@bongos/core 1.19.439 → 1.19.440

package/public-landing/projects.html

@@ -695,6 +695,20 @@ summary{min-height:24px;padding:3px 0;}
         <div class="actions" id="mActs" hidden></div>
       </div>
 
+      <!-- its address (task 1003355): the bring-your-own-domain control, moved
+           off the list row when a row shrank to view and manage. Its home is
+           here, under the ledger's address fact. The section hides itself where
+           there is nothing to point an address at (a snagged or torn-down
+           project) — the same call the card's fold used to make. -->
+      <div class="card mSec" id="mAddress" hidden>
+        <h2>Its address</h2>
+        <div id="mDom"><p class="finePrint">Reading the project…</p></div>
+        <details class="finePrint" id="mDomWhat">
+          <summary>Where an address comes from</summary>
+          <p>Every project gets one on this platform, at its own handle. You can point a domain you already own at it instead: type the name here, then add a DNS record for it at your registrar. The platform holds the address for this project and wires the secure connection once the name resolves. Changing it later lets the old address go, and nothing on the project restarts for it.</p>
+        </details>
+      </div>
+
       <!-- live since task 1003045: reads the repo's real visibility from GitHub
            with the owner's own repository credential. Flip-to-PUBLIC only — the
            private direction is refused (server + copy) until the private-repo
@@ -3447,6 +3461,14 @@ summary{min-height:24px;padding:3px 0;}
     var GH_ICON = '<svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>';
 
     var instanceId = null;             /* set when a create lands / a resumed watch starts */
+    /* where a project is ACTED on since task 1003355: its own page. A list row
+       carries only view and manage now, so every pointer that names a control —
+       attach an address, retry a snagged standup, bring a torn-down project
+       back — must land there, not on the list, which has no such button. */
+    function projectPageLink(label) {
+      return '<a href="' + (instanceId ? '?view=manage&id=' + encodeURIComponent(instanceId) : '?view=mine') +
+        '">' + label + '</a>';
+    }
     var live = { instStatus: null, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
     var planPromises = {};             /* mode|domain → Promise<steps[]> */
     var lastStepsHtml = '';
@@ -3518,7 +3540,7 @@ summary{min-height:24px;padding:3px 0;}
     function renderStepOauthApp() {
       var domain = resolvedDomain();
       if (!domain) {
-        return '<li class="slocked" data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Unlocks once your project has an address — sign-in needs a real domain. Attach one any time from <a href="?view=mine">your projects page</a>.</p></li>';
+        return '<li class="slocked" data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Unlocks once your project has an address — sign-in needs a real domain. Attach one any time from ' + projectPageLink('this project’s own page') + '.</p></li>';
       }
       /* honesty about the venue (owner walk, 2026-08-12): GitHub rejects app
          manifests whose hook URL isn't publicly reachable, so a locally-hosted
@@ -3535,7 +3557,7 @@ summary{min-height:24px;padding:3px 0;}
            address yet — says where to go instead of what the server said. */
         var snag, raw = '';
         if (live.manifest === 'expired') snag = 'That setup link expired (they last 30 minutes) — mint a fresh one.';
-        else if (live.manifestCode === 'domain_required') snag = 'This project needs an address first — attach one from <a href="?view=mine">your projects page</a>, then come back to this step.';
+        else if (live.manifestCode === 'domain_required') snag = 'This project needs an address first — attach one from ' + projectPageLink('its own page') + ', then come back to this step.';
         else { snag = 'GitHub setup didn’t start. Nothing was changed on GitHub — try again.'; raw = live.manifestMsg; }
         return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>' + snag + '</p>' +
           (raw ? '<details><summary>Technical details</summary><p>' + esc(raw) + '</p></details>' : '') +
@@ -3866,7 +3888,8 @@ summary{min-height:24px;padding:3px 0;}
              answer at, so a verified answer can never arrive; say what IS true
              instead of promising the hall (sign-in stays locked without one) */
           setProgress(progressMarkup(-1, 2,
-            'The build finished — your project is standing, but it has no address yet, so sign-in can’t be wired up. Attach a domain any time from <a href="?view=mine">your projects page</a>; the steps below that need one unlock then.', '', flow));
+            'The build finished — your project is standing, but it has no address yet, so sign-in can’t be wired up. Attach a domain any time from ' +
+            projectPageLink('its own page') + '; the steps below that need one unlock then.', '', flow));
           return true;
         }
         if (inst.last_verified_up === false) {
@@ -3885,16 +3908,19 @@ summary{min-height:24px;padding:3px 0;}
         return false;
       } else if (s === 'error') {
         /* the honest snag (direction §5 / F19): no raw stderr as the headline, no
-           false "keeps retrying" — retries stop, and the retry door is the mine view */
+           false "keeps retrying" — retries stop, and the retry door is the project's
+           own page (task 1003355 moved it off the row) */
         setProgress(progressMarkup(1, 1,
-          'The standup stopped partway — it won’t continue on its own. Retry it (and see the technical details) from <a href="?view=mine">your projects page</a>.', 'isErr'));
+          'The standup stopped partway — it won’t continue on its own. Retry it (and see the technical details) from ' +
+          projectPageLink('its own page') + '.', 'isErr'));
       } else if (s === 'tearing_down') {
         /* a deliberate end is calm, never styled as a failure (direction §5) —
            and it speaks the teardown vocabulary, not the standup's (F22) */
         setProgress(progressMarkup(1, 1, 'Taking the server offline. The repository stays yours; ' +
           (inst.hosting_shape === 'dedicated' ? 'its database goes with the machine.' : 'the database is kept.'), '', 'teardown'));
       } else if (s === 'torn_down') {
-        setProgress(progressMarkup(-1, 3, 'This instance was torn down. Bring it back any time from <a href="?view=mine">your projects page</a>, or start another below.', '', 'teardown'));
+        setProgress(progressMarkup(-1, 3, 'This instance was torn down. Bring it back any time from ' +
+          projectPageLink('its own page') + ', or start another below.', '', 'teardown'));
         return true;
       } else {
         setProgress(progressMarkup(0, 0, 'Filed. Watching for the standup to start…'));
@@ -4234,16 +4260,6 @@ summary{min-height:24px;padding:3px 0;}
     return chipMarkup('', inst.status);
   }
 
