@bongos/core 1.19.529 → 1.19.531

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.529",
-  "core_contract": "1.19.529",
-  "source_commit": "80d814daa7174fe0e760966095ee9339a29d7d1d",
+  "core_version": "1.19.531",
+  "core_contract": "1.19.531",
+  "source_commit": "9044e13dacbf2160d02eef08915ffa74dbc669be",
   "source_ref": "HEAD",
-  "built_at": "2026-09-04T13:17:35.687Z",
+  "built_at": "2026-09-04T13:41:13.821Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 435,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1976,
+    "functional_verbatim": 1979,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2435,
-  "tree_sha256": "a029bcb3e7adddef9f33b68cd23f96158ebb345a0b1a60e28dc8f2553809d595",
+  "file_count": 2438,
+  "tree_sha256": "0d93f09e833a982f219a54f124fe11808be718651cd93d5258119ef9e50a7954",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1767,12 +1767,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "42f1210b3c422d2b05b719c38eabfb3ed25ed31988a757394dfc2caed045ee36"
+      "sha256": "729633c41036ec0026d3ef1ac787f68cb6fb7ab77e3eb578f855b5ec2d63280f"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "0d9a040a9bac5670b2034e98479d86706070853dbb65b799d770b76e488534a6"
+      "sha256": "344a451940b630b1f6db2f97acb45eb387616311675b243dcc4381dc604ef77d"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2617,7 +2617,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "8a6ba922b7918d974e9374510472ce2a67c28790e60875b36efe7ceccda84e2f"
+      "sha256": "fa1785c5b0009ea7431a5fcf3fd13dcb5b65563c481e8d417d62c2eea6050af6"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6064,10 +6064,15 @@
       "mode": "0000644",
       "sha256": "4c933aad1307378496d47960e24c9d797a1f122f28aefa27b769f336e4cf2e75"
     },
+    {
+      "path": "modules/provisioning/routes/callback-page.js",
+      "mode": "0000644",
+      "sha256": "6b43ebf71a778277b94de1b9400f690fac9f51b48010e50a159af57195f99f02"
+    },
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "69ec9994c833b54466fa0e83a3aa2c09eada6b0aefadf73e6eb50b085996aaa6"
+      "sha256": "e08199bc9146bd3122ca038637a0e390b9f5e636a102fa290dba414cf6cafdc1"
     },
     {
       "path": "modules/provisioning/starter-bundles.js",
@@ -6882,12 +6887,12 @@
     {
       "path": "modules/status-ui/public/explore.html",
       "mode": "0000644",
-      "sha256": "e80fc1d5f44667f82761c9732433d1b38f074321024f493be0f74d9c037973ff"
+      "sha256": "7bdde42ca7bc23acaabf1966c928c6d0816e29677c243f82175a0e20bd995c07"
     },
     {
       "path": "modules/status-ui/public/explore.js",
       "mode": "0000644",
-      "sha256": "48769902093fa8d7d68ee38ee799eef70a2ac3190242886428fd635bf2a6e9ce"
+      "sha256": "a6311740e338d81cdeb9d5ce38733bd1dd4d978a6a5399c4f103017daf6f5cf2"
     },
     {
       "path": "modules/status-ui/public/index.html",
@@ -7327,12 +7332,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "43ac8c190119cd19cbd7884c854dd616d4dce8947f9435367acbf04c3058d7b1"
+      "sha256": "03ecbc56365c6b70ada0bdfd2ca666962f3ed8edcf95ef52acf93f2d0b82de51"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9baba915b700faa5eda5733b68bffd4aaeaa54b5a3076502440c39a944944f3d"
+      "sha256": "0eaf9886acaf585da2ecc97408dcb6f879a801ff20cead40a20bac221e8ea32f"
     },
     {
       "path": "public-docs/index.html",
@@ -9012,7 +9017,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "532e7d3dc98b5ff136f1cb7484232b17f2f3c750dad15315493224b2619ef78f"
+      "sha256": "a534c8a215f1f744707ef9835905ac2850c991757a76545f77a191f8c3827e7b"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9752,7 +9757,7 @@
     {
       "path": "tests/design_tokens_sync.mjs",
       "mode": "0000644",
-      "sha256": "0454ee692bbbf19d02c7f19c029f4da5a4dd939b84c4d67ebb713d12de179c2a"
+      "sha256": "6fc1f0a595d3042b5b57b708643cfdc18007b3b33bb6684ffbeb46217da4c376"
     },
     {
       "path": "tests/dev_lib.mjs",
@@ -9929,6 +9934,11 @@
       "mode": "0000644",
