@bongos/core 1.21.95 → 1.21.97

package/modules/public-landing/public/projects.html

@@ -459,6 +459,13 @@ body:has(#view-new:not([hidden])) footer.foot{position:relative;z-index:1;backgr
 .hint strong{color:var(--ink);font-weight:500;}
 
 .row2{display:grid;grid-template-columns:1fr 1fr;gap:0 22px;}
+/* whose GitHub account (task 1004651): the account, the organisation, and a typed name
+   with its Check button sitting on the field's baseline */
+.acctPick{max-width:680px;}
+.acctPick .row2{grid-template-columns:1fr;}
+.acctPick .acctTyped{display:flex;align-items:flex-end;gap:14px;}
+.acctPick .acctTyped .wizField{flex:1;min-width:0;}
+.acctPick .acctTyped .btn{flex:none;margin:0 0 2px;}
 
 /* the choice (start fresh / adopt): two cells of one band on hairlines, the
    chosen one carrying the dot — the dot is the mark, so the icon leaves */
@@ -601,6 +608,10 @@ body:has(#view-new:not([hidden])) footer.foot{position:relative;z-index:1;backgr
   display:inline-flex;align-items:center;justify-content:center;font-family:var(--font-body);font-size:13px;letter-spacing:0;}
 #panel-done .humanSteps>li.sdone::before{content:"✓";text-transform:none;color:var(--ok);background:color-mix(in srgb,var(--ok) 12%,transparent);border:1px solid var(--ok);}
 #panel-done .humanSteps>li.slocked::before{border:1px solid var(--rule-soft);}
+/* a stopped step (task 1004652, the mockup's "!" dot): what stopped, and the button that fixes it */
+#panel-done .humanSteps>li.sstopped::before{content:"!";color:var(--err);background:color-mix(in srgb,var(--err) 10%,transparent);border:1px solid var(--err);}
+.humanSteps .linklike{display:block;margin-top:10px;min-height:24px;padding:3px 0;background:none;border:0;cursor:pointer;font-family:var(--font-body);font-size:13.5px;color:var(--link-ink);text-decoration:underline;text-underline-offset:3px;text-align:left;}
+.humanSteps .linklike:hover{color:var(--ink);}
 /* the optional step (command-line sign-in, task 1004649): a dashed ring until it ticks */
 #panel-done .humanSteps>li.soptional:not(.sdone)::before{border-style:dashed;}
 #panel-done .humanSteps b{font-size:15px;line-height:24px;}
@@ -1810,6 +1821,21 @@ summary{min-height:24px;padding:3px 0;}
                           <!-- visibility is stated on EVERY repo path (task 1002721); updateFreshPreview()
                                replaces this floor with the same claim plus the resolved repo URL -->
                           <div class="hint" id="ghFreshHint">A new <strong>private</strong> repo. You can make it public later.</div>
+                          <!-- whose account the new repo is made on (task 1004651); the
+                               organisation names are GitHub's, so they are built as DOM
+                               text, never as markup -->
+                          <div class="acctPick" id="raPick">
+                            <div class="row2">
+                              <label class="wizField"><span>Whose account</span>
+                                <select id="raSel"><option value="personal">On my account</option><option value="org">On an organisation</option></select></label>
+                              <label class="wizField" id="raOrgField" hidden><span>Organisation</span><select id="raOrg"></select></label>
+                            </div>
+                            <div class="row2 acctTyped" id="raTyped" hidden>
+                              <label class="wizField"><span>Organisation name</span><input type="text" id="raName" placeholder="acme-studio" autocomplete="off" maxlength="39"></label>
+                              <button type="button" class="btn small ghost" id="raCheck">Check</button>
+                            </div>
+                            <p class="hint" id="raNote" aria-live="polite"></p>
+                          </div>
                         </div>
                         <div class="row2" id="manualHome">
                           <label class="wizField"><span>GitHub owner <small>(user or org)</small></span>
@@ -2104,6 +2130,20 @@ summary{min-height:24px;padding:3px 0;}
                 <p class="hint" id="doneRender" role="status" hidden></p>
                 <p class="hint" id="doneLook" role="status" hidden></p>
                 <div id="doneApp" hidden></div>
+                <!-- whose account GitHub makes the app on (task 1004651, the mockup's
+                     account select beside Connect GitHub); shown while Connect is offered -->
+                <div class="acctPick" id="aaPick" hidden>
+                  <div class="row2">
+                    <label class="wizField"><span>Make the app on</span>
+                      <select id="aaSel" aria-label="Which GitHub account"><option value="personal">On my account</option><option value="org">On an organisation</option></select></label>
+                    <label class="wizField" id="aaOrgField" hidden><span>Organisation</span><select id="aaOrg"></select></label>
+                  </div>
+                  <div class="row2 acctTyped" id="aaTyped" hidden>
+                    <label class="wizField"><span>Organisation name</span><input type="text" id="aaName" placeholder="acme-studio" autocomplete="off" maxlength="39"></label>
+                    <button type="button" class="btn small ghost" id="aaCheck">Check</button>
+                  </div>
+                  <p class="hint" id="aaNote" aria-live="polite"></p>
+                </div>
                 <ol class="humanSteps" id="humanSteps"></ol>
                 <!-- the STABLE live region: the strip inside is rebuilt every 5s tick,
                      and a live region that is itself replaced never announces -->
@@ -5438,13 +5478,16 @@ summary{min-height:24px;padding:3px 0;}
          Never before identity settles — myLogin()'s 'you' is display copy, and a
          draft that stored it would file target_ref "you/<repo>". */
       if (!me) return;
-      state.owner = myLogin();
+      /* the founder's own account, unless they chose an organisation for it (task 1004651) */
+      state.owner = state.repoOrg || myLogin();
       $('ghNewName').value = state.repo || '';
       updateFreshPreview();
+      if (repoPick) repoPick.load(state.repoAcct === 'org' ? (state.repoOrg || state.repoOrgTyped || '') : null);
     }
     function updateFreshPreview() {
       var hint = $('ghFreshHint');
