@bongos/core 1.21.44 → 1.21.46

package/tests/paintbrush.mjs

@@ -0,0 +1,351 @@
+// tests/paintbrush.mjs — the Artistry paintbrush (task 1004497): a page's own
+// words, edited where they stand, as a proposed wording change.
+//
+// Runs the REAL paintbrush.js, with the REAL tweak-editor-lib.js and
+// studio-lib.js it shares with the editor and the studio, over a small page
+// (there is no jsdom here; the fake-DOM idiom of tests/page_notes_panel.mjs).
+// The task's done-when, as cases: an artist toggles editing, changes the words
+// a page shows, reviews the changes and sends them as one proposal; nobody
+// else's view changes — the page's words come back when editing ends, and the
+// only writes are the copy desk's own page-round routes (owner, 2026-10-04: the
+// edits are real wording changes, kept apart from the palette's feedback docs).
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
+const BRUSH = read('paintbrush.js');
+const EDITOR_LIB = read('tweak-editor-lib.js');
+const STUDIO_LIB = read('studio-lib.js');
+const CRAFT = read('craft-mode.js');
+const CSS = read('style.css');
+
+// ---------- a small DOM: enough for the selectors paintbrush.js asks ----------
+function matchesOne(el, sel) {
+  sel = sel.trim();
+  const m = /^([a-z]+)?(?:#([\w-]+))?(?:\.([\w-]+))?(?:\[([\w-]+)(?:="([^"]*)")?\])?$/i.exec(sel);
+  if (!m) throw new Error('fake DOM cannot match ' + sel);
+  const [, tag, id, cls, attr, val] = m;
+  if (tag && el.tagName !== tag.toUpperCase()) return false;
+  if (id && el.id !== id) return false;
+  if (cls && !el.classList.contains(cls)) return false;
+  if (attr) {
+    if (attr === 'hidden') return !!el.hidden;
+    if (!el.hasAttribute(attr)) return false;
+    if (val !== undefined && el.getAttribute(attr) !== val) return false;
+  }
+  return true;
+}
+const matches = (el, sel) => sel.split(',').some((s) => matchesOne(el, s));
+
+class El {
+  constructor(tag, text) {
+    this.tagName = tag.toUpperCase();
+    this.attrs = {};
+    this.children = [];
+    this.parentNode = null;
+    this.id = '';
+    this.hidden = false;
+    this.dataset = {};
+    this.listeners = {};
+    this._text = text == null ? '' : String(text);
+    this._html = '';
+    const cls = new Set();
+    this.classList = {
+      add: (...c) => c.forEach((x) => cls.add(x)), remove: (...c) => c.forEach((x) => cls.delete(x)),
+      contains: (c) => cls.has(c), toggle: (c, on) => { if (on === undefined ? !cls.has(c) : on) cls.add(c); else cls.delete(c); },
+    };
+  }
+  add(child) { child.parentNode = this; this.children.push(child); return child; }
+  appendChild(c) { return this.add(c); }
+  removeChild(c) { this.children.splice(this.children.indexOf(c), 1); c.parentNode = null; return c; }
+  get childElementCount() { return this.children.length; }
+  get textContent() { return this.children.length ? this.children.map((c) => c.textContent).join('') : this._text; }
+  set textContent(v) { this.children = []; this._text = String(v); }
+  get innerHTML() { return this._html; }
+  set innerHTML(v) { this._html = String(v); }
+  set className(v) { String(v).split(/\s+/).filter(Boolean).forEach((c) => this.classList.add(c)); }
+  setAttribute(k, v) { this.attrs[k] = String(v); if (k === 'contenteditable') this.contentEditable = String(v); }
+  getAttribute(k) { return k in this.attrs ? this.attrs[k] : null; }
+  hasAttribute(k) { return k in this.attrs; }
+  removeAttribute(k) { delete this.attrs[k]; if (k === 'contenteditable') this.contentEditable = 'inherit'; }
+  closest(sel) { for (let n = this; n; n = n.parentNode) if (n.tagName && matches(n, sel)) return n; return null; }
+  querySelectorAll(sel) {
+    const out = [];
+    const walk = (n) => n.children.forEach((c) => { if (sel === '*' || matches(c, sel)) out.push(c); walk(c); });
+    walk(this);
+    return out;
+  }
+  querySelector(sel) { return this.querySelectorAll(sel)[0] || null; }
