@bongos/core 1.21.104 → 1.21.106

package/tests/github_one_trip.mjs

@@ -8,8 +8,8 @@
 //      app's OWN key: the creds read back out of a REAL webEnvBody, a JWT that verifies,
 //      installed / not installed / cannot tell, device flow on / off / cannot tell, and the
 //      tick recording only what GitHub confirmed — never a secret in a log line.
-//   3. the REAL projection (githubSetupRead) run into the REAL page renderers (projects.html,
-//      the vm-slice idiom): each server state draws the step the founder should see.
+//   3. the REAL projection (githubSetupRead) run into the REAL page facts (projects.html,
+//      ghFacts, the vm-slice idiom; task 1004683): each server state draws the fact the founder should see.
 //   4. the device-flow finding is written down where the next builder will look.
 //
 // Run:  node --test tests/github_one_trip.mjs
@@ -185,38 +185,35 @@ test('the window query takes each project\'s LATEST attempt, past placement, sti
   assert.match(fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'provision.js'), 'utf8'), /require\('\.\/provision-github-setup\.js'\)\.verifyGithubAppSetups\(deps\)/, 'it runs on every runner tick, after the conversions');
 });
 
-// ── 3. the real projection into the real renderers ──────────────────────────
+// ── 3. the real projection into the real page facts ─────────────────────────
+// Since task 1004683 part 03 draws FACTS, not checklist markup: ghFacts() is pure over
+// what the reads said, and paintFacts draws it from nodes (tests/setup_status_facts.mjs
+// runs the whole route-to-DOM path). Here: the GitHub half, fed by the real projection.
 
-const RS = SCRIPT.indexOf('    /* The four GitHub steps of part 03');
-const RE = SCRIPT.indexOf('    var STEP_RENDERERS = {', RS);
+const FS = SCRIPT.indexOf('    function ghStep(key) {');
+const FE = SCRIPT.indexOf('    /* ── drawing it: nodes and textContent only', FS);
 const SS = SCRIPT.indexOf('    /* the checklist the server derived (task 1004649)');
 const SE = SCRIPT.indexOf('    function pollManifest(stateToken) {', SS);
-const PS = SCRIPT.indexOf('    function stepsPaint() {');
-const PE = SCRIPT.indexOf('    (function hopInput()', PS);
 
 test('the regions are findable (a rename must fail loudly)', () => {
-  assert.ok(RS > 0 && RE > RS && SS > 0 && SE > SS && PS > 0 && PE > PS);
+  assert.ok(FS > 0 && FE > FS && SS > 0 && SE > SS);
+  assert.match(SCRIPT.slice(FS, FE), /function ghFacts\(now\)/);
 });
 
 function page({ manifest, appSlug = null }) {
   const sandbox = {
-    live: { manifest, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug, setup: null, installUrl: null, instStatus: 'active', addrReady: true },
+    live: { manifest, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug, appOrg: null, setup: null, installUrl: null, pickUp: null, verifying: false, askedPlatform: false, instStatus: 'active', addrReady: true, inst: null, readAt: 0, gone: '', repo: null },
     state: { name: 'Mer<cury', slug: 'mercury', owner: 'acme', repo: 'mercury', step: 2 },
-    autoOpenArmed: false,
-    resolvedDomain: () => 'mercury.example.com', apexBase: () => 'example.com',
-    esc: (x) => String(x).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
-    GH_ICON: '', manualOauthDetails: () => '', projectPageLink: (t) => t, autoOpenTick: () => '',
-    progressMarkup: (a, b, note) => `<prog>${note}</prog>`, encodeURIComponent, JSON, Array,
+    resolvedDomain: () => 'mercury.example.com', apexBase: () => 'example.com', addressReady: () => true,
+    document: { hidden: false, hasFocus: () => true },
   };
   vm.createContext(sandbox);
-  vm.runInContext(`${SCRIPT.slice(RS, RE)}\n${SCRIPT.slice(SS, SE)}\n${SCRIPT.slice(PS, PE)}`, sandbox);
+  vm.runInContext(`${SCRIPT.slice(FS, FE)}\n${SCRIPT.slice(SS, SE)}`, sandbox);
   return sandbox;
 }
-const ROWS = ['renderStepOauthApp', 'renderStepAppInstall', 'renderStepFirstSignIn', 'renderStepDeviceFlow'];
-function draw(sb) {
-  return ROWS.map((f) => vm.runInContext(`${f}()`, sb));
-}
-function cls(li) { return ((li.match(/^<li(?: class="([^"]*)")?/) || [])[1] || '').split(/\s+/).filter(Boolean); }
+// vm-born values compared through JSON
+const draw = (sb) => JSON.parse(JSON.stringify(vm.runInContext('ghFacts(Date.now())', sb)));
+const states = (rows) => rows.map((r) => r.state);
 
 async function serverSays(status, appSlug, eventRows) {
   const db = { query: async () => ({ rows: eventRows }) };
@@ -224,55 +221,50 @@ async function serverSays(status, appSlug, eventRows) {
   return GS.githubSetupRead(db, { target_ref: 'acme/mercury' }, row, status);
 }
 
