Recover sign-in discovery and preserve failed authentication drafts

Author: antropos17

DESIGN.md

@@ -103,6 +103,12 @@ distinct; only a refresh of the same scope may show explicitly last-available
 rows. A mismatched service snapshot asks the user to synchronize the workspace.
 Manual Retry/Refresh keeps keyboard entry and respects another chosen input.
 
+Provider discovery has its own busy/error/retry state on the account page.
+Unknown or malformed sign-in options stay disabled while the local account form
+and navigation remain usable. Refresh preserves that form's draft. Failed local
+or provider sign-in restores the initiating control unless another input was
+chosen. Configuration discovery does not establish a successful provider login.
+
 ## Motion
 
 No authored animation or transition in the workspace, including modal scale/fade, progress interpolation, hover motion and smooth route scrolling. Update status immediately without recreating the page. Native dialog handles focus and Escape; returning focus must not move the document. Game canvas motion belongs to gameplay and remains independent of workspace chrome.

docs/CONTEXT.md

@@ -82,7 +82,7 @@ and external AI CLIs require a direct user request. Never merge old work implici
 - Existing Commons run 49092854-f9bd-4b7a-8d12-4ac5ea0e5f70 retains the approved,
   unmerged safe-timer change from job 811bdb98-bcbb-4b65-80b9-f19693aef6b4.
   Preserve it. 29 earlier lab experiments were verified before this release work.
-- Public source: antropos17/commit-zero at 25a8583; all three CI jobs passed with local 7665539's identical tree. Preserve separate histories.
+- Public source: antropos17/commit-zero at c42faa4; all three CI jobs passed with local a13df1e's identical tree. Preserve separate histories.
   README GIF is a 15.8s condensed walkthrough of retained Sequence Kit work,
   not a continuous live recording. Static fallback included; desktop/mobile and all
   three CI jobs passed. Evidence: runtime/verification/github-readme-gif-2026-10-19.json.

docs/DISTRIBUTION.md

@@ -86,6 +86,14 @@ announcement posted elsewhere.
 > read-only large-history fixture; smaller initial DOM size is verified, while
 > changed snapshots still transfer the full history.
 >
+> Startup, service health, rankings and account recovery now have explicit
+> failure/retry behavior. Keyboard scenario stepping and pause remain usable;
+> saved-repository writes stay ordered across navigation and session changes.
+> Proposed roles include concrete downloadable fixtures and a separate unscored
+> evaluation set. Hosted-provider drafts remain disconnected. A read-only
+> artifact inspector identifies the existing Qwen file, and a source-evidence
+> preflight binds full/browser receipts to the exact source and public Git tree.
+>
 > The existing local Builder/Reviewer and Language lab paths remain separate
 > from the deterministic repository example and new fixtures. Proposal parsing
 > and review do not prove code behavior. Follow `README.md` for installation,
@@ -94,13 +102,14 @@ announcement posted elsewhere.
 Before publishing a release, replace the candidate version with an actual tag,
 link its exact commit and CI run, re-run the documented gates, and record real
 browser/model/sandbox coverage separately. No release was created by this note.
-Current implemented-code checkpoint: public `e788d0e`, [CI run 39228142114](https://github.com/antropos17/commit-zero/actions/runs/39228142114)
-passed the full gate, Chromium and runtime dependency audit. The fresh evidence
-preflight confirmed exact public main/CI. Local frozen gate at `e61e129` passed 81/81 Node tests, DOM/axe 2/2,
-build and serving with source hash
-`d3ab286ac18b39386976ac5278b923aebc2e4e066c7e509a26208793c3cce5e5`;
-separate local Chrome coverage passed 15/15 on the same hash. Health/retry changes await
-their full gate. Verify the final candidate revision before creating a release.
+Use the [dated handoff](HANDOFF-2026-10-19.md) and fresh
+`npm run evidence:status -- --github` output for the exact candidate SHA, source
+hash and CI association after frozen verification/publication. Copy those values
+into the release instead of carrying an earlier checkpoint's counts forward.
+The existing [v0.3.0 release](https://github.com/antropos17/commit-zero/releases/tag/v0.3.0)
+still points to `1abdf00` (checked 2026-10-19); this mission publishes newer main
+source and prepares the next release. Choose a new tag for that source and preserve
+the existing release and tag. No new release or promotional post was published.
 The checked capture set is already published at `98389bd`.
 
