flightops workspace --database CATALOG --scope-key EXACT_SCOPE starts a private loopback desktop app over the existing recording, retention and history APIs. Open the private URL printed by the command and keep its terminal open. Ctrl-C closes only this workspace; recording lifecycle remains independent. --json prints the same bounded snapshot without starting an HTTP listener.
The dark laptop/desktop view has three columns: retained runs and attempts on the left; capture state, per-topic surviving horizons and the last action in the middle; protecting an incident window, retention and deletion, and strategy applicability on the right. Below 1280 pixels the right column moves under the other two. The header shows the exact project/environment/ROS-domain scope. It does not infer clock alignment, complete delivery or current configuration validity from timestamps. Large nanosecond timestamps cross the browser boundary as exact decimal strings.
Pass --collector-config PATH to expose Pause, Resume and Stop for that exact installed collector. Config/catalog/scope must agree; actions use the reviewed frozen config. This view does not install collectors, enable broader capture or control application processes. Explicit standing-policy installation/enabling remains under flightops record.
Incident pins require exact topic/time bounds and explicit prerequisite roles and references. Repeat --allow-source ID at startup for each retained source and upstream source you authorize. The catalog's current source-use rules still apply. Missing prerequisites, budget, bytes or permission produce visible refusal. Release controls bind the exact displayed pin digest and compare it atomically, so a newly coalesced incident cannot be unpinned through a stale view. Deletion first previews policy-eligible owned files, then requires the exact reviewed plan digest; previews are consumed once and the retention API rechecks leases, policy and bytes before deleting.
Select up to eight history records and eight recordings to reopen an investigation or export its structured metadata JSON. Failures, blocked work, unrun attempts, source-fingerprint state and independent clocks remain visible. Exported metadata is a local-owner copy, not a portable verified handoff or a publication grant; use flightops handoff for the separately reviewed handoff format.
The configuration comparison panel reads one exact saved strategy revision and one current configuration snapshot through the governed knowledge API. Repeat --allow-knowledge KIND:ID for each selected and linked metadata record and --allow-source ID for its source lineage. It shows match/difference/unknown fields and required rechecks; it never promotes a historical pass to current validation or executes the strategy.
The server binds only to 127.0.0.1 with an ephemeral session token delivered in the URL fragment. API calls require that token, exact Host and same-origin checks; mutations require an Origin header. It serves fixed application assets, never arbitrary filesystem paths. Requests, responses, workers and socket waits are bounded. Content enters the page through text nodes; no retrieved command or model text can add an action. No model, internet request or shared service is required. Treat the private URL like a local control credential.
Focused API/HTTP fixtures verify backend controls and data boundaries. Native systemd behavior, full desktop browser validation and real-user acceptance remain deferred; file-URL browser restrictions were not bypassed to preview this app.