failproofai 1.0.0 → 1.0.1-beta.0

package/.next/standalone/app/actions/update-scheduled-audit.ts

@@ -1,29 +1,104 @@
 "use server";
 
 /**
- * Write side of the /settings "Scheduled audit" section. Every write goes
- * through `updateConfig` — never a raw file write — so the layout-2 config
- * helpers stay the single writer of `config.toml` and the dashboard can never
- * disagree with what the CLI reads.
+ * Write side of the /settings scheduled-audit panel. Every write goes through
+ * `updateConfig` — never a raw file write — so `fp-config` stays the single
+ * writer of `config.json` and the dashboard can never disagree with what the
+ * CLI reads.
  *
  * ## CLI ⟷ dashboard parity
- *   - `setAutoAuditAction(enabled)`   ⟷ `[audit] auto`          (updateConfig)
- *   - `setAuditIntervalAction(days)`  ⟷ `[audit] interval_days` (updateConfig)
- * Both keys are exactly what the `failproofai config` wizard writes, so a value
- * set here is indistinguishable from one set on the CLI.
+ *   - `setAutoAuditAction(enabled)`  ⟷ `[audit] auto`
+ *   - `setAuditIntervalAction(days)` ⟷ `[audit] interval_days`
+ *
+ * Both go through the same `updateConfig` the CLI uses — `failproofai audit
+ * --schedule` / `--no-schedule` call it too — so a value set on either side is
+ * byte-identical. That is the whole mechanism behind "the two
+ * surfaces are always in sync": there is one file, one writer function, and no
+ * second copy of the state to drift.
  */
 
 import { readConfig, updateConfig } from "@/src/hooks/fp-config";
+import { readAuth, whoAmI } from "@/lib/auth/auth-store";
+
+/**
+ * The outcome of trying to turn scheduling on.
+ *
+ * "Signed out" is RETURNED, not thrown, and that is the whole point of this
+ * type. Next masks a server action's thrown error before the browser sees it —
+ * the client gets an opaque digest, never the message — so a caller matching on
+ * the text works in development and silently degrades to a generic failure in
+ * production, which is exactly what happened: the page showed an address it had
+ * read from the local session file, the toggle took the signed-in path, and the
+ * user got "could not turn that on." with no way forward from that click.
+ *
+ * A returned discriminant survives the boundary, so the caller can open the
+ * sign-in dialog for the one failure that has an obvious next step.
+ */
+export type SetAutoAuditResult =
+  | { ok: true; auto: boolean }
+  | { ok: false; reason: "signed-out" }
+  /**
+   * The session is intact locally and the api-server could not be reached.
+   *
+   * Separated from `signed-out` because `whoAmI()` collapses them: it returns
+   * null for a 401 AND for every transport failure, so an offline machine, a
+   * proxy that blocks the host, and a genuinely expired token were one answer.
+   * The user was told "that sign-in expired" and handed a code prompt that
+   * cannot succeed either — the failure it names is not the failure they have,
+   * and following its advice costs them a real, working session.
+   */
+  | { ok: false; reason: "unreachable" };
 
