@bongos/core 1.19.980 → 1.19.982

package/tests/blockers_lib.mjs

@@ -16,31 +16,35 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const lib = require('../modules/hall-ui/public/blockers-lib.js');
+// The lib owns no esc/fmtDate — callers pass the kit's (task 1003984).
+const kit = require('../modules/hall-ui/public/hall-kit.js');
+const F = { esc: kit.esc, fmtDate: kit.fmtAbsDate };
 
 test('loads standalone via require() — no window, no DOM (Node-require-safe like hall-kit.js)', () => {
   assert.ok(lib, 'module.exports must be set');
-  for (const k of ['esc', 'fmtDate', 'blockingLine', 'blockerFacts']) {
+  for (const k of ['blockingLine', 'blockerFacts']) {
     assert.ok(k in lib, `missing export: ${k}`);
   }
+  for (const k of ['esc', 'fmtDate']) assert.ok(!(k in lib), `lib must not re-own ${k}`);
 });
 
 test('blockerFacts: title links into the SAME #/blocker/N overlay task-detail.js renders', () => {
   const b = { id: 42, title: 'Need the owner’s AWS card on file', created_at: '2026-08-30T00:00:00.000Z', blocking_task_ids: [] };
-  const { titleHtml } = lib.blockerFacts(b, { blockerHref: (id) => `#/blocker/${id}` });
+  const { titleHtml } = lib.blockerFacts(b, { ...F, blockerHref: (id) => `#/blocker/${id}` });
   assert.match(titleHtml, /href="#\/blocker\/42"/);
   assert.match(titleHtml, /Need the owner/);
 });
 
 test('blockerFacts: with no blockerHref, the title renders as plain text, not a dead link', () => {
   const b = { id: 42, title: 'Something stuck', created_at: null, blocking_task_ids: [] };
-  const { titleHtml } = lib.blockerFacts(b);
+  const { titleHtml } = lib.blockerFacts(b, F);
   assert.doesNotMatch(titleHtml, /<a /);
   assert.match(titleHtml, /<span/);
 });
 
 test('blockerFacts: the caller-supplied classes land on the right fragments', () => {
   const b = { id: 1, title: 'x', body_md: 'a reason', created_at: '2026-08-30T00:00:00.000Z', blocking_task_ids: [] };
-  const { titleHtml, noteHtml, factsHtml } = lib.blockerFacts(b, {
+  const { titleHtml, noteHtml, factsHtml } = lib.blockerFacts(b, { ...F,
     titleClass: 'ginbox__goal', noteClass: 'ginbox__note', whenClass: 'ginbox__sub',
   });
   assert.match(titleHtml, /class="ginbox__goal"/);
@@ -49,19 +53,19 @@ test('blockerFacts: the caller-supplied classes land on the right fragments', ()
 });
 
 test('blockingLine: no linked tasks reads honestly, not as a false "0 tasks"', () => {
-  assert.equal(lib.blockingLine({ blocking_task_ids: [] }, null), 'Blocking nothing yet');
-  assert.equal(lib.blockingLine({}, null), 'Blocking nothing yet');
+  assert.equal(lib.blockingLine({ blocking_task_ids: [] }, null, kit.esc), 'Blocking nothing yet');
+  assert.equal(lib.blockingLine({}, null, kit.esc), 'Blocking nothing yet');
 });
 
 test('blockingLine: singular/plural noun agreement, and every id becomes a link when taskHref is given', () => {
-  const one = lib.blockingLine({ blocking_task_ids: [5] }, (id) => `/task/${id}`);
+  const one = lib.blockingLine({ blocking_task_ids: [5] }, (id) => `/task/${id}`, kit.esc);
   assert.equal(one, 'Blocking 1 task: <a href="/task/5">#5</a>');
-  const many = lib.blockingLine({ blocking_task_ids: [5, 6] }, (id) => `/task/${id}`);
+  const many = lib.blockingLine({ blocking_task_ids: [5, 6] }, (id) => `/task/${id}`, kit.esc);
   assert.equal(many, 'Blocking 2 tasks: <a href="/task/5">#5</a>, <a href="/task/6">#6</a>');
 });
 