+  addEventListener(t, fn) { (this.listeners[t] ||= []).push(fn); }
+  focus() { this.ownerDocument.activeElement = this; }
+  blur() {}
+}
+
+// A page with words the reading lists, and words it must leave alone.
+function page() {
+  const body = new El('body');
+  body.dataset.page = 'roadmap';
+  body.dataset.pageTitle = 'Roadmap';
+  const main = body.add(new El('main'));
+  const h1 = main.add(new El('h1', 'Where the build is going'));
+  const lede = main.add(new El('p', 'Every version, from first idea to shipped.'));
+  const link = main.add(new El('a'));
+  link.setAttribute('href', '/goals');
+  const linkWords = link.add(new El('span', 'See every goal'));
+  const count = main.add(new El('p', '12 versions shipped'));            // a {…} hole line: the editor's
+  const btn = main.add(new El('button', 'Star this version'));          // a control: never editable
+  const stray = main.add(new El('p', 'Words the reading has never seen'));
+  const hiddenBox = main.add(new El('div'));
+  hiddenBox.hidden = true;
+  const hiddenWords = hiddenBox.add(new El('p', 'Nothing in flight right now.'));
+  const footer = body.add(new El('footer', 'Skip to content'));        // outside main
+  return { body, main, h1, lede, link, linkWords, count, btn, stray, hiddenWords, footer };
+}
+const READING = {
+  reading_hash: 'abc123',
+  read: true,
+  lines: [
+    { key: 'L0001', section: 'skip link', text: 'Skip to content', placement: 'shared' },
+    { key: 'L0002', section: 'page top', text: 'Where the build is going', placement: 'placed' },
+    { key: 'L0003', section: 'page top', text: 'Every version, from first idea to shipped.', placement: 'placed' },
+    { key: 'L0004', section: 'versions', text: 'See every goal', placement: 'placed' },
+    { key: 'L0005', section: 'versions', text: '{…} versions shipped', placement: 'placed' },
+    { key: 'L0006', section: 'versions', text: 'Star this version', placement: 'placed' },
+    { key: 'L0007', section: 'versions', text: 'Nothing in flight right now.', placement: 'unplaced' },
+  ],
+};
+
+function boot({ round = null, draft = null, claim = { status: 200, body: { ok: true } }, submit = { status: 200, body: { ok: true, outcome: 'submitted' } } } = {}) {
+  const p = page();
+  const head = new El('head');
+  const calls = [];
+  const docListeners = {};
+  const document = {
+    body: p.body, head, documentElement: new El('html'), activeElement: null,
+    currentScript: { src: 'https://h/builders/paintbrush.js?v=2026-10-04-test' },
+    querySelector: (sel) => p.body.querySelector(sel),
+    getElementById: (id) => p.body.querySelectorAll('*').find((n) => n.id === id) || null,
+    createElement: (t) => { const e = new El(t); e.ownerDocument = document; return e; },
+    addEventListener: (t, fn) => { (docListeners[t] ||= []).push(fn); },
+    removeEventListener: (t, fn) => { docListeners[t] = (docListeners[t] || []).filter((f) => f !== fn); },
+    execCommand() { return true; },
+    title: 'Roadmap — Builders hall',
+  };
+  for (const n of [p.body, ...p.body.querySelectorAll('*')]) n.ownerDocument = document;
+  let state = { round, draft };
+  const respond = (status, body) => Promise.resolve({ ok: status < 400, status, json: () => Promise.resolve(body) });
+  const fetch = (url, opts = {}) => {
+    const method = opts.method || 'GET';
+    calls.push({ method, url, body: opts.body ? JSON.parse(opts.body) : undefined, keepalive: !!opts.keepalive });
+    if (!url.startsWith('/api/bongos/copy-desk/pages/builders%3Aroadmap/')) return respond(404, {});
+    const rest = url.slice('/api/bongos/copy-desk/pages/builders%3Aroadmap/'.length);
+    if (method === 'GET' && rest === 'draft') return respond(200, { ok: true, page: { id: 'builders:roadmap', title: 'Roadmap' }, reading: READING, round: state.round, draft: state.draft });
+    if (method === 'POST' && rest === 'claim') {
