@bongos/core 1.21.44 → 1.21.46

package/modules/hall-ui/public/thinking.html

@@ -138,9 +138,9 @@
   </div>
 </div>
 
-<script src="/builders/shell-trail.js?v=2026-10-04-nolegacy"></script>
-<script src="/builders/craft-mode.js?v=2026-10-04-nolegacy"></script>
-<script src="/builders/shell.js?v=2026-10-04-nolegacy"></script>
+<script src="/builders/shell-trail.js?v=2026-10-04-paintbrush"></script>
+<script src="/builders/craft-mode.js?v=2026-10-04-paintbrush"></script>
+<script src="/builders/shell.js?v=2026-10-04-paintbrush"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/tweak-editor.html

@@ -142,9 +142,9 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell-trail.js?v=2026-10-04-nolegacy"></script>
-<script src="/builders/craft-mode.js?v=2026-10-04-nolegacy"></script>
-<script src="/builders/shell.js?v=2026-10-04-nolegacy"></script>
+<script src="/builders/shell-trail.js?v=2026-10-04-paintbrush"></script>
+<script src="/builders/craft-mode.js?v=2026-10-04-paintbrush"></script>
+<script src="/builders/shell.js?v=2026-10-04-paintbrush"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/brand-holes.js?v=2026-09-29-aqfix"></script>

package/modules/hall-ui/public/watch.html

@@ -162,9 +162,9 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell-trail.js?v=2026-10-04-nolegacy"></script>
-<script src="/builders/craft-mode.js?v=2026-10-04-nolegacy"></script>
-<script src="/builders/shell.js?v=2026-10-04-nolegacy"></script>
+<script src="/builders/shell-trail.js?v=2026-10-04-paintbrush"></script>
+<script src="/builders/craft-mode.js?v=2026-10-04-paintbrush"></script>
+<script src="/builders/shell.js?v=2026-10-04-paintbrush"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -171,9 +171,9 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell-trail.js?v=2026-10-04-nolegacy"></script>
-<script src="/builders/craft-mode.js?v=2026-10-04-nolegacy"></script>
-<script src="/builders/shell.js?v=2026-10-04-nolegacy"></script>
+<script src="/builders/shell-trail.js?v=2026-10-04-paintbrush"></script>
+<script src="/builders/craft-mode.js?v=2026-10-04-paintbrush"></script>
+<script src="/builders/shell.js?v=2026-10-04-paintbrush"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/modules/hall-ui/records/craft-mode.md

@@ -35,3 +35,12 @@ Covers: every shelled hall page (`craft-mode.js`, `shell.js`, `style.css`), and
 - **Two pieces are drawn by `craft-mode.js` `applyLook()`, on every mode change:** the eyebrow beside `#topbar-title` (`LOOKS`: "the studio · night", "the sky", "the city"; hidden at <=640px, where it overflowed phones) and the scene plate under `.app-sidebar__brand` (40px closed rail, 64px open). The plate's markup IS `artHtml(mode)`, the picker's door art, exported rather than copied; light mode recolours it to each scene's day (the city is the dark one through `invert(1) hue-rotate(180deg)`). It does not animate.
 - **Always-present tabs widened** (owner, 2026-10-03): `ALWAYS_TABS` is Builders, Collab and Profile, so every mode keeps the You and Community groups.
 - **Governing's header tallies** ("needs you · moving") are task 1004563, not this look.
+
+## The paintbrush (task 1004497)
+
+- **Artistry carries two tools**: the palette (a feedback doc, `page-notes.js`, record `page-notes.md`) and the paintbrush (`paintbrush.js`). Both are `TOOLS` entries in `craft-mode.js` and load their own script on first press.
+- **The paintbrush edits the page's own words where they stand, as a REAL wording change** (owner, 2026-10-04): it is the copy desk's page round, the same one the tweak editor and the studio's own words write (ADR 0341). Pressing it reads `GET /copy-desk/pages/builders:<page>/draft`; a page nobody holds is OFFERED, never taken silently (taking it is the copy desk's artists-only claim, and the page shows as being tweaked while held). Typing saves the whole draft; "Review" lists every change as was/now; "Send for approval" submits the round. It never writes `page-notes` (owner: kept separate from the feedback docs).
+- **Only a leaf element inside `<main>` whose words are one reading line becomes editable.** Shared chrome, a line with a `{…}` hole, controls (`button`, form fields, `code`), and anything hidden stay as they are; the bar counts the lines it cannot reach and links to the tweak editor for them. A click on edited words inside a link does not navigate.
+- **Nobody else's view changes, and neither does yours once editing ends**: "Stop editing" and "Send" both put the page's own words back. The draft stays on the round.
+- **The top bar fits two tools at 390px** because, at phone width, the side packs to a 4px gap, a tool is 28px, the side and the menu do not shrink, and a long page title trims with an ellipsis instead. All 34 hall pages measure 0px of sideways scroll in Artistry at 390px.
+- `tests/paintbrush.mjs` runs the real script and both shared libs over a small page.

