diff --git a/scripts/test-accessible-modals.mjs b/scripts/test-accessible-modals.mjs
index 4763cb2..62be552 100644
--- a/scripts/test-accessible-modals.mjs
+++ b/scripts/test-accessible-modals.mjs
@@ -74,6 +74,7 @@ try {
["pricing-modal", "window.openPricingModal"],
["commit-confirm-modal", `() => window.openCommitConfirmModal({fileName:'test.dart',artifactType:'CustomAction',content:'void test() {}'}, {warnings:[]}, null)`],
["commit-success-modal", `() => window.showCommitSuccessModal({success:true,message:'Done',metadata:{projectId:'test',fileName:'test.dart',artifactType:'CustomAction',codeSize:14}})`],
+ ["commit-terminal-modal", `() => window.showCommitUnconfirmedModal({success:false,unconfirmed:true,targetIdentity:{projectId:'test',endpoint:'https://api.flutterflow.io',artifactType:'CustomClass',artifactName:'T',fileName:'test.dart'},error:'outcome unknown'})`],
];
for (const [id, expression] of cases) {
console.log(`Checking ${id}...`);
diff --git a/src/deployOutcome.js b/src/deployOutcome.js
new file mode 100644
index 0000000..abaa037
--- /dev/null
+++ b/src/deployOutcome.js
@@ -0,0 +1,65 @@
+/**
+ * STU-380 — truthful deployment terminal outcomes.
+ *
+ * A deploy to FlutterFlow can end in four distinct terminal outcomes, and the
+ * UI must not flatten them together. Only a confirmed success may say
+ * "committed". A client-side wait that expires, or a dropped connection before
+ * the runner reports a result, leaves the remote outcome unknown: that is
+ * UNCONFIRMED, never a fabricated failure or success. This module is the
+ * single source of truth for how a deploy result maps to what the UI tells
+ * the user.
+ */
+
+export const DeployOutcome = Object.freeze({
+ /** The runner and the push both confirmed success. Only this may say "committed". */
+ COMMITTED: "committed",
+ /** Custom classes were written to FlutterFlow, but the remaining sync failed. */
+ PARTIAL: "partial",
+ /** A definitive rejection: nothing was confirmed written. */
+ FAILED: "failed",
+ /** The remote outcome is unknown (UI wait expired or the stream dropped). */
+ UNCONFIRMED: "unconfirmed",
+});
+
+/**
+ * How long the browser keeps a live progress view for a provisioning request
+ * before it stops claiming progress and reports UNCONFIRMED.
+ *
+ * Derivation: Cloud Run's request timeout for the deploy runner is 900s and
+ * the runner reports a server-side timeout rather than hanging past it
+ * (DEPLOYMENT.md), so a remote write cannot outlive roughly 900s. Observed
+ * provision latency is of the order of one to a few minutes. 120s is therefore
+ * comfortably longer than a healthy provision yet well below the server
+ * deadline, so a normal deploy renders to completion long before this fires
+ * and the UI can never out-wait a real server decision. This bound governs
+ * only the UI's waiting/rendering: on expiry the UI stops claiming progress,
+ * but it never aborts or retries the in-flight remote write.
+ */
+export const DEPLOY_UI_TIMEOUT_MS = 120_000;
+
+/**
+ * Maps a deploy result to its single truthful terminal outcome.
+ *
+ * Priority: an explicit unconfirmed marker beats everything (a partial outcome
+ * is only meaningful once at least one write is confirmed, and a client timeout
+ * means we cannot even be sure of that); then partial; then confirmed success;
+ * then the default failure for any unconfirmed-negative result.
+ *
+ * @param {Object|null|undefined} result - A deploy result object
+ * @param {boolean} [result.success] - True only when remote writes confirmed success
+ * @param {boolean} [result.partial] - True when some writes landed and some failed
+ * @param {boolean} [result.unconfirmed] - True when the remote outcome is unknown
+ * @returns {string} One of the DeployOutcome values
+ */
+export function classifyDeployResult(result) {
+ if (result?.unconfirmed === true || result?.outcome === DeployOutcome.UNCONFIRMED) {
+ return DeployOutcome.UNCONFIRMED;
+ }
+ if (result?.partial === true || result?.outcome === DeployOutcome.PARTIAL) {
+ return DeployOutcome.PARTIAL;
+ }
+ if (result?.success === true) {
+ return DeployOutcome.COMMITTED;
+ }
+ return DeployOutcome.FAILED;
+}
diff --git a/src/deployOutcome.test.js b/src/deployOutcome.test.js
new file mode 100644
index 0000000..b9c7e2d
--- /dev/null
+++ b/src/deployOutcome.test.js
@@ -0,0 +1,96 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import {
+ classifyDeployResult,
+ DeployOutcome,
+ DEPLOY_UI_TIMEOUT_MS,
+} from "./deployOutcome.js";
+
+// --- Falsification harness -------------------------------------------------
+// Every assertion that "this shape maps to THAT outcome" is run twice: once
+// against the classifier, and once after a deliberate mutation that must flip
+// the outcome. A test that cannot be flipped by breaking the code under test
+// would prove nothing about it, so each `flip` writes a value that must change
+// the result and asserts it does.
