The review done-card stops assuming why titles are unresolved

Clean-run finding #2 from Eric: with a token loaded and resolve simply
not yet run, the card still said unmatched titles were "waiting on the
API token" — stub-era copy hard-coding the only reason unresolved
titles existed back then. The summary payload now carries
token_present (a boolean, never the value — pinned by test), and the
card gives the advice that fits: token loaded → "run resolve";
no token → the waiting message, now with a link to BGG's application
page since that reader hasn't registered yet.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016jXZFSTZQKzAC8fqpWSz9g

src/bggpipe/templates/pages/review.html

@@ -157,9 +157,15 @@ function render() {
         <div>${s.summary.rejected}<span>rejected</span></div>
       </div>
       ${waiting
-        ? `<p class="waiting">${waiting} titles are extracted but not yet matched
+        ? s.summary.token_present
-             to BGG — they're waiting on the API token.</p>
+          ? `<p class="waiting">${waiting} title(s) are extracted but not yet matched
-           <p class="next">When it arrives, run <b>resolve</b> from the <a href="/">pipeline</a>.</p>`
+               to BGG.</p>
+             <p class="next">Run <b>resolve</b> from the <a href="/">pipeline</a> to match them.</p>`
+          : `<p class="waiting">${waiting} title(s) are extracted but not yet matched
+               to BGG — they're waiting on your API token
+               (<a href="https://boardgamegeek.com/applications" target="_blank"
+                   rel="noopener">boardgamegeek.com/applications</a>).</p>
+             <p class="next">When it arrives, run <b>resolve</b> from the <a href="/">pipeline</a>.</p>`
         : `<p class="next">Next: run <b>diff</b> from the <a href="/">pipeline</a>, then check the <a href="/queue">queue</a>.</p>`}
     </div>`;
   }

src/bggpipe/webreview.py

@@ -701,6 +701,9 @@ def create_app(
                 "total": len(session.rows),
                 "extracted": len(session.titles),
                 "unresolved": unresolved_count,
+                # presence only, never the value: the done-card's advice
+                # differs between "run resolve" and "get a token first"
+                "token_present": bool(os.environ.get("BGG_API_TOKEN")),
             },
         }
 

tests/test_webreview.py

@@ -1429,3 +1429,17 @@ def test_readding_a_removed_hand_added_title_rescinds_the_removal(tmp_path):
     assert web.post("/api/add-title", json=add).status_code == 200
     titles = json.loads(cfg.titles_path.read_text())
     assert any(t["title_raw"] == "Homebrew Quest" for t in titles)
+
+
+def test_review_summary_reports_token_presence_not_value(tmp_path, monkeypatch):
+    """The done-card's advice differs between "run resolve" and "get a
+    token": the payload carries presence as a boolean, never the value."""
+    monkeypatch.setenv("BGG_API_TOKEN", "secret-token-value")
+    web, _ = make_client(tmp_path)
+    body = web.get("/api/state")
+    assert body.json()["summary"]["token_present"] is True
+    assert "secret-token-value" not in body.text
+
+    monkeypatch.delenv("BGG_API_TOKEN")
+    web2, _ = make_client(tmp_path / "tokenless")
+    assert web2.get("/api/state").json()["summary"]["token_present"] is False