       "sha256": "d6a78357533fdeea3bc33fe97cfcd27b1d04747c600d0a7800ddfca5199dbb1f"
     },
+    {
+      "path": "tests/explore_visible_states.mjs",
+      "mode": "0000644",
+      "sha256": "015588572bf3c75c1af00b3bb591f133dff7e604be1f9b40272f1f963b24bf71"
+    },
     {
       "path": "tests/extract_json.mjs",
       "mode": "0000644",
@@ -11274,6 +11284,11 @@
       "mode": "0000644",
       "sha256": "9a04386b3047177bb55b6d392db88764f06f92e5c0b20c16ed9e0f8ce520b07d"
     },
+    {
+      "path": "tests/provisioning_callback_page.mjs",
+      "mode": "0000644",
+      "sha256": "74d53ae7f3c93883bdc6db5187c904cc6c641267233d70bfef1a25d5b2a4ca05"
+    },
     {
       "path": "tests/provisioning_default_domain.mjs",
       "mode": "0000644",
@@ -11292,7 +11307,7 @@
     {
       "path": "tests/provisioning_module_selection.mjs",
       "mode": "0000644",
-      "sha256": "48fc7c59efae4b7d1b9ab565882473483d7b4d8a40635583a789d0749da16578"
+      "sha256": "4a27e1641d949f261a8ba1b72816a8b077fc8a55862c4eef4091b453b7cfd45c"
     },
     {
       "path": "tests/provisioning_onboard_mode.mjs",

package/docs/copy-inventory.md

@@ -4,14 +4,14 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1645 strings** across 3 surfaces · 1427 distinct pieces of copy · 1645 certain, 0 heuristic · 154 shown in more than one place.
+**1647 strings** across 3 surfaces · 1429 distinct pieces of copy · 1647 certain, 0 heuristic · 154 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
 | `builders-hall` | `modules/hall-ui/public` | 73 | 1187 |
-| `status-dashboard` | `modules/status-ui/public` | 4 | 98 |
+| `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 5 | 360 |
 
 ## Confidence, and why it is on every row
@@ -1270,7 +1270,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7e1bb38d4777` | certain | 🔒 Request to join | `modules/hall-ui/public/goals-render.js:861` |
 | `cce9c199e874` | certain | 🛡 Archon-mediated | `modules/hall-ui/public/goals-render.js:803` |
 
-## `status-dashboard` — 98 strings
+## `status-dashboard` — 100 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -1278,6 +1278,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c5fbe5ea4335` | certain | , a third-party logistics house in Cleveland, Ohio. | `modules/status-ui/public/index.html:355` |
 | `2045078fb115` | certain | 90 days ago | `modules/status-ui/public/status.js:477` |
 | `e4848e2d9386` | certain | A new portrait is set down each time the city's stones are reshaped. Scroll to see how {{worldName}} has grown | `modules/status-ui/public/index.html:344` |
+| `390faeaffb47` | certain | A project | `modules/status-ui/public/explore.js:71` |
 | `f4a664041da5` | certain | A shipping container has washed ashore upon the coast south of Athens. About it a new civilization rises. Set  | `modules/status-ui/public/index.html:126` |
 | `623d6b7ae6b7` | certain | A true-to-life portrait of {{worldName}} as she stands today, rendered from the city's own stones. | `modules/status-ui/public/index.html:332` |
 | `155d14ab692a` | certain | All categories | `modules/status-ui/public/index.html:280` |
@@ -1290,11 +1291,10 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c8959bdc0e59` | certain | Breakdown filtered to {…}: {…} of {…} ({…}% of all spend). | `modules/status-ui/public/status.js:659` |
 | `1fe8937399f5` | certain | By order of the Senate | `modules/status-ui/public/index.html:354` |
 | `21f644463d57` | certain | Citizens who have set the most stone. | `modules/status-ui/public/index.html:201` |
-| `87af953708b3` | certain | Couldn't load projects right now. | `modules/status-ui/public/explore.html:56` |
+| `87af953708b3` | certain | Couldn't load projects right now. | `modules/status-ui/public/explore.html:109` |
 | `3aa071ef1142` | certain | Cross into the city → | `modules/status-ui/public/index.html:128` |
-| `f70f217504ce` | certain | Explore — featured projects | `modules/status-ui/public/explore.html:6` |
-| `f70f217504ce` | certain | Explore — featured projects | `modules/status-ui/public/explore.html:6` |