-  /* client mirror of provisioning.TEARDOWN_FROM — every state EXCEPT torn_down
-     (nothing left to release), minus tearing_down (already going) and minus a
-     teardown that is already queued. It used to list only provisioning+active,
-     which is how a snagged project ended up with no way out of the owner's list
-     at all: its only button was "Try again" (walk finding N5, task 1003042). */
-  function canTeardown(inst) {
-    if (inst.open_intent && inst.open_intent.action === 'teardown') return false;
-    if (inst.status === 'tearing_down' || inst.status === 'torn_down') return false;
-    return true;
-  }
   /* client mirror of provisioning.DOMAIN_ATTACH_FROM */
   /* the platform-assigned <slug>.<apex> for this instance, from the server-stamped
      apex only — no host guessing here: the upgrade door below must never show for
@@ -4471,7 +4487,11 @@ summary{min-height:24px;padding:3px 0;}
       : 'The server goes away. Your repository is untouched. The database is kept, so bringing it back later restores its memory. Its web address stays reserved for this project and shows an error page until you bring it back. Nothing here erases a project.';
   }
 
-  function addressRow(inst) {
+  /* onManage: the same facts, but the pointers name the controls THIS surface
+     has. Since task 1003355 the list row acts on nothing, so a row's sentence
+     sends the owner to the project's own page and the manage page's says
+     "below" — the ADR 0199 §8 rule that a refusal must name a reachable door. */
+  function addressRow(inst, onManage) {
     /* state FIRST, then domain: a torn-down or snagged project still holds its
        domain (ADR 0181 keeps port + address), and the standup promise below
        was reaching it — "answers once the instance is live" two lines above
@@ -4499,7 +4519,7 @@ summary{min-height:24px;padding:3px 0;}
            available. Where there is no button the sentence stops at the full stop. */
         if (inst.last_verified_up === false) {
           return 'Not answering at ' + link + ' right now. We keep checking every few minutes and update this on its own if it comes back' +
-            (canRestart(inst) ? ' — or restart it yourself below.' : '.');
+            (canRestart(inst) ? (onManage ? ' — or restart it yourself below.' : ' — or restart it from its own page.') : '.');
         }
         if (inst.last_verified_up) return 'Its address is ' + link + ' — last answered ' + esc(relTime(verifiedAt(inst))) + '.';
         return 'Its address is ' + link + ' — confirming it answers.';
@@ -4508,50 +4528,9 @@ summary{min-height:24px;padding:3px 0;}
       return 'Address: <code>' + esc(inst.domain) + '</code> — it answers there once the instance is live.';
     }
     /* the HONEST no-address state: sign-in on the instance needs a real domain */
-    return '<span class="none">No address yet</span> — sign-in on this project can’t be set up until it has one. <a href="?view=mine" data-nav-to="mine">Give it an address from your projects</a>.';
-  }
-
-  /* ── the bring-your-own-domain fold (owner decision 2, 2026-08-24). A live
-     card's loudest control used to be a full-width domain field + filled
-     button — for a domain the founder can't buy here — while the success
-     moment had only "Open site →". The field now sits behind the disclosure
-     the wizard's address step uses (direction §6): closed, after the card's
-     doors, and only where something is or will be answering — live and
-     queued. A snagged or torn-down card has nothing to point a domain at, so
-     it carries no fold (canAttachDomain stays the server's mirror; this is
-     the card's own call). The re-kick door (F19) keeps its shape — open and
-     pre-filled, one button: Try the address again. ── */
-  function attachFold(inst, iid) {
-    if (!canAttachDomain(inst)) return '';
-    if (inst.status !== 'active' && inst.status !== 'requested') return '';
-    /* the strip already says "Wiring the address" — a second attach would only
-       be refused (intent_conflict), so the fold waits for the run to land */
-    if (inst.open_intent && inst.open_intent.action === 'domain-attach') return '';
-    var rekick = inst.status === 'active' && inst.domain && inst.error_note;
-    /* the CORRECTION door (task 1003237): the project already answers on an
-       address the founder brought, and it can be changed. The field carries the
-       current one so a typo is fixed by editing it, not retyped from scratch —
-       the re-kick door's shape, for the same reason. The platform-assigned
-       <slug>.<apex> is NOT a correction: moving off it is the upgrade the fold
-       already offered, and the field stays empty for the domain being brought. */
-    var byo = inst.domain && inst.domain !== assignedDefaultFor(inst);
-    var repoint = !rekick && byo;
-    var prefill = rekick || repoint;
-    var label = rekick ? 'Try the address again'
-      : repoint ? 'Use a different domain'
-      : inst.domain ? 'Use a domain I own' : 'Give it an address';
-    return '<details class="attachFold"' + (rekick ? ' open' : '') + '>' +
-      '<summary>' + label + '</summary>' +
-      '<div class="attach">' +
-      '<input type="text" id="dom-' + iid + '" placeholder="myproject.example.com" autocomplete="off" spellcheck="false" maxlength="253" aria-label="A domain you own, for ' + esc(inst.slug) + '"' +
-      (prefill ? ' value="' + esc(inst.domain) + '"' : '') + '>' +
-      '<button type="button" class="btn small" data-attach="' + iid + '">' +
-      (rekick ? 'Try the address again' : repoint ? 'Change the address' : 'Use this domain') + '</button></div>' +
-      /* true in every state the fold renders in: a REQUESTED project never
-         answered anywhere yet, so "stops answering" would be a claim about a
-         thing that never happened (the F16 rule) */
-      (repoint ? '<p class="attachNote">Changing it lets <code>' + esc(inst.domain) + '</code> go — this project won’t use that address any more.</p>' : '') +
-      '</details>';
+    return '<span class="none">No address yet</span> — sign-in on this project can’t be set up until it has one. ' +
+      (onManage ? 'Give it an address below.'
+        : '<a href="?view=manage&id=' + esc(String(inst.id)) + '" data-manage="' + esc(String(inst.id)) + '">Give it an address on its own page</a>.');
   }
 
