@bongos/core 1.19.327 → 1.19.328

package/public-landing/projects.html

@@ -42,6 +42,9 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
    intent); the control-plane runner does the real infra work (ADR 0111 §2). */
 .viewWrap{padding-bottom:40px;}
 .card{margin-bottom:26px;}
+/* page titles align with the cards below them — cosmos's .hero is 880px-centred
+   for the landing hero, which indented every hub title ~48px past its card */
+#view-mine .hero,#view-manage .hero{max-width:none;}
 
 /* ── the manage view (task 1003041): container rhythm only — every component
    it draws (card, chip, addr, empty) is cosmos vocabulary ── */
@@ -553,11 +556,11 @@ h1[tabindex="-1"]:focus{outline:none;}
         <p class="mineEmpty" id="mineEmpty" hidden>Nothing matches that. <button type="button" class="linklike" id="mineClear">Clear the filters</button></p>
 
         <section class="empty" id="empty" hidden>
-          <p>You don't own any projects yet. Creating one takes about five minutes — name it, pick a home for its code, and it gets an address of its own in this sky.</p>
+          <p>You don't own any projects yet. Name one, pick a home for its code, and it gets an address of its own in this sky.</p>
           <a class="btn" href="?view=new" data-nav-to="new">Create your first project</a>
         </section>
         <ul class="projects" id="projectsList"></ul>
-        <p class="finePrint">Buttons here ask the platform to act — a runner does the real work, and each card reports only what was verified, with a timestamp. Standups keep running even with this tab closed.</p>
+        <p class="finePrint">Buttons here ask the platform to act; each card reports only what was verified, and when. A standup keeps going even with this tab closed.</p>
       </section>
     </main>
   </div>
@@ -597,8 +600,8 @@ h1[tabindex="-1"]:focus{outline:none;}
 
     <section id="mMain" hidden>
       <div class="hero" style="padding-left:0;padding-right:0">
-        <h1>Manage</h1>
-        <p class="lede">One project, up close — its address, its repository, and what the platform last <b>verified</b> about it, with a timestamp. The controls land here piece by piece; each section says what it can do today.</p>
+        <h1 id="mTitle">Manage</h1>
+        <p class="lede">Its address, its repository, what the platform last <b>verified</b> about it — and the controls you have today.</p>
       </div>
 
       <div class="card">
@@ -606,16 +609,13 @@ h1[tabindex="-1"]:focus{outline:none;}
         <div class="projMeta" id="mMeta" hidden></div>
         <div class="addr" id="mAddr" hidden></div>
         <p class="finePrint" id="mCreated" hidden></p>
-      </div>
-
-      <div class="card" id="mVisibility">
-        <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">Who can see it</h2>
-        <div class="empty"><p>Choosing who can open this project’s pages — everyone, or only people signed in to it — isn’t wired up here yet. It lands in one of the next updates; until then every project keeps the behavior it already has.</p></div>
-      </div>
-
-      <div class="card" id="mJoinability">
-        <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">How people join</h2>
-        <div class="empty"><p>Choosing how new people join — walk right in, apply first, or invite only — isn’t wired up here yet. It lands in one of the next updates.</p></div>
+        <!-- the card's own story, on the project's own page (task 1003232): the
+             per-flow strip, the honest snag, and the doors — the same
+             stripFor/errMarkup/canRetry/canRevive the list card reads -->
+        <div id="mStrip"></div>
+        <div class="projMsg err" id="mErr" hidden></div>
+        <div class="projMsg" id="mMsg"></div>
+        <div class="actions" id="mActs" hidden></div>
       </div>
 
       <!-- live since task 1003045: reads the repo's real visibility from GitHub
@@ -636,6 +636,18 @@ h1[tabindex="-1"]:focus{outline:none;}
         </details>
       </div>
 