-      var clash = state.repo && repoList.some(function (r) { return String(r.name).toLowerCase() === state.repo.toLowerCase(); });
+      /* repoList is the founder's OWN repos, so a clash is only knowable on their account */
+      var clash = !state.repoOrg && state.repo && repoList.some(function (r) { return String(r.name).toLowerCase() === state.repo.toLowerCase(); });
       if (state.repo && !validRepoName(state.repo)) {
         hint.className = 'hint err'; hint.textContent = 'Use letters, numbers, and . _ - (1–100 chars).';
       } else if (clash) {
@@ -5453,11 +5496,177 @@ summary{min-height:24px;padding:3px 0;}
         /* Visibility stated up front (task 1002694 / idea 1000684): repos WE create are
            private by default (github-repos.js, ADR 0370); the owner can make one
            public later from the project's manage page. */
-        hint.className = 'hint'; hint.innerHTML = 'A new <strong>private</strong> repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code>. You can make it public later.';
+        hint.className = 'hint'; hint.innerHTML = 'A new <strong>private</strong> repo at <code style="font-family:var(--font-mono)">github.com/' + esc(state.repoOrg || myLogin()) + '/' + esc(state.repo || 'name') + '</code>. You can make it public later.';
       }
     }
     $('ghNewName').addEventListener('input', function () { state.repo = this.value.trim(); updateFreshPreview(); saveDraft(); });
 
+    /* ── whose GitHub account: mine or an organisation's (task 1004651) ──
+       Two pickers share this: the new repo's owner (part 02's Code row) and the app's
+       (part 03). The founder's organisations come from GET /github/orgs; GitHub may not
+       show this sign-in's memberships (it asks for repo access, not org access), so a
+       typed name with a Check button is always offered beside the list, and a role GitHub
+       did not tell us is said as such. For the app, an organisation the founder is known
+       not to own is listed with the reason and cannot be picked: only owners can make
+       apps there. Every organisation name is DOM text (textContent / option text). */
+    var GH_LOGIN_RE = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
+    var OTHER_ORG = '__other';   /* a login can never contain "_" */
+    var orgsRead = null;
+    function readOrgs() {
+      if (!orgsRead) {
+        orgsRead = fetch(API + '/github/orgs', { credentials: 'same-origin' })
+          .then(function (res) { return res.ok ? res.json() : null; })
+          .then(function (d) {
+            var orgs = d && Array.isArray(d.orgs) ? d.orgs.filter(function (o) { return o && GH_LOGIN_RE.test(String(o.login || '')); }) : [];
+            return { orgs: orgs, listed: (d && d.listed) || 'none' };
+          })
+          .catch(function () { orgsRead = null; return { orgs: [], listed: 'none' }; });
+      }
+      return orgsRead;
+    }
+    function acctPicker(p, opts) {
+      var el = { box: $(p + 'Pick'), sel: $(p + 'Sel'), orgField: $(p + 'OrgField'), org: $(p + 'Org'), typed: $(p + 'Typed'), name: $(p + 'Name'), check: $(p + 'Check'), note: $(p + 'Note') };
+      var orgs = [], listed = 'none', loaded = false, typed = null, checking = false;
+      function find(login) {
+        var l = String(login || '').toLowerCase();
+        for (var i = 0; i < orgs.length; i++) if (orgs[i].login.toLowerCase() === l) return orgs[i];
+        return null;
+      }
+      /* for the app only: GitHub will not let a known non-owner make it */
+      function refused(o) { return !!(opts.needsOwner && o && o.can_create_apps === false); }
+      function say(text, cls) { el.note.textContent = text || ''; el.note.className = 'hint' + (cls ? ' ' + cls : ''); }
+      function fill(want) {
+        while (el.org.firstChild) el.org.removeChild(el.org.firstChild);
+        var pick = '';
+        orgs.forEach(function (o) {
+          var opt = document.createElement('option');
+          opt.value = o.login;
+          if (refused(o)) {
+            opt.disabled = true;
+            opt.textContent = o.login + (o.role === 'member' ? ' (you’re a member, not an owner)' : ' (not open to you yet)');
+          } else {
+            opt.textContent = o.login;
+            if (!pick) pick = o.login;
+          }
+          el.org.appendChild(opt);
+        });
+        var other = document.createElement('option');
+        other.value = OTHER_ORG;
+        other.textContent = orgs.length ? 'Another organisation…' : 'Type its name…';
+        el.org.appendChild(other);
+        var w = want ? find(want) : null;
+        if (w && !refused(w)) pick = w.login;
+        else if (want) { pick = OTHER_ORG; el.name.value = want; }
+        el.org.value = pick || OTHER_ORG;
+      }
+      /* the choice: personal, or an organisation and whether it can go ahead */
+      function value() {
+        if (el.sel.value !== 'org') return { account: 'personal', ok: true };
+        var v = el.org.value;
+        if (v && v !== OTHER_ORG) { var o = find(v); return { account: 'org', org: o ? o.login : v, ok: !refused(o), access: o }; }
+        var nm = String(el.name.value || '').trim();
+        if (typed && !typed.missing && typed.login.toLowerCase() === nm.toLowerCase()) return { account: 'org', org: typed.login, ok: !refused(typed), access: typed };
+        return { account: 'org', org: '', ok: false, typedName: nm };
+      }
+      function paint() {
+        var isOrg = el.sel.value === 'org';
+        el.orgField.hidden = !isOrg || !loaded || !orgs.length;   /* nothing listed: just the typed name */
+        el.typed.hidden = !(isOrg && loaded && el.org.value === OTHER_ORG);
+        var v = value();
+        if (!isOrg) say('');
+        else if (!loaded) say('Reading your organisations from GitHub…');
+        else if (v.org && v.access && v.access.reason && (opts.needsOwner || v.access.can_create_apps === false)) say(v.access.reason, v.access.can_create_apps === false ? 'err' : '');
+        else if (v.org) say(v.access && v.access.can_create_apps ? 'You own ' + v.org + ' on GitHub.' : '');
+        else if (checking) say('Checking with GitHub…');
+        else if (typed && typed.missing && typed.login.toLowerCase() === String(el.name.value || '').trim().toLowerCase()) say(typed.reason, 'err');
+        else say(listed === 'none' && !orgs.length ? 'GitHub didn’t show us your organisations, so type its name and press Check.' : 'Type the organisation’s name and press Check.');
