@bongos/core 1.21.45 → 1.21.46

package/modules/provisioning/manifest-truth.js

@@ -0,0 +1,63 @@
+'use strict';
+
+// modules/provisioning/manifest-truth.js — what the wizard is told about the GitHub
+// sign-in leg (the GitHub-App-Manifest handshake, ADR 0133), at every stage.
+//
+// WHY (task 1004572, live on 2026-10-04). A founder setting up a project saw
+// "Waiting for your approval on GitHub…" while the platform was already placing
+// credentials, then "GitHub setup didn't start. Nothing was changed on GitHub" after
+// GitHub HAD created an app on their account, and — once a setup link lapsed — no
+// button at all, forever, because nothing ever flips a lapsed 'pending' row.
+// These helpers make the read surface say what is actually true. PURE: no DB, no
+// network; split out because provisioning.js sits at the 1500-line ratchet.
+
+// The status a manifest row MEANS right now. Only 'pending' decays: past expires_at
+// the callback refuses its code (attachManifestCode's TTL guard in SQL), so a lapsed
+// 'pending' row is expired in every sense but the column.
+function effectiveManifestStatus(row, now = Date.now()) {
+  const status = String((row && row.status) || '');
+  if (status === 'pending' && row.expires_at && new Date(row.expires_at).getTime() <= now) return 'expired';
+  return status;
+}
+
+// How far a FAILED attempt got, as a closed vocabulary the wizard turns into a
+// sentence. The raw last_error never leaves the server (the status route is public
+// by state token). Read from the row's shape, never from error-message text:
+//   'not_approved'        — the runner never picked it up (attempts 0): nothing we
+//                           know of happened on GitHub's side.
+//   'sign_in_unconfirmed' — GitHub handed over the credentials (the App's slug is
+//                           recorded) and they were placed, but the project never
+//                           confirmed sign-in works. An App exists on the founder's
+//                           account, so "try again" makes a second one.
+//   'finish_failed'       — GitHub approved, but turning that into credentials on
+//                           the project failed before the App was recorded.
+const MANIFEST_FAILURES = Object.freeze(['not_approved', 'sign_in_unconfirmed', 'finish_failed']);
+
+function manifestFailure(row) {
+  if (!row || !(Number(row.attempts) > 0)) return 'not_approved';
+  if (row.app_slug) return 'sign_in_unconfirmed';
+  return 'finish_failed';
+}
+
+// The GitHub-App manifest leg's truth for an instance, as the instance read carries
+// it (task 1003235): the latest attempt's lifecycle status + the App's public slug,
+// in the same vocabulary as GET /github-app/status ('pending' | 'code_received' |
+// 'converting' | 'done' | 'error' | 'expired'), so the wizard can seed `live.manifest`
+// after a reload, a second tab, or another device. null = no attempt ever made.
+//   status     — the EFFECTIVE status (above).
+//   failure    — on 'error' only, how far it got (above); null otherwise.
+//   started_at — when the setup link was minted, so a reloaded page can still offer
+//                "start again" once the wait has clearly gone wrong.
+// An allow-list projection of the row, never the row itself (it holds GitHub's code).
+function publicGithubApp(manifestRow, now = Date.now()) {
+  if (!manifestRow || !manifestRow.status) return null;
+  const status = effectiveManifestStatus(manifestRow, now);
+  return {
+    status,
+    app_slug: manifestRow.app_slug || null,
+    failure: status === 'error' ? manifestFailure(manifestRow) : null,
+    started_at: manifestRow.created_at ? new Date(manifestRow.created_at).toISOString() : null,
+  };
+}
+
+module.exports = { effectiveManifestStatus, manifestFailure, publicGithubApp, MANIFEST_FAILURES };

package/modules/provisioning/provisioning.js

@@ -477,17 +477,9 @@ function publicInstance(row) {
   };
 }
 
-// The GitHub-App manifest leg's truth for an instance, as the read surface carries
-// it (task 1003235): the latest attempt's lifecycle status + the App's public slug.
-// Same vocabulary as GET /github-app/status ('pending' | 'code_received' |
-// 'converting' | 'done' | 'error' | 'expired'), so the wizard can seed its
-// `live.manifest` from a plain instance read after a reload, a second tab, or
-// another device — no sessionStorage bridge needed. null = no attempt ever made.
-// PURE: an allow-list projection of the manifest row, never the row itself.
-function publicGithubApp(manifestRow) {
-  if (!manifestRow || !manifestRow.status) return null;
-  return { status: String(manifestRow.status), app_slug: manifestRow.app_slug || null };
-}
+// The GitHub-App manifest leg's truth as the read surface carries it (task 1003235;
+// task 1004572 made it tell the truth at every stage) — moved to manifest-truth.js.
+const { publicGithubApp } = require('./manifest-truth');
 
