@bongos/core 1.19.331 → 1.19.332

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.331",
-  "core_contract": "1.19.331",
-  "source_commit": "cc85e05304300cfad9f701b9f9432f1f74b5cf53",
+  "core_version": "1.19.332",
+  "core_contract": "1.19.332",
+  "source_commit": "e2808f7a5ce4556d6265f326004a0cc87f463841",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T00:01:28.994Z",
+  "built_at": "2026-08-25T00:18:07.252Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 324,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1811,
-  "tree_sha256": "68c81c790b852a7c79d261a2d55f43ec6c2dbc17f1e89a80757b41023f929748",
+  "tree_sha256": "e1c90c92977490868bc70a33b665c39305e4a5ec7c2b8af2f042df1ad8151de5",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4667,12 +4667,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0d95e9a5ad8a6d63dba589cbe1bc8f4497bebf1470776bdbfcf21f470a7bb81e"
+      "sha256": "bc62624584d42e3c04dda858b69f3fdbb1c09db67d54c46b1e7601f004c2eca9"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ab2dde9733b1e67f8099474fc5d998b4e4c2060b2ac239ddd16db36bd1570fa5"
+      "sha256": "be5885b562847832c030b3dcbed240eb204a1c648eb6835d0b3bddb107aec2f6"
     },
     {
       "path": "public-docs/index.html",
@@ -4912,7 +4912,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "a7f21729b00719b22cfd13c14b33d87f4fdd8aaa2890a174bfc36d1b53c1e5e4"
+      "sha256": "2a258be2790a6fadd1c2d9e190675c62e2b68dddece65f497b4e983c6d9b9146"
     },
     {
       "path": "public-landing/assets/verro-medallion.png",
@@ -4932,7 +4932,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "203b726527c02ed0383945c431df062ae6f02ed64cadc7942f9fef3e587a9da6"
+      "sha256": "44474703a87cecfa8f80ecbca6ecfb03d4fc3ccf166fe26bc4c310f404f5f76a"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -6452,7 +6452,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "11aa1bff9445edc29d7fe5034536edc7a6758e2f3d4c91d4b16a45c8ca1091ba"
+      "sha256": "34ffbdddcf9e14262f980f9badc4f19eee6235321572aeb71809810eb09b32b5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8332,7 +8332,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "a3cea371bb80b2dc05762a11bc43de84667f06db8723e384b34073e48fdfda6a"
+      "sha256": "c30221f0cb0b23b7f18b2edffd26cb895038543b07ee87c7a401508131edfc1a"
     },
     {
       "path": "tests/promote_goal_id.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.331",
+  "version": "1.19.332",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.331",
+      "version": "1.19.332",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.331",
+  "version": "1.19.332",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -414,6 +414,10 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 /* ── page-level bits ── */
 .alert{display:none;background:var(--err-soft);border:2px solid color-mix(in srgb,var(--err) 25%,transparent);color:var(--err);font-weight:600;font-size:14px;border-radius:14px;padding:12px 16px;margin-bottom:18px;}
 .alert.on{display:block;}
+/* the raw server text folds under the alert's plain sentence (task 1003244) */
+.alert details{margin-top:8px;}
+.alert summary{cursor:pointer;font-size:12.5px;font-weight:700;}
+.alert details p{margin-top:6px;font-family:var(--font-mono);font-size:12px;font-weight:500;overflow-wrap:anywhere;}
 .loading{font-size:14.5px;font-weight:600;color:var(--ink-faint);padding:14px 0;}
 .empty{border:2px dashed var(--line);border-radius:18px;padding:22px;text-align:center;}
 .empty p{font-size:14.5px;font-weight:600;color:var(--ink-soft);margin-bottom:14px;line-height:1.55;}

package/public-landing/projects.html

@@ -614,7 +614,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
              stripFor/errMarkup/canRetry/canRevive the list card reads -->
         <div id="mStrip"></div>
         <div class="projMsg err" id="mErr" hidden></div>
-        <div class="projMsg" id="mMsg"></div>
+        <div class="projMsg" id="mMsg" role="status" aria-live="polite"></div>
         <div class="actions" id="mActs" hidden></div>
       </div>
 