+        if (opts.onChange) opts.onChange(v);
+      }
+      function check() {
+        var nm = String(el.name.value || '').trim();
+        if (!GH_LOGIN_RE.test(nm)) { typed = { login: nm, missing: true, reason: 'That isn’t a GitHub organisation name: letters, numbers and single dashes, up to 39.' }; paint(); return; }
+        checking = true; typed = null; paint();
+        fetch(API + '/github/orgs/' + encodeURIComponent(nm), { credentials: 'same-origin' })
+          .then(function (res) {
+            return res.json().catch(function () { return {}; }).then(function (d) {
+              if (res.ok && d.org && GH_LOGIN_RE.test(String(d.org.login || ''))) return d.org;
+              var msg = (d.error && d.error.message) || '';
+              if (res.status === 404) return { login: nm, missing: true, reason: msg || ('GitHub didn’t show your account an organisation called ' + nm + '.') };
+              return { login: nm, missing: true, reason: 'We couldn’t check that with GitHub just now. Try again in a moment.' };
+            });
+          })
+          .catch(function () { return { login: nm, missing: true, reason: 'We couldn’t check that with GitHub just now. Try again in a moment.' }; })
+          .then(function (r) {
+            checking = false;
+            /* a name typed since the click is not the one this answer is about */
+            if (String(el.name.value || '').trim().toLowerCase() === nm.toLowerCase()) typed = r;
+            paint();
+          });
+      }
+      /* GitHub is asked for the organisations only once one is wanted */
+      function ensureOrgs(want) {
+        if (el.sel.value !== 'org') return;
+        readOrgs().then(function (d) {
+          var first = !loaded;
+          orgs = d.orgs; listed = d.listed; loaded = true;
+          /* a second look keeps what the founder already picked */
+          var keep = first ? want : (value().org || want);
+          fill(keep);
+          if (keep && el.org.value === OTHER_ORG && GH_LOGIN_RE.test(keep)) check();
+          paint();
+        });
+      }
+      el.sel.addEventListener('change', function () { paint(); ensureOrgs(''); });
+      el.org.addEventListener('change', paint);
+      el.name.addEventListener('input', paint);
+      el.name.addEventListener('keydown', function (ev) { if (ev.key === 'Enter') { ev.preventDefault(); check(); } });
+      el.check.addEventListener('click', check);
+      return {
+        value: value,
+        el: el,
+        /* want: null = the founder's own account; a login = that organisation; '' = an
+           organisation not picked yet */
+        load: function (want) {
+          el.sel.value = want != null ? 'org' : 'personal';
+          paint();
+          ensureOrgs(want);
+        },
+        /* the reason the choice cannot go ahead, said where it is made */
+        explain: function () {
+          if (el.org.value === OTHER_ORG && el.name) el.name.focus(); else el.org.focus();
+          if (!el.note.textContent) say('Pick the organisation, or choose your own account.', 'err');
+        }
+      };
+    }
+    var repoPick = acctPicker('ra', {
+      needsOwner: false,
+      onChange: function (v) {
+        if (state.repoAutoCreated) return;   /* GitHub already made it: the owner is a fact now */
+        state.repoAcct = v.account;
+        state.repoOrg = v.account === 'org' && v.ok ? v.org : '';
+        state.repoOrgTyped = v.account === 'org' && !v.org ? (v.typedName || '') : '';
+        if (me && repoAccess === true && state.mode !== 'adopt') state.owner = state.repoOrg || myLogin();
+        updateFreshPreview();
+        saveDraft();
+        if (typeof paintSetup === 'function') paintSetup();
+      }
+    });
+    /* part 03's account picker (task 1004651). Its default is the organisation the app
+       last went to, else the one the new repo went to, else the founder's own account —
+       set once per project, so a poll never undoes a choice. */
+    var appPick = acctPicker('aa', { needsOwner: true });
+    var appPickFor = null;
+    function syncAppPick(offered) {
+      var box = $('aaPick');
+      if (!box || !appPick) return;
+      box.hidden = !offered;
+      if (!offered || appPickFor === instanceId) return;
+      appPickFor = instanceId;
+      var rec = createdRecord() || {};
+      var want = appOrgLogin() || (state.repoAutoCreated && state.repoAcct === 'org' && state.repoOrg) || rec.repo_org || null;
+      appPick.load(want && /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/.test(want) ? want : null);
+    }
+
     /* The adopt picker behaves like a standard combobox (owner design review, task
        1002247): the dropdown is open only while the visitor is choosing. Selecting a
        repo fills the search box with its full_name and collapses the list; focusing or
@@ -6019,8 +6228,10 @@ summary{min-height:24px;padding:3px 0;}
         if (works.indexOf(a.main_work) === -1) return homeErr('Mark which of them is your main one.');
       }
       if (repoAccess === true && state.mode !== 'adopt') {
-        /* Fresh with access: just the new repo NAME (owner is the signed-in account). */
+        /* Fresh with access: just the new repo NAME (owner is the signed-in account, or
+           the organisation the founder picked, task 1004651). */
         if (!validRepoName(state.repo)) return homeErr('Name the new repository (letters, numbers, and . _ -).');
+        if (state.repoAcct === 'org' && !state.repoOrg) return homeErr('Pick the organisation for the repo, or put it on your own account.');
       } else {
         /* Adopt (picker or manual) and the manual fallback: need a concrete owner + repo. */
         if (!state.owner || !state.repo) {
@@ -6430,10 +6641,13 @@ summary{min-height:24px;padding:3px 0;}
     function ensureFreshRepo() {
       if (state.mode === 'adopt' || repoAccess !== true) return Promise.resolve();
       if (state.repoAutoCreated && state.owner && state.repo) return Promise.resolve();
+      /* the founder's own account sends exactly what it always did; an organisation
+         rides as `org`, and the server checks the name again (task 1004651) */
+      var repoBody = state.repoAcct === 'org' && state.repoOrg ? { name: state.repo, org: state.repoOrg } : { name: state.repo };
       return fetch(API + '/github/repos', {
