@@ -492,6 +492,10 @@ button { font-family: inherit; }
 }
 .install-checks li.ok::before { content: '✓'; color: #2F6B4F; }
 .install-checks li.no::before { content: '✕'; color: #B3261E; }
+/* Not a failure -- the install worked -- but the result needs acting on
+   before the next deploy, so it cannot look like the passing rows. */
+.install-checks li.warn::before { content: '!'; color: #8A5A00; font-weight: 800; }
+.install-checks li.warn { color: var(--ink); }
 .install-checks li span { display: block; color: var(--ink-dim); font-size: 0.8rem; }
 .install-errors {
   background: #FDECEA; border: 1px solid #F3C4BF; border-radius: 10px;
 
@@ -17,7 +17,50 @@
 require_once __DIR__ . '/src/db.php';
 require_once __DIR__ . '/src/migrate.php';
 
-const CONFIG_PATH    = __DIR__ . '/config.php';
+/**
+ * Where a new config.php should be written.
+ *
+ * It used to be __DIR__ . '/config.php', beside the panel. That is inside the
+ * document root, and the document root is rebuilt from scratch on every
+ * deploy -- so the installer's own output was erased by the next publish, and
+ * the panel came back reporting it had never been set up. It happened, and it
+ * took the admin down.
+ *
+ * config() looks for nitesha-config/config.php in each directory above the
+ * panel, so a file one level above the document root is found and is out of
+ * reach of anything that rewrites the site. That is where this writes.
+ *
+ * Beside the panel stays as the fallback for hosting where the parent
+ * directory cannot be written, because a panel that works until the next
+ * deploy beats a panel that never starts. install_config_path() says which
+ * one was used so the last screen can be honest about it.
+ */
+function install_config_dir_preferred(): string
+{
+    // __DIR__ is <docroot>/admin, so this is the directory holding the
+    // document root -- above everything a deploy replaces.
+    return dirname(__DIR__, 2) . '/nitesha-config';
+}
+
+function install_config_path(): string
+{
+    // An existing config wins wherever it is: rewriting a working install's
+    // settings into a second file would leave two, and config() would pick
+    // whichever it reached first.
+    $existing = config_path();
+    if ($existing !== null) {
+        return $existing;
+    }
+
+    $preferred = install_config_dir_preferred();
+    if (is_dir($preferred) || @mkdir($preferred, 0750, true) || is_dir($preferred)) {
+        if (is_writable($preferred)) {
+            return $preferred . '/config.php';
+        }
+    }
+
+    return __DIR__ . '/config.php';
+}
 const MIN_PHP        = '8.1';
 const MIN_PASSWORD   = 10;
 
@@ -39,9 +82,10 @@
 // The presence of config.php is not enough — a half-finished attempt leaves
 // one behind. What settles it is whether anyone can sign in.
 // ---------------------------------------------------------------------------
-if (is_file(CONFIG_PATH)) {
+$existingConfig = config_path();
+if ($existingConfig !== null) {
     try {
-        $existing = require CONFIG_PATH;
+        $existing = require $existingConfig;
         config_set(is_array($existing) ? $existing : []);
         $n = (int) (fetch_one('SELECT COUNT(*) AS n FROM users')['n'] ?? 0);
         if ($n > 0) {
@@ -158,7 +202,9 @@ function build_config(array $form): array
             'password' => (string) $form['db_pass'],
             'charset'  => 'utf8mb4',
         ],
-        'storage_path'       => dirname(__DIR__) . '/nitesha-storage',
+        // Above the document root for the same reason config.php is: anything
+        // inside it is temporary, because a deploy rebuilds it.
+        'storage_path'       => dirname(__DIR__, 2) . '/nitesha-storage',
         'public_site_origin' => $origins,
         // Hostinger serves these domains over HTTPS, and the session cookie
         // carries the sign-in, so it should never travel in the clear.
@@ -169,20 +215,36 @@ function build_config(array $form): array
 
 function write_config(array $config): bool
 {
+    $target = install_config_path();
+
     $php = "<?php\n\n// Written by install.php. Holds the database password —\n"
          . "// keep it out of version control and off any public URL.\n\n"
          . 'return ' . var_export($config, true) . ";\n";
 
-    if (@file_put_contents(CONFIG_PATH, $php) === false) {
+    $dir = dirname($target);
+    if (!is_dir($dir) && !@mkdir($dir, 0750, true) && !is_dir($dir)) {
         return false;
     }
-    @chmod(CONFIG_PATH, 0640);
+
+    if (@file_put_contents($target, $php) === false) {
+        return false;
+    }
+    @chmod($target, 0640);
+
+    $GLOBALS['__config_written_to'] = $target;
     return true;
 }
 