+      <!-- the two settings the sibling tasks (1003043 / 1003044) fill in — placed
+           BELOW the sections that work, so a founder meets controls before promises -->
+      <div class="card" id="mVisibility">
+        <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">Who can see it</h2>
+        <div class="empty"><p>Choosing who can open this project’s pages — everyone, or only people signed in to it — isn’t wired up here yet. For now, every project’s pages are open to everyone.</p></div>
+      </div>
+
+      <div class="card" id="mJoinability">
+        <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">How people join</h2>
+        <div class="empty"><p>Choosing how new people join — walk right in, apply first, or invite only — isn’t wired up here yet. For now, people apply to join and you invite them.</p></div>
+      </div>
+
       <!-- live since task 1003042: the teardown control, for a project in ANY
            state that still holds something. The server used to refuse a
            'requested' or an 'error' project outright — and force-teardown reused
@@ -684,7 +696,7 @@ h1[tabindex="-1"]:focus{outline:none;}
           <section class="panel" id="panel-gate" aria-labelledby="gate-h">
             <h1 id="gate-h">Create a project</h1>
             <p class="lede">Your own <strong data-brand-product-inline>Cloud Bongos</strong> project: its own repository, its own home on the web, and a hall of AI builders who do the building. You set the direction; agents lay down the code. Sign in with GitHub so the project belongs to <em>you</em> from the very first beat.</p>
-            <!-- The wizard's own sign-in opts into repo scope (read:user + public_repo) up
+            <!-- The wizard's own sign-in opts into repo scope (read:user + repo, ADR 0155) up
                  front (&repos=1) — anyone here intends to create a project, which needs repo
                  access, so we ask once at sign-in instead of a second "Connect" step at Home.
                  Hall + CLI sign-in stay identity-only (ADR 0143 least-privilege default). -->
@@ -692,6 +704,11 @@ h1[tabindex="-1"]:focus{outline:none;}
               <svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>
               Sign in with GitHub
             </a>
+            <!-- Informed consent BEFORE GitHub's own wording (ADR 0155): the scope the
+                 button asks for reads as "all your repositories" on GitHub's screen, so
+                 the reason is stated here, on the path every founder actually takes —
+                 not only on the Home step's re-connect branch (task 1003232). -->
+            <p class="finePrint" id="wizScopeNote">Signing in asks GitHub for repository access. GitHub words this as access to <em>all</em> your repositories — that is the only permission it offers that can write to a private repo. We use it to create (or read) the one repo your project lives in and push its starting files. Nothing else is touched.</p>
             <!-- Trust link → the AGPL license text (task 1002705): the old private-repo URL
                  404ed, and no public code artifact exists until the ADR 0099 mirror flips
                  (~2026-11; npm scopes are private too) — the license is the one live,
@@ -784,7 +801,7 @@ h1[tabindex="-1"]:focus{outline:none;}
               <div id="ghBusy" class="hint" hidden>Reading your GitHub repositories…</div>
               <div id="ghAdopt" class="wizField" hidden>
                 <span>Pick one of your repositories</span>
-                <input type="text" id="ghSearch" placeholder="Search your repos…" autocomplete="off">
+                <input type="text" id="ghSearch" placeholder="Search your repos…" autocomplete="off" aria-label="Search your repositories">
                 <div id="ghList" class="ghlist" role="listbox" aria-label="Your repositories"></div>
                 <div class="hint" id="ghAdoptHint">&nbsp;</div>
                 <!-- visibility stated on EVERY repo path (task 1002721) — the picker
@@ -793,7 +810,7 @@ h1[tabindex="-1"]:focus{outline:none;}
               </div>
               <div id="ghFresh" class="wizField" hidden>
                 <span>New repository name</span>
-                <input type="text" id="ghNewName" placeholder="mercury" autocomplete="off" maxlength="100">
+                <input type="text" id="ghNewName" placeholder="mercury" autocomplete="off" maxlength="100" aria-label="New repository name">
                 <!-- visibility is stated on EVERY repo path (task 1002721) — this baked
                      line is the floor; updateFreshPreview() replaces it with the same
                      claim plus the resolved repo URL once a name is typed -->
@@ -830,7 +847,7 @@ h1[tabindex="-1"]:focus{outline:none;}
                choice; the owner read the step as "weird" and never found it. -->
           <section class="panel" id="panel-address" aria-labelledby="addr-h">
             <h1 id="addr-h">Its address in the sky</h1>
-            <p class="lede">The handle names your project on the platform — and its address comes with it. Sign-in, sharing, everything just works from the moment it stands up.</p>
+            <p class="lede">The handle names your project on the platform — and its address comes with it. Once it stands up, a few GitHub steps (the next screen walks you through them) switch sign-in on.</p>
             <form data-next="5">
               <label class="wizField"><span>Project handle</span>
                 <input type="text" id="f-slug" placeholder="mercury" autocomplete="off" maxlength="40" spellcheck="false">
@@ -882,7 +899,7 @@ h1[tabindex="-1"]:focus{outline:none;}
             <div id="liveProgress"></div>
             <h2 style="font-family:var(--font-display);font-size:19px;margin-top:22px;">Your steps — the parts only you can play</h2>
             <ol class="humanSteps" id="humanSteps"></ol>
-            <p class="samePath">This is the same sequence the <code style="font-family:var(--font-mono)">/new-project</code> assistant and <code style="font-family:var(--font-mono)">bongos onboard</code> use — three doors, one path.</p>
+            <p class="samePath">These are the same steps however a project is created — nothing here is special to this page.</p>
           </section>
         </div>
 
@@ -969,6 +986,7 @@ h1[tabindex="-1"]:focus{outline:none;}
   'use strict';
 
   var API = '/api/bongos';
+  var BASE_TITLE = document.title;
   var POLL_MS = 5000;          /* the create.html watch cadence (in-flight cards) */
   var POLL_SOFT_MS = 10000;    /* transient failure back-off */
   var REFRESH_MS = 60000;      /* settled-card refresh: recency + heartbeat overlay
@@ -1037,17 +1055,28 @@ h1[tabindex="-1"]:focus{outline:none;}
 
   function setView(v, focus) {
     if (!VIEWS[v]) v = 'map';
+    var prevView = currentView;
     currentView = v;
     Object.keys(VIEWS).forEach(function (k) { $('view-' + k).hidden = (k !== v); });
     document.querySelectorAll('[data-nav]').forEach(function (a) {
       /* Home is a PAGE, not a view — it never takes the current-view pill */
       if (a.dataset.nav !== 'home' && a.dataset.nav === v) a.setAttribute('aria-current', 'page');
+      /* the manage view is a page OF your projects — that pill stays lit there */
+      else if (v === 'manage' && a.dataset.nav === 'mine') a.setAttribute('aria-current', 'page');
       else a.removeAttribute('aria-current');
     });
     /* the manage view's URL names its project — the deep-link contract grew
        an id in task 1003041, so a manage tab is shareable and reload-safe */
     var idPart = (v === 'manage' && manageId) ? '&id=' + encodeURIComponent(manageId) : '';
-    try { history.replaceState(null, '', '?view=' + v + idPart); } catch (e) {}
+    /* a DELIBERATE view change is a history entry, so the browser's Back button
+       moves between views instead of leaving the hub; boot and background
+       settles keep rewriting the entry in place (task 1003232) */
+    var deliberate = focus || (v === 'manage' && prevView && prevView !== 'manage');
+    try {
+      if (deliberate && location.search !== '?view=' + v + idPart) history.pushState(null, '', '?view=' + v + idPart);
+      else history.replaceState(null, '', '?view=' + v + idPart);
+    } catch (e) {}
+    if (v !== 'manage') document.title = BASE_TITLE;
     /* the shell's sign-in door returns the visitor to the view they left, and
        carries the repo scope when that view is the wizard (ADR 0143: the
        create path asks once up front instead of a second consent at Home) */
@@ -1080,6 +1109,9 @@ h1[tabindex="-1"]:focus{outline:none;}
   document.querySelectorAll('[data-nav-to]').forEach(function (a) {
     a.addEventListener('click', function (ev) { ev.preventDefault(); setView(a.dataset.navTo, true); });
   });
+  /* Back / Forward land on the view the URL names — viewFromUrl() reads the
+     manage id too, so a manage entry restores its project */
+  window.addEventListener('popstate', function () { setView(viewFromUrl()); });
 