 /**
  * Turn the scheduled scan on or off.
  *
+ * Turning it ON is refused without a session. Scheduling and mailing are ONE
+ * decision — the reason to put a scan on a timer is to be told what it found —
+ * so a machine with the timer set and nobody to tell is a switch that reads as
+ * on and produces nothing, discoverable only by noticing that no digest ever
+ * arrives. The caller signs the user in first and retries.
+ *
+ * `whoAmI()` asks the SERVER, so this refuses in a case the page cannot see: a
+ * session file that exists locally but whose refresh token the api-server has
+ * rejected. The local file is what the page reads to show "reports go to …", so
+ * the two disagree exactly when a session has expired or was minted against a
+ * different server — and that disagreement is the common case, not an edge one.
+ *
+ * Turning it OFF never checks. An expired session must not be able to trap
+ * somebody into keeping a feature they are trying to disable.
+ *
+ * Note this gates SETTING UP the timer, not the machine's ongoing work: a
+ * session that later expires leaves the timer running and the local scan
+ * working, and only the digest stops. See `report-harm.ts`.
+ *
  * Returns the value actually stored (re-read), so an optimistic UI can confirm
  * against the source of truth rather than assume its own guess landed.
  */
-export async function setAutoAuditAction(enabled: boolean): Promise<{ auto: boolean }> {
-  const next = updateConfig({ audit: { auto: enabled } });
-  return { auto: next.audit.auto };
+export async function setAutoAuditAction(enabled: boolean): Promise<SetAutoAuditResult> {
+  if (enabled) {
+    const who = await whoAmI();
+    if (!who) {
+      // `whoAmI()` deletes the session on a 401 and leaves it alone on a
+      // transport failure, so what is left ON DISK is the one thing that tells
+      // the two apart — no extra request, and nothing new that can fail.
+      const local = readAuth();
+      const stillWithinWindow = local && local.refresh_expires_at * 1000 > Date.now();
+      return { ok: false, reason: stillWithinWindow ? "unreachable" : "signed-out" };
+    }
+  }
+  // Enabling stamps consent in the same write, because the `whoAmI()` above is
+  // exactly what makes this a consent record rather than a guess: a person was
+  // present, signed in, and looking at the panel that enumerates what gets
+  // sent. `reportHarm` gates sending on the stamp, not on `auto`, so a machine
+  // that inherited `auto` from a release where it meant "scan locally on a
+  // timer" mails nothing until somebody passes through here or the CLI.
+  //
+  // Disabling leaves the stamp alone. It is a record of something that did
+  // happen, and it grants nothing on its own — sending needs `auto` too.
+  const next = updateConfig({
+    audit: enabled ? { auto: true, reportsConsentedAt: Date.now() } : { auto: false },
+  });
+  return { ok: true, auto: next.audit.auto };
 }
 
 /**
@@ -31,14 +106,12 @@ export async function setAutoAuditAction(enabled: boolean): Promise<{ auto: bool
  *
  * The clamp lives in `fp-config.readIntervalDays` (1..90, with 0/negatives/
  * fractions falling back to the default) and is DELIBERATELY not reimplemented
- * here: we write the raw value and then RE-READ, so what we return to the UI is
- * exactly what the config decided to keep. Reflecting the re-read value is how a
- * hand-typed 3650 shows up in the dashboard as the 90 the config actually
- * enforces, with no second copy of the bounds to drift.
+ * here: we write the raw value and then RE-READ, so what comes back is exactly
+ * what the config decided to keep. Reflecting the re-read value is how a
+ * hand-typed 3650 shows up as the 90 the config actually enforces, with no
+ * second copy of the bounds to drift.
  */
 export async function setAuditIntervalAction(days: number): Promise<{ intervalDays: number }> {
   updateConfig({ audit: { intervalDays: days } });
-  // Re-read through readConfig so the returned value carries the config's own
-  // clamp, not the raw input.
   return { intervalDays: readConfig().audit.intervalDays };
 }

package/.next/standalone/app/api/auth/status/route.ts

@@ -2,40 +2,30 @@
  * GET /api/auth/status
  *
  * Returns the currently signed-in identity by reading the local
- * `~/.failproofai/auth.json` cache. No round-trip to the api-server — the
+ * `~/.failproofai/audit/session.json` cache. No round-trip to the api-server — the
  * file is the source of truth for who is signed in on this machine.
  * This keeps the dashboard UI and the CLI consistent regardless of whether
  * the api-server is reachable.
  *
- * Also returns the user's persisted re-audit reminder (if any). The reminder
- * lives in ~/.failproofai/next-audit.json and is only surfaced when its
- * `user_email` matches the active session — so swapping accounts via CLI
- * does not leak a previous user's reminder into the dashboard.
+ * Reminders are gone: the machine now audits itself on a timer and mails a
+ * digest when it finds harm, so there is nothing to nudge anyone about. The
+ * scheduled-scan state lives in `getScheduledAuditAction`, which reads it from
+ * the config and the daemon rather than from here.
  */
 import { NextResponse } from "next/server";
-import { readAuth, readReminder } from "@/lib/auth/auth-store";
+import { readAuth } from "@/lib/auth/auth-store";
 
 export const dynamic = "force-dynamic";
 
 export async function GET(): Promise<NextResponse> {
   const auth = readAuth();
   if (!auth) {
-    return NextResponse.json({ authenticated: false, reminder: null }, { status: 200 });
+    return NextResponse.json({ authenticated: false }, { status: 200 });
   }
-  const reminderRaw = readReminder();
-  const reminder =
-    reminderRaw && reminderRaw.user_email === auth.user.email
-      ? {
-          next_audit_at: reminderRaw.next_audit_at,
-          user_email: reminderRaw.user_email,
-          set_at: reminderRaw.set_at,
-        }
-      : null;
   return NextResponse.json(
     {
       authenticated: true,
       user: { id: auth.user.id, email: auth.user.email },
-      reminder,
     },
     { status: 200 },
   );