-test('the mockup\'s four steps, in its words and order, the typed name escaped', () => {
-  const sb = page({ manifest: null });
-  const rows = draw(sb);
-  const titles = rows.map((li) => (li.match(/<b>([^<]*)<\/b>/) || [])[1]);
-  assert.deepEqual(titles, ['Approve the Mer&lt;cury app on GitHub', 'Install it on your repo', 'Builders can sign in', 'Command-line sign-in is on']);
-  assert.match(rows[0], /data-action="manifest-start"[^>]*>Connect GitHub ↗/, 'one click starts the one trip');
-  assert.equal(SCRIPT.match(/var STEP_ORDER = \[([^\]]*)\]/)[1], "'github-repo', 'oauth-app', 'app-install', 'first-sign-in', 'device-flow', 'enter-hall'", 'drawn in the mockup\'s order');
+test('the mockup\'s four facts, in its words and order; the typed name is text, never markup', () => {
+  const rows = draw(page({ manifest: null }));
+  assert.deepEqual(rows.map((r) => r.title), ['Approve the Mer<cury app on GitHub', 'Install it on your repo', 'Builders can sign in', 'Command-line sign-in']);
+  assert.deepEqual(rows.map((r) => r.key), ['approve', 'install', 'sign_in', 'device_flow']);
+  assert.equal(rows[0].act, 'connect', 'one click starts the one trip, from inside the Approve fact');
+  assert.equal(rows[0].state, 'you', 'it is the founder\'s turn');
+  assert.equal(rows[3].opt, true, 'command-line sign-in is optional');
+  assert.doesNotMatch(SCRIPT.slice(FS, FE), /esc\(|innerHTML/, 'the facts carry text; the painter writes nodes');
 });
 
-test('each server state draws the step the founder should see — from the REAL projection', async () => {
+test('each server state draws the facts the founder should see — from the REAL projection', async () => {
   // keys placed, nothing verified on GitHub yet
   let sb = page({ manifest: 'converting', appSlug: 'mercury-app' });
   let d = await serverSays('converting', 'mercury-app', []);
-  vm.runInContext(`seedSetup(${JSON.stringify(d.checklist)}, ${JSON.stringify(d.install_url)})`, sb);
+  vm.runInContext(`seedSetup(${JSON.stringify(d.checklist)}, ${JSON.stringify(d.install_url)}, ${JSON.stringify(d)})`, sb);
   let rows = draw(sb);
-  assert.deepEqual(rows.map(cls), [['sdone'], [], ['slocked'], ['slocked', 'soptional']]);
-  assert.match(rows[1], /href="https:\/\/github\.com\/apps\/mercury-app\/installations\/new\?state=S1"/, 'the way back to the install, with the attempt');
-  assert.equal(vm.runInContext('stepsPaint.toString().length > 0', sb), true);
+  assert.deepEqual(states(rows), ['done', 'you', 'now', 'todo']);
+  assert.equal(rows[1].href, 'https://github.com/apps/mercury-app/installations/new?state=S1', 'the way back to the install, with the attempt');
+  assert.equal(rows[1].sub, 'acme/mercury', 'the repo the server says it installs on');
+  assert.equal(rows[1].right, 'not yet seen');
 
   // sign-in verified, install still unconfirmed: NOT connected
   sb = page({ manifest: 'done', appSlug: 'mercury-app' });
   d = await serverSays('done', 'mercury-app', []);
-  vm.runInContext(`seedSetup(${JSON.stringify(d.checklist)}, ${JSON.stringify(d.install_url)})`, sb);
+  vm.runInContext(`seedSetup(${JSON.stringify(d.checklist)}, ${JSON.stringify(d.install_url)}, ${JSON.stringify(d)})`, sb);
   rows = draw(sb);
-  assert.deepEqual(rows.map(cls), [['sdone'], [], ['sdone'], ['soptional']]);
-  assert.match(rows[3], /Optional — turn it on later\./);
+  assert.deepEqual(states(rows), ['done', 'you', 'done', 'todo']);
+  assert.equal(JSON.stringify(rows[3].sub), JSON.stringify(['Turn it on later in ', { t: 'the app settings', href: 'https://github.com/settings/apps/mercury-app' }, '.']));
   assert.equal(vm.runInContext('setupOpen()', sb), true, 'the page keeps watching for the install');
 
   // GitHub confirmed the install to the runner: connected, device flow still optional
   sb = page({ manifest: 'done', appSlug: 'mercury-app' });
   d = await serverSays('done', 'mercury-app', [{ event: 'github-app-installed', at: '2026-10-08T10:00:00Z' }]);
-  vm.runInContext(`seedSetup(${JSON.stringify(d.checklist)}, ${JSON.stringify(d.install_url)})`, sb);
+  vm.runInContext(`seedSetup(${JSON.stringify(d.checklist)}, ${JSON.stringify(d.install_url)}, ${JSON.stringify(d)})`, sb);
   rows = draw(sb);
-  assert.deepEqual(rows.map(cls), [['sdone'], ['sdone'], ['sdone'], ['soptional']]);
-  assert.match(rows[1], /The app is on acme\/mercury/);
+  assert.deepEqual(states(rows), ['done', 'done', 'done', 'todo']);
   assert.equal(vm.runInContext('setupOpen()', sb), false);
-  // the part's state line, from these very rows: the optional step does not hold it back
-  const items = rows.map((li) => ({ classList: { contains: (c) => cls(li).includes(c) } }));
-  const ghState = { textContent: '' };
-  sb.$ = (id) => (id === 'humanSteps' ? { children: items } : id === 'ghState' ? ghState : null);
-  sb.manifestInFlight = () => false;
-  vm.runInContext('stepsPaint()', sb);
-  assert.equal(ghState.textContent, 'connected ✓');
+  assert.equal(vm.runInContext('setupCount([], ghFacts(Date.now()))', sb), 'ready ✓', 'the optional fact does not hold the count back');
 