   /* ── the self-typing mark. `bongos` is the CONSTANT — it is the word you
      type — and the prefix is what varies, which is exactly what the vanity
@@ -1568,7 +1600,7 @@ h1[tabindex="-1"]:focus{outline:none;}
   function goToManage(instId) {
     manageId = String(instId || '');
     manageInst = null;
-    setView('manage');
+    setView('manage'); /* setView pushes a history entry for a list → manage move, so Back returns to the list */
   }
   /* Card-shell lookup by instance id. CSS.escape, not esc(): the data-inst
      attribute holds the DECODED value, so an HTML-escaped id would never match
@@ -2293,6 +2325,8 @@ h1[tabindex="-1"]:focus{outline:none;}
       var avail = !custom && !state.noAddress && assigned ? slugAvailState() : 'unknown';
       box.classList.toggle('optedOut', state.noAddress && !custom);
       box.classList.toggle('unavailable', avail === 'taken' || avail === 'yours' || avail === 'reserved');
+      /* the format verdict must not cheer a handle the box below is refusing */
+      if (avail === 'taken' || avail === 'yours' || avail === 'reserved') { var hs = $('h-slug'); hs.innerHTML = '&nbsp;'; hs.className = 'hint'; }
       if (custom) {
         big.innerHTML = '<code>' + esc(custom) + '</code> — your own domain, wired up for you.';
         note.textContent = 'DNS pointing happens after the standup; the card on your projects page walks you through it.';
@@ -2301,7 +2335,7 @@ h1[tabindex="-1"]:focus{outline:none;}
         note.textContent = 'Sign-in on your project can’t be set up until it has one — add it any time from your projects page.';
       } else if (assigned && avail === 'free') {
         big.innerHTML = '<code>' + esc(assigned) + '</code> — yours from the moment it stands up.';
-        note.textContent = 'Sign-in, sharing, everything just works. You can point a domain you own at it any time.';
+        note.textContent = 'Sharing works from the moment it stands up; sign-in switches on after the GitHub steps. You can point a domain you own at it any time.';
       } else if (assigned && avail === 'taken') {
         big.innerHTML = '<code>' + esc(assigned) + '</code> — already taken.';
         note.textContent = 'Another project on the platform holds that handle. Pick a different one.';
@@ -2389,6 +2423,9 @@ h1[tabindex="-1"]:focus{outline:none;}
          (a pre-auth probe 401s for strangers and, worse, could seed the
          draft's owner with myLogin()'s placeholder) */
       if (step === 3) { syncHome(); if (authKnown) ensureRepoAccess(); }
+      /* a resumed draft can land PAST the Home step with the probe never run —
+         Create would then file a repo it promised to make but never did */
+      else if (step > 3 && step < 6 && authKnown && repoAccess === null) ensureRepoAccess();
       /* re-check on every entry, not just on typing: a resumed draft arrives here with
          a handle nobody has asked the server about, and a handle free ten minutes ago
          may not be now (task 1002898 N10) */
@@ -2671,7 +2708,14 @@ h1[tabindex="-1"]:focus{outline:none;}
           $('h-slug').className = 'hint err'; $('f-slug').classList.add('bad');
           return false;
         }
-        if (state.domain && !looksLikeDomain(state.domain)) return false;
+        if (state.domain && !looksLikeDomain(state.domain)) {
+          $('addrCustom').open = true;
+          var hd0 = $('h-domain');
+          hd0.textContent = 'That doesn’t look like a domain yet (e.g. mercury.example.com) — fix it, or clear the field to use the address above.';
+          hd0.className = 'hint err';
+          $('f-domain').focus();
+          return false;
+        }
         /* A handle the server has already said is not free would only 409 at Create —
            stop here instead (task 1002898 N10). ONLY a definite negative blocks:
            'unknown' and 'checking' must never gate the step, because the check is
@@ -2730,7 +2774,7 @@ h1[tabindex="-1"]:focus{outline:none;}
         ['Address', resolvedDomain()
           ? '<code>' + esc(resolvedDomain()) + '</code>'
           : '<em style="font-weight:600;color:var(--warn)">none — sign-in stays locked until it has one</em>'],
-        ['Shape', 'Standalone — your own repo, pinned platform core']
+        ['Shape', 'Its own server, running the platform’s current release']
       ];
       $('reviewList').innerHTML = rows.map(function (r) {
         return '<li><span class="k">' + r[0] + '</span><span class="v">' + r[1] + '</span></li>';
@@ -2821,7 +2865,7 @@ h1[tabindex="-1"]:focus{outline:none;}
           })
         });
       }).then(function (res) {
-        if (res.status === 401) { window.location.assign(API + '/auth/web/start?return=/projects%3Fview%3Dnew'); throw new Error('signing in'); }
+        if (res.status === 401) { window.location.assign(API + '/auth/web/start?return=/projects%3Fview%3Dnew&repos=1'); throw new Error('signing in'); }
         return res.json().catch(function () { return {}; }).then(function (data) {
           if (!res.ok) {
             var e = new Error((data.error && (data.error.message || data.error.code)) || ('HTTP ' + res.status));
@@ -2877,7 +2921,7 @@ h1[tabindex="-1"]:focus{outline:none;}
     var live = { instStatus: null, manifest: null, manifestMsg: '', appSlug: null };
     var planPromises = {};             /* mode|domain → Promise<steps[]> */
     var lastStepsHtml = '';
-    var FALLBACK_HUMAN_KEYS = ['github-repo', 'oauth-app', 'first-sign-in', 'enter-hall'];
+    var FALLBACK_HUMAN_KEYS = ['github-repo', 'oauth-app', 'device-flow', 'app-install', 'first-sign-in', 'enter-hall'];
 
