[atyrode]

What

Every question a Launch press waits on is now asked in a modal dialog instead of a short line beside the launch control, and how a press ended also reaches Manifold's notice stack.

• Model check charge: "Check your models first", why a launch needs it, the requests in all and per provider family, Approve and launch (or Approve for a check started from Models or a struck lane) and Cancel. Approve keeps every existing safeguard: only the very charge shown, after the 700 ms checking hold, a single deliberate press. Every other answer cancels the check, spending nothing. The launch line and the Models sheet no longer carry an Approve.
• Held review that differs: "What will run differs" with the differences, Launch it (launches that reviewed session) and Not now (drops it; the next press reviews again).
• Check that narrowed the profile: the settings it moved, Launch and Not now.
• Refused Launch press: the refusal, one sentence on why, the launch line's fixes for that refusal and Close. A fix runs and closes it; a refusal that lifts or changes closes it.
• Notices: launched ("Type your task in its terminal."), resumed, saved, a failed step and a stopped check are posted to Manifold's notice stack under one key, each replacing the last. The panel's own polite live region still announces outcomes, since a freshly inserted notice row is not reliably read out.

Safety of the dialog

• Opens with focus on its title, never on a choice.
• No press answers in the first 400 ms after a question opens or changes. Enter or Space answers with a choice only once that choice has held focus for 300 ms (held on keydown), so Tab-then-Enter typed for something else never answers, while an assistive tool's activation, which sends no key, still counts once settled. The second click of a double click and key repeat never answer.
• Esc, a press that starts and ends on the backdrop, and a browser-forced close take the way out, which never spends or launches. A drag from the box to the backdrop, or a press on its border, answers nothing.
• A held review and a narrowed stop are asked when they happen or never: a moment when the launch cannot go on drops them for good, so no question reopens later without a press.
• Which question is asked and what each answer does are pure (decisionFor, answer in decision-model.ts) and unit-tested: a check the panel runs on its own never asks; only Approve approves; every other answer to a charge cancels first; no way out launches or approves.
• Choices are 44 px both ways on a coarse pointer.

Also

• The machine dropdown keeps its Tab stop while locked (it left the Tab order only so the old inline Approve came next).
• README.md: the launch row no longer lists Review, and the stale sentence saying the skill, automation and continuation additions are source-only is removed (they ship in the released bundles).

Verification

• Unit tests and type check pass; scripts/gate.sh passes (see the head-specific comment).
• The real-browser verifier proves the questions (charge, Models-started charge, held review, narrowed stop, refusals), their guards (double click, key repeat, Enter on the title, a Tab-Enter burst after the settle, unsettled and dragged presses, coarse targets, widths 170 to 1440 px, reduced motion, no layout shift) and the notices and announcements for refusals and failures. Success outcomes ("Launched on", "Resumed on") are not reachable in its fixture, which never opens a terminal.
• Checked in Chromium on the design lab: charge, refusal and Models-started questions; Esc, settled and unsettled backdrop presses, Tab to a choice, fixes; 170 to 1440 px; reduced motion; notices.

Closes #279

[atyrode]

Head-specific evidence for 16cd59c581b4028bad4f57bc37237d74d0c34438:

• scripts/gate.sh (Bun 1.4.2, two CPUs, exact Manifold 82605419ea9a67198d9ea0dae1257a8fd812ecd8 and OMP pins): exit 0. 458 unit tests pass; type check clean; four bundles packed; disposable native composition; real-browser verifier PASS (491s).
• Independent review: pass at c137e35d8d (five rounds: spend safety, dialog lifecycle, stale questions, keyboard and assistive activation, verifier coverage). The only commit after it, 16cd59c581, makes the verifier wait for the generator's rows before choosing a machine (a race seen once in a gate run); no product change.
• Real surface checked in Chromium on a disposable lab server: charge, Models-started charge and refusal questions; Esc, settled and unsettled backdrop presses, Tab to a choice, a fix; widths 170 to 1440 px; reduced motion; notices.

Not reachable in the verifier's fixture: a successful launch or resume (and their "Launched on" / "Resumed on" notices), since it never opens a terminal.

[atyrode]

Independent review (head-specific): pass at 16cd59c581b4028bad4f57bc37237d74d0c34438. The last commit only makes the browser verifier wait for the generator's rows before pressing the machine picker; no product change.