@bongos/core 1.21.94 → 1.21.95

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.94",
-  "core_contract": "1.21.94",
-  "source_commit": "04eb025dc97e59ea5197b03ace52613f7c994568",
+  "core_version": "1.21.95",
+  "core_contract": "1.21.95",
+  "source_commit": "1895cbf114f5a8932e751d9208a592dfbbf99ff8",
   "source_ref": "HEAD",
-  "built_at": "2026-10-09T07:52:21.563Z",
+  "built_at": "2026-10-09T08:47:23.210Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 590,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3012,
+    "functional_verbatim": 3013,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3631,
-  "tree_sha256": "8388b6818944b7acc6215a9cd5b9f18ba7dc84a7afdeffecd68793d74bdbcd21",
+  "file_count": 3632,
+  "tree_sha256": "82e713c766d3a2684a614b15ca98c09c047238193da0dc6be4ab5f95b9dbb975",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -312,12 +312,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "2d0587d4dc0cc403c9cf13d907dba3532cf5db972a0203e2bd3c15ae5e723f19"
+      "sha256": "ddef69b1dc2ff76269e9f84955ca554ec70f1f18aeb502e408bf20920f694669"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "6f18acc228869c7c96dfaf533ceef9d76d56736a9d576e7b55ee5dcc0e65d158"
+      "sha256": "35ac01d598a9ba76e928f115f5de99e952128d37de311e3bab548d9a74bfe53a"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -327,17 +327,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "901215b9d2a3119b36e58087fa6657a0869c7a06d78cd5e088210f5e091e8bd8"
+      "sha256": "0793d04a2a43eef50144bc607927c7b3560af4948877926edf24aa3d781e7323"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "4eae2c37e7ff4af282a4b397535ca59b8cc38c90cf42a99d62e417ffa0abdc69"
+      "sha256": "c4708244379cd28709caf48d817266b184ffe18a65f9590bc62c2b1aeb71d824"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "728ec9a7b74aa8f775a3d3355694ad240f6a7a5180bb045a986c1d5f84518303"
+      "sha256": "e143421ec34b742f29a21690b81ed8fdf2b01a7c87d380fcea43a56dbba42465"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2317,12 +2317,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "9040a7fc570772b0d28d0db07fa603b31647a1958bdc2cf98b787992e189596b"
+      "sha256": "3b3f6ed65d2c90fa08c7a2000862c7c9ffd8b7625420f377b52d132d9b17d8d3"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "8ff2cb4c702848e15e2baf0e92ef055a9bd060d10ebd0991f3d6ee131a399c9f"
+      "sha256": "8704ce350de56a1b955a41296cb7fa053128d2b4fc8a76e156a4e8578afef6a3"
     },
     {
       "path": "docs/architecture.md",
@@ -2432,7 +2432,7 @@
     {
       "path": "docs/design/project-startup-direction.md",
       "mode": "0000644",
-      "sha256": "1948e880f19c1bb2ee973e816455449c0170acee2c59bc070054760bc32ae867"
+      "sha256": "1fc48632ac7af6d55bc62cf0207affb597956c2243febe1faa0b39e22bdef829"
     },
     {
       "path": "docs/design/projects-hub-direction-v2.md",
@@ -2862,7 +2862,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "68fbc54195d7fb5acd38c28fc5690b3e62fad65b18daa5530fadf3fc86ad4ff4"