+      if (claim.status < 400) state = { round: { task_id: '9', state: 'writing', held_by_you: true, holder: { login: 'me' } }, draft: null };
+      return respond(claim.status, claim.body);
+    }
+    if (method === 'PUT' && rest === 'draft') return respond(200, { ok: true, outcome: 'saved' });
+    if (method === 'POST' && rest === 'submit') return respond(submit.status, submit.body);
+    return respond(404, {});
+  };
+  const winListeners = {};
+  const window = { location: { pathname: '/roadmap' }, addEventListener: (t, fn) => { (winListeners[t] ||= []).push(fn); }, removeEventListener: (t, fn) => { winListeners[t] = (winListeners[t] || []).filter((f) => f !== fn); } };
+  const sandbox = { window, document, fetch, Promise, setTimeout, clearTimeout, JSON, Math, String, Array, Object };
+  window.window = window;
+  vm.createContext(sandbox);
+  // The two shared libs, as the page would have them once the tool loads them.
+  vm.runInContext(EDITOR_LIB, sandbox, { filename: 'tweak-editor-lib.js' });
+  vm.runInContext(STUDIO_LIB, sandbox, { filename: 'studio-lib.js' });
+  vm.runInContext(BRUSH, sandbox, { filename: 'paintbrush.js' });
+  const bar = () => p.body.querySelector('#paintbrush');
+  const fire = (type, ev) => (docListeners[type] || []).slice().forEach((fn) => fn(ev));
+  // Press a bar button by its data attribute.
+  const press = (attr) => {
+    const html = bar().innerHTML;
+    assert.match(html, new RegExp(attr), `the bar offers [${attr}]`);
+    const btn = new El('button');
+    btn.setAttribute(attr, '');
+    btn.parentNode = bar();
+    bar().listeners.click.forEach((fn) => fn({ target: btn }));
+  };
+  const type = (el, text) => { el.textContent = text; fire('input', { target: el }); };
+  const editable = () => p.body.querySelectorAll('*').filter((n) => n.hasAttribute('contenteditable'));
+  return { ...p, leave: () => (winListeners.pagehide || []).forEach((fn) => fn()), brush: window.OTBPaintbrush, calls, bar, press, type, fire, editable, html: document.documentElement, writes: () => calls.filter((c) => c.method !== 'GET') };
+}
+const settle = () => new Promise((r) => setTimeout(r, 5));
+
+test('craft-mode.js puts the paintbrush beside the palette in Artistry, loading its own script', () => {
+  assert.match(CRAFT, /\{ id: 'paintbrush', icon: 'brush', short: 'Edit words', label: 'Edit this page\\'s words', script: 'paintbrush.js', api: 'OTBPaintbrush' \}/);
+  const tools = /var TOOLS = \{([\s\S]*?)\n  \};/.exec(CRAFT)[1];
+  assert.match(tools, /^\s*artistry: \[/m, 'it is an Artistry tool');
+  assert.doesNotMatch(tools, /building:|ideating:|governing:/, 'and no other mode has one');
+});
+
+test('pressing it on a page nobody holds OFFERS the page — nothing is editable and nothing is written until the artist takes it', async () => {
+  const p = boot();
+  p.brush.open();
+  await settle();
+  assert.match(p.bar().innerHTML, /Take this page/);
+  assert.match(p.bar().innerHTML, /Nobody else sees them until then/);
+  assert.equal(p.editable().length, 0);
+  assert.deepEqual(p.writes(), [], 'reading the page writes nothing');
+  assert.equal(p.calls[0].url, '/api/bongos/copy-desk/pages/builders%3Aroadmap/draft', 'it reads this page by its reading id');
+});
+
+test('taking the page makes the words the reading lists editable where they stand — not shared chrome, holes, controls, hidden or unknown words', async () => {
+  const p = boot();
+  p.brush.open();
+  await settle();
+  p.press('data-pb-take');
+  await settle();
+  assert.deepEqual(p.writes().map((c) => c.method + ' ' + c.url.split('/').pop()), ['POST claim'], 'one claim, through the copy desk');
+  assert.deepEqual(p.editable().map((n) => n.textContent), ['Where the build is going', 'Every version, from first idea to shipped.', 'See every goal']);
+  for (const n of [p.count, p.btn, p.stray, p.hiddenWords, p.footer]) assert.ok(!n.hasAttribute('contenteditable'), `"${n.textContent}" stays as it is`);
