@bongos/core 1.19.829 → 1.19.831

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.829",
-  "core_contract": "1.19.829",
-  "source_commit": "5e752a914c7b9d8e6a0a2d433c4489eae62a201f",
+  "core_version": "1.19.831",
+  "core_contract": "1.19.831",
+  "source_commit": "30cc1cbe10b2f1a3d1cb907ee320d18c78e23eb0",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T14:33:33.476Z",
+  "built_at": "2026-09-17T15:15:18.923Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 491,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2242,
+    "functional_verbatim": 2244,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2759,
-  "tree_sha256": "d2c620df0cd6ca7d45a6da686f8faae022490ec620e93678796d350e2a8f78d3",
+  "file_count": 2761,
+  "tree_sha256": "484014065f907c382c6fdbaadc2ae5bc3ff3af2f1b79a02119f7acf9d3ccd2fc",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -407,7 +407,7 @@
     {
       "path": "docker-compose.yml",
       "mode": "0000644",
-      "sha256": "1742d8f1fe0795a1b1396e0e59b17bb324cba1101cb89b17336a866a34eeddd1"
+      "sha256": "098a2645a43876141b6c711362c2a93e134d1de7533cb6e17de9e80ccfb1327e"
     },
     {
       "path": "docker-entrypoint.sh",
@@ -2552,7 +2552,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "031987fb991bfd88d12ce55f8408abd54fa7c0ae14aeb06773590ce347765fe9"
+      "sha256": "eb4a8912413adbed5f2677ea334c86aeaac50dab4acc03e618dcff866286d505"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2782,7 +2782,7 @@
     {
       "path": "docs/recipes/self-host.md",
       "mode": "0000644",
-      "sha256": "8f97eeefdd7e2e0bd15ff066a7a7ab10378716182bbcc494ef0bdde1fd7c3f2b"
+      "sha256": "2108b55f6e3264af35c2db885b5a98ff8cc9a5c5c68881d3f5ce8037db1bf159"
     },
     {
       "path": "docs/recipes/server-bring-up.md",
@@ -7837,12 +7837,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8af9d6b81006a300da6bb7df13c0114e0a94882a25715a314c31daa8039943aa"
+      "sha256": "9ef226bf93c85c85d63babd32469fb3a3f4a69fdf2dc94f57d80c3b54b3e9c0d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "facb74c30d620f2cecc5b3476752741626fc11fb5f3a19f0736eee180404e301"
+      "sha256": "3a966e21858e712dbb9e8bedc875e4bc92095f1c4489b471221e51b42d701aed"
     },
     {
       "path": "public-docs/index.html",
@@ -9467,7 +9467,7 @@
     {
       "path": "src/bongos/auth-admission.js",
       "mode": "0000644",
-      "sha256": "27b9f2ed74d5abbf8dade5199da278fe758c0e6472fbdb1d280bfbb9c24e4596"
+      "sha256": "2d11e7b745a0476fa0643fd997c2e17a49709bae1ef93a7c4636f7efd18c7ab0"
     },
     {
       "path": "src/bongos/auth-config.js",
@@ -9492,7 +9492,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "0cfc14e764b04d21b710278132ed35a297417954b1200db0db7f61ece224a389"
+      "sha256": "7e9b3c48e6d4bc3e0370e6ff4dba799691abeb02181d8910d0807651656f7d7e"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -9507,7 +9507,7 @@
     {
       "path": "src/bongos/db-kernel.js",
       "mode": "0000644",
-      "sha256": "e9a566e63b95225e3ee15331424af831875f75b5ea977c73f077bb50f46c4c6b"
+      "sha256": "1fffc39fb9b70cd009d7d239729a9ff329cd41ca1f35b50b7c9e6b89aa83624e"
     },
     {
       "path": "src/bongos/db.js",
@@ -9652,7 +9652,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "40ff17b595791bf6a8c7ae1cd17c54d8ce5cc6fa805622fd8fbc2dc2c398c961"
+      "sha256": "66abf424a565cdcc4de85350774d91e93be826a3b01a23ad75fee1feb7977a3c"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -9762,7 +9762,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9d2cc3cc105693debf99590994668c2060c0d39ecca4fa14b217c87eb1fb2ca4"
+      "sha256": "0e198cb1212d9a60178cb27ffed61166f60e097d3bed2afb564c9960b10c81e7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10544,6 +10544,11 @@
       "mode": "0000644",
       "sha256": "3f9e3ea6d2b88cd6592ba7b0575908eb020a072e6ccdb8cdf908bfba65b5191c"
     },
+    {
+      "path": "tests/compose_demo_credentials.mjs",
+      "mode": "0000644",
+      "sha256": "1d625746b022de4f4e23ce071e276ce5758e048f5997fce690ac8e301b6c6721"
+    },
     {
       "path": "tests/conductor.mjs",
       "mode": "0000644",
@@ -10969,6 +10974,11 @@
       "mode": "0000644",
       "sha256": "8006f4696e6bae21b84c9e8ec25cb7a7d34c5899f187d2ac59b2a6dcbb6f92d1"
     },
+    {
+      "path": "tests/first_admin_unset_signin.mjs",
+      "mode": "0000644",
+      "sha256": "88b3d0c7fb278e560850f440ec6721655efb62bcafcd983deb7e9ddb25103b65"
+    },
     {
       "path": "tests/first_run_engine_check.mjs",
       "mode": "0000644",