 // The env variables that carry this instance's settings, as the instance reads
 // them: { <PREFIX>_PLATFORM_VISIBILITY, <PREFIX>_JOINABILITY } (task 1003139 /

package/modules/provisioning/routes/provisioning.js

@@ -1405,10 +1405,12 @@ module.exports = function provisioningRoutes() {
       const row = await provisioning.getOAuthManifestByState(pool, state);
       if (!row) return res.status(404).json({ ok: false, error: 'unknown_state' });
       const inst = await provisioning.getInstanceById(pool, row.instance_id).catch(() => null);
-      const status = row.status;
+      // EFFECTIVE status + how far a failure got (task 1004572, manifest-truth.js)
+      const { status, failure } = provisioning.publicGithubApp(row);
       return res.json({
         ok: true,
         status,
+        failure,
         ready: status === 'done',
         terminal: status === 'done' || status === 'error' || status === 'expired',
         domain: inst && inst.domain ? inst.domain : null,

package/modules/public-landing/public/projects.html

@@ -6533,7 +6533,7 @@ summary{min-height:24px;padding:3px 0;}
       return '<a href="' + (instanceId ? '?view=manage&id=' + encodeURIComponent(instanceId) : '?view=mine') +
         '">' + label + '</a>';
     }
-    var live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
+    var live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null };
     var planPromises = {};             /* mode|domain → Promise<steps[]> */
     var lastStepsHtml = '';
     var lastProgHtml = '';            /* same change-only contract, for the progress strip */
@@ -6654,14 +6654,24 @@ summary{min-height:24px;padding:3px 0;}
            details (task 1003244). The one refusal a founder can act on — no
            address yet — says where to go instead of what the server said. */
         var snag, raw = '';
+        /* a failure AFTER GitHub's approval left an app on the founder's account,
+           so "nothing was changed" would be false — the server says how far it got
+           (live.manifestFailure, task 1004572) and the words follow it */
         if (live.manifest === 'expired') snag = 'That setup link expired (they last 30 minutes) — mint a fresh one.';
         else if (live.manifestCode === 'domain_required') snag = 'This project needs an address first — attach one from ' + projectPageLink('its own page') + ', then come back to this step.';
+        else if (live.manifestFailure === 'sign_in_unconfirmed') {
+          var appLink = live.appSlug ? '<a href="https://github.com/settings/apps/' + esc(live.appSlug) + '" target="_blank" rel="noopener">your app on GitHub</a>' : 'the app on your GitHub account';
+          return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>GitHub approved the app and the platform placed its credentials on your project, but your project didn’t confirm that sign-in works. Trying again would make a second app on your GitHub account and is unlikely to fix this — it needs a look from the platform team. <a href="/contact">Contact us</a> and mention ' + appLink + '.</p>' +
+            progressMarkup(1, 1, 'Stopped: your project didn’t confirm sign-in.', 'isErr', 'signin') +
+            '<button type="button" class="linklike" data-action="manifest-start">Try again anyway</button></li>';
+        }
+        else if (live.manifestFailure === 'finish_failed') snag = 'GitHub approved the app, but the platform couldn’t finish setting up sign-in on your project. The app GitHub made is still on your account — delete it first (GitHub → Settings → Developer settings → GitHub Apps) so you don’t end up with two, then try again.';
         else { snag = 'GitHub setup didn’t start. Nothing was changed on GitHub — try again.'; raw = live.manifestMsg; }
         return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>' + snag + '</p>' +
           (raw ? '<details><summary>Technical details</summary><p>' + esc(raw) + '</p></details>' : '') +
           '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
       }
-      if (live.manifest === 'code_received') {
+      if (live.manifest === 'code_received' || live.manifest === 'converting') {
         /* GitHub's half is done — say so, rather than keep telling the founder
            to approve an app they just approved */
         autoOpenArmed = true;
@@ -6670,7 +6680,7 @@ summary{min-height:24px;padding:3px 0;}
       }
       if (live.manifest) {   /* pending — GitHub holds the manifest, nobody has approved it yet */
         autoOpenArmed = true;
-        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Waiting on GitHub — approve the app in the tab that opened. Once approved, the platform places the credentials and verifies sign-in on its own; this step ticks itself.</p>' +
+        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Waiting on GitHub — approve the app in the tab that opened. No GitHub tab? It may have opened behind this window or in another one. Once approved, the platform places the credentials and verifies sign-in on its own; this step ticks itself.</p>' +
           progressMarkup(0, 0, 'Waiting for your approval on GitHub…', '', 'signin') + autoOpenTick() +
           (manifestStale ? '<button type="button" class="linklike" data-action="manifest-start">Didn’t get to GitHub? Start the setup again</button>' : '') + '</li>';
       }
@@ -6889,7 +6899,7 @@ summary{min-height:24px;padding:3px 0;}
         inp.type = 'hidden'; inp.name = 'manifest'; inp.value = JSON.stringify(d.manifest);
         form.appendChild(inp); document.body.appendChild(form);
         form.submit(); form.remove();
-        live.manifest = 'pending'; live.manifestMsg = '';
+        live.manifest = 'pending'; live.manifestMsg = ''; live.manifestFailure = null;
         manifestStartedAt = Date.now(); manifestStale = false;
         rememberManifest(d.state, 'pending');
         renderSteps();
@@ -6897,12 +6907,21 @@ summary{min-height:24px;padding:3px 0;}
       }).catch(function (err) {
         if (String(err && err.message) === 'signing in') return;
         if (tab) { try { tab.close(); } catch (e) {} }
-        live.manifest = 'error'; live.manifestMsg = String((err && err.message) || 'could not start');
+        live.manifest = 'error'; live.manifestFailure = null; live.manifestMsg = String((err && err.message) || 'could not start');
         live.manifestCode = String((err && err.code) || '');
         renderSteps();
       });
     }
 