+  assert.equal(p.h1.getAttribute('data-pb-key'), 'L0002');
+  assert.ok(p.html.classList.contains('pb-editing'));
+  assert.match(p.bar().innerHTML, /0 changes/);
+  assert.match(p.bar().innerHTML, /tweak editor/, 'the lines it cannot reach point to the editor');
+});
+
+test('a refused claim says why, in the artist\'s words, and leaves the page alone', async () => {
+  const p = boot({ claim: { status: 403, body: { ok: false, error: { code: 'not_an_artist', message: 'no' } } } });
+  p.brush.open();
+  await settle();
+  p.press('data-pb-take');
+  await settle();
+  assert.match(p.bar().innerHTML, /Only an artist can take a page/);
+  assert.equal(p.editable().length, 0);
+});
+
+test('a page another artist holds is not offered, and one already on its way is not either', async () => {
+  const held = boot({ round: { task_id: '9', state: 'writing', held_by_you: false, holder: { login: 'mira' } } });
+  held.brush.open();
+  await settle();
+  assert.match(held.bar().innerHTML, /mira is tweaking this page right now/);
+  assert.doesNotMatch(held.bar().innerHTML, /Take this page/);
+  const flight = boot({ round: { task_id: '9', state: 'submitted', held_by_you: false, holder: null } });
+  flight.brush.open();
+  await settle();
+  assert.match(flight.bar().innerHTML, /on its way to the site/);
+  assert.deepEqual([...held.writes(), ...flight.writes()], []);
+});
+
+test('typing saves the WHOLE draft to the page round, and a click on words inside a link does not follow it', async () => {
+  const p = boot({ round: { task_id: '9', state: 'writing', held_by_you: true, holder: { login: 'me' } } });
+  p.brush.open();
+  await settle();
+  assert.equal(p.editable().length, 3, 'a page you already hold opens straight into editing');
+  p.type(p.lede, 'Every version, from the first spark to shipped.');
+  p.fire('focusout', { target: p.lede });
+  await settle();
+  const put = p.writes().find((c) => c.method === 'PUT');
+  assert.ok(put, 'a save went out');
+  assert.match(put.url, /builders%3Aroadmap\/draft$/);
+  assert.deepEqual(JSON.parse(JSON.stringify(put.body)), { reading_hash: 'abc123', lines: [{ key: 'L0003', after: 'Every version, from the first spark to shipped.' }] });
+  assert.ok(p.lede.classList.contains('pb-word--changed'));
+  let prevented = false;
+  p.fire('click', { target: p.linkWords, preventDefault() { prevented = true; } });
+  assert.ok(prevented, 'the link around the words does not navigate while editing');
+});
+
+test('REVIEW lists every change as was/now, and SEND submits the page once and puts its own words back', async () => {
+  const p = boot({ round: { task_id: '9', state: 'writing', held_by_you: true, holder: { login: 'me' } } });
+  p.brush.open();
+  await settle();
+  p.type(p.h1, 'Where we are going');
+  p.type(p.linkWords, 'Every goal <b>here</b>');
+  p.press('data-pb-review');
+  await settle();
+  const html = p.bar().innerHTML;
+  assert.match(html, /Was<\/span> Where the build is going/);
+  assert.match(html, /Now<\/span> Where we are going/);
+  assert.match(html, /Every goal &lt;b&gt;here&lt;\/b&gt;/, 'what the artist typed is escaped in the review');
+  p.press('data-pb-send');
+  await settle();
+  const submits = p.writes().filter((c) => c.method === 'POST' && c.url.endsWith('/submit'));
+  assert.equal(submits.length, 1, 'one proposal for the page');
+  const lastPut = p.writes().filter((c) => c.method === 'PUT').pop();
+  assert.deepEqual(JSON.parse(JSON.stringify(lastPut.body.lines)), [{ key: 'L0002', after: 'Where we are going' }, { key: 'L0004', after: 'Every goal <b>here</b>' }], 'the saved draft held both changes before the submit');
+  assert.match(p.bar().innerHTML, /Sent for approval: 2 changes/);
+  assert.equal(p.h1.textContent, 'Where the build is going', 'the page shows its own words again');
+  assert.equal(p.linkWords.textContent, 'See every goal');