 test('blockingLine: with no taskHref the ids still render, as plain text — never a dead link', () => {
-  const line = lib.blockingLine({ blocking_task_ids: [5] }, null);
+  const line = lib.blockingLine({ blocking_task_ids: [5] }, null, kit.esc);
   assert.equal(line, 'Blocking 1 task: #5');
   assert.doesNotMatch(line, /<a /);
 });
@@ -71,21 +75,21 @@ test('blockerFacts: the facts line is ONE `·`-joined span, not several ungapped
   // between them (unlike .ov-row__facts, which is a flex container) and would
   // render Filed-date and Blocking-line running together with no separator.
   const b = { id: 1, title: 'x', created_at: '2026-08-30T00:00:00.000Z', blocking_task_ids: [7] };
-  const { factsHtml } = lib.blockerFacts(b, { taskHref: (id) => `/task/${id}` });
+  const { factsHtml } = lib.blockerFacts(b, { ...F, taskHref: (id) => `/task/${id}` });
   assert.equal((factsHtml.match(/<span/g) || []).length, 1, 'exactly one wrapping span');
   assert.match(factsHtml, /Filed .* · Blocking 1 task/);
 });
 
 test('blockerFacts: body_md becomes a quoted note; an empty one renders nothing', () => {
-  const withNote = lib.blockerFacts({ id: 1, title: 'x', body_md: 'reason', blocking_task_ids: [] });
+  const withNote = lib.blockerFacts({ id: 1, title: 'x', body_md: 'reason', blocking_task_ids: [] }, F);
   assert.match(withNote.noteHtml, /<p class="ov-row__sub">“reason”<\/p>/);
-  const noNote = lib.blockerFacts({ id: 1, title: 'x', body_md: '   ', blocking_task_ids: [] });
+  const noNote = lib.blockerFacts({ id: 1, title: 'x', body_md: '   ', blocking_task_ids: [] }, F);
   assert.equal(noNote.noteHtml, '');
 });
 
 test('blockerFacts: a very long body_md is clipped, so one enormous blocker cannot blow up the row', () => {
   const long = 'x'.repeat(500);
-  const { noteHtml } = lib.blockerFacts({ id: 1, title: 't', body_md: long, blocking_task_ids: [] });
+  const { noteHtml } = lib.blockerFacts({ id: 1, title: 't', body_md: long, blocking_task_ids: [] }, F);
   assert.ok(noteHtml.length < 500, 'clipped well below the source length');
   assert.match(noteHtml, /…”<\/p>$/);
 });
@@ -95,8 +99,12 @@ test('blockerFacts: HTML in a title/body/task id is escaped, not injected', () =
     id: 1, title: '<script>alert(1)</script>', body_md: '<img onerror=alert(1)>',
     created_at: '2026-08-30T00:00:00.000Z', blocking_task_ids: [1],
   };
-  const { titleHtml, noteHtml, factsHtml } = lib.blockerFacts(b, { taskHref: (id) => `/task/"><script>${id}` });
+  const { titleHtml, noteHtml, factsHtml } = lib.blockerFacts(b, { ...F, taskHref: (id) => `/task/"><script>${id}` });
   assert.doesNotMatch(titleHtml, /<script>/);
   assert.doesNotMatch(noteHtml, /<img /);
   assert.doesNotMatch(factsHtml, /<script>/);
 });
+
+test('blockerFacts: refuses to render without the caller-supplied esc/fmtDate', () => {
+  assert.throws(() => lib.blockerFacts({ id: 1, title: 'x' }), /opts.esc and opts.fmtDate are required/);
+});