 ## Show HN fact sheet for a human author

docs/FIRST-RUN.md

@@ -59,6 +59,7 @@ do not establish runtime correctness. [Complete workflow](COMMONS.md).
 | Rankings are unavailable | Restore the service and select **Try again** or **Refresh**. A failed category read never reuses scores from another category. Same-category refresh failures label the last available rows; an empty search is separate. |
 | Rankings do not match the saved scenario | Another client may have changed the run or revision. Use **Refresh workspace** in the toolbar, then retry rankings if needed. Mismatched rows stay hidden. |
 | A request times out or returns invalid JSON | The browser reports a recoverable error. Restore the service and retry the read; a failed write is never retried automatically. Ordinary UI requests have a 12-second active-browser-time deadline, including body reads, alongside route cancellation. |
+| External sign-in options are unknown or failed to load | Use **Refresh sign-in options** in the account page. The local username/password draft stays in place. Unknown or malformed provider data never enables external sign-in. Configured options still require a real OAuth flow; this read does not verify account access. |
 | Commons cannot reach the service | Restore the local gateway, then use **Retry**. The error settles without a busy announcement; Retry is disabled while its request is pending. Background polling can also recover once the service returns. |
 | Built UI is older than source | `npm start` serves `dist`; run `npm run build` after source changes, or use `npm run dev` for development. |
 | **Run agents** is disabled | Check that the task has text, the project is active, no task is running, and **Check model** reports available. Start the local provider if it is offline. |

docs/HANDOFF-2026-10-19.md

@@ -8,17 +8,17 @@ tracks dated decisions and receipts; this file is the operational entry point.
 ## Repositories and state
 
 - Working repository: `X:\ai-github`, branch `codex/development-foundation`,
-  latest fully checked local commit `7665539` at this checkpoint. The local data and model
+  latest fully checked local commit `a13df1e` at this checkpoint. The local data and model
   installation are here. Recheck status before acting; this file can age.
 - Public repository: [antropos17/commit-zero](https://github.com/antropos17/commit-zero),
-  `main` at `25a85839d8ec92bc1d2f349bc6b4d876e29ede1b` after a normal push.
+  `main` at `c42faa484be0d9e068b23fd1b583f344a63e1e15` after a normal push.
   Its separate checkout is `.cache/publication`. The histories are unrelated;
-  the public tree matches local `7665539` (`e31d35601cf37efc51c787cbfca8950b8849e2cb`).
-  Scoped ranking/read-deadline changes are awaiting final gates.
+  the public tree matches local `a13df1e` (`9a8c3381af33da4f83097347e3f8db03c083a8c5`).
+  Account sign-in/discovery recovery changes are awaiting final gates.
   Do not merge histories, reset the local branch or force push. Recheck remote
   before publishing anything else.
-- Public CI [run 39235408701](https://github.com/antropos17/commit-zero/actions/runs/39235408701)
-  passed full gate, Chromium and runtime dependency audit for `25a8583`. Local
+- Public CI [run 39237404863](https://github.com/antropos17/commit-zero/actions/runs/39237404863)
+  passed full gate, Chromium and runtime dependency audit for `c42faa4`. Local
   `evidence:status` confirmed equal trees and current full/browser receipts. The
   preceding retry-fixture failure at `5f9f88e` is preserved in the mission log.
 - This mission has not run local or hosted model inference, spawned product
@@ -133,21 +133,28 @@ continues after a failed write, and drops unsent work after identity changes.
 Repository form state is scoped to run/repository; save completion respects focus.
 Other tabs are reconciled by explicit saved-list refresh, not cross-tab locking.
 Its six account Chrome tests and full 25-test browser/full gates passed before
-publication. The pending ranking unit keys resources by URL/revision, distinguishes
+publication. The completed ranking unit keys resources by URL/revision, distinguishes
 failure from empty results, and validates actual run/revision/category before
 showing rows. Four focused Chrome tests passed, including actual 12-second
 deadline recovery and a real newer transactional scenario revision. Four host
 HTTP tests cover error details, unfinished-body timeout, cancellation and invalid
 JSON. [Failure](media/rankings-unavailable-2026-10-19.png) and
 [narrow retained rows](media/rankings-last-known-2026-10-19.png) are inspected
 Chrome captures in disposable services with routed failures and simulated scores.
+Its frozen full 85/85 and Chrome 29/29 gates, then public CI, passed. The pending
+account-page unit validates discovery types, offers explicit Refresh without
+reloading the draft, scopes unknown availability, and restores failed-auth focus.
+Four focused Chrome tests passed, including malformed data and a routed OAuth
+start rejection with no external request. [Actual 390px error view](media/sign-in-discovery-unavailable-2026-10-19.png)
+uses an explicit fake draft and discovery failure in disposable services; real
+OAuth login remains unqualified.
 