+  assert.equal(p.editable().length, 0);
+  assert.ok(!p.html.classList.contains('pb-editing'));
+});
+
+test('STOP EDITING keeps the draft saved and puts the page\'s words back', async () => {
+  const p = boot({ round: { task_id: '9', state: 'writing', held_by_you: true, holder: { login: 'me' } } });
+  p.brush.open();
+  await settle();
+  p.type(p.h1, 'A new heading');
+  p.press('data-pb-stop');
+  await settle();
+  assert.ok(p.writes().some((c) => c.method === 'PUT'), 'the change was saved first');
+  assert.ok(!p.writes().some((c) => c.url.endsWith('/submit')), 'stopping sends nothing');
+  assert.equal(p.h1.textContent, 'Where the build is going');
+  assert.equal(p.editable().length, 0);
+  assert.equal(p.bar(), null, 'the bar is gone');
+});
+
+test('a draft saved earlier comes back: the words show the artist\'s rewrite when editing resumes', async () => {
+  const p = boot({
+    round: { task_id: '9', state: 'writing', held_by_you: true, holder: { login: 'me' } },
+    draft: { reading_hash: 'abc123', lines: [{ key: 'L0002', after: 'Where it all goes' }] },
+  });
+  p.brush.open();
+  await settle();
+  assert.equal(p.h1.textContent, 'Where it all goes');
+  assert.ok(p.h1.classList.contains('pb-word--changed'));
+  assert.match(p.bar().innerHTML, /1 change/);
+});
+
+test('the only routes it writes are the copy desk\'s page round — never page-notes, never anything else', () => {
+  const routes = [...BRUSH.matchAll(/request\('(POST|PUT|PATCH|DELETE)', [^,]*?'\/([a-z-]+)'/g)].map((m) => m[1] + ' ' + m[2]);
+  assert.deepEqual(routes.sort(), ['POST claim', 'POST submit', 'PUT draft']);
+  assert.match(BRUSH, /var API = '\/api\/bongos\/copy-desk\/pages\/';/);
+  assert.doesNotMatch(BRUSH, /page-notes/);
+});
+
+test('its styles live in style.css, on the token tier', () => {
+  for (const sel of ['.pb {', '.pb__btn--go', '.pb-word {', '.pb-word--changed', '.pb__changes']) assert.ok(CSS.includes(sel), `style.css styles ${sel}`);
+  const block = CSS.slice(CSS.indexOf('/* THE PAINTBRUSH'), CSS.indexOf('/* THE BACK LINK'));
+  assert.doesNotMatch(block, /#[0-9a-f]{3,8}\b|rgba?\(/i, 'no colour literals: tokens only');
+});
+
+test('leaving the page mid-edit sends the last save with keepalive, so closing the tab does not lose it', async () => {
+  const p = boot({ round: { task_id: '9', state: 'writing', held_by_you: true, holder: { login: 'me' } } });
+  p.brush.open();
+  await settle();
+  p.type(p.h1, 'Typed, then the tab closed');
+  p.leave();
+  await settle();
+  const put = p.writes().find((c) => c.method === 'PUT');
+  assert.ok(put && put.keepalive, 'the save on the way out is a keepalive request');
+  assert.equal(put.body.lines[0].after, 'Typed, then the tab closed');
+});
+
+test('words only: bold, italic and underline keys do nothing in the words; elsewhere they are left alone', async () => {
+  const p = boot({ round: { task_id: '9', state: 'writing', held_by_you: true, holder: { login: 'me' } } });
+  p.brush.open();
+  await settle();
+  let prevented = 0;
+  for (const key of ['b', 'i', 'u']) p.fire('keydown', { key, ctrlKey: true, target: p.h1, preventDefault() { prevented++; } });
+  assert.equal(prevented, 3);
+  p.fire('keydown', { key: 'b', ctrlKey: true, target: p.stray, preventDefault() { prevented++; } });
+  assert.equal(prevented, 3, 'a key outside the edited words is not touched');
+});
+
+test('a word on the page matches its line however its spaces wrap, and one table serves every element', async () => {
+  const p = boot({ round: { task_id: '9', state: 'writing', held_by_you: true, holder: { login: 'me' } } });
+  p.lede.textContent = '  Every version,\n   from first idea to shipped. ';
+  p.brush.open();
+  await settle();
+  assert.equal(p.lede.getAttribute('data-pb-key'), 'L0003');
+  assert.doesNotMatch(BRUSH, /matchLine\(/, 'no per-element pattern matching: the hole-free lines are looked up by their words');
+});

