@bongos/core 1.19.350 → 1.19.351

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.350",
-  "core_contract": "1.19.350",
-  "source_commit": "b3898b596361d562a903c957d10018ca30a88239",
+  "core_version": "1.19.351",
+  "core_contract": "1.19.351",
+  "source_commit": "a1a7446c35da856e17ae920f2d2e2a446320edb6",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T04:58:04.601Z",
+  "built_at": "2026-08-25T12:53:45.200Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 329,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1857,
-  "tree_sha256": "5f758a2af4bf5a44b2f4f32cbc908d1eff7b70dca35b889880a63f5c768fb78d",
+  "tree_sha256": "fef03d4bf7a70641e028393447ebffd7ca615173e976f25945a0f2846cb9f791",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1477,12 +1477,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "c9747b5e5e84179f9f5b33abd89c7b38e520328273a2f977a8d2abacacf1f318"
+      "sha256": "c517a98c5c2a6f853a441a64accd1cd00d5448a9f3fbf6e2c5a89d21ba110527"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "44564011072520a55824d40f2ed824a3a4238c362f41416cf3e43b2bac6a06eb"
+      "sha256": "47aa5ef6c242988ab5e47123f442e67b47ad03803588b7fecd57027cfb5c36e9"
     },
     {
       "path": "docs/design-contract.md",
@@ -4787,12 +4787,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2fd58f9d0189864a4c8d2c3162a8770850b9c2e40a424f770d7674680215ccb6"
+      "sha256": "782cf5fe234b13ce532d23dff2d26511364e0671fc4a706e828bb69a1aa747e5"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ed85b50d7ee00f78cda9cd034c43d319d0d99c2350a63f48b92fc374df73f5e4"
+      "sha256": "ffa5d64cebc96b2aa32b1e925ec8d128854b565fde7853b1dd6a1a40ae24f1ff"
     },
     {
       "path": "public-docs/index.html",
@@ -5052,7 +5052,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "208f23e9909da075d0f2bb64732ef34253421615fc6c7c6142eb3605637821f3"
+      "sha256": "6d57b80519977cc23b3da231164e20b645ced2b6bbf97ebd3e64f3f9b393321b"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -6652,7 +6652,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "60a8faf9804d21e1e7a71b48b407d0f1e3ef9fcc01532ca382dce975ef440e6d"
+      "sha256": "227d48d264188e540dda1fb674d6fb282d8eafd3db3d3d876ef075c0690029fa"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8537,12 +8537,12 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "c6062fe1a27ef5797e82e706e85034570baa933cca1d1db041b40bd3f5517a0b"
+      "sha256": "3a04673fa06b8319b07998b63829cc83c2ef0ec531c4156ca8823e26172c8ef5"
     },
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "d1f8e7c790b3086e15d727c38738e2ee8a08dc439a5b0d19ec00f988754fd8df"
+      "sha256": "4f8b786e8704b418354d2551d20466e4d9ca705ca7ac39d00cd2dc83e3080032"
     },
     {
       "path": "tests/promote_goal_id.mjs",
@@ -8612,7 +8612,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "9dab9ff400b0bcdfbf97e9fd365e3682457b76abfd9a8a70029cb944265b81f8"
+      "sha256": "5c5fe7821194630d0dc765ea0ad34560049e2b88c5ac5cae19b9fbd770df3168"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/docs/copy-inventory.md

@@ -1419,12 +1419,12 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `f6584b0a728b` | certain | The Verro Labs mark: a galaxy and constellation above a river valley threaded with circuitry | `public-landing/index.html:426` |
 | `72e85e8b6f47` | certain | The drums are rolling | `public-landing/projects.html:917` |
 | `fb416bf1a26b` | certain | The handle names your project on the platform — and its address comes with it. Once it stands up, a few GitHub | `public-landing/projects.html:871` |
-| `9dc1eee28cee` | certain | The platform used to deploy every project by reading its code from GitHub with a shared read-only credential — | `public-landing/projects.html:656` |
 | `20fcebaa85c4` | certain | The project hub needs JavaScript — the map, your projects, and starting a new one all live here. You can read  | `public-landing/projects.html:397` |
 | `4a740b5afe73` | certain | The project map | `public-landing/projects.html:407` |
 | `2b193468bbb5` | certain | These are the same steps however a project is created — nothing here is special to this page. | `public-landing/projects.html:925` |
 | `1eff94c94b66` | certain | This files the request; the control plane does the real standup and nothing touches servers from this page. Yo | `public-landing/projects.html:910` |
 | `d83b739afb1e` | certain | This is a project’s management page — it answers only to the person who owns it. Sign in with GitHub to open y | `public-landing/projects.html:605` |
+| `406e774e0952` | certain | This project’s deploys read its code from GitHub with an older key that only works on public repositories — so | `public-landing/projects.html:656` |
 | `8d60f3ee4d86` | certain | Toggle light or dark | `public-landing/index.html:282` |
 | `9b514fce13d7` | certain | Torn down | `public-landing/projects.html:574` |
 | `b1dd149424ea` | certain | Turn the filter off to see what everyone else is building — or start your own. | `public-landing/projects.html:450` |