-- Latest local frozen full gate at `7665539`: 81/81 Node tests, compiled DOM/axe
+- Latest local frozen full gate at `a13df1e`: 85/85 Node tests, compiled DOM/axe
   2/2, build and static serving passed. Stable source hash
-  `7ec859e49d5b90de6ba814c39b7cc6ee84d84ff79133506204945ab9bcaa623f`;
-  receipts `runtime/verification/bookmark-writes-{full,browser}-2026-10-19.json`
+  `71009df00efbbf03638e1258a3ea3210258e18c6fa4113f7b4a48998f953dd9a`;
+  receipts `runtime/verification/ranking-recovery-{full,browser}-2026-10-19.json`
   (ignored by Git).
-- Installed Chrome browser suite passed 25/25 at desktop and 390px. Real captures
+- Installed Chrome browser suite passed 29/29 at desktop and 390px. Real captures
   are `runtime/verification/commons-first-run-{desktop,narrow}-2026-10-19.png`,
   `commons-provider-offline-desktop-2026-10-19.png` and catalog captures. Tests
   used in-memory services; provider-health responses were controlled in the
@@ -216,7 +223,7 @@ Chrome captures in disposable services with routed failures and simulated scores
 
 ## Next work, in order
 
-1. Complete scoped rankings and request deadlines: run grouped Chrome and `npm run check` on frozen source,
+1. Complete account sign-in/discovery recovery: run grouped Chrome and `npm run check` on frozen source,
    commit it, copy the unpublished local commit into the separate public
    checkout, compare Git trees, push without force and inspect public CI.
    Record exact SHA and receipt.

docs/MISSION-2026-10-19.md

@@ -12,7 +12,7 @@ Start: 03:46:17 UTC. Deadline: 15:46:17 UTC. Final integration reserve begins 14
 
 ## Current action
 
-Finish scoped ranking recovery and ordinary request deadlines after three preserved Chrome failures. Retain data only within the same URL/revision, distinguish failure from empty results, verify returned ranking run/version/category, and combine route cancellation with the existing 12-second request/body deadline. Four host HTTP tests and four focused Chrome tests passed; run final focused/full gates and publish. Keep all new profiles disabled. The final integration reserve still begins at 14:16:17 UTC.
+Finish account sign-in/discovery recovery after three preserved Chrome failures. Keep local drafts/navigation through failed or malformed discovery, offer explicit refresh with unknown availability, and restore failed-auth focus. Four focused Chrome tests passed with no external provider request; complete frozen full gates and publication. Keep all new profiles disabled. The final integration reserve still begins at 14:16:17 UTC.
 
