diff --git a/README.md b/README.md
index 83409d4..8cb76d8 100644
--- a/README.md
+++ b/README.md
@@ -275,6 +275,93 @@ version:
     changelog-on-rc: true
 ```
 
+## notify — inputs
+
+Posts a rich Slack card for a pipeline result. Header shows the label + version
+with a green ✅ / red ❌ icon; a subtitle line reads `Deploy succeeded` or
+`Deploy failed`. The body is a single-column key/value grid ordered by
+importance: `COMMIT`, `PR`, `AUTHOR`, `HASH`, `DURATION`, `DATE`, plus `URL`
+(success only) or `FAILED AT` (failure only, promoted to the top row). A
+`View run` button links back to the CI run. With no PR it falls back to the
+**commit** (subject + clickable short SHA); with neither, a single-line text
+message.
+
+Duration and the failing step name are auto-fetched by the action via the
+GitHub Actions API — no caller wiring required. The caller must grant
+`actions: read` on the notify job (in addition to `contents: read` and
+`pull-requests: read` used for the PR/commit lookup).
+
+Best-effort: an empty `webhook-url` is a no-op that still succeeds, and a failed
+post never fails the pipeline. If the run/jobs API is unreachable (typically:
+the notify job forgot to grant `actions: read`), the action emits a workflow
+`::warning::` and the duration/failed-step rows are omitted from the card.
+
+The `header`, `color`, and `status` inputs switch the card into **alert mode**:
+the redesigned deploy card is replaced with an attachments-wrapper alert card
+whose title, color bar, and first field (`Status` instead of `Version`) come
+from those inputs. Used by `actions/enforce` and other non-deploy callers. The
+PR/commit resolution is unchanged, so the alert still shows the PR (or commit)
+`target-sha` traces to. Omit all three and the card is the standard deploy
+card above.
+
+| Input | Required | Default | Description |
+|-------|----------|---------|-------------|
+| `result` | yes | — | `success` / `failure` — e.g. a deploy job's `result`. Anything other than `success` renders as failed. |
+| `webhook-url` | no | `''` | Slack incoming webhook URL. Empty makes the action a no-op. |
+| `label` | no | `Deployment` | Short label rendered next to the version in the header. Prefer a bare component name (`"Backend"`) — the Slack channel already implies environment. |
+| `version` | no | `''` | Version string shown next to the label (`n/a` if empty). |
+| `deployed-url` | no | `''` | Fully-qualified URL of the deployed app; shown only on success. The card strips protocol and trailing slash for display, and links back to the full URL. Caller resolves per-environment. |
+| `header` | no | `''` | Full alert-card title, verbatim. Presence switches the card into alert mode (replaces the deploy card with an attachments-wrapper alert card). May contain Slack emoji shortcodes. |
+| `color` | no | `''` | Alert-card bar color (hex, e.g. `#F9A825`). Only takes effect in alert mode. Overrides the result-derived green/red. |
+| `status` | no | `''` | When set, the alert card's first field renders as **Status** with this text in place of the **Version** field. Only takes effect in alert mode. |
+| `channel` | no | `slack` | Chat channel; only `slack` is implemented today. |
+| `github-token` | no | `${{ github.token }}` | Token used to read the PR/commit, the workflow run, and (on failure) the run's jobs. The default job token covers a same-repo deploy; for a cross-org deploy pass a token minted in the caller from a GitHub App with read access to `target-repo`. |
+| `target-repo` | no | `${{ github.repository }}` | `owner/repo` whose PR/commit the card describes. Override for a cross-repo deploy. |
+| `target-sha` | no | `${{ github.sha }}` | Exact built/deployed commit SHA used to resolve the PR/commit. |
+
+Example — same-repo deploy (token/target default to this repo):
+
+```yaml
+  announce:
+    needs: deploy
+    if: ${{ always() && github.event_name == 'push' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      actions: read
+    steps:
+      - uses: nurdsoft/ci-workflows/actions/notify@v4
+        with:
+          result: ${{ needs.deploy.result }}
+          label: "Backend"
+          version: ${{ needs.deploy.outputs.version }}
+          deployed-url: ${{ github.ref_name == 'main' && 'https://app.example.com' || 'https://dev.example.com' }}
+          webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
+```
+
+Example — cross-org deploy (card describes a PR/commit in another repo):
+
+```yaml
+      - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547  # v1.12.0
+        id: app-token
+        with:
+          app-id: ${{ vars.READ_APP_ID }}
+          private-key: ${{ secrets.READ_APP_KEY }}
+          owner: other-org
+          repositories: other-repo
+      - uses: nurdsoft/ci-workflows/actions/notify@v4
+        with:
+          result: ${{ needs.deploy.result }}
+          label: "Web"
+          version: ${{ needs.build.outputs.app_version }}
+          deployed-url: https://app.other-org.com
+          webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
+          github-token: ${{ steps.app-token.outputs.token }}
+          target-repo: other-org/other-repo
+          target-sha: ${{ needs.build.outputs.app_sha }}
+```
+
 ## enforce — inputs & outputs
 
 Merge-time gate that enforces non-empty PR descriptions. Call it as the **first
@@ -341,14 +428,14 @@ jobs:
       block: ${{ steps.g.outputs.block }}
     steps:
       - id: g
-        uses: nurdsoft/ci-workflows/actions/enforce@v3
+        uses: nurdsoft/ci-workflows/actions/enforce@v4
         with:
           label: Backend
 