     function fetchPlan() {
       var domain = resolvedDomain() || '';
@@ -2960,8 +3004,14 @@ h1[tabindex="-1"]:focus{outline:none;}
           (live.manifest === 'expired' ? 'That setup link expired (they last 30 minutes) — mint a fresh one.' : 'GitHub setup hit a snag' + (live.manifestMsg ? ': ' + esc(live.manifestMsg) : '') + '. Try again.') + '</p>' +
           '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
       }
-      if (live.manifest) {   /* pending / code_received — GitHub or the runner is mid-flight */
-        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Waiting on GitHub — approve the app in the tab that opened. Once approved, the platform places the credentials and verifies sign-in on its own; this step ticks itself.</p></li>';
+      if (live.manifest === 'code_received') {
+        /* GitHub's half is done — say so, rather than keep telling the founder
+           to approve an app they just approved */
+        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>GitHub’s part is done. The platform is placing the credentials on your project now — this step ticks itself.</p></li>';
+      }
+      if (live.manifest) {   /* pending — GitHub holds the manifest, nobody has approved it yet */
+        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Waiting on GitHub — approve the app in the tab that opened. Once approved, the platform places the credentials and verifies sign-in on its own; this step ticks itself.</p>' +
+          (manifestStale ? '<button type="button" class="linklike" data-action="manifest-start">Didn’t get to GitHub? Start the setup again</button>' : '') + '</li>';
       }
       return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in — one click</b><p>Approve a pre-filled GitHub App and the platform wires sign-in by itself: no keys to copy, and the secret never leaves the server side.</p>' +
         '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
@@ -3003,11 +3053,20 @@ h1[tabindex="-1"]:focus{outline:none;}
       if (!domain) {
         return '<li class="slocked" data-onboard-step="first-sign-in"><b>First sign-in</b><p>Unlocks with sign-in above — you’ll open your project’s address, sign in with GitHub once, and be seated as the owner (the founding Archon).</p></li>';
       }
+      /* the door opens only when the project ANSWERS and sign-in is wired: a
+         link to an address that does not resolve yet is the worst first
+         impression a founder can get of their own project (task 1003232) */
+      if (live.instStatus !== 'active' || live.manifest !== 'done') {
+        return '<li class="slocked" data-onboard-step="first-sign-in"><b>First sign-in</b><p>Unlocks once your project is answering and sign-in above is wired. Then you’ll open <code style="font-family:var(--font-mono)">' + esc(domain) + '</code>, sign in with GitHub once, and be seated as the owner — the founding Archon.</p></li>';
+      }
       return '<li data-onboard-step="first-sign-in"><b>First sign-in</b><p>Open <a href="https://' + esc(domain) + '" target="_blank" rel="noopener"><code style="font-family:var(--font-mono)">' + esc(domain) + '</code></a> and sign in with GitHub once. That seats you as the owner — the founding Archon.</p></li>';
     }
 