         method: 'POST', credentials: 'same-origin',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ name: state.repo })
+        body: JSON.stringify(repoBody)
       }).then(function (res) {
         return res.json().catch(function () { return {}; }).then(function (data) {
           if (res.status === 401 || res.status === 403) {
@@ -6449,6 +6663,8 @@ summary{min-height:24px;padding:3px 0;}
             var e = new Error((data.error && (data.error.message || data.error.code)) || ('HTTP ' + res.status));
             e.data = data;
             if (data.error && data.error.code === 'name_taken') { e.gotoHome = true; e.homeMsg = data.error.message; }
+            /* the organisation said no: its reason, where the owner is chosen */
+            if (data.error && /^(org_app_restricted|org_forbidden|org_not_found|bad_org)$/.test(data.error.code || '')) { e.gotoHome = true; e.homeMsg = data.error.message; }
             throw e;
           }
           var full = data.repo && data.repo.full_name;
@@ -6554,6 +6770,8 @@ summary{min-height:24px;padding:3px 0;}
             id: data.instance && data.instance.id, slug: state.slug, domain: madeDomain,
             noaddr: !madeDomain,
             mode: state.mode, name: state.name, at: Date.now(),
+            /* the organisation the new repo went to, so part 03 offers it for the app */
+            repo_org: state.repoAutoCreated && state.repoAcct === 'org' && state.repoOrg ? state.repoOrg : undefined,
             /* a demo's teammates, offered once the hall is up (task 1004503) */
             demo_invites: state.demo && state.demo.invites && state.demo.invites.length ? state.demo.invites.slice() : undefined
           }));
@@ -6608,7 +6826,7 @@ summary{min-height:24px;padding:3px 0;}
       return '<a href="' + (instanceId ? '?view=manage&id=' + encodeURIComponent(instanceId) : '?view=mine') +
         '">' + label + '</a>';
     }
-    var live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null, setup: null, installUrl: null };
+    var live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null, appOrg: null, setup: null, installUrl: null, pickUp: null, verifying: false, askedPlatform: false };
     var planPromises = {};             /* mode|domain → Promise<steps[]> */
     var lastStepsHtml = '';
     var lastProgHtml = '';            /* same change-only contract, for the progress strip */
@@ -6660,7 +6878,7 @@ summary{min-height:24px;padding:3px 0;}
           : '<li data-onboard-step="github-repo"><b>Your empty repo is ready</b><p>We created ' + repoLink + ' on GitHub for you — public (projects here are open by design), empty, and waiting. The scaffold lands there when the build runs; nothing for you to do here.</p></li>';
       }
       var ghNewUrl = githubNewRepoUrl(state.owner, state.repo);
-      return '<li' + (landed ? ' class="sdone"' : '') + ' data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the owner and name already filled in), press <strong>Create repository</strong>, and leave it completely empty. It must land at exactly ' + repoLabel + ' — leave GitHub’s Owner box as prefilled (your personal account), because the build watches that exact address; a repo created under a different owner (an organization, say) is never found. GitHub will ask public or private — your choice; both work here, and we never change it. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
+      return '<li' + (landed ? ' class="sdone"' : '') + ' data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the owner and name already filled in), press <strong>Create repository</strong>, and leave it completely empty. It must land at exactly ' + repoLabel + ' — leave GitHub’s Owner box as prefilled, because the build watches that exact address; a repo created under a different owner is never found. GitHub will ask public or private — your choice; both work here, and we never change it. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
         '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + GH_ICON + 'Create ' + repoLabel + ' on GitHub</a></li>';
     }
 
@@ -6712,7 +6930,30 @@ summary{min-height:24px;padding:3px 0;}
        the server verified (live.setup, the status poll's `checklist`). Every value that
        reaches the markup goes through esc(). */
     function ghStep(key) { return live.setup && live.setup[key]; }
+    /* "Pick up where it stopped" (task 1004652): a stopped step says what stopped in one plain
+       sentence and carries the action that fixes it, with the app GitHub already made, never a
+       second one. live.pickUp is the server's word for what that action does (github-setup.js
+       pickUpFor); live.verifying is whether the runner is still checking. Static words only. */
+    var ghTabTrouble = null;   /* 'behind' | 'closed': what this page saw of the GitHub tab it opened */
+    var NO_SECOND_APP = 'Nothing is lost, and no second app will be made.';
+    function pickUpBtn() { return '<button type="button" class="ghbtn" data-action="pick-up">Pick up where it stopped</button>'; }
+    function askPlatformBtn() {
+      if (live.askedPlatform === true) return '<p>Sent. The platform team has it and finishes it from here; there is nothing else for you to do.</p>';
+      return (live.askedPlatform === 'failed' ? '<p>That didn’t send. Try again.</p>' : '') +
+        '<button type="button" class="linklike" data-action="ask-platform">Send it to the platform team</button>';
+    }
     function appTitle() { return 'Approve the ' + esc(state.name || state.slug || 'project') + ' app on GitHub'; }
+    /* the organisation that owns the app, when the founder made it on one (task 1004651) */
+    function appOrgLogin() {
+      return typeof live.appOrg === 'string' && /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/.test(live.appOrg) ? live.appOrg : null;
+    }
+    /* the app's own settings on GitHub: under its organisation, or under the founder's
+       account. A raw URL; callers esc() it into an attribute. */
+    function appSettingsUrl() {
+      if (!live.appSlug) return null;
+      var org = appOrgLogin();
+      return 'https://github.com' + (org ? '/organizations/' + encodeURIComponent(org) : '') + '/settings/apps/' + encodeURIComponent(live.appSlug);
+    }
 
     /* oauth-app — the ADR 0133 one-click GitHub-App manifest flow is the primary path
        (gap 3 / idea 1000676); locked until a domain exists (the App needs the real
