@bongos/core 1.21.45 → 1.21.47

package/modules/hall-ui/public/street-card.css

@@ -108,8 +108,10 @@ body[data-page="street"] {
 
 .mcard-btn:focus-visible, .mcard-textbtn:focus-visible, .mcard-form__text:focus-visible, .mcard-form__select:focus-visible, .mcard-chip:focus-visible, .mcard-chips__field:focus-visible { outline: 2px solid var(--accent); outline-offset: 3px; }
 
-/* the toast: one short line over the street */
-.street-toast { position: absolute; left: 50%; top: 192px; transform: translateX(-50%); max-width: calc(100% - 32px); box-sizing: border-box; font-size: 15px; line-height: 1.35; color: var(--ink); padding: 11px 20px; border-radius: 999px; background: var(--bg-card); border: 1px solid var(--street-rule-strong); z-index: 10; pointer-events: none; text-align: center; }
+/* the toast: one short line over the street. Centred with translate, not
+   transform: the enter animation ends on transform none, which put the toast
+   half its width right of centre (task 1004562) */
+.street-toast { position: absolute; left: 50%; top: 192px; translate: -50% 0; max-width: calc(100% - 32px); box-sizing: border-box; font-size: 15px; line-height: 1.35; color: var(--ink); padding: 11px 20px; border-radius: 999px; background: var(--bg-card); border: 1px solid var(--street-rule-strong); z-index: 10; pointer-events: none; text-align: center; }
 .street-toast[hidden] { display: none; }
 
 /* the city answers: a building rises (the prototype's rise) or lights, a pin settles */
@@ -128,6 +130,10 @@ body[data-page="street"] {
 @media (max-width: 560px) {
   .street-toast { top: 96px; border-radius: 16px; }
 }
+/* the desk's toast after an act (Desks.dc.html, task 1004562): an ink pill with
+   the orange dot, low over the desk, just above the six readings */
+.street-toast--desk { top: auto; bottom: 150px; display: flex; align-items: center; gap: 10px; width: max-content; font-size: 14px; background: var(--ink); color: var(--bg); border: 0; border-radius: 999px; text-align: left; }
+.street-toast--desk::before { content: ''; flex: none; width: 8px; height: 8px; border-radius: 999px; background: var(--accent); }
 
 /* The Kill Switch: under reduced motion nothing moves; the street still
    answers, at rest (the toast, the new pins, the lit windows). */

package/modules/hall-ui/public/street-desk.js

@@ -96,6 +96,50 @@
     if (d < 14) return d + ' days';
     return Math.round(d / 7) + ' weeks';
   }
+  // The record line's age, in the board's short words: 'today', '3d', '2w', '1mo'
+  // (task 1004562: the long age was cut off the end of nearly every record item).
+  function shortAge(at, now) {
+    const t = at ? Date.parse(at) : NaN;
+    if (!isFinite(t) || !now) return '';
+    const d = Math.floor(Math.max(0, now - t) / 86400000);
+    if (d < 1) return 'today';
+    if (d < 14) return d + 'd';
+    if (d < 60) return Math.round(d / 7) + 'w';
+    return Math.round(d / 30) + 'mo';
+  }
+  // One record item: the title, then what came of it and when, in 30
+  // characters. The age always shows; the outcome only when the title fits
+  // beside it whole ('Lea → metic · 2w' on the board).
+  function recordText(h, now) {
+    const title = str(h && h.title).replace(/\s+/g, ' ').trim();
+    const age = shortAge(h && h.at, now);
+    const out = str(h && h.outcome).trim();
+    const tail = (parts) => parts.filter(Boolean).join(' · ');
+    const full = tail([title, out, age]);
+    if (full.length <= LIMITS.recordLen) return full;
+    const room = LIMITS.recordLen - (age ? age.length + 3 : 0);
+    return fit(tail([fit(title, room), age]), LIMITS.recordLen);
+  }
+  // A quiet floor's tile says what its number counts, in two words that read as
+  // a label: the floor line's own words when they follow that same number and
+  // are short ('5 seats'), else the floor's name ('3 testers', '2 signed off'),
+  // else the line's last two words ('1 went live'). Never the first two words of
+  // a longer line, which read 'Lu, Bo' or 'piece of' (task 1004562).
+  function floorLabel(count, line, name) {
+    const first = str(line).split(' · ')[0].replace(/\s+/g, ' ').trim();
+    const m = /^([$]?[0-9][0-9,.%]*)\s+(.+)$/.exec(first);
+    const same = !!m && m[1] === str(count).trim();
+    const w = (s) => s.split(' ').filter(Boolean);
+    if (same && w(m[2]).length <= LIMITS.tileWords) return m[2];
+    const nm = str(name).replace(/\s+/g, ' ').trim().toLowerCase();
+    if (nm && !/^§/.test(nm) && w(nm).length <= LIMITS.tileWords) return nm;
+    if (same) return w(m[2]).slice(-LIMITS.tileWords).join(' ');
+    return 'here';
+  }
+  // A count agrees with its noun: '1 rank', '2 open votes' (task 1004562).
+  const SINGULAR = Object.freeze({ ranks: 'rank', runners: 'runner', builders: 'builder', invites: 'invite', settings: 'setting', modules: 'module', backups: 'backup', updates: 'update' });
+  const PLURAL = Object.freeze({ 'open vote': 'open votes', update: 'updates' });
+  function agree(n, noun) { return Number(n) === 1 ? (SINGULAR[noun] || noun) : (PLURAL[noun] || noun); }
 