package/docs/copy-registry.json

@@ -12421,15 +12421,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "9dc1eee28cee",
-      "surface": "landing",
-      "text": "The platform used to deploy every project by reading its code from GitHub with a shared read-only credential — and private repositories don’t admit it. New standups fix this: a private repository now gets the project’s own read-only deploy key, wired automatically",
-      "file": "public-landing/projects.html",
-      "line": 656,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "20fcebaa85c4",
       "surface": "landing",
@@ -12475,6 +12466,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "406e774e0952",
+      "surface": "landing",
+      "text": "This project’s deploys read its code from GitHub with an older key that only works on public repositories — so making the repository private would break the next deploy. New standups fix this: a private repository now gets the project’s own read-only deploy key, wired automatically",
+      "file": "public-landing/projects.html",
+      "line": 656,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "8d60f3ee4d86",
       "surface": "landing",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.350",
+  "version": "1.19.351",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.350",
+      "version": "1.19.351",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.350",
+  "version": "1.19.351",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -653,7 +653,7 @@ summary{min-height:24px;padding:3px 0;}
              explanation, not another platform's task tracker. -->
         <details class="finePrint" id="mRepoVisWhy">
           <summary>Why can’t it be private yet?</summary>
-          <p>The platform used to deploy every project by reading its code from GitHub with a shared read-only credential — and private repositories don’t admit it. New standups fix this: a private repository now gets the project’s own read-only deploy key, wired automatically<!--apex-only:start--> — shipped as <a href="{{buildersOrigin}}#/task/1002735" target="_blank" rel="noopener">task 1002735</a> in the builders’ hall<!--apex-only:end-->. A project set up before that still reads with the shared credential, so flipping it private would break its next deploy — the switch stays off until existing projects are re-wired.</p>
+          <p>This project’s deploys read its code from GitHub with an older key that only works on public repositories — so making the repository private would break the next deploy. New standups fix this: a private repository now gets the project’s own read-only deploy key, wired automatically<!--apex-only:start--> — shipped as <a href="{{buildersOrigin}}#/task/1002735" target="_blank" rel="noopener">task 1002735</a> in the builders’ hall<!--apex-only:end-->. A project set up before that still reads with the older key, so the switch stays off until existing projects are re-wired.</p>
         </details>
       </div>
 
@@ -1152,8 +1152,15 @@ summary{min-height:24px;padding:3px 0;}
     if (a.dataset.nav === 'home') return;   /* a real navigation — leave it alone */
     a.addEventListener('click', function (ev) { ev.preventDefault(); setView(a.dataset.nav, true); });
   });
-  document.querySelectorAll('[data-nav-to]').forEach(function (a) {
-    a.addEventListener('click', function (ev) { ev.preventDefault(); setView(a.dataset.navTo, true); });
+  /* delegated, not swept: a data-nav-to link injected into a card or the manage
+     page after boot (addressRow, renderDelete) would never be upgraded by a
+     one-shot querySelectorAll — it would cost a whole page load. A modified
+     click keeps its browser meaning, the same contract a[data-manage] has. */
+  document.addEventListener('click', function (ev) {
+    var a = ev.target.closest && ev.target.closest('[data-nav-to]');
+    if (!a || !isPlainClick(ev)) return;
+    ev.preventDefault();
+    setView(a.dataset.navTo, true);
   });
   /* Back / Forward land on the view the URL names — viewFromUrl() reads the
      manage id too, so a manage entry restores its project */
@@ -3125,7 +3132,7 @@ summary{min-height:24px;padding:3px 0;}
         '<p>GitHub → <em>your account’s</em> Settings → Developer settings → OAuth Apps → New OAuth App. (Developer settings live under your account, not the repo.)</p>' +
         '<div class="kv"><span class="kk">Homepage URL</span><code>' + esc(oa.homepageUrl) + '</code>' + copyBtn(oa.homepageUrl) + '</div>' +
         '<div class="kv"><span class="kk">Callback URL</span><code>' + esc(oa.callbackUrl) + '</code>' + copyBtn(oa.callbackUrl) + '</div>' +
-        '<p>The generated credentials are placed on the platform’s control plane by an operator — that part isn’t yours to run (the one-click path above does it all automatically). It’s done when <code style="font-family:var(--font-mono)">' + esc(oa.homepageUrl) + '/healthz</code> reports <code style="font-family:var(--font-mono)">auth_configured: true</code>.</p></details>';
+        '<p>The platform team places the generated credentials; this step ticks itself once they land.</p></details>';
     }
 