   function renderCard(inst) {
@@ -4561,7 +4540,6 @@ summary{min-height:24px;padding:3px 0;}
     var iid = esc(String(inst.id));
     var li = liFor(inst.id);
     if (!li) return;
-    if (cardAsking !== null && cardAsking === String(inst.id)) return; /* keep THIS card's open confirmation */
     var gone = inst.status === 'torn_down';
     li.className = 'proj' + (gone ? ' gone' : '');
     var meta = [];
@@ -4596,73 +4574,38 @@ summary{min-height:24px;padding:3px 0;}
     /* a live region: an action's result is announced where the pointer is,
        not only painted (task 1003244) */
     body += '<div class="projMsg' + (lm && lm.cls ? ' ' + lm.cls : '') + '" id="msg-' + iid + '" role="status" aria-live="polite">' + (lm ? lm.text : '') + '</div>';
-    /* every owned card opens its manage view (task 1003041) — a real link, so
-       middle/ctrl-click works; the delegated handler upgrades a plain click */
-    var acts = ['<a class="btn small ghost" data-manage="' + iid + '" href="?view=manage&id=' + iid + '">Manage</a>'];
-    /* the success moment needs a door: a live project opens from its own card
-       (the orb and the address link were the only ways in — task 1003232) */
-    if (inst.status === 'active' && inst.domain) acts.unshift('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">Open site →</a>');
-    if (canRetry(inst)) acts.push('<button type="button" class="btn small" data-retry="' + iid + '">Try again</button>');
-    if (canRevive(inst)) acts.push('<button type="button" class="btn small" data-revive="' + iid + '">Bring it back</button>');
-    if (canRestart(inst)) acts.push('<button type="button" class="btn small" data-restart="' + iid + '">Restart it</button>');
-    if (canTeardown(inst)) acts.push('<button type="button" class="btn small danger" data-teardown="' + iid + '">Tear it down</button>');
-    if (acts.length) body += '<div class="actions" id="act-' + iid + '">' + acts.join('') + '</div>';
-    body += attachFold(inst, iid);
-    /* sig() buckets recency per minute, so a live card re-renders on the
-       heartbeat — that must not snap an open fold shut, eat a half-typed
-       domain or drop the caret. defaultValue tells a founder's typing from
-       the re-kick pre-fill. */
-    var oldFold = li.querySelector('details.attachFold');
-    var oldInput = oldFold ? oldFold.querySelector('input') : null;
-    var keepOpen = !!(oldFold && oldFold.open);
-    var typed = oldInput && oldInput.value !== oldInput.defaultValue ? oldInput.value : '';
-    var hadFocus = !!oldInput && document.activeElement === oldInput;
-    /* focus anywhere else on the card (a door, a confirm, the fold's summary)
-       comes back to the same control — or the nearest one — after the swap;
-       quietActions() leaves a note when a disabled button already let go */
+    /* TWO DOORS, never more (owner, 2026-08-29 — task 1003355): View opens the
+       project itself, Manage opens its own page. Restart, try again, bring it
+       back, the ender and the address all live there now, so a row SAYS what is
+       true and opens a door — it no longer acts on the project. Both are real
+       links, so middle/ctrl-click works; the delegated handler upgrades a plain
+       click on Manage (task 1003041). */
+    var acts = [];
+    if (inst.status === 'active' && inst.domain) acts.push('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">View</a>');
+    acts.push('<a class="btn small ghost" data-manage="' + iid + '" href="?view=manage&id=' + iid + '">Manage</a>');
+    body += '<div class="actions">' + acts.join('') + '</div>';
+    /* sig() buckets recency per minute, so a live row re-renders on the
+       heartbeat — a door that held focus must get it back after the swap */
     var wasInside = li.contains(document.activeElement) && document.activeElement !== li;
     var prefer = wasInside ? focusKeyOf(document.activeElement) : null;
-    var focusBack = wasInside || li.hasAttribute('data-focus-back');
-    li.removeAttribute('data-focus-back');
     li.innerHTML = orbFor(inst) + '<div class="projBody">' + body + '</div>';
-    var fold = li.querySelector('details.attachFold');
-    var input = fold ? fold.querySelector('input') : null;
-    if (fold && keepOpen) fold.open = true;
-    if (input && typed) input.value = typed;
-    if (input && hadFocus) input.focus();
-    else if (focusBack) focusCardControl(inst.id, prefer);
+    if (wasInside) focusCardControl(inst.id, prefer);
   }
 