   // The words a floor counts its rows in, and says when it is cleared.
   const NOUNS = Object.freeze({
@@ -105,6 +149,10 @@
   const CLEAR = Object.freeze({
     access_requests: 'Everyone is in', goal_join_requests: 'No one is asking', override_requests: 'No overrides asked',
     gate_approvals: 'Everything ready is live', blockers: 'Nothing blocked on you', board: 'Every vote is in', idea: 'No ideas waiting',
+    // every other floor that holds matters says its own line too (task 1004562)
+    redteam_reports: 'No reports open', removal_proposals: 'No removals asked', grade_appeals: 'No appeals open',
+    module_rechecks: 'Every module checked', criteria_uat: 'Nothing waits for a tester', core_update: 'Core is up to date',
+    autobongos_fence: 'The switch is set', standing_rules: 'No rules proposed', treasury_spending: 'No spending asked',
   });
   // The card's acts under the desk's words (the board's button labels).
   const ACT_WORDS = Object.freeze({
@@ -246,7 +294,12 @@
     if (card && card.subject) card.subject.council = councilOf(ctx.docket, card.building) ? card.building : null;
     const actions = [];
     const choices = {};
+    // 'open' leaves for an older page: a row that can act here keeps its detail
+    // in place (tap the name) and drops the link; only a row with no act of its
+    // own may link out (owner standard, task 1004562)
+    const inPlace = acts.some((a) => a && a.key !== 'open' && a.key !== 'record');
     acts.forEach((a) => {
+      if (a.key === 'open' && inPlace) return;
       // the core's 'take' is its own word ('take it'), not the rank's 'take back'
       const word = a.key === 'take' && card.subject && card.subject.kind === 'core_pin' ? 'take_core' : a.key;
       if (actions.length >= LIMITS.actions || !ACT_WORDS[word]) return;
@@ -311,7 +364,18 @@
     // a desk row that stands in for a source (the core update's check-then-take)
     // replaces that source's matter rows on this floor
     const over = desked.map((r) => r.over).filter(Boolean);
-    return floorMatters(key, floor, docket).filter((m) => !done[str(m.id)] && over.indexOf(m.source) < 0).map((m) => rowOf(m, c))
+    const here = floorMatters(key, floor, docket).filter((m) => !done[str(m.id)]);
+    // the stand-in keeps what it stands for: a matter that needs you still
+    // needs you on the desk (orange status, its age), as on the floor's sign
+    // and the street's count (task 1004562)
+    desked.forEach((r) => {
+      if (!r.over) return;
+      const stood = here.filter((m) => m.source === r.over && stateOf(m) === 'needs');
+      if (!stood.length) return;
+      r.needs = true;
+      if (!r.opened) r.opened = stood.reduce((a, m) => (m.opened_at && (!a || Date.parse(m.opened_at) < Date.parse(a)) ? m.opened_at : a), null);
+    });
+    return here.filter((m) => over.indexOf(m.source) < 0).map((m) => rowOf(m, c))
       .concat(desked)
       .sort((a, b) => (b.needs - a.needs) || ((Date.parse(a.opened || 0) || 0) - (Date.parse(b.opened || 0) || 0)));
   }
@@ -400,9 +464,11 @@
     const quiet = rows.length === 0;
     let status, hot = false;
     if (!docket) status = 'the docket could not be read';
-    else if (needs.length) { hot = true; const age = ageWord(oldestOf(needs), o.now); status = needs.length + ' ' + noun + (age ? ' · oldest ' + age : ''); }
-    else if (counted.length) { const age = ageWord(oldestOf(counted), o.now); status = counted.length + ' ' + moving + (age ? ' · oldest ' + age : ''); }
-    else if (rows.length) status = fl.line;
+    else if (needs.length) { hot = true; const age = ageWord(oldestOf(needs), o.now); status = needs.length + ' ' + agree(needs.length, noun) + (age ? ' · oldest ' + age : ''); }
+    else if (counted.length) { const age = ageWord(oldestOf(counted), o.now); status = counted.length + ' ' + agree(counted.length, moving) + (age ? ' · oldest ' + age : ''); }
+    // only tools left (an invite, a setting): the floor's line, unless that line
+    // still counts what you just did ('1 needs you' after you let them in)
+    else if (rows.length) status = /needs? you/.test(str(fl.line)) ? 'nothing needs you' : fl.line;
     else if (cleared) status = 'floor clear';
     else status = 'nothing needs you · ' + fl.line;
     const history = docket && Array.isArray(docket.history) ? docket.history.filter((h) => h && h.building === o.key) : [];
@@ -419,13 +485,16 @@
       // the order's one number: the share of its goals' promises kept
       const on = ordered.reduce((a, r) => a + (r.pips || []).filter((p) => p.on).length, 0);
       const of = ordered.reduce((a, r) => a + (r.pips || []).length, 0);
-      tile(needs.length, noun);
+      tile(needs.length, agree(needs.length, noun));
       if (of) tile(Math.round((100 * on) / of) + '%', 'promises kept');
-    } else if (rows.length) { tile(needs.length, noun); tile(counted.length - needs.length, moving); }
-    else if (fl.count) tile(fl.count, str(fl.line).replace(/^[$]?[0-9][0-9,.%]*\s*/, '') || 'on this floor');
+    } else if (rows.length) { tile(needs.length, agree(needs.length, noun)); tile(counted.length - needs.length, agree(counted.length - needs.length, moving)); }
+    // a quiet floor's own number; never on a floor you just cleared, and never a
+    // 'needs you' count on a floor where nothing does (task 1004562)
+    else if (fl.count && !cleared && !/needs? you/.test(str(fl.line))) tile(fl.count, floorLabel(fl.count, fl.line, spec[0]));
     tile(history.length, 'on record');
-    const record = (o.mine || []).map((t, i) => ({ key: 'm' + i, text: fit(t + ' · now', LIMITS.recordLen), mine: true }))
-      .concat(history.map((h, i) => ({ key: 'h' + i, text: fit([h.title, h.outcome, ageWord(h.at, o.now)].filter(Boolean).join(' · '), LIMITS.recordLen), mine: false })))
+    // what you did keeps its ' · now'; a closed item keeps its age (task 1004562)
+    const record = (o.mine || []).map((t, i) => ({ key: 'm' + i, text: fit(t, LIMITS.recordLen - 6) + ' · now', mine: true }))
+      .concat(history.map((h, i) => ({ key: 'h' + i, text: recordText(h, o.now), mine: false })))
       .slice(0, LIMITS.record);
     return {
       key: o.key + ':' + floor, building: o.key, floor: floor, name: spec[0], sym: o.sym || { d: '', f: '' },