package/tests/github_repo_visibility.mjs

@@ -3,10 +3,11 @@
 //
 // The load-bearing assertions:
 //   • the PRIVATE direction is refused BEFORE GitHub is ever called (409
-//     private_not_deployable): the deploy pull runs as the shared deploy key,
-//     which cannot read a private repo (walk finding N4), so flipping private
-//     would break the project's next deploy — the honest-refusal leg this task
-//     ships. The refusal must not even consult the stored token.
+//     private_not_deployable): a project stood up public reads with the shared
+//     key, which cannot read a private repo (walk finding N4), so a bare flip
+//     would break its next deploy. The refusal points at the manage page, whose
+//     queued route wires the project's own deploy key first (task 1003078). It
+//     must not even consult the stored token.
 //   • flip-to-public calls makeRepoPublic with the parsed owner/name and
 //     forwards GitHub's own answer — the new state is never assumed
 //   • a GitHub 401 drops the stored token and re-prompts (the /github/repos
@@ -80,7 +81,7 @@ test('GET /github/repo: forwards GitHub\'s answer for the caller\'s own credenti
     assert.equal(res._status, 200);
     assert.equal(res._body.repo.private, true);
     assert.equal(res._body.repo.admin, true);
-    assert.equal(res._body.private_deployable, false, 'the platform truth rides every answer');
+    assert.equal(res._body.private_deployable, true, 'a private repo deploys through its own key (ADR 0176)');
     assert.deepEqual(s.calls.read, [{ owner: 'jaxri', name: 'mercury' }]);
   } finally { s.restore(); }
 });
@@ -129,7 +130,9 @@ test('POST visibility=private: refused 409 private_not_deployable — GitHub and
     await postHandler()({ builder: { id: 1 }, body: { repo: 'jaxri/mercury', visibility: 'private' } }, res);
     assert.equal(res._status, 409);
     assert.equal(res._body.error.code, 'private_not_deployable');
-    assert.match(res._body.error.message, /deploy/i, 'the refusal says WHY in plain words');
+    assert.match(res._body.error.message, /deploy key/i, 'the refusal says WHY in plain words');
+    assert.match(res._body.error.message, /manage page/, 'and names the door that CAN do it');
+    assert.doesNotMatch(res._body.error.message, /can’t be deployed yet/, 'the old platform-wide refusal is gone');
     assert.equal(s.calls.flip.length, 0, 'no GitHub call for a refused direction');
     assert.equal(tokenReads, 0, 'the refusal happens before the credential is even read');
   } finally { db.getGithubToken = origGet; s.restore(); }

package/tests/projects_hub.mjs

@@ -1210,10 +1210,10 @@ test('every owned card carries its Manage door, and a modified click keeps its m
 
 /* ── Repo visibility on the manage page (task 1003045) ──────────────────────
    The section reads the repo's REAL visibility from GitHub with the owner's
-   own repository credential and offers exactly one direction: private→public.
-   The private direction is refused — server-side and here — until the
-   private-repo deploy fix lands, because the deploy pull runs as the shared
-   deploy key that cannot read a private repo (walk finding N4). ── */
+   own repository credential. Going public is the direct core call; going
+   private (task 1003078) is QUEUED on the provisioning route, because the
+   project's own deploy key must be wired before the flip — a project stood up
+   public reads with the shared key, which cannot read a private repo (N4). ── */
 
 test('the repo-visibility section is live markup with its body slot (C7)', () => {
   assert.match(HUB, /id="mRepoVis"/, 'the section body must be real markup');
@@ -1221,16 +1221,14 @@ test('the repo-visibility section is live markup with its body slot (C7)', () =>
     'the pre-answer state is honest waiting copy, not a fake answer');
 });
 