+      "sha256": "4b50f866b73e605791b602d3d0dd212aeebc0b406f1f8579a8f3f4625fb9a8f2"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2952,7 +2952,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "156f2ba353e667857b5573f4ba333af3796dea1d1042e5faa35316369e3aa114"
+      "sha256": "998e448cf903b275a9c44c0f326197963e83929626cce5dc506e980148690b98"
     },
     {
       "path": "docs/project-context.template.md",
@@ -8552,7 +8552,7 @@
     {
       "path": "modules/provisioning/routes/callback-page.js",
       "mode": "0000644",
-      "sha256": "b81fa153fe693e8a734d028f67cab629e2b90a148bffbd92cd9023e29428a558"
+      "sha256": "a84b6fce647c0902e7c90f5c85185d8ca2939d49fb67650bcca013eed3c90daa"
     },
     {
       "path": "modules/provisioning/routes/core-upgrade.js",
@@ -8577,7 +8577,7 @@
     {
       "path": "modules/provisioning/routes/github-setup.js",
       "mode": "0000644",
-      "sha256": "ba653473e0a1fa0b4e5a62308de8be9a2a8a1d1b4f838bf9dafd8508429e9da8"
+      "sha256": "652c1aafba1e38ae46b02b54d3e6cfa8c18a0ceadcf8a94ea67d664d773cce85"
     },
     {
       "path": "modules/provisioning/routes/look.js",
@@ -9337,7 +9337,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "f461704616f4b6a4c50dd1b8da5441a12786268b26fab1e31c941720abb82bc4"
+      "sha256": "99b6553bb9756a91713c0842510d0dc8545111d0366fd59237968df21e69bf99"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -10117,12 +10117,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7998607661e397160f9bbed3c39e5d25a1f8e339a33e1583b7d8c7b61fcd981b"
+      "sha256": "8a3f6a8660b0f20118070b8adaad21cbbd3866e6a272720b94c2719fafe53b77"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e12d7b166a78fcf82c456218fa12967a566f73a5c2d919708e6b504c0143a789"
+      "sha256": "256622b8d3de980cdb9dc368b115d0259af8e192f43d3757fcbc399ea053b00b"
     },
     {
       "path": "public-docs/index.html",
@@ -10142,7 +10142,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "2f02fecacd57c662ec2439823135a4ae81bdf1535da9e2538550e9c929f68d60"
+      "sha256": "f0933c625fe42e498bad837a26383cbd38181bb7dba0f02d33457789fdbac345"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12412,7 +12412,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3f71efbd68543de424e2d6eea488e0f6167890b28bfbd99f936a22f89a37268e"
+      "sha256": "5cabb78f9a62e76cbe3b084a14f0f4a50c5dc73b9c359cded8b13c64c5158f38"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14034,6 +14034,11 @@
       "mode": "0000644",
       "sha256": "79208b90f1b785af56ab057c858e96cea4e67ebf247858457addedce55e71b06"
     },
+    {
+      "path": "tests/github_handback_any_device.mjs",
+      "mode": "0000644",
+      "sha256": "7c264331e939bda95029e4448534734a236a59c7b46e44e34bed7a0f13577cd3"
+    },
     {
       "path": "tests/github_one_trip.mjs",
       "mode": "0000644",
