See <a href={page("hosted-app/plans")}>Plans and adopted
 
 These are the permissions the app asks for, and what each one is used for.
 
+This table is being corrected: the app's registration on GitHub is being fixed for Workflows,
+Checks and Members, and the table will follow what GitHub shows on a real install, so until
+then go by GitHub's own screen where the two differ.
+
 | Permission | Access | What for |
 | --- | --- | --- |
 | Metadata | Read | Required by GitHub for every app. |
@@ -170,7 +174,8 @@ deployment records your workflow deploys. With `sluiceway[bot]` on it:
   preview gives the same diff hash and value fingerprint, as for any tick.
 
 Ticking and Rescan from the app work in a repo whose `sluiceway.yaml` names `sluiceway[bot]` in
-`recordWriters`, and in any other repo they open the dashboard on GitHub.
+`recordWriters`. In any other repo a box opens the dashboard on GitHub, and the rescan box is
+there too.
 
 It allows nothing else. The app cannot deploy a stack nobody ticked, and a stack that deletes
 or replaces resources still waits for a person's tick.

src/content/docs/hosted-app/plans.mdx

@@ -56,24 +56,33 @@ The adopted repos past the line are listed greyed out, in a group of their own c
 free tier, or past your plan's name:
 
 - **The org view** lists each by name with its state counts, and no stacks or rows.
-- **Their own pages** are not shown, so Rescan for them opens the dashboard on GitHub.
+- **Their own pages** show the repo's name, its state counts, **Open the dashboard on GitHub**
+  and **Choose the active repos**, and no stacks. Their rescan box is on that dashboard.
 - **The audit log** says how many lines each one has, and not the lines. The CSV holds what the
   page shows.
 - **Insights** name each one with its deploys, and do not count them.
 
 <Callout kind="note" title="Nothing about deploying changes">
   A repo past the line keeps its dashboard on GitHub, and it works as always: scans, ticks and
-  deploys go on exactly as they did. The app keeps its facts, and shows them again as soon as
-  the repo is active.
+  deploys go on exactly as they did. The app keeps its facts as it does for an active repo, and
+  shows them again as soon as the repo is active.
 </Callout>
 
 ## History
 
 The audit log shows the deploys inside your plan's history, and its last sentence says how far
-back that is and on which plan. Nothing is deleted at the line: when your plan grows, the older
-lines are shown again.
+back that is and on which plan. What is older than your plan's history is deleted, each night.
+A bigger plan keeps more from the day it starts. It does not bring back lines that were deleted
+before it.
 
-Insights always cover the last 12 weeks against the 12 before, on every plan.
+One thing is kept whatever its age: the newest state of each stack, with its last deploy, so
+the Overview tab can always draw the row.
+
+Insights cover 12 weeks against the 12 before, and 6 months or 1 year on a plan whose history
+covers them. On Free only the last 30 days have their numbers.
+
+<a href={page("hosted-app/what-the-app-keeps#how-long-it-keeps-it")}>How long it keeps it</a>
+has every window in one list.
 
 ## Upgrade
 
@@ -87,8 +96,8 @@ line. Choose a plan, monthly or yearly, and pay on Stripe's Checkout page. There
 
 - **VAT**: Stripe works out the tax from your billing address. A business in the EU can enter
   its VAT id.
-- **A promotion code** goes in on the Checkout page. A code that brings the price to 0 needs no
-  card, and the Plan section names the code.
+- **A promotion code** goes in on the Checkout page of a monthly plan. The yearly Checkout takes
+  none. A code that brings the price to 0 needs no card, and the Plan section names the code.
 
 You come back to Settings, which says Stripe is confirming the payment until it has.
 
@@ -98,9 +107,11 @@ You come back to Settings, which says Stripe is confirming the payment until it
 Team Plus or monthly and yearly, update your card, read your invoices, or cancel there.
 