-test('flip-to-private cannot travel from this page — only the public direction exists', () => {
-  assert.match(SCRIPT, /visibility: 'public'/, 'the one POST body pins the public direction');
+test('flip-to-private travels ONLY through the queued provisioning route, never the core flip', () => {
+  assert.match(SCRIPT, /visibility: 'public'/, 'the core POST body still pins the public direction');
   assert.doesNotMatch(SCRIPT, /visibility:\s*'private'/,
-    'no code path may send the private direction');
-  // the refusal is SAID, with its reason, not silently missing — post-ADR-0176 the
-  // reason is THIS project's shared-credential wiring, not a platform-wide inability
-  assert.match(SCRIPT, /Making it private isn’t possible from here yet — see below for why\./,
-    'the refusal is SAID inline, and points at the fold that carries the reason');
-  assert.match(HUB, /would break the next deploy/,
-    'the flip-to-private limitation is stated in plain words, in the fold');
+    'the core flip is never asked for private — it cannot wire the deploy key');
+  assert.match(SCRIPT, /'\/provisioning\/instances\/' \+ encodeURIComponent\(manageId\) \+ '\/repo-private'/,
+    'the private direction is the provisioning route, keyed on the project');
+  assert.doesNotMatch(HUB, /isn’t possible from here yet/, 'the refusal copy is gone');
+  assert.doesNotMatch(HUB, /Why can’t it be private yet\?/, 'and so is its fold');
 });
 
 test('the visibility shown is GitHub\'s answer, never an assumption', () => {
@@ -1261,19 +1259,15 @@ test('the reconnect door asks for repository access and returns to this project'
     'and returns to the exact project being managed');
 });
 
-test('the refusal carries a LINK to the limitation, never prose alone (task 1003077)', () => {
-  assert.match(HUB, /id="mRepoVisWhy"/, 'the why-fold is real markup beside the section body');
+test('the fold says what making it private does, in the order it happens (task 1003078)', () => {
+  assert.match(HUB, /id="mRepoVisWhy"/, 'the fold is real markup beside the section body');
   const fold = (HUB.match(/<details[^>]*id="mRepoVisWhy"[\s\S]*?<\/details>/) || [''])[0];
   assert.ok(fold, 'the fold must be extractable');
-  assert.match(fold, /an older key that only works on public repositories/, 'the WHY is stated in plain words');
-  assert.match(fold, /\{\{buildersOrigin\}\}#\/task\/1002735/,
-    'the tracked fix is a real link, hall-origin server-stamped (never client-filled)');
-  // apex-only: a child instance keeps the explanation, not another platform's tracker
-  const at = HUB.indexOf('{{buildersOrigin}}#/task/1002735');
-  const before = HUB.slice(0, at);
-  const opens = (before.match(/<!--apex-only:start-->/g) || []).length;
-  const closes = (before.match(/<!--apex-only:end-->/g) || []).length;
-  assert.equal(opens - closes, 1, 'the task link sits inside an apex-only sentinel pair');
+  assert.match(fold, /What making it private does/);
+  assert.match(fold, /its own read-only deploy key[\s\S]*only then makes the repository private/,
+    'the key comes first, the flip second — the safety property, in plain words');
+  assert.match(fold, /needs admin rights on the repository/, 'the one thing the owner must bring');
+  assert.doesNotMatch(fold, /an older key that only works on public repositories/, 'the old limitation is gone');
 });
 
 test('making a repo public asks first — exposure is never one accidental click', () => {

package/tests/projects_hub_pre_uat.mjs

@@ -585,15 +585,16 @@ test('founder voice on the Device Flow step and the manual OAuth fallback', () =
   assert.doesNotMatch(manual, /auth_configured|healthz/, 'no JSON health check for a founder to perform');
 });
 