       # Alert on Slack when the guard acted; on a clean merge this step skips.
       # Best-effort — a missing/failed webhook never fails the job.
       - if: ${{ steps.g.outputs.outcome != '' }}
-        uses: nurdsoft/ci-workflows/actions/notify@v3
+        uses: nurdsoft/ci-workflows/actions/notify@v4
         with:
           result: failure
           webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
@@ -365,78 +452,6 @@ jobs:
     # ...
 ```
 
-## notify — inputs
-
-Posts a rich Slack card for a pipeline result: a green/red header
-(`<label> — succeeded|failed`), a Version field, and the **PR** this deploy
-traces to (title + clickable `owner/repo#NN`). With no PR it falls back to the
-**commit** (subject + clickable short SHA), and with neither to a single-line
-text message. A context line shows the author, the UTC build date
-(`YYYY.MM.DD`), and a link to the run. The build date is stamped by the action
-so the deploy date reads unambiguously rather than being inferred from Slack's
-local-timezone message timestamp.
-Best-effort: an empty `webhook-url` is a no-op that still succeeds, and a failed
-post never fails the pipeline.
-
-The `header`, `color`, and `status` inputs turn the same card into a general
-**alert** (e.g. a revert or guard notice) instead of a deploy result: supply a
-custom title and color bar, and the first field becomes **Status** instead of
-**Version**. The PR/commit resolution, body, and context line are unchanged, so
-the card still shows the PR (or commit) that `target-sha` traces to. Omit all
-three and the card is exactly the deploy-result card above.
-
-| Input | Required | Default | Description |
-|-------|----------|---------|-------------|
-| `result` | yes | — | `success` / `failure` — e.g. a deploy job's `result`. Anything other than `success` renders as failed. |
-| `webhook-url` | no | `''` | Slack incoming webhook URL. Empty makes the action a no-op. |
-| `label` | no | `Deployment` | Short label for the card header (app / component name). |
-| `version` | no | `''` | Version string shown in the Version field (`n/a` if empty). |
-| `header` | no | `''` | Full header line, verbatim, overriding the default `<emoji> <label> — <status>`. May contain Slack emoji shortcodes. |
-| `color` | no | `''` | Attachment bar color (hex) overriding the result-derived green/red. |
-| `status` | no | `''` | When set, the first field renders as **Status** with this text in place of the **Version** field. |
-| `channel` | no | `slack` | Chat channel; only `slack` is implemented today. |
-| `github-token` | no | `${{ github.token }}` | Token used to read the PR/commit. The default job token covers a same-repo deploy; for a cross-org deploy pass a token minted in the caller from a GitHub App with read access to `target-repo`. |
-| `target-repo` | no | `${{ github.repository }}` | `owner/repo` whose PR/commit the card describes. Override for a cross-repo deploy. |
-| `target-sha` | no | `${{ github.sha }}` | Exact built/deployed commit SHA used to resolve the PR/commit. |
-
-Example — same-repo deploy (token/target default to this repo):
-
-```yaml
-  announce:
-    needs: deploy
-    if: ${{ always() && github.event_name == 'push' }}
-    runs-on: ubuntu-latest
-    permissions: { contents: read, pull-requests: read }
-    steps:
-      - uses: nurdsoft/ci-workflows/actions/notify@v3
-        with:
-          result: ${{ needs.deploy.result }}
-          label: "Backend (${{ github.ref_name == 'prod' && 'Prod' || 'Dev' }})"
-          version: ${{ needs.deploy.outputs.version }}
-          webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
-```
-
-Example — cross-org deploy (card describes a PR/commit in another repo):
-
-```yaml
-      - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547  # v1.12.0
-        id: app-token
-        with:
-          app-id: ${{ vars.READ_APP_ID }}
-          private-key: ${{ secrets.READ_APP_KEY }}
-          owner: other-org
-          repositories: other-repo
-      - uses: nurdsoft/ci-workflows/actions/notify@v3
-        with:
-          result: ${{ needs.deploy.result }}
-          label: "Web (Prod)"
-          version: ${{ needs.build.outputs.app_version }}