package/.next/standalone/app/audit/_components/audit-dashboard.tsx

@@ -10,7 +10,7 @@
  *   02 StrengthsSection — what it's great at
  *   03 QuirksSection — what slipped through
  *   04 HowToImproveSection — install / configure
- *   05 ComeBackBetterSection — reminder + perks
+ *   05 ComeBackBetterSection — spread the audit (invite)
  *
  * Empty / running states fall back to EmptyState and RunProgress.
  */
@@ -355,11 +355,7 @@ function MainReport({
             projected={projected}
             projectedGrade={projectedGrade}
           />
-          <ComeBackBetterSection
-            isRunning={isRunning}
-            onRerun={() => onRerun("return_section")}
-            score={score}
-          />
+          <ComeBackBetterSection score={score} />
         </div>
         <ReportFooter cachedAt={cachedAt} />
       </div>

package/.next/standalone/app/audit/_components/come-back-better-section.tsx

@@ -1,335 +1,155 @@
 "use client";
 
 /**
- * Section 05 — COME BACK BETTER. "build the habit."
+ * Section 05 — SPREAD THE AUDIT.
  *
- * Two side-by-side cards:
+ * One job: get someone else to run this on their own machine. The scheduled-
+ * audit controls used to live here too and have moved to `/settings`, reachable
+ * from the gear in the header — they are machine configuration, and this is the
+ * end of a report. Mixing "here is what your agent did" with "here is how to
+ * configure a background service" made the last thing you read before leaving
+ * the page a settings form.
  *
- *  • Reminder — set a reminder cadence (3d / 7d / 14d / 30d). The cadence
- *    selection persists through /api/auth/reminder. Anon users get the
- *    AuthDialog first; authed-with-existing-reminder users see the next
- *    audit date and can reset.
- *
- *  • Unlock perks — share with N friends to unlock pro features for a
- *    month. UI only — invite tracking + entitlement is a follow-up; the
- *    button opens the same X share intent the poster uses.
- *
- * Re-audit moves out of this section: a small inline "or re-audit now"
- * link sits under the reminder card so the affordance survives without
- * dominating the layout.
+ * The AuthDialog is still here because inviting needs a sender identity to Cc.
+ * It is now the ONLY thing on this section that opens it, which is what makes
+ * the resume unambiguous — the bug this section used to have was a shared
+ * dialog whose success handler assumed which control had opened it.
  */
 import { useCallback, useEffect, useRef, useState } from "react";
 import { usePostHog } from "@/contexts/PostHogContext";
-import { isAbortError } from "@/lib/fetch-with-timeout";
 import { AuthDialog, type AuthedUser } from "./auth-dialog";
 import { InviteDialog } from "./invite-dialog";
 
 interface Props {
-  isRunning: boolean;
-  onRerun: () => void;
   /** Current audit score (0–100), forwarded into the invite email body. */
   score?: number;
 }
 
-const DEFAULT_REMINDER_DAYS = 7;
-const REMINDER_OPTIONS = [3, 7, 14, 30] as const;
-type Cadence = typeof REMINDER_OPTIONS[number];
-
 const PERKS_PERK = "wanna know how your friends' agents score?";
 
-// The AuthDialog is shared by the reminder and invite CTAs. The reminder path
-// keeps the dialog's default copy; the invite path swaps in login-required
-// copy. Content only — the auth flow is identical for both.
 const INVITE_AUTH_COPY = {
   headline: "Oops! Login required",
   subhead: "What's your email?",
 } as const;
 