package/docker-compose.yml

@@ -14,7 +14,10 @@ services:
     image: postgres:16-alpine
     environment:
       POSTGRES_USER: cloudbongos
-      POSTGRES_PASSWORD: cloudbongos
+      # Under 8 characters on purpose: the leak scan treats any 8+ character value of a
+      # secret-named variable as a live credential, and this file ships in the core
+      # (task 1002717). The db port is not published; this value never leaves the network.
+      POSTGRES_PASSWORD: demo-pw
       POSTGRES_DB: cloudbongos
     volumes:
       - cloudbongos-db:/var/lib/postgresql/data
@@ -35,7 +38,7 @@ services:
       PGHOST: db
       PGPORT: "5432"
       PGUSER: cloudbongos
-      PGPASSWORD: cloudbongos
+      PGPASSWORD: demo-pw
       PGDATABASE: cloudbongos
       # Bind to all interfaces inside the container so the published port works.
       HOST: 0.0.0.0

package/docs/module-api-changelog.md

@@ -2132,5 +2132,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.827 with no explicit bump. run 35231300810. (task 1002620)
   1.19.829 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.828 with no explicit bump. run 35234300466. (task 1002620)
+  1.19.830 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.829 with no explicit bump. run 35235005422. (task 1002620)
+  1.19.831 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.830 with no explicit bump. run 35238952391. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/self-host.md

@@ -18,6 +18,10 @@ That builds the image, starts Postgres, applies the build-system migrations (gam
 
 To stop and wipe: `docker compose down -v` (the `-v` drops the `cloudbongos-db` volume).
 
+**Before your first sign-in, set `BONGOS_FIRST_ADMIN` to your GitHub login** (in `docker-compose.override.yml`, below). A new instance has no owner to approve anyone, so without it every sign-in is refused, yours included, and the page says so.
+
+**Upgrading from a compose file older than task 1002717?** The demo database password changed from `cloudbongos` to `demo-pw`, and an existing volume keeps the old one. Either wipe it (`docker compose down -v`) or keep your data and update the password in place: `docker compose exec db psql -U cloudbongos -c "ALTER USER cloudbongos PASSWORD 'demo-pw'"`.
+
 ## Branding / configuring your instance
 
 The image is intentionally vanilla. To make it yours, supply your own config at runtime by mounting it over the build:
@@ -35,7 +39,7 @@ Author `config/branding.json` from the neutral starter — see [the branding con
 
 **Or scaffold it with `bongos init`** ([task #1204](https://example.com/builders#/task/1204)): a short interview (or `bongos init --from spec.json` for a hands-free / CI run) that writes both config files, **seeds your first version + its done-when goal**, and **files the human-only kickoff steps** (register a GitHub OAuth app, first owner sign-in, repo binding, admission) as real tracked tasks — so a fresh instance has a claimable queue on day one instead of an empty hall. It never invents your branding (it points you at the fill prompt for that). Preview the whole plan with `bongos init --dry-run`.
 
-**Production hosting, optional (the `provisioning` module — [ADR 0111](../adr/0111-instance-hosting-provisioning-module.md) §3).** If you enable the `provisioning` module and answer the interview's hosting questions (shape — co-tenant `$0` or a dedicated droplet — bring-your-own domain, credential ref, tier), init turns those answers into a real **provisioning request** (a queued `provision` intent the control-plane runner drains) instead of only filing a manual "production topology" task. The two irreducibly-human legs — the GitHub OAuth app and the first owner sign-in — stay guided/manual. If the module isn't enabled on the target instance, init falls back to the manual production-topology task, so nothing is silently skipped.
+**Production hosting, optional (the `provisioning` module — [ADR 0111](../adr/0111-instance-hosting-provisioning-module.md) §3).** If you enable the `provisioning` module and answer the interview's hosting questions (shape — co-tenant `$0` or a dedicated droplet — bring-your-own domain, credential ref, tier), init turns those answers into a real **provisioning request** (a queued `provision` intent the control-plane runner drains) instead of only filing a manual "production topology" task. **A queued request does nothing until a runner drains it:** on the control plane that is a systemd timer running `node scripts/gds/provision.js run-intents --apply`. This Docker image cannot run that today (no git in the image, systemd and a DigitalOcean token assumed; task 1002718), so on a compose self-host a new project waits indefinitely. The two irreducibly-human legs — the GitHub OAuth app and the first owner sign-in — stay guided/manual. If the module isn't enabled on the target instance, init falls back to the manual production-topology task, so nothing is silently skipped.
 