package/modules/provisioning/manifest-truth.js

@@ -0,0 +1,63 @@
+'use strict';
+
+// modules/provisioning/manifest-truth.js — what the wizard is told about the GitHub
+// sign-in leg (the GitHub-App-Manifest handshake, ADR 0133), at every stage.
+//
+// WHY (task 1004572, live on 2026-10-04). A founder setting up a project saw
+// "Waiting for your approval on GitHub…" while the platform was already placing
+// credentials, then "GitHub setup didn't start. Nothing was changed on GitHub" after
+// GitHub HAD created an app on their account, and — once a setup link lapsed — no
+// button at all, forever, because nothing ever flips a lapsed 'pending' row.
+// These helpers make the read surface say what is actually true. PURE: no DB, no
+// network; split out because provisioning.js sits at the 1500-line ratchet.
+
+// The status a manifest row MEANS right now. Only 'pending' decays: past expires_at
+// the callback refuses its code (attachManifestCode's TTL guard in SQL), so a lapsed
+// 'pending' row is expired in every sense but the column.
+function effectiveManifestStatus(row, now = Date.now()) {
+  const status = String((row && row.status) || '');
+  if (status === 'pending' && row.expires_at && new Date(row.expires_at).getTime() <= now) return 'expired';
+  return status;
+}
+
+// How far a FAILED attempt got, as a closed vocabulary the wizard turns into a
+// sentence. The raw last_error never leaves the server (the status route is public
+// by state token). Read from the row's shape, never from error-message text:
+//   'not_approved'        — the runner never picked it up (attempts 0): nothing we
+//                           know of happened on GitHub's side.
+//   'sign_in_unconfirmed' — GitHub handed over the credentials (the App's slug is
+//                           recorded) and they were placed, but the project never
+//                           confirmed sign-in works. An App exists on the founder's
+//                           account, so "try again" makes a second one.
+//   'finish_failed'       — GitHub approved, but turning that into credentials on
+//                           the project failed before the App was recorded.
+const MANIFEST_FAILURES = Object.freeze(['not_approved', 'sign_in_unconfirmed', 'finish_failed']);
+
+function manifestFailure(row) {
+  if (!row || !(Number(row.attempts) > 0)) return 'not_approved';
+  if (row.app_slug) return 'sign_in_unconfirmed';
+  return 'finish_failed';
+}
+
+// The GitHub-App manifest leg's truth for an instance, as the instance read carries
+// it (task 1003235): the latest attempt's lifecycle status + the App's public slug,
+// in the same vocabulary as GET /github-app/status ('pending' | 'code_received' |
+// 'converting' | 'done' | 'error' | 'expired'), so the wizard can seed `live.manifest`
+// after a reload, a second tab, or another device. null = no attempt ever made.
+//   status     — the EFFECTIVE status (above).
+//   failure    — on 'error' only, how far it got (above); null otherwise.
+//   started_at — when the setup link was minted, so a reloaded page can still offer
+//                "start again" once the wait has clearly gone wrong.
+// An allow-list projection of the row, never the row itself (it holds GitHub's code).
+function publicGithubApp(manifestRow, now = Date.now()) {
+  if (!manifestRow || !manifestRow.status) return null;
+  const status = effectiveManifestStatus(manifestRow, now);
+  return {
+    status,
+    app_slug: manifestRow.app_slug || null,
+    failure: status === 'error' ? manifestFailure(manifestRow) : null,
+    started_at: manifestRow.created_at ? new Date(manifestRow.created_at).toISOString() : null,
+  };
+}
+
+module.exports = { effectiveManifestStatus, manifestFailure, publicGithubApp, MANIFEST_FAILURES };