@@ -16392,7 +16397,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "635f36dc6f0134a901307d58f6706a864c31fcf1f0950c9f8cbcf434163b928d"
+      "sha256": "2183ec464cc6ab88d95bb7416a75aef72b674e05677cc6698e4dcb50fde366fb"
     },
     {
       "path": "tests/projects_hub_app_status.mjs",
@@ -16532,7 +16537,7 @@
     {
       "path": "tests/provisioning_callback_page.mjs",
       "mode": "0000644",
-      "sha256": "8886fae6d241f2360c5948d9a243821d6ac20d0021d14ea6477ebf0651e4a712"
+      "sha256": "464edbf5d2095148cf2bc37af1abc22b228eeaf5bd25f39d5d604bae10778688"
     },
     {
       "path": "tests/provisioning_capacity.mjs",
@@ -16592,7 +16597,7 @@
     {
       "path": "tests/provisioning_github_app_routes.mjs",
       "mode": "0000644",
-      "sha256": "e80789df044437fa96306063343889e9378e337b7753e208ae9cea86c28ea457"
+      "sha256": "c8969d3782cbc6d9b3b4c776cdf8c3f2e0bc5282d6cb7af3a82c5164034416a1"
     },
     {
       "path": "tests/provisioning_look.mjs",
@@ -18092,7 +18097,7 @@
     {
       "path": "tests/wizard_draft_resume.mjs",
       "mode": "0000644",
-      "sha256": "df40c0f2dfae806de973b782e9f693353801881659a39de88ef008de16b9905c"
+      "sha256": "0d87008084384aad7592579f3b9f3e4476e5af12fa7826d1dd77f995b33319b4"
     },
     {
       "path": "tests/wizard_front_door.mjs",
@@ -18102,7 +18107,7 @@
     {
       "path": "tests/wizard_github_feedback.mjs",
       "mode": "0000644",
-      "sha256": "0e9aae041edc457202b40ae2228720fcf99a60c6ad0dfd82ad76302e077fd7f0"
+      "sha256": "153932c97b0cfb95c01c19787d7543ce80efe2ef8a8ab813e67c0376b4eb508b"
     },
     {
       "path": "tests/wizard_intent_resume.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 534 operations across 76 resource groups
+- 536 operations across 76 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -895,6 +895,10 @@ function createClient(opts = {}) {
       getProvisioningFleetCostLedger: (args) => request("GET", "/provisioning/fleet/cost-ledger", { hasBody: false }, args),
       // GET /provisioning/github-app/callback — rank: public — GET /provisioning/github-app/callback
       getProvisioningGithubAppCallback: (args) => request("GET", "/provisioning/github-app/callback", { hasBody: false }, args),
+      // GET /provisioning/github-app/resume — rank: any-builder — GET /provisioning/github-app/resume
+      getProvisioningGithubAppResume: (args) => request("GET", "/provisioning/github-app/resume", { hasBody: false }, args),
+      // GET /provisioning/github-app/return — rank: public — GET /provisioning/github-app/return
+      getProvisioningGithubAppReturn: (args) => request("GET", "/provisioning/github-app/return", { hasBody: false }, args),
       // GET /provisioning/github-app/setup — rank: public — GET /provisioning/github-app/setup
       getProvisioningGithubAppSetup: (args) => request("GET", "/provisioning/github-app/setup", { hasBody: false }, args),
       // GET /provisioning/github-app/status — rank: public — GET /provisioning/github-app/status

