diff --git a/apps/web/README.md b/apps/web/README.md
index 126470d..eb987db 100644
--- a/apps/web/README.md
+++ b/apps/web/README.md
@@ -133,7 +133,9 @@ Phase 14 is not implemented as a live outreach workflow. The current static clie
## Remaining limitations
-The static client has no client-side crawler, scanner, contact extractor, enrichment scheduler, outreach integration, availability provider, or SSE delivery. It can display server-provided Phase 9 observations, but production still requires server-side official-site scoping, SSRF/DNS-rebinding/redirect controls, hard extraction/page/byte/time/candidate budgets, durable history/cache isolation and retention/deletion, abuse/rate controls, suppression regression tests, and authenticated provenance/audit coverage. For domain intelligence, display registrable-domain/PSL version and unresolved reasons, DNS status and freshness/TTL (not “available”), independent MX/NS/TXT uncertainty, and association confidence with explainable evidence. Never auto-attach candidate domains or treat `nxdomain`/`no_data` as availability. CSV preview is capped for display and is not an import workflow.
+The Discovery Runs workspace is a static client over the existing authenticated contracts: `POST /api/v1/discovery` creates a bounded run, `GET /api/v1/discovery-runs` lists run history, and `GET /api/v1/jobs/{id}` supplies progress/events. It sends category/geography criteria, selected approved source IDs, max records, daily limit, schedule metadata, dry-run intent, optional seeds, and an idempotency key. The UI polls persisted job state, renders independently scrollable logs, metrics, partial/error states, and source-health telemetry when returned. CSV/manual source management continues to use `GET/POST/PATCH /api/v1/sources`, `POST /api/v1/sources/{id}/test`, and `GET /api/v1/source-records`; provider configuration remains read/write-only through the existing AI provider routes.
+
+Pause/resume and per-source retry/circuit buttons are deliberately fail-closed because the current backend exposes no matching mutation routes. The UI documents the expected future names (`POST /api/v1/jobs/{id}/pause`, `POST /api/v1/jobs/{id}/resume`, and source-run retry/circuit endpoints) instead of pretending those actions succeeded. Cancel uses the existing `POST /api/v1/jobs/{id}/cancel` contract. Prospect explorer filters use server query fields where available and apply safe client-side matching for returned source, geography, category, website/domain, and contact fields. The browser never fetches targets or stores secrets in localStorage.
## Phase 13 optional AI assistance UI contract
diff --git a/apps/web/app.js b/apps/web/app.js
index ccf5013..2b1a38c 100644
--- a/apps/web/app.js
+++ b/apps/web/app.js
@@ -6,14 +6,14 @@
const endpoint = (path) => `${API_BASE}${path}`;
let prospects = [], selectedId = null, selectedDetail = null, currentUser = null;
let page = 1, pageSize = 10, hasNextPage = false, savedFilters = [], reviewQueue = [], selectedReviewIds = new Set();
- const filterKeys = ['q','score','status','website_class','pipeline_stage','freshness'];
+ const filterKeys = ['q','score','status','website_class','pipeline_stage','freshness','source','geography','category','contact_status'];
const reviewItems = payload => payloadItems(payload, ['items','businesses','prospects','queue']);
const savedItems = payload => payloadItems(payload, ['items','saved_filters','filters','views']);
const apiError = error => error?.message || 'Request failed.';
function setExplorerState(text='', error=false){const el=$('explorerState');if(el){el.textContent=text;el.className=`explorer-state${error?' error':''}`;}}
function setSavedMessage(text,error=false){const el=$('savedFilterMessage');if(el){el.textContent=text;el.className=`form-message${error?' error':''}`;}}
function currentFilters(){return filterValues();}
- function applyFilters(filters={}){filterKeys.forEach(key=>{const id={q:'searchInput',score:'scoreFilter',status:'statusFilter',website_class:'websiteClassFilter',pipeline_stage:'pipelineFilter'}[key];if(filters[key]!==undefined&&$(id))$(id).value=filters[key];});if($('explorerState'))$('explorerState').dataset.filter=filters.freshness||'all';page=1;loadData();}
+ function applyFilters(filters={}){filterKeys.forEach(key=>{const id={q:'searchInput',score:'scoreFilter',status:'statusFilter',website_class:'websiteClassFilter',pipeline_stage:'pipelineFilter',source:'sourceFilter',geography:'geographyFilter',category:'categoryFilter',contact_status:'contactStatusFilter'}[key];if(filters[key]!==undefined&&$(id))$(id).value=filters[key];});if($('explorerState'))$('explorerState').dataset.filter=filters.freshness||'all';page=1;loadData();}
function selectedReviewProspects(){return [...selectedReviewIds].filter(id=>reviewQueue.some(p=>String(p.id)===String(id)));}
function updateBulkState(){const count=selectedReviewProspects().length; if($('selectedReviewCount'))$('selectedReviewCount').textContent=`${count} selected`;['bulkVerifyBtn','bulkRejectBtn'].forEach(id=>{if($(id))$(id).disabled=!count;});if($('selectAllReview'))$('selectAllReview').checked=Boolean(reviewQueue.length&&count===reviewQueue.length);}
function renderReviewQueue(payload){reviewQueue=reviewItems(payload).slice(0,100);$('reviewQueueCount').textContent=Number(payload?.count??payload?.total??reviewQueue.length);const state=$('reviewQueueState');if(!state)return;if(!reviewQueue.length){state.innerHTML='
No prospects currently require human review.
';updateBulkState();return;}state.innerHTML=`
${reviewQueue.map(p=>``).join('')}
Showing up to 100 queued prospects. Bulk actions apply only to selected visible records.
`;updateBulkState();}
@@ -37,12 +37,13 @@
function showLogin(message=''){currentUser=null;$('dashboardShell').hidden=true;$('loginScreen').hidden=false;$('loginMessage').textContent=message;$('loginMessage').className=`form-message${message?' error':''}`;}
function showDashboard(user){currentUser=user||{};const name=currentUser.name||currentUser.full_name||currentUser.email||'Workspace member';const role=currentUser.role||currentUser.roles?.[0]||'Member';$('userIdentity').textContent=`${name} · ${role}`;$('userAvatar').textContent=name.split(/\s+/).map(x=>x[0]).join('').slice(0,2).toUpperCase();$('loginScreen').hidden=true;$('dashboardShell').hidden=false;updateJobPermissions();}
function renderMetrics(summary){const total=Number(summary?.businesses??summary?.total??prospects.length),high=Number(summary?.high_fit??summary?.high_fit_count??prospects.filter(p=>scoreFor(p)>=80).length),review=Number(summary?.needs_review??summary?.review_count??prospects.filter(p=>statusOf(p)==='review').length),suppressed=Number(summary?.suppressed??summary?.suppressed_count??prospects.filter(p=>statusOf(p)==='suppressed').length),fresh=prospects.length?Math.round(prospects.filter(p=>freshness(p).cls==='good').length/prospects.length*100):0;$('metricTotal').textContent=total;$('heroCount').textContent=`${total} prospects`;$('metricReview').textContent=review;$('metricHigh').textContent=high;$('metricFresh').textContent=`${summary?.freshness_under_7d??summary?.fresh_count??fresh}%`;if($('metricSuppressed'))$('metricSuppressed').textContent=suppressed;}
- function filterValues(){return {q:$('searchInput').value.trim(),score:$('scoreFilter').value,status:$('statusFilter').value,website_class:$('websiteClassFilter').value,pipeline_stage:$('pipelineFilter').value,freshness:$('explorerState')?.dataset?.filter||'all'};}
- function filtered(){const {q,score:sf,status:st,website_class:wc,pipeline_stage:ps,freshness}=filterValues();return prospects.filter(p=>{const s=scoreFor(p),text=`${p.name} ${p.website_domain||p.website||''} ${p.location||''}`.toLowerCase(),stage=p.pipeline_stage||p.pipeline?.stage||(Array.isArray(p.pipeline)?p.pipeline.at(-1)?.stage:'')||'new';return(!q||text.includes(q.toLowerCase()))&&(sf==='all'||(sf==='high'&&s>=80)||(sf==='medium'&&s>=60&&s<80)||(sf==='low'&&s<60))&&(st==='all'||statusOf(p)===st)&&(wc==='all'||(p.website_class||'missing')===wc)&&(ps==='all'||stage===ps)&&(freshness!=='under_7d'||freshnessValue(p));});}
+ function filterValues(){return {q:$('searchInput').value.trim(),score:$('scoreFilter').value,status:$('statusFilter').value,website_class:$('websiteClassFilter').value,pipeline_stage:$('pipelineFilter').value,source:$('sourceFilter')?.value||'all',geography:$('geographyFilter')?.value||'all',category:$('categoryFilter')?.value||'all',contact_status:$('contactStatusFilter')?.value||'all',freshness:$('explorerState')?.dataset?.filter||'all'};}
+ function filtered(){const {q,score:sf,status:st,website_class:wc,pipeline_stage:ps,source,geography,category,contact_status,freshness}=filterValues();return prospects.filter(p=>{const s=scoreFor(p),text=`${p.name} ${p.website_domain||p.website||''} ${p.location||''}`.toLowerCase(),stage=p.pipeline_stage||p.pipeline?.stage||(Array.isArray(p.pipeline)?p.pipeline.at(-1)?.stage:'')||'new',contacts=p.contacts||p.contact_extractions||[], pSource=String(p.source_name||p.source||p.source_id||'all'), geo=String(p.city||p.province||p.country||p.location||'all'), cat=String(p.category||p.industry||p.categories?.[0]||'all'), contactState=contacts.length||p.email||p.phone?'present':statusOf(p)==='suppressed'?'suppressed':'missing';return(!q||text.includes(q.toLowerCase()))&&(source==='all'||pSource===source||String(p.source_id)===source)&&(geography==='all'||geo.toLowerCase().includes(geography.toLowerCase()))&&(category==='all'||cat===category)&&(contact_status==='all'||contactState===contact_status)&&(sf==='all'||(sf==='high'&&s>=80)||(sf==='medium'&&s>=60&&s<80)||(sf==='low'&&s<60))&&(st==='all'||statusOf(p)===st)&&(wc==='all'||(p.website_class||'missing')===wc)&&(ps==='all'||stage===ps)&&(freshness!=='under_7d'||freshnessValue(p));});}
const freshnessValue=p=>freshness(p).cls==='good';
function renderRows(){const rows=filtered();$('resultCount').textContent=`Showing ${rows.length} prospect${rows.length===1?'':'s'} · page ${page}`;$('prospectRows').innerHTML=rows.length?rows.map(p=>{const s=scoreFor(p),f=freshness(p),st=statusOf(p),factors=p.score_factors||p.factors||[];return `
' + esc(job?.error?.message || job?.message || run.error || 'The job returned no safe result.') + '
' : '') + stats + health + '
Run log
' + log + '
Results
' + cards + '
';
+ }
+ async function discoveryAction(action,run){ if(action==='pause'||action==='resume'){message('directDiscoveryMessage',`${action[0].toUpperCase()+action.slice(1)} is not available in the current backend contract. Expected POST /api/v1/jobs/:id/${action}.`,true);return;} if(!run?.job_id)return; if(!window.confirm('Cancel this discovery run? The current partial result will remain reviewable.'))return; try{await jsonRequest(`/api/v1/jobs/${encodeURIComponent(run.job_id)}/cancel`,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({})});await loadDiscoveryRuns();}catch(error){if(error.message!=='unauthorized')message('directDiscoveryMessage',error.message,true);} }
+ async function loadDiscoveryRun(run) { selectedDiscoveryRunId=run.id; renderDiscoveryResult(run); try { const job=await jsonRequest(`/api/v1/jobs/${encodeURIComponent(run.job_id)}`); renderDiscoveryResult(run,job); if(['queued','running','paused'].includes(discoveryStatus(job))){clearTimeout(discoveryPollTimer);discoveryPollTimer=setTimeout(loadDiscoveryRuns,3000);} } catch(error){if(error.message!=='unauthorized')renderDiscoveryResult(run,{status:'error',message:error.message});} }
+ function renderDiscoveryRuns() { const el=$('directDiscoveryRunsState'); if(!discoveryRuns.length){el.innerHTML='
No discovery runs yet. Start with a market brief and approved sources.
';return;} el.innerHTML=discoveryRuns.map(run=>``).join(''); }
async function loadDiscoveryRuns() { const state=$('directDiscoveryRunsState'); if(state)state.innerHTML='
Describe the market, provide up to five public seed URLs, and let the bounded workspace job return reviewable candidates. No manual source registration required.
Bounded · review first
+
SOURCE INTELLIGENCE
Discovery runs
Build a criteria-first run across approved sources, monitor it live, and review every result with provenance before it enters your pipeline.
Bounded · review first
-
DISCOVERY BRIEF
Set your criteria
Max 20 pages · 50 candidates
-
+
RUN BUILDER
Define your market
Max 20 pages · 50 candidates
+
-
RESULT STATUS
Select a run to inspect results
No run selected
Results appear here with job state, partial-result handling, and candidate provenance.
+
ACTIVE RUN
Select a run to inspect results
No run selected
Progress, metrics, live events, and per-source health appear here.