   /* ── keeping focus on the card through a re-render (task 1003244) ── */
 
-  /* which control had focus, as a selector the rebuilt card can answer;
-     a confirm's Yes/Keep lands back on the door that opened it */
+  /* which door had focus, as a selector the rebuilt row can answer. Manage is
+     the one that carries a marker; View falls through to the .actions fallback,
+     which is the same element whenever both doors render. */
   function focusKeyOf(el) {
-    if (!el || !el.getAttribute) return null;
-    if (el.tagName === 'SUMMARY') return 'details.attachFold summary';
-    if (el.hasAttribute('data-teardown-yes') || el.hasAttribute('data-teardown-no')) return '[data-teardown]';
-    var keys = ['data-manage', 'data-attach', 'data-retry', 'data-revive', 'data-restart', 'data-teardown'];
-    for (var i = 0; i < keys.length; i++) if (el.hasAttribute(keys[i])) return '[' + keys[i] + ']';
-    return null;
+    return el && el.getAttribute && el.hasAttribute('data-manage') ? '[data-manage]' : null;
   }
   function focusCardControl(id, prefer) {
     var li = liFor(id);
     if (!li) return;
-    var t = (prefer && li.querySelector(prefer)) ||
-      li.querySelector('.actions a, .actions button') ||
-      li.querySelector('details.attachFold summary');
+    var t = (prefer && li.querySelector(prefer)) || li.querySelector('.actions a');
     if (t) t.focus();
   }
-  /* an action in flight: the row stays put and its buttons go quiet, so
-     nothing under the pointer is deleted mid-click; a button that held
-     focus lets go when disabled, so the card remembers to take it back */
-  function quietActions(id) {
-    var act = $('act-' + id);
-    if (!act) return;
-    var li = liFor(id);
-    if (li && act.contains(document.activeElement)) li.setAttribute('data-focus-back', '');
-    act.querySelectorAll('button').forEach(function (b) { b.disabled = true; });
-  }
 
   function render(instances) {
     $('loading').hidden = true;
@@ -4756,17 +4699,6 @@ summary{min-height:24px;padding:3px 0;}
     }
     timers[id] = setTimeout(tick, POLL_MS);
   }
-  function watchOnce(id) {
-    fetch(API + '/provisioning/instances/' + encodeURIComponent(id), { credentials: 'same-origin' })
-      .then(function (res) { if (!res.ok) throw new Error('soft'); return res.json(); })
-      .then(function (data) {
-        var inst = data.instance || {};
-        inst.open_intent = data.open_intent || null;
-        takeUpdate(id, inst);
-        if (shouldWatch(inst)) watch(id);
-      })
-      .catch(function () { if (byId[id] && shouldWatch(byId[id])) watch(id); });
-  }
 
   /* ── settled-card refresh: the heartbeat overlay must reach the page.
      A card at 'active' has no fast poll; once a minute (and on tab return)
@@ -4867,7 +4799,7 @@ summary{min-height:24px;padding:3px 0;}
     if (server) rows.push(['server', server]);
     $('mMeta').innerHTML = rows.map(ledgerRow).join('');
     $('mMeta').hidden = !rows.length;
-    var addr = addressRow(inst);
+    var addr = addressRow(inst, true);
     $('mAddr').innerHTML = addr ? ledgerRow(['address', addr]) : '';
     $('mAddr').hidden = !addr;
     /* a fact with no answer hides — never a dash (the card rule) */
@@ -4877,6 +4809,9 @@ summary{min-height:24px;padding:3px 0;}
        it: the delete section reads only status + open_intent, both already in
        hand, and a queued teardown must show up without a reload */
     renderDelete(inst);
+    /* its address (task 1003355) is fetch-free too — the control it carries
+       reads status + domain + open_intent, all already in hand */
+    renderAddress(inst);
     /* same contract: the visibility section's in-flight line reads open_intent
        only, so a queued settings push shows up on the tick without a reload */
     renderVisState(inst);
@@ -4962,6 +4897,121 @@ summary{min-height:24px;padding:3px 0;}
     if (t.hasAttribute('data-m-restart')) return mRestart();
   });
 