     function renderStepEnterHall() {
       var domain = resolvedDomain();
+      if (domain && (live.instStatus !== 'active' || live.manifest !== 'done')) {
+        return '<li class="slocked" data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>Unlocks with the first sign-in — your project’s home will be <code style="font-family:var(--font-mono)">' + esc(domain) + '/builders</code>.</p></li>';
+      }
       return domain
         ? '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>Your project’s home — open <a href="https://' + esc(domain) + '/builders" target="_blank" rel="noopener"><code style="font-family:var(--font-mono)">' + esc(domain) + '/builders</code></a> and start building.</p></li>'
         : '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>No address yet — run <code style="font-family:var(--font-mono)">bongos dev</code> in your repo checkout to start the local hall on your machine.</p></li>';
@@ -3095,6 +3154,20 @@ h1[tabindex="-1"]:focus{outline:none;}
     var manifestPollTimer = null;
     var manifestState = null;      /* the one-time state token — kept so a parked poll can resume */
     var manifestPending = false;
+    var manifestStartedAt = 0;     /* when the founder was sent to GitHub */
+    var manifestStale = false;     /* ~90s with no approval → offer to start again */
+    /* the manifest leg survives a reload: token + last status ride the CREATED
+       record, so enter() re-seeds the step instead of re-offering "Set up
+       GitHub sign-in" for an app the founder already approved (task 1003232) */
+    function rememberManifest(stateToken, status, appSlug) {
+      try {
+        var rec = createdRecord() || {};
+        if (stateToken !== undefined) rec.manifest_state = stateToken;
+        if (status !== undefined) rec.manifest = status;
+        if (appSlug !== undefined) rec.app_slug = appSlug;
+        sessionStorage.setItem(CREATED_KEY, JSON.stringify(rec));
+      } catch (e) {}
+    }
     /* a cleared setTimeout id can't cancel a chain that's mid-fetch — each chain
        carries the generation it was born under, and stopping bumps it so an
        orphaned chain goes quiet instead of re-arming itself forever */
@@ -3109,7 +3182,7 @@ h1[tabindex="-1"]:focus{outline:none;}
         method: 'POST', credentials: 'same-origin',
         headers: { 'Content-Type': 'application/json' }, body: '{}'
       }).then(function (res) {
-        if (res.status === 401) { window.location.assign(API + '/auth/web/start?return=/projects%3Fview%3Dnew'); throw new Error('signing in'); }
+        if (res.status === 401) { window.location.assign(API + '/auth/web/start?return=/projects%3Fview%3Dnew&repos=1'); throw new Error('signing in'); }
         return res.json().catch(function () { return {}; }).then(function (d) {
           if (!res.ok) {
             var e = new Error((d.error && (d.error.message || d.error.code)) || ('HTTP ' + res.status));
@@ -3125,6 +3198,8 @@ h1[tabindex="-1"]:focus{outline:none;}
         form.appendChild(inp); document.body.appendChild(form);
         form.submit(); form.remove();
         live.manifest = 'pending'; live.manifestMsg = '';
+        manifestStartedAt = Date.now(); manifestStale = false;
+        rememberManifest(d.state, 'pending');
         renderSteps();
         pollManifest(d.state);
       }).catch(function (err) {
@@ -3146,9 +3221,10 @@ h1[tabindex="-1"]:focus{outline:none;}
           .then(function (res) { if (!res.ok) throw new Error('soft'); return res.json(); })
           .then(function (d) {
             if (myGen !== manifestGen) return;
-            if (d.app_slug && d.app_slug !== live.appSlug) { live.appSlug = d.app_slug; renderSteps(); }
+            if (d.app_slug && d.app_slug !== live.appSlug) { live.appSlug = d.app_slug; rememberManifest(undefined, undefined, d.app_slug); renderSteps(); }
             var next = d.ready ? 'done' : (d.status || 'pending');
-            if (next !== live.manifest) { live.manifest = next; renderSteps(); }
+            if (next !== live.manifest) { live.manifest = next; rememberManifest(undefined, next); renderSteps(); }
+            else if (next === 'pending' && !manifestStale && manifestStartedAt && (Date.now() - manifestStartedAt) > 90000) { manifestStale = true; renderSteps(); }
             if (!d.terminal) manifestPollTimer = setTimeout(tick, 4000);
             else manifestPollTimer = null;   /* a stale fired id would read as "still polling" and resume a finished poll */
           })
@@ -3206,7 +3282,7 @@ h1[tabindex="-1"]:focus{outline:none;}
         }
       }
       if (s === 'requested') {
-        el.innerHTML = progressMarkup(1, 1, 'Waiting for a runner to pick it up. This updates the moment it starts.', '', revive ? 'revive' : 'standup');
+        el.innerHTML = progressMarkup(0, 0, 'Filed — waiting for the platform to pick it up. This updates the moment it starts.', '', revive ? 'revive' : 'standup');
       } else if (s === 'provisioning') {
         el.innerHTML = progressMarkup(1, 1,
           revive ? 'Bringing it back on the newest platform version — nothing needed from you.'
@@ -3225,8 +3301,8 @@ h1[tabindex="-1"]:focus{outline:none;}
           /* domainless instances are never probed — there is no address to
              answer at, so a verified answer can never arrive; say what IS true
              instead of promising the hall (sign-in stays locked without one) */
-          el.innerHTML = progressMarkup(-1, 3,
-            'The build finished — your project is standing, but it has no address yet, so sign-in can’t be wired up. Attach a domain any time from <a href="?view=mine">your projects page</a>; the steps below that need one unlock then.', 'isLive', flow);
+          el.innerHTML = progressMarkup(-1, 2,
+            'The build finished — your project is standing, but it has no address yet, so sign-in can’t be wired up. Attach a domain any time from <a href="?view=mine">your projects page</a>; the steps below that need one unlock then.', '', flow);
           return true;
         }
         if (inst.last_verified_up === false) {
@@ -3257,7 +3333,7 @@ h1[tabindex="-1"]:focus{outline:none;}
         el.innerHTML = progressMarkup(-1, 3, 'This instance was torn down. Bring it back any time from <a href="?view=mine">your projects page</a>, or start another below.', '', 'teardown');
         return true;
       } else {
-        el.innerHTML = progressMarkup(0, 1, 'Filed. Watching for the standup to start…');
+        el.innerHTML = progressMarkup(0, 0, 'Filed. Watching for the standup to start…');
       }
       return false;
     }
@@ -3268,8 +3344,9 @@ h1[tabindex="-1"]:focus{outline:none;}
       watchPending = false;
       var myGen = watchGen;
       var ticks = 0;
+      var watchFlow = 'standup'; /* the vocabulary the strip is speaking (F22) */
       var el = $('liveProgress');
-      el.innerHTML = progressMarkup(0, 1, 'Filed. Watching for the standup to start…');
+      el.innerHTML = progressMarkup(0, 0, 'Filed. Watching for the standup to start…');
       function tick() {
         if (myGen !== watchGen) return;
         if (!wizPollActive()) { watchPending = true; stopPolling(); return; }
@@ -3279,14 +3356,18 @@ h1[tabindex="-1"]:focus{outline:none;}
              the long watch to the mine view, the owner's durable surface (task
              1002693). The old "stop quietly" here was a dead-end lie: the hall
              card it assumed was removed in task 1002675. */
-          $('liveProgress').innerHTML = progressMarkup(1, 1,
-            'Still building — this tab will stop watching now. Follow it any time on <a href="?view=mine">your projects page</a>.');
+          /* a SNAGGED standup keeps its honest error — "still building" would be
+             a lie exactly when the founder most needs the truth */
+          if (live.instStatus !== 'error') {
+            $('liveProgress').innerHTML = progressMarkup(1, 1,
+              'Still working — this tab will stop watching now. Follow it any time on <a href="?view=mine">your projects page</a>.', '', watchFlow);
+          }
           stopPolling();
           return;
         }
         fetch(API + '/provisioning/instances/' + encodeURIComponent(id), { credentials: 'same-origin' })
           .then(function (res) {
-            if (res.status === 401) { throw new Error('gone:Your session expired — <a href="' + API + '/auth/web/start?return=/projects%3Fview%3Dnew">sign in again</a> to keep watching.'); }
+            if (res.status === 401) { throw new Error('gone:Your session expired — <a href="' + API + '/auth/web/start?return=/projects%3Fview%3Dnew&amp;repos=1">sign in again</a> to keep watching.'); }
             if (res.status === 404) { throw new Error('gone:Can’t see this instance any more — it may have been torn down.'); }
             if (!res.ok) throw new Error('soft');
             return res.json();
@@ -3295,6 +3376,7 @@ h1[tabindex="-1"]:focus{outline:none;}
             if (myGen !== watchGen) return;
             var inst = data.instance;
             if (inst) inst.open_intent = data.open_intent || null;   /* F22: the strip reads intents */
+            if (inst) watchFlow = inst.torn_down_at ? 'revive' : 'standup';
             /* the checklist reflects live state (task 1002694): a status transition —
                e.g. the scaffold landing — re-renders the steps (change-only, so the
                5s tick never clobbers an open dropdown or mid-flight button) */
@@ -3307,7 +3389,7 @@ h1[tabindex="-1"]:focus{outline:none;}
             if (myGen !== watchGen) return;
             var m = String(err && err.message || '');
             if (m.indexOf('gone:') === 0) {
-              $('liveProgress').innerHTML = progressMarkup(1, 1, m.slice(5), 'isErr');
+              $('liveProgress').innerHTML = progressMarkup(1, 1, m.slice(5), 'isErr', watchFlow);
               stopPolling();
               return;
             }
@@ -3323,10 +3405,13 @@ h1[tabindex="-1"]:focus{outline:none;}
       var again = document.createElement('button');
       again.type = 'button'; again.className = 'again'; again.textContent = 'Start another project';
       again.addEventListener('click', function () {
+        /* a standup still being watched is not abandoned by accident */
+        if (instanceId && pollTimer && !confirm((state.name || state.slug) + ' keeps building — you’ll find it on your projects page. Start a new one?')) return;
         stopPolling();
         stopManifestPoll();
         instanceId = null;
         watchPending = false; manifestPending = false; manifestState = null;
+        manifestStartedAt = 0; manifestStale = false;
         live = { instStatus: null, manifest: null, manifestMsg: '', appSlug: null };
         lastStepsHtml = '';
         try { sessionStorage.removeItem(CREATED_KEY); sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
@@ -3363,6 +3448,11 @@ h1[tabindex="-1"]:focus{outline:none;}
         /* restore the opt-out too — without it resolvedDomain() re-derives the
            assigned address and the done panel promises one that doesn't exist */
         state.noAddress = !!created.noaddr;
+        /* the manifest leg's last known truth, kept across a reload */
+        if (created.manifest) { live.manifest = created.manifest; live.appSlug = created.app_slug || null; }
+        if (created.manifest_state && created.manifest !== 'done' && created.manifest !== 'error' && created.manifest !== 'expired') {
+          manifestState = created.manifest_state; manifestPending = true;
+        }
         renderDone();
         show(6, !!focus);
         startProgress(created.id);
@@ -3511,13 +3601,21 @@ h1[tabindex="-1"]:focus{outline:none;}
   function jsonOrEmpty(res) { return res.json().catch(function () { return {}; }); }
 
   function signInAgain() {
-    return 'Your session expired — <a href="' + API + '/auth/web/start?return=/projects">sign in again</a>.';
+    /* from the wizard, the re-sign-in keeps the repo scope it already granted */
+    var back = currentView === 'new' ? '/projects%3Fview%3Dnew&amp;repos=1' : '/projects';
+    return 'Your session expired — <a href="' + API + '/auth/web/start?return=' + back + '">sign in again</a>.';
   }
 
