@bongos/core 1.19.978 → 1.19.980

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.978",
-  "core_contract": "1.19.978",
-  "source_commit": "07b4598f521bd18dea921d1f707ab68214f85278",
+  "core_version": "1.19.980",
+  "core_contract": "1.19.980",
+  "source_commit": "7e92e28e22b7fc66cf188d2f089c9824fc3c2c4f",
   "source_ref": "HEAD",
-  "built_at": "2026-09-23T15:32:43.462Z",
+  "built_at": "2026-09-23T16:31:15.535Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 517,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2929,
-  "tree_sha256": "e4b9a04a3018488400611b2d2bc6029ec350c267a483e351233d87a8f0a55948",
+  "tree_sha256": "c520e6934b708166a12bcdce8eb65bec32d14c3141823739f4e11ca7a4ccf0e0",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1362,7 +1362,7 @@
     {
       "path": "docs/adr/0176-private-repo-deploy-keys.md",
       "mode": "0000644",
-      "sha256": "c10a9b3039835676e84c1cedac77b3897fc03f5db689ecc34b8b658c51210d5f"
+      "sha256": "a397741f6fcbf88fe3a05fabe74c5fa0e6464d810e812ae7981700b13a0f1806"
     },
     {
       "path": "docs/adr/0177-goal-membership-kind.md",
@@ -2172,12 +2172,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "3174b60315d83707f5f9ab53f6dae77fc7c0a50fdb2da3d7ff866e0ebdfb414b"
+      "sha256": "ba0cec7ca155cae33a729aeed1bc960396f62f24119b4189070ae0ed1720e7f6"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "828a4e9925c463d88698b98da4510e7fda508234b88b96fc8af7a9f5652b901a"
+      "sha256": "fa6b7f4460cd63dcd37fe69928707e6281a32a36a6a2ce1f18d430961ec51039"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2707,7 +2707,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "8d5ba6662f56dc81bf49320bc07c18445e5097f3e40ed0e53f5af4a24a96f39b"
+      "sha256": "b0b20c2d38f39b2de54cdc173285f2e37b582a6e94bc4b46244eed8ec5eca1cc"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4722,7 +4722,7 @@
     {
       "path": "modules/hall-ui/public/blockers.js",
       "mode": "0000644",
-      "sha256": "432878a3718cb8540f5827dcb508ec5b3f414b7ffc96788ac108e7907ee84b19"
+      "sha256": "756983ad538385f5992d088d781bffadf495cc866ed3fca6df56ef734c53f50f"
     },
     {
       "path": "modules/hall-ui/public/board-lib.js",
@@ -4927,7 +4927,7 @@
     {
       "path": "modules/hall-ui/public/goal-inbox.js",
       "mode": "0000644",
-      "sha256": "8e8d581eb99bbff050e088b727266b9f4c0ab957d1c98fd407e2c4d592a5c8b3"
+      "sha256": "b64ea71dc70993e2d3f8e728a0c3ff6450ffb14d8bc84ea7fb6825f9758aa089"
     },
     {
       "path": "modules/hall-ui/public/goal-map-lib.js",
@@ -6792,7 +6792,7 @@
     {
       "path": "modules/provisioning/repo-private.js",
       "mode": "0000644",
-      "sha256": "0adee6537b5f127ea3fa5589bc92acc5b6accf6f100f395fe802640ff74b018f"
+      "sha256": "aa3e794ed904157f8549d6ab8ce28ae4a9fa3c2235758b59fc4bd3a66a3b7049"
     },
     {
       "path": "modules/provisioning/routes/body-validators.js",
@@ -8147,12 +8147,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "1250bd983d6fae46de399b17b3a04dc4ffd89acb0c259b814b820fbedcedce35"
+      "sha256": "d0620eae73bba11cd42473b163ad3eb1fc066cb17e4c9bbe8445517a57b20beb"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "36026f4837ffb4ce421f652247a82f1e632039142f154f8d5803de9425523c94"
+      "sha256": "fe13c610a08748c99ae43a611bddad1709f43163c8c107b85fb6d8690fddbb97"
     },
     {
       "path": "public-docs/index.html",
@@ -9132,12 +9132,12 @@
     {
       "path": "scripts/gds/provision-repo-private.js",
       "mode": "0000644",
-      "sha256": "f2c31eaf1808ee19aaf7266a82509a05ae39d7f638ffaf3aeffcc33e304262aa"
+      "sha256": "1209c7ae79f6ba568d8ae5b0da28a4a52d27447d24b0faf7d8496196e0110138"
     },
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "6e025cfa37165ff491f736f31bb97fa439e3e6cece9eaeeb4edcd6698e9868c0"
+      "sha256": "8ed211e290daa9621ec8c5b9ee107b6eea670adf46a32655fc4aa394dba001de"
     },
     {
       "path": "scripts/gds/provision-teardown.js",
@@ -10177,7 +10177,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "92413d2fc4ee3c637dd738d498afb53fdbae34119ba940b9fb72c46c391dc0d6"
+      "sha256": "6c31da122ca01487eb9d0e70dc06fd77f36d60d2333d0b1f8f24c2660c86c7df"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10712,7 +10712,7 @@
     {
       "path": "tests/blockers_page_ui.mjs",
       "mode": "0000644",
-      "sha256": "786a97b9cb24ed38c8703113533d733eb475ed671e3fc5b5ca5ce679b8d4a4a4"
+      "sha256": "83f7c78790430927c2666741036c4311e3efab3b2c28d093555e8a4c0b170a6e"
     },
     {
       "path": "tests/bongos_cli.mjs",
@@ -13317,7 +13317,7 @@
     {
       "path": "tests/provision_repo_private.mjs",
       "mode": "0000644",
-      "sha256": "9140b670c8ab76069c76238cf47bfdd539141198a40ef23f443813543947c4aa"
+      "sha256": "cd97e188c5b842b60d99b250d164a2b2da39e25fb56081064c9ec44107518356"
     },
     {
       "path": "tests/provision_restart.mjs",
@@ -13652,7 +13652,7 @@
     {
       "path": "tests/rot_inbox.mjs",
       "mode": "0000644",
-      "sha256": "382ddf61536d7fb738d99127cee03fa06df8ca79e53f876f702676189d900a67"
+      "sha256": "7611e8595f5ea2b314d92d756c15ba8dfc6843daf32c0130e00ed13a24fe38b8"
     },
     {
       "path": "tests/route_permission_check.mjs",