   // and once GitHub has device flow on, the fourth ticks too
   sb = page({ manifest: 'done', appSlug: 'mercury-app' });
   d = await serverSays('done', 'mercury-app', [{ event: 'github-app-installed', at: '2026-10-08T10:00:00Z' }, { event: 'github-app-device-flow', at: '2026-10-08T10:05:00Z' }]);
-  vm.runInContext(`seedSetup(${JSON.stringify(d.checklist)}, ${JSON.stringify(d.install_url)})`, sb);
-  assert.deepEqual(cls(draw(sb)[3]), ['sdone', 'soptional']);
+  vm.runInContext(`seedSetup(${JSON.stringify(d.checklist)}, ${JSON.stringify(d.install_url)}, ${JSON.stringify(d)})`, sb);
+  assert.equal(draw(sb)[3].state, 'done');
 });
 
 test('seedSetup is change-only, and an install link must be GitHub\'s', () => {
@@ -286,6 +278,12 @@ test('seedSetup is change-only, and an install link must be GitHub\'s', () => {
   vm.runInContext(`seedSetup(${c}, 'javascript:alert(1)')`, sb2);
   assert.equal(vm.runInContext('live.installUrl', sb2), null);
   assert.equal(vm.runInContext('seedSetup(null, null)', sb2), false);
+  // the repo it installs on rides the read, strict
+  const sb3 = page({ manifest: 'done', appSlug: 'a' });
+  vm.runInContext(`seedSetup(${c}, null, { repo: 'acme/mer cury' })`, sb3);
+  assert.equal(vm.runInContext('live.repo', sb3), null, 'a malformed repo never reaches the page');
+  vm.runInContext(`seedSetup(${c}, null, { repo: 'acme/mercury' })`, sb3);
+  assert.equal(vm.runInContext('live.repo', sb3), 'acme/mercury');
 });
 
 // ── 4. the finding is written down ──────────────────────────────────────────

package/tests/github_org_account.mjs

@@ -113,7 +113,7 @@ const PICKER = region("    /* ── whose GitHub account: mine or an organisati
 const ENSURE_REPO = region('    function ensureFreshRepo() {', "    $('doCreate').addEventListener('click'");
 const NOTE_ORG = region("    /* the organisation the server says this attempt's app is on: change-only */", '    function startManifest(btn) {');
 const START = region('    function startManifest(btn) {', '    /* the "start again" offer once a wait has clearly gone wrong');
-const SETTINGS = region('    /* the organisation that owns the app, when the founder made it on one (task 1004651) */', '    /* oauth-app — the ADR 0133 one-click GitHub-App manifest flow');
+const SETTINGS = region('    /* the organisation that owns the app, when the founder made it on one (task 1004651) */', '    /* When a fact was seen, said plainly');
 
 test('the page regions are still findable (a rename must fail loudly, not test nothing)', () => {
   for (const [name, r] of Object.entries({ PICKER, ENSURE_REPO, NOTE_ORG, START, SETTINGS })) assert.ok(r, `${name} region not found`);
@@ -165,7 +165,7 @@ function page({ state = {}, live = {} } = {}) {
     live: { manifest: null, manifestMsg: '', manifestFailure: null, appSlug: null, appOrg: null, setup: null, installUrl: null, ...live },
     repoAccess: true, instanceId: 42, me: { github_login: 'founder' },
     hopForRepoAccess: () => false, syncHome() {}, saveDraft() {},
-    rememberManifest() {}, renderSteps() {}, pollManifest() {}, watchGhTab() {},
+    rememberManifest() {}, paintFacts() {}, repaintFacts() {}, pollManifest() {}, watchGhTab() {},
   };
   sandbox.manifestStartedAt = 0;
   vm.createContext(sandbox);

package/tests/github_pick_up.mjs

@@ -13,7 +13,7 @@
 //   2. the runner — a stopped sign-in is re-asked with the keys already placed and becomes
 //      'done'; a placement that throws after GitHub's conversion is a SPENT code (never
 //      re-queued); GitHub's 404 on a conversion drops the dead code.
-//   3. the REAL status route's answer run into the REAL page (seedSetup + the step renderers):
+//   3. the REAL status route's answer run into the REAL page (seedSetup + part 03's facts, task 1004683):
 //      every reachable state draws a sentence and an action, none a chore or "contact us".
 //   4. the page's own actions: pick-up posts to the pick-up route and watches again, Reopen
 //      GitHub goes through the mint route (which hands back the SAME state), and "Send it to
@@ -184,29 +184,29 @@ const express = require('express');
 const app = express();
 app.use('/api/bongos', require(path.join(ROOT, 'modules', 'provisioning', 'routes', 'github-setup.js'))());
 
-const RS = SCRIPT.indexOf('    /* The four GitHub steps of part 03');
-const RE = SCRIPT.indexOf('    var STEP_RENDERERS = {', RS);
+// part 03's facts (task 1004683): the pure half of the facts region, the seed, and the actions
+const FS = SCRIPT.indexOf('    function ghStep(key) {');
+const FE = SCRIPT.indexOf('    /* ── drawing it: nodes and textContent only', FS);
 const SS = SCRIPT.indexOf('    /* the checklist the server derived (task 1004649)');
 const SE = SCRIPT.indexOf('    function setupOpen() {', SS);
 const AS = SCRIPT.indexOf('    /* ── Pick up where it stopped (task 1004652).');
 const AE = SCRIPT.indexOf('    function startManifest(btn) {', AS);
 
 test('the page regions are findable (a rename must fail loudly)', () => {
-  assert.ok(RS > 0 && RE > RS && SS > 0 && SE > SS && AS > 0 && AE > AS);
+  assert.ok(FS > 0 && FE > FS && SS > 0 && SE > SS && AS > 0 && AE > AS);
 });
 