-| `4db99e47bc50` | certain | Featured projects built on the platform. | `modules/status-ui/public/explore.html:52` |
+| `f151456aedc1` | certain | Explore — projects on the map | `modules/status-ui/public/explore.html:6` |
+| `f151456aedc1` | certain | Explore — projects on the map | `modules/status-ui/public/explore.html:6` |
 | `14d6b38bc659` | certain | Filter inscriptions by date range | `modules/status-ui/public/index.html:309` |
 | `194f07002413` | certain | Filter spend by category | `modules/status-ui/public/index.html:279` |
 | `183993d780be` | certain | Filter spend by source | `modules/status-ui/public/index.html:273` |
@@ -1315,15 +1315,17 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `37b171a6195a` | certain | No architects yet — be the first to lay a stone. | `modules/status-ui/public/index.html:205` |
 | `7816fbe0add8` | certain | No builders yet — be the first. | `modules/status-ui/public/status.js:1117` |
 | `0b097f051d6f` | certain | No endeavors underway just now. | `modules/status-ui/public/status.js:516` |
-| `837af36041de` | certain | No featured projects yet — check back soon. | `modules/status-ui/public/explore.html:55` |
+| `ed9b06f79234` | certain | No projects on the map yet — check back soon. | `modules/status-ui/public/explore.html:108` |
 | `4b1a11bfdf10` | certain | No works yet inscribed in this window. | `modules/status-ui/public/status.js:947` |
 | `7a8afe641683` | certain | No works yet inscribed. | `modules/status-ui/public/index.html:318` |
 | `3e8205a358d9` | certain | No {…} yet attributed to a hand. | `modules/status-ui/public/status.js:746` |
 | `c9efa62c36e7` | certain | No {…} yet spent. | `modules/status-ui/public/status.js:684` |
 | `2df94faddc8c` | certain | Not enough shipped works yet to draw the curve. | `modules/status-ui/public/index.html:224` |
 | `9d8692476139` | certain | Previous page | `modules/status-ui/public/index.html:321` |
+| `f1b103f87df2` | certain | Projects on the map, and how each one stands on it. | `modules/status-ui/public/explore.html:105` |
 | `48473324e839` | certain | Sections of the ledger | `modules/status-ui/public/index.html:144` |
 | `81cb441627b8` | certain | Show history of earlier portraits | `modules/status-ui/public/index.html:342` |
+| `abd2ce869517` | certain | Something is here. Its name, and everything else about it, stay with its owner. | `modules/status-ui/public/explore.js:74` |
 | `0cc023b5f470` | certain | Split by hand — {{currency}} spent by each builder at the workshop. | `modules/status-ui/public/index.html:295` |
 | `fddc39dcf1eb` | certain | Tablet being consulted… | `modules/status-ui/public/index.html:130` |
 | `8f86e1c9ad44` | certain | Text size | `modules/status-ui/public/index.html:18` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1645,
-    "unique_ids": 1427,
-    "certain": 1645,
+    "strings": 1647,
+    "unique_ids": 1429,
+    "certain": 1647,
     "heuristic": 0,
     "duplicate_ids": 154
   },
@@ -18,7 +18,7 @@
     "status-dashboard": {
       "at": "modules/status-ui/public",
       "files": 4,
-      "strings": 98
+      "strings": 100
     },
     "landing": {
       "at": "modules/public-landing/public",
@@ -693,9 +693,9 @@
       ]
     },
     {
-      "id": "f70f217504ce",
+      "id": "f151456aedc1",
       "surface": "status-dashboard",
-      "text": "Explore — featured projects",
+      "text": "Explore — projects on the map",
       "occurrences": 2,
       "at": [
         "modules/status-ui/public/explore.html:6",
@@ -15603,6 +15603,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "390faeaffb47",
+      "surface": "status-dashboard",
+      "text": "A project",
+      "file": "modules/status-ui/public/explore.js",
+      "line": 71,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
     {
       "id": "f4a664041da5",
       "surface": "status-dashboard",
@@ -15716,7 +15725,7 @@
       "surface": "status-dashboard",