package/clients/bongos-client/index.cjs

@@ -894,6 +894,10 @@ function createClient(opts = {}) {
       getProvisioningFleetCostLedger: (args) => request("GET", "/provisioning/fleet/cost-ledger", { hasBody: false }, args),
       // GET /provisioning/github-app/callback — rank: public — GET /provisioning/github-app/callback
       getProvisioningGithubAppCallback: (args) => request("GET", "/provisioning/github-app/callback", { hasBody: false }, args),
+      // GET /provisioning/github-app/resume — rank: any-builder — GET /provisioning/github-app/resume
+      getProvisioningGithubAppResume: (args) => request("GET", "/provisioning/github-app/resume", { hasBody: false }, args),
+      // GET /provisioning/github-app/return — rank: public — GET /provisioning/github-app/return
+      getProvisioningGithubAppReturn: (args) => request("GET", "/provisioning/github-app/return", { hasBody: false }, args),
       // GET /provisioning/github-app/setup — rank: public — GET /provisioning/github-app/setup
       getProvisioningGithubAppSetup: (args) => request("GET", "/provisioning/github-app/setup", { hasBody: false }, args),
       // GET /provisioning/github-app/status — rank: public — GET /provisioning/github-app/status

package/clients/bongos-client/index.d.ts

@@ -132,6 +132,7 @@ export interface GetProjectSettingsShipModeResponse { mode: unknown; chosen: unk
 export interface GetProjectsFeaturedResponse { projects: unknown; page: PageInfo }
 export interface GetProjectsResponse { projects: unknown }
 export interface GetProvisioningFleetResponse { instances: unknown; capacity: unknown }
+export interface GetProvisioningGithubAppResumeResponse { ok: boolean; project: unknown }
 export interface GetProvisioningGithubAppStatusResponse { ok: boolean; status: unknown; failure: unknown; ready: unknown; terminal: unknown; domain: unknown; instance_status: unknown; app_slug: unknown; checklist: unknown; install_url: unknown; repo: unknown; verifying: unknown }
 export interface GetProvisioningHealthResponse { module: unknown; ok: boolean; coreVersion: unknown }
 export interface GetProvisioningInstancesIdEnvManifestResponse { instance: unknown; env_vars: unknown; environments: unknown; values_held: boolean; note: unknown }
@@ -1402,6 +1403,10 @@ export interface BongosClient {
     getProvisioningFleetCostLedger(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /provisioning/github-app/callback — rank: public */
     getProvisioningGithubAppCallback(args?: RequestArgs): Promise<ApiResponse>;
+    /** GET /provisioning/github-app/resume — rank: any-builder */
+    getProvisioningGithubAppResume(args?: RequestArgs): Promise<GetProvisioningGithubAppResumeResponse>;
+    /** GET /provisioning/github-app/return — rank: public */
+    getProvisioningGithubAppReturn(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /provisioning/github-app/setup — rank: public */
     getProvisioningGithubAppSetup(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /provisioning/github-app/status — rank: public */

package/clients/bongos-client/index.mjs

@@ -891,6 +891,10 @@ export function createClient(opts = {}) {
       getProvisioningFleetCostLedger: (args) => request("GET", "/provisioning/fleet/cost-ledger", { hasBody: false }, args),
       // GET /provisioning/github-app/callback — rank: public — GET /provisioning/github-app/callback
       getProvisioningGithubAppCallback: (args) => request("GET", "/provisioning/github-app/callback", { hasBody: false }, args),
+      // GET /provisioning/github-app/resume — rank: any-builder — GET /provisioning/github-app/resume
+      getProvisioningGithubAppResume: (args) => request("GET", "/provisioning/github-app/resume", { hasBody: false }, args),
+      // GET /provisioning/github-app/return — rank: public — GET /provisioning/github-app/return
+      getProvisioningGithubAppReturn: (args) => request("GET", "/provisioning/github-app/return", { hasBody: false }, args),
       // GET /provisioning/github-app/setup — rank: public — GET /provisioning/github-app/setup
       getProvisioningGithubAppSetup: (args) => request("GET", "/provisioning/github-app/setup", { hasBody: false }, args),
       // GET /provisioning/github-app/status — rank: public — GET /provisioning/github-app/status