+    /* the "start again" offer once a wait has clearly gone wrong — measured from
+       when the link was MINTED (the server's started_at after a reload), so a
+       reloaded page offers it too instead of never (task 1004572) */
+    function manifestInFlight() {
+      return live.manifest === 'pending' || live.manifest === 'code_received' || live.manifest === 'converting';
+    }
+    function noteManifestWait() {
+      if (live.manifest === 'pending' && !manifestStale && manifestStartedAt && (Date.now() - manifestStartedAt) > 90000) { manifestStale = true; renderSteps(); }
+    }
     function pollManifest(stateToken) {
       stopManifestPoll();
       manifestState = stateToken;
@@ -6916,8 +6935,9 @@ summary{min-height:24px;padding:3px 0;}
             if (myGen !== manifestGen) return;
             if (d.app_slug && d.app_slug !== live.appSlug) { live.appSlug = d.app_slug; rememberManifest(undefined, undefined, d.app_slug); renderSteps(); }
             var next = d.ready ? 'done' : (d.status || 'pending');
-            if (next !== live.manifest) { live.manifest = next; rememberManifest(undefined, next); renderSteps(); }
-            else if (next === 'pending' && !manifestStale && manifestStartedAt && (Date.now() - manifestStartedAt) > 90000) { manifestStale = true; renderSteps(); }
+            var failure = d.failure || null;
+            if (next !== live.manifest || failure !== live.manifestFailure) { live.manifest = next; live.manifestFailure = failure; rememberManifest(undefined, next); renderSteps(); }
+            else noteManifestWait();
             if (!d.terminal) manifestPollTimer = setTimeout(tick, 4000);
             else manifestPollTimer = null;   /* a stale fired id would read as "still polling" and resume a finished poll */
           })
@@ -7119,10 +7139,15 @@ summary{min-height:24px;padding:3px 0;}
             var ga = data.github_app;
             if (ga && ga.status && !manifestPollTimer) {
               var seeded = ga.status === 'done' ? 'done' : ga.status;
-              var seedChanged = seeded !== live.manifest || (!!ga.app_slug && ga.app_slug !== live.appSlug);
+              var seedFailure = ga.failure || null;
+              var seedChanged = seeded !== live.manifest || seedFailure !== live.manifestFailure || (!!ga.app_slug && ga.app_slug !== live.appSlug);
               if (ga.app_slug) live.appSlug = ga.app_slug;
-              live.manifest = seeded;
+              live.manifest = seeded; live.manifestFailure = seedFailure;
+              /* the wait is timed from when the link was MINTED, so a reload still
+                 reaches the "start again" offer (task 1004572) */
+              if (!manifestStartedAt && ga.started_at) manifestStartedAt = Date.parse(ga.started_at) || 0;
               if (seedChanged) { rememberManifest(undefined, live.manifest, live.appSlug || undefined); renderSteps(); }
+              else noteManifestWait();
             }
             /* the checklist reflects live state (task 1002694): a status transition —
                e.g. the scaffold landing — re-renders the steps (change-only, so the
@@ -7131,7 +7156,9 @@ summary{min-height:24px;padding:3px 0;}
               live.instStatus = inst.status; live.addrReady = addressReady(inst); renderSteps();
             }
             var terminal = renderProgress(inst);
-            if (!terminal) pollTimer = setTimeout(tick, 5000);
+            /* a GitHub leg still in flight keeps this read alive even once the
+               project is up — after a reload it is the ONLY thing watching it */
+            if (!terminal || manifestInFlight()) pollTimer = setTimeout(tick, 5000);
             else stopPolling();
           })
           .catch(function (err) {
@@ -7160,7 +7187,7 @@ summary{min-height:24px;padding:3px 0;}
       instanceId = null;
       watchPending = false; manifestPending = false; manifestState = null;
       manifestStartedAt = 0; manifestStale = false;
-      live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
+      live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null };
       lastStepsHtml = '';
       lastProgHtml = '';
       try { sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.45",
+  "version": "1.21.46",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.45",
+      "version": "1.21.46",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.45",
+  "version": "1.21.46",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9034,5 +9034,11 @@
       "id": "1004497",
       "text": "Artists can now edit any hall page's words right where they stand. In Artistry mode, \"Edit words\" offers to take the page; the words get an underline and can be typed over, a review lists each change as was/now, and \"Send for"
     }
+  ],
+  "1.21.46": [
+    {
+      "id": "1004572",
+      "text": "Setting up GitHub sign-in for a new project now says what is really happening at each step, and always leaves a way forward if it gets stuck."
+    }
   ]
 }