   /* ── status vocabulary (direction §4): the chip only asserts what the
      platform verified, and says when. `last_verified_*` is the heartbeat
      overlay — absent (pre-migration or never probed) reads as unverified. ── */
 
+  /* ONE freshness rule (direction §2 principle 1 / §3): "live" is claimed only
+     from an UP probe within FRESH_MS. Chip, orb and address row all read this,
+     so the page can never say "Answering at …" beside a chip that says "live?". */
+  function verifiedAt(inst) { return inst.last_verified_at ? new Date(inst.last_verified_at).getTime() : 0; }
+  function freshUp(inst) { var at = verifiedAt(inst); return !!(inst.last_verified_up && at && (Date.now() - at) <= FRESH_MS); }
+
   function chipMarkup(cls, label, rec) {
     return '<span class="chip ' + cls + '"><span class="cdot"></span>' + esc(label) +
       (rec ? ' <span class="rec">· ' + esc(rec) + '</span>' : '') + '</span>';
@@ -3525,9 +3623,9 @@ h1[tabindex="-1"]:focus{outline:none;}
   function chipFor(inst) {
     var s = inst.status;
     if (s === 'active') {
-      var at = inst.last_verified_at ? new Date(inst.last_verified_at).getTime() : 0;
+      var at = verifiedAt(inst);
       if (inst.last_verified_up === false) return chipMarkup('down', 'unreachable', at ? 'since ' + clockOrDate(at) : '');
-      if (inst.last_verified_up && at && (Date.now() - at) <= FRESH_MS) return chipMarkup('live', 'live', 'checked ' + relTime(at));
+      if (freshUp(inst)) return chipMarkup('live', 'live', 'checked ' + relTime(at));
       return chipMarkup('maybe', 'live?', at ? 'last seen ' + relTime(at) : 'not checked yet');
     }
     if (s === 'requested') return chipMarkup('busy', 'queued');
@@ -3585,7 +3683,7 @@ h1[tabindex="-1"]:focus{outline:none;}
     var cls = 'orb';
     if (inst.status === 'torn_down' || inst.status === 'tearing_down') cls += ' ghost';
     else if (inst.status === 'error' || (inst.status === 'active' && inst.last_verified_up === false)) cls += ' ashen';
-    else if (inst.status === 'active' && !(inst.last_verified_up && inst.last_verified_at && (Date.now() - new Date(inst.last_verified_at).getTime()) <= FRESH_MS)) cls += ' dim';
+    else if (inst.status === 'active' && !freshUp(inst)) cls += ' dim';
     var style = '--acc:' + ORB_ACCENTS[k] + ';--glow:' + ORB_GLOWS[k];
     if (inst.status === 'active' && inst.domain) {
       return '<a class="' + cls + '" style="' + style + '" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener" title="Open ' + esc(inst.slug) + '" aria-label="Open ' + esc(inst.slug) + '"></a>';
@@ -3616,8 +3714,10 @@ h1[tabindex="-1"]:focus{outline:none;}
     var s = inst.status;
     var revive = !!inst.torn_down_at; /* stood down before this standup → it's a revive */
     if (s === 'requested') {
-      return stripMarkup(revive ? 'revive' : 'standup', 1, 1,
-        'Waiting for a runner to pick it up. This card updates the moment it starts.');
+      /* "Request filed" is the CURRENT stage — the standing-up dot must not
+         light before the platform has actually picked the request up */
+      return stripMarkup(revive ? 'revive' : 'standup', 0, 0,
+        'Filed — waiting for the platform to pick it up. This card updates the moment it starts.');
     }
     if (s === 'provisioning') {
       return stripMarkup(revive ? 'revive' : 'standup', 1, 1,
@@ -3684,22 +3784,31 @@ h1[tabindex="-1"]:focus{outline:none;}
   }
 