package/docs/api/openapi.json

@@ -16460,6 +16460,65 @@
         "security": []
       }
     },
+    "/provisioning/github-app/resume": {
+      "get": {
+        "operationId": "get_provisioning_github_app_resume",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "GET /provisioning/github-app/resume",
+        "description": "GET /provisioning/github-app/resume[?id=<n>] — the project page's \"which project am I connecting?\" read when its tab remembers nothing (task 1004650): a hand-back on another device, a fresh tab, a cleared browser. With an id: that project, if the caller owns it. Without: the caller's newest project whose GitHub checklist is not connected yet, made or last tried within a week — so opening the create page later resumes part 03 from the server's view. Either way { project: null } when there is none; never the state token. rank: any authenticated builder (requireBuilder), own projects only — no Archon override.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/provisioning/routes/github-setup.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProvisioningGithubAppResumeResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/provisioning/github-app/return": {
+      "get": {
+        "operationId": "get_provisioning_github_app_return",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "GET /provisioning/github-app/return",
+        "description": "GET /provisioning/github-app/return?state=<> — where the callback and setup pages send the founder back (task 1004650). The SERVER resolves the one-time state to the project it was minted for and 302s that project's signed-in OWNER to its part 03 (/projects?view=new&id=<id>), so the hand-back works from any tab, window or device — nothing in browser storage is read. Not signed in → through the web sign-in and back here. Signed in as anyone else, an unknown or malformed state, or a gone project → one refusal page that names no project (no oracle about which). The state stays single-use where it matters: only the manifest callback's code exchange consumes it, and this route changes nothing — it reveals a project's page only to the person who already owns it. rank: public — as a GATE: it is a browser redirect, so no middleware 401s a signed-out visitor (they are sent through sign-in instead). WHO lands is decided in-handler from the live session: the project's own owner, no Archon override, and nobody else ever learns which project the state names. It reveals no secret and writes nothing.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/provisioning/routes/github-setup.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
     "/provisioning/github-app/setup": {
       "get": {
         "operationId": "get_provisioning_github_app_setup",
@@ -26773,6 +26832,19 @@
           "capacity"
         ]
       },
+      "GetProvisioningGithubAppResumeResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "project": {}
+        },
+        "required": [
+          "ok",
+          "project"
+        ]
+      },
       "GetProvisioningGithubAppStatusResponse": {
         "type": "object",
         "properties": {
@@ -34253,9 +34325,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 534,
-  "x-schema-count": 574,
+  "x-endpoint-count": 536,
+  "x-schema-count": 575,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 380,
+  "x-response-schemas": 381,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 534 endpoints across 95 route files.
+> **Generated from the live route files** — the route file is authoritative. 536 endpoints across 95 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -636,7 +636,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/projects/invite` | `metic+archon` | `client_id`, `github_login` | own-or-metic in effect: where to invite a builder into a project, asked by a `project.curate` holder OR the project's OWN OWNER (task 100… |
 | POST | `/api/bongos/projects/invite-guild` | `metic+archon` | `client_id`, `guild` | own-or-metic in effect, the SAME gate as POST /projects/invite above and for the same reasons (a non-inviter gets that route's unchanged … |
 
-## `provisioning` (43)
+## `provisioning` (45)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -644,6 +644,8 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/provisioning/fleet` | `metic+archon` | — | GET /provisioning/fleet — the full instance roster across all owners. |
 | GET | `/api/bongos/provisioning/fleet/cost-ledger` | `metic+archon` | — | GET /provisioning/fleet/cost-ledger — per-instance monthly cost to us + estimated cost to its owner, with totals. |
 | GET | `/api/bongos/provisioning/github-app/callback` | `public` | — | GET /provisioning/github-app/callback?code=&state= — GitHub redirects the owner's BROWSER here after they approve the App Manifest (task … |
+| GET | `/api/bongos/provisioning/github-app/resume` | `any-builder` | — | GET /provisioning/github-app/resume[?id=<n>] — the project page's "which project am I connecting?" read when its tab remembers nothing (t… |
+| GET | `/api/bongos/provisioning/github-app/return` | `public` | — | GET /provisioning/github-app/return?state=<> — where the callback and setup pages send the founder back (task 1004650). |
 | GET | `/api/bongos/provisioning/github-app/setup` | `public` | — | GET /provisioning/github-app/setup?installation_id=&setup_action=&state= — the App's setup_url (task 1004649). |
 | GET | `/api/bongos/provisioning/github-app/status` | `public` | — | GET /provisioning/github-app/status?state=<> — the PUBLIC progress read (task 1004548; the checklist since task 1004649). |
 | GET | `/api/bongos/provisioning/health` | `public` | — | GET /provisioning/health — liveness + the core version this module mounted against. |