package/scripts/gds/provision.js

@@ -1095,7 +1095,9 @@ async function placeManifestCreds(inst, mrow, deps) {
       await sleep(MANIFEST_VERIFY_INTERVAL_MS);
     }
     if (!authConfigured) {
-      return { ok: false, codeSpent: true, error: 'the credentials are placed, but the project did not report sign-in ready in time' };
+      // The App now EXISTS on the owner's account — keep its id + slug on the row so
+      // the wizard can name it and say why "try again" makes a second one (task 1004572).
+      return { ok: false, codeSpent: true, appId: creds.appId, appSlug: creds.appSlug, error: 'the credentials are placed, but the project did not report sign-in ready in time' };
     }
     log('  [oauth-manifest] ✓ /healthz auth_configured=true — sign-in is live');
   } else {
@@ -1147,7 +1149,7 @@ async function drainOAuthManifests(deps) {
         // single-use, so resetting the row to 'code_received' guarantees the
         // next tick re-converts a burned code and 404s forever. Only failures
         // that happened BEFORE the conversion stay retryable.
-        if (result.codeSpent) await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: result.error, github_code: null });
+        if (result.codeSpent) await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: result.error, github_code: null, ...(result.appSlug ? { app_id: result.appId, app_slug: result.appSlug } : {}) });
         else if (mrow.attempts >= MAX_INTENT_ATTEMPTS) await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: result.error });
         else await provisioning.resolveOAuthManifest(db, mrow.id, 'code_received', { last_error: result.error });
         errors++; log(`  ✖ oauth-manifest #${mrow.id}: ${result.error}`);

package/src/bongos/routes/auth.js

@@ -127,6 +127,19 @@ function renderAuthErrorPage(heading, detail, opts = {}) {
 </body></html>`;
 }
 