-test('repo visibility: the refusal is one line, the mechanism lives in the fold', () => {
+test('repo visibility: the public line stays one line, then the door or the reason — the mechanism lives in the fold', () => {
   const rv = fn('renderRepoVis');
   assert.match(rv, /This repository is <b>public<\/b> — anyone can read its code\./, 'line one stays');
-  assert.match(rv, /Making it private isn’t possible from here yet — see below for why\./);
+  assert.match(rv, /repoPrivDoor\(manageInst, repo\)/, 'the public branch offers the door, or says why there is none');
+  assert.doesNotMatch(rv, /isn’t possible from here yet/, 'the old refusal is gone');
   assert.doesNotMatch(rv, /shared credential/);
   const fold = (HUB.match(/<details[^>]*id="mRepoVisWhy"[\s\S]*?<\/details>/) || [''])[0];
-  assert.match(fold, /an older key that only works on public repositories/);
+  assert.match(fold, /What making it private does/);
   assert.doesNotMatch(fold, /shared read-only credential/);
-  assert.match(fold, /<!--apex-only:start--> — shipped as <a href="\{\{buildersOrigin\}\}#\/task\/1002735"/, 'the hall task link stays inside its apex-only sentinel');
+  assert.doesNotMatch(fold, /#\/task\//, 'the fold explains; it no longer points at a tracked fix');
 });
 
 test('a failed manage read offers a retry; the no-address sentence offers a door', () => {