       "text": "Couldn't load projects right now.",
       "file": "modules/status-ui/public/explore.html",
-      "line": 56,
+      "line": 109,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -15730,32 +15739,23 @@
       "confidence": "certain"
     },
     {
-      "id": "f70f217504ce",
+      "id": "f151456aedc1",
       "surface": "status-dashboard",
-      "text": "Explore — featured projects",
+      "text": "Explore — projects on the map",
       "file": "modules/status-ui/public/explore.html",
       "line": 6,
       "origin": "html-text",
       "confidence": "certain"
     },
     {
-      "id": "f70f217504ce",
+      "id": "f151456aedc1",
       "surface": "status-dashboard",
-      "text": "Explore — featured projects",
+      "text": "Explore — projects on the map",
       "file": "modules/status-ui/public/explore.html",
       "line": 6,
       "origin": "html-title",
       "confidence": "certain"
     },
-    {
-      "id": "4db99e47bc50",
-      "surface": "status-dashboard",
-      "text": "Featured projects built on the platform.",
-      "file": "modules/status-ui/public/explore.html",
-      "line": 52,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "14d6b38bc659",
       "surface": "status-dashboard",
@@ -15937,11 +15937,11 @@
       "confidence": "certain"
     },
     {
-      "id": "837af36041de",
+      "id": "ed9b06f79234",
       "surface": "status-dashboard",
-      "text": "No featured projects yet — check back soon.",
+      "text": "No projects on the map yet — check back soon.",
       "file": "modules/status-ui/public/explore.html",
-      "line": 55,
+      "line": 108,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -15999,6 +15999,15 @@
       "origin": "html-attr:aria-label",
       "confidence": "certain"
     },
+    {
+      "id": "f1b103f87df2",
+      "surface": "status-dashboard",
+      "text": "Projects on the map, and how each one stands on it.",
+      "file": "modules/status-ui/public/explore.html",
+      "line": 105,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "48473324e839",
       "surface": "status-dashboard",
@@ -16017,6 +16026,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "abd2ce869517",
+      "surface": "status-dashboard",
+      "text": "Something is here. Its name, and everything else about it, stay with its owner.",
+      "file": "modules/status-ui/public/explore.js",
+      "line": 74,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
     {
       "id": "0cc023b5f470",
       "surface": "status-dashboard",

package/docs/module-api-changelog.md

@@ -1495,5 +1495,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.527 with no explicit bump. run 33829339717. (task 1002620)
   1.19.529 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.528 with no explicit bump. run 33877197857. (task 1002620)
+  1.19.530 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.529 with no explicit bump. run 33878817005. (task 1002620)
+  1.19.531 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.530 with no explicit bump. run 33879403011. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/routes/callback-page.js

@@ -0,0 +1,159 @@
+// modules/provisioning/routes/callback-page.js — the standalone HTML the public
+// GitHub-App-Manifest redirect lands on (task 1003570; the page itself is task 2096).
+//
+// WHY. This is pure PRESENTATION for exactly one route — `GET /provisioning/
+// github-app/callback` in routes/provisioning.js — and it is ~135 lines of escaper,
+// palette, stylesheet, client script and template with no request, DB or auth logic
+// in it. Carrying it inside the route file pushed that file onto the 1500-line
+// OVERSIZE_LINES fitness ratchet (scripts/gds/fitness-ratchets.js), where the next
+// single added line failed `unit` and the only obvious escape — raising the baseline
+// — is the one thing the ratchet forbids (ADR 0243 §4/§5 for the argument that put
+// it there). Moved here verbatim so the route file has room to change again.