-          webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
-          github-token: ${{ steps.app-token.outputs.token }}
-          target-repo: other-org/other-repo
-          target-sha: ${{ needs.build.outputs.app_sha }}
-```
-
 ## Runner contract
 
 Phase actions (`build`, `deploy`, `plan`, `apply`) run a command — supply it any
diff --git a/actions/notify/action.yml b/actions/notify/action.yml
index 9439774..3e665e8 100644
--- a/actions/notify/action.yml
+++ b/actions/notify/action.yml
@@ -1,11 +1,11 @@
 name: Notify
 description: >-
   Post a pipeline result to a chat channel as a rich card. Resolves the deploy's
-  PR (or commit) to show title, version, author and a run link. Best-effort:
-  with no webhook the action is a no-op and succeeds, so a missing webhook never
-  fails the pipeline. The PR/commit lookup needs `pull-requests: read` and
-  `contents: read` on the calling job; without them the card silently falls back
-  to commit-only details.
+  PR (or commit) to show title, version, author, hash, duration, and a run link.
+  Auto-fetches pipeline duration and (on failure) the failing step name via the
+  GitHub Actions API — caller must grant `actions: read` on the notify job.
+  Best-effort: with no webhook the action is a no-op and succeeds, so a missing
+  webhook never fails the pipeline.
 
 inputs:
   result:
@@ -16,31 +16,44 @@ inputs:
     required: false
     default: ""
   label:
-    description: Short label for the message (app / component name).
+    description: >-
+      Short label for the message header (app / component name). Rendered
+      alongside `version`. Prefer a bare name ("Backend") — the Slack
+      channel already implies the environment.
     required: false
     default: Deployment
   version:
-    description: Version string shown in the message.
+    description: Version string shown in the header, next to the label (e.g. `v2.1.0`).
+    required: false
+    default: ""
+  deployed-url:
+    description: >-
+      Fully-qualified URL of the deployed app (shown only on success). The card
+      strips protocol and trailing slash for display, and links back to the full
+      URL. Caller resolves per-environment.
     required: false
     default: ""
   header:
     description: >-
-      Full header line, verbatim. When set, overrides the default
-      "<emoji> <label> — <succeeded|failed>" header — for alert cards that need
-      a custom title (e.g. a revert notice). May contain Slack emoji shortcodes.
+      Full header line, verbatim. When set, switches the card into alert mode:
+      the redesigned deploy card is replaced with an attachments-wrapper alert
+      card whose title is this string and whose bar color is `color`. Used by
+      `actions/enforce` and other non-deploy callers. May contain Slack emoji
+      shortcodes. Setting any of `header` / `color` / `status` enables alert
+      mode; leave all three empty for the standard deploy card.
     required: false
     default: ""
   color:
     description: >-
-      Attachment bar color (hex, e.g. "#F9A825"). When set, overrides the
-      result-derived green/red — lets alert callers signal a state that isn't a
-      clean pass/fail.
+      Attachment bar color (hex, e.g. `"#F9A825"`). Only takes effect in alert
+      mode (any of `header` / `color` / `status` set). Overrides the
+      result-derived green/red.
     required: false
     default: ""
   status:
     description: >-
-      When set, the first card field renders as "*Status*\n<status>" in place of
-      "*Version*\n<version>". For alert cards where a version is meaningless.
+      When set, the alert card's first field renders as `*Status*\n<status>` in
+      place of `*Version*\n<version>`. Only takes effect in alert mode.
     required: false
     default: ""
   channel:
@@ -49,10 +62,10 @@ inputs:
     default: slack
   github-token:
     description: >-
-      Token used to read the PR / commit that this deploy traces to. For a
-      same-repo deploy the default job token is enough; for a cross-org deploy
-      (target-repo differs from this repo) pass a token minted in the caller
-      from a GitHub App with read access to target-repo.
