Extend protected release continuity surfaces

docs/v6_5_deep_manual_pack/HyperTwist/DEVELOPMENT.md

@@ -604,8 +604,9 @@ Latest same-day browser/distribution continuity follow-up still on `2026-06-24`:
   - dashboard auth-health and release-authority fallback continuity
   - public download and protected release-lane fallback continuity
 - the next same-family protected release follow-through packet now also keeps
-  the signed-in dashboard, protected download center, and protected account
-  lane on one shared release-action decision surface driven by:
+  the signed-in dashboard, protected download center, protected browser-access
+  lane, protected notices lane, and protected account lane on one shared
+  release-action decision surface driven by:
   - live manifest viewer entitlement
   - live checkout-target availability
   - configured packaged-release targets

docs/v6_5_deep_manual_pack/HyperTwist/ROADMAP.md

@@ -296,11 +296,13 @@ Current consolidated milestone snapshot:
   snapshot from that fresher manifest viewer truth and the protected dashboard
   plus account surfaces now surface a compact live-authority sync notice
   summarizing what changed, and the protected dashboard, protected
-  `/app/downloads`, and protected account lane now also resolve that same live
-  manifest plus checkout truth into one explicit operator-facing release-action
-  surface that chooses between direct package download, checkout or
-  provisioning, notices or release follow-through, and degraded-authority
-  recovery instead of leaving the next move implicit across separate panels,
+  `/app/downloads`, protected `/app/browser-access`, protected
+  `/app/notices`, and protected account lane now also resolve that same live
+  manifest plus checkout truth into one explicit operator-facing
+  release-action surface that chooses between direct package download,
+  checkout or provisioning, notices or release follow-through, and
+  degraded-authority recovery instead of leaving the next move implicit across
+  separate panels,
   and the same auth layer now also clears stale
   stored sessions when shared auth is configured and `/api/auth/me` returns
   `401` instead of preserving a false authenticated protected-shell posture,

website/src/__tests__/protected-app-pages.test.tsx

@@ -191,6 +191,8 @@ describe('protected app pages', () => {
     renderPage(<BrowserAccessPage />, '/app/browser-access')
 
     expect(await screen.findByText('Current browser posture')).toBeTruthy()
+    expect(screen.getByText('Current release action')).toBeTruthy()
+    expect((await screen.findByRole('link', { name: 'Download Windows package' })).getAttribute('href')).toBe('https://downloads.hypertwist.app/windows.exe')
     expect(screen.getByText('Current packaged desktop proof')).toBeTruthy()
     expect(screen.getByText('Packaged validation passed')).toBeTruthy()
     expect(screen.getByText(/Magic120Cell dedicated-family training map: passed/i)).toBeTruthy()
@@ -257,6 +259,8 @@ describe('protected app pages', () => {
     renderPage(<NoticesPage />, '/app/notices')
 
     expect(await screen.findByText('Distribution notices')).toBeTruthy()
+    expect(screen.getByText('Current release action')).toBeTruthy()
+    expect((await screen.findByRole('link', { name: 'Download Windows package' })).getAttribute('href')).toBe('https://downloads.hypertwist.app/windows.exe')
     expect(screen.getByText('Current packaged desktop proof')).toBeTruthy()
     expect(screen.getByText('Packaged validation passed')).toBeTruthy()
     expect(screen.getByText('Protected browser-versus-desktop reality')).toBeTruthy()

website/src/pages/app-pages.tsx

@@ -1403,6 +1403,12 @@ export function BrowserAccessPage() {
             </Link>
           </div>
         </Panel>
+        <ProtectedReleaseActionPanel
+          title="Current release action"
+          kicker="Protected access guidance"
+          releaseManifest={releaseManifest}
+          releaseAuthorityUnavailable={releaseManifestQuery.isError}
+        />
         <ProtectedBrowserDesktopRealityPanel
           title="Protected browser-versus-desktop reality"
           kicker="Signed-in product boundary"
@@ -1642,6 +1648,12 @@ export function NoticesPage() {
             <li>Corresponding-source URL: {releaseManifest.corresponding_source_url || 'configure the corresponding-source URL before public launch'}</li>
           </ul>
         </Panel>
+        <ProtectedReleaseActionPanel
+          title="Current release action"
+          kicker="Protected access guidance"
+          releaseManifest={releaseManifest}
+          releaseAuthorityUnavailable={releaseManifestQuery.isError}
+        />
         <Panel title="Operator obligations" kicker="Keep aligned">
           <ul className="list">
             <li>Keep pricing, download, and notices surfaces aligned whenever a public downloadable build is offered.</li>