 When you cancel, or a payment fails, your plan holds until the end of the period you paid for,
-and the installation falls back to Free after it. Nothing is deleted: the app shows what Free
-shows, and shows the rest again if a plan starts again. Settings says when your plan renews or
-ends, and what then happens.
+and the installation falls back to Free after it. The app then shows what Free shows, and
+keeps the wider history for 30 days more. Start a paid plan again within those 30 days and
+nothing is lost. After them, the lines older than Free's history are deleted. A move to a
+smaller plan keeps its wider history for 30 days in the same way. Settings says when your plan
+renews or ends, and the day the older lines are deleted.
 
 To pay by invoice, write to <a href="mailto:hello@sluiceway.dev">hello@sluiceway.dev</a>. An
 invoice plan is changed the same way.

src/content/docs/hosted-app/using-the-app.mdx

@@ -14,8 +14,9 @@ import { glossary, page, ROUTES } from "../../../lib/routes";
 </p>
 
 Sign in at <a href="https://console.sluiceway.dev/">console.sluiceway.dev</a> with GitHub. The app reads
-which installations you may see once, when you sign in, and keeps no token of yours. A session
-lasts eight hours, so a change of your membership on GitHub shows at your next sign-in.
+which installations and repos you may see when you sign in, and keeps no token of yours. A
+session lasts 30 days from the last day you used it. While you use it, the app asks GitHub
+again every hour, so a change of your membership on GitHub shows within the hour.
 
 The top bar shows where you are, an org or one of its repos, and switches between them. An org
 has the tabs Overview, Insights, Audit and Settings. A repo has Dashboard, Insights and Audit.
@@ -32,10 +33,10 @@ The org's Overview tab is every stack of every repo the app covers, at `console.
   sync, folded. Or By repo, one panel per repo.
 
 A row is one link to its repo. It says what the dashboard's row says, without the changes: the
-state, how many resources it deletes or replaces, drift outside the code, and the stack's last
-deploy with who <a href={glossary("Ticker")}>ticked</a> it or merged it, the commit and the run.
-A deploy the dashboard's trail lists as an <a href={glossary("Outside deploy")}>outside deploy</a>
-is marked "deployed outside the dashboard".
+state, how many resources it deletes or replaces, drift outside the code, and how the stack's
+last deploy ended, with who <a href={glossary("Ticker")}>ticked</a> it or merged it. A deploy the
+dashboard's trail lists as an <a href={glossary("Outside deploy")}>outside deploy</a> is marked
+"deployed outside the dashboard", with its short commit, and names nobody.
 
 Under the stacks:
 
@@ -50,7 +51,9 @@ Under the stacks:
 
 The Dashboard tab is the repo's dashboard issue drawn again, in the same order, with the same
 headings and sentences, <a href={ROUTES.theHeader}>Penny's header</a> included. The app draws
-it with the action's own renderer, at the version these docs describe, from the facts it keeps.
+it with the action's own renderer, from the facts it keeps. It carries a release of the action
+of its own, which can be older than the one these docs describe, so a sentence that a newer
+release words differently reads in the console as that older release wrote it.
 
 The app keeps no diff, so a pending or drifted row is drawn the way a
 <a href={glossary("Redact")}>redacted</a> row is: its counts and no change lines. The changes
@@ -93,7 +96,8 @@ A <a href={glossary("Read-only dashboard")}>read-only dashboard</a> has no boxes
 on GitHub.
 
 Ticking and Rescan from the app work in a repo whose `sluiceway.yaml` names `sluiceway[bot]` in
-`recordWriters`, and in any other repo they open the dashboard on GitHub.
+`recordWriters`. In any other repo a box opens the dashboard on GitHub, and the rescan box is
+there too.
 
 You can also tick and rescan from a terminal, or have a coding agent do it with a token you
 make: <a href={page("hosted-app/command-line")}>the command line</a> asks the app, which judges
@@ -109,13 +113,17 @@ The app starts your workflow, which runs a full scan, and the rescan box on the
 unticked. A rescan deploys nothing, so it is asked at once, with no Undo. The toast says "Asked
 GitHub to scan" and the repo's name. Asking again while that scan runs starts nothing new.
 
