[abhaypadmanabhan]

What changes

Your Apps leads with Preview and Live, a named Show password control, and Review preview highlighted when changes are unpublished. Publishing confirms the exact version and destination; cancelling restores the review emphasis. Local work, history and technical settings stay one level deeper. Editing stays available. The approved Paper design uses Bops' existing controls and highlighter. Design and proof map: docs/YOUR-APPS-V4.md.

Merged with main (#176, #178, #179, #183, #185, #187, #138, #191 and the 0.0.51 and 0.0.52 releases), and with the review findings fixed:

• GitHub production, as members see it. An Admin's (or a Member's) review of an app on GitHub reads Live from the last push, as the owner's page does, never Orgo's Published, which a push doesn't move. Bops Cloud passes the changeset last sent there as SharedApp.github.at at every level (null while not linked; never the GitHub commit). With a Bops Cloud that only says Admins link an app to GitHub and bring in its changes; apps use keys from Keys; notes for 0.0.52 #191's linked (Write), Live is read from that; with one that says neither, from Published as before, and Publish stays pressable.
• Where Publish goes (Your Apps and the bot say where Publish goes: GitHub, or a domain not pointed at Orgo yet #179) is said in the Publish confirmation, not as a line under the row: "Publish sends it to GitHub (repo, branch), where its own deploy puts it live." with repo · branch as the destination, or "Visitors to won't see a publish until its DNS points at Orgo." with the domain.
• Admins keep Update preview beside Publish changes, so they can rebuild the Preview after changing its build settings. An Admin never gets an "Add a domain" they can't use: Update preview takes its place.
• Admins link an app to GitHub and bring in its changes; apps use keys from Keys; notes for 0.0.52 #191's GitHub part (Link, Bring in, where it publishes) sits in Technical details, where the owner's GitHub menu is. Publish waits while its computer works on GitHub, and says "Link it to GitHub first." until it's linked.
• A failed preview update no longer blocks publishing what the Preview still serves when that isn't live.
• Restore on an app of more than one site says "Restore to preview, all sites" (same request as before).
• No apps and hosting closed: only why, quietly, and the tools; no invitation to add a website that can't go on the web.
• GitHub words no longer point to a "menu beside Publish"; the refusal for an app not linked yet says "Link it first, from Technical details in Your Apps." The bot's note names the Preview button by its new name, Update preview.
• scripts/verify is one ESM dispatcher: browser-speed, browser-input, your-apps [--ui]; --list names them. docs/FEATURES.md is one table.
• The task note and the 4 MB of screenshots are out of the branch. The before and after pictures (1440px and 1180px) are in this description's edit history and at commit 29fdb9f.

Why

People could not tell what needed review, where to find the preview password, or what publishing would affect. This makes the next action visible while keeping technical information on demand. "Unpublished" describes a preview/release difference; it does not claim a recorded approval. The merge fixes keep #179's and #191's GitHub work true on the new page: without them an Admin's view of a GitHub app said "1 unpublished change" forever after publishing, or offered only a disabled "Add a domain".

How I checked it

On head 6b32678a (Linux dev box, Node 24, main's lockfile); 4d35b05b only rewrites one older test assertion CodeQL took for a URL check (UI suite rerun: 89 passed). GitHub CI on 4d35b05b: check, cloud-tests and CodeQL pass.

• npx next typegen, npx tsc --noEmit -p ., npx tsc -p cloud/tsconfig.json --noEmit: clean. npm run lint: 0 errors (19 warnings, all in files this PR doesn't touch).
• node scripts/test-hosted-apps-ui.mjs 89 passed; test-app-status.mjs 15; test-preview-password-ui.mjs 10; test-shared.mjs 71; test-state-merge.mjs 42.
• node --conditions=react-server scripts/test-hosted-apps.mjs 144; test-github-mirror.mjs 26; test-member-acts.mjs 41; test-chat-tools.mjs 91; test-keys.mjs 51; test-runner-chat.mjs 13.
• scripts/verify targets' own tests: node --test scripts/test-browser-probe.mjs 13; node scripts/test-browser-view.mjs 4.
• Bops Cloud on a throwaway Postgres 18: node --test --test-concurrency=1 "cloud/test/core-*.test.ts" 380/380; "cloud/test/edge-*.test.ts" cloud/test/server.test.ts 196/196.
• node scripts/test-your-apps-e2e.mjs (the --ui pass, local two-person stack, every publishing request answered locally): 95 PASS at 1440px and 1180px, no page or console errors.
• New checks fail on the code before each fix: the GitHub and where-Publish-goes UI tests on Your Apps: review changes before publishing #186's shared-apps.tsx, the Cloud at test on main's slice, and the Update preview, all sites, closed list, GitHub words and failed preview checks on the merge state.
• check-public.sh on HEAD: OK. gitleaks over the new commits: no leaks.

Not done or limits

• The browser checks prove the UI and its requests on fixtures, not a real GitHub push or Orgo deploy.
• An Admin's view of a GitHub app reads Live correctly only from a Bops Cloud with this change (at), or at Write from 0.0.52's (linked); an older Bops Cloud falls back to Published, as before this PR.
• The removed task note and screenshots are still in this branch's earlier commits; a squash merge leaves them out of main.
• Update preview for members deploys every site of an app with more than one, as before; the "all sites" words are on Restore only.

[TigerYWang]

Merged main into this branch (three merges, since main moved twice while I worked: #179/#183 and friends, then #187, then #191) and fixed the review findings. What changed:

• Merge: Your Apps and the bot say where Publish goes: GitHub, or a domain not pointed at Orgo yet #179's "where Publish goes" words now live in the Publish confirmation (line and destination), not as a stray line under the row. Your Apps and the bot say where Publish goes: GitHub, or a domain not pointed at Orgo yet #179's checks are ported to the new page. scripts/verify is one ESM dispatcher (browser-speed, browser-input, your-apps [--ui], --list). FEATURES.md is one table. Admins link an app to GitHub and bring in its changes; apps use keys from Keys; notes for 0.0.52 #191's GitHub part sits in Technical details, its test is ported to the new layout, and the shared-words dash check is back.
• 186-1: an Admin's (and a Member's) review of a GitHub app reads Live from the last push. Bops Cloud adds SharedApp.github.at (the changeset last sent to GitHub, at every level); it falls back to Admins link an app to GitHub and bring in its changes; apps use keys from Keys; notes for 0.0.52 #191's linked, then to Published. I chose this over sending GitHub's changeset as serving from the owner's Mac because it works whatever version the owner's Mac or runner is.
• 186-2: Admins keep Update preview beside Publish changes, and never get a dead "Add a domain".
• 186-3: if the newest preview update failed but the Preview still serves something not live, Publish stays the button.
• 186-4: no more "menu beside Publish". The server refusal reads "Link it first, from Technical details in Your Apps."
• 186-5: Restore on an app with more than one site says "Restore to preview, all sites" (same request).
• 186-6: with no apps and hosting closed, only why is shown, quietly.
• 186-7: the task note and the screenshots are removed; the pictures are linked from the description at commit 29fdb9f.
• The e2e answers /api/keys/apps for the sample (Admins link an app to GitHub and bring in its changes; apps use keys from Keys; notes for 0.0.52 #191's new route 404s on the stack's server otherwise).

Checks on 6b32678: types and lint clean; UI 89, status 15, password 10, sharing 71, hosted-apps 144, github-mirror 26, member-acts 41, chat-tools 91, keys 51, runner-chat 13, state-merge 42; Cloud core 380/380, edge 196/196; browser 95 PASS at both widths. The PR description has the details.