-const esc = (x) => String(x).replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[ch]));
 function page(extra = {}) {
+  const now = new Date().toISOString();
   const sandbox = {
-    live: { manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null, appOrg: null, setup: null, installUrl: null, instStatus: 'active', addrReady: true, pickUp: null, verifying: false, askedPlatform: false },
-    state: { name: 'Mercury', slug: 'mercury', owner: 'acme', repo: 'mercury' }, autoOpenArmed: false,
-    resolvedDomain: () => 'mercury.example.com', apexBase: () => 'example.com', esc,
-    GH_ICON: '', manualOauthDetails: () => '<details>manual</details>', projectPageLink: (t) => t, autoOpenTick: () => '',
-    progressMarkup: (a, b, note) => `<prog>${note}</prog>`, encodeURIComponent, JSON,
+    live: { manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null, appOrg: null, setup: null, installUrl: null, instStatus: 'active', addrReady: true, pickUp: null, verifying: false, askedPlatform: false,
+      inst: { id: 42, status: 'active', domain: 'mercury.example.com', dns_resolves: true, last_verified_up: true, last_verified_at: now, created_at: now, provisioned_at: now, open_intent: null }, readAt: Date.now(), gone: '', repo: null },
+    state: { name: 'Mercury', slug: 'mercury', owner: 'acme', repo: 'mercury' },
+    resolvedDomain: () => 'mercury.example.com', apexBase: () => 'example.com', addressReady: () => true, API: '/api/bongos',
     ...extra,
   };
   vm.createContext(sandbox);
-  vm.runInContext(`${SCRIPT.slice(RS, RE)}\n${SCRIPT.slice(SS, SE)}\n${SCRIPT.slice(AS, AE)}`, sandbox);
+  vm.runInContext(`${SCRIPT.slice(FS, FE)}\n${SCRIPT.slice(SS, SE)}\n${SCRIPT.slice(AS, AE)}`, sandbox);
   return sandbox;
 }
 // what the page's poll does with one answer (pollManifest's tick, minus the timer)
@@ -216,7 +216,12 @@ function seedFrom(sb, d) {
   sb.live.manifest = d.ready ? 'done' : d.status;
   sb.live.manifestFailure = d.failure || null;
 }
-const ROWS = ['renderStepOauthApp', 'renderStepAppInstall', 'renderStepFirstSignIn', 'renderStepDeviceFlow'];
+// the GitHub facts and the one sentence, as the founder reads them (vm-born values through JSON)
+function facts(sb) {
+  return JSON.parse(JSON.stringify(vm.runInContext('(function () { var n = Date.now(), h = homeFacts(live.inst, n), g = ghFacts(n); return { gh: g, said: setupSentence(h, g) }; })()', sb)));
+}
+const words = (r) => [r.title, [].concat(r.sub || []).map((p) => (typeof p === 'string' ? p : p.t)).join('')].join(' ');
+const acts = (r) => [].concat(r.act || []);
 const CHORE = /\/contact|Contact us|delete it|Developer settings → GitHub Apps\) so|Try again anyway|Start the setup again|by hand/;
 