+  /* ── its address (task 1003355): the bring-your-own-domain control, moved off
+     the list row when a row shrank to view and manage. Every server truth the
+     card's fold carried comes with it: canAttachDomain mirrors
+     DOMAIN_ATTACH_FROM, a snagged or torn-down project has nothing to point an
+     address at, no second control renders while one is wiring, and the re-kick
+     door (F19) and the correction door (task 1003237) keep their pre-filled
+     shapes. Fetch-free, like every other section here, so the minute tick may
+     repaint it. ── */
+
+  var mDomFor = null;   /* the project the section is drawn for */
+  var mDomNote = null;  /* its last receipt — a repaint must not swallow it */
+
+  function domNote(html, cls) {
+    mDomNote = html ? { html: html, cls: cls || '' } : null;
+    var box = $('mDomMsg');
+    if (!box) return;
+    box.className = 'projMsg' + (cls ? ' ' + cls : '');
+    box.innerHTML = html || '';
+  }
+
+  function renderAddress(inst) {
+    if (mDomFor !== inst.id) { mDomFor = inst.id; mDomNote = null; }
+    /* the server's mirror first, then the card's own call: a project that never
+       stood up and one that is gone have nothing to point an address at */
+    var offer = canAttachDomain(inst) && (inst.status === 'active' || inst.status === 'requested');
+    $('mAddress').hidden = !offer;
+    if (!offer) return;
+    /* the strip already says "Wiring the address" — a second attach would only
+       be refused (intent_conflict), so the control waits for the run to land */
+    if (inst.open_intent && inst.open_intent.action === 'domain-attach') {
+      $('mDom').innerHTML = '<div class="addr">Wiring the address' +
+        (inst.domain ? ' for <b>' + esc(inst.domain) + '</b>' : '') + ' right now.</div>' +
+        '<p class="finePrint">This page updates when it lands.</p>';
+      return;
+    }
+    var rekick = inst.status === 'active' && inst.domain && inst.error_note;
+    /* the platform-assigned <slug>.<apex> is NOT a correction: moving off it is
+       the upgrade this control already offered, and the field stays empty for
+       the domain being brought */
+    var byo = inst.domain && inst.domain !== assignedDefaultFor(inst);
+    var repoint = !rekick && byo;
+    var prefill = rekick || repoint;
+    var lead = rekick ? 'The wiring for this address stopped. Send it again and the platform picks it up.'
+      : repoint ? 'It answers on an address you brought. Point it at a different one by editing the name.'
+      : inst.domain ? 'It has the address the platform assigned it. Point a domain you own at it instead.'
+      : 'It has no address yet. Point a domain you own at it.';
+    /* the minute tick must not eat a half-typed domain or drop the caret;
+       defaultValue tells the founder's typing from the pre-fill (the card rule) */
+    var old = $('mDom').querySelector('input[type=text]');
+    var typed = old && old.value !== old.defaultValue ? old.value : '';
+    var hadFocus = !!old && document.activeElement === old;
+    $('mDom').innerHTML = '<p class="plain">' + lead + '</p>' +
+      '<div class="attach">' +
+      '<input type="text" id="mDomName" placeholder="myproject.example.com" autocomplete="off" spellcheck="false" maxlength="253" aria-label="A domain you own, for ' + esc(inst.slug) + '"' +
+      (prefill ? ' value="' + esc(inst.domain) + '"' : '') + '>' +
+      '<button type="button" class="btn small" data-m-attach>' +
+      (rekick ? 'Try the address again' : repoint ? 'Change the address' : 'Use this domain') + '</button></div>' +
+      /* true in every state this renders in: a REQUESTED project never answered
+         anywhere yet, so "stops answering" would be a claim about a thing that
+         never happened (the F16 rule) */
+      (repoint ? '<p class="attachNote">Changing it lets <code>' + esc(inst.domain) + '</code> go — this project won’t use that address any more.</p>' : '') +
+      '<div class="projMsg' + (mDomNote && mDomNote.cls ? ' ' + mDomNote.cls : '') + '" id="mDomMsg" role="status" aria-live="polite">' +
+      (mDomNote ? mDomNote.html : '') + '</div>';
+    var field = $('mDomName');
+    if (field && typed) field.value = typed;
+    if (field && hadFocus) field.focus();
+  }
+
+  /* every refusal as the server worded it (the task 1002692 rule); the codes the
+     page can say more precisely get their own sentence */
+  function attachFailure(data, status) {
+    var e = apiError(data, status);
+    if (e.code === 'bad_domain') return 'That doesn’t look like a usable address — ' + esc(e.details.reason || 'use a real hostname like myproject.example.com') + '.';
+    if (e.code === 'domain_taken') return esc(e.message || 'That address is already in use by another project.');
+    if (e.code === 'domain_not_attachable') return esc(e.message || 'An address can be attached once the instance settles.');
+    if (e.code === 'intent_conflict') {
+      /* the address may still have been RECORDED (details.recorded) — say so */
+      var t = esc(e.message || 'Another run holds the queue right now — re-send once it settles.');
+      return e.details.recorded ? t + ' (The address itself is saved.)' : t;
+    }
+    return esc(e.message || 'The address could not be recorded — try again in a moment.');
+  }
+
+  function mAttach() {
+    var inst = manageInst;
+    if (!inst) return;
+    var field = $('mDomName');
+    var domain = field ? String(field.value || '').trim() : '';
+    if (!domain) { domNote('Type the domain you own first — e.g. <code>myproject.example.com</code>.', 'err'); return; }
+    var btn = $('mDom').querySelector('[data-m-attach]');
+    if (btn) btn.disabled = true;
+    domNote('Recording the address…');
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(inst.id) + '/domain', {
+      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ domain: domain })
+    }).then(function (res) {
+      if (res.status === 401) { domNote(signInAgain(), 'err'); return null; }
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) { domNote(esc(data.message || 'Address recorded.'), 'ok'); return; }
+        domNote(attachFailure(data, res.status), 'err');
+      });
+    }).catch(function () {
+      domNote('Couldn’t reach the platform — check your connection and try again.', 'err');
+    }).then(function () {
+      var b = $('mDom').querySelector('[data-m-attach]');
+      if (b) b.disabled = false;
+      loadManage(true, true); /* the address this page renders just changed */
+    });
+  }
+
+  $('mDom').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('button');
+    if (t && t.hasAttribute('data-m-attach')) mAttach();
+  });
+
   /* an IN-FLIGHT project is watched here at the card's cadence — its own copy
      says "this page updates when it starts", so it must. A settled project
      keeps the C8 rule: entry + tab return, plus the request-free minute tick. */
@@ -5631,9 +5681,11 @@ summary{min-height:24px;padding:3px 0;}
   function renderDelete(inst) {
     if (mDelAsking && mDelAsking === inst.slug) return; /* keep THIS project's open confirmation */
     if (inst.status === 'torn_down') {
+      /* the revive door is on THIS page since task 1003355 — a pointer at the
+         list would now send the owner to a row that only opens doors */
       delMsg('<div class="addr">This project is already torn down — its server is stopped.</div>' +
-        '<p class="finePrint">Its repository, its database and its web address are all still here. ' +
-        'Bring it back any time from <a href="?view=mine" data-nav-to="mine">your projects</a>.</p>');
+        '<p class="finePrint">Its repository, its database and its web address are all still here.' +
+        (canRevive(inst) ? ' Bring it back with the button at the top of this page.' : '') + '</p>');
       return;
     }
     if (inst.status === 'tearing_down') {
@@ -5675,6 +5727,22 @@ summary{min-height:24px;padding:3px 0;}
     return !!(field && manageInst && field.value.trim() === manageInst.slug);
   }
 