-type AuthStatus =
-  | { kind: "unknown" }
-  | { kind: "anon" }
-  | { kind: "authed"; user: { id: string; email: string } };
-
-interface Reminder {
-  next_audit_at: number;
-  user_email: string;
-  set_at: number;
-}
-
-function daysUntil(unixSecs: number): number {
-  const nowSecs = Math.floor(Date.now() / 1000);
-  return Math.max(0, Math.ceil((unixSecs - nowSecs) / 86400));
-}
-
-function formatNextAudit(unixSecs: number): string {
-  const d = new Date(unixSecs * 1000);
-  return d.toLocaleDateString(undefined, {
-    weekday: "short",
-    month: "short",
-    day: "numeric",
-  });
-}
-
-export function ComeBackBetterSection({ isRunning, onRerun, score }: Props) {
+export function ComeBackBetterSection({ score }: Props) {
   const { capture } = usePostHog();
-  const [authStatus, setAuthStatus] = useState<AuthStatus>({ kind: "unknown" });
-  const [reminder, setReminder] = useState<Reminder | null>(null);
-  const [cadence, setCadence] = useState<Cadence>(DEFAULT_REMINDER_DAYS);
-  const [dialogOpen, setDialogOpen] = useState(false);
-  const [inviteDialogOpen, setInviteDialogOpen] = useState(false);
-  const [reminderBusy, setReminderBusy] = useState(false);
-  // Copy for the shared AuthDialog: {} keeps the reminder defaults,
-  // INVITE_AUTH_COPY shows the invite variant. Set by whichever CTA opens the
-  // dialog — content selection only, no effect on the auth flow.
-  const [authCopy, setAuthCopy] = useState<{ headline?: string; subhead?: string }>({});
-  const ctaShownRef = useRef(false);
-  const lastRefreshAtRef = useRef(0);
-
-  const refreshStatus = useCallback(async () => {
-    lastRefreshAtRef.current = Date.now();
-    // Preserve current UI state on transient failures (5xx, network blips).
-    // Downgrading to anon on every error would clear a valid reminder mid-
-    // session on a single failed poll, forcing an unnecessary auth prompt.
-    // Only fall through to anon on the very first probe (still "unknown")
-    // so the cadence buttons unlock even if the server is unreachable.
-    const fallbackToAnonOnError = () => {
-      setAuthStatus((prev) => (prev.kind === "unknown" ? { kind: "anon" } : prev));
-    };
-    try {
-      const res = await fetch("/api/auth/status", { cache: "no-store" });
-      if (!res.ok) {
-        fallbackToAnonOnError();
-        return;
-      }
-      const body = (await res.json()) as {
-        authenticated?: boolean;
-        user?: { id: string; email: string };
-        reminder?: Reminder | null;
-      };
-      if (body.authenticated && body.user) {
-        setAuthStatus({ kind: "authed", user: body.user });
-        setReminder(body.reminder ?? null);
-      } else {
-        setAuthStatus({ kind: "anon" });
-        setReminder(null);
-      }
-    } catch {
-      fallbackToAnonOnError();
-    }
-  }, []);
+  const [signedIn, setSignedIn] = useState<{ id: string; email: string } | null>(null);
+  /**
+   * Whether the sign-in probe below has come back yet.
+   *
+   * `signedIn` starts null and null also means "signed out", so on its own it
+   * cannot say whether the answer has arrived — and the impression event fires
+   * on the first commit, which is always before the fetch resolves. It
+   * therefore reported `signed_in: false` for every view ever recorded,
+   * including a signed-in one. A separate flag restores the tri-state the
+   * previous version of this section carried for the same reason.
+   */
+  const [probed, setProbed] = useState(false);
+  const [authOpen, setAuthOpen] = useState(false);
+  const [inviteOpen, setInviteOpen] = useState(false);
+  const shownRef = useRef(false);
 
   useEffect(() => {
-    void refreshStatus();
-    const REFRESH_MIN_INTERVAL_MS = 5_000;
-    const maybeRefresh = () => {
-      if (Date.now() - lastRefreshAtRef.current < REFRESH_MIN_INTERVAL_MS) return;
-      void refreshStatus();
-    };
-    const onFocus = () => maybeRefresh();
-    const onVisibility = () => {
-      if (document.visibilityState === "visible") maybeRefresh();
-    };
-    window.addEventListener("focus", onFocus);
-    document.addEventListener("visibilitychange", onVisibility);
+    // Cancellation guard rather than a bare fire-and-forget: the probe outlives
+    // a fast unmount otherwise, and setting state on a gone component is the
+    // kind of warning people learn to scroll past.
+    let cancelled = false;
+    (async () => {
+      try {
+        const res = await fetch("/api/auth/status", { cache: "no-store" });
+        if (!res.ok || cancelled) return;
+        const body = (await res.json()) as {
+          authenticated?: boolean;
+          user?: { id: string; email: string };
+        };
+        if (!cancelled) setSignedIn(body.authenticated && body.user ? body.user : null);
+      } catch {
+        // Leave whatever we last knew. A failed probe is not evidence of a
+        // signed-out user, and downgrading on one would prompt for a login the
+        // person already completed.
+      } finally {
+        // In `finally`, so a route that 404s or a fetch that throws still
+        // releases the impression event. A failed probe genuinely does not know
+        // whether anyone is signed in, and never reporting the view at all is a
+        // worse answer than reporting the one it has.
+        if (!cancelled) setProbed(true);
+      }
+    })();
     return () => {
-      window.removeEventListener("focus", onFocus);
-      document.removeEventListener("visibilitychange", onVisibility);
+      cancelled = true;
     };
-  }, [refreshStatus]);
+  }, []);
 