+      Token used to read the PR/commit, the workflow run, and (on failure) the
+      run's jobs. Same-repo deploy: the default job token is enough. Cross-org
+      deploy: pass a token minted in the caller from a GitHub App with read
+      access to target-repo. Requires `actions: read` on the notify job.
     required: false
     default: ${{ github.token }}
   target-repo:
@@ -78,12 +91,14 @@ runs:
         RESULT: ${{ inputs.result }}
         LABEL: ${{ inputs.label }}
         VERSION: ${{ inputs.version }}
+        DEPLOYED_URL: ${{ inputs.deployed-url }}
         HEADER_IN: ${{ inputs.header }}
         COLOR_IN: ${{ inputs.color }}
         STATUS_IN: ${{ inputs.status }}
         WEBHOOK: ${{ inputs.webhook-url }}
         TARGET_REPO: ${{ inputs.target-repo }}
         TARGET_SHA: ${{ inputs.target-sha }}
+        RUN_ID: ${{ github.run_id }}
         RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         GH_TOKEN: ${{ inputs.github-token }}
       run: |
@@ -94,88 +109,246 @@ runs:
           exit 0
         fi
 
-        emoji=":x:"; color="#D32F2F"; status="failed"
+        # Status icon only. Header emoji conveys success/failure — no separate
+        # subtitle line under it.
+        icon=":x:"; is_success=0
         if [ "${RESULT:-}" = "success" ]; then
-          emoji=":white_check_mark:"; color="#2E7D32"; status="succeeded"
+          icon=":white_check_mark:"; is_success=1
         fi
+
         version="${VERSION:-}"; [ -z "$version" ] && version="n/a"
         short_sha="${TARGET_SHA:0:7}"
+        built_utc="$(date -u +%Y-%m-%d)"
 
-        # Card chrome. Alert callers can override the header line and color bar,
-        # and swap the first field from Version to Status. With none of these
-        # inputs set, the result-derived defaults reproduce the original card
-        # verbatim, so existing deploy callers are unaffected.
-        header="${HEADER_IN:-${emoji} ${LABEL} — ${status}}"
-        [ -n "${COLOR_IN:-}" ] && color="$COLOR_IN"
-        if [ -n "${STATUS_IN:-}" ]; then
-          field1_label="Status"; field1_value="$STATUS_IN"
-        else
-          field1_label="Version"; field1_value="$version"
-        fi
-
-        # Build date in UTC (YYYY.MM.DD), shown on the card so the deploy date is
-        # unambiguous rather than inferred from Slack's local-timezone timestamp.
-        built_utc="$(date -u +%Y.%m.%d)"
+        # -- Alert mode: header/color/status swap the redesigned deploy card
+        # for an attachments-wrapper alert card. Byte-identical to the pre-v4
+        # notify card, so the actions/enforce alert path (#20) survives v4.
+        # Skips the run/jobs fetch entirely — DURATION and FAILED AT are
+        # deploy-only.
+        if [ -n "${HEADER_IN:-}" ] || [ -n "${COLOR_IN:-}" ] || [ -n "${STATUS_IN:-}" ]; then
+          a_emoji=":x:"; a_color="#D32F2F"; a_status="failed"
+          if [ "${RESULT:-}" = "success" ]; then
+            a_emoji=":white_check_mark:"; a_color="#2E7D32"; a_status="succeeded"
+          fi
+          header="${HEADER_IN:-${a_emoji} ${LABEL} — ${a_status}}"
+          [ -n "${COLOR_IN:-}" ] && a_color="$COLOR_IN"
+          if [ -n "${STATUS_IN:-}" ]; then
+            f1label="Status"; f1value="$STATUS_IN"
+          else
+            f1label="Version"; f1value="$version"
+          fi
 
-        # Prefer the PR this deploy traces to (a merge commit on dev/prod resolves
-        # to its PR); fall back to the commit itself, then to a plain line.