+  /* every refusal as the server worded it, with the two codes the page can say
+     more precisely spelled out. This vocabulary rode the list row's sender until
+     task 1003355 made the ender the only teardown door — losing it would have
+     turned two named refusals back into the generic "could not be queued" the
+     tasks 1002691/1002692 walk was about. */
+  function teardownFailure(data, status) {
+    var e = apiError(data, status);
+    if (e.code === 'intent_conflict') {
+      return esc(e.message || ('A ' + (e.details.action || 'previous') + ' run is still ' + (e.details.state || 'open') + ' — retry in a moment.'));
+    }
+    if (e.code === 'not_teardownable') {
+      return esc(e.message || ('Nothing to tear down right now — the instance is ' + (e.details.status || 'settled') + '.'));
+    }
+    return esc(e.message || 'The teardown could not be queued — try again in a moment.');
+  }
+
   function doDelete() {
     var inst = manageInst;
     /* the typed name is this page's own gate, never the server's — so a click
@@ -5696,10 +5764,8 @@ summary{min-height:24px;padding:3px 0;}
         /* the still-true state first, then exactly what the server said */
         renderDelete(inst);
         $('mDel').insertAdjacentHTML('beforeend',
-          res.status === 401
-            ? '<div class="projMsg err">' + signInAgain() + '</div>'
-            : '<div class="projMsg err">' + esc(apiError(data, res.status).message ||
-                'The teardown could not be queued — try again in a moment.') + '</div>');
+          '<div class="projMsg err">' +
+          (res.status === 401 ? signInAgain() : teardownFailure(data, res.status)) + '</div>');
       });
     }).catch(function () {
       renderDelete(inst);
@@ -5722,109 +5788,12 @@ summary{min-height:24px;padding:3px 0;}
     if (t.hasAttribute('data-del-no')) { mDelAsking = null; if (manageInst) renderDelete(manageInst); }
   });
 