package/docs/design/project-startup-direction.md

@@ -59,7 +59,15 @@ This table replaces the blended flow's table below for every hub-side capability
 - **The trip.** "Connect GitHub ↗" posts the app manifest to GitHub. The manifest now carries a `setup_url` (the hub's `/provisioning/github-app/setup`). After the approval GitHub returns to the manifest callback, which waits until the runner has placed the app's keys and recorded its name, then sends the same tab straight to `github.com/apps/<app>/installations/new`. When GitHub will describe the repo to an anonymous caller (a public repo), the link is narrowed with `/permissions?suggested_target_id=<owner id>&repository_ids[]=<repo id>`, so the founder only has to confirm. After the install, GitHub sends them to the `setup_url` with the attempt's `state`, and that page hands them back to the checklist.
 - **The ticks are server facts, never clicks.** *Approve*: GitHub made the app and the runner placed its keys (the slug is recorded only after the placement write). *Install*: the runner asks GitHub `GET /repos/{owner}/{repo}/installation`, signed as the app with the app's own key. The `installation_id` GitHub appends to the `setup_url` is never trusted, because GitHub's docs warn it can be spoofed; it only makes the runner look again. *Builders can sign in*: the runner saw `auth_configured` on the project's `/api/bongos/healthz`. The root `/healthz` answers a plain "ok", and reading that one is why every setup used to be recorded as failed (task 1004577). *Command-line sign-in*: the runner starts a device sign-in with the app's client id, and GitHub does not refuse it with `device_flow_disabled`. The facts are rows in `provisioning_events`, so no new column was needed. The checklist is derived in `modules/provisioning/github-setup.js`; the runner's check is `scripts/gds/provision-github-setup.js`.
 - **Device flow cannot be switched on for the founder (spike, task 1004649).** GitHub's manifest parameters are `name`, `url`, `hook_attributes`, `redirect_url`, `callback_urls`, `setup_url`, `setup_on_update`, `request_oauth_on_install`, `public`, `default_permissions`, `default_events` and `description`, and none of them is device flow. The REST API for apps (`/app`, `/app/installations…`, `/app-manifests/{code}/conversions`) has no endpoint that changes an app's registration. GitHub's own guide says device flow has to be enabled in the app's settings first. So the fourth step is **optional**: it reads "Optional — turn it on later" with a link to the app's settings, ticks itself when the runner sees it on, and never holds back "connected" or "is alive". Web sign-in works without it, and the CLI falls back to a web token meanwhile (`scripts/gds/device-flow-help.js`).
-- **Left as seams for the sibling tasks.** The hand-back from any tab or device, and checking while the page is hidden (task 1004650). The page already re-learns the checklist from the owner's instance read (`github_setup`), and that read never carries the state token. A personal or an organisation account (task 1004651). Resuming a stopped step, and a fixing button for every failure, including "check again" after the runner's two-hour window (task 1004652).
+- **Left as seams for the sibling tasks.** The hand-back from any tab or device, and checking while the page is hidden (task 1004650, built: see below). The page already re-learns the checklist from the owner's instance read (`github_setup`), and that read never carries the state token. A personal or an organisation account (task 1004651). Resuming a stopped step, and a fixing button for every failure, including "check again" after the runner's two-hour window (task 1004652).
+
+### Coming back from any tab or device, as built (task 1004650)
+
+- **The server names the project.** The callback page and the setup page no longer send the founder to `/projects?view=new#ghstate=…` and trust the tab to know which project that was. They send them to `/api/bongos/provisioning/github-app/return?state=…`. That route looks the one-time state up, finds the project it was minted for, and, if the person signed in owns that project, sends them to `/projects?view=new&id=<project>#ghstate=…`. Nothing is read from browser storage, so approving on a phone, in another window or in a fresh tab lands on the right project at part 03.
+- **Only the owner lands.** Not signed in: through the web sign-in and back to the same return. Signed in as anyone else, an unknown or malformed state, or a project that is gone: one page that names no project ("This isn't your project"), the same for each case. There is no Archon override here. The state is still used once where it matters: only the manifest callback's code exchange uses it up, and the return route changes nothing.
+- **The page asks the server when its tab cannot say.** `GET /provisioning/github-app/resume?id=<project>` (signed in, own projects only) answers with what part 03 needs: id, slug, address, kind and repo. A hand-back named by the return route always opens that project's part 03. Without an id, the read names the founder's newest project whose GitHub checklist is not connected yet, if it was made or last tried within a week. Opening the create page later then reopens part 03 for it, unless the founder is typing a new project or clicked "New project" (then it is offered on the "still watching" line). "Start another project" sets it down for that tab. The hub's other views are unchanged.
+- **The page keeps checking while hidden.** Both of part 03's polls (the state-keyed checklist and the owner's project read) keep going while the tab is hidden, every 20 seconds instead of every 4 to 5. When the tab is seen again, a waiting check runs at once. They still stop when the founder leaves the create view (C8).
+- **Left for the sibling tasks.** A personal or an organisation account (task 1004651). Picking up a stopped step, and a fixing button for every failure (task 1004652); the resume read already reopens part 03 for a failed attempt, which is where those buttons go.
 