package/docs/adr/0176-private-repo-deploy-keys.md

@@ -54,7 +54,9 @@ best-effort revokes the key by title. Pushes keep preferring the owner-token HTT
   **Progress (2026-09-23):** the runner half has landed — task 1004167 let the wiring run
   before a flip (`intendedPrivate`), and task 1004193 added the `repo-private` intent whose
   runner leg wires the key and only then flips. The refusal stays until task 1003078 adds the
-  route and the manage-page control that enqueue it.
+  route and the manage-page control that enqueue it. **That route is owner-only** (owner
+  decision, task 1004194): the runner acts with the owner's stored GitHub token whoever
+  queued the intent, so an archon override would act on another person's GitHub account.
 - Builder **dev boxes** of a private-repo project were parked here as out of scope.
   **Answered on hardware 2026-08-25 (task 1003247): a box CAN read the private repo, and the
   auth design needed no change.** The GDS-backed credential helper (`otb-git-credential`,

package/docs/copy-inventory.md

@@ -590,7 +590,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `f192ff6563f9` | certain | Leave your GitHub username and an Archon will let you in. No coding needed to start — once you're approved, si | `modules/hall-ui/public/hall-render.js:294` |
 | `d6a78b9e5368` | certain | Let it be for now | `modules/hall-ui/public/studio.js:204` |
 | `d6a78b9e5368` | certain | Let it be for now | `modules/hall-ui/public/studio.js:219` |
-| `b8ba1fa4457c` | certain | Link a task | `modules/hall-ui/public/blockers.js:143` |
+| `b8ba1fa4457c` | certain | Link a task | `modules/hall-ui/public/blockers.js:146` |
 | `43660902bf79` | certain | Link copied. | `modules/hall-ui/public/drachmae.js:332` |
 | `a53e0cde7ff7` | certain | Link first — your rank role is set the moment you join. | `modules/hall-ui/public/settings.js:840` |
 | `64e85f1691f9` | certain | Link your Discord account and you're added to the {{worldName}} server with your rank role already set — no in | `modules/hall-ui/public/settings.html:61` |
@@ -862,7 +862,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a030881168b5` | certain | Reset to default | `modules/hall-ui/public/government.js:267` |
 | `fd89b5be9d3b` | certain | Reset zoom to fit | `modules/hall-ui/public/diagram-viewer.js:97` |
 | `9d9567d1dead` | certain | Reset {…} to its default permissions?\n\nEvery change you've made to this rank is discarded, and it takes effe | `modules/hall-ui/public/government.js:293` |
-| `10d8f8c501b0` | certain | Resolution note (optional) | `modules/hall-ui/public/blockers.js:126` |
+| `10d8f8c501b0` | certain | Resolution note (optional) | `modules/hall-ui/public/blockers.js:129` |
 | `10d8f8c501b0` | certain | Resolution note (optional) | `modules/hall-ui/public/task-detail.js:207` |
 | `3ef9382d4726` | certain | Resolved — the copy was changed | `modules/hall-ui/public/copy-desk.html:122` |
 | `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/board-room.js:521` |
@@ -972,7 +972,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1e40f33483eb` | certain | Switch theme | `modules/hall-ui/public/shell.js:486` |
 | `93fa2e97dd35` | certain | System default for this skill | `modules/hall-ui/public/settings.js:72` |
 | `4894b1d9b0de` | certain | System oversight: people, operations and security. | `modules/hall-ui/public/watch.js:1335` |
-| `e604fc3ace79` | certain | Task # | `modules/hall-ui/public/blockers.js:134` |