package/tests/projects_hub_pre_uat.mjs

@@ -206,7 +206,8 @@ test('the fallback checklist carries every human step the canonical plan has', (
 
 /* ── the manifest leg: acknowledges GitHub, offers a way out, survives a reload ── */
 test('the manifest step acknowledges code_received, offers a restart after a stall, and rides the CREATED record', () => {
-  assert.match(SCRIPT, /if \(live\.manifest === 'code_received'\)/, 'GitHub’s half is acknowledged');
+  // 'converting' is the same stage — it used to fall through to "waiting for approval" (task 1004572)
+  assert.match(SCRIPT, /if \(live\.manifest === 'code_received' \|\| live\.manifest === 'converting'\)/, 'GitHub’s half is acknowledged');
   assert.match(SCRIPT, /GitHub’s part is done/);
   assert.match(SCRIPT, /manifestStale \? '<button type="button" class="linklike" data-action="manifest-start">/, 'a stalled wait gets a restart door');
   assert.match(SCRIPT, /\(Date\.now\(\) - manifestStartedAt\) > 90000/, 'after ~90 seconds');
@@ -558,7 +559,7 @@ test('a manifest error says a plain sentence, folds the route text, and sends a
   assert.match(steps, /\(raw \? '<details><summary>Technical details<\/summary><p>' \+ esc\(raw\) \+ '<\/p><\/details>' : ''\)/);
   assert.match(SCRIPT, /e\.code = \(d\.error && d\.error\.code\) \|\| '';/, 'the route code travels with the error');
   assert.match(SCRIPT, /live\.manifestCode = String\(\(err && err\.code\) \|\| ''\);/);
-  assert.equal((SCRIPT.match(/manifestMsg: '', manifestCode: '', appSlug: null/g) || []).length, 2, 'both resets carry the code');
+  assert.equal((SCRIPT.match(/manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null/g) || []).length, 2, 'both resets carry the code (and, since task 1004572, the failure stage)');
 });
 
 test('the progress rail is gone (task 1004504): no painter, no repaint at the done panel, no static rail', () => {

package/tests/provision.mjs

@@ -1723,6 +1723,59 @@ await ta('a SPENT code is never re-converted — terminal error, no code_receive
   assert.ok(!resolves.some((x) => x.status === 'code_received'), 'never reset for a doomed retry');
 });
 