+//
+// Reaches core ONLY through the doorway src/module-api.js (the one-way rule, ADR
+// 0083); it is required by routes/provisioning.js and by nothing else.
+//
+// Shape: no DB, no network, no request object — given a plain options bag it returns
+// a string. `esc` and `callbackPage` are the whole surface; PAGE_STYLE and
+// CALLBACK_SCRIPT stay private because they are only ever this page's own body.
+'use strict';
+
+const api = require('../../../src/module-api');
+
+// Minimal HTML escaper for the callback landing page (no template engine here).
+function esc(s) {
+  return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => (
+    { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]
+  ));
+}
+
+// Accent pair resolved from the instance's own branding — the pack is the palette
+// authority (task 1002810); the literal fallbacks are the neutral pack's values, so
+// a branding validation error still paints the current family, never a stale one.
+const ACCENT = (() => {
+  try {
+    const c = api.branding().theme?.ui?.colors || {};
+    return { sun: c.accent || '#fb9569', sun600: c.accentDeep || '#a3481a' };
+  } catch { return { sun: '#fb9569', sun600: '#a3481a' }; }
+})();
+
+// Brand styling for the standalone onboarding pages — sunrise palette + Baloo 2 /
+// Quicksand (accents from the branding pack, config/branding.neutral.json resolved
+// under the instance's own config/branding.json). Light + dark aware; no external
+// dependency beyond an optional Google-Fonts link (system fallback if it doesn't load).
+const PAGE_STYLE = `
+:root{color-scheme:light dark;--sun:${ACCENT.sun};--sun600:${ACCENT.sun600};--sunInk:#2a1305;--coral:#fb7185;--sky:#38bdf8;--sky600:#0284c7;--ok:#16a34a;--warn:#f59e0b;--ink:#2a1f17;--inkSoft:#6b5d52;--card:#fffdfa;--line:#f0e2cf;--bg1:#fde8c8;--bg2:#fff4e6;--bg3:#fffdfa}
+@media (prefers-color-scheme:dark){:root{--ink:#f5efe6;--inkSoft:#cbbdad;--card:#241b13;--line:#3a2c1e;--bg1:#2a1d10;--bg2:#1b130b;--bg3:#130d07}}
+*{box-sizing:border-box}html,body{height:100%}
+body{margin:0;font-family:"Quicksand",system-ui,-apple-system,"Segoe UI",sans-serif;color:var(--ink);background:linear-gradient(180deg,var(--bg1) 0%,var(--bg2) 45%,var(--bg3) 100%);background-attachment:fixed;display:flex;align-items:center;justify-content:center;padding:1.5rem;-webkit-font-smoothing:antialiased;text-rendering:optimizeLegibility}
+.card{width:100%;max-width:30rem;background:var(--card);border:1px solid var(--line);border-radius:20px;padding:2.4rem 2rem 2rem;text-align:center;box-shadow:0 18px 50px -22px rgba(120,60,10,.4),0 2px 8px rgba(120,60,10,.07)}
+.badge-warn{font-size:2.4rem;line-height:1;margin:0 auto 1rem}
+h1{font-family:"Baloo 2",system-ui,sans-serif;font-weight:700;font-size:1.5rem;line-height:1.15;margin:.2rem 0 .55rem}
+.sub{color:var(--inkSoft);font-size:1.02rem;line-height:1.5;margin:0 auto;max-width:24rem}
+.sub p{margin:.6rem 0}
+code{font-family:"Fira Code",ui-monospace,SFMono-Regular,monospace;background:rgba(56,189,248,.14);color:var(--sky600);padding:.12em .45em;border-radius:6px;font-size:.9em;overflow-wrap:anywhere}
+@media (prefers-color-scheme:dark){code{color:var(--sky)}}
+.steps{display:flex;align-items:flex-start;justify-content:center;margin:1.9rem 0 1.1rem}
+.step{flex:1 1 0;max-width:9rem;position:relative}
+.step::before{content:"";position:absolute;top:16px;left:-50%;width:100%;height:3px;background:var(--line);z-index:0;transition:background .4s ease}
+.step:first-child::before{display:none}
+.dot{width:34px;height:34px;border-radius:50%;margin:0 auto;display:grid;place-items:center;background:var(--bg3);border:2px solid var(--line);color:var(--inkSoft);font-weight:700;font-size:.95rem;position:relative;z-index:1;transition:all .4s ease}
+.lbl{margin-top:.55rem;font-size:.78rem;color:var(--inkSoft);font-weight:600;line-height:1.25;padding:0 .2rem}