package/modules/hall-ui/public/street.css

@@ -344,7 +344,10 @@ html[data-fullscreen="on"] .street-top { padding-right: 184px; }
 .desk-quiet--cleared .desk-quiet__tick { stroke: var(--street-accent-text); }
 .desk-quiet__line { font-size: 20px; font-weight: 300; }
 .desk-quiet__sub { font-size: 13.5px; color: var(--ink-faint); }
-.desk-record { display: flex; align-items: baseline; flex-wrap: wrap; gap: 8px 22px; border-top: 1px solid var(--street-rule); margin-top: 18px; padding-top: 14px; }
+/* the record is ONE line, as on the board: items that do not fit wrap onto a
+   second line that is clipped away, so the newest stay and none is cut in half
+   (task 1004562) */
+.desk-record { display: flex; align-items: baseline; flex-wrap: wrap; gap: 0 22px; border-top: 1px solid var(--street-rule); margin-top: 18px; padding-top: 14px; box-sizing: border-box; line-height: 20px; max-height: 35px; overflow: hidden; }
 .desk-record__label { font-size: 11.5px; letter-spacing: 0.12em; text-transform: uppercase; color: var(--ink-faint); }
 .desk-record__item { font-size: 13px; color: var(--ink-faint); white-space: nowrap; }
 .desk-record__item--mine { color: var(--ink); }