 ## Configuration surface
 
@@ -46,6 +50,8 @@ Author `config/branding.json` from the neutral starter — see [the branding con
 | `MEDUSA_GDS_ONLY` | `1` = hard force-skip the OTB **instance-seed** migrations (`migrations/instance/`) — belt-and-suspenders over the default. A vanilla instance never wants OTB's versions/goals/criteria (task 1704 / [ADR 0105](../adr/0105-instance-seed-migrations-out-of-core.md)). | `1` |
 | `GDS_APPLY_INSTANCE_SEEDS` | `1` = opt IN to applying the bundled OTB instance-seed migrations. Default (unset) = **skip** — so a self-host never inherits OTB scope-truth. Only the owning instance sets this, and only when rebuilding its DB from scratch (DR). | unset |
 | `BONGOS_PUBLIC_ORIGIN` | public origin for OAuth callbacks etc. | `http://localhost:3000` |
+| `BONGOS_FIRST_ADMIN` | GitHub login seated as the first Archon at their first sign-in. Unset, nobody can sign in, because nobody exists to approve them. | unset |
+| `BONGOS_BUILDERS_ORIGIN` | origin the builders' hall is served on. The vanilla pack uses the public origin's host, which makes the hall the whole site: pages that only live on the apex, such as `/projects` and `/create`, return 404. Set a separate host (e.g. `http://builders.localhost:3000`) when you enable `provisioning`. | same host as the public origin |
 
 (The env prefix is the instance's `envPrefix` from its branding pack — `BONGOS` for vanilla.)
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.829",
+  "version": "1.19.831",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.829",
+      "version": "1.19.831",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.829",
+  "version": "1.19.831",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/auth-admission.js

@@ -16,6 +16,7 @@
 const {
   upsertBuilder,
   seatFirstAdminIfUnclaimed,
+  archonExists,
   createSession,
   lookupSession,
   getBuilderById,
@@ -308,6 +309,20 @@ async function webAdmissionStatus(login) {
   return { admitted, expectedSoon: admitted || state.pending || isFirstAdmin };
 }
 
+// instanceNeedsFirstAdmin — true while no Archon exists AND no firstAdmin is
+// configured: the vanilla self-host, where every sign-in (the operator's own
+// included) is refused and the generic page told them to ask an owner who does not
+// exist (task 1002717). A DB error answers false, leaving the generic page.
+async function instanceNeedsFirstAdmin() {
+  if (firstAdminLogin()) return false;
+  try {
+    return !(await archonExists());
+  } catch (err) {
+    log.error('[auth] instanceNeedsFirstAdmin', err);
+    return false;
+  }
+}
+
 // First-admin bootstrap (R62 / task 1201, ADR 0062). The configured firstAdmin
 // login — an install-time env override (<PREFIX>_FIRST_ADMIN, incl. legacy) wins,
 // else branding.firstAdmin. Empty/unset (the vanilla starter) means "no one is
@@ -456,6 +471,7 @@ async function readApplicantProfileFromHub(githubId) {
 module.exports = {
   firstAdminLogin,
   firstTimeAdmissionBlocked,
+  instanceNeedsFirstAdmin,
   readApplicantProfileFromHub,
   // Re-exported, not defined here (task 1003579 moved it to project-door.js with
   // the two knobs it composes against). auth.js, the doorway's api.joinabilityMode

package/src/bongos/auth.js

@@ -55,7 +55,7 @@ const ic = require('../instance-config');
 const { branding, userAgent } = require('../branding');
 