package/tests/projects_hub_repo_private.mjs

@@ -0,0 +1,238 @@
+// tests/projects_hub_repo_private.mjs
+//
+// The manage page's "Make it private" (split (c) of task 1003078): the page's OWN functions,
+// lifted out of projects.html and run in a sandbox with a fake DOM and fetch — so what is
+// proved is behaviour, not the shape of the source.
+//
+// The load-bearing assertions:
+//   • the door shows only where the route would accept it, and every other case says why
+//   • the POST reply is a RECEIPT: it lands in the stable slot, and nothing claims the
+//     repository is private until GitHub is asked again after the run settles
+//   • the in-flight line is fetch-free, repaints only when the run's state MOVES (the
+//     minute tick never flickers it), and the settle triggers exactly ONE GitHub re-read
+//   • a failed make-private reads as a failed make-private on the card, not a failed standup
+//
+// Run:  node tests/projects_hub_repo_private.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
+import vm from 'node:vm';
+
+const HUB = readFileSync(new URL('../modules/public-landing/public/projects.html', import.meta.url), 'utf8').replace(/\r\n/g, '\n');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// A top-level (2-space) declaration, up to its own closing brace at that indent.
+function grab(head) {
+  const at = HUB.indexOf(`\n  ${head}`);
+  assert.ok(at >= 0, `${head} must exist`);
+  const end = HUB.indexOf('\n  }', at + 1);
+  const close = HUB.slice(end, end + 5) === '\n  };' ? end + 5 : end + 4;
+  return HUB.slice(at, close);
+}
+const SOURCES = [
+  'function esc(', 'var FLOWS = {', 'function stripMarkup(', 'function stripFor(', 'function errCategory(',
+  'function repoPrivOpen(', 'function repoPrivDoor(', 'function repoVisNote(', 'function renderRepoVis(',
+  'function renderRepoVisState(', 'function askRepoPrivate(', 'function doRepoPrivate(',
+].map(grab).join('\n') + "\nfunction repoVisMsg(html) { $('mRepoVis').innerHTML = html; }\n";
+
+const RECEIPT = { status: 200, body: { ok: true, queued: true, message: 'Queued <b>ok</b>.' } };
+function world({ reply = RECEIPT } = {}) {
+  const els = { mRepoVis: { innerHTML: '' }, mRepoVisMsg: { className: 'projMsg', innerHTML: '' } };
+  const calls = { fetch: [], loadManage: [], reread: 0 };
+  let settle;
+  const done = new Promise((r) => { settle = r; });
+  const ctx = {
+    API: '/api/bongos', manageId: '18', manageInst: null, manageRepo: null,
+    mRepoPrivSeen: false, mRepoPrivState: '',
+    $: (id) => els[id],
+    document: { querySelector: () => null },
+    jsonOrEmpty: (res) => res.json(),
+    apiError: (data) => (data && data.error) || {},
+    signInAgain: () => 'SIGN-IN',
+    justLive: () => false,
+    loadRepoVisibility: () => { calls.reread++; },
+    loadManage: (...a) => { calls.loadManage.push(a); settle(); },
+    fetch: (url, opts) => {
+      calls.fetch.push({ url, opts });
+      return Promise.resolve({ ok: reply.status < 300, status: reply.status, json: async () => reply.body });
+    },
+  };
+  vm.createContext(ctx);
+  vm.runInContext(SOURCES, ctx, { filename: 'projects.html#repo-private' });
+  return { ctx, els, calls, done };
+}
+
+const LIVE = { id: 18, status: 'active', hosting_shape: 'standalone', target_ref: 'o/demo', open_intent: null };
+const PUBLIC = { private: false, admin: true };
+
+console.log('the door:');
+
+await ta('a live Cloud-host project whose owner is a repo admin gets the button', async () => {
+  const { ctx } = world();
+  assert.match(ctx.repoPrivDoor(LIVE, PUBLIC), /data-repo-private>Make it private</);
+});
+
+for (const [label, inst, repo, why] of [
+  ['own host', { ...LIVE, hosting_shape: 'byo-host' }, PUBLIC, /on GitHub directly/],
+  ['another shape', { ...LIVE, hosting_shape: 'dedicated' }, PUBLIC, /Cloud host/],
+  ['not running', { ...LIVE, status: 'error' }, PUBLIC, /once the project is running/],
+  ['no admin rights', LIVE, { private: false, admin: false }, /can’t change this repository’s settings/],
+]) {
+  await ta(`${label}: no button, and a sentence saying why`, async () => {
+    const { ctx } = world();
+    const html = ctx.repoPrivDoor(inst, repo);