+// Task 1004572: once the credentials are placed, an App EXISTS on the owner's GitHub
+// account whether or not the project then confirms sign-in. The failed row must keep
+// its id + slug, or the wizard can only say "GitHub setup didn't start" — false, and
+// it sends the founder to make a second App (live on mercury, 2026-10-04).
+await ta('a sign-in check that never confirms still records WHICH App GitHub made (task 1004572)', async () => {
+  const inst = { ...coTenant, domain: 'mercury.example.com' };
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    convertManifestCode: async () => ({ clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 5189633, appSlug: 'mercury-cloudbongos-com' }),
+    exec: () => ({ ok: true, stdout: '{"ok":true,"auth_configured":false}' }),
+    writeFile: () => ({ ok: true }),
+  };
+  const r = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, deps);
+  assert.equal(r.ok, false);
+  assert.equal(r.appId, 5189633, 'the App id rides the failure');
+  assert.equal(r.appSlug, 'mercury-cloudbongos-com', 'the App slug rides the failure');
+
+  const resolves = [];
+  let claims = 0;
+  await P.drainOAuthManifests({
+    ...deps, db: {},
+    provisioning: {
+      claimNextOAuthManifest: async () => (claims++ === 0 ? { id: 18, instance_id: 53, github_code: 'C', attempts: 1 } : null),
+      getInstanceById: async () => inst,
+      resolveOAuthManifest: async (_db, _id, status, patch = {}) => { resolves.push({ status, patch }); },
+      recordEvent: async () => {},
+    },
+  });
+  assert.equal(resolves.length, 1);
+  assert.equal(resolves[0].status, 'error');
+  assert.equal(resolves[0].patch.app_slug, 'mercury-cloudbongos-com', 'the error row names the App');
+  assert.equal(resolves[0].patch.app_id, 5189633);
+  assert.equal(resolves[0].patch.github_code, null, 'the burned code is still scrubbed');
+});
+
+await ta('a failure BEFORE GitHub handed over credentials claims no App (task 1004572)', async () => {
+  const resolves = [];
+  let claims = 0;
+  await P.drainOAuthManifests({
+    apply: true, privileged: false, log: () => {}, sleep: async () => {}, db: {},
+    exec: () => ({ ok: true, stdout: '' }), writeFile: () => ({ ok: true }),
+    convertManifestCode: async () => { throw new Error('GitHub manifest conversion failed: code expired'); },
+    provisioning: {
+      claimNextOAuthManifest: async () => (claims++ === 0 ? { id: 19, instance_id: 53, github_code: 'C', attempts: 1 } : null),
+      getInstanceById: async () => ({ ...coTenant, domain: 'mercury.example.com' }),
+      resolveOAuthManifest: async (_db, _id, status, patch = {}) => { resolves.push({ status, patch }); },
+      recordEvent: async () => {},
+    },
+  });
+  assert.ok(resolves.length >= 1);
+  assert.ok(resolves.every((x) => !('app_slug' in x.patch)), 'no App is named when none was handed over');
+});
+
 await ta('a PRE-conversion failure stays retryable — the narrowing spared the retry path (F23)', async () => {
   let claims = 0; const resolves = [];
   const deps = {