@@ -6725,7 +6966,11 @@ summary{min-height:24px;padding:3px 0;}
       /* GitHub made the app and the platform placed its keys: the slug is recorded only
          after the placement (the runner), so a known slug outside a failure is the tick —
          a fact, whatever the venue says about starting a NEW trip */
-      if (live.manifest !== 'error' && live.manifest !== 'expired' && (ghStep('approve') === 'done' || live.appSlug)) {
+      /* …including when a LATER step stopped (sign-in unconfirmed): the app and its keys are
+         real, so this step stays ticked and the stopped one says so (task 1004652) */
+      var appMade = (ghStep('approve') === 'done' || live.appSlug) && live.manifest !== 'expired' &&
+        (live.manifest !== 'error' || live.manifestFailure === 'sign_in_unconfirmed');
+      if (appMade) {
         return '<li class="sdone" data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>GitHub made the app, and its keys are on your project.</p></li>';
       }
       /* honesty about the venue (owner walk, 2026-08-12): GitHub rejects app
@@ -6739,22 +6984,24 @@ summary{min-height:24px;padding:3px 0;}
            details (task 1003244). The one refusal a founder can act on — no
            address yet — says where to go instead of what the server said. */
         var snag, raw = '';
-        /* a failure AFTER GitHub's approval left an app on the founder's account,
-           so "nothing was changed" would be false — the server says how far it got
-           (live.manifestFailure, task 1004572) and the words follow it */
-        if (live.manifest === 'expired') snag = 'That setup link expired (they last 30 minutes) — mint a fresh one.';
+        /* a failure AFTER GitHub's approval left an app on the founder's account, so
+           "nothing was changed" would be false, and a new link would make a second app —
+           the server says how far it got (live.manifestFailure, task 1004572) and what
+           picking it up does (live.pickUp, task 1004652); the words and the action follow */
+        var act = '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Connect GitHub ↗</button>' + manualOauthDetails();
+        if (live.manifest === 'expired') snag = 'That setup link expired (they last 30 minutes) before GitHub was approved, so nothing was made on GitHub. Start a fresh one.';
         else if (live.manifestCode === 'domain_required') snag = 'This project needs an address first — attach one from ' + projectPageLink('its own page') + ', then come back to this step.';
-        else if (live.manifestFailure === 'sign_in_unconfirmed') {
-          var appLink = live.appSlug ? '<a href="https://github.com/settings/apps/' + esc(live.appSlug) + '" target="_blank" rel="noopener">your app on GitHub</a>' : 'the app on your GitHub account';
-          return '<li data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>GitHub approved the app and the platform placed its credentials on your project, but your project didn’t confirm that sign-in works. Trying again would make a second app on your GitHub account and is unlikely to fix this — it needs a look from the platform team. <a href="/contact">Contact us</a> and mention ' + appLink + '.</p>' +
-            progressMarkup(1, 1, 'Stopped: your project didn’t confirm sign-in.', 'isErr', 'signin') +
-            '<button type="button" class="linklike" data-action="manifest-start">Try again anyway</button></li>';
+        else if (live.pickUp === 'convert') {
+          snag = 'GitHub approved the app, and the platform stopped before it finished collecting the app’s keys. ' + NO_SECOND_APP;
+          act = pickUpBtn();
+        }
+        else if (live.manifestFailure === 'finish_failed') {
+          snag = 'GitHub made the app, but its keys never reached your project, so it can’t be used yet. Making another would leave you with two, so we won’t: the platform team finishes this one. Send it to them from here.';
+          act = askPlatformBtn();
         }
-        else if (live.manifestFailure === 'finish_failed') snag = 'GitHub approved the app, but the platform couldn’t finish setting up sign-in on your project. The app GitHub made is still on your account — delete it first (GitHub → Settings → Developer settings → GitHub Apps) so you don’t end up with two, then try again.';
         else { snag = 'GitHub setup didn’t start. Nothing was changed on GitHub — try again.'; raw = live.manifestMsg; }
-        return '<li data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>' + snag + '</p>' +
-          (raw ? '<details><summary>Technical details</summary><p>' + esc(raw) + '</p></details>' : '') +
-          '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Connect GitHub ↗</button>' + manualOauthDetails() + '</li>';
+        return '<li class="sstopped" data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>' + snag + '</p>' +
+          (raw ? '<details><summary>Technical details</summary><p>' + esc(raw) + '</p></details>' : '') + act + '</li>';
       }
       if (live.manifest === 'code_received' || live.manifest === 'converting') {
         /* GitHub's half of the approval is done — say so, rather than keep telling the
@@ -6765,9 +7012,19 @@ summary{min-height:24px;padding:3px 0;}
       }
       if (live.manifest) {   /* pending — GitHub holds the manifest, nobody has approved it yet */
         autoOpenArmed = true;
-        return '<li data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>Waiting on GitHub — approve the app in the tab that opened. No GitHub tab? It may have opened behind this window or in another one. Once approved, GitHub takes you straight on to installing it on your repo, then back here; every step ticks itself.</p>' +
+        /* the tab this page opened, as seen from here (task 1004652): behind this window, or
+           closed before the approval. "Reopen GitHub" posts the SAME attempt again (the mint
+           route hands back a link still waiting), so it can never make a second app. */
+        var wait = ghTabTrouble === 'closed'
+          ? 'The GitHub tab closed before the app was approved, so nothing was made on GitHub. Reopen it to carry on with this same setup.'
+          : ghTabTrouble === 'behind'
+            ? 'Your GitHub tab opened behind this window. Reopen it to bring it to the front; it is this same setup, so no second app will be made.'