package/modules/hall-ui/public/street.js

@@ -707,11 +707,11 @@
     draw();
     return send(req).then(function (out) {
       desk.busy = false;
-      if (!out.ok) { say(C.refusal(out.status, out.body)); draw(); return false; }
+      if (!out.ok) { say(C.refusal(out.status, out.body), true); draw(); return false; }
       desk.order[k] = null;
       desk.mine[k] = [dm.save.council ? 'order sent to council' : 'order set'].concat(desk.mine[k] || []);
       bumpToday();
-      say(dm.save.said);
+      say(dm.save.said, true);
       draw();
       return load().then(function () { return true; });
     });
@@ -760,7 +760,7 @@
     var C = window.GovMatterCard, st = view.inside;
     if (!C || !st || !r.card || desk.busy) return Promise.resolve(false);
     var refused = C.check(r.card, key, input);
-    if (refused) { say(refused); return Promise.resolve(false); }
+    if (refused) { say(refused, true); return Promise.resolve(false); }
     var k = st.key + ':' + (view.insideModel ? view.insideModel.selFloor : 0);
     var req = C.request(r.card, key, input);
     var settle = function (body) {
@@ -774,14 +774,14 @@
       if (st.floor == null && view.insideModel) st.floor = view.insideModel.selFloor;
       bumpToday();
       if (a.building && a.kind) card.answer = { building: a.building, matter: r.matter, kind: a.kind, at: Date.now() };
-      say(a.toast || 'Done.');
+      say(a.toast || 'Done.', true);
     };
     if (!req) return new Promise(function (res) { clearRow(r.key, function () { settle({}); draw(); res(true); }); });
     desk.busy = true;
     draw();
     return send(req).then(function (out) {
       desk.busy = false;
-      if (!out.ok) { say(C.refusal(out.status, out.body)); draw(); return false; }
+      if (!out.ok) { say(C.refusal(out.status, out.body), true); draw(); return false; }
       return new Promise(function (res) {
         clearRow(r.key, function () {
           settle(out.body);
@@ -1230,9 +1230,12 @@
     for (var j = 0; j < pins.length; j++) if (String(pins[j].getAttribute('data-matters') || pins[j].getAttribute('data-matter')).split(' ').indexOf(a.matter) >= 0) pins[j].className += ' street-pin--answer';
   }
   var toastTimer = null;
-  function say(text) {
+  // desk: the Desks board's toast after an act on a floor (an ink pill with the
+  // orange dot, low over the desk); the street's own toast otherwise (task 1004562)
+  function say(text, desk) {
     var t = $('streetToast');
     if (!t || !text) return;
+    t.className = 'street-toast' + (desk ? ' street-toast--desk' : '');
     t.textContent = text;
     t.hidden = false;
     if (typeof setTimeout !== 'function') return;

package/modules/hall-ui/records/governor-street.md

@@ -33,3 +33,17 @@ Files: `street-inside.js` (`window.GovInside`, node-require-safe, pure): the pro
 - **Narrow.** Under 900 px the board becomes a column: the drawing in its own sideways strip (never scaled under 0.6, so a floor stays a 24 px target), then the panel.
 
 Tests: `tests/hall_street_inside.mjs` runs the prototype's own `Component` beside `street-inside.js` on the prototype's sample floors and holds every building's section, panel bindings and every district equal to it in both modes, then the docket rules (no invented numbers) and the page in a vm (the persistent lift, the flip, the drawers, the amendment note, the card from a table row, back to the street, a district's tasks). The states file renders every building, a floor pick, the amendment note and a district.
+
+## The floor desks, walked (task 1004562)
+
+Every building and every floor desk was walked in light, dark and at phone width (375 px) against `Desks.dc.html` and the line rule of `Ground.dc.html`. The live site is behind its password gate, so the walk ran on the real pages in the hall preview harness with its fixtures. What it settled:
+
+- **A quiet floor's tile says what it counts.** Two words that read as a label: the floor line's own noun when it follows the same number ("5 seats"), else the floor's name ("3 testers", "2 signed off"), else the line's last two words ("1 went live"). Never the first two words of a longer line ("3 Lu, Bo", "1 piece of"). `floorLabel()` in `street-desk.js`.
+- **A cleared floor shows no count of the work just done.** The docket's floor count lags the act, so a cleared floor draws no floor-count tile, and a floor left with only a tool (the invite) does not repeat a stale "1 needs you" as its status. Floors that hold matters each say their own clear line ("No removals asked").
+- **Counts agree with their nouns**: "2 open votes", "1 rank".
+- **The record is one line.** Each item keeps its age in the board's short words ("· 3d", "· 2w"); the outcome shows only when the title fits beside it; what you did keeps its "· now". Items that do not fit wrap onto a clipped second line, so none is cut in half.
+- **A stand-in row keeps the need it stands for.** The Release desk's core row replaces the core-update matter; it now carries that matter's need, so the status is orange where the floor sign and the street count already said "needs you".
+- **No link out beside an act.** A row that can act in place drops the server's `open` act; its detail opens in place by its name. A row with no act of its own (a Full Idea that needs its page to finish, Work categories) still links, as the standard allows.
+- **The desk's toast is the board's**: an ink pill with the orange dot, low over the desk. The street's own toast is centred again (its enter animation had undone the centring).
+
+Left as found, on purpose: the six readings stay under a building (task 1004526 marks the building's own reading), the old month drawers stay under the desk, and the recording sign-off still goes to its page (an open owner choice).