+    assert.doesNotMatch(html, /data-repo-private/);
+    assert.match(html, why);
+  });
+}
+
+console.log('\nthe request — a receipt, never a new state:');
+
+await ta('Yes POSTs to the project’s repo-private route with NO body', async () => {
+  const w = world();
+  w.ctx.manageInst = { ...LIVE }; w.ctx.manageRepo = PUBLIC;
+  w.ctx.doRepoPrivate();
+  await w.done;
+  assert.equal(w.calls.fetch.length, 1);
+  assert.equal(w.calls.fetch[0].url, '/api/bongos/provisioning/instances/18/repo-private');
+  assert.equal(w.calls.fetch[0].opts.method, 'POST');
+  assert.equal(w.calls.fetch[0].opts.body, undefined, 'the route takes no fields');
+});
+
+await ta('a 200 puts the server’s sentence (escaped) in the stable slot, arms the re-read, and re-reads the row', async () => {
+  const w = world();
+  w.ctx.manageInst = { ...LIVE }; w.ctx.manageRepo = PUBLIC;
+  w.ctx.doRepoPrivate();
+  await w.done;
+  assert.equal(w.els.mRepoVisMsg.className, 'projMsg ok');
+  assert.equal(w.els.mRepoVisMsg.innerHTML, 'Queued &lt;b&gt;ok&lt;/b&gt;.');
+  assert.equal(w.ctx.mRepoPrivSeen, true, 'a run that settles before the re-read lands is still followed up');
+  assert.equal(JSON.stringify(w.ctx.manageInst.open_intent), JSON.stringify({ action: 'repo-private', state: 'pending' }),
+    'the receipt proves a run is open, so the row says so — and the 5s watch follows it');
+  assert.match(w.els.mRepoVis.innerHTML, /Making it private is queued/, 'the door gives way to the in-flight line at once');
+  assert.deepEqual(w.calls.loadManage, [[true, true]], 'quiet, keep the repo read');
+  assert.doesNotMatch(w.els.mRepoVis.innerHTML, /<b>private<\/b>/, 'nothing claims the flip happened');
+});
+
+await ta('a repaint from the row right after the click (the minute tick) keeps the run and its receipt', async () => {
+  const w = world();
+  w.ctx.manageInst = { ...LIVE }; w.ctx.manageRepo = PUBLIC;
+  w.ctx.doRepoPrivate();
+  await w.done;
+  w.ctx.renderRepoVisState(w.ctx.manageInst);
+  assert.equal(w.calls.reread, 0, 'no settle is read into a run that has not been re-read yet');
+  assert.match(w.els.mRepoVisMsg.innerHTML, /Queued/);
+  assert.doesNotMatch(w.els.mRepoVis.innerHTML, /data-repo-private/, 'the button does not come back');
+});
+
+await ta('a 404 (an archon on someone else’s project) says the rule plainly', async () => {
+  const w = world({ reply: { status: 404, body: { error: { code: 'instance_not_found' } } } });
+  w.ctx.manageInst = { ...LIVE }; w.ctx.manageRepo = PUBLIC;
+  w.ctx.doRepoPrivate();
+  await w.done;
+  assert.equal(w.els.mRepoVisMsg.className, 'projMsg err');
+  assert.match(w.els.mRepoVisMsg.innerHTML, /Only the project’s owner can make its repository private/);
+  assert.equal(w.ctx.mRepoPrivSeen, false);
+});
+
+await ta('a 409 shows the server’s own sentence, escaped', async () => {
+  const w = world({ reply: { status: 409, body: { error: { code: 'intent_conflict', message: "A 'restart' run is <i>running</i>" } } } });
+  w.ctx.manageInst = { ...LIVE }; w.ctx.manageRepo = PUBLIC;
+  w.ctx.doRepoPrivate();
+  await w.done;
+  assert.equal(w.els.mRepoVisMsg.className, 'projMsg err');
+  assert.match(w.els.mRepoVisMsg.innerHTML, /restart.* run is &lt;i&gt;running&lt;\/i&gt;/);
+  assert.doesNotMatch(w.els.mRepoVisMsg.innerHTML, /<i>/);
+});
+
+console.log('\nthe in-flight line and the settle:');
+
+await ta('the receipt slot is painted INSIDE #mRepoVis, never a sibling of it', async () => {
+  // every .mSec>div takes the same grid cell (cosmos.css), so a sibling would sit on top
+  const card = (HUB.match(/<div class="card mSec" id="mRepoVisibility">[\s\S]*?\n      <\/div>/) || [''])[0];
+  assert.ok(card, 'the card markup is extractable');
+  assert.doesNotMatch(card, /id="mRepoVisMsg"/, 'no second grid child in the card markup');
+  const w = world();
+  w.ctx.manageInst = { ...LIVE };
+  w.ctx.renderRepoVis(PUBLIC);
+  assert.match(w.els.mRepoVis.innerHTML, /<div class="projMsg" id="mRepoVisMsg" role="status" aria-live="polite"><\/div>$/);
+});
+
+await ta('an open run replaces the door with the in-flight line, worded by its state', async () => {
+  const w = world();
+  w.ctx.manageRepo = PUBLIC;