 ### Who builds it
 

package/docs/module-api-changelog.md

@@ -3025,5 +3025,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.92 with no explicit bump. run 37898035856. (task 1002620)
   1.21.94 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.93 with no explicit bump. run 37901444360. (task 1002620)
+  1.21.95 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.94 with no explicit bump. run 37907054923. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -4570,7 +4570,7 @@
       "surface": "landing",
       "title": "{{productName}} — projects",
       "states_read": ["out-map","in-map","in-map-projects","in-map-profile","in-map-kbd","in-map-search","in-map-mine-on","in-table","in-table-by-builders","in-mine","in-manage","in-manage-address","in-manage-planet","in-manage-card","in-manage-look","in-manage-kind","in-manage-invite","in-manage-invite-handoff","in-manage-invite-guild","in-manage-app-live","in-manage-app-building","in-manage-app-failed","in-manage-app-retry","in-manage-app-offer","in-manage-app-connect","in-manage-snag","in-manage-gone","in-manage-missing","out-manage","in-new","in-new-named","in-new-ready","in-new-name-prefilled","in-new-demo","in-new-demo-used","in-new-checks-filled","in-new-checks-entity","in-new-row-code","in-new-row-address","in-new-row-team","in-new-row-extras","in-new-row-rewards","in-new-row-app","in-new-row-run","in-new-row-ship","in-new-look","in-new-look-custom","in-new-create-blocked","in-new-done","in-new-resume-offer","out-new","out-map-projects","card","card-noart","card-self","in-manage-demo","in-mine-dns-pending","in-manage-dns-pending","in-mine-empty","card-floor","card-backdrop","in-new-done-live"],
-      "files_hash": "13e14dbe1b0db933",
+      "files_hash": "8c02f1901e82c185",
       "reading_hash": "5bd7b2d212b112d6",
       "counts": {"lines":1207,"placed":237,"shared":21,"unplaced":949},
       "omitted": {"data":142},