-        pr_json="$(gh api "repos/${TARGET_REPO}/commits/${TARGET_SHA}/pulls" \
-          -H "Accept: application/vnd.github+json" 2>/dev/null || echo '[]')"
-        sel="$(jq -c 'if (type=="array" and length>0) then ([.[]|select(.merged_at!=null)][0] // .[0]) else {} end' <<<"$pr_json")"
-        pr_num="$(jq -r '.number // empty' <<<"$sel")"
+          pr_json="$(gh api "repos/${TARGET_REPO}/commits/${TARGET_SHA}/pulls" -H "Accept: application/vnd.github+json" 2>/dev/null || echo '[]')"
+          sel="$(jq -c 'if (type=="array" and length>0) then ([.[]|select(.merged_at!=null)][0] // .[0]) else {} end' <<<"$pr_json")"
+          pr_num="$(jq -r '.number // empty' <<<"$sel")"
 
-        if [ -n "$pr_num" ]; then
-          # PR card: title + number + link (no commit bullets).
-          pr_title="$(jq -r '.title // ""' <<<"$sel")"
-          pr_url="$(jq -r '.html_url // ""' <<<"$sel")"
-          pr_user="$(jq -r '.user.login // "unknown"' <<<"$sel")"
-          payload="$(jq -n \
-            --arg color "$color" --arg header "$header" \
-            --arg f1label "$field1_label" --arg f1value "$field1_value" \
-            --arg prlabel "${TARGET_REPO}#${pr_num}" --arg title "$pr_title" \
-            --arg user "$pr_user" --arg runurl "$RUN_URL" --arg prurl "$pr_url" \
-            --arg built "$built_utc" '
-            def esc: gsub("&";"&amp;") | gsub("<";"&lt;") | gsub(">";"&gt;");
-            { attachments: [{ color: $color, blocks: [
-                { type:"header", text:{ type:"plain_text", text:$header, emoji:true } },
-                { type:"section", fields:[
-                    { type:"mrkdwn", text:("*" + $f1label + "*\n" + $f1value) },
-                    { type:"mrkdwn", text:("*PR*\n" + (if $prurl != "" then "<" + $prurl + "|" + $prlabel + ">" else $prlabel end)) } ]},
-                { type:"section", text:{ type:"mrkdwn", text:("*" + ($title|esc) + "*") } },
-                { type:"context", elements:[
-                    { type:"mrkdwn", text:("👤 " + ($user|esc) + "   ·   📅 " + $built + " UTC   ·   🔗 <" + $runurl + "|view run>") } ]}
-            ]}]}')"
-        else
-          # No PR -> show the commit that triggered this deploy (target-sha).
-          commit_json="$(gh api "repos/${TARGET_REPO}/commits/${TARGET_SHA}" 2>/dev/null || echo '{}')"
-          c_subject="$(jq -r '.commit.message // "" | split("\n")[0] // ""' <<<"$commit_json")"
-          c_author="$(jq -r '.author.login // .commit.author.name // "unknown"' <<<"$commit_json")"
-          c_url="$(jq -r '.html_url // ""' <<<"$commit_json")"
-
-          if [ -n "$c_subject" ]; then
-            # Commit card: subject + short SHA (linked) + author.
+          if [ -n "$pr_num" ]; then
+            pr_title="$(jq -r '.title // ""' <<<"$sel")"
+            pr_url="$(jq -r '.html_url // ""' <<<"$sel")"
+            pr_user="$(jq -r '.user.login // "unknown"' <<<"$sel")"
             payload="$(jq -n \
-              --arg color "$color" --arg header "$header" \
-              --arg f1label "$field1_label" --arg f1value "$field1_value" \
-              --arg short "$short_sha" --arg cmurl "$c_url" \
-              --arg subject "$c_subject" --arg user "$c_author" --arg runurl "$RUN_URL" \
+              --arg color "$a_color" --arg header "$header" \
+              --arg f1label "$f1label" --arg f1value "$f1value" \
+              --arg prlabel "${TARGET_REPO}#${pr_num}" --arg title "$pr_title" \
+              --arg user "$pr_user" --arg runurl "$RUN_URL" --arg prurl "$pr_url" \
               --arg built "$built_utc" '
               def esc: gsub("&";"&amp;") | gsub("<";"&lt;") | gsub(">";"&gt;");
               { attachments: [{ color: $color, blocks: [
                   { type:"header", text:{ type:"plain_text", text:$header, emoji:true } },
                   { type:"section", fields:[
                       { type:"mrkdwn", text:("*" + $f1label + "*\n" + $f1value) },
-                      { type:"mrkdwn", text:("*Commit*\n" + (if $cmurl != "" then "<" + $cmurl + "|" + $short + ">" else "`" + $short + "`" end)) } ]},
-                  { type:"section", text:{ type:"mrkdwn", text:("*" + ($subject|esc) + "*") } },
+                      { type:"mrkdwn", text:("*PR*\n" + (if $prurl != "" then "<" + $prurl + "|" + $prlabel + ">" else $prlabel end)) } ]},
+                  { type:"section", text:{ type:"mrkdwn", text:("*" + ($title|esc) + "*") } },
                   { type:"context", elements:[
                       { type:"mrkdwn", text:("👤 " + ($user|esc) + "   ·   📅 " + $built + " UTC   ·   🔗 <" + $runurl + "|view run>") } ]}
               ]}]}')"
           else
-            # Fallback - nothing resolved: original single-line text format.