package/modules/provisioning/provisioning.js

@@ -477,17 +477,9 @@ function publicInstance(row) {
   };
 }
 
-// The GitHub-App manifest leg's truth for an instance, as the read surface carries
-// it (task 1003235): the latest attempt's lifecycle status + the App's public slug.
-// Same vocabulary as GET /github-app/status ('pending' | 'code_received' |
-// 'converting' | 'done' | 'error' | 'expired'), so the wizard can seed its
-// `live.manifest` from a plain instance read after a reload, a second tab, or
-// another device — no sessionStorage bridge needed. null = no attempt ever made.
-// PURE: an allow-list projection of the manifest row, never the row itself.
-function publicGithubApp(manifestRow) {
-  if (!manifestRow || !manifestRow.status) return null;
-  return { status: String(manifestRow.status), app_slug: manifestRow.app_slug || null };
-}
+// The GitHub-App manifest leg's truth as the read surface carries it (task 1003235;
+// task 1004572 made it tell the truth at every stage) — moved to manifest-truth.js.
+const { publicGithubApp } = require('./manifest-truth');
 
 // The env variables that carry this instance's settings, as the instance reads
 // them: { <PREFIX>_PLATFORM_VISIBILITY, <PREFIX>_JOINABILITY } (task 1003139 /

package/modules/provisioning/routes/provisioning.js

@@ -1405,10 +1405,12 @@ module.exports = function provisioningRoutes() {
       const row = await provisioning.getOAuthManifestByState(pool, state);
       if (!row) return res.status(404).json({ ok: false, error: 'unknown_state' });
       const inst = await provisioning.getInstanceById(pool, row.instance_id).catch(() => null);
-      const status = row.status;
+      // EFFECTIVE status + how far a failure got (task 1004572, manifest-truth.js)
+      const { status, failure } = provisioning.publicGithubApp(row);
       return res.json({
         ok: true,
         status,
+        failure,
         ready: status === 'done',
         terminal: status === 'done' || status === 'error' || status === 'expired',
         domain: inst && inst.domain ? inst.domain : null,