-  /* ── teardown: ask, confirm (the truth, itemized — direction §5.4), then
-     SAY exactly what the server said ── */
-
-  /* the id whose confirmation is open — renderCard skips that card, so the
-     minute re-render (sig() buckets recency) cannot wipe the prompt mid-read
-     (the manage page's mDelAsking rule, task 1003232) */
-  var cardAsking = null;
-  function askTeardown(id) {
-    var act = $('act-' + id);
-    if (!act) return;
-    cardAsking = String(id);
-    act.innerHTML = '<div class="confirmRow" tabindex="-1">' +
-      '<span class="plain">Tear it down? ' + teardownTruth(byId[id]) + '</span>' +
-      '<button type="button" class="btn small danger" data-teardown-yes="' + esc(id) + '">Yes, tear it down</button>' +
-      '<button type="button" class="linklike" data-teardown-no="' + esc(id) + '">Keep it running</button></div>';
-    /* the pressed button is gone — focus lands on the question itself, so
-       the truth is read before Tab reaches Yes (task 1003244) */
-    var row = act.firstChild;
-    if (row && row.focus) row.focus();
-  }
-  function unAskTeardown(id) { cardAsking = null; var inst = byId[id]; if (inst) renderCard(inst); }
-  function doTeardown(id) {
-    cardAsking = null;
-    quietActions(id);
-    msg(id, 'Asking…');
-    fetch(API + '/provisioning/instances/' + encodeURIComponent(id) + '/teardown', {
-      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' }, body: '{}'
-    }).then(function (res) {
-      if (res.status === 401) { msg(id, signInAgain(), 'err'); return null; }
-      return jsonOrEmpty(res).then(function (data) {
-        if (res.ok) {
-          /* truthful outcomes (task 1002691): queued:true = really queued;
-             queued:false = one was ALREADY queued; superseded = a stale
-             provision intent was cleared to make room */
-          var note = esc(data.message || 'Teardown requested.');
-          if (data.superseded) note += ' (A stale standup request was cleared to make room.)';
-          msg(id, note, 'ok');
-          return;
-        }
-        var e = apiError(data, res.status);
-        if (e.code === 'intent_conflict') {
-          msg(id, esc(e.message || ('A ' + (e.details.action || 'previous') + ' run is still ' + (e.details.state || 'open') + ' — retry in a moment.')), 'err');
-        } else if (e.code === 'not_teardownable') {
-          msg(id, esc(e.message || ('Nothing to tear down right now — the instance is ' + (e.details.status || 'settled') + '.')), 'err');
-        } else {
-          msg(id, esc(e.message || 'The teardown could not be queued — try again in a moment.'), 'err');
-        }
-      });
-    }).catch(function () {
-      msg(id, 'Couldn’t reach the platform — check your connection and try again.', 'err');
-    }).then(function () {
-      /* wake the quieted row even when the state didn't change (renderCard
-         also hands focus back), then pick up whatever DID change */
-      if (byId[id]) renderCard(byId[id]);
-      watchOnce(id);
-    });
-  }
-
-  /* ── re-enqueue: Try again (snagged) and Bring it back (torn down) both
-     re-POST the slug — the server's PROVISION_ENQUEUE_FROM gate decides.
-     Same truth-telling as every other action: say what the server said. ── */
-
-  function reProvision(id, verb) {
-    var inst = byId[id];
-    if (!inst) return;
-    quietActions(id);
-    msg(id, 'Asking…');
-    var body = { slug: inst.slug, hosting_shape: inst.hosting_shape || 'standalone' };
-    if (inst.onboard_mode) body.onboard_mode = inst.onboard_mode;
-    if (inst.target_ref) body.target_ref = inst.target_ref;
-    if (inst.domain) body.domain = inst.domain;
-    fetch(API + '/provisioning/instances', {
-      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(body)
-    }).then(function (res) {
-      if (res.status === 401) { msg(id, signInAgain(), 'err'); return null; }
-      return jsonOrEmpty(res).then(function (data) {
-        if (res.ok) {
-          msg(id, esc(data.message || (verb === 'revive' ? 'Revive queued — bringing it back.' : 'Queued again — the platform picks it up from here.')), 'ok');
-          return;
-        }
-        var e = apiError(data, res.status);
-        if (e.code === 'intent_conflict') {
-          msg(id, esc(e.message || 'A previous run is still open — retry once it settles.'), 'err');
-        } else if (e.code === 'rate_limited') {
-          msg(id, esc(e.message || 'Too many requests right now — give it a minute and try again.'), 'err');
-        } else {
-          msg(id, esc(e.message || 'The request could not be queued — try again in a moment.'), 'err');
-        }
-      });
-    }).catch(function () {
-      msg(id, 'Couldn’t reach the platform — check your connection and try again.', 'err');
-    }).then(function () {
-      if (byId[id]) renderCard(byId[id]);
-      watchOnce(id);
-    });
-  }
-
   /* ── restart an unreachable project (task 1003238). Its own route, because
      PROVISION_ENQUEUE_FROM excludes 'active' — re-POSTing the slug the way
      Try again / Bring it back do would be refused on every press. Every
      refusal is shown as the server worded it: the server owns the gate, and
-     a card that invents its own reason drifts from it. ── */
+     a page that invents its own reason drifts from it. mRestart() is the one
+     sender since task 1003355 moved the door off the list row. ── */
 
   function restartFailure(data, status) {
     var e = apiError(data, status);
@@ -5832,84 +5801,16 @@ summary{min-height:24px;padding:3px 0;}
     return e.message || 'The restart could not be queued — try again in a moment.';
   }
 