     /* oauth-app — the ADR 0133 one-click GitHub-App manifest flow is the primary path
@@ -3176,10 +3183,10 @@ summary{min-height:24px;padding:3px 0;}
        the box. Web sign-in works either way; the CLI also has a web-token fallback. */
     function renderStepDeviceFlow() {
       if (live.manifest !== 'done') {
-        return '<li class="slocked" data-onboard-step="device-flow"><b>Enable Device Flow — one checkbox</b><p>Unlocks once GitHub sign-in above is wired. It lets builders sign in from a terminal (<code style="font-family:var(--font-mono)">bongos setup</code>); web sign-in works without it.</p></li>';
+        return '<li class="slocked" data-onboard-step="device-flow"><b>Let builders sign in from a command line — one checkbox</b><p>Unlocks once GitHub sign-in above is wired. It lets builders sign in from a terminal — the <code style="font-family:var(--font-mono)">bongos setup</code> command builders run on their own machine; web sign-in works without it.</p></li>';
       }
       var appUrl = live.appSlug ? 'https://github.com/settings/apps/' + esc(live.appSlug) : null;
-      return '<li data-onboard-step="device-flow"><b>Enable Device Flow — one checkbox</b><p>' +
+      return '<li data-onboard-step="device-flow"><b>Let builders sign in from a command line — one checkbox</b><p>' +
         (appUrl
           ? 'Open <a href="' + appUrl + '" target="_blank" rel="noopener">your app’s settings</a>, check <strong>Enable Device Flow</strong>, and save. '
           : 'GitHub → Settings → Developer settings → GitHub Apps → your app → check <strong>Enable Device Flow</strong> → save. ') +
@@ -3957,6 +3964,11 @@ summary{min-height:24px;padding:3px 0;}
        address is tracked separately (task 1002897); until then "reserved" is
        both the honest word and the accurate one, since a revive re-uses exactly
        this hostname. */
+    /* pre-standup: at 'requested' nothing has been built, so the shape arms
+       below would describe a server and a database that never existed. error
+       and provisioning keep the built-world text on purpose — a run that failed
+       partway may already have a database, a port and a DNS record. */
+    if (inst && inst.status === 'requested') return 'Nothing has been stood up yet — this cancels the standup. Anything already on GitHub is untouched, and the name and web address stay reserved for this project.';
     return inst && inst.hosting_shape === 'dedicated'
       ? 'This project has a machine to itself, so the machine goes away and its database goes with it. Your repository is untouched. Its web address stays reserved for this project and shows an error page until you bring it back. Nothing here erases a project.'
       : 'The server goes away. Your repository is untouched. The database is kept, so bringing it back later restores its memory. Its web address stays reserved for this project and shows an error page until you bring it back. Nothing here erases a project.';
@@ -3989,7 +4001,7 @@ summary{min-height:24px;padding:3px 0;}
       return 'Address: <code>' + esc(inst.domain) + '</code> — it answers there once the instance is live.';
     }
     /* the HONEST no-address state: sign-in on the instance needs a real domain */
-    return '<span class="none">No address yet</span> — sign-in on this project can’t be set up until it has one.';
+    return '<span class="none">No address yet</span> — sign-in on this project can’t be set up until it has one. <a href="?view=mine" data-nav-to="mine">Give it an address from your projects</a>.';
   }
 
   /* ── the bring-your-own-domain fold (owner decision 2, 2026-08-24). A live
@@ -4431,11 +4443,18 @@ summary{min-height:24px;padding:3px 0;}
         if (m === 'handled' || m === 'stale') return;
         $('mLoading').hidden = true;
         var a = $('mAlert');
-        a.textContent = 'Couldn’t read this project right now — refresh in a moment.';
+        a.innerHTML = 'Couldn’t read this project right now. <button type="button" class="btn small ghost" id="mAlertRetry">Try again</button>';
         a.classList.add('on');
       });
   }
 