 const { SCOPE, authConfigured, grantedScopeCoversRepos, idpConfigured, idpEnabled, loadIdpConfig, scopeForWebFlow } = require('./auth-config.js');
-const { firstAdminLogin, firstTimeAdmissionBlocked, joinabilityMode, maybeSeatFirstAdmin, membershipKind, openEnrollmentEnabled, readApplicantProfileFromHub, webAdmissionStatus } = require('./auth-admission.js');
+const { firstAdminLogin, firstTimeAdmissionBlocked, instanceNeedsFirstAdmin, joinabilityMode, maybeSeatFirstAdmin, membershipKind, openEnrollmentEnabled, readApplicantProfileFromHub, webAdmissionStatus } = require('./auth-admission.js');
 const { buildAuthorizeUrl, completeWebFlow, pollDeviceFlow, startDeviceFlow } = require('./auth-github.js');
 const { buildIdpAuthorizeUrl, completeDeviceExchange, completeIdpFlow, idpAuthorizeUrl, loadHubPublicKey, logoutTokenJtiSeenAndRecord, verifyHubAssertion, verifyHubLogoutToken } = require('./auth-idp.js');
 const { addDiscordGuildMember, buildDiscordAuthorizeUrl, discordAuthorizeUrl, discordBotConfigured, discordConfigured, exchangeDiscordCode, fetchDiscordUser, isValidDiscordUserId, loadDiscordBotToken, loadDiscordCreds, removeDiscordGuildMember } = require('./auth-discord.js');
@@ -895,6 +895,7 @@ module.exports = {
   joinabilityMode,
   readApplicantProfileFromHub,
   firstTimeAdmissionBlocked,
+  instanceNeedsFirstAdmin,
   webAdmissionStatus,
   firstAdminLogin,
   maybeSeatFirstAdmin,

package/src/bongos/db-kernel.js

@@ -212,6 +212,14 @@ async function seatFirstAdminIfUnclaimed(builderId, login) {
   return rowCount > 0;
 }
 
+// archonExists — has anyone been seated as Archon yet? The same predicate the seat
+// above guards on, so "no owner yet" is exactly the window in which a configured
+// firstAdmin would still be seated (task 1002717).
+async function archonExists() {
+  const { rows } = await pool.query(`SELECT EXISTS (SELECT 1 FROM builders WHERE rank = 'archon') AS has`);
+  return !!(rows[0] && rows[0].has);
+}
+
 // getBuilderByGithubId — minimal identity read by stable GitHub numeric id (login
 // can change; github_id is the stable key). Backs the approval-gated web sign-in.
 async function getBuilderByGithubId(githubId) {
@@ -378,6 +386,7 @@ module.exports = {
   SESSION_TTL_MS,
   upsertBuilder,
   seatFirstAdminIfUnclaimed,
+  archonExists,
   getBuilderByGithubId,
   hasInvitedAccessRequest,
   accessStateByLogin,

package/src/bongos/routes/auth.js

@@ -40,7 +40,7 @@ const { pairStore } = require('../app-pair');
 const { publicOrigin, parseCookie, validateOrRespond } = require('./_helpers');
 const { accountExistenceReadRateLimit } = require('../middleware/rate-limit');
 const { branding } = require('../../branding');
-const { resolveEnv } = require('../../instance-config');
+const { resolveEnv, envPrefix } = require('../../instance-config');
 const seams = require('../../module-seams');
 // task 1003208: structured logging — was console.*. A core file logs through
 // the kernel logger directly; only MODULES go via api.logger (the doorway).
@@ -738,6 +738,19 @@ module.exports = function buildAuthRouter() {
         if (expectedSoon) {
           return res.status(202).type('text/html').send(renderAccessPendingPage(err.login, recoveryStartHref(req)));
         }
+        // task 1002717: with no owner and no FIRST_ADMIN, everyone is refused, the
+        // operator included. Name the fix instead of pointing at an owner who does not exist.
+        if (await auth.instanceNeedsFirstAdmin()) {
+          return res.status(403).type('text/html').send(renderAuthErrorPage(
+            'This instance has no owner yet',
+            `Nobody can sign in until an owner is configured. If you run this instance, set ${envPrefix()}_FIRST_ADMIN to your GitHub login, restart it, and sign in again. That account becomes the first Archon and can approve everyone after it.`,
+            {
+              subtitle: 'A new instance needs its owner set before anyone can sign in.',
+              startHref: recoveryStartHref(req),
+              note: 'The self-host recipe (docs/recipes/self-host.md) lists this setting.',
+            },
+          ));
+        }
         // The founder-shaped branch (only reachable with open enrollment OFF):
         // a stranger who was on their way to create a project is told the
         // approval brings them back to it — the return cookie says where.