+| `e604fc3ace79` | certain | Task # | `modules/hall-ui/public/blockers.js:137` |
 | `a0f384b022fd` | certain | Task dependencies | `modules/hall-ui/public/goals.html:140` |
 | `91576eb7c880` | certain | Task dependency forest — scrolls sideways inside this box | `modules/hall-ui/public/goal-forest-render.js:120` |
 | `dfc967a63d57` | certain | Task lifecycle from backlog to shipped, showing states and transitions and the edge where credits are awarded. | `modules/hall-ui/public/diagrams.html:51` |
@@ -1406,7 +1406,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1711516b4411` | certain | waiting for a nod | `modules/hall-ui/public/thinking.js:130` |
 | `35be9e0923da` | certain | walks the whole path in plain language. | `modules/hall-ui/public/hall-render.js:890` |
 | `17705daf7b85` | certain | what counts as passing | `modules/hall-ui/public/government.html:55` |
-| `96a8971a5c44` | certain | what got un-stuck | `modules/hall-ui/public/blockers.js:127` |
+| `96a8971a5c44` | certain | what got un-stuck | `modules/hall-ui/public/blockers.js:130` |
 | `96a8971a5c44` | certain | what got un-stuck | `modules/hall-ui/public/task-detail.js:208` |
 | `3126bb540c89` | certain | what needs the owner’s decision | `modules/hall-ui/public/blockers.js:305` |
 | `b1c5eaa20a9d` | certain | what the idea is, in one line | `modules/hall-ui/public/ideas.html:150` |

package/docs/copy-registry.json

@@ -1326,7 +1326,7 @@
       "text": "Resolution note (optional)",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/blockers.js:126",
+        "modules/hall-ui/public/blockers.js:129",
         "modules/hall-ui/public/task-detail.js:207"
       ]
     },
@@ -1776,7 +1776,7 @@
       "text": "what got un-stuck",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/blockers.js:127",
+        "modules/hall-ui/public/blockers.js:130",
         "modules/hall-ui/public/task-detail.js:208"
       ]
     },
@@ -6479,7 +6479,7 @@
       "surface": "builders-hall",
       "text": "Link a task",
       "file": "modules/hall-ui/public/blockers.js",
-      "line": 143,
+      "line": 146,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8927,7 +8927,7 @@
       "surface": "builders-hall",
       "text": "Resolution note (optional)",
       "file": "modules/hall-ui/public/blockers.js",
-      "line": 126,
+      "line": 129,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9917,7 +9917,7 @@
       "surface": "builders-hall",
       "text": "Task #",
       "file": "modules/hall-ui/public/blockers.js",
-      "line": 134,
+      "line": 137,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13823,7 +13823,7 @@
       "surface": "builders-hall",
       "text": "what got un-stuck",
       "file": "modules/hall-ui/public/blockers.js",
-      "line": 127,
+      "line": 130,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -2430,5 +2430,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.976 with no explicit bump. run 35880930697. (task 1002620)
   1.19.978 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.977 with no explicit bump. run 35882259144. (task 1002620)
+  1.19.979 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.978 with no explicit bump. run 35887876013. (task 1002620)
+  1.19.980 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.979 with no explicit bump. run 35889261972. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/blockers.js