package/modules/provisioning/manifest-truth.js

@@ -0,0 +1,63 @@
+'use strict';
+
+// modules/provisioning/manifest-truth.js — what the wizard is told about the GitHub
+// sign-in leg (the GitHub-App-Manifest handshake, ADR 0133), at every stage.
+//
+// WHY (task 1004572, live on 2026-10-04). A founder setting up a project saw
+// "Waiting for your approval on GitHub…" while the platform was already placing
+// credentials, then "GitHub setup didn't start. Nothing was changed on GitHub" after
+// GitHub HAD created an app on their account, and — once a setup link lapsed — no
+// button at all, forever, because nothing ever flips a lapsed 'pending' row.
+// These helpers make the read surface say what is actually true. PURE: no DB, no
+// network; split out because provisioning.js sits at the 1500-line ratchet.
+
+// The status a manifest row MEANS right now. Only 'pending' decays: past expires_at
+// the callback refuses its code (attachManifestCode's TTL guard in SQL), so a lapsed
+// 'pending' row is expired in every sense but the column.
+function effectiveManifestStatus(row, now = Date.now()) {
+  const status = String((row && row.status) || '');
+  if (status === 'pending' && row.expires_at && new Date(row.expires_at).getTime() <= now) return 'expired';
+  return status;
+}
+
+// How far a FAILED attempt got, as a closed vocabulary the wizard turns into a
+// sentence. The raw last_error never leaves the server (the status route is public
+// by state token). Read from the row's shape, never from error-message text:
+//   'not_approved'        — the runner never picked it up (attempts 0): nothing we
+//                           know of happened on GitHub's side.
+//   'sign_in_unconfirmed' — GitHub handed over the credentials (the App's slug is
+//                           recorded) and they were placed, but the project never
+//                           confirmed sign-in works. An App exists on the founder's
+//                           account, so "try again" makes a second one.
+//   'finish_failed'       — GitHub approved, but turning that into credentials on
+//                           the project failed before the App was recorded.
+const MANIFEST_FAILURES = Object.freeze(['not_approved', 'sign_in_unconfirmed', 'finish_failed']);
+
+function manifestFailure(row) {
+  if (!row || !(Number(row.attempts) > 0)) return 'not_approved';
+  if (row.app_slug) return 'sign_in_unconfirmed';
+  return 'finish_failed';
+}
+
+// The GitHub-App manifest leg's truth for an instance, as the instance read carries
+// it (task 1003235): the latest attempt's lifecycle status + the App's public slug,
+// in the same vocabulary as GET /github-app/status ('pending' | 'code_received' |
+// 'converting' | 'done' | 'error' | 'expired'), so the wizard can seed `live.manifest`
+// after a reload, a second tab, or another device. null = no attempt ever made.
+//   status     — the EFFECTIVE status (above).
+//   failure    — on 'error' only, how far it got (above); null otherwise.
+//   started_at — when the setup link was minted, so a reloaded page can still offer
+//                "start again" once the wait has clearly gone wrong.
+// An allow-list projection of the row, never the row itself (it holds GitHub's code).
+function publicGithubApp(manifestRow, now = Date.now()) {
+  if (!manifestRow || !manifestRow.status) return null;
+  const status = effectiveManifestStatus(manifestRow, now);
+  return {
+    status,
+    app_slug: manifestRow.app_slug || null,
+    failure: status === 'error' ? manifestFailure(manifestRow) : null,
+    started_at: manifestRow.created_at ? new Date(manifestRow.created_at).toISOString() : null,
+  };
+}
+
+module.exports = { effectiveManifestStatus, manifestFailure, publicGithubApp, MANIFEST_FAILURES };

package/modules/provisioning/provisioning.js

@@ -477,17 +477,9 @@ function publicInstance(row) {
   };
 }
 
-// The GitHub-App manifest leg's truth for an instance, as the read surface carries
-// it (task 1003235): the latest attempt's lifecycle status + the App's public slug.
-// Same vocabulary as GET /github-app/status ('pending' | 'code_received' |
-// 'converting' | 'done' | 'error' | 'expired'), so the wizard can seed its
-// `live.manifest` from a plain instance read after a reload, a second tab, or
-// another device — no sessionStorage bridge needed. null = no attempt ever made.
-// PURE: an allow-list projection of the manifest row, never the row itself.
-function publicGithubApp(manifestRow) {
-  if (!manifestRow || !manifestRow.status) return null;
-  return { status: String(manifestRow.status), app_slug: manifestRow.app_slug || null };
-}
+// The GitHub-App manifest leg's truth as the read surface carries it (task 1003235;
+// task 1004572 made it tell the truth at every stage) — moved to manifest-truth.js.
+const { publicGithubApp } = require('./manifest-truth');
 