+            : 'Waiting on GitHub — approve the app in the tab that opened. No GitHub tab? It may have opened behind this window or in another one. Once approved, GitHub takes you straight on to installing it on your repo, then back here; every step ticks itself.';
+        return '<li data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>' + wait + '</p>' +
           progressMarkup(0, 0, 'Waiting for your approval on GitHub…', '', 'signin') + autoOpenTick() +
-          (manifestStale ? '<button type="button" class="linklike" data-action="manifest-start">Didn’t get to GitHub? Start the setup again</button>' : '') + '</li>';
+          (ghTabTrouble
+            ? '<button type="button" class="ghbtn" data-action="reopen-github">' + GH_ICON + 'Reopen GitHub ↗</button>'
+            : '<button type="button" class="linklike" data-action="reopen-github">No GitHub tab? Reopen GitHub</button>') + '</li>';
       }
       return '<li data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>One trip to GitHub: approve the app, install it on your repo, and you land back here. No keys to copy, and the secret never leaves the server side.</p>' +
         '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Connect GitHub ↗</button>' + manualOauthDetails() + '</li>';
@@ -6787,12 +7044,16 @@ summary{min-height:24px;padding:3px 0;}
       if (live.manifest !== 'done') {
         return '<li class="slocked soptional" data-onboard-step="device-flow">' + title + '<p>Optional — turn it on later. It lets builders sign in from a terminal, with the <code style="font-family:var(--font-mono)">bongos setup</code> command they run on their own machine; web sign-in works without it.</p></li>';
       }
-      var appUrl = live.appSlug ? 'https://github.com/settings/apps/' + esc(live.appSlug) : null;
+      var appUrl = live.appSlug ? esc(appSettingsUrl()) : null;
       return '<li class="soptional" data-onboard-step="device-flow">' + title + '<p>Optional — turn it on later. GitHub leaves it off on new apps and lets only you switch it on: ' +
         (appUrl
           ? 'open <a href="' + appUrl + '" target="_blank" rel="noopener">your app’s settings</a>, check <strong>Enable Device Flow</strong>, and save. '
           : 'GitHub → Settings → Developer settings → GitHub Apps → your app → check <strong>Enable Device Flow</strong> → save. ') +
-        'We tick this when GitHub has it on. Until then builders sign in on the web, and terminal sign-in falls back to a web token from the hall’s Settings page.</p></li>';
+        'We tick this when GitHub has it on. Until then builders sign in on the web, and terminal sign-in falls back to a web token from the hall’s Settings page.</p>' +
+        /* past the runner's checking window (task 1004652): ask it to look again. The
+           install step carries the same action while it is unverified, so it shows here
+           only once the install has ticked. */
+        (live.pickUp === 'check' && ghStep('install') === 'done' ? '<button type="button" class="linklike" data-action="pick-up">Turned it on? Check again</button>' : '') + '</li>';
     }
 
     /* app-install — "Install it on your repo": the ADR 0055 publish credential (task
@@ -6809,6 +7070,12 @@ summary{min-height:24px;padding:3px 0;}
         return '<li class="slocked" data-onboard-step="app-install">' + title + '<p>Comes straight after the approval, on the same trip: pick your repo and you land back here.</p></li>';
       }
       var installUrl = live.installUrl || ('https://github.com/apps/' + encodeURIComponent(live.appSlug) + '/installations/new');
+      /* the runner stopped checking and GitHub never confirmed the install (task 1004652):
+         the link opens the SAME app's install page, and the click asks the runner to look again */
+      if (live.pickUp === 'check') {
+        return '<li class="sstopped" data-onboard-step="app-install">' + title + '<p>GitHub stopped before the app was installed on your repo. ' + NO_SECOND_APP + '</p>' +
+          '<a class="ghbtn" href="' + esc(installUrl) + '" target="_blank" rel="noopener" data-action="pick-up">' + GH_ICON + 'Pick up where it stopped ↗</a></li>';
+      }
       return '<li data-onboard-step="app-install">' + title + '<p>Your GitHub tab goes here next. We check with GitHub that the app is on your repo, and this step ticks itself. Came back without installing it?</p>' +
         '<a class="ghbtn" href="' + esc(installUrl) + '" target="_blank" rel="noopener">' + GH_ICON + 'Install it on your repo ↗</a></li>';
     }
@@ -6823,6 +7090,16 @@ summary{min-height:24px;padding:3px 0;}
       if (!domain) {
         return '<li class="slocked" data-onboard-step="first-sign-in">' + title + '<p>Unlocks with an address — then you open it, sign in with GitHub once, and take the owner’s seat (the founding Archon).</p></li>';
       }
+      /* the app and its keys are placed, but the project never confirmed sign-in (task
+         1004652): the runner re-asks it with the keys already there, so picking it up never
+         makes a second app — and a project that still will not answer goes to the platform team */
+      if (live.manifest === 'error' && live.manifestFailure === 'sign_in_unconfirmed') {
+        return '<li' + (live.verifying ? '' : ' class="sstopped"') + ' data-onboard-step="first-sign-in">' + title + '<p>' +
+          (live.verifying
+            ? 'Your project hasn’t confirmed sign-in yet. We’re asking it again, with the app GitHub already made, and this step ticks itself.'
+            : 'Your project didn’t confirm that sign-in works. ' + NO_SECOND_APP) + '</p>' +
+          (live.pickUp === 'check' ? pickUpBtn() : '') + askPlatformBtn() + '</li>';
+      }
       if (live.manifest !== 'done') {
         return '<li class="slocked" data-onboard-step="first-sign-in">' + title + '<p>Ticks once the platform has seen sign-in work on <code style="font-family:var(--font-mono)">' + esc(domain) + '</code>.</p></li>';
       }
@@ -6865,6 +7142,8 @@ summary{min-height:24px;padding:3px 0;}
           var r = STEP_RENDERERS[s.key];
           return r ? r(s) : '<li data-onboard-step="' + esc(s.key) + '"><b>' + esc(s.label || s.key) + '</b></li>';
         }).join('');
+        /* the account picker stands beside Connect GitHub, so it shows while that is offered */
+        syncAppPick(html.indexOf('data-action="manifest-start"') !== -1);
         if (html === lastStepsHtml) return;   /* change-only re-render — polls never clobber open UI */
         lastStepsHtml = html;
         $('humanSteps').innerHTML = html;
@@ -6915,6 +7194,13 @@ summary{min-height:24px;padding:3px 0;}
     $('humanSteps').addEventListener('click', function (ev) {
       var mBtn = ev.target.closest('[data-action="manifest-start"]');
       if (mBtn) { startManifest(mBtn); return; }
+      /* task 1004652: the pick-up link to GitHub's install page keeps its default (it opens) */
+      var pBtn = ev.target.closest('[data-action="pick-up"]');
+      if (pBtn) { pickUpSetup(pBtn); return; }
+      var rBtn = ev.target.closest('[data-action="reopen-github"]');
+      if (rBtn) { reopenGithub(rBtn); return; }
+      var aBtn = ev.target.closest('[data-action="ask-platform"]');
+      if (aBtn) { askPlatform(aBtn); return; }
       var t = ev.target.closest('.copy');
       if (!t) return;
       navigator.clipboard.writeText(t.getAttribute('data-copy')).then(function () {
@@ -6970,7 +7256,6 @@ summary{min-height:24px;padding:3px 0;}
     var manifestState = null;      /* the one-time state token — kept so a parked poll can resume */
     var manifestPending = false;
     var manifestStartedAt = 0;     /* when the founder was sent to GitHub */
-    var manifestStale = false;     /* ~90s with no approval → offer to start again */
     /* the GitHub hand-back (task 1004548): the callback page returns the founder here
        with the attempt's one-time state in the fragment (#ghstate=…), so a checklist
        that page opened — not only the tab that started the setup — keeps watching the
@@ -7007,13 +7292,83 @@ summary{min-height:24px;padding:3px 0;}
     var manifestGen = 0;
     function stopManifestPoll() { manifestGen += 1; if (manifestPollTimer) { clearTimeout(manifestPollTimer); manifestPollTimer = null; } }
 
+    /* the organisation the server says this attempt's app is on: change-only */
+    function noteAppOrg(org) {
+      var next = typeof org === 'string' && org ? org : null;
+      if (next === live.appOrg) return false;
+      live.appOrg = next;
+      return true;
+    }
+
+    /* ── Pick up where it stopped (task 1004652). The server says what the action does
+          (live.pickUp). 'convert' and 'check' are the pick-up route's: it resumes the
+          stopped step with the app GitHub already made, and this page watches again.