 ## Decisions and limits
 
@@ -100,4 +100,8 @@ Finish scoped ranking recovery and ordinary request deadlines after three preser
 - Chrome then reproduced a failed initial ranking labeled as an empty search, Overall rows remaining under a failed Code category, and a caller-cancellable read that stayed pending beyond the ordinary deadline. Baselines: `runtime/verification/ranking-state-baseline-2026-10-19` and `ranking-deadline-baseline-2026-10-19`. Scoped resources, explicit states and combined timeout/cancellation passed four focused Chrome tests; an actual 12-second foreground timeout recovered, and a real newer API revision required workspace synchronization before rows returned. Four host HTTP tests passed, including an unfinished body. Inspected actual captures copied to docs/media have SHA-256 `fad7ddf7` and `14840d06`. No inference or retained-store write.
 - Bounded primary research on GitHub Copilot's task/review workflow, Dev Containers metadata and Ollama model information reinforced existing scope/identity/runtime boundaries; no extra delegation, container configuration or provider was added. [Decisions and sources](ECOSYSTEM-DECISIONS.md). The dated older agent-native research now points explicitly to current operational documents without rewriting historical evidence.
 
-Complete focused UI, then freeze all source for the full 29-test browser suite and `npm run check`; commit/publish and inspect CI. Next inspect first-run provider-discovery recovery and release acceptance gaps. Keep the final 90-minute reserve from 14:16:17 UTC.
+- 10:26 UTC: scoped ranking recovery/request deadlines committed locally as `a13df1ee1dcc251b38b33721dcda7730b674fa48` after full 85/85 and Chrome 29/29 on frozen hash `71009df00efbbf03638e1258a3ea3210258e18c6fa4113f7b4a48998f953dd9a`. Receipts: `runtime/verification/ranking-recovery-{full,browser,evidence}-2026-10-19.json`. Normal push produced `c42faa484be0d9e068b23fd1b583f344a63e1e15`, identical tree `9a8c3381af33da4f83097347e3f8db03c083a8c5`. CI39237404863 passed all three jobs.
+- Chrome exposed a discovery error with no in-page repeat, malformed provider data replacing the workspace with its global error boundary, and a failed local sign-in losing keyboard focus. Baselines: `runtime/verification/auth-discovery-baseline-2026-10-19`, `auth-discovery-malformed-baseline-2026-10-19`, and `auth-submit-focus-baseline-2026-10-19`. Validation and scoped refresh/auth focus now passed four focused Chrome tests, including strict boolean availability, retained drafts and a routed OAuth-start failure with zero external requests. The inspected 390px capture is `docs/media/sign-in-discovery-unavailable-2026-10-19.png`, SHA-256 `04d44a2d`. No real OAuth login was attempted.
+- The existing public latest-release URL was checked: it resolves to v0.3.0 at `1abdf00`. Distribution notes now preserve that tag and request a new tag for the mission's newer main source. The earlier hardcoded release checkpoint was replaced by the live source-evidence workflow. No release or promotional post was created.
+
+Complete focused UI, then freeze all source for the full 33-test browser suite and `npm run check`; commit/publish and inspect CI. Next assess a reversible publication-preparation command against the observed repeated manual-copy workflow and remaining release gaps. Keep the final 90-minute reserve from 14:16:17 UTC.

docs/OAUTH.md

@@ -6,6 +6,15 @@ buttons stay disabled until both credentials for that provider are configured.
 Local username/password accounts remain usable. Automated tests use a mocked
 provider transport; they do not qualify a real provider login.
 
+On the account page, **Refresh sign-in options** rereads this server's provider
+configuration without reloading the local username/password draft. Failed or
+malformed discovery shows unknown availability and keeps external buttons
+disabled; it does not remove the local form or navigation. The refresh has scoped
+busy state and restores keyboard entry while respecting another selected input.
+A failed local sign-in or provider start also preserves the draft and its control.
+This UI recovery is tested in disposable services; the configured-only fixture
+and denied start do not establish actual GitHub/Google account access.
+
 ## Configure the local preview
 
 1. Create an OAuth application in your own GitHub/Google account using the settings