package/modules/provisioning/routes/callback-page.js

@@ -27,6 +27,16 @@ function esc(s) {
   ));
 }
 
+// The way back to the project (task 1004650): the hub's return route, keyed on the attempt's
+// one-time state. The SERVER resolves that state to the project it was minted for and lands
+// its signed-in owner on that project's part 03 (routes/github-setup.js), so the hand-back no
+// longer depends on what the starting tab kept in sessionStorage — approving on a phone or in
+// another window lands on the right project. No state names no project: the projects list.
+const RETURN_PATH = '/api/bongos/provisioning/github-app/return';
+function returnHref(state) {
+  return state ? `${RETURN_PATH}?state=${encodeURIComponent(state)}` : '/projects?view=mine';
+}
+
 // Accent pair resolved from the instance's own branding — the pack is the palette
 // authority (task 1002810); the literal fallbacks are the neutral pack's values, so
 // a branding validation error still paints the current family, never a stale one.
@@ -65,15 +75,15 @@ code{font-family:"Fira Code",ui-monospace,SFMono-Regular,monospace;background:rg
 // page hands them straight back: as the wizard's pop-up it closes itself so the checklist
 // tab is in front again (that tab is already polling the same status and shows the wait);
 // if the browser refuses the close, or this was a same-tab return (pop-up blocked), this
-// tab becomes the checklist. The one-time state rides the URL FRAGMENT — never sent to a
-// server — so a checklist opened here can keep watching the same attempt.
+// tab becomes the checklist. The way back is the return route (returnHref above): the
+// server names the project for the state, so the checklist opened here is the right one
+// whatever this browser remembers (task 1004650).
 // Deliberately contains NO backticks and NO ${...} so it survives the outer template
 // literal verbatim; the only server data it reads is the JSON config block above it.
 const HANDBACK_SCRIPT = `
 (function(){
   var cfg=window.__CB_SETUP__||{};
-  var back=cfg.back||'/projects?view=new';
-  if(cfg.state)back+='#ghstate='+encodeURIComponent(cfg.state);
+  var back=cfg.back||'/projects?view=mine';
   var link=document.getElementById('back');if(link)link.href=back;
   var popup=false;
   try{popup=!!window.opener&&!window.opener.closed;}catch(e){}
@@ -94,8 +104,7 @@ const HANDBACK_SCRIPT = `
 const INSTALL_SCRIPT = `
 (function(){
   var cfg=window.__CB_SETUP__||{};
-  var back=cfg.back||'/projects?view=new';
-  if(cfg.state)back+='#ghstate='+encodeURIComponent(cfg.state);
+  var back=cfg.back||'/projects?view=mine';
   var link=document.getElementById('back');if(link)link.href=back;
   var note=document.getElementById('note');
   var say=function(t){if(note)note.textContent=t;};
@@ -142,7 +151,8 @@ const INSTALL_SCRIPT = `
 //     + `body` (server-authored, trusted HTML).
 function callbackPage({ ok, title, body, state, domain, next }) {
   const handback = !!(ok && state && domain);
-  const cfgJson = JSON.stringify({ state: state || '', domain: domain || '', back: '/projects?view=new' }).replace(/</g, '\\u003c');
+  const back = returnHref(state);
+  const cfgJson = JSON.stringify({ state: state || '', domain: domain || '', back }).replace(/</g, '\\u003c');
   const head = `<!doctype html><html lang="en"><head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="color-scheme" content="light dark">
@@ -157,7 +167,7 @@ function callbackPage({ ok, title, body, state, domain, next }) {
   <h1>${esc(title)}</h1>
   <p class="sub">Next, install it on your repo. Taking you there now.</p>
   <p class="muted" id="note" role="status" aria-live="polite">Waiting for GitHub to hand over the app…</p>
-  <div class="cta"><a class="btn" id="back" href="/projects?view=new">Back to my project</a></div>
+  <div class="cta"><a class="btn" id="back" href="${esc(back)}">Back to my project</a></div>
 </main>
 <script>window.__CB_SETUP__=${cfgJson};</script>
 <script>${INSTALL_SCRIPT}</script>
@@ -169,7 +179,7 @@ function callbackPage({ ok, title, body, state, domain, next }) {
   <div class="badge-warn">✓</div>
   <h1>${esc(title)}</h1>
   <p class="sub">Taking you back to your setup checklist — it finishes setting up <code>${esc(domain)}</code> there.</p>
-  <div class="cta"><a class="btn" id="back" href="/projects?view=new">Back to my checklist →</a></div>
+  <div class="cta"><a class="btn" id="back" href="${esc(back)}">Back to my checklist →</a></div>
 </main>
 <script>window.__CB_SETUP__=${cfgJson};</script>
 <script>${HANDBACK_SCRIPT}</script>
@@ -184,4 +194,4 @@ function callbackPage({ ok, title, body, state, domain, next }) {
 </body></html>`;
 }
 
-module.exports = { esc, callbackPage };
+module.exports = { esc, callbackPage, returnHref, RETURN_PATH };