 // every shape the status derivation can reach, as rows the real route reads
@@ -256,31 +261,37 @@ test('every state the setup can reach: the REAL status answer draws a sentence a
     assert.equal(d.ok, true, name);
     const sb = page();
     seedFrom(sb, d);
-    const html = ROWS.map((f) => vm.runInContext(`${f}()`, sb)).join('\n');
-    seen[name] = { pick: d.pick_up, html };
-    assert.doesNotMatch(html, CHORE, `${name}: no manual chore and no "contact us"`);
-    // a stopped step always carries the action that fixes it
-    for (const li of html.split('\n').filter((x) => /class="sstopped/.test(x))) {
-      assert.match(li, /data-action="(pick-up|manifest-start|ask-platform)"/, `${name}: a stopped step has its button — ${li.slice(0, 120)}`);
+    const f = facts(sb);
+    const all = f.gh.map(words).join('\n') + '\n' + f.said.map((p) => p.t).join('');
+    const allActs = f.gh.flatMap(acts);
+    seen[name] = { pick: d.pick_up, f, all, allActs };
+    assert.doesNotMatch(all, CHORE, `${name}: no manual chore and no "contact us"`);
+    // a stopped fact always carries the action that fixes it
+    for (const r of f.gh.filter((x) => x.state === 'bad')) {
+      assert.ok(acts(r).some((a) => /^(pick-up|pick-up-link|connect|ask-platform|manage)$/.test(a)), `${name}: the stopped "${r.title}" has its button`);
+    }
+    // a pick-up the server offers is on the page, once
+    if (d.pick_up === 'check' || d.pick_up === 'convert') {
+      assert.equal(allActs.filter((a) => /^pick-up/.test(a) || a === 'check-again').length, 1, `${name}: ${d.pick_up} is offered once`);
     }
-    // a pick-up the server offers is on the page
-    if (d.pick_up === 'check' || d.pick_up === 'convert') assert.match(html, /data-action="pick-up"/, `${name}: ${d.pick_up} is offered`);
-    if (d.pick_up === 'operator') assert.match(html, /data-action="ask-platform"/, `${name}: the platform team is one click away`);
-    if (d.pick_up === 'reopen') assert.match(html, /data-action="reopen-github"/, `${name}: the same link can be reopened`);
+    if (d.pick_up === 'operator') assert.ok(allActs.includes('ask-platform'), `${name}: the platform team is one click away`);
+    if (d.pick_up === 'reopen') assert.ok(allActs.includes('reopen'), `${name}: the same link can be reopened`);
     // a new link is offered ONLY where nothing was made on GitHub
-    if (/data-action="manifest-start"/.test(html)) assert.ok(d.pick_up === 'fresh', `${name}: Connect GitHub is offered only when no app exists (pick_up=${d.pick_up})`);
+    if (allActs.includes('connect')) assert.ok(d.pick_up === 'fresh', `${name}: Connect GitHub is offered only when no app exists (pick_up=${d.pick_up})`);
   }
   assert.equal(seen['waiting on GitHub'].pick, 'reopen');
   assert.equal(seen['link lapsed'].pick, 'fresh');
   assert.equal(seen['conversion stopped, code young'].pick, 'convert');
   assert.equal(seen['conversion stopped, code spent'].pick, 'operator');
   assert.equal(seen['sign-in unconfirmed, re-asking'].pick, null);
-  assert.match(seen['sign-in unconfirmed, re-asking'].html, /We’re asking it again/);
+  assert.match(seen['sign-in unconfirmed, re-asking'].all, /Asking your project again, with the app GitHub already made\./);
   assert.equal(seen['sign-in unconfirmed, window over'].pick, 'check');
-  assert.match(seen['signed in, install never confirmed, window over'].html, /GitHub stopped before the app was installed on your repo\. Nothing is lost, and no second app will be made\./, 'the mockup\'s sentence, from the real read');
-  assert.match(seen['installed, device flow off, window over'].html, /Turned it on\? Check again/);
+  const never = seen['signed in, install never confirmed, window over'];
+  assert.equal(never.f.gh[1].sub, 'GitHub stopped before the app was on acme/mercury.', 'the mockup\'s sentence, from the real read');
+  assert.equal(never.f.said.map((p) => p.t).join(''), 'One step stopped. Nothing is lost, and no second app will be made.', 'said once, in the sentence');
+  assert.ok(seen['installed, device flow off, window over'].allActs.includes('check-again'));
   assert.equal(seen['all four ticked'].pick, null);
-  assert.doesNotMatch(seen['all four ticked'].html, /sstopped|data-action="pick-up"/);
+  assert.ok(!seen['all four ticked'].f.gh.some((r) => r.state === 'bad') && !seen['all four ticked'].allActs.some((a) => /^pick-up/.test(a)));
   t.diagnostic(Object.entries(seen).map(([k, v]) => `${k}: ${v.pick}`).join(' · '));
 });
 
@@ -289,13 +300,13 @@ test('every state the setup can reach: the REAL status answer draws a sentence a
 function actions({ pickUp, answer, manifestState = null, blockerStatus = 201 }) {
   const calls = { fetched: [], polled: [], progress: [], started: 0, renders: 0 };
   const sb = page({
-    API: '/api/bongos', instanceId: 42, manifestState, pollTimer: null, lastStepsHtml: 'x', manifestStartedAt: 1700000000000, ghTab: null,
+    instanceId: 42, manifestState, pollTimer: null, manifestStartedAt: 1700000000000, ghTab: null,
     fetch: async (url, init) => {
       calls.fetched.push({ url, init });
       if (/\/blockers$/.test(url)) return { ok: blockerStatus < 300, status: blockerStatus, json: async () => ({}) };
       return { ok: true, status: 200, json: async () => answer };
     },
-    rememberManifest: () => {}, renderSteps: () => { calls.renders++; },
+    rememberManifest: () => {}, repaintFacts: () => { calls.renders++; }, paintFacts: () => { calls.renders++; },
     pollManifest: (s) => calls.polled.push(s), startProgress: (id) => calls.progress.push(id),
     startManifest: () => { calls.started++; },
   });

package/tests/github_push_merge_driver.mjs

@@ -12,6 +12,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const gh = require('../modules/lifecycle/github-push.js');
@@ -169,6 +170,51 @@ test('mergeBlockReason maps the common blocker states', () => {
   assert.equal(gh.mergeBlockReason({ ...open, merged: true }), null);
 });
 