+// The project has no way to sign anyone in yet: neither its own GitHub app nor
+// sign-in through the platform (task 1004572). It used to answer a bare 503
+// "auth not configured", which told a founder mid-setup nothing they could act on.
+// Still a 503 — the service genuinely is not available — but in words, and
+// pointing the one person who can fix it at the step that does.
+const AUTH_NOT_CONFIGURED_DETAIL = "Sign-in isn't set up on this project yet. If it's your project, go back to its setup checklist on the platform where you created it and finish the \"Wire GitHub sign-in\" step. Otherwise, ask the project's owner.";
+function sendAuthNotConfigured(res) {
+  return res.status(503).type('text/html').send(renderAuthErrorPage(
+    "Sign-in isn't set up yet", AUTH_NOT_CONFIGURED_DETAIL,
+    { subtitle: "This project can't sign anyone in yet.", cta: { href: '/', label: 'Back to the project' }, note: 'Nothing is wrong with your account.' },
+  ));
+}
+
 // renderAccessPendingPage — the calm "hang tight" page shown instead of the red
 // dead-end when admission is plausibly imminent (task 1002097): the configured
 // firstAdmin during the bootstrap window, or a login with a pending request.
@@ -681,7 +694,7 @@ module.exports = function buildAuthRouter() {
     // Either direct-GitHub creds OR platform-IdP federation must be configured
     // (ADR 0141 §1) — a federated instance has no GitHub app of its own.
     if (!auth.authConfigured() && !auth.idpConfigured()) {
-      return res.status(503).type('text/plain').send('auth not configured');
+      return sendAuthNotConfigured(res);
     }
     const wantsRepos = req.query.repos === '1' || req.query.repos === 'true';
     // A sign-in begun on a satellite hub host (builders./status.) restarts on
@@ -842,7 +855,7 @@ module.exports = function buildAuthRouter() {
   // rank: public — OAuth callback; the state cookie + code are the bearer.
   router.get('/auth/web/callback', async (req, res) => {
     if (!auth.authConfigured() && !auth.idpConfigured()) {
-      return res.status(503).type('text/plain').send('auth not configured');
+      return sendAuthNotConfigured(res);
     }
     const expectedState = parseCookie(req, STATE_COOKIE) || parseCookie(req, STATE_COOKIE_LEGACY);
     const { state, code, error } = req.query;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.45'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.46'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/projects_hub_pre_uat.mjs

@@ -206,7 +206,8 @@ test('the fallback checklist carries every human step the canonical plan has', (
 
 /* ── the manifest leg: acknowledges GitHub, offers a way out, survives a reload ── */
 test('the manifest step acknowledges code_received, offers a restart after a stall, and rides the CREATED record', () => {
-  assert.match(SCRIPT, /if \(live\.manifest === 'code_received'\)/, 'GitHub’s half is acknowledged');
+  // 'converting' is the same stage — it used to fall through to "waiting for approval" (task 1004572)
+  assert.match(SCRIPT, /if \(live\.manifest === 'code_received' \|\| live\.manifest === 'converting'\)/, 'GitHub’s half is acknowledged');
   assert.match(SCRIPT, /GitHub’s part is done/);
   assert.match(SCRIPT, /manifestStale \? '<button type="button" class="linklike" data-action="manifest-start">/, 'a stalled wait gets a restart door');
   assert.match(SCRIPT, /\(Date\.now\(\) - manifestStartedAt\) > 90000/, 'after ~90 seconds');
@@ -558,7 +559,7 @@ test('a manifest error says a plain sentence, folds the route text, and sends a
   assert.match(steps, /\(raw \? '<details><summary>Technical details<\/summary><p>' \+ esc\(raw\) \+ '<\/p><\/details>' : ''\)/);
   assert.match(SCRIPT, /e\.code = \(d\.error && d\.error\.code\) \|\| '';/, 'the route code travels with the error');
   assert.match(SCRIPT, /live\.manifestCode = String\(\(err && err\.code\) \|\| ''\);/);
-  assert.equal((SCRIPT.match(/manifestMsg: '', manifestCode: '', appSlug: null/g) || []).length, 2, 'both resets carry the code');
+  assert.equal((SCRIPT.match(/manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null/g) || []).length, 2, 'both resets carry the code (and, since task 1004572, the failure stage)');
 });
 
 test('the progress rail is gone (task 1004504): no painter, no repaint at the done panel, no static rail', () => {

package/tests/provision.mjs

@@ -1723,6 +1723,59 @@ await ta('a SPENT code is never re-converted — terminal error, no code_receive
   assert.ok(!resolves.some((x) => x.status === 'code_received'), 'never reset for a doomed retry');
 });
 