@@ -683,7 +683,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
   <div class="wrap viewWrap">
     <div class="card">
       <ol class="steps" aria-label="Creation steps">
-        <li class="now" data-step="1"><span class="snum">1</span><span class="slbl">Name</span></li>
+        <li class="now" data-step="1" aria-current="step"><span class="snum">1</span><span class="slbl">Name</span></li>
         <li data-step="2"><span class="snum">2</span><span class="slbl">Type</span></li>
         <li data-step="3"><span class="snum">3</span><span class="slbl">Home</span></li>
         <li data-step="4"><span class="snum">4</span><span class="slbl">Address</span></li>
@@ -2400,16 +2400,27 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
        Six steps since task 1002772: gate 0 · name 1 · type 2 · home 3 ·
        address 4 · review 5 · done 6 (the rail shows 1-5; done marks it all). */
     var panels = { 0: 'panel-gate', 1: 'panel-name', 2: 'panel-type', 3: 'panel-home', 4: 'panel-address', 5: 'panel-review', 6: 'panel-done' };
+    /* the rail at the done panel (task 1003244): "done" is the Create step
+       still running — the marker stays on 5 until the project actually
+       answers, and only then does the whole rail read finished. aria-current
+       tells a screen reader the same thing. */
+    function paintRail(step) {
+      var landed = step === 6 && !!(live && live.instStatus === 'active');
+      var cur = step === 6 ? 5 : step;
+      root.querySelectorAll('.steps li').forEach(function (li) {
+        var n = Number(li.getAttribute('data-step'));
+        var now = !landed && n === cur;
+        li.classList.toggle('now', now);
+        li.classList.toggle('done', landed || n < cur);
+        if (now) li.setAttribute('aria-current', 'step'); else li.removeAttribute('aria-current');
+      });
+    }
     function show(step, moveFocus) {
       state.step = step;
       Object.keys(panels).forEach(function (k) {
         $(panels[k]).classList.toggle('on', Number(k) === step);
       });
-      root.querySelectorAll('.steps li').forEach(function (li) {
-        var n = Number(li.getAttribute('data-step'));
-        li.classList.toggle('now', n === step);
-        li.classList.toggle('done', n < step || step === 6);
-      });
+      paintRail(step);
       saveDraft();
       /* the done step takes the whole card — the bongo pair steps aside */
       root.querySelector('.createSplit').classList.toggle('wizDone', step === 6);
@@ -2782,14 +2793,24 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
     }
 
     /* ── create ── */
+    /* the mapped codes are headline-only; anything else gets a fixed owner
+       sentence with the raw text folded under Technical details (direction
+       §5.1, task 1003244) — operator text is never the headline */
     function friendlyCreateError(err) {
       var code = err && err.data && err.data.error && (err.data.error.code || '');
       if (code === 'slug_taken') return 'That handle is already taken by another project. Pick a different one.';
       if (code === 'bad_slug') return 'The handle didn’t pass the server’s checks — 2–40 lowercase letters, numbers, or dashes.';
-      if (code === 'domain_reserved') return 'That address is reserved for the platform itself. Pick a different handle, or bring a domain you own.';
+      /* both server branches: a reserved hostname, and any name under the platform's own apex */
+      if (code === 'domain_reserved') return 'That address belongs to the platform’s own domain — your project already gets its own address there from its handle. Use a domain you own instead.';
       if (code === 'domain_taken') return 'That address is already held by another project. Pick a different handle or domain.';
       if (code === 'bad_domain') return 'The domain didn’t parse as a real hostname — use something like myproject.example.com.';
-      return 'Couldn’t file the request: ' + (err && err.message ? err.message : 'something went sideways. Try again.');
+      if (code === 'repo_scope_required') return 'GitHub hasn’t granted repository access for this session. Sign in again — it asks for repository access — and try once more.';
+      if (code === 'request_failed') return 'The platform couldn’t file the request. Nothing was created — try again in a moment.';
+      return '';
+    }
+    function createFailureMarkup(err) {
+      return 'We couldn’t file the request just now. Nothing was created — you can try again.' +
+        '<details><summary>Technical details</summary><p>' + esc(err && err.message ? err.message : 'no detail came back') + '</p></details>';
     }
 