 // The env variables that carry this instance's settings, as the instance reads
 // them: { <PREFIX>_PLATFORM_VISIBILITY, <PREFIX>_JOINABILITY } (task 1003139 /

package/modules/provisioning/routes/provisioning.js

@@ -1405,10 +1405,12 @@ module.exports = function provisioningRoutes() {
       const row = await provisioning.getOAuthManifestByState(pool, state);
       if (!row) return res.status(404).json({ ok: false, error: 'unknown_state' });
       const inst = await provisioning.getInstanceById(pool, row.instance_id).catch(() => null);
-      const status = row.status;
+      // EFFECTIVE status + how far a failure got (task 1004572, manifest-truth.js)
+      const { status, failure } = provisioning.publicGithubApp(row);
       return res.json({
         ok: true,
         status,
+        failure,
         ready: status === 'done',
         terminal: status === 'done' || status === 'error' || status === 'expired',
         domain: inst && inst.domain ? inst.domain : null,

package/modules/public-landing/public/projects.html

@@ -6533,7 +6533,7 @@ summary{min-height:24px;padding:3px 0;}
       return '<a href="' + (instanceId ? '?view=manage&id=' + encodeURIComponent(instanceId) : '?view=mine') +
         '">' + label + '</a>';
     }
-    var live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
+    var live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null };
     var planPromises = {};             /* mode|domain → Promise<steps[]> */
     var lastStepsHtml = '';
     var lastProgHtml = '';            /* same change-only contract, for the progress strip */
@@ -6654,14 +6654,24 @@ summary{min-height:24px;padding:3px 0;}
            details (task 1003244). The one refusal a founder can act on — no
            address yet — says where to go instead of what the server said. */
         var snag, raw = '';
+        /* a failure AFTER GitHub's approval left an app on the founder's account,
+           so "nothing was changed" would be false — the server says how far it got
+           (live.manifestFailure, task 1004572) and the words follow it */
         if (live.manifest === 'expired') snag = 'That setup link expired (they last 30 minutes) — mint a fresh one.';
         else if (live.manifestCode === 'domain_required') snag = 'This project needs an address first — attach one from ' + projectPageLink('its own page') + ', then come back to this step.';
+        else if (live.manifestFailure === 'sign_in_unconfirmed') {
+          var appLink = live.appSlug ? '<a href="https://github.com/settings/apps/' + esc(live.appSlug) + '" target="_blank" rel="noopener">your app on GitHub</a>' : 'the app on your GitHub account';
+          return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>GitHub approved the app and the platform placed its credentials on your project, but your project didn’t confirm that sign-in works. Trying again would make a second app on your GitHub account and is unlikely to fix this — it needs a look from the platform team. <a href="/contact">Contact us</a> and mention ' + appLink + '.</p>' +
+            progressMarkup(1, 1, 'Stopped: your project didn’t confirm sign-in.', 'isErr', 'signin') +
+            '<button type="button" class="linklike" data-action="manifest-start">Try again anyway</button></li>';
+        }
+        else if (live.manifestFailure === 'finish_failed') snag = 'GitHub approved the app, but the platform couldn’t finish setting up sign-in on your project. The app GitHub made is still on your account — delete it first (GitHub → Settings → Developer settings → GitHub Apps) so you don’t end up with two, then try again.';
         else { snag = 'GitHub setup didn’t start. Nothing was changed on GitHub — try again.'; raw = live.manifestMsg; }
         return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>' + snag + '</p>' +
           (raw ? '<details><summary>Technical details</summary><p>' + esc(raw) + '</p></details>' : '') +
           '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
       }
-      if (live.manifest === 'code_received') {
+      if (live.manifest === 'code_received' || live.manifest === 'converting') {
         /* GitHub's half is done — say so, rather than keep telling the founder
            to approve an app they just approved */
         autoOpenArmed = true;
@@ -6670,7 +6680,7 @@ summary{min-height:24px;padding:3px 0;}
       }
       if (live.manifest) {   /* pending — GitHub holds the manifest, nobody has approved it yet */
         autoOpenArmed = true;
-        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Waiting on GitHub — approve the app in the tab that opened. Once approved, the platform places the credentials and verifies sign-in on its own; this step ticks itself.</p>' +
+        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Waiting on GitHub — approve the app in the tab that opened. No GitHub tab? It may have opened behind this window or in another one. Once approved, the platform places the credentials and verifies sign-in on its own; this step ticks itself.</p>' +
           progressMarkup(0, 0, 'Waiting for your approval on GitHub…', '', 'signin') + autoOpenTick() +
           (manifestStale ? '<button type="button" class="linklike" data-action="manifest-start">Didn’t get to GitHub? Start the setup again</button>' : '') + '</li>';
       }
@@ -6889,7 +6899,7 @@ summary{min-height:24px;padding:3px 0;}
         inp.type = 'hidden'; inp.name = 'manifest'; inp.value = JSON.stringify(d.manifest);
         form.appendChild(inp); document.body.appendChild(form);
         form.submit(); form.remove();
-        live.manifest = 'pending'; live.manifestMsg = '';
+        live.manifest = 'pending'; live.manifestMsg = ''; live.manifestFailure = null;
         manifestStartedAt = Date.now(); manifestStale = false;
         rememberManifest(d.state, 'pending');
         renderSteps();
@@ -6897,12 +6907,21 @@ summary{min-height:24px;padding:3px 0;}
       }).catch(function (err) {
         if (String(err && err.message) === 'signing in') return;
         if (tab) { try { tab.close(); } catch (e) {} }
-        live.manifest = 'error'; live.manifestMsg = String((err && err.message) || 'could not start');
+        live.manifest = 'error'; live.manifestFailure = null; live.manifestMsg = String((err && err.message) || 'could not start');
         live.manifestCode = String((err && err.code) || '');
         renderSteps();
       });
     }
 