+function assertOutcome(result, expected) {
+ assert.equal(classifyDeployResult(result), expected);
+}
+
+function assertFlip(result, expected, flippedExpectation, flip) {
+ assertOutcome(result, expected);
+ const mutated = flip(structuredClone(result ?? {}));
+ assertOutcome(mutated, flippedExpectation);
+}
+
+test("only a confirmed success classifies as committed", () => {
+ assertFlip(
+ { success: true, message: "Deployed" },
+ DeployOutcome.COMMITTED,
+ DeployOutcome.FAILED,
+ (r) => { r.success = false; return r; },
+ );
+ // A success that never came from a remote write must not be reported either.
+ assertFlip(
+ { success: false },
+ DeployOutcome.FAILED,
+ DeployOutcome.COMMITTED,
+ (r) => { r.success = true; return r; },
+ );
+});
+
+test("a result with no success field and no marker is a failure", () => {
+ assertOutcome({ error: "403 Forbidden" }, DeployOutcome.FAILED);
+ assertOutcome(undefined, DeployOutcome.FAILED);
+ assertOutcome(null, DeployOutcome.FAILED);
+});
+
+test("partial marks an outcome where some writes landed and some failed", () => {
+ assertFlip(
+ { success: false, partial: true, errorMap: { "a.dart": "rejected" } },
+ DeployOutcome.PARTIAL,
+ DeployOutcome.FAILED,
+ (r) => { delete r.partial; return r; },
+ );
+ // A partial that carries `success:true` is contradictory; the explicit
+ // partial marker must still win over a bare success flag.
+ assertFlip(
+ { success: true, partial: true },
+ DeployOutcome.PARTIAL,
+ DeployOutcome.COMMITTED,
+ (r) => { delete r.partial; return r; },
+ );
+});
+
+test("an unconfirmed marker beats every other signal", () => {
+ // Timeout: success flag absent, neither committed nor failed may be assumed.
+ assertFlip(
+ { unconfirmed: true, error: "waited too long" },
+ DeployOutcome.UNCONFIRMED,
+ DeployOutcome.FAILED,
+ (r) => { delete r.unconfirmed; return r; },
+ );
+ // Even a degenerate object claiming success while also unconfirmed must be
+ // unconfirmed: we cannot trust a success for an outcome we did not confirm.
+ assertFlip(
+ { success: true, unconfirmed: true },
+ DeployOutcome.UNCONFIRMED,
+ DeployOutcome.COMMITTED,
+ (r) => { delete r.unconfirmed; return r; },
+ );
+ // The `outcome` spelling is honored too (exported by the provisioning layer).
+ assertFlip(
+ { outcome: DeployOutcome.UNCONFIRMED },
+ DeployOutcome.UNCONFIRMED,
+ DeployOutcome.FAILED,
+ (r) => { r.outcome = DeployOutcome.FAILED; return r; },
+ );
+});
+
+test("the UI waiting bound is finite and below the documented server deadline", () => {
+ // Cloud Run's request timeout is 900s; the UI bound must be shorter so the
+ // UI never out-waits a real server decision, and positive so it actually
+ // fires.
+ assert.ok(Number.isFinite(DEPLOY_UI_TIMEOUT_MS));
+ assert.ok(DEPLOY_UI_TIMEOUT_MS > 0);
+ assert.ok(DEPLOY_UI_TIMEOUT_MS < 900_000);
+});
diff --git a/src/provisionStream.js b/src/provisionStream.js
index 773c616..5a23fee 100644
--- a/src/provisionStream.js
+++ b/src/provisionStream.js
@@ -1,4 +1,5 @@
import { flushNdjsonBuffer, readNdjsonChunk } from "./ndjsonStream.js";
+import { classifyDeployResult, DeployOutcome } from "./deployOutcome.js";
/**
* Reads the custom class deploy response.
@@ -15,7 +16,11 @@ import { flushNdjsonBuffer, readNdjsonChunk } from "./ndjsonStream.js";
* @param {function(string): void} [handlers.onLog] - Called with each raw CLI
* output line
* @returns {Promise