   useEffect(() => {
-    if (ctaShownRef.current) return;
-    if (authStatus.kind === "unknown") return;
-    ctaShownRef.current = true;
-    capture("audit_reminder_cta_shown", {
-      auth_state: authStatus.kind,
-      has_existing_reminder: reminder !== null,
-      source: "come_back_better_section",
-    });
-  }, [authStatus, capture, reminder]);
-
-  const persistReminder = useCallback(
-    async (inDays: number): Promise<Reminder | null> => {
-      const controller = new AbortController();
-      const timer = setTimeout(() => controller.abort(), 10_000);
-      try {
-        setReminderBusy(true);
-        const res = await fetch("/api/auth/reminder", {
-          method: "POST",
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify({ in_days: inDays }),
-          signal: controller.signal,
-        });
-        if (!res.ok) {
-          if (res.status === 401) {
-            setAuthStatus({ kind: "anon" });
-            setReminder(null);
-          }
-          capture("audit_reminder_saved", {
-            status: `http_${res.status}`,
-            source: "come_back_better_section",
-            cadence_days: inDays,
-          });
-          return null;
-        }
-        const body = (await res.json()) as { reminder?: Reminder };
-        capture("audit_reminder_saved", {
-          status: body.reminder ? "success" : "empty",
-          source: "come_back_better_section",
-          cadence_days: inDays,
-        });
-        return body.reminder ?? null;
-      } catch (err) {
-        const kind = isAbortError(err) ? "timeout" : "error";
-        capture("audit_reminder_saved", {
-          status: kind,
-          source: "come_back_better_section",
-          cadence_days: inDays,
-        });
-        return null;
-      } finally {
-        clearTimeout(timer);
-        setReminderBusy(false);
-      }
-    },
-    [capture],
-  );
+    if (!probed || shownRef.current) return;
+    shownRef.current = true;
+    capture("audit_share_section_shown", { signed_in: signedIn !== null });
+  }, [capture, probed, signedIn]);
 
-  const handleCadenceClick = useCallback(
-    async (next: Cadence) => {
-      setCadence(next);
-      capture("audit_reminder_cta_clicked", {
-        auth_state: authStatus.kind,
-        has_existing_reminder: reminder !== null,
-        cadence_days: next,
-        source: "come_back_better_section",
-      });
-      if (authStatus.kind === "authed") {
-        const saved = await persistReminder(next);
-        if (saved) setReminder(saved);
-        return;
-      }
-      if (authStatus.kind === "anon") {
-        setAuthCopy({}); // reminder context → keep the dialog's default copy
-        setDialogOpen(true);
-      }
-    },
-    [authStatus, capture, persistReminder, reminder],
-  );
+  const handleInvite = useCallback(() => {
+    capture("audit_perks_invite_clicked", { signed_in: signedIn !== null });
+    // Unauthed users sign in first, so the invite has a sender to Cc.
+    if (!signedIn) {
+      setAuthOpen(true);
+      return;
+    }
+    setInviteOpen(true);
+  }, [capture, signedIn]);
 
   const handleAuthed = useCallback(
     async (user: AuthedUser) => {
-      setAuthStatus({ kind: "authed", user });
-      capture("audit_auth_completed", {
-        source: "come_back_better_section",
-      });
-      const saved = await persistReminder(cadence);
-      if (saved) setReminder(saved);
+      setSignedIn(user);
+      setAuthOpen(false);
+      capture("audit_auth_completed", { source: "share_section" });
+      // Resume the one thing that could have opened the dialog.
+      setInviteOpen(true);
     },
-    [cadence, capture, persistReminder],
+    [capture],
   );
 