     /* Fresh + repo access: auto-create the empty GitHub repo NOW (the commit moment),
@@ -2901,7 +2922,9 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
           $('h-home').className = 'hint err';
           return;
         }
-        alertBox.textContent = friendlyCreateError(err);
+        var friendly = friendlyCreateError(err);
+        if (friendly) alertBox.textContent = friendly;
+        else alertBox.innerHTML = createFailureMarkup(err);
         alertBox.classList.add('on');
       });
     });
@@ -2918,7 +2941,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
     var GH_ICON = '<svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>';
 
     var instanceId = null;             /* set when a create lands / a resumed watch starts */
-    var live = { instStatus: null, manifest: null, manifestMsg: '', appSlug: null };
+    var live = { instStatus: null, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
     var planPromises = {};             /* mode|domain → Promise<steps[]> */
     var lastStepsHtml = '';
     var FALLBACK_HUMAN_KEYS = ['github-repo', 'oauth-app', 'device-flow', 'app-install', 'first-sign-in', 'enter-hall'];
@@ -3000,8 +3023,15 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
         return '<li class="sdone" data-onboard-step="oauth-app"><b>GitHub sign-in is wired</b><p>Credentials placed and verified — sign-in on <code style="font-family:var(--font-mono)">' + esc(domain) + '</code> is live.</p></li>';
       }
       if (live.manifest === 'error' || live.manifest === 'expired') {
-        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>' +
-          (live.manifest === 'expired' ? 'That setup link expired (they last 30 minutes) — mint a fresh one.' : 'GitHub setup hit a snag' + (live.manifestMsg ? ': ' + esc(live.manifestMsg) : '') + '. Try again.') + '</p>' +
+        /* a plain sentence first; the raw route text folds under Technical
+           details (task 1003244). The one refusal a founder can act on — no
+           address yet — says where to go instead of what the server said. */
+        var snag, raw = '';
+        if (live.manifest === 'expired') snag = 'That setup link expired (they last 30 minutes) — mint a fresh one.';
+        else if (live.manifestCode === 'domain_required') snag = 'This project needs an address first — attach one from <a href="?view=mine">your projects page</a>, then come back to this step.';
+        else { snag = 'GitHub setup didn’t start. Nothing was changed on GitHub — try again.'; raw = live.manifestMsg; }
+        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>' + snag + '</p>' +
+          (raw ? '<details><summary>Technical details</summary><p>' + esc(raw) + '</p></details>' : '') +
           '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
       }
       if (live.manifest === 'code_received') {
@@ -3186,6 +3216,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
         return res.json().catch(function () { return {}; }).then(function (d) {
           if (!res.ok) {
             var e = new Error((d.error && (d.error.message || d.error.code)) || ('HTTP ' + res.status));
+            e.code = (d.error && d.error.code) || '';
             throw e;
           }
           return d;
@@ -3206,6 +3237,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
         if (String(err && err.message) === 'signing in') return;
         if (tab) { try { tab.close(); } catch (e) {} }
         live.manifest = 'error'; live.manifestMsg = String((err && err.message) || 'could not start');
+        live.manifestCode = String((err && err.code) || '');
         renderSteps();
       });
     }
@@ -3380,7 +3412,10 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
             /* the checklist reflects live state (task 1002694): a status transition —
                e.g. the scaffold landing — re-renders the steps (change-only, so the
                5s tick never clobbers an open dropdown or mid-flight button) */
-            if (inst && inst.status !== live.instStatus) { live.instStatus = inst.status; renderSteps(); }
+            if (inst && inst.status !== live.instStatus) {
+              live.instStatus = inst.status; renderSteps();
+              if (state.step === 6) paintRail(6);   /* the rail finishes only when the project answers */
+            }
             var terminal = renderProgress(inst);
