[freeqaz]

Problem

A member walk of the console found four wording leftovers:

• Repositories tab without repository access. A member who can edit the Agent saw "Repository access is not available in this Installation's configuration. [Set up repository access] (a GitHub operator runbook). You can't save repository changes on this page until an operator sets up repository access." A member cannot follow the runbook, and "an operator" appears nowhere else. The console says "an Installation administrator".
• First deployment the caller cannot read. The status line said "Deployment accepted…", but the summary card said "Latest visible deployment: None. No readable deployments." A redeploy shows "Deployment accepted. You cannot read the version you deployed." (fix(console): say a member's own unreadable deployment was accepted and keep stop #3731/fix(console): keep the accepted unreadable deployment when older versions are unloaded #3737).
• Two names for one empty state. The Namespaces page said "No accessible namespaces". The shell panel said "No readable Namespaces".

Change

• agents/repositories.mts: one first sentence for everyone: "This Installation has no repository access, so this Agent cannot use repositories." The setup guide link now shows only to a known Installation administrator. Anyone else sees "Ask an Installation administrator to set it up." (askAdministratorTo). The "until an operator sets up repository access" sentence is gone. Save stays hidden in that state, as before. The follow-up sentences that tell the user how to continue without repository access are unchanged.
• agents/detail.mts: with no readable versions, a version that this tab deployed sets the card to "Deployment accepted" / "You cannot read the version you deployed." (one constant, also used by the redeploy note).
• namespaces.mts / console.mjs: one NO_READABLE_NAMESPACES heading ("No readable Namespaces") for both places.
• Tests use new shared constants in tests/helpers/refusal-text.mjs. They cover a new member case for the Repositories tab, a summary-card check on the first-deploy test, and both Namespace headings. A new Storybook story covers the member view: Pages/Agent detail "Repository access without a Repo Driver, for a member".

Two items from the same walk needed no change:

• POST /namespaces/{id}/credential-sources 403 names the Namespace ID that the request path carried. That is allowed by the denial rule (fix(iam): name the missing grant in a caller's own denial #3699/fix(api): name a denied resource the caller can already read #3712). The console never shows it to a member: Agent create is administrator-only, and Create Agent refuses up front. So no console text is rephrased and the API is not changed.
• PATCH of an Agent without configurationId answers 400 before 403. Fastify's schema validation runs before identity resolution and authorization (preHandler / handler), so every Agent ID gets the same 400. It is not an existence oracle. Every console Agent PATCH sends configurationId. API validation order is unchanged.

Verification

• On main with only the test changes, these fail: the member Repositories test, the admin setup-line test, the two retained-repository tests, the first-deploy summary-card check, and the four "No readable Namespaces" heading checks. With this change, all pass (remote test VM).
• checks-browser and checks-browser-2 lanes, and the touched browser files pinned 20/20 at 2 CPUs: see the comment below.
• tsc --build (incl. tests), Prettier, and ESLint on the touched files.
• UI: copy-only change. The new Storybook story shows the member view. The admin story keeps its link.

Risks

Low. Console copy only. An administrator whose Installation-access answer is unknown (the probe failed) sees the member line without the link until a reload. A known administrator keeps the link.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review ended

ClawSweeper stopped reviewing this revision because the pull request closed.

View the workflow run.

[freeqaz]

Verification on a remote test VM (head 23428d2; 063b11e only drops an unused export):

• checks-browser: pass. checks-browser-2: pass.
• Touched browser files pinned 20/20 at 2 CPUs (private network namespace): console-agent-repositories, console-next-steps, console-namespace-create, console-agent-saves, console-agents, console.test.mjs.
• On main with only this PR's test changes, the changed tests fail: the member and administrator Repositories setup lines, the two retained-repository cases, the first-deploy summary card, and the four "No readable Namespaces" heading checks.
• tsc --build tsconfig.json tests/tsconfig.json: exit 0.

UI media is not attached yet. The change is copy only. The member view has a Storybook story: Pages/Agent detail, "Repository access without a Repo Driver, for a member".

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix(console): send members to an Installation administrator for repository setup and align deploy and Namespace copy This is item 1/1 in the current shard. Shard 0/1.

This temporary status tracks the active review worker. The completed review will appear in the durable ClawSweeper review comment.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.