+          'reopen' and 'fresh' go through the mint route, which hands back a link still
+          waiting on GitHub and refuses a new one once GitHub has made the app; 'operator'
+          is a blocker filed for the platform team. ── */
+    function pickUpSetup(btn) {
+      if (!instanceId) return;
+      if (live.pickUp === 'reopen' || live.pickUp === 'fresh') { startManifest(btn); return; }
+      if (live.pickUp === 'operator') { askPlatform(btn); return; }
+      var isBtn = btn.tagName === 'BUTTON';
+      if (isBtn) { btn.disabled = true; btn.textContent = 'Picking it up…'; }
+      fetch(API + '/provisioning/instances/' + encodeURIComponent(instanceId) + '/github-app/pick-up', { method: 'POST', credentials: 'same-origin' })
+        .then(function (res) { return res.json().catch(function () { return {}; }); })
+        .then(function (d) {
+          if (d && d.ok) applyPickUp(d);
+          else if (isBtn) { btn.disabled = false; btn.textContent = 'That didn’t go through. Try again'; }
+          watchSetupAgain();
+        })
+        .catch(function () { if (isBtn) { btn.disabled = false; btn.textContent = 'That didn’t go through. Try again'; } });
+    }
+    /* the pick-up route's answer is the fresh read: seed it and redraw at once */
+    function applyPickUp(d) {
+      if (typeof d.status === 'string') { live.manifest = d.status; live.manifestFailure = d.failure || null; rememberManifest(undefined, d.status); }
+      seedSetup(d.checklist, d.install_url, d);
+      lastStepsHtml = '';
+      renderSteps();
+    }
+    /* …and keep watching: the attempt's own poll when this tab knows it, else the instance read */
+    function watchSetupAgain() {
+      if (manifestState) pollManifest(manifestState);
+      else if (!pollTimer && instanceId) startProgress(instanceId);
+    }
+    /* "Reopen GitHub": bring a tab still open to the front, and post the SAME attempt again */
+    function reopenGithub(btn) {
+      if (ghTab && !ghTab.closed) { try { ghTab.focus(); } catch (e) {} }
+      startManifest(btn);
+    }
+    /* the one stop no button on this page can fix (GitHub made the app but its keys never
+       reached the project): filed as a blocker for the platform team, once per attempt */
+    function askPlatform(btn) {
+      if (!instanceId) return;
+      btn.disabled = true; btn.textContent = 'Sending…';
+      fetch(API + '/blockers', {
+        method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          title: 'A project’s GitHub setup needs the platform team',
+          body_md: 'Project ' + instanceId + ': the founder pressed “Send it to the platform team” on the GitHub step. GitHub made the app, but the project cannot finish connecting with it (its latest provisioning_oauth_manifests row says why in last_error), and a new link would make a second app. Once it is sorted, mark that attempt expired so the founder can start a fresh link.',
+          source: 'github-setup', source_ref: 'instance-' + instanceId + '-' + (manifestStartedAt || 'latest')
+        })
+      }).then(function (res) {
+        live.askedPlatform = res.ok ? true : 'failed';
+      }).catch(function () { live.askedPlatform = 'failed'; })
+        .then(function () { lastStepsHtml = ''; renderSteps(); });
+    }
+
     function startManifest(btn) {
       if (!instanceId) return;
+      /* an organisation that cannot go ahead says why where it is chosen, before any
+         tab opens or any link is minted */
+      var acct = appPick ? appPick.value() : { account: 'personal', ok: true };
+      if (!acct.ok) { appPick.explain(); return; }
       btn.disabled = true; btn.textContent = 'Preparing GitHub…';
       var tab = window.open('about:blank', 'ghAppSetup');
+      if (tab) { try { tab.focus(); } catch (e) {} watchGhTab(tab); }
       fetch(API + '/provisioning/instances/' + encodeURIComponent(instanceId) + '/github-app', {
         method: 'POST', credentials: 'same-origin',
-        headers: { 'Content-Type': 'application/json' }, body: '{}'
+        /* the founder's own account posts exactly what it always did */
+        headers: { 'Content-Type': 'application/json' }, body: acct.account === 'org' ? JSON.stringify({ account: 'org', org: acct.org }) : '{}'
       }).then(function (res) {
         if (res.status === 401) { window.location.assign(API + '/auth/web/start?return=/projects%3Fview%3Dnew&repos=1'); throw new Error('signing in'); }
         return res.json().catch(function () { return {}; }).then(function (d) {
@@ -7032,13 +7387,21 @@ summary{min-height:24px;padding:3px 0;}
         form.appendChild(inp); document.body.appendChild(form);
         form.submit(); form.remove();
         live.manifest = 'pending'; live.manifestMsg = ''; live.manifestFailure = null;
-        manifestStartedAt = Date.now(); manifestStale = false;
+        noteAppOrg(d.account === 'org' ? d.org_login : null);
+        manifestStartedAt = Date.now();
         rememberManifest(d.state, 'pending');
         renderSteps();
         pollManifest(d.state);
       }).catch(function (err) {
         if (String(err && err.message) === 'signing in') return;
         if (tab) { try { tab.close(); } catch (e) {} }
+        /* GitHub already approved an app for this project (task 1004652): no second one —
+           this page was behind, so it re-learns the truth and draws that step's own action */
+        if (err && (err.code === 'app_exists' || err.code === 'github_in_progress')) {
+          lastStepsHtml = '';
+          if (instanceId) startProgress(instanceId);
+          return;
+        }
         live.manifest = 'error'; live.manifestFailure = null; live.manifestMsg = String((err && err.message) || 'could not start');
         live.manifestCode = String((err && err.code) || '');
         renderSteps();
@@ -7053,22 +7416,57 @@ summary{min-height:24px;padding:3px 0;}
     }
     /* the checklist the server derived (task 1004649) — change-only; true when it moved.