-            payload="$(jq -n \
-              --arg text "${emoji} ${LABEL}: ${status}  |  version \`${version}\`  |  📅 ${built_utc} UTC  |  <${RUN_URL}|view run>" \
-              '{ text: $text }')"
+            commit_json="$(gh api "repos/${TARGET_REPO}/commits/${TARGET_SHA}" 2>/dev/null || echo '{}')"
+            c_subject="$(jq -r '.commit.message // "" | split("\n")[0] // ""' <<<"$commit_json")"
+            c_author="$(jq -r '.commit.author.name // .author.login // "unknown"' <<<"$commit_json")"
+            c_url="$(jq -r '.html_url // ""' <<<"$commit_json")"
+            if [ -n "$c_subject" ]; then
+              payload="$(jq -n \
+                --arg color "$a_color" --arg header "$header" \
+                --arg f1label "$f1label" --arg f1value "$f1value" \
+                --arg short "$short_sha" --arg cmurl "$c_url" \
+                --arg subject "$c_subject" --arg user "$c_author" --arg runurl "$RUN_URL" \
+                --arg built "$built_utc" '
+                def esc: gsub("&";"&amp;") | gsub("<";"&lt;") | gsub(">";"&gt;");
+                { attachments: [{ color: $color, blocks: [
+                    { type:"header", text:{ type:"plain_text", text:$header, emoji:true } },
+                    { type:"section", fields:[
+                        { type:"mrkdwn", text:("*" + $f1label + "*\n" + $f1value) },
+                        { type:"mrkdwn", text:("*Commit*\n" + (if $cmurl != "" then "<" + $cmurl + "|" + $short + ">" else "`" + $short + "`" end)) } ]},
+                    { type:"section", text:{ type:"mrkdwn", text:("*" + ($subject|esc) + "*") } },
+                    { type:"context", elements:[
+                        { type:"mrkdwn", text:("👤 " + ($user|esc) + "   ·   📅 " + $built + " UTC   ·   🔗 <" + $runurl + "|view run>") } ]}
+                ]}]}')"
+            else
+              payload="$(jq -n --arg text "${a_emoji} ${LABEL}: ${a_status}  |  version \`${version}\`  |  📅 ${built_utc} UTC  |  <${RUN_URL}|view run>" '{ text: $text }')"
+            fi
+          fi
+
+          if curl -fsS -X POST -H 'Content-Type: application/json' --data "$payload" "$WEBHOOK" >/dev/null; then
+            echo "Slack notification sent."
+          else
+            echo "Slack notification failed (ignored, best-effort)."
           fi
+          exit 0
+        fi
+
+        # -- Duration: pull run_started_at, compute elapsed vs now.
+        # Falls back silently if the API call fails.
+        duration=""
+        run_json="$(gh api "repos/${TARGET_REPO}/actions/runs/${RUN_ID}" 2>/dev/null || echo '{}')"
+        started_at="$(jq -r '.run_started_at // .created_at // empty' <<<"$run_json")"
+        if [ -z "$started_at" ]; then
+          echo "::warning::notify: /actions/runs/${RUN_ID} returned no run_started_at. Check that the notify job grants 'actions: read' — DURATION will not render."
+        fi
+        if [ -n "$started_at" ]; then
+          started_epoch="$(date -u -d "$started_at" +%s 2>/dev/null || echo '')"
+          if [ -n "$started_epoch" ]; then
+            now_epoch="$(date -u +%s)"
+            elapsed=$(( now_epoch - started_epoch ))
+            if [ "$elapsed" -lt 0 ]; then elapsed=0; fi
+            if [ "$elapsed" -lt 60 ]; then
+              duration="${elapsed}s"
+            else
+              duration="$((elapsed / 60))m $((elapsed % 60))s"
+            fi
+          fi
+        fi
+
+        # -- Failed job name: the first pipeline stage (job) with conclusion=failure.