   function addressRow(inst) {
+    /* state FIRST, then domain: a torn-down or snagged project still holds its
+       domain (ADR 0181 keeps port + address), and the standup promise below
+       was reaching it — "answers once the instance is live" two lines above
+       "nothing more will happen" (task 1003232) */
+    if (inst.status === 'torn_down' || inst.status === 'tearing_down') {
+      if (!inst.domain) return '';
+      return 'Its address, <code>' + esc(inst.domain) + '</code>, stays reserved for this project — it shows an error page until you bring it back.';
+    }
     if (inst.domain) {
       if (inst.status === 'active') {
-        /* "answering" is a VERIFIED claim (direction §3 / F16): only the
-           heartbeat earns it — never the runner finishing its script */
+        /* "answering" is a VERIFIED claim (direction §3 / F16): only a FRESH up
+           probe earns it — never the runner finishing its script, and never a
+           probe the chip has already aged into "live?" */
         var link = '<a href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">' + esc(inst.domain) + '</a>';
-        if (inst.last_verified_up) return 'Answering at ' + link;
+        if (freshUp(inst)) return 'Answering at ' + link;
         /* the runner had no DNS hook (F16): the CAUSE beats the bare symptom —
            a successful A record flips last_verified_up and retires the note */
         if (inst.dns_note) return 'Its address is ' + link + '. ' + esc(inst.dns_note);
-        if (inst.last_verified_up === false) return 'Not answering at ' + link + ' right now.';
+        if (inst.last_verified_up === false) return 'Not answering at ' + link + ' right now. We keep checking every few minutes and update this on its own if it comes back.';
+        if (inst.last_verified_up) return 'Its address is ' + link + ' — last answered ' + esc(relTime(verifiedAt(inst))) + '.';
         return 'Its address is ' + link + ' — confirming it answers.';
       }
+      if (inst.status === 'error') return 'Address <code>' + esc(inst.domain) + '</code> — held for this project, but nothing is answering there yet.';
       return 'Address: <code>' + esc(inst.domain) + '</code> — it answers there once the instance is live.';
     }
-    /* a torn-down instance has no address to speak of — the card's own line says so */
-    if (inst.status === 'torn_down' || inst.status === 'tearing_down') return '';
     /* the HONEST no-address state: sign-in on the instance needs a real domain */
     return '<span class="none">No address yet</span> — sign-in on this project can’t be set up until it has one.';
   }
@@ -3711,22 +3820,25 @@ h1[tabindex="-1"]:focus{outline:none;}
     var iid = esc(String(inst.id));
     var li = liFor(inst.id);
     if (!li) return;
+    if (cardAsking !== null && cardAsking === String(inst.id)) return; /* keep THIS card's open confirmation */
     var gone = inst.status === 'torn_down';
     li.className = 'proj' + (gone ? ' gone' : '');
     var meta = [];
     if (inst.target_ref) meta.push('repo <code>' + esc(inst.target_ref) + '</code>');
+    /* each item is ONE flex item (span-wrapped below), so the separator can
+       never strand at the end of a wrapped line on a phone */
     if (inst.hosting_shape) meta.push(esc(SHAPE_LABEL[inst.hosting_shape] || inst.hosting_shape));
     if (inst.onboard_mode === 'adopt') meta.push('adopted repo');
     if (inst.status === 'active' && inst.torn_down_at) meta.push('back live since ' + esc(shortDate(inst.provisioned_at || inst.torn_down_at)));
     var body =
       '<div class="projHead"><span class="projName">' + esc(inst.slug) + '</span>' + chipFor(inst) + '</div>' +
-      (meta.length ? '<div class="projMeta">' + meta.join('<span aria-hidden="true">·</span>') + '</div>' : '');
+      (meta.length ? '<div class="projMeta">' + meta.map(function (m) { return '<span>' + m + '</span>'; }).join('') + '</div>' : '');
     var addr = addressRow(inst);
     if (addr) body += '<div class="addr">' + addr + '</div>';
     if (canAttachDomain(inst)) {
       var rekick = inst.status === 'active' && inst.domain && inst.error_note;
       body += '<div class="attach">' +
-        '<input type="text" id="dom-' + iid + '" placeholder="myproject.example.com" autocomplete="off" spellcheck="false" maxlength="253"' +
+        '<input type="text" id="dom-' + iid + '" placeholder="myproject.example.com" autocomplete="off" spellcheck="false" maxlength="253" aria-label="A domain you own, for ' + esc(inst.slug) + '"' +
         (rekick ? ' value="' + esc(inst.domain) + '"' : '') + '>' +
         '<button type="button" class="btn small" data-attach="' + iid + '">' +
         (rekick ? 'Try the address again' : inst.domain ? 'Use your own domain' : 'Give it an address') + '</button></div>';
@@ -3752,6 +3864,9 @@ h1[tabindex="-1"]:focus{outline:none;}
     /* every owned card opens its manage view (task 1003041) — a real link, so
        middle/ctrl-click works; the delegated handler upgrades a plain click */
     var acts = ['<a class="btn small ghost" data-manage="' + iid + '" href="?view=manage&id=' + iid + '">Manage</a>'];
+    /* the success moment needs a door: a live project opens from its own card
+       (the orb and the address link were the only ways in — task 1003232) */
+    if (inst.status === 'active' && inst.domain) acts.unshift('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">Open site →</a>');
     if (canRetry(inst)) acts.push('<button type="button" class="btn small" data-retry="' + iid + '">Try again</button>');
     if (canRevive(inst)) acts.push('<button type="button" class="btn small" data-revive="' + iid + '">Bring it back</button>');
     if (canTeardown(inst)) acts.push('<button type="button" class="btn small danger" data-teardown="' + iid + '">Tear it down</button>');
@@ -3943,7 +4058,7 @@ h1[tabindex="-1"]:focus{outline:none;}
     }
     if (inst.hosting_shape) meta.push(esc(SHAPE_LABEL[inst.hosting_shape] || inst.hosting_shape));
     if (inst.onboard_mode === 'adopt') meta.push('adopted repo');
-    $('mMeta').innerHTML = meta.join('<span aria-hidden="true">·</span>');
+    $('mMeta').innerHTML = meta.map(function (m) { return '<span>' + m + '</span>'; }).join('');
     $('mMeta').hidden = !meta.length;
     var addr = addressRow(inst);
     $('mAddr').innerHTML = addr;
@@ -3955,9 +4070,75 @@ h1[tabindex="-1"]:focus{outline:none;}
        it: the delete section reads only status + open_intent, both already in
        hand, and a queued teardown must show up without a reload */
     renderDelete(inst);
+    /* the page names its project — in the heading and in the tab */
+    $('mTitle').textContent = inst.slug || 'Manage';
+    document.title = (inst.slug ? inst.slug + ' — ' : '') + BASE_TITLE;
+    /* the card's own story, on the project's own page (task 1003232): the
+       per-flow strip, the honest snag, and the doors the list card has */
+    $('mStrip').innerHTML = stripFor(inst);
+    var snag = (inst.status === 'error' || inst.error_note) && !inst.open_intent;
+    $('mErr').innerHTML = snag ? errMarkup(inst) : '';
+    $('mErr').hidden = !snag;
+    var acts = [];
+    if (inst.status === 'active' && inst.domain) acts.push('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">Open site →</a>');
+    if (canRetry(inst)) acts.push('<button type="button" class="btn small" data-m-retry>Try again</button>');
+    if (canRevive(inst)) acts.push('<button type="button" class="btn small" data-m-revive>Bring it back</button>');
+    $('mActs').innerHTML = acts.join('');
+    $('mActs').hidden = !acts.length;
+  }
+
+  /* Try again / Bring it back from the project's own page — the same POST the
+     list card sends (the server's PROVISION_ENQUEUE_FROM gate is the authority) */
+  function mReProvision(verb) {
+    var inst = manageInst;
+    if (!inst) return;
+    var box = $('mMsg');
+    box.className = 'projMsg'; box.textContent = verb === 'revive' ? 'Asking the platform to bring it back…' : 'Asking the platform to try again…';
+    $('mActs').querySelectorAll('button').forEach(function (b) { b.disabled = true; });
+    var body = { slug: inst.slug, hosting_shape: inst.hosting_shape || 'standalone' };
+    if (inst.onboard_mode) body.onboard_mode = inst.onboard_mode;
+    if (inst.target_ref) body.target_ref = inst.target_ref;
+    if (inst.domain) body.domain = inst.domain;
+    fetch(API + '/provisioning/instances', {
+      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(body)
+    }).then(function (res) {
+      if (res.status === 401) { box.className = 'projMsg err'; box.innerHTML = signInAgain(); return; }
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          box.className = 'projMsg ok';
+          box.textContent = data.message || (verb === 'revive' ? 'Revive queued — bringing it back.' : 'Queued again — the platform picks it up from here.');
+          return;
+        }
+        var e = apiError(data, res.status);
+        box.className = 'projMsg err';
+        box.textContent = e.message || 'The request could not be queued — try again in a moment.';
+      });
+    }).catch(function () {
+      box.className = 'projMsg err';
+      box.textContent = 'Couldn’t reach the platform — check your connection and try again.';
+    }).then(function () { loadManage(true, true); });
+  }
+  $('mActs').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('button');
+    if (!t) return;
+    if (t.hasAttribute('data-m-retry')) return mReProvision('retry');
+    if (t.hasAttribute('data-m-revive')) return mReProvision('revive');
+  });
+
+  /* an IN-FLIGHT project is watched here at the card's cadence — its own copy
+     says "this page updates when it starts", so it must. A settled project
+     keeps the C8 rule: entry + tab return, plus the request-free minute tick. */
+  function manageWatchTick() {
+    if (document.hidden || currentView !== 'manage' || !manageInst || !shouldWatch(manageInst)) return;
+    loadManage(true, true);
   }
+  setInterval(manageWatchTick, 5000);
 