+  /* the alert's own way out (task 1003245): delegated, because the catch above
+     rewrites #mAlert's innerHTML on every failure — a bound button would not
+     survive the next write. A loud re-read: the founder asked. */
+  $('mAlert').addEventListener('click', function (ev) {
+    if (ev.target.closest && ev.target.closest('#mAlertRetry')) loadManage();
+  });
+
   function manageChipTick() {
     if (document.hidden || currentView !== 'manage' || !manageInst) return;
     renderManage(manageInst); /* zero requests — re-dates "checked Xm ago" */
@@ -4475,7 +4494,7 @@ summary{min-height:24px;padding:3px 0;}
     } else {
       repoVisMsg(
         '<div class="addr">This repository is <b>public</b> — anyone can read its code.</div>' +
-        '<p class="finePrint">Making it private isn’t possible from here yet: this project’s deploys still read the repository with the shared credential, so flipping now would break the next deploy. The switch lands with the re-wiring fix.</p>');
+        '<p class="finePrint">Making it private isn’t possible from here yet — see below for why.</p>');
     }
   }
 
@@ -4596,7 +4615,8 @@ summary{min-height:24px;padding:3px 0;}
       return;
     }
     /* a project that never finished standing up still reaches here — that is
-       the whole point of the widened gate; the consequence copy is the same */
+       the whole point of the widened gate; teardownTruth() scopes the copy to
+       its status */
     delMsg('<p class="plain">' + teardownTruth(inst) + '</p>' +
       '<div class="actions"><button type="button" class="btn small danger" data-del-ask>Tear it down</button></div>');
   }

package/src/module-api.js

@@ -1130,8 +1130,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.348 with no explicit bump. run 32803276871. (task 1002620)
 //   1.19.350 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.349 with no explicit bump. run 32810944115. (task 1002620)
+//   1.19.351 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.350 with no explicit bump. run 32850120472. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.350'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.351'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub.mjs

@@ -997,8 +997,10 @@ test('flip-to-private cannot travel from this page — only the public direction
     'no code path may send the private direction');
   // the refusal is SAID, with its reason, not silently missing — post-ADR-0176 the
   // reason is THIS project's shared-credential wiring, not a platform-wide inability
-  assert.match(SCRIPT, /would break the next deploy/,
-    'the flip-to-private limitation is stated in plain words');
+  assert.match(SCRIPT, /Making it private isn’t possible from here yet — see below for why\./,
+    'the refusal is SAID inline, and points at the fold that carries the reason');
+  assert.match(HUB, /would break the next deploy/,
+    'the flip-to-private limitation is stated in plain words, in the fold');
 });
 
 test('the visibility shown is GitHub\'s answer, never an assumption', () => {
@@ -1033,7 +1035,7 @@ test('the refusal carries a LINK to the limitation, never prose alone (task 1003
   assert.match(HUB, /id="mRepoVisWhy"/, 'the why-fold is real markup beside the section body');
   const fold = (HUB.match(/<details[^>]*id="mRepoVisWhy"[\s\S]*?<\/details>/) || [''])[0];
   assert.ok(fold, 'the fold must be extractable');
-  assert.match(fold, /shared read-only credential/, 'the WHY is stated in plain words');
+  assert.match(fold, /an older key that only works on public repositories/, 'the WHY is stated in plain words');
   assert.match(fold, /\{\{buildersOrigin\}\}#\/task\/1002735/,
     'the tracked fix is a real link, hall-origin server-stamped (never client-filled)');
   // apex-only: a child instance keeps the explanation, not another platform's tracker

package/tests/projects_hub_pre_uat.mjs

@@ -363,6 +363,47 @@ test('card action results announce, nothing under the pointer is deleted, and fo
   assert.match(fn('focusCardControl'), /li\.querySelector\('\.actions a, \.actions button'\) \|\|\n\s*li\.querySelector\('details\.attachFold summary'\)/, 'nearest control as the fallback');
 });
 