             if (!terminal) pollTimer = setTimeout(tick, 5000);
             else stopPolling();
@@ -3412,7 +3447,7 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
         instanceId = null;
         watchPending = false; manifestPending = false; manifestState = null;
         manifestStartedAt = 0; manifestStale = false;
-        live = { instStatus: null, manifest: null, manifestMsg: '', appSlug: null };
+        live = { instStatus: null, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
         lastStepsHtml = '';
         try { sessionStorage.removeItem(CREATED_KEY); sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
         state = { step: 1, name: '', projType: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
@@ -3882,7 +3917,9 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
           : '. The repository is still yours, and its database is kept — bringing it back takes one click. Or <a href="?view=new">start another</a>.</div>');
     }
     var lm = lastMsg[inst.id];
-    body += '<div class="projMsg' + (lm && lm.cls ? ' ' + lm.cls : '') + '" id="msg-' + iid + '">' + (lm ? lm.text : '') + '</div>';
+    /* a live region: an action's result is announced where the pointer is,
+       not only painted (task 1003244) */
+    body += '<div class="projMsg' + (lm && lm.cls ? ' ' + lm.cls : '') + '" id="msg-' + iid + '" role="status" aria-live="polite">' + (lm ? lm.text : '') + '</div>';
     /* every owned card opens its manage view (task 1003041) — a real link, so
        middle/ctrl-click works; the delegated handler upgrades a plain click */
     var acts = ['<a class="btn small ghost" data-manage="' + iid + '" href="?view=manage&id=' + iid + '">Manage</a>'];
@@ -3903,12 +3940,51 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
     var keepOpen = !!(oldFold && oldFold.open);
     var typed = oldInput && oldInput.value !== oldInput.defaultValue ? oldInput.value : '';
     var hadFocus = !!oldInput && document.activeElement === oldInput;
+    /* focus anywhere else on the card (a door, a confirm, the fold's summary)
+       comes back to the same control — or the nearest one — after the swap;
+       quietActions() leaves a note when a disabled button already let go */
+    var wasInside = li.contains(document.activeElement) && document.activeElement !== li;
+    var prefer = wasInside ? focusKeyOf(document.activeElement) : null;
+    var focusBack = wasInside || li.hasAttribute('data-focus-back');
+    li.removeAttribute('data-focus-back');
     li.innerHTML = orbFor(inst) + '<div class="projBody">' + body + '</div>';
     var fold = li.querySelector('details.attachFold');
     var input = fold ? fold.querySelector('input') : null;
     if (fold && keepOpen) fold.open = true;
     if (input && typed) input.value = typed;
     if (input && hadFocus) input.focus();
+    else if (focusBack) focusCardControl(inst.id, prefer);
+  }
+
+  /* ── keeping focus on the card through a re-render (task 1003244) ── */
+
+  /* which control had focus, as a selector the rebuilt card can answer;
+     a confirm's Yes/Keep lands back on the door that opened it */
+  function focusKeyOf(el) {
+    if (!el || !el.getAttribute) return null;
+    if (el.tagName === 'SUMMARY') return 'details.attachFold summary';
+    if (el.hasAttribute('data-teardown-yes') || el.hasAttribute('data-teardown-no')) return '[data-teardown]';
+    var keys = ['data-manage', 'data-attach', 'data-retry', 'data-revive', 'data-teardown'];
+    for (var i = 0; i < keys.length; i++) if (el.hasAttribute(keys[i])) return '[' + keys[i] + ']';
+    return null;
+  }
+  function focusCardControl(id, prefer) {
+    var li = liFor(id);
+    if (!li) return;
+    var t = (prefer && li.querySelector(prefer)) ||
+      li.querySelector('.actions a, .actions button') ||
+      li.querySelector('details.attachFold summary');
+    if (t) t.focus();
+  }
+  /* an action in flight: the row stays put and its buttons go quiet, so
+     nothing under the pointer is deleted mid-click; a button that held
+     focus lets go when disabled, so the card remembers to take it back */
+  function quietActions(id) {
+    var act = $('act-' + id);
+    if (!act) return;
+    var li = liFor(id);
+    if (li && act.contains(document.activeElement)) li.setAttribute('data-focus-back', '');
+    act.querySelectorAll('button').forEach(function (b) { b.disabled = true; });
   }
 