+// --- task 1004666: a check still running is waiting, not red --------------
+//
+// check-rollup maps a status context's state into `conclusion`, so PENDING and
+// EXPECTED (posted but unfinished, or required but not yet reported) reached
+// mergeBlockReason as conclusions. It counted anything outside SUCCESS/NEUTRAL/
+// SKIPPED as failing, so a BLOCKED PR waiting on a third-party status read
+// "failing_check:<context>" and the reconciler tried a regen-heal on it.
+
+const ctx = (context, state) => ({ __typename: 'StatusContext', context, state, description: null });
+
+test('1004666 a PENDING or EXPECTED status context on a BLOCKED PR reads as waiting', async () => {
+  for (const state of ['PENDING', 'EXPECTED']) {
+    const { fetchImpl } = mkFetch({ node: prNode({ mergeStateStatus: 'BLOCKED', rollup: 'PENDING', checks: [TRUST, ctx('ci/external', state)] }) });
+    const r = await gh.mergeIfGreen({ branch: 'claude/wt' }, DEPS(fetchImpl));
+    assert.equal(r.reason, 'blocked_required_review_or_pending_check', `${state} is not a failure`);
+  }
+});
+
+test('1004666 on an UNSTABLE PR a pending optional check is pending, not failing', () => {
+  const open = { pr_state: 'open', merged: false };
+  assert.equal(gh.mergeBlockReason({ ...open, merge_state: 'UNSTABLE', checks: [{ name: 'e2e', conclusion: 'PENDING' }] }), 'non_required_check_pending');
+  assert.equal(gh.mergeBlockReason({ ...open, merge_state: 'UNSTABLE', checks: [{ name: 'e2e', conclusion: 'TIMED_OUT' }] }), 'non_required_check_failing:e2e');
+});
+
+test('1004666 every red conclusion still names its check, past a pending one', () => {
+  for (const state of ['FAILURE', 'ERROR', 'TIMED_OUT', 'CANCELLED', 'ACTION_REQUIRED', 'STARTUP_FAILURE']) {
+    const open = { pr_state: 'open', merged: false, merge_state: 'BLOCKED' };
+    assert.equal(gh.mergeBlockReason({ ...open, checks: [{ name: 'ci/external', conclusion: 'PENDING' }, { name: 'unit', conclusion: state }] }), 'failing_check:unit', state);
+  }
+});
+
+test('1004666 the server and the laptop read red from ONE set', () => {
+  const rollup = require('../modules/lifecycle/check-rollup.js');
+  const land = fs.readFileSync(new URL('../scripts/gds/ship-land.js', import.meta.url), 'utf8');
+  const push = fs.readFileSync(new URL('../modules/lifecycle/github-push.js', import.meta.url), 'utf8');
+  assert.ok(land.includes("RED_CONCLUSIONS } = require('../../modules/lifecycle/check-rollup.js')"), 'ship-land imports the shared set');
+  assert.doesNotMatch(land, /const RED_CONCLUSIONS\s*=/, 'and no longer declares its own');
+  assert.doesNotMatch(push, /_BAD_CHECK|'SUCCESS', 'NEUTRAL', 'SKIPPED'/, 'the old allow-list reading is gone');
+  for (const c of ['PENDING', 'EXPECTED', 'SUCCESS', 'NEUTRAL', 'SKIPPED', 'STALE', null, undefined]) {
+    assert.equal(rollup.isRedCheck({ conclusion: c }), false, String(c));
+  }
+  assert.equal(rollup.isRedCheck({ conclusion: 'failure' }), true, 'case-insensitive like the old reader');
+  assert.equal(rollup.isRedCheck(null), false);
+});
+
 // --- task 1003988: a red PR names what failed, or says it cannot see -------
 //
 // Without Checks:read GitHub nulls every CheckRun node and keeps the rollup state,

package/tests/onboard.mjs

@@ -193,11 +193,12 @@ test('every render surface carries the terminal hall step (task 1002703)', () =>
   const cli = read('scripts/gds/onboard.js');
   assert.match(cli, /builders hall/i, 'the CLI walkthrough ends at the hall');
   assert.match(cli, /bongos dev/, 'the CLI offers the local-hall one-liner when no domain');
+  // the one page (task 1004683): the hall is entered through the Enter Genesis door, the
+  // hall's founding mode, once every required fact of part 03 is done
   const hubHtml = read('modules/public-landing/public/projects.html');
-  const enterHall = hubHtml.match(/data-onboard-step="enter-hall"[^]*?<\/li>/g) || [];
-  assert.ok(enterHall.length >= 1, 'the ?view=new wizard tags the enter-hall step');
-  assert.match(enterHall.join(''), /\/builders/, 'the wizard points at the hall address');
-  assert.match(enterHall.join(''), /bongos dev/, 'the wizard offers the local hall when no domain');
+  assert.match(hubHtml, /<a class="btn" id="enterGenesis" data-onboard-step="enter-hall" target="_blank" rel="noopener">Enter Genesis<\/a>/,
+    'the ?view=new wizard tags the enter-hall step on its Enter Genesis door');
+  assert.match(hubHtml, /\$\('enterGenesis'\)\.setAttribute\('href', 'https:\/\/' \+ inst\.domain\);/, 'which opens the project\'s own address');
 });
 
 test('the wizard done panel is plan-driven, manifest-driven, and owner-honest (task 1002694)', () => {
@@ -206,8 +207,10 @@ test('the wizard done panel is plan-driven, manifest-driven, and owner-honest (t
   const { readFileSync } = require('node:fs');
   const path = require('node:path');
   const src = readFileSync(path.join(import.meta.dirname, '..', 'modules/public-landing/public/projects.html'), 'utf8');
-  // gap 2 (idea 1000675): the checklist renders FROM the canonical plan endpoint
-  assert.match(src, /provisioning\/onboard-plan/, 'the done panel fetches the canonical plan');
+  // gap 2 (idea 1000675): the checklist follows the canonical plan. Since task 1004683 part
+  // 03 is a fixed list of facts the server checks, each GitHub fact named by the plan step
+  // it is (FACT_PLAN_STEP); the drift guard below holds that set equal to the plan's.
+  assert.match(src, /var FACT_PLAN_STEP = \{ approve: 'oauth-app', install: 'app-install', sign_in: 'first-sign-in', device_flow: 'device-flow' \};/, 'the facts name their plan steps');
   // gap 3 (idea 1000676): the ADR 0133 one-click manifest flow has a UI caller again
   assert.match(src, /\/github-app/, 'the done panel drives the GitHub-App manifest flow');
   assert.match(src, /github-app\/status/, 'and polls its progress to reflect live state');
@@ -305,7 +308,10 @@ test('the web form (?view=new) declares EXACTLY the canonical human steps — dr
     // keys are kebab-case literals; the charset excludes the page's DYNAMIC fallback
     // tag (data-onboard-step="' + esc(s.key) + '"), which renders unknown plan steps
     // at runtime and has no literal key to pin here (task 1002694).
-    const found = [...src.matchAll(/data-onboard-step="([a-z0-9-]+)"/g)].map((m) => m[1]);
+    // …plus the plan step each of part 03's facts is (task 1004683), set from one map
+    const facts = (src.match(/var FACT_PLAN_STEP = \{([^}]*)\};/) || [, ''])[1];
+    const found = [...src.matchAll(/data-onboard-step="([a-z0-9-]+)"/g)].map((m) => m[1])
+      .concat([...facts.matchAll(/: '([a-z0-9-]+)'/g)].map((m) => m[1]));
     const uniq = [...new Set(found)].sort();
     assert.deepEqual(uniq, humanKeys, `${name} (${rel}) must tag exactly the canonical human steps [${humanKeys}], found [${uniq}]`);
   }