-  const handleInvite = useCallback(() => {
-    capture("audit_perks_invite_clicked", {
-      source: "come_back_better_section",
-      auth_state: authStatus.kind,
-    });
-    // Unauthed users go through the AuthDialog first so we have a sender
-    // identity to Cc on the invite email.
-    if (authStatus.kind !== "authed") {
-      setAuthCopy(INVITE_AUTH_COPY); // invite context → "Oops! Login required"
-      setDialogOpen(true);
-      return;
-    }
-    setInviteDialogOpen(true);
-  }, [authStatus.kind, capture]);
-
-  const handleRerunInline = useCallback(() => {
-    if (isRunning) return;
-    onRerun();
-  }, [isRunning, onRerun]);
-
-  const days = reminder ? daysUntil(reminder.next_audit_at) : 0;
-
   return (
-    <section className="audit-sec" data-screen-label="05 Come back better">
+    <section className="audit-sec" data-screen-label="05 Spread the audit">
       <div className="audit-sec-head">
-        <span className="audit-sec-eyebrow">
-          <span className="ix">05</span>{"// come back better"}
-        </span>
-      </div>
-      <h2 className="audit-sec-title">build the habit</h2>
-
-      <div className="cbb-grid">
-        {/* Reminder card */}
-        <div className="cbb-card">
-          <div className="cbb-card-title">set a reminder</div>
-          <div className="cbb-card-sub">
-            {reminder
-              ? `next audit set for ${formatNextAudit(reminder.next_audit_at)} · in ${days} day${days === 1 ? "" : "s"}.`
-              : "we'll nudge you when your next audit is due. pick the cadence:"}
-          </div>
-          <div className="cadence-row">
-            {REMINDER_OPTIONS.map((d) => (
-              <button
-                key={d}
-                type="button"
-                className={`cadence-btn${cadence === d ? " on" : ""}`}
-                disabled={reminderBusy || authStatus.kind === "unknown"}
-                onClick={() => void handleCadenceClick(d)}
-              >
-                {d}d
-              </button>
-            ))}
-          </div>
-          <button
-            type="button"
-            className="cbb-link"
-            disabled={isRunning}
-            onClick={handleRerunInline}
-          >
-            {isRunning ? "scanning…" : "or re-audit now →"}
-          </button>
+        <div className="audit-sec-eyebrow">
+          <span className="ix">05</span> share
         </div>
-
-        {/* Perks card */}
-        <div className="cbb-card">
-          <div className="cbb-card-title">Share with friends</div>
-          <div className="cbb-card-sub">{PERKS_PERK}</div>
-          <button type="button" className="invite-btn" onClick={handleInvite}>
-            invite a friend
-          </button>
-          <div className="cbb-foot">
-            {"// invites are sent from failproof.ai, Cc'd to you, with a link to run their own audit."}
-          </div>
+      </div>
+      <h2 className="audit-sec-title">spread the audit</h2>
+
+      <div className="cbb-card share-card">
+        <div className="cbb-card-title">Share with friends</div>
+        <div className="cbb-card-sub">{PERKS_PERK}</div>
+        <button type="button" className="invite-btn" onClick={handleInvite}>
+          invite a friend
+        </button>
+        <div className="cbb-foot">
+          {"// invites are sent from failproof.ai, Cc'd to you, with a link to run their own audit."}
         </div>
       </div>
 
       <InviteDialog
-        open={inviteDialogOpen}
+        open={inviteOpen}
         source="come_back_better_section"
         score={score}
-        onClose={() => setInviteDialogOpen(false)}
+        onClose={() => setInviteOpen(false)}
         onUnauthorized={() => {
-          // Session expired between probe and submit — flip back to anon
-          // and bounce through the AuthDialog so the user re-auths.
-          setAuthStatus({ kind: "anon" });
-          setReminder(null);
-          setAuthCopy(INVITE_AUTH_COPY); // still the invite context
-          setDialogOpen(true);
+          // Session expired between the probe and the submit. Bounce through
+          // the dialog; success reopens the invite, since that is the only
+          // thing it can be resuming.
+          setInviteOpen(false);
+          setSignedIn(null);
+          setAuthOpen(true);
         }}
       />
 
       <AuthDialog
-        open={dialogOpen}
-        source="return_section"
-        headline={authCopy.headline}
-        subhead={authCopy.subhead}
-        onClose={() => setDialogOpen(false)}
-        onAuthed={(u) => {
-          setDialogOpen(false);
-          void handleAuthed(u);
-        }}
+        open={authOpen}
+        source="share_section"
+        headline={INVITE_AUTH_COPY.headline}
+        subhead={INVITE_AUTH_COPY.subhead}
+        onClose={() => setAuthOpen(false)}
+        onAuthed={(u) => void handleAuthed(u)}
       />
     </section>
   );