+  w.ctx.manageInst = { ...LIVE, open_intent: { action: 'repo-private', state: 'pending' } };
+  w.ctx.renderRepoVisState(w.ctx.manageInst);
+  assert.match(w.els.mRepoVis.innerHTML, /Making it private is queued/);
+  assert.doesNotMatch(w.els.mRepoVis.innerHTML, /data-repo-private/);
+  w.ctx.manageInst = { ...LIVE, open_intent: { action: 'repo-private', state: 'running' } };
+  w.ctx.renderRepoVisState(w.ctx.manageInst);
+  assert.match(w.els.mRepoVis.innerHTML, /the platform is giving this project its own deploy key first/);
+});
+
+await ta('the minute tick with an unchanged state does not repaint', async () => {
+  const w = world();
+  w.ctx.manageRepo = PUBLIC;
+  w.ctx.manageInst = { ...LIVE, open_intent: { action: 'repo-private', state: 'running' } };
+  w.ctx.renderRepoVisState(w.ctx.manageInst);
+  w.els.mRepoVis.innerHTML = 'SENTINEL';
+  w.ctx.renderRepoVisState(w.ctx.manageInst);
+  assert.equal(w.els.mRepoVis.innerHTML, 'SENTINEL');
+  assert.equal(w.calls.reread, 0, 'and asks GitHub nothing while it runs');
+});
+
+await ta('the settle asks GitHub exactly once and clears the receipt', async () => {
+  const w = world();
+  w.ctx.manageRepo = PUBLIC;
+  w.ctx.renderRepoVisState({ ...LIVE, open_intent: { action: 'repo-private', state: 'running' } });
+  w.els.mRepoVisMsg.innerHTML = 'Queued.';
+  w.ctx.renderRepoVisState({ ...LIVE, open_intent: null });
+  w.ctx.renderRepoVisState({ ...LIVE, open_intent: null });
+  assert.equal(w.calls.reread, 1, 'only GitHub can say the flip took — asked once');
+  assert.equal(w.els.mRepoVisMsg.innerHTML, '');
+});
+
+await ta('another intent (a restart) is not mistaken for a make-private run', async () => {
+  const w = world();
+  w.ctx.manageRepo = PUBLIC;
+  w.ctx.manageInst = { ...LIVE, open_intent: { action: 'restart', state: 'running' } };
+  w.ctx.renderRepoVis(PUBLIC);
+  assert.match(w.els.mRepoVis.innerHTML, /data-repo-private/);
+  w.ctx.renderRepoVisState(w.ctx.manageInst);
+  assert.equal(w.ctx.mRepoPrivSeen, false);
+});
+
+console.log('\nthe card:');
+
+await ta('the mine-card strip names the make-private flow and its running half', async () => {
+  const { ctx } = world();
+  const run = ctx.stripFor({ ...LIVE, open_intent: { action: 'repo-private', state: 'running' } });
+  assert.match(run, /Setting up its deploy key/);
+  assert.match(run, /setting up the project’s own deploy key first/);
+  const queued = ctx.stripFor({ ...LIVE, open_intent: { action: 'repo-private', state: 'pending' } });
+  assert.match(queued, /Making the repository private is queued/);
+  assert.doesNotMatch(queued, /repo-private run is queued/, 'not the generic fallback');
+});
+
+await ta('a retired make-private reads as that, not as a standup that stopped', async () => {
+  const { ctx } = world();
+  for (const note of [
+    'o/demo is still public: its deploy key could not be set up on the server. Nothing on your side caused this, and trying again is safe.',
+    'o/demo cannot be made private right now: GitHub could not be reached to set up its deploy key (fetch failed). Nothing has been changed — try again.',
+    'The deploy key for o/demo could not be set up, so the repository was left public.',
+  ]) assert.match(ctx.errCategory(note), /Making the repository private didn’t finish/, note);
+  for (const note of [
+    "o/demo cannot be made private: there is no usable GitHub credential stored for this project, and without one its deploy key cannot be registered. Reconnect the project's GitHub access, then try again.",
+    "o/demo was not made private: the project's GitHub credential could not be read. Its deploy key is already in place, so reconnect GitHub and try again.",
+  ]) assert.match(ctx.errCategory(note), /needs reconnecting/, 'the one fix the owner can make is not folded away');
+  assert.match(ctx.errCategory('deploy-key setup failed for o/demo: GitHub deploy-key add failed (500).'), /deploy key on GitHub didn’t finish/);
+  assert.match(ctx.errCategory('repository not found: GitHub answered 404'), /couldn’t find the project’s repository/, 'the older categories are untouched');
+});
+
+console.log(`\nprojects_hub_repo_private: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);