+    /* the "start again" offer once a wait has clearly gone wrong — measured from
+       when the link was MINTED (the server's started_at after a reload), so a
+       reloaded page offers it too instead of never (task 1004572) */
+    function manifestInFlight() {
+      return live.manifest === 'pending' || live.manifest === 'code_received' || live.manifest === 'converting';
+    }
+    function noteManifestWait() {
+      if (live.manifest === 'pending' && !manifestStale && manifestStartedAt && (Date.now() - manifestStartedAt) > 90000) { manifestStale = true; renderSteps(); }
+    }
     function pollManifest(stateToken) {
       stopManifestPoll();
       manifestState = stateToken;
@@ -6916,8 +6935,9 @@ summary{min-height:24px;padding:3px 0;}
             if (myGen !== manifestGen) return;
             if (d.app_slug && d.app_slug !== live.appSlug) { live.appSlug = d.app_slug; rememberManifest(undefined, undefined, d.app_slug); renderSteps(); }
             var next = d.ready ? 'done' : (d.status || 'pending');
-            if (next !== live.manifest) { live.manifest = next; rememberManifest(undefined, next); renderSteps(); }
-            else if (next === 'pending' && !manifestStale && manifestStartedAt && (Date.now() - manifestStartedAt) > 90000) { manifestStale = true; renderSteps(); }
+            var failure = d.failure || null;
+            if (next !== live.manifest || failure !== live.manifestFailure) { live.manifest = next; live.manifestFailure = failure; rememberManifest(undefined, next); renderSteps(); }
+            else noteManifestWait();
             if (!d.terminal) manifestPollTimer = setTimeout(tick, 4000);
             else manifestPollTimer = null;   /* a stale fired id would read as "still polling" and resume a finished poll */
           })
@@ -7119,10 +7139,15 @@ summary{min-height:24px;padding:3px 0;}
             var ga = data.github_app;
             if (ga && ga.status && !manifestPollTimer) {
               var seeded = ga.status === 'done' ? 'done' : ga.status;
-              var seedChanged = seeded !== live.manifest || (!!ga.app_slug && ga.app_slug !== live.appSlug);
+              var seedFailure = ga.failure || null;
+              var seedChanged = seeded !== live.manifest || seedFailure !== live.manifestFailure || (!!ga.app_slug && ga.app_slug !== live.appSlug);
               if (ga.app_slug) live.appSlug = ga.app_slug;
-              live.manifest = seeded;
+              live.manifest = seeded; live.manifestFailure = seedFailure;
+              /* the wait is timed from when the link was MINTED, so a reload still
+                 reaches the "start again" offer (task 1004572) */
+              if (!manifestStartedAt && ga.started_at) manifestStartedAt = Date.parse(ga.started_at) || 0;
               if (seedChanged) { rememberManifest(undefined, live.manifest, live.appSlug || undefined); renderSteps(); }
+              else noteManifestWait();
             }
             /* the checklist reflects live state (task 1002694): a status transition —
                e.g. the scaffold landing — re-renders the steps (change-only, so the
@@ -7131,7 +7156,9 @@ summary{min-height:24px;padding:3px 0;}
               live.instStatus = inst.status; live.addrReady = addressReady(inst); renderSteps();
             }
             var terminal = renderProgress(inst);
-            if (!terminal) pollTimer = setTimeout(tick, 5000);
+            /* a GitHub leg still in flight keeps this read alive even once the
+               project is up — after a reload it is the ONLY thing watching it */
+            if (!terminal || manifestInFlight()) pollTimer = setTimeout(tick, 5000);
             else stopPolling();
           })
           .catch(function (err) {
@@ -7160,7 +7187,7 @@ summary{min-height:24px;padding:3px 0;}
       instanceId = null;
       watchPending = false; manifestPending = false; manifestState = null;
       manifestStartedAt = 0; manifestStale = false;
-      live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
+      live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null };
       lastStepsHtml = '';
       lastProgHtml = '';
       try { sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.45",
+  "version": "1.21.47",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.45",
+      "version": "1.21.47",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.45",
+  "version": "1.21.47",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9034,5 +9034,17 @@
       "id": "1004497",
       "text": "Artists can now edit any hall page's words right where they stand. In Artistry mode, \"Edit words\" offers to take the page; the words get an underline and can be typed over, a review lists each change as was/now, and \"Send for"
     }
+  ],
+  "1.21.46": [
+    {
+      "id": "1004572",
+      "text": "Setting up GitHub sign-in for a new project now says what is really happening at each step, and always leaves a way forward if it gets stuck."
+    }
+  ],
+  "1.21.47": [
+    {
+      "id": "1004562",
+      "text": "Walked every building and floor desk of the Governor City in light, dark and on a phone, and fixed what did not match the design: number tiles now say what they count, a cleared floor no longer shows a stale count, counts read"
+    }
   ]
 }