package/tests/project_invite_ui.mjs

@@ -523,7 +523,9 @@ function bootGate({ me = { github_login: 'kestrel' }, created = { id: 7, slug: '
 test('the wizard opens the invite step only once the hall is up, and only for a signed-in owner of a project that exists (tasks 1002346, 1004503)', () => {
   assert.ok(gateSlice().includes('function paintInviteGate(live)'), 'the gate slice is found');
   assert.match(SCRIPT, /function renderDone\(\) \{[\s\S]*?paintInviteGate\(false\);/, 'the done panel paints the gate shut');
-  assert.match(SCRIPT, /if \(inst\.last_verified_up\) \{[\s\S]{0,400}paintInviteGate\(true\);/, 'and opens it only on the verified Live');
+  // since task 1004683: "is alive" — and with it the invite — opens once every required fact
+  // of part 03 is done, which includes the hall answering (last_verified_up)
+  assert.match(SCRIPT, /var on = !!\(ready && inst && hostOk\(inst\.domain\) && addressReady\(inst\) && inst\.last_verified_up === true\);[\s\S]{0,900}paintInviteGate\(on\);/, 'and opens it only on the verified Live');
   assert.equal((SCRIPT.match(/setInviteSlug\('wizInvite'/g) || []).length, 2, 'the gate is the only caller: shut, or open on Live');
 
   const before = bootGate();
@@ -577,8 +579,9 @@ test('the wizard’s invite step ships as real markup in part 03, with the alive
   assert.match(panel, /data-invite-send="wizInvite"/, 'the sender');
   assert.match(panel, /data-invite-skip="wizInvite"/, 'and the skip is a CONTROL, not "leave it and move on"');
   assert.match(panel, /Optional/, 'the panel says so before it asks');
-  assert.ok(panel.indexOf('id="humanSteps"') < panel.indexOf('id="done-h"') && panel.indexOf('id="done-h"') < panel.indexOf('id="wizInvite"'),
-    'the mockup\'s order: the checklist, then "is alive", then the invite (task 1004648)');
+  assert.ok(panel.indexOf('id="ghFacts"') > 0 && panel.indexOf('id="ghFacts"') < panel.indexOf('id="done-h"') && panel.indexOf('id="done-h"') < panel.indexOf('id="wizInvite"') &&
+    panel.indexOf('id="wizInvite"') < panel.indexOf('id="enterGenesis"'),
+    'the mockup\'s order: the facts, then "is alive", then the invite, then the Enter Genesis door (tasks 1004648, 1004683)');
   assert.match(panel, /Invite your first builders\. They become founding builders\./, 'in the mockup\'s words');
   assert.match(panel, /<p class="samePath" id="wizInviteLater"><\/p>/, 'and the way back afterwards is a slot beside the modules one');
   assert.match(SCRIPT, /\$\('wizInviteLater'\)\.innerHTML = 'You can invite builders any time from ' \+ projectPageLink\('the project’s own page'\) \+ '\.';/,

package/tests/project_modules_ui.mjs

@@ -299,10 +299,10 @@ test('the catalog is read ONCE however often the section repaints', async () =>
 
 test('the wizard’s done panel points at the project’s settings for its extras', () => {
   assert.match(HUB, /<p class="samePath" id="doneModules"><\/p>/, 'the panel carries the slot');
-  assert.match(SCRIPT, /\$\('doneModules'\)\.innerHTML = 'Add or remove modules later in ' \+ projectPageLink\('the project’s settings'\) \+ '\.';/,
-    'and renderDone fills it with one sentence pointing at the manage page');
+  assert.match(SCRIPT, /var mods = \$\('doneModules'\);\n\s*mods\.textContent = '';\n\s*partsInto\(mods, \['Add or remove modules later in ', \{ t: 'the project’s settings', href: manageHref\(\) \}, '\.'\]\);/,
+    'and renderDone fills it with one sentence pointing at the manage page, drawn from nodes (task 1004683)');
   assert.equal((SCRIPT.match(/doneModules/g) || []).length, 1, 'one line, written in one place');
-  assert.match(SCRIPT, /function projectPageLink\(label\) \{\s*return '<a href="' \+ \(instanceId \? '\?view=manage&id=' \+ encodeURIComponent\(instanceId\)/,
+  assert.match(SCRIPT, /function manageHref\(\) \{\s*return instanceId \? '\?view=manage&id=' \+ encodeURIComponent\(instanceId\)/,
     'and the link names the instance just created, not the list');
 });
 

package/tests/projects_hub.mjs

@@ -2190,7 +2190,7 @@ test('the wizard folds at one width: no rail fold is left, and no 900px rule is
   assert.match(STYLE, /@media \(max-width:560px\)\{\s*\.setRow\{grid-template-columns:minmax\(0,1fr\) auto;grid-template-areas:"k acts" "v v";/, 'part 02\'s rows stack under 560, Change beside the label');
 });
 