        The install link rides only on a state-keyed read; the owner's read keeps the last. */
-    function seedSetup(checklist, installUrl) {
+    function seedSetup(checklist, installUrl, more) {
       if (!checklist || typeof checklist !== 'object') return false;
+      /* what picking it up does, and whether the runner is still checking (task 1004652) */
+      var moreMoved = false;
+      if (more && typeof more === 'object') {
+        var pick = typeof more.pick_up === 'string' ? more.pick_up : null, ver = !!more.verifying;
+        moreMoved = pick !== live.pickUp || ver !== live.verifying;
+        live.pickUp = pick; live.verifying = ver;
+      }
       var next = JSON.stringify(checklist), was = live.setup ? JSON.stringify(live.setup) : '';
       var url = typeof installUrl === 'string' && /^https:\/\/github\.com\/apps\//.test(installUrl) ? installUrl : null;
       var urlMoved = !!url && url !== live.installUrl && (!live.installUrl || /[?&]state=/.test(url) || !/[?&]state=/.test(live.installUrl));
-      if (next === was && !urlMoved) return false;
+      if (next === was && !urlMoved) return moreMoved;
       live.setup = checklist;
       if (urlMoved) live.installUrl = url;
       return true;
     }
     /* still worth watching after sign-in: the install not verified yet, while the runner checks */
     function setupOpen() {
-      return !!(live.setup && !live.setup.connected && live.manifest === 'done');
+      return !!(live.setup && ((!live.setup.connected && live.manifest === 'done') || (live.verifying && live.manifest === 'error')));
+    }
+    /* The GitHub tab this page opened (task 1004652). A tab that opened BEHIND this window
+       (this page kept the focus) or was closed before the approval is noticed within a few
+       seconds — it used to take 90 — and the step offers "Reopen GitHub". */
+    var ghTab = null, ghTabLeft = false, ghTabSince = 0, ghTabTimer = null, ghTabHeard = false;
+    /* PURE: 'closed' · 'behind' (still focused here a few seconds after opening it) · null */
+    function ghTabState(tab, left, since, now, focusedHere) {
+      if (!tab) return null;
+      if (tab.closed) return 'closed';
+      if (!left && focusedHere && now - since > 4000) return 'behind';
+      return null;
+    }
+    function watchGhTab(tab) {
+      if (!ghTabHeard) {   /* this page losing the focus = the GitHub tab came to the front */
+        ghTabHeard = true;
+        window.addEventListener('blur', function () { ghTabLeft = true; });
+        document.addEventListener('visibilitychange', function () { if (document.hidden) ghTabLeft = true; });
+      }
+      ghTab = tab; ghTabLeft = false; ghTabSince = Date.now(); ghTabTrouble = null;
+      if (ghTabTimer) clearInterval(ghTabTimer);
+      ghTabTimer = setInterval(noteManifestWait, 1500);
     }
     function noteManifestWait() {
-      if (live.manifest === 'pending' && !manifestStale && manifestStartedAt && (Date.now() - manifestStartedAt) > 90000) { manifestStale = true; renderSteps(); }
+      if (live.manifest !== 'pending') {
+        if (ghTabTimer) { clearInterval(ghTabTimer); ghTabTimer = null; }
+        ghTabTrouble = null;
+        return;
+      }
+      var focused = !document.hidden && (typeof document.hasFocus !== 'function' || document.hasFocus());
+      var next = ghTabState(ghTab, ghTabLeft, ghTabSince, Date.now(), focused);
+      if (next !== ghTabTrouble) { ghTabTrouble = next; renderSteps(); }
     }
     function pollManifest(stateToken) {
       stopManifestPoll();
@@ -7083,7 +7481,10 @@ summary{min-height:24px;padding:3px 0;}
           .then(function (d) {
             if (myGen !== manifestGen) return;
             if (d.app_slug && d.app_slug !== live.appSlug) { live.appSlug = d.app_slug; rememberManifest(undefined, undefined, d.app_slug); renderSteps(); }
-            if (seedSetup(d.checklist, d.install_url)) renderSteps();   /* the server-verified ticks (task 1004649) */
+            /* the server-verified ticks (task 1004649), and whose account the app is on */
+            var setupMoved = seedSetup(d.checklist, d.install_url, d);
+            if (noteAppOrg(d.app_org)) setupMoved = true;
+            if (setupMoved) renderSteps();
             var next = d.ready ? 'done' : (d.status || 'pending');
             var failure = d.failure || null;
             if (next !== live.manifest || failure !== live.manifestFailure) { live.manifest = next; live.manifestFailure = failure; rememberManifest(undefined, next); renderSteps(); }
@@ -7329,7 +7730,11 @@ summary{min-height:24px;padding:3px 0;}
               else noteManifestWait();
             }
             /* the server-verified checklist rides the same read (task 1004649) */
-            if (data.github_setup && !manifestPollTimer && seedSetup(data.github_setup.checklist, data.github_setup.install_url)) renderSteps();
+            if (data.github_setup && !manifestPollTimer) {
+              var seedMoved = seedSetup(data.github_setup.checklist, data.github_setup.install_url, data.github_setup);
+              if (noteAppOrg(data.github_setup.app_org)) seedMoved = true;
+              if (seedMoved) renderSteps();
+            }
             /* the checklist reflects live state (task 1002694): a status transition —
                e.g. the scaffold landing — re-renders the steps (change-only, so the
                5s tick never clobbers an open dropdown or mid-flight button) */
@@ -7368,8 +7773,8 @@ summary{min-height:24px;padding:3px 0;}
       stopManifestPoll();
       instanceId = null;
       watchPending = false; manifestPending = false; manifestState = null;
-      manifestStartedAt = 0; manifestStale = false;
-      live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null, setup: null, installUrl: null };
+      manifestStartedAt = 0; ghTabTrouble = null;
+      live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null, appOrg: null, setup: null, installUrl: null, pickUp: null, verifying: false, askedPlatform: false };
       lastStepsHtml = '';
       lastProgHtml = '';
       hopReset();