-  function loadManage(quiet) {
+  /* keepRepo: the in-flight watch below re-reads the instance every few
+     seconds, and must not re-ask GitHub each time — that read stays on entry
+     and tab return */
+  function loadManage(quiet, keepRepo) {
     if (!manageId) return;
     $('mAlert').classList.remove('on');
     $('mSignin').href = manageSignin();
@@ -3990,7 +4171,7 @@ h1[tabindex="-1"]:focus{outline:none;}
         renderManage(inst);
         /* the SECOND, GitHub-backed read — fired only here (entry + tab
            return), never from renderManage, which the fetch-free tick calls */
-        loadRepoVisibility(inst);
+        if (!keepRepo) loadRepoVisibility(inst);
       })
       .catch(function (err) {
         var m = String(err && err.message);
@@ -4027,11 +4208,16 @@ h1[tabindex="-1"]:focus{outline:none;}
 
   function renderRepoVis(repo) {
     if (repo.private) {
+      /* a LIVE project with a private repo is not broken — the deploy key reads
+         it (ADR 0176). The warning stays for a project that actually snagged. */
+      var snagged = !!(manageInst && (manageInst.status === 'error' || manageInst.error_note));
       repoVisMsg(
         '<div class="addr">This repository is <b>private</b> — only accounts it’s shared with can read its code.</div>' +
-        '<div class="projMsg err">A private repository deploys through the project’s own read-only deploy key, wired at standup. A project set up before that fix can’t read it yet — retry the standup from your projects page, or make the repository public.</div>' +
+        (snagged
+          ? '<div class="projMsg err">A private repository deploys through the project’s own read-only deploy key, wired at standup. If the standup couldn’t read it, retry it from the card above — or make the repository public.</div>'
+          : '<p class="finePrint">The platform reads it through this project’s own read-only deploy key, set up at standup. Nothing to do here.</p>') +
         (repo.admin
-          ? '<div class="actions"><button type="button" class="btn small" data-repo-public>Make it public</button></div>'
+          ? '<div class="actions"><button type="button" class="btn small ghost" data-repo-public>Make it public</button></div>'
           : '<p class="finePrint">Your GitHub account can’t change this repository’s settings.</p>'));
     } else {
       repoVisMsg(
@@ -4234,16 +4420,22 @@ h1[tabindex="-1"]:focus{outline:none;}
   /* ── teardown: ask, confirm (the truth, itemized — direction §5.4), then
      SAY exactly what the server said ── */
 
+  /* the id whose confirmation is open — renderCard skips that card, so the
+     minute re-render (sig() buckets recency) cannot wipe the prompt mid-read
+     (the manage page's mDelAsking rule, task 1003232) */
+  var cardAsking = null;
   function askTeardown(id) {
     var act = $('act-' + id);
     if (!act) return;
+    cardAsking = String(id);
     act.innerHTML = '<div class="confirmRow">' +
       '<span class="plain">Tear it down? ' + teardownTruth(byId[id]) + '</span>' +
       '<button type="button" class="btn small danger" data-teardown-yes="' + esc(id) + '">Yes, tear it down</button>' +
       '<button type="button" class="linklike" data-teardown-no="' + esc(id) + '">Keep it running</button></div>';
   }
-  function unAskTeardown(id) { var inst = byId[id]; if (inst) renderCard(inst); }
+  function unAskTeardown(id) { cardAsking = null; var inst = byId[id]; if (inst) renderCard(inst); }
   function doTeardown(id) {
+    cardAsking = null;
     var act = $('act-' + id);
     if (act) act.innerHTML = '<span class="projMsg">Asking…</span>';
     fetch(API + '/provisioning/instances/' + encodeURIComponent(id) + '/teardown', {
@@ -4299,7 +4491,7 @@ h1[tabindex="-1"]:focus{outline:none;}
       if (res.status === 401) { msg(id, signInAgain(), 'err'); return null; }
       return jsonOrEmpty(res).then(function (data) {
         if (res.ok) {
-          msg(id, esc(data.message || (verb === 'revive' ? 'Revive queued — bringing it back.' : 'Queued again — a runner picks it up from here.')), 'ok');
+          msg(id, esc(data.message || (verb === 'revive' ? 'Revive queued — bringing it back.' : 'Queued again — the platform picks it up from here.')), 'ok');
           return;
         }
         var e = apiError(data, res.status);