 function environment_checks(): array
 {
-    $writable = is_writable(__DIR__);
+    // The directory that matters is the one write_config() will use, which is
+    // normally above the document root -- not this one. Checking __DIR__ told
+    // people the install would work when the file was going somewhere else
+    // entirely.
+    $target  = install_config_path();
+    $dir     = dirname($target);
+    $writable = is_dir($dir) ? is_writable($dir) : is_writable(dirname($dir));
+    $aboveRoot = $dir !== __DIR__;
     return [
         ['label' => 'PHP ' . MIN_PHP . ' or newer',
          'ok'    => version_compare(PHP_VERSION, MIN_PHP, '>='),
@@ -192,10 +254,13 @@ function environment_checks(): array
          'note'  => extension_loaded('pdo_mysql') ? 'Available' : 'Enable it in hPanel → PHP Configuration'],
         ['label' => 'JSON support',
          'ok'    => extension_loaded('json'), 'note' => ''],
-        ['label' => 'This folder is writable',
+        ['label' => 'Somewhere to keep config.php',
          'ok'    => $writable,
-         'note'  => $writable ? 'config.php can be written for you'
-                              : 'You will need to create config.php by hand'],
+         'note'  => !$writable
+             ? 'You will need to create ' . $dir . '/config.php by hand'
+             : ($aboveRoot
+                 ? 'Will be written to ' . $dir . ', above the website folder, where a deploy cannot erase it'
+                 : 'Will be written beside the panel. A deploy that rebuilds the website folder will erase it')],
         ['label' => 'sql/ files present',
          'ok'    => (glob(__DIR__ . '/sql/*.sql') ?: []) !== [],
          'note'  => 'The table definitions'],
@@ -247,7 +312,15 @@ function page(string $title, string $body): void
       <ul class="install-checks">'
       . ($applied === [] ? '' : '<li class="ok">Tables created (' . h(implode(', ', $applied)) . ')</li>')
       . '<li class="ok">Your Super Admin account was created</li>
-         <li class="ok">config.php was written</li>
+         <li class="ok">config.php was written to <code>'
+      . h((string) ($GLOBALS['__config_written_to'] ?? 'the panel folder')) . '</code></li>'
+      . (str_contains((string) ($GLOBALS['__config_written_to'] ?? ''), 'nitesha-config')
+          ? ''
+          : '<li class="warn">That is inside the website folder. A deploy that rebuilds the
+             site will erase it and the panel will report it has never been set up. Move it
+             to a folder named <code>nitesha-config</code> above the website folder when you
+             can &mdash; the panel looks there first.</li>')
+      . '
       </ul>
       <p style="margin-top:18px"><a class="btn btn-primary btn-block" href="index.php">Sign in</a></p>
       <p class="install-note" style="margin-top:18px"><strong>One last step:</strong>
 
@@ -67,6 +67,64 @@ function config_path(): ?string
     return null;
 }
 
+/**
+ * What the panel shows when it cannot find its configuration.
+ *
+ * This used to be one sentence of plain text on a 500. It is technically
+ * accurate and it is a dead end: it does not say which file is missing, where
+ * the panel looked, or that the database itself is untouched -- and it is the
+ * first thing an owner sees after a deploy wipes the config, which is a moment
+ * where "not set up yet" reads like the data is gone.
+ *
+ * The paths are the ones config_path() actually searched, computed rather than
+ * described, so the instructions cannot drift away from the code. Nothing here
+ * is a secret: no credentials are read at this point, because the file that
+ * would hold them is the one that is missing.
+ */
+function config_missing_page(): never
+{
+    http_response_code(500);
+    header('Content-Type: text/html; charset=utf-8');
+    header('X-Robots-Tag: noindex, nofollow');
+
+    $panel  = dirname(__DIR__);
+    $above  = dirname($panel, 2) . '/nitesha-config';
+    $e      = static fn (string $v): string => htmlspecialchars($v, ENT_QUOTES, 'UTF-8');
+
+    echo '<!doctype html><html lang="en"><head><meta charset="utf-8">'
+       . '<meta name="viewport" content="width=device-width, initial-scale=1">'
+       . '<title>Panel not configured</title>'
+       . '<style>'
+       . 'body{margin:0;padding:32px 16px;background:#FAF7F2;color:#1A2233;'
+       . 'font:16px/1.6 system-ui,-apple-system,"Segoe UI",Roboto,sans-serif}'
+       . 'main{max-width:640px;margin:0 auto;background:#fff;border:1px solid #E7E0D6;'
+       . 'border-radius:14px;padding:24px}'
+       . 'h1{font-size:1.3rem;margin:0 0 8px}p{margin:0 0 12px}'
+       . 'code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.85rem;'
+       . 'background:#FAF7F2;padding:2px 5px;border-radius:5px;word-break:break-all}'
+       . 'ol{margin:0 0 12px;padding-left:20px}li{margin-bottom:6px}'
+       . '.note{color:#5C5348;font-size:.92rem}'
+       . 'a.btn{display:inline-block;margin-top:8px;background:#E8A317;color:#1A2233;'
+       . 'text-decoration:none;font-weight:700;padding:10px 18px;border-radius:10px}'
+       . '</style></head><body><main>'
+       . '<h1>The panel cannot find its configuration</h1>'
+       . '<p><code>config.php</code> holds the database details. It is deliberately not '
+       . 'part of the deploy, so a rebuild of the website folder never overwrites it '
+       . '&mdash; but that also means a rebuild cannot put it back.</p>'
+       . '<p class="note"><strong>Your data is not affected.</strong> Bookings, vehicles '
+       . 'and enquiries live in the database, which this file only points at.</p>'
+       . '<p>Two places were checked:</p><ol>'
+       . '<li><code>' . $e($panel . '/config.php') . '</code></li>'
+       . '<li><code>' . $e($above . '/config.php') . '</code> &mdash; the better one, '
+       . 'because it sits above the website folder where a deploy cannot reach it</li>'
+       . '</ol>'
+       . '<p>The installer will write it for you, in the second place, and will not '
+       . 'touch an existing account if one is already in the database.</p>'
+       . '<p><a class="btn" href="install.php">Open the installer</a></p>'
+       . '</main></body></html>';
+    exit;
+}
+
 function config(?string $key = null): mixed
 {
     static $config = null;
@@ -78,8 +136,7 @@ function config(?string $key = null): mixed
     if ($config === null) {
         $path = config_path();
         if ($path === null) {
-            http_response_code(500);
-            exit('Not set up yet. Open install.php in your browser to get started.');
+            config_missing_page();
         }
         $config = require $path;
     }