[freeqaz]

Problem

Dogfood round 44 (findings D746, D733, D734) found console refusals that say something different from the API and the CLI for the same refusal, or that show raw codes:

• Logs: "Log text requires Agent read_logs (or administer) and read access." The API and CLI name Agent read_logs (or Agent administer) and say who grants it.
• Diagnostics for a version without Slack showed failed (NOT_CONFIGURED) and unknown rows, as if something failed.
• A member's empty Agents list said "No Agents yet", although Agents exist that are not shared with them.
• Page-level 403 panels offered Retry, which gives the same answer, and one 403 named no one to ask.
• Several sentences said "an administrator" instead of "an Installation administrator".

Already fixed on main by #3695/#3696 (checked, not changed here): "Ask its owner to share it with you.", the Driver configurations sentence, the bound Secret metadata 403 and the empty Secrets list.

Change

• access-reasons.mts: LOG_TEXT_GRANT, LOG_TEXT_DENIED and RUNTIME_STATUS_DENIED, used by the Logs section and the network policy log grant. The text names Agent read_logs (or Agent administer) and asks an Installation administrator.
• Diagnostics: a version without Slack shows not set up / not checked instead of failed (NOT_CONFIGURED) / unknown, with a plain hint.
• Agents list: a reader without Agent create sees "No Agents are shared with you".
• A page-level 403 shows no Retry (the header's Refresh checks again after a grant); the Request ID stays as secondary detail. The Agent read refusal names who to ask.
• "an administrator" becomes "an Installation administrator" in the disabled-account, Namespace and shell panels.
• Docs: docs/guides/console/agent-details.md (diagnostics rows).
• Storybook: new scenarios runtimeLogTextDenied ("Runtime status and log text refused"), diagnosticsNoSlack ("Current observations for a version without Slack") and agentsEmptyMember ("Empty for a member").

Verification

• Browser tests updated to the new text (logs, overview, state, detail, console): console-agent-logs, console-agent-overview, console-agent-state, console-agent-detail, console.test.mjs. The changed assertions fail on main (checked in a separate worktree with only the test changes applied).
• The checks-browser lane passed on a remote test VM before the last test fix; CI is the authority for the final head. A 20/20 pin of the changed browser tests is owed and will be run when the test VM is reachable again.
• Prettier and ESLint on touched files.
• Before/after media below (Storybook, simulated UI proof, not backend proof).

Risks

• Low: copy and one empty-state title; no API change.
• Browser tests in other open PRs that assert the old log sentence need the new constant.

Media (Storybook, before then after)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix(console): log, diagnostics and empty-list text match the api and cli This is item 1/1 in the current shard. Shard 0/1.

This temporary status tracks the active review worker. The completed review will appear in the durable ClawSweeper review comment.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.