+.step.done .dot{background:var(--ok);border-color:var(--ok);color:#fff}
+.step.done::before{background:var(--ok)}
+.step.active .dot{border-color:var(--sun);color:var(--sun600);animation:pulse 1.5s ease-in-out infinite}
+.step.active .lbl{color:var(--ink)}
+.step.active .dot::after{content:"";position:absolute;inset:-3px;border-radius:50%;border:2px solid transparent;border-top-color:var(--sun);animation:spin .8s linear infinite}
+@keyframes spin{to{transform:rotate(360deg)}}
+@keyframes pulse{0%,100%{box-shadow:0 0 0 4px rgba(249,115,22,.15)}50%{box-shadow:0 0 0 9px rgba(249,115,22,.04)}}
+@media (prefers-reduced-motion:reduce){.step.active .dot,.step.active .dot::after{animation:none}}
+.status-line{min-height:1.4em;color:var(--inkSoft);font-size:.94rem;margin:.4rem auto 0;max-width:24rem;line-height:1.45}
+.cta{margin-top:1.4rem}
+.btn{display:inline-block;background:var(--sun);color:var(--sunInk);text-decoration:none;font-weight:700;font-family:"Baloo 2",system-ui,sans-serif;padding:.72rem 1.5rem;border-radius:999px;font-size:1.02rem;box-shadow:0 10px 22px -8px rgba(249,115,22,.7);transition:transform .15s ease,box-shadow .15s ease}
+.btn:hover{transform:translateY(-1px);box-shadow:0 14px 28px -8px rgba(249,115,22,.8)}
+.muted{color:var(--inkSoft);opacity:.9;font-size:.85rem;margin:1.1rem auto 0;max-width:24rem;line-height:1.45}
+.hidden{display:none!important}
+`;
+
+// Client script for the PROGRESS variant only (task 2096): poll the public status
+// endpoint, advance the stepper, and auto-open the instance the moment its credentials
+// land. Deliberately contains NO backticks and NO ${...} so it survives the outer
+// template literal verbatim; the only server data it reads is the JSON config block
+// written just above it. Fails soft — a poll hiccup just retries; a long wait reveals a
+// manual "open" button rather than ever falsely erroring. The auto-open countdown runs
+// ONLY when this page is the wizard's pop-up; a same-tab return (pop-up blocked) keeps
+// the founder here with the door and a way back to the checklist (task 1003236).
+const CALLBACK_SCRIPT = `
+(function(){
+  var cfg=window.__CB_SETUP__||{};
+  var state=cfg.state||'',domain=cfg.domain||'';
+  if(!state||!domain)return;
+  var target='https://'+domain;
+  var pollUrl=location.pathname.replace('/callback','/status')+'?state='+encodeURIComponent(state);
+  var steps=document.getElementById('steps'),statusEl=document.getElementById('status');
+  var cta=document.getElementById('cta'),go=document.getElementById('go'),foot=document.getElementById('foot'),back=document.getElementById('back');
+  /* Opened from the wizard as a pop-up (window.opener alive, or the tab still carries the name the wizard gave it):
+     the checklist is in the other tab, so this one may auto-open the instance. Same-tab fallback (pop-up blocked,
+     form target=_self): this IS the founder's checklist tab — never navigate it away; offer both doors (task 1003236). */
+  var popup=!!window.opener||window.name==='ghAppSetup';
+  var finished=false,tries=0,manual=false;
+  function dot(n){return steps.querySelector('[data-step="'+n+'"]');}
+  function setActive(n){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active','done');if(i<n){el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}else if(i===n){el.classList.add('active');}}}
+  function allDone(){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active');el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}}
+  function ready(){if(finished)return;finished=true;allDone();statusEl.textContent='Your instance is ready \\u2014 sign in with GitHub to claim it as owner.';cta.classList.remove('hidden');
+    if(!popup){go.textContent='Open '+domain+' \\u2192';if(back)back.classList.remove('hidden');if(foot)foot.textContent='Your setup checklist is waiting where you left it \\u2014 finish it first, or open your instance now.';return;}
+    var n=4;(function tick(){if(n<=0){location.href=target;return;}go.textContent='Opening '+domain+' in '+n+'\\u2026';n--;setTimeout(tick,1000);})();}
+  function failed(){if(finished)return;finished=true;statusEl.textContent='Setup didn\\u2019t finish. Open your instance page and start the GitHub sign-in setup again.';cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';}
+  function revealManual(){if(manual||finished)return;manual=true;cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';if(foot)foot.textContent='This is taking a little longer than usual \\u2014 you can open your instance now, or keep waiting.';}
+  function schedule(){if(!finished)setTimeout(poll,3000);}
+  function poll(){tries++;fetch(pollUrl,{headers:{accept:'application/json'},cache:'no-store'}).then(function(r){return r.ok?r.json():null;}).then(function(j){if(!j){schedule();return;}if(j.ready||j.status==='done'){ready();return;}if(j.status==='error'||j.status==='expired'){failed();return;}setActive(2);if(tries===40)revealManual();schedule();}).catch(function(){schedule();});}
+  setActive(2);poll();
+})();
+`;
+
+// The standalone landing page for the public GitHub redirect (the mothership serves it;
+// it is NOT the hall shell). Two variants share the Cloud Bongos brand shell (task 2096):
+//   • progress — ok + state + domain: an animated stepper that polls the status endpoint
+//     and auto-opens the instance when its credentials are placed.
+//   • message — everything else (errors + the no-domain success fallback): a calm badge
+//     + `body` (server-authored, trusted HTML).
+function callbackPage({ ok, title, body, state, domain }) {
+  const progress = !!(ok && state && domain);
+  const cfgJson = JSON.stringify({ state: state || '', domain: domain || '' }).replace(/</g, '\\u003c');
+  const head = `<!doctype html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="color-scheme" content="light dark">
+<title>${esc(title)}</title>
+<link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link href="https://fonts.googleapis.com/css2?family=Baloo+2:wght@600;700;800&family=Quicksand:wght@400;500;600;700&family=Fira+Code&display=swap" rel="stylesheet">
+<style>${PAGE_STYLE}</style></head><body>`;
+  if (progress) {
+    return `${head}
+<main class="card">
+  <h1>${esc(title)}</h1>
+  <p class="sub">Finishing sign-in setup for <code>${esc(domain)}</code>.</p>
+  <div class="steps" id="steps" aria-label="Setup progress">
+    <div class="step done" data-step="1"><div class="dot">✓</div><div class="lbl">GitHub app created</div></div>
+    <div class="step active" data-step="2"><div class="dot">2</div><div class="lbl">Placing credentials</div></div>
+    <div class="step" data-step="3"><div class="dot">3</div><div class="lbl">Ready to sign in</div></div>
+  </div>
+  <p class="status-line" id="status">Hang tight — keep this tab open while we finish.</p>
+  <div class="cta hidden" id="cta"><a class="btn" id="go" href="https://${esc(domain)}">Open ${esc(domain)} →</a></div>
+  <p class="muted hidden" id="back"><a href="/projects?view=new">Finish your remaining setup steps →</a></p>
+  <p class="muted" id="foot">This page opens <code>${esc(domain)}</code> for you the moment it’s ready.</p>
+  <noscript><p class="muted">When setup finishes, open <a href="https://${esc(domain)}">${esc(domain)}</a> and sign in with GitHub — that first sign-in makes you the owner.</p></noscript>
+</main>
+<script>window.__CB_SETUP__=${cfgJson};</script>
+<script>${CALLBACK_SCRIPT}</script>
+</body></html>`;
+  }
+  return `${head}
+<main class="card">
+  <div class="badge-warn">${ok ? '✓' : '⚠️'}</div>
+  <h1>${esc(title)}</h1>
+  <div class="sub">${body || ''}</div>
+</main>
+</body></html>`;
+}
+
+module.exports = { esc, callbackPage };