+// Task 1004572: once the credentials are placed, an App EXISTS on the owner's GitHub
+// account whether or not the project then confirms sign-in. The failed row must keep
+// its id + slug, or the wizard can only say "GitHub setup didn't start" — false, and
+// it sends the founder to make a second App (live on mercury, 2026-10-04).
+await ta('a sign-in check that never confirms still records WHICH App GitHub made (task 1004572)', async () => {
+  const inst = { ...coTenant, domain: 'mercury.example.com' };
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    convertManifestCode: async () => ({ clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 5189633, appSlug: 'mercury-cloudbongos-com' }),
+    exec: () => ({ ok: true, stdout: '{"ok":true,"auth_configured":false}' }),
+    writeFile: () => ({ ok: true }),
+  };
+  const r = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, deps);
+  assert.equal(r.ok, false);
+  assert.equal(r.appId, 5189633, 'the App id rides the failure');
+  assert.equal(r.appSlug, 'mercury-cloudbongos-com', 'the App slug rides the failure');
+
+  const resolves = [];
+  let claims = 0;
+  await P.drainOAuthManifests({
+    ...deps, db: {},
+    provisioning: {
+      claimNextOAuthManifest: async () => (claims++ === 0 ? { id: 18, instance_id: 53, github_code: 'C', attempts: 1 } : null),
+      getInstanceById: async () => inst,
+      resolveOAuthManifest: async (_db, _id, status, patch = {}) => { resolves.push({ status, patch }); },
+      recordEvent: async () => {},
+    },
+  });
+  assert.equal(resolves.length, 1);
+  assert.equal(resolves[0].status, 'error');
+  assert.equal(resolves[0].patch.app_slug, 'mercury-cloudbongos-com', 'the error row names the App');
+  assert.equal(resolves[0].patch.app_id, 5189633);
+  assert.equal(resolves[0].patch.github_code, null, 'the burned code is still scrubbed');
+});
+
+await ta('a failure BEFORE GitHub handed over credentials claims no App (task 1004572)', async () => {
+  const resolves = [];
+  let claims = 0;
+  await P.drainOAuthManifests({
+    apply: true, privileged: false, log: () => {}, sleep: async () => {}, db: {},
+    exec: () => ({ ok: true, stdout: '' }), writeFile: () => ({ ok: true }),
+    convertManifestCode: async () => { throw new Error('GitHub manifest conversion failed: code expired'); },
+    provisioning: {
+      claimNextOAuthManifest: async () => (claims++ === 0 ? { id: 19, instance_id: 53, github_code: 'C', attempts: 1 } : null),
+      getInstanceById: async () => ({ ...coTenant, domain: 'mercury.example.com' }),
+      resolveOAuthManifest: async (_db, _id, status, patch = {}) => { resolves.push({ status, patch }); },
+      recordEvent: async () => {},
+    },
+  });
+  assert.ok(resolves.length >= 1);
+  assert.ok(resolves.every((x) => !('app_slug' in x.patch)), 'no App is named when none was handed over');
+});
+
 await ta('a PRE-conversion failure stays retryable — the narrowing spared the retry path (F23)', async () => {
   let claims = 0; const resolves = [];
   const deps = {