   function render(instances) {
@@ -4465,16 +4541,20 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
     var act = $('act-' + id);
     if (!act) return;
     cardAsking = String(id);
-    act.innerHTML = '<div class="confirmRow">' +
+    act.innerHTML = '<div class="confirmRow" tabindex="-1">' +
       '<span class="plain">Tear it down? ' + teardownTruth(byId[id]) + '</span>' +
       '<button type="button" class="btn small danger" data-teardown-yes="' + esc(id) + '">Yes, tear it down</button>' +
       '<button type="button" class="linklike" data-teardown-no="' + esc(id) + '">Keep it running</button></div>';
+    /* the pressed button is gone — focus lands on the question itself, so
+       the truth is read before Tab reaches Yes (task 1003244) */
+    var row = act.firstChild;
+    if (row && row.focus) row.focus();
   }
   function unAskTeardown(id) { cardAsking = null; var inst = byId[id]; if (inst) renderCard(inst); }
   function doTeardown(id) {
     cardAsking = null;
-    var act = $('act-' + id);
-    if (act) act.innerHTML = '<span class="projMsg">Asking…</span>';
+    quietActions(id);
+    msg(id, 'Asking…');
     fetch(API + '/provisioning/instances/' + encodeURIComponent(id) + '/teardown', {
       method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' }, body: '{}'
     }).then(function (res) {
@@ -4501,8 +4581,8 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
     }).catch(function () {
       msg(id, 'Couldn’t reach the platform — check your connection and try again.', 'err');
     }).then(function () {
-      /* restore the actions row ("Asking…" replaced it) even when the state
-         didn't change, then pick up whatever DID change */
+      /* wake the quieted row even when the state didn't change (renderCard
+         also hands focus back), then pick up whatever DID change */
       if (byId[id]) renderCard(byId[id]);
       watchOnce(id);
     });
@@ -4515,8 +4595,8 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
   function reProvision(id, verb) {
     var inst = byId[id];
     if (!inst) return;
-    var act = $('act-' + id);
-    if (act) act.innerHTML = '<span class="projMsg">Asking…</span>';
+    quietActions(id);
+    msg(id, 'Asking…');
     var body = { slug: inst.slug, hosting_shape: inst.hosting_shape || 'standalone' };
     if (inst.onboard_mode) body.onboard_mode = inst.onboard_mode;
     if (inst.target_ref) body.target_ref = inst.target_ref;

package/src/module-api.js

@@ -1089,8 +1089,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.329 with no explicit bump. run 32789596635. (task 1002620)
 //   1.19.331 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.330 with no explicit bump. run 32791877167. (task 1002620)
+//   1.19.332 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.331 with no explicit bump. run 32793033453. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.331'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.332'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub_pre_uat.mjs

@@ -309,3 +309,56 @@ test('decision 10 — both footers carry the open-source (AGPL-3.0) link, in lin
   assert.ok(indexFoot.indexOf('<!--apex-only:end-->') < indexFoot.search(AGPL), 'index.html: after the apex-only block');
   assert.match(COSMOS, /\.foot a\{color:var\(--link-ink\);font-weight:700;text-decoration:none;\}/, 'never the browser’s blue');
 });
+
+/* ── the should-fix remainder (task 1003244) ── */
+test('an unmapped create failure gets a plain sentence with the raw text folded under Technical details', () => {
+  const friendly = fn('friendlyCreateError');
+  assert.match(friendly, /return '';\n\s*\}/, 'unmapped codes return nothing — the caller folds them');
+  assert.doesNotMatch(friendly, /Couldn’t file the request: ' \+/, 'the raw message is no longer the headline');
+  for (const code of ['slug_taken', 'bad_slug', 'domain_reserved', 'domain_taken', 'bad_domain', 'repo_scope_required', 'request_failed']) {
+    assert.match(friendly, new RegExp(`code === '${code}'`), `${code} stays headline-only`);
+  }
+  assert.match(friendly, /belongs to the platform’s own domain/, 'domain_reserved covers both server branches');
+  assert.match(fn('createFailureMarkup'), /Nothing was created — you can try again\.' \+\n\s*'<details><summary>Technical details<\/summary><p>' \+ esc\(err && err\.message/);
+  assert.match(SCRIPT, /if \(friendly\) alertBox\.textContent = friendly;\n\s*else alertBox\.innerHTML = createFailureMarkup\(err\);/);
+  assert.match(COSMOS, /\.alert details p\{[^}]*font-family:var\(--font-mono\)/, 'the raw text reads as code, inside the alert');
+});
+
+test('a manifest error says a plain sentence, folds the route text, and sends a domainless project to its address', () => {
+  const steps = fn('renderStepOauthApp');
+  assert.doesNotMatch(steps, /'GitHub setup hit a snag' \+ \(live\.manifestMsg \? ': ' \+ esc\(live\.manifestMsg\)/, 'the raw route text is no longer the headline');
+  assert.match(steps, /else if \(live\.manifestCode === 'domain_required'\) snag = 'This project needs an address first — attach one from <a href="\?view=mine">your projects page<\/a>/);
+  assert.match(steps, /\(raw \? '<details><summary>Technical details<\/summary><p>' \+ esc\(raw\) \+ '<\/p><\/details>' : ''\)/);
+  assert.match(SCRIPT, /e\.code = \(d\.error && d\.error\.code\) \|\| '';/, 'the route code travels with the error');
+  assert.match(SCRIPT, /live\.manifestCode = String\(\(err && err\.code\) \|\| ''\);/);
+  assert.equal((SCRIPT.match(/manifestMsg: '', manifestCode: '', appSlug: null/g) || []).length, 2, 'both resets carry the code');
+});
+
+test('the rail at the done panel keeps its marker on Create until the project answers', () => {
+  const rail = fn('paintRail');
+  assert.match(rail, /var landed = step === 6 && !!\(live && live\.instStatus === 'active'\);/);
+  assert.match(rail, /var cur = step === 6 \? 5 : step;/);
+  assert.match(rail, /li\.classList\.toggle\('done', landed \|\| n < cur\);/);
+  assert.match(rail, /if \(now\) li\.setAttribute\('aria-current', 'step'\); else li\.removeAttribute\('aria-current'\);/);
+  assert.match(fn('show'), /paintRail\(step\);/, 'show() paints through it');
+  assert.doesNotMatch(fn('show'), /classList\.toggle\('done'/, 'and no longer marks the rail on its own');
+  assert.match(SCRIPT, /live\.instStatus = inst\.status; renderSteps\(\);\n\s*if \(state\.step === 6\) paintRail\(6\);/, 'the done-panel poll repaints when the status moves');
+  assert.match(HUB, /<li class="now" data-step="1" aria-current="step">/, 'the static rail starts with the same marker');
+});
+
+test('card action results announce, nothing under the pointer is deleted, and focus stays on the card', () => {
+  assert.match(fn('renderCard'), /id="msg-' \+ iid \+ '" role="status" aria-live="polite">/, 'the card slot is a live region');
+  assert.match(HUB, /<div class="projMsg" id="mMsg" role="status" aria-live="polite"><\/div>/, 'so is the manage page’s');
+  assert.doesNotMatch(SCRIPT, /act\.innerHTML = '<span class="projMsg">Asking…<\/span>'/, 'no action replaces the row it was pressed in');
+  assert.match(fn('doTeardown'), /quietActions\(id\);\n\s*msg\(id, 'Asking…'\);/);
+  assert.match(fn('reProvision'), /quietActions\(id\);\n\s*msg\(id, 'Asking…'\);/);
+  assert.match(fn('quietActions'), /act\.querySelectorAll\('button'\)\.forEach\(function \(b\) \{ b\.disabled = true; \}\);/);
+  assert.match(fn('quietActions'), /li\.setAttribute\('data-focus-back', ''\)/, 'a disabled button that held focus leaves a note');
+  assert.match(fn('askTeardown'), /<div class="confirmRow" tabindex="-1">/);
+  assert.match(fn('askTeardown'), /if \(row && row\.focus\) row\.focus\(\);/, 'the question takes focus when the button goes');
+  const card = fn('renderCard');
+  assert.match(card, /var wasInside = li\.contains\(document\.activeElement\) && document\.activeElement !== li;/);
+  assert.match(card, /else if \(focusBack\) focusCardControl\(inst\.id, prefer\);/);
+  assert.match(fn('focusKeyOf'), /data-teardown-yes'\) \|\| el\.hasAttribute\('data-teardown-no'\)\) return '\[data-teardown\]'/, 'Yes / Keep land back on the door that opened them');
+  assert.match(fn('focusCardControl'), /li\.querySelector\('\.actions a, \.actions button'\) \|\|\n\s*li\.querySelector\('details\.attachFold summary'\)/, 'nearest control as the fallback');
+});