@@ -53,6 +53,9 @@
   var body = document.getElementById('blockers-body');
   var countPill = document.getElementById('blockers-count');
   var sub = document.getElementById('blockers-sub');
+  // The reason-for-blockers prose lives ONLY in blockers.html; JS restores what
+  // the markup shipped instead of carrying a second copy that can drift.
+  var baseSub = sub ? sub.textContent : '';
   var fileArea = document.getElementById('blockers-file-area');
 
   // The generated typed client (task-detail.js's own pattern), result-mode so
@@ -203,10 +206,7 @@
   function paintHeadline() {
     if (countPill) { countPill.textContent = String(state.total); countPill.hidden = state.total === 0; }
     if (sub) {
-      sub.textContent = state.total
-        ? (state.total === 1 ? 'One thing' : state.total + ' things') + ' stuck on the owner — a credential, a '
-          + 'purchase, a product call only they can make. Resolving one un-sticks every task waiting on it automatically.'
-        : 'Nothing is stuck on the owner right now.';
+      sub.textContent = state.total ? baseSub : 'Nothing is stuck on the owner right now.';
     }
   }
 

package/modules/hall-ui/public/goal-inbox.js

@@ -278,7 +278,7 @@
       const more = count > 5 ? `<p class="ginbox__pending">…${count - 5} more awaiting a nod.</p>` : '';
       box.innerHTML = '<h3 class="ginbox__sec-h">Reported work awaiting a nod '
         + `<span class="count-pill">${count}</span></h3>`
-        + `<ul class="ginbox__list">${rows.slice(0, 5).map(nodRowHtml).join('')}</ul>${more}`;
+        + `<ul class="ginbox">${rows.slice(0, 5).map(nodRowHtml).join('')}</ul>${more}`;
     }
     window.OTBAttention?.refresh();
   }
@@ -358,7 +358,7 @@
       const more = count > 5 ? `<p class="ginbox__pending">…${count - 5} more awaiting an answer.</p>` : '';
       box.innerHTML = '<h3 class="ginbox__sec-h">Was this removed? '
         + `<span class="count-pill">${count}</span></h3>`
-        + `<ul class="ginbox__list">${rows.slice(0, 5).map(removalRowHtml).join('')}</ul>${more}`;
+        + `<ul class="ginbox">${rows.slice(0, 5).map(removalRowHtml).join('')}</ul>${more}`;
     }
     window.OTBAttention?.refresh();
   }
@@ -457,7 +457,7 @@
       : `<span class="ginbox__sub"> — untouched ${escapeHtml(String(t.rot_days ?? '?'))}+ days</span>`;
     box.innerHTML = '<h3 class="ginbox__sec-h">Going quiet '
       + `<span class="count-pill">${rows.length}</span>${timerNote}</h3>`
-      + `<ul class="ginbox__list">${shown.map(rotRowHtml).join('')}</ul>${more}`;
+      + `<ul class="ginbox">${shown.map(rotRowHtml).join('')}</ul>${more}`;
     window.OTBAttention?.refresh();
   }
 

package/modules/provisioning/repo-private.js

@@ -19,6 +19,11 @@ const provisioning = require('./provisioning');
 // { conflict: 'open_intent' } rather than racing a standup, teardown or settings push over
 // the same checkout. The partial unique index ux_provisioning_intents_open stays the
 // arbiter if two requests interleave.
+//
+// The caller is the ONLY authorization: the runner flips with the owner's stored GitHub
+// token whatever `requestedBy` says. So a route calling this is OWNER-ONLY, with no archon
+// override — unlike restart, this acts on the owner's own GitHub account (owner decision
+// 2026-09-23, task 1004194).
 async function enqueueRepoPrivate(db, instanceId, requestedBy) {
   const { intent, created } = await provisioning.enqueueIntent(db, instanceId, 'repo-private', requestedBy);
   if (created) return { intent, created: true };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.978",
+  "version": "1.19.980",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.978",
+      "version": "1.19.980",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.978",
+  "version": "1.19.980",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision-repo-private.js

@@ -28,6 +28,12 @@ const { REPO_ROOT } = require('./provision-config.js');
 const { parseTargetRef, resolveOwnerGithubToken } = require('./provision-repo-auth.js');
 const { ensurePrivateRepoAccess } = require('./provision-repo.js');
 
+// A failed shell step (execSync: stderr/output) or file read (a Node system error: syscall)
+// carries the command line, box paths and stderr in its message. It never reaches the
+// owner's card; a GithubApiError, or a fetch error whose syscall sits on its own cause,
+// matