Log H11 (Run pipeline from bookmarks and changes) as done 03571027793e

        // The state after the most recently imported commit, with its Git

        // tree, reused when the next commit's first parent is that commit.

        let mut last: Option<(String, State, BTreeMap<String, (String, String)>)> = None;

            // Base: union of every parent's state. When the first parent is

            // the commit just imported, its state moves on, and its tree

            // tells which paths this commit leaves alone.

            let (mut base, mut prev_tree) = match (gc.parents.first(), last.take()) {

                (Some(p1), Some((sha, st, tree))) if *p1 == sha => (st, Some(tree)),

                    (st, None)

                (None, _) => (State::new(), None),

                // The other parents bring changes to paths the first

                // parent's tree cannot vouch for: compare every file.

                prev_tree = None;

            }

            let tree = list_tree(git_dir, &gc.sha)?;

            // Text files with the same blob and mode as in the first

            // parent's tree equal the base's rendering: they are neither

            // rendered nor read nor compared (spec §12.3, as for a clean

            // working copy), so a commit costs what it changes.

            let mut same: HashMap<&str, NodeId> = HashMap::new();

            if let Some(prev) = &prev_tree {

                let view = base.tree().view();

                for (path, v) in &tree {

                    // Submodule handling reads these two whatever changed.

                    if prev.get(path) != Some(v) || path == ".gitmodules" || path == ".oxymodules" {

                        continue;

                    }

                    if let Some(e) = view.entries.get(path) {

                        if e.kind == NodeKind::File && !e.mode.opaque {

                            same.insert(path.as_str(), e.node);

                        }

                    }

                }

            let base_snapshot = if same.is_empty() {

                base.materialize()

            } else {

                base.materialize_except(&same.values().copied().collect())

            };

            for (path, (mode, sha)) in &tree {

                let (path, sha) = (path.clone(), sha.clone());

                if same.contains_key(path.as_str()) {

                    let mut e = FsEntry::new(kind, exec, Vec::new());

                    e.unchanged = true;

                    entries.insert(path, e);

                    continue;

                }

            last = Some((gc.sha.clone(), base, tree));

- [x] H11 Run pipeline without a push, made easy (Andy): a primary button on the Flow tab, reasons shown when it is missing, and Run pipeline beside each bookmark and on change pages (runs the change's own state); `POST /flow/runs` takes `{"change"}`.

- 2026-09-29 **H11 done** (oxygenhub#40; Andy's request).

  - **Andy asked** whether a run without a check-in breaks the history. It does not. Runs only take committed states already in the repository, write no history, and add signed receipts about a state; running it again adds another statement. Only running uncommitted work would be unverifiable, and that stays impossible.

  - **Run pipeline:** now a primary button on the Flow tab. Viewers who cannot use it are told why: Flow is off, they are not signed in, or they lack write access.

  - **Bookmarks and changes:** each bookmark has Run pipeline beside it. On a change page it runs the state whose only head is that change; such runs carry no bookmark and are labelled "change". `POST /flow/runs` accepts `{"change"}`, and the empty-state text mentions manual runs.

  - **Tests and deploy:** the manual-run test covers a change run, an unknown change, the reasons text and the missing buttons. Deployed; the hub run is green.