package/tests/provisioning_github_app_routes.mjs

@@ -158,6 +158,29 @@ console.log('\nGET /provisioning/github-app/status (the page poll → auto-open
   t("status 'done' → ready:true + terminal:true", res.status === 200 && j.ready === true && j.terminal === true, JSON.stringify(j));
   provisioning.getOAuthManifestByState = prev;
 }
+{
+  // Task 1004572: a setup link nobody finished lapses after 30 minutes, and the
+  // callback refuses it from then on — so the poll must say 'expired' (terminal)
+  // rather than 'pending' forever, or the page waits on a link that can never land.
+  const prev = provisioning.getOAuthManifestByState;
+  provisioning.getOAuthManifestByState = async () => ({ id: 17, instance_id: 42, status: 'pending', attempts: 0, expires_at: new Date(Date.now() - 1000).toISOString() });
+  const res = await fetch(`${base}/provisioning/github-app/status?state=GOODSTATE`);
+  const j = await res.json();
+  t('a LAPSED pending link reads expired + terminal (task 1004572)', res.status === 200 && j.status === 'expired' && j.terminal === true && j.ready === false && j.failure === null, JSON.stringify(j));
+  provisioning.getOAuthManifestByState = prev;
+}
+{
+  // A failure after GitHub handed over credentials: the poll names how far it got,
+  // and never the raw last_error (this route is public by state token).
+  const prev = provisioning.getOAuthManifestByState;
+  provisioning.getOAuthManifestByState = async () => ({ id: 18, instance_id: 42, status: 'error', attempts: 1, app_slug: 'mercury-signin', last_error: 'the credentials are placed, but the project did not report sign-in ready in time', expires_at: new Date(Date.now() - 1000).toISOString() });
+  const res = await fetch(`${base}/provisioning/github-app/status?state=GOODSTATE`);
+  const raw = await res.text();
+  const j = JSON.parse(raw);
+  t("a post-approval failure says failure:'sign_in_unconfirmed' (task 1004572)", j.status === 'error' && j.failure === 'sign_in_unconfirmed' && j.terminal === true, raw);
+  t('…and never leaks last_error', !/did not report/.test(raw) && !('last_error' in j), raw);
+  provisioning.getOAuthManifestByState = prev;
+}
 {
   const res = await fetch(`${base}/provisioning/github-app/status?state=NOPE`);
   t('unknown state → 404 (no oracle)', res.status === 404, `status=${res.status}`);

package/tests/provisioning_settings.mjs

@@ -115,10 +115,12 @@ await ta('owner reads their own instance', async () => {
 
 await ta('the read carries the GitHub-App leg\'s truth — github_app {status, app_slug} from the latest manifest attempt (task 1003235)', async () => {
   reset();
-  manifest = { id: 3, instance_id: 18, status: 'done', app_slug: 'spike-bongos', github_code: 'never-surfaced', state: 'never-surfaced' };
+  manifest = { id: 3, instance_id: 18, status: 'done', app_slug: 'spike-bongos', github_code: 'never-surfaced', state: 'never-surfaced', last_error: 'never-surfaced', created_at: '2026-10-04T20:20:56.930Z' };
   const r = await get('/provisioning/instances/18');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.github_app, { status: 'done', app_slug: 'spike-bongos' }, 'an allow-list projection — the code and the state token never ride the read');
+  // task 1004572 added failure + started_at to the allow-list; nothing else rides
+  assert.deepEqual(r.body.github_app, { status: 'done', app_slug: 'spike-bongos', failure: null, started_at: '2026-10-04T20:20:56.930Z' }, 'an allow-list projection — the code, the state token and last_error never ride the read');
+  assert.doesNotMatch(r.raw, /never-surfaced/);
   assert.equal(r.body.instance.slug, 'spike', 'the instance projection is untouched');
 });
 
@@ -134,8 +136,8 @@ await ta('no manifest attempt yet → github_app is null, not absent (a reload c
 await ta('publicGithubApp is a pure allow-list projection with the status route\'s vocabulary', async () => {
   assert.equal(provisioning.publicGithubApp(null), null);
   assert.equal(provisioning.publicGithubApp({ app_slug: 'x' }), null, 'a row with no status is no truth');
-  assert.deepEqual(provisioning.publicGithubApp({ status: 'pending', github_code: 'secret' }), { status: 'pending', app_slug: null });
-  assert.deepEqual(provisioning.publicGithubApp({ status: 'code_received', app_slug: 'mercury-bongos' }), { status: 'code_received', app_slug: 'mercury-bongos' });
+  assert.deepEqual(provisioning.publicGithubApp({ status: 'pending', github_code: 'secret' }), { status: 'pending', app_slug: null, failure: null, started_at: null });
+  assert.deepEqual(provisioning.publicGithubApp({ status: 'code_received', app_slug: 'mercury-bongos' }), { status: 'code_received', app_slug: 'mercury-bongos', failure: null, started_at: null });
 });
 
 await ta('ANOTHER builder\'s GET → 404 (no existence leak)', async () => {