+        # We surface the JOB name — not a step name — because inner steps of
+        # composite actions are opaque to the /jobs endpoint (only the outer
+        # `Run owner/repo/actions/name@ref` wrapper is visible), which makes
+        # step-level names misleading. Job names ("Build", "Deploy", …) are
+        # always human-meaningful and match what users see in the Actions UI.
+        failed_step=""
+        if [ "$is_success" -eq 0 ]; then
+          jobs_json="$(gh api "repos/${TARGET_REPO}/actions/runs/${RUN_ID}/jobs" 2>/dev/null || echo '{}')"
+          if [ "$(jq -r '(.jobs // []) | length' <<<"$jobs_json")" = "0" ]; then
+            echo "::warning::notify: /actions/runs/${RUN_ID}/jobs returned no jobs. Check that the notify job grants 'actions: read' — FAILED AT will not render."
+          fi
+          failed_step="$(jq -r '[.jobs[]? | select(.conclusion == "failure")] | .[0].name // ""' <<<"$jobs_json")"
+        fi
+
+        # -- Resolve PR (preferred) or commit for the header rows.
+        pr_json="$(gh api "repos/${TARGET_REPO}/commits/${TARGET_SHA}/pulls" \
+          -H "Accept: application/vnd.github+json" 2>/dev/null || echo '[]')"
+        sel="$(jq -c 'if (type=="array" and length>0) then ([.[]|select(.merged_at!=null)][0] // .[0]) else {} end' <<<"$pr_json")"
+        pr_num="$(jq -r '.number // empty' <<<"$sel")"
+
+        commit_json="$(gh api "repos/${TARGET_REPO}/commits/${TARGET_SHA}" 2>/dev/null || echo '{}')"
+        commit_subject="$(jq -r '.commit.message // "" | split("\n")[0] // ""' <<<"$commit_json")"
+        # Prefer git-metadata display name over the raw GitHub login.
+        commit_author="$(jq -r '.commit.author.name // .author.login // "unknown"' <<<"$commit_json")"
+        commit_url="$(jq -r '.html_url // ""' <<<"$commit_json")"
+
+        if [ -n "$pr_num" ]; then
+          pr_title="$(jq -r '.title // ""' <<<"$sel")"
+          pr_url="$(jq -r '.html_url // ""' <<<"$sel")"
+          pr_label="${TARGET_REPO}#${pr_num}"
+          # PR title beats commit subject when available.
+          [ -n "$pr_title" ] && commit_subject="$pr_title"
+        else
+          pr_url=""; pr_label=""
+        fi
+
+        # -- URL display: strip protocol + trailing slash.
+        url_display=""
+        if [ -n "${DEPLOYED_URL:-}" ]; then
+          url_display="$(printf '%s' "$DEPLOYED_URL" | sed -E 's|^https?://||; s|/+$||')"
+        fi
+
+        # Fallback path: neither PR nor commit resolved → single-line message.
+        if [ -z "$commit_subject" ] && [ -z "$pr_num" ]; then
+          payload="$(jq -n \
+            --arg text "${icon} ${LABEL} ${version}  |  📅 ${built_utc} UTC  |  <${RUN_URL}|view run>" \
+            '{ text: $text }')"
+        else
+          # -- Single full-width mrkdwn section with monospace-padded labels.
+          # Slack's section.fields is a 2-col grid ~50/50; the value column is
+          # only ~30 chars, which wrapped long commit subjects and PR refs.
+          # Wrapping each label in inline code (`) forces monospace, so we can
+          # right-pad to a fixed 9-char column ("FAILED AT" is the longest at
+          # 9). That preserves the aligned-column look while giving the value
+          # column the full card width — long values no longer wrap.
+          # `-r` is required so the joined newlines survive raw to the outer jq.
+          rows_text="$(jq -n -r \
+            --arg is_success "$is_success" \
+            --arg failed_step "$failed_step" \
+            --arg subject "$commit_subject" \
+            --arg pr_label "$pr_label" --arg pr_url "$pr_url" \
+            --arg author "$commit_author" \
+            --arg short_sha "$short_sha" --arg commit_url "$commit_url" \
+            --arg duration "$duration" \
+            --arg built "$built_utc" \
+            --arg url_display "$url_display" --arg url_full "$DEPLOYED_URL" '
+            def esc: gsub("&";"&amp;") | gsub("<";"&lt;") | gsub(">";"&gt;");
+            # MAINTENANCE RISK. The padlabel scheme below is empirically tuned to
+            # Slacks Lato font at current rendering sizes  any Slack renderer
+            # change and column alignment drifts silently (visible only on
+            # screenshot review, not in any test signal). If durability matters
+            # more than fidelity, the safe fallback is a plain bold-then-value
+            # render: replace padlabel(k) + v with "*" + k + "*\n" + v.
+            # `label` is a jq reserved keyword (label/break), so name this `padlabel`.
+            # Two-space padding scheme for column alignment in Slack Lato:
+            #   1. Em space (\u2003 = 1 em)     \u2014 pad to 12 chars total.
+            #   2. NBSP     (\u00a0 = ~0.25 em) \u2014 add N per label = label length.
+            # In Slack Lato, bold letter width is ~0.75 em, em space is 1 em, NBSP
+            # is ~0.25 em. Total row width = L*0.75 + (12-L)*1 + L*0.25 = 12 em,
+            # constant across all label lengths. Pure em-space padding drifted
+            # because bold letter (0.75) < em (1), so longer labels came out
+            # narrower \u2014 visible as DURATION (8 chars) drifting left of PR (2).
+            # The per-label NBSP tail scales with L to make up the missing 0.25 em
+            # per bold letter, so DURATION gets the largest NBSP tail.
+            # NOTE: no apostrophes in these comments  the outer shell context
+            # is a single-quoted jq expression and an apostrophe would close it.
+            def padlabel(k):
+              (k | length) as $L
+              # Empirical shave: COMMIT / AUTHOR / DURATION are all-caps single
+              # words dominated by wide bold letters (M, D, U, R, A, O, N), so
+              # under the analytical formula their rendered width overshoots
+              # the reference column formed by the other labels. Drop 2 NBSPs
+              # from those three to pull their values back into the same X.
+              | (if k == "COMMIT" or k == "AUTHOR" or k == "DURATION" then 2 elif k == "PR" or k == "FAILED AT" then -2 else 0 end) as $shave
+              | "*" + k + "*"
+                + "\u2003" * (if 12 - $L > 0 then 12 - $L else 0 end)
+                + "\u00a0" * ($L - $shave);
+            def row(k; v): padlabel(k) + v;
+
+            ( if $is_success == "0" and $failed_step != "" then
+                [ row("FAILED AT"; ($failed_step|esc)) ]
+              else [] end )
+            + ( if $subject != "" then [ row("COMMIT"; ($subject|esc)) ] else [] end )
+            + ( if $pr_label != "" then
+                  [ row("PR"; (if $pr_url != "" then "<" + $pr_url + "|" + $pr_label + ">" else $pr_label end)) ]
+                else [] end )
+            + [ row("AUTHOR"; ($author|esc)) ]
+            + [ row("HASH"; (if $commit_url != "" then "<" + $commit_url + "|`" + $short_sha + "`>" else "`" + $short_sha + "`" end)) ]
+            + ( if $duration != "" then [ row("DURATION"; $duration) ] else [] end )
+            + [ row("DATE"; ($built + " UTC")) ]
+            + ( if $is_success == "1" and $url_display != "" then
+                  [ row("URL"; "<" + $url_full + "|" + $url_display + ">") ]
+                else [] end )
+            | join("\n\n")
+          ')"
+
+          # Header emoji conveys status; no separate context/subtitle block.
+          payload="$(jq -n \
+            --arg icon "$icon" --arg label "$LABEL" --arg version "$version" \
+            --arg runurl "$RUN_URL" \
+            --arg rows_text "$rows_text" '
+            { blocks:
+              [ { type:"header", text:{ type:"plain_text", text:($icon + " " + $label + " " + $version), emoji:true } },
+                { type:"section", text:{ type:"mrkdwn", text: $rows_text } },
+                { type:"actions", elements:[
+                    { type:"button",
+                      text:{ type:"plain_text", text:"View run" },
+                      url: $runurl } ] } ]
+            }')"
         fi
 
         # -f makes curl fail on HTTP >=400 so Slack payload rejections surface in