package/tests/provisioning_github_app_routes.mjs

@@ -158,6 +158,29 @@ console.log('\nGET /provisioning/github-app/status (the page poll → auto-open
   t("status 'done' → ready:true + terminal:true", res.status === 200 && j.ready === true && j.terminal === true, JSON.stringify(j));
   provisioning.getOAuthManifestByState = prev;
 }
+{
+  // Task 1004572: a setup link nobody finished lapses after 30 minutes, and the
+  // callback refuses it from then on — so the poll must say 'expired' (terminal)
+  // rather than 'pending' forever, or the page waits on a link that can never land.
+  const prev = provisioning.getOAuthManifestByState;
+  provisioning.getOAuthManifestByState = async () => ({ id: 17, instance_id: 42, status: 'pending', attempts: 0, expires_at: new Date(Date.now() - 1000).toISOString() });
+  const res = await fetch(`${base}/provisioning/github-app/status?state=GOODSTATE`);
+  const j = await res.json();
+  t('a LAPSED pending link reads expired + terminal (task 1004572)', res.status === 200 && j.status === 'expired' && j.terminal === true && j.ready === false && j.failure === null, JSON.stringify(j));
+  provisioning.getOAuthManifestByState = prev;
+}
+{
+  // A failure after GitHub handed over credentials: the poll names how far it got,
+  // and never the raw last_error (this route is public by state token).
+  const prev = provisioning.getOAuthManifestByState;
+  provisioning.getOAuthManifestByState = async () => ({ id: 18, instance_id: 42, status: 'error', attempts: 1, app_slug: 'mercury-signin', last_error: 'the credentials are placed, but the project did not report sign-in ready in time', expires_at: new Date(Date.now() - 1000).toISOString() });
+  const res = await fetch(`${base}/provisioning/github-app/status?state=GOODSTATE`);
+  const raw = await res.text();
+  const j = JSON.parse(raw);
+  t("a post-approval failure says failure:'sign_in_unconfirmed' (task 1004572)", j.status === 'error' && j.failure === 'sign_in_unconfirmed' && j.terminal === true, raw);
+  t('…and never leaks last_error', !/did not report/.test(raw) && !('last_error' in j), raw);
+  provisioning.getOAuthManifestByState = prev;
+}
 {
   const res = await fetch(`${base}/provisioning/github-app/status?state=NOPE`);
   t('unknown state → 404 (no oracle)', res.status === 404, `status=${res.status}`);

package/tests/provisioning_settings.mjs

@@ -115,10 +115,12 @@ await ta('owner reads their own instance', async () => {
 
 await ta('the read carries the GitHub-App leg\'s truth — github_app {status, app_slug} from the latest manifest attempt (task 1003235)', async () => {
   reset();
-  manifest = { id: 3, instance_id: 18, status: 'done', app_slug: 'spike-bongos', github_code: 'never-surfaced', state: 'never-surfaced' };
+  manifest = { id: 3, instance_id: 18, status: 'done', app_slug: 'spike-bongos', github_code: 'never-surfaced', state: 'never-surfaced', last_error: 'never-surfaced', created_at: '2026-10-04T20:20:56.930Z' };
   const r = await get('/provisioning/instances/18');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.github_app, { status: 'done', app_slug: 'spike-bongos' }, 'an allow-list projection — the code and the state token never ride the read');
+  // task 1004572 added failure + started_at to the allow-list; nothing else rides
+  assert.deepEqual(r.body.github_app, { status: 'done', app_slug: 'spike-bongos', failure: null, started_at: '2026-10-04T20:20:56.930Z' }, 'an allow-list projection — the code, the state token and last_error never ride the read');
+  assert.doesNotMatch(r.raw, /never-surfaced/);
   assert.equal(r.body.instance.slug, 'spike', 'the instance projection is untouched');
 });
 
@@ -134,8 +136,8 @@ await ta('no manifest attempt yet → github_app is null, not absent (a reload c
 await ta('publicGithubApp is a pure allow-list projection with the status route\'s vocabulary', async () => {
   assert.equal(provisioning.publicGithubApp(null), null);
   assert.equal(provisioning.publicGithubApp({ app_slug: 'x' }), null, 'a row with no status is no truth');
-  assert.deepEqual(provisioning.publicGithubApp({ status: 'pending', github_code: 'secret' }), { status: 'pending', app_slug: null });
-  assert.deepEqual(provisioning.publicGithubApp({ status: 'code_received', app_slug: 'mercury-bongos' }), { status: 'code_received', app_slug: 'mercury-bongos' });
+  assert.deepEqual(provisioning.publicGithubApp({ status: 'pending', github_code: 'secret' }), { status: 'pending', app_slug: null, failure: null, started_at: null });
+  assert.deepEqual(provisioning.publicGithubApp({ status: 'code_received', app_slug: 'mercury-bongos' }), { status: 'code_received', app_slug: 'mercury-bongos', failure: null, started_at: null });
 });
 
 await ta('ANOTHER builder\'s GET → 404 (no existence leak)', async () => {