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.829'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.831'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/compose_demo_credentials.mjs

@@ -0,0 +1,30 @@
+// tests/compose_demo_credentials.mjs — the self-host demo credentials never read as a live secret (task 1002717).
+//
+// docker-compose.yml used PGPASSWORD=cloudbongos. The env-secret leak scan
+// (collectEnvSecrets) treats any secret-named env value of 8+ characters as a live
+// credential, and package-core refuses to build when a functional file contains one.
+// Inside the compose container that meant every file mentioning the brand name, and
+// docker-compose.yml itself ships in the core, so any long demo value trips it.
+//
+// Run:  node --test tests/compose_demo_credentials.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { collectEnvSecrets } = require('../modules/security/secret-scrub.js');
+
+const compose = fs.readFileSync(new URL('../docker-compose.yml', import.meta.url), 'utf8');
+const env = {};
+for (const m of compose.matchAll(/^\s+([A-Z][A-Z0-9_]*):\s*"?([^"\r\n#]*?)"?\s*$/gm)) env[m[1]] = m[2];
+
+test('the compose file declares the database password for both services', () => {
+  assert.ok(env.POSTGRES_PASSWORD, 'db service password');
+  assert.equal(env.PGPASSWORD, env.POSTGRES_PASSWORD, 'the app connects with the password the db was created with');
+});
+
+test('no compose env value is collected as a live secret', () => {
+  assert.deepEqual(collectEnvSecrets(env), []);
+});

package/tests/first_admin_unset_signin.mjs

@@ -0,0 +1,80 @@
+// tests/first_admin_unset_signin.mjs — a fresh instance with no owner says so (task 1002717).
+//
+// A vanilla docker-compose self-host configures no FIRST_ADMIN, so the very first
+// sign-in (the operator's own) is refused, and the page it lands on said "ask the
+// owner to confirm your request" on an instance that has no owner. The callback
+// now asks auth.instanceNeedsFirstAdmin() first and, when it is true, names the fix.
+//
+// The stub goes into require.cache BEFORE auth.js loads: auth-admission destructures
+// its db-kernel bindings at require time.
+//
+// Run:  node --test tests/first_admin_unset_signin.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+const kernelPath = require.resolve('../src/bongos/db-kernel.js');
+const realKernel = require(kernelPath);
+let archon = false;
+let dbThrows = false;
+require.cache[kernelPath].exports = {
+  ...realKernel,
+  archonExists: async () => {
+    if (dbThrows) throw new Error('simulated DB outage');
+    return archon;
+  },
+};
+
+// Any prefix resolveEnv reads — the instance's own and the legacy spellings.
+for (const k of Object.keys(process.env)) if (k.endsWith('_FIRST_ADMIN')) delete process.env[k];
+
+const auth = require('../src/bongos/auth.js');
+
+test('precondition: this pack configures no firstAdmin', () => {
+  assert.equal(auth.firstAdminLogin(), null);
+});
+
+test('no owner and no FIRST_ADMIN: the instance needs one', async () => {
+  archon = false;
+  assert.equal(await auth.instanceNeedsFirstAdmin(), true);
+});
+
+test('an Archon exists: an established instance never shows the no-owner page', async () => {
+  archon = true;
+  assert.equal(await auth.instanceNeedsFirstAdmin(), false);
+});
+
+test('FIRST_ADMIN is configured: the bootstrap will seat them, so no', async () => {
+  archon = false;
+  process.env.OTB_FIRST_ADMIN = 'founding-owner';
+  try {
+    assert.equal(await auth.instanceNeedsFirstAdmin(), false);
+  } finally {
+    delete process.env.OTB_FIRST_ADMIN;
+  }
+});
+
+test('a DB error answers false, leaving the generic page', async () => {
+  dbThrows = true;
+  try {
+    assert.equal(await auth.instanceNeedsFirstAdmin(), false);
+  } finally {
+    dbThrows = false;
+  }
+});
+
+test('the callback checks for a missing owner before the generic not-approved pages', () => {
+  const src = fs.readFileSync(new URL('../src/bongos/routes/auth.js', import.meta.url), 'utf8').replace(/\r\n/g, '\n');
+  const waiting = src.indexOf('if (expectedSoon) {');
+  const noOwner = src.indexOf('if (await auth.instanceNeedsFirstAdmin()) {');
+  const inviteOnly = src.indexOf("if (effectiveJoinDoor() !== 'apply') {");
+  assert.ok(waiting > 0 && noOwner > 0 && inviteOnly > 0, 'all three branches present');
+  assert.ok(waiting < noOwner && noOwner < inviteOnly, 'waiting page, then no-owner page, then the refusals');
+  const branch = src.slice(noOwner, inviteOnly);
+  assert.match(branch, /'This instance has no owner yet'/);
+  assert.match(branch, /\$\{envPrefix\(\)\}_FIRST_ADMIN/, 'names the setting under this instance\'s own env prefix');
+});