-test('the wizard\'s own structures wear the world: hairline fields, cells of one band, the review as a ledger, the human steps as a numbered ledger, the standup strip as the rail (task 1003346)', () => {
+test('the wizard\'s own structures wear the world: hairline fields, cells of one band, part 02\'s rows, part 03\'s checked facts (tasks 1003346, 1004683)', () => {
   const at = STYLE.indexOf('the create wizard (task 1002763');
   assert.ok(at > -1, 'the wizard block is still the page\'s own');
   const block = STYLE.slice(at);
@@ -2204,13 +2204,12 @@ test('the wizard\'s own structures wear the world: hairline fields, cells of one
   assert.match(block, /\.setRows\{margin:14px 0 0;border-top:1px solid var\(--rule\);\}/, 'part 02\'s rows hang from one hairline');
   assert.match(block, /\.setRow\{display:grid;grid-template-columns:108px minmax\(0,1fr\) auto;[^}]*border-bottom:1px solid var\(--rule\);\}/, 'each row is label · value · Change on its own hairline');
   assert.doesNotMatch(block, /\.review( li)?\{/, 'the ledger\'s rules are gone with renderReview');
-  assert.match(block, /\.humanSteps>li\{\s*display:grid;grid-template-columns:44px 1fr;/, 'the human steps keep the ledger grid');
-  assert.match(block, /#panel-done \.humanSteps>li\{grid-template-columns:24px 1fr;/, 'which part 03 draws as the mockup\'s checklist: a dot, then the step');
-  assert.match(block, /\.humanSteps>li>\*\{grid-column:2;/, 'every child of a step sits in the text column, never under the counter (the sheet\'s bug)');
-  assert.match(block, /#panel-done \.humanSteps>li\.sdone::before\{content:"✓";/, 'a verified step wears the tick in the ok ink');
-  assert.match(block, /\.prog\{background:none;border:0;border-radius:0;padding:0;/, 'the standup strip is drawn as the rail');
-  assert.match(block, /\.prog \.stages li\.now \.sdot::after\{content:none;animation:none;\}/, 'no pulse on the rail');
-  assert.match(block, /\.doneHead \.tick\{display:none;\}/, 'the tick leaves; the rail says filed');
+  // task 1004683 (docs/design/mocks/day-night-rooms/setup-status.html): part 03 is one list
+  // of facts on hairlines — a dot, the fact, when it was checked — and no stage strip at all
+  assert.match(block, /\.setFact\{display:grid;grid-template-columns:24px minmax\(0,1fr\) auto;[^}]*border-top:1px solid var\(--rule\);\}/, 'each fact is dot · fact · when, on its own hairline');
+  assert.match(block, /\.setFact\.done \.d\{background:color-mix\(in srgb,var\(--ok\) 12%,transparent\);color:var\(--ok\);border-color:var\(--ok\);\}/, 'a verified fact wears the tick in the ok ink');
+  assert.match(block, /\.setFact\.bad \.d\{[^}]*color:var\(--err\);/, 'a stopped fact wears the error ink');
+  assert.doesNotMatch(block, /\.prog\b|\.humanSteps|\.doneHead|\.stepsHead|\.ghbtn/, 'the standup strip, the old checklist and their sheet are gone');
   assert.match(block, /\.addrBig code\{display:block;font-family:var\(--font-display\);/, 'the address stands in the display voice');
   assert.doesNotMatch(block, /linear-gradient/, 'no tinted plates');
   // the one exception is drawn, not chrome: the night room's moon glows in the window
@@ -2221,7 +2220,7 @@ test('the wizard\'s own structures wear the world: hairline fields, cells of one
   assert.doesNotMatch(HUB, /data-back="|id="wizBack"/, 'no back door is left');
   assert.match(HUB, /<div class="wizTop">\s*<span class="wizEyebrow" id="wizEyebrow">New project<\/span>\s*<\/div>/, 'the eyebrow alone in the top row');
   assert.match(HUB, /<div class="createBar">\s*<button type="button" class="btn big" id="doCreate">Create my project<\/button>\s*<span class="wizRecap" id="wizRecap"><\/span>/, 'Create, with the one-line recap beside it');
-  assert.match(HUB, /<h2 id="done-part-h"><span class="n">03<\/span>Connect GitHub <span class="state" id="ghState">opens once your project exists<\/span><\/h2>/, 'part 03 names itself and where it is');
+  assert.match(HUB, /<h2 id="done-part-h"><span class="n">03<\/span><span id="donePartT">Connect GitHub<\/span> <span class="state" id="ghState">opens once your project exists<\/span><\/h2>/, 'part 03 names itself and where it is');
   // what is enqueued is unchanged (ADR 0111): the filing body the control plane reads
   assert.match(SCRIPT, /body: JSON\.stringify\(\{\s*slug: state\.slug,/, 'the filing still carries the slug first');
   assert.match(SCRIPT, /hosting_shape: 'cloud-host',/, 'the shape is unchanged');