package/modules/public-landing/public/projects.html

@@ -6533,7 +6533,7 @@ summary{min-height:24px;padding:3px 0;}
       return '<a href="' + (instanceId ? '?view=manage&id=' + encodeURIComponent(instanceId) : '?view=mine') +
         '">' + label + '</a>';
     }
-    var live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
+    var live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null };
     var planPromises = {};             /* mode|domain → Promise<steps[]> */
     var lastStepsHtml = '';
     var lastProgHtml = '';            /* same change-only contract, for the progress strip */
@@ -6654,14 +6654,24 @@ summary{min-height:24px;padding:3px 0;}
            details (task 1003244). The one refusal a founder can act on — no
            address yet — says where to go instead of what the server said. */
         var snag, raw = '';
+        /* a failure AFTER GitHub's approval left an app on the founder's account,
+           so "nothing was changed" would be false — the server says how far it got
+           (live.manifestFailure, task 1004572) and the words follow it */
         if (live.manifest === 'expired') snag = 'That setup link expired (they last 30 minutes) — mint a fresh one.';
         else if (live.manifestCode === 'domain_required') snag = 'This project needs an address first — attach one from ' + projectPageLink('its own page') + ', then come back to this step.';
+        else if (live.manifestFailure === 'sign_in_unconfirmed') {
+          var appLink = live.appSlug ? '<a href="https://github.com/settings/apps/' + esc(live.appSlug) + '" target="_blank" rel="noopener">your app on GitHub</a>' : 'the app on your GitHub account';
+          return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>GitHub approved the app and the platform placed its credentials on your project, but your project didn’t confirm that sign-in works. Trying again would make a second app on your GitHub account and is unlikely to fix this — it needs a look from the platform team. <a href="/contact">Contact us</a> and mention ' + appLink + '.</p>' +
+            progressMarkup(1, 1, 'Stopped: your project didn’t confirm sign-in.', 'isErr', 'signin') +
+            '<button type="button" class="linklike" data-action="manifest-start">Try again anyway</button></li>';
+        }
+        else if (live.manifestFailure === 'finish_failed') snag = 'GitHub approved the app, but the platform couldn’t finish setting up sign-in on your project. The app GitHub made is still on your account — delete it first (GitHub → Settings → Developer settings → GitHub Apps) so you don’t end up with two, then try again.';
         else { snag = 'GitHub setup didn’t start. Nothing was changed on GitHub — try again.'; raw = live.manifestMsg; }
         return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>' + snag + '</p>' +
           (raw ? '<details><summary>Technical details</summary><p>' + esc(raw) + '</p></details>' : '') +
           '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
       }
-      if (live.manifest === 'code_received') {
+      if (live.manifest === 'code_received' || live.manifest === 'converting') {
         /* GitHub's half is done — say so, rather than keep telling the founder
            to approve an app they just approved */
         autoOpenArmed = true;
@@ -6670,7 +6680,7 @@ summary{min-height:24px;padding:3px 0;}
       }
       if (live.manifest) {   /* pending — GitHub holds the manifest, nobody has approved it yet */
         autoOpenArmed = true;
-        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Waiting on GitHub — approve the app in the tab that opened. Once approved, the platform places the credentials and verifies sign-in on its own; this step ticks itself.</p>' +
+        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Waiting on GitHub — approve the app in the tab that opened. No GitHub tab? It may have opened behind this window or in another one. Once approved, the platform places the credentials and verifies sign-in on its own; this step ticks itself.</p>' +
           progressMarkup(0, 0, 'Waiting for your approval on GitHub…', '', 'signin') + autoOpenTick() +
           (manifestStale ? '<button type="button" class="linklike" data-action="manifest-start">Didn’t get to GitHub? Start the setup again</button>' : '') + '</li>';
       }
@@ -6889,7 +6899,7 @@ summary{min-height:24px;padding:3px 0;}
         inp.type = 'hidden'; inp.name = 'manifest'; inp.value = JSON.stringify(d.manifest);
         form.appendChild(inp); document.body.appendChild(form);
         form.submit(); form.remove();
-        live.manifest = 'pending'; live.manifestMsg = '';
+        live.manifest = 'pending'; live.manifestMsg = ''; live.manifestFailure = null;
         manifestStartedAt = Date.now(); manifestStale = false;
         rememberManifest(d.state, 'pending');
         renderSteps();
@@ -6897,12 +6907,21 @@ summary{min-height:24px;padding:3px 0;}
       }).catch(function (err) {
         if (String(err && err.message) === 'signing in') return;
         if (tab) { try { tab.close(); } catch (e) {} }
-        live.manifest = 'error'; live.manifestMsg = String((err && err.message) || 'could not start');
+        live.manifest = 'error'; live.manifestFailure = null; live.manifestMsg = String((err && err.message) || 'could not start');
         live.manifestCode = String((err && err.code) || '');
         renderSteps();
       });
     }
 