-  function doRestart(id) {
-    var inst = byId[id];
-    if (!inst) return;
-    quietActions(id);
-    msg(id, 'Asking…');
-    fetch(API + '/provisioning/instances/' + encodeURIComponent(id) + '/restart', {
-      method: 'POST', credentials: 'same-origin'
-    }).then(function (res) {
-      if (res.status === 401) { msg(id, signInAgain(), 'err'); return null; }
-      return jsonOrEmpty(res).then(function (data) {
-        if (res.ok) { msg(id, esc(data.message || 'Restart queued.'), 'ok'); return; }
-        msg(id, esc(restartFailure(data, res.status)), 'err');
-      });
-    }).catch(function () {
-      msg(id, 'Couldn’t reach the platform — check your connection and try again.', 'err');
-    }).then(function () {
-      if (byId[id]) renderCard(byId[id]);
-      watchOnce(id);
-    });
-  }
-
-  /* ── domain attach: same truth-telling for every refusal (task 1002692) ── */
-
-  function doAttach(id) {
-    var input = $('dom-' + id);
-    var domain = input ? String(input.value || '').trim() : '';
-    if (!domain) { msg(id, 'Type the domain you own first — e.g. <code>myproject.example.com</code>.', 'err'); return; }
-    msg(id, 'Recording the address…');
-    fetch(API + '/provisioning/instances/' + encodeURIComponent(id) + '/domain', {
-      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ domain: domain })
-    }).then(function (res) {
-      if (res.status === 401) { msg(id, signInAgain(), 'err'); return null; }
-      return jsonOrEmpty(res).then(function (data) {
-        if (res.ok) {
-          msg(id, esc(data.message || 'Address recorded.'), 'ok');
-          return;
-        }
-        var e = apiError(data, res.status);
-        if (e.code === 'bad_domain') {
-          msg(id, 'That doesn’t look like a usable address — ' + esc(e.details.reason || 'use a real hostname like myproject.example.com') + '.', 'err');
-        } else if (e.code === 'domain_taken') {
-          msg(id, esc(e.message || 'That address is already in use by another project.'), 'err');
-        } else if (e.code === 'domain_not_attachable') {
-          msg(id, esc(e.message || 'An address can be attached once the instance settles.'), 'err');
-        } else if (e.code === 'intent_conflict') {
-          /* the address may still have been RECORDED (details.recorded) — say so */
-          var t = esc(e.message || 'Another run holds the queue right now — re-send once it settles.');
-          if (e.details.recorded) t += ' (The address itself is saved.)';
-          msg(id, t, 'err');
-        } else {
-          msg(id, esc(e.message || 'The address could not be recorded — try again in a moment.'), 'err');
-        }
-      });
-    }).catch(function () {
-      msg(id, 'Couldn’t reach the platform — check your connection and try again.', 'err');
-    }).then(function () { watchOnce(id); });
-  }
-
-  /* one delegated listener for all card actions */
+  /* the list's one delegated handler. A row holds no sender since task 1003355
+     — only its two doors — so the Manage link is all there is to upgrade: it is
+     a real anchor, a modified click keeps its browser meaning and a plain one
+     stays in-page (the orb-click contract). The address line's "give it an
+     address" link carries the same marker, so it lands on the same page. */
   $('projectsList').addEventListener('click', function (ev) {
-    /* the Manage link is a real anchor — a modified click keeps its browser
-       meaning, a plain one stays in-page (the orb-click contract) */
     var m = ev.target.closest && ev.target.closest('a[data-manage]');
-    if (m) {
-      if (!isPlainClick(ev)) return;
-      ev.preventDefault();
-      return goToManage(m.getAttribute('data-manage'));
-    }
-    var t = ev.target.closest('button');
-    if (!t) return;
-    if (t.hasAttribute('data-teardown')) return askTeardown(t.getAttribute('data-teardown'));
-    if (t.hasAttribute('data-teardown-yes')) return doTeardown(t.getAttribute('data-teardown-yes'));
-    if (t.hasAttribute('data-teardown-no')) return unAskTeardown(t.getAttribute('data-teardown-no'));
-    if (t.hasAttribute('data-attach')) return doAttach(t.getAttribute('data-attach'));
-    if (t.hasAttribute('data-retry')) return reProvision(t.getAttribute('data-retry'), 'retry');
-    if (t.hasAttribute('data-revive')) return reProvision(t.getAttribute('data-revive'), 'revive');
-    if (t.hasAttribute('data-restart')) return doRestart(t.getAttribute('data-restart'));
+    if (!m || !isPlainClick(ev)) return;
+    ev.preventDefault();
+    goToManage(m.getAttribute('data-manage'));
   });
 
   /* ── boot: who am I → my instances ────────────────────────────────────── */