-On a repo that does not name the app in `recordWriters`, and on one past your plan, Rescan opens
-the dashboard on GitHub, where the rescan box is.
+The button is drawn only where the app can ask for the scan. A repo that does not name the app
+in `recordWriters`, and one past your plan, has no Rescan on its own pages: its rescan box is on
+its dashboard on GitHub. The org's Rescan menu lists every adopted repo, one that the app scans
+as "Rescans here" and any other as "Rescan on GitHub", which is a link to that dashboard.
 
 ## Insights
 
-Insights, for an org or for one repo, cover the last 12 weeks, from Monday in UTC, each number
-against the 12 weeks before.
+Insights, for an org or for one repo, cover a window you choose: 12 weeks, and 6 months or
+1 year where your plan's history covers them. Weeks start on Monday in UTC, and each number is
+set against the same span before it. On Free the app keeps 30 days of history, so only the last
+weeks have their numbers.
 
 - **Lead time**: from the merge of a pull request to the deploy of its merge commit, the median.
   A deploy of a commit with no merged pull request, such as a direct push, is not measured.
@@ -125,25 +133,30 @@ against the 12 weeks before.
 
 Four charts show lead time per week, deploys per week, stacks drifted per week, and where the
 time goes between a merge and its deploy: to the scan, to the preview, waiting for a tick, and
-the deploy itself. The org's Insights end with one row per repo.
+the deploy itself. The org's Insights end with a table of the repos that had deploys in the
+window, and one sentence that names the repos with none.
 
 A number the facts cannot give says "Not measured yet" in one sentence, with no number.
 
 ## The audit log
 
 The Audit tab lists one line per deploy, newest first: when, the repo, the stack, who ticked or
 who merged, the commit, and the result in the trail's words. A deploy outside the dashboard is
-flagged in red, "outside the dashboard", and names nobody, because the tool's history never says
-who.
+flagged in bold after its result, "⚠ outside the dashboard", and names nobody, because the tool's
+history never says who.
 
 A tick from <a href={page("hosted-app/command-line")}>the command line</a> counts as the person
 whose token it used, and its line says "via the command line".
 
-Filter by repo, by stack or to the flagged lines only. Each filter is a plain link, so a filtered
-log has an address you can paste into a ticket. **CSV** downloads what the page shows, with the
-same filters, the time in UTC and the whole commit.
+The buttons above the log filter it: every deploy, the flagged lines only, and from the org, one
+repo. There is no button for one stack: add `?stack=` and the stack id to the address. Every
+filter is part of the address, so a filtered log can be pasted into a ticket. **Download CSV**
+downloads what the page shows, with the same filters, the time in UTC and the whole commit.
 
-The log goes back as far as your plan's history, and its last sentence says how far.
+The log shows one month at a time, the newest first, with **Older** and **Newer** under it. It
+goes back as far as your plan's history, and its last sentence says how far. What is older than
+that is deleted each night: see
+<a href={page("hosted-app/what-the-app-keeps#how-long-it-keeps-it")}>How long it keeps it</a>.
 
 ## Edit mode
 
@@ -154,10 +167,25 @@ the settings of the block you select beside it. Every change redraws the dashboa
 Every setting is a documented key of `sluiceway.yaml` that the action reads without the app. What
 you build keeps working exactly the same if you stop using the app.
 
