Host detail page + pipeline timeline

Click a tile to open /hosts/{id} — the canonical control surface per
host. Timeline renders every pre-stage, stage, and terminal node in
order, with the current one pulsing, failed ones flagged, and
downstream ones dimmed as skipped. Detail page shows summary, hold
card (when holding), all action buttons, spec diffs, a full-height
log pane, and a collapsed expected-spec YAML.

Tile slims to name, last-seen, status, and one primary action; a
CSS-overlay <a> makes the whole card clickable while buttons stay
receptive via z-index.

Runner.publishTileUpdate now also emits pipeline-{runID} fragments,
and CompleteStage wraps Stages.CompleteByName so stage completions
advance the timeline live — without this the dots only moved on
state transitions.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/orchestrator/runner.go

@@ -50,6 +50,21 @@ func (r *Runner) StartStage(ctx context.Context, runID int64, name string) error
 	return nil
 }
 
+// CompleteStage marks a stage row passed/failed/skipped and publishes a
+// tile + pipeline refresh. Wrapper around Stages.CompleteByName so every
+// stage completion triggers an SSE update — without this, stage dots on
+// the pipeline wouldn't advance until the next run-state transition.
+func (r *Runner) CompleteStage(ctx context.Context, runID int64, name string, state model.StageState, summaryJSON string) error {
+	if err := r.Stages.CompleteByName(ctx, runID, name, state, summaryJSON); err != nil {
+		return err
+	}
+	run, err := r.Runs.Get(ctx, runID)
+	if err == nil {
+		r.publishTileUpdate(ctx, run.HostID)
+	}
+	return nil
+}
+
 // PublishTileUpdate is the exported entry point for non-orchestrator
 // callers (the UI heartbeat handler) that change tile-visible state
 // without going through Transition.
@@ -70,6 +85,19 @@ func (r *Runner) publishTileUpdate(ctx context.Context, hostID int64) {
 	}
 	payload := renderTileSSE(ctx, *host, latest)
 	r.EventHub.Publish(events.Event{Name: fmt.Sprintf("tile-%d", hostID), Payload: payload})
+
+	// Pipeline fragment — same call sites as the tile refresh, keyed by
+	// run ID so the detail page's <section sse-swap="pipeline-N"> picks
+	// it up. Silently skips when no renderer is wired or no run exists.
+	if latest != nil && PipelineRenderer != nil && r.Stages != nil {
+		stages, err := r.Stages.ListForRun(ctx, latest.ID)
+		if err != nil {
+			log.Printf("publishTileUpdate: list stages run %d: %v", latest.ID, err)
+			return
+		}
+		pipePayload := PipelineRenderer(latest, stages)
+		r.EventHub.Publish(events.Event{Name: fmt.Sprintf("pipeline-%d", latest.ID), Payload: pipePayload})
+	}
 }
 
 // TileRenderer renders a single tile fragment. Registered at startup
@@ -79,6 +107,11 @@ func (r *Runner) publishTileUpdate(ctx context.Context, hostID int64) {
 // template package.
 var TileRenderer func(ctx context.Context, host model.Host, latest *model.Run) string
 
+// PipelineRenderer renders the detail-page pipeline fragment for the
+// given run + its stage rows. Registered alongside TileRenderer so
+// orchestrator stays free of template imports.
+var PipelineRenderer func(run *model.Run, stages []model.Stage) string
+
 func renderTileSSE(ctx context.Context, host model.Host, latest *model.Run) string {
 	if TileRenderer == nil {
 		return fmt.Sprintf(`<article id="host-%d">state change</article>`, host.ID)