+    /* the "start again" offer once a wait has clearly gone wrong — measured from
+       when the link was MINTED (the server's started_at after a reload), so a
+       reloaded page offers it too instead of never (task 1004572) */
+    function manifestInFlight() {
+      return live.manifest === 'pending' || live.manifest === 'code_received' || live.manifest === 'converting';
+    }
+    function noteManifestWait() {
+      if (live.manifest === 'pending' && !manifestStale && manifestStartedAt && (Date.now() - manifestStartedAt) > 90000) { manifestStale = true; renderSteps(); }
+    }
     function pollManifest(stateToken) {
       stopManifestPoll();
       manifestState = stateToken;
@@ -6916,8 +6935,9 @@ summary{min-height:24px;padding:3px 0;}
             if (myGen !== manifestGen) return;
             if (d.app_slug && d.app_slug !== live.appSlug) { live.appSlug = d.app_slug; rememberManifest(undefined, undefined, d.app_slug); renderSteps(); }
             var next = d.ready ? 'done' : (d.status || 'pending');
-            if (next !== live.manifest) { live.manifest = next; rememberManifest(undefined, next); renderSteps(); }
-            else if (next === 'pending' && !manifestStale && manifestStartedAt && (Date.now() - manifestStartedAt) > 90000) { manifestStale = true; renderSteps(); }
+            var failure = d.failure || null;
+            if (next !== live.manifest || failure !== live.manifestFailure) { live.manifest = next; live.manifestFailure = failure; rememberManifest(undefined, next); renderSteps(); }
+            else noteManifestWait();
             if (!d.terminal) manifestPollTimer = setTimeout(tick, 4000);
             else manifestPollTimer = null;   /* a stale fired id would read as "still polling" and resume a finished poll */
           })
@@ -7119,10 +7139,15 @@ summary{min-height:24px;padding:3px 0;}
             var ga = data.github_app;
             if (ga && ga.status && !manifestPollTimer) {
               var seeded = ga.status === 'done' ? 'done' : ga.status;
-              var seedChanged = seeded !== live.manifest || (!!ga.app_slug && ga.app_slug !== live.appSlug);
+              var seedFailure = ga.failure || null;
+              var seedChanged = seeded !== live.manifest || seedFailure !== live.manifestFailure || (!!ga.app_slug && ga.app_slug !== live.appSlug);
               if (ga.app_slug) live.appSlug = ga.app_slug;
-              live.manifest = seeded;
+              live.manifest = seeded; live.manifestFailure = seedFailure;
+              /* the wait is timed from when the link was MINTED, so a reload still
+                 reaches the "start again" offer (task 1004572) */
+              if (!manifestStartedAt && ga.started_at) manifestStartedAt = Date.parse(ga.started_at) || 0;
               if (seedChanged) { rememberManifest(undefined, live.manifest, live.appSlug || undefined); renderSteps(); }
+              else noteManifestWait();
             }
             /* the checklist reflects live state (task 1002694): a status transition —
                e.g. the scaffold landing — re-renders the steps (change-only, so the
@@ -7131,7 +7156,9 @@ summary{min-height:24px;padding:3px 0;}
               live.instStatus = inst.status; live.addrReady = addressReady(inst); renderSteps();
             }
             var terminal = renderProgress(inst);
-            if (!terminal) pollTimer = setTimeout(tick, 5000);
+            /* a GitHub leg still in flight keeps this read alive even once the
+               project is up — after a reload it is the ONLY thing watching it */
+            if (!terminal || manifestInFlight()) pollTimer = setTimeout(tick, 5000);
             else stopPolling();
           })
           .catch(function (err) {
@@ -7160,7 +7187,7 @@ summary{min-height:24px;padding:3px 0;}
       instanceId = null;
       watchPending = false; manifestPending = false; manifestState = null;
       manifestStartedAt = 0; manifestStale = false;
-      live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
+      live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null };
       lastStepsHtml = '';
       lastProgHtml = '';
       try { sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.44",
+  "version": "1.21.46",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.44",
+      "version": "1.21.46",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.44",
+  "version": "1.21.46",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9028,5 +9028,17 @@
       "id": "1004569",
       "text": "The street's pins no longer pile up or talk over each other. Each building now has one pin, and its colour and size show how much it matters: largest and pulsing orange when something needs you within a day, orange when it nee"
     }
+  ],
+  "1.21.45": [
+    {
+      "id": "1004497",
+      "text": "Artists can now edit any hall page's words right where they stand. In Artistry mode, \"Edit words\" offers to take the page; the words get an underline and can be typed over, a review lists each change as was/now, and \"Send for"
+    }
+  ],
+  "1.21.46": [
+    {
+      "id": "1004572",
+      "text": "Setting up GitHub sign-in for a new project now says what is really happening at each step, and always leaves a way forward if it gets stuck."
+    }
   ]
 }