-- **The dashboard**: `dashboard.title`, `personality` (Penny's header), `redact`, `showValues`,
-  `recentlyDeployed`, `timeZone` and `readOnly`, and `drift.enabled`.
+Select a block of the dashboard, and its own settings open:
+
+- **Header picture**: `personality`, Penny's header and voice.
+- **Title** and **Counts line**: `dashboard.title`, and whether a count of 0 is shown.
+- **A section**: drag it to move it, and turn it on or off where the action has a key for that.
+  Pending and Preview failed cannot be hidden.
+- **Pending**: Row detail, which is how much a pending row shows, the Caution that names
+  destroys, the Deploy all box, and `showValues`.
+- **Drifted**: the Repair all box.
+- **In sync**: the `ignore` list with its reasons.
+- **Recently deployed**: `recentlyDeployed` and `timeZone`.
+- **Rescan box** and **Footer**: each on or off.
+
+Under **The whole dashboard** are the settings that belong to no block:
+
+- **The dashboard**: `dashboard.title`, `redact`, `readOnly` and `drift.enabled`.
+- **Templates**, below.
 - **Who may tick**: `tickers`, and `recordWriters` as the app on the list or off it.
-- **Stacks**: per stack, `deploy` and `tickers`, and the `ignore` list with its reasons.
+- **Stacks**: per stack, `deploy` and `tickers`.
 
 A setting at its default takes its key out of the file. See
 <a href={page("guides/configuration")}>Configuration</a> for what each key does.
@@ -167,16 +195,23 @@ A setting at its default takes its key out of the file. See
 A template is a named set of those keys, applied in one click over the settings you have, and
 adjusted after. It touches no key it does not name.
 
-- **Minimal**: `personality` off, rows redacted, and the last 3 deploys in the trail.
-- **Classic**: every dashboard key and drift at the action's defaults.
-- **Ops desk**: the last 30 deploys in the trail and drift on. Set your time zone yourself.
+- **Minimal**: `personality` off, a pending row cut to its first line and what must be seen,
+  the In sync section off, no count of 0, and the last 3 deploys in the trail.
+- **Classic**: every dashboard key, the layout and drift at the action's defaults.
+- **Ops desk**: the last 30 deploys in the trail, drift on, every line of a pending row and
+  every count. Set your time zone yourself.
+
+No template turns `redact` on. To keep resource names and values off the issue, set Redact
+yourself, under The dashboard.
 
-### Save opens a pull request
+### A change is a pull request
 
-**Save** opens one pull request on the branch `sluiceway/dashboard`, from the commit the dashboard
-was scanned at. It changes `sluiceway.yaml` and nothing else, keeps every other key and every
-comment as they were, and its description names each change and shows the dashboard as it will
-look. A person merges it, and the next scan draws the dashboard that way.
+A bar above the dashboard counts your changes, with **Discard** and **Review pull request**.
+Review shows the pull request before it exists: its title, its branch, `sluiceway/dashboard`,
+and the diff of `sluiceway.yaml`. **Open the pull request** then opens it, from the commit the
+dashboard was scanned at. It changes `sluiceway.yaml` and nothing else, keeps every other key and
+every comment as they were, and its description names each change and shows the dashboard as it
+will look. A person merges it, and the next scan draws the dashboard that way.
 
 The app never changes the file behind anyone's back. While a pull request from edit mode is open,
 the app names it rather than open a second one. When the file moved on the default branch since
@@ -193,5 +228,10 @@ The org's Settings tab holds what the app decides, and nothing that belongs in `
 - **Active repos**: which adopted repos your plan shows.
 - **The installation**: the repos the app is installed on, with a link to GitHub's page to change
   them.
-- **Access per repo**: whether each adopted repo names the app in `recordWriters`, with a button
-  that opens the one-line pull request to add it or take it out.
+- **The app's access**: whether each adopted repo names the app in `recordWriters`, with a button
+  that opens the pull request to add it or take it out.
+- **Second approver**: what your plan does with the Sluiceway protection rule, and who may
+  approve. See <a href={page("hosted-app/plans")}>Plans and adopted repos</a>.
+- **Delete everything**, last and apart: an admin of the org, or the person whose account it is,
+  deletes all the app keeps of the installation at once. See
+  <a href={page("hosted-app/what-the-app-keeps#if-you-stop-using-the-app")}>If you stop using the app</a>.