+/* ── copy follow-ups (task 1003245) ── */
+test('teardown copy is state-aware: a queued project is told nothing was built', () => {
+  const truth = fn('teardownTruth');
+  assert.match(truth, /if \(inst && inst\.status === 'requested'\) return 'Nothing has been stood up yet — this cancels the standup\. Anything already on GitHub is untouched, and the name and web address stay reserved for this project\.';/);
+  const arm = truth.indexOf("inst.status === 'requested'");
+  const shape = truth.indexOf("hosting_shape === 'dedicated'");
+  assert.ok(arm > 0 && arm < shape, 'the pre-standup arm comes before the shape arms');
+  assert.doesNotMatch(truth, /status === 'error'|status === 'provisioning'/, 'error and provisioning keep today’s text — a failed run may already have built things');
+});
+
+test('founder voice on the Device Flow step and the manual OAuth fallback', () => {
+  const df = fn('renderStepDeviceFlow');
+  assert.equal((df.match(/<b>Let builders sign in from a command line — one checkbox<\/b>/g) || []).length, 2, 'both branches carry the outcome-first title');
+  assert.doesNotMatch(df, /<b>Enable Device Flow — one checkbox<\/b>/);
+  assert.match(df, /the <code style="font-family:var\(--font-mono\)">bongos setup<\/code> command builders run on their own machine/, 'the command is glossed, not bare-coded');
+  assert.doesNotMatch(df, /Optional/, 'not optional — a manifest-born App has Device Flow off');
+  assert.equal((df.match(/<strong>Enable Device Flow<\/strong>/g) || []).length, 2, 'GitHub’s own checkbox label stays verbatim in the instructions');
+  const manual = fn('manualOauthDetails');
+  assert.match(manual, /The platform team places the generated credentials; this step ticks itself once they land\.<\/p><\/details>/);
+  assert.doesNotMatch(manual, /auth_configured|healthz/, 'no JSON health check for a founder to perform');
+});
+
+test('repo visibility: the refusal is one line, the mechanism lives in the fold', () => {
+  const rv = fn('renderRepoVis');
+  assert.match(rv, /This repository is <b>public<\/b> — anyone can read its code\./, 'line one stays');
+  assert.match(rv, /Making it private isn’t possible from here yet — see below for why\./);
+  assert.doesNotMatch(rv, /shared credential/);
+  const fold = (HUB.match(/<details[^>]*id="mRepoVisWhy"[\s\S]*?<\/details>/) || [''])[0];
+  assert.match(fold, /an older key that only works on public repositories/);
+  assert.doesNotMatch(fold, /shared read-only credential/);
+  assert.match(fold, /<!--apex-only:start--> — shipped as <a href="\{\{buildersOrigin\}\}#\/task\/1002735"/, 'the hall task link stays inside its apex-only sentinel');
+});
+
+test('a failed manage read offers a retry; the no-address sentence offers a door', () => {
+  assert.match(SCRIPT, /a\.innerHTML = 'Couldn’t read this project right now\. <button type="button" class="btn small ghost" id="mAlertRetry">Try again<\/button>';/);
+  assert.match(SCRIPT, /\$\('mAlert'\)\.addEventListener\('click', function \(ev\) \{\n\s*if \(ev\.target\.closest && ev\.target\.closest\('#mAlertRetry'\)\) loadManage\(\);/, 'delegated — the catch rewrites the alert on every failure');
+  assert.match(fn('addressRow'), /No address yet<\/span> — sign-in on this project can’t be set up until it has one\. <a href="\?view=mine" data-nav-to="mine">Give it an address from your projects<\/a>\./);
+  assert.match(SCRIPT, /var a = ev\.target\.closest && ev\.target\.closest\('\[data-nav-to\]'\);\n\s*if \(!a \|\| !isPlainClick\(ev\)\) return;/, 'data-nav-to is delegated, so a link injected after boot switches views in place');
+  assert.doesNotMatch(SCRIPT, /querySelectorAll\('\[data-nav-to\]'\)/, 'the boot-time sweep is gone');
+});
+
 /* ── accessibility follow-ups (task 1003246) ── */
 test('the done panel’s progress region is stable, change-only, and says each stage’s state', () => {
   assert.match(HUB, /<div id="liveProgress" role="status" aria-live="polite"><\/div>/, 'the live region is the static wrapper');

package/tests/public_landing_projects.mjs

@@ -157,7 +157,7 @@ test('the repo-visibility section is served live, with the private direction ref
   // never shows another platform's tracker). The link itself is pinned inside
   // its sentinels by tests/projects_hub.mjs.
   assert.match(body, /id="mRepoVisWhy"/, 'the why-fold is served');
-  assert.match(body, /shared read-only credential/, 'the explanation survives the strip');
+  assert.match(body, /an older key that only works on public repositories/, 'the explanation survives the strip');
   assert.doesNotMatch(body, /#\/task\/1002735/,
     'the apex-only task link is stripped from a standalone serve');
 });