package/scripts/gds/provision.js

@@ -1095,7 +1095,9 @@ async function placeManifestCreds(inst, mrow, deps) {
       await sleep(MANIFEST_VERIFY_INTERVAL_MS);
     }
     if (!authConfigured) {
-      return { ok: false, codeSpent: true, error: 'the credentials are placed, but the project did not report sign-in ready in time' };
+      // The App now EXISTS on the owner's account — keep its id + slug on the row so
+      // the wizard can name it and say why "try again" makes a second one (task 1004572).
+      return { ok: false, codeSpent: true, appId: creds.appId, appSlug: creds.appSlug, error: 'the credentials are placed, but the project did not report sign-in ready in time' };
     }
     log('  [oauth-manifest] ✓ /healthz auth_configured=true — sign-in is live');
   } else {
@@ -1147,7 +1149,7 @@ async function drainOAuthManifests(deps) {
         // single-use, so resetting the row to 'code_received' guarantees the
         // next tick re-converts a burned code and 404s forever. Only failures
         // that happened BEFORE the conversion stay retryable.
-        if (result.codeSpent) await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: result.error, github_code: null });
+        if (result.codeSpent) await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: result.error, github_code: null, ...(result.appSlug ? { app_id: result.appId, app_slug: result.appSlug } : {}) });
         else if (mrow.attempts >= MAX_INTENT_ATTEMPTS) await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: result.error });
         else await provisioning.resolveOAuthManifest(db, mrow.id, 'code_received', { last_error: result.error });
         errors++; log(`  ✖ oauth-manifest #${mrow.id}: ${result.error}`);

package/src/bongos/routes/auth.js

@@ -127,6 +127,19 @@ function renderAuthErrorPage(heading, detail, opts = {}) {
 </body></html>`;
 }
 
+// The project has no way to sign anyone in yet: neither its own GitHub app nor
+// sign-in through the platform (task 1004572). It used to answer a bare 503
+// "auth not configured", which told a founder mid-setup nothing they could act on.
+// Still a 503 — the service genuinely is not available — but in words, and
+// pointing the one person who can fix it at the step that does.
+const AUTH_NOT_CONFIGURED_DETAIL = "Sign-in isn't set up on this project yet. If it's your project, go back to its setup checklist on the platform where you created it and finish the \"Wire GitHub sign-in\" step. Otherwise, ask the project's owner.";
+function sendAuthNotConfigured(res) {
+  return res.status(503).type('text/html').send(renderAuthErrorPage(
+    "Sign-in isn't set up yet", AUTH_NOT_CONFIGURED_DETAIL,
+    { subtitle: "This project can't sign anyone in yet.", cta: { href: '/', label: 'Back to the project' }, note: 'Nothing is wrong with your account.' },
+  ));
+}
+
 // renderAccessPendingPage — the calm "hang tight" page shown instead of the red
 // dead-end when admission is plausibly imminent (task 1002097): the configured
 // firstAdmin during the bootstrap window, or a login with a pending request.
@@ -681,7 +694,7 @@ module.exports = function buildAuthRouter() {
     // Either direct-GitHub creds OR platform-IdP federation must be configured
     // (ADR 0141 §1) — a federated instance has no GitHub app of its own.
     if (!auth.authConfigured() && !auth.idpConfigured()) {
-      return res.status(503).type('text/plain').send('auth not configured');
+      return sendAuthNotConfigured(res);
     }
     const wantsRepos = req.query.repos === '1' || req.query.repos === 'true';
     // A sign-in begun on a satellite hub host (builders./status.) restarts on
@@ -842,7 +855,7 @@ module.exports = function buildAuthRouter() {
   // rank: public — OAuth callback; the state cookie + code are the bearer.
   router.get('/auth/web/callback', async (req, res) => {
     if (!auth.authConfigured() && !auth.idpConfigured()) {
-      return res.status(503).type('text/plain').send('auth not configured');
+      return sendAuthNotConfigured(res);
     }
     const expectedState = parseCookie(req, STATE_COOKIE) || parseCookie(req, STATE_COOKIE_LEGACY);
     const { state, code, error } = req.query;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.44'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.46'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hall_tweak_editor.mjs

@@ -635,7 +635,7 @@ try {
     assert.match(HTML, /<body data-page="tweak-editor"[^>]*data-fullscreen-switch/);
     assert.equal((HTML.match(/<h1\b/g) || []).length, 1);
     assert.ok(HTML.indexOf('tweak-editor-lib.js') < HTML.indexOf('tweak-editor.js?'), 'the lib loads first');
-    assert.match(HTML, /shell\.js\?v=2026-10-04-nolegacy/);
+    assert.match(HTML, /shell\.js\?v=2026-10-04-paintbrush/);
     assert.equal(/fonts\.googleapis\.com\/css/.test(HTML), false);
     for (const id of ['tw-bar', 'tw-counter', 'tw-open', 'tw-open-more', 'tw-divider', 'tw-openwrap', 'tw-open-menu', 'tw-open-tab', 'tw-open-split', 'tw-frame', 'tw-frame-view', 'tw-split-close', 'tw-download', 'tw-upload', 'tw-file', 'tw-submit', 'tw-paper', 'tw-doc', 'tw-notice', 'tw-done', 'tw-take', 'tw-pick', 'tw-picks', 'tw-refused', 'tw-refused-title', 'tw-refused-list', 'tw-refused-next', 'tw-refused-download', 'tw-refused-close']) {
       assert.ok(new RegExp(`id="${id}"`).test(HTML), `#${id} is in the markup`);

package/tests/page_notes_panel.mjs

@@ -76,8 +76,9 @@ const flush = () => new Promise((r) => setTimeout(r, 0));
 
 test('THE PALETTE: in the top bar in Artistry alone, right before the switch, and gone when the mode changes', () => {
   const p = boot({ session: { 'hall-craft': 'artistry' } });
-  assert.deepEqual(p.tools().map((t) => t.id), ['craft-tool-palette']);
-  assert.equal(p.tools()[0].nextSibling, p.sw, 'it sits right before the mode switch');
+  assert.deepEqual(p.tools().map((t) => t.id), ['craft-tool-palette', 'craft-tool-paintbrush'], 'the palette, then the paintbrush (task 1004497)');
+  assert.equal(p.tools()[0].nextSibling, p.tools()[1], 'the palette comes first');
+  assert.equal(p.tools()[1].nextSibling, p.sw, 'and the pair sits right before the mode switch');
   assert.equal(p.tools()[0].getAttribute('aria-label'), 'Write feedback on this page');
   for (const m of ['building', 'ideating', 'governing']) {
     p.craft.choose(m);
@@ -85,7 +86,7 @@ test('THE PALETTE: in the top bar in Artistry alone, right before the switch, an
   }
   p.craft.choose('artistry');
   p.craft.choose('artistry');
-  assert.equal(p.tools().length, 1, 'choosing Artistry twice draws one palette');
+  assert.equal(p.tools().length, 2, 'choosing Artistry twice draws one palette and one paintbrush');
   assert.equal(boot().tools().length, 0, 'and none with no mode at all');
 });