package/scripts/gds/provision.js

@@ -1095,7 +1095,9 @@ async function placeManifestCreds(inst, mrow, deps) {
       await sleep(MANIFEST_VERIFY_INTERVAL_MS);
     }
     if (!authConfigured) {
-      return { ok: false, codeSpent: true, error: 'the credentials are placed, but the project did not report sign-in ready in time' };
+      // The App now EXISTS on the owner's account — keep its id + slug on the row so
+      // the wizard can name it and say why "try again" makes a second one (task 1004572).
+      return { ok: false, codeSpent: true, appId: creds.appId, appSlug: creds.appSlug, error: 'the credentials are placed, but the project did not report sign-in ready in time' };
     }
     log('  [oauth-manifest] ✓ /healthz auth_configured=true — sign-in is live');
   } else {
@@ -1147,7 +1149,7 @@ async function drainOAuthManifests(deps) {
         // single-use, so resetting the row to 'code_received' guarantees the
         // next tick re-converts a burned code and 404s forever. Only failures
         // that happened BEFORE the conversion stay retryable.
-        if (result.codeSpent) await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: result.error, github_code: null });
+        if (result.codeSpent) await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: result.error, github_code: null, ...(result.appSlug ? { app_id: result.appId, app_slug: result.appSlug } : {}) });
         else if (mrow.attempts >= MAX_INTENT_ATTEMPTS) await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: result.error });
         else await provisioning.resolveOAuthManifest(db, mrow.id, 'code_received', { last_error: result.error });
         errors++; log(`  ✖ oauth-manifest #${mrow.id}: ${result.error}`);

package/src/bongos/routes/auth.js

@@ -127,6 +127,19 @@ function renderAuthErrorPage(heading, detail, opts = {}) {
 </body></html>`;
 }
 
+// The project has no way to sign anyone in yet: neither its own GitHub app nor
+// sign-in through the platform (task 1004572). It used to answer a bare 503
+// "auth not configured", which told a founder mid-setup nothing they could act on.
+// Still a 503 — the service genuinely is not available — but in words, and
+// pointing the one person who can fix it at the step that does.
+const AUTH_NOT_CONFIGURED_DETAIL = "Sign-in isn't set up on this project yet. If it's your project, go back to its setup checklist on the platform where you created it and finish the \"Wire GitHub sign-in\" step. Otherwise, ask the project's owner.";
+function sendAuthNotConfigured(res) {
+  return res.status(503).type('text/html').send(renderAuthErrorPage(
+    "Sign-in isn't set up yet", AUTH_NOT_CONFIGURED_DETAIL,
+    { subtitle: "This project can't sign anyone in yet.", cta: { href: '/', label: 'Back to the project' }, note: 'Nothing is wrong with your account.' },
+  ));
+}
+
 // renderAccessPendingPage — the calm "hang tight" page shown instead of the red
 // dead-end when admission is plausibly imminent (task 1002097): the configured
 // firstAdmin during the bootstrap window, or a login with a pending request.
@@ -681,7 +694,7 @@ module.exports = function buildAuthRouter() {
     // Either direct-GitHub creds OR platform-IdP federation must be configured
     // (ADR 0141 §1) — a federated instance has no GitHub app of its own.
     if (!auth.authConfigured() && !auth.idpConfigured()) {
-      return res.status(503).type('text/plain').send('auth not configured');
+      return sendAuthNotConfigured(res);
     }
     const wantsRepos = req.query.repos === '1' || req.query.repos === 'true';
     // A sign-in begun on a satellite hub host (builders./status.) restarts on
@@ -842,7 +855,7 @@ module.exports = function buildAuthRouter() {
   // rank: public — OAuth callback; the state cookie + code are the bearer.
   router.get('/auth/web/callback', async (req, res) => {
     if (!auth.authConfigured() && !auth.idpConfigured()) {
-      return res.status(503).type('text/plain').send('auth not configured');
+      return sendAuthNotConfigured(res);
     }
     const expectedState = parseCookie(req, STATE_COOKIE) || parseCookie(req, STATE_COOKIE_LEGACY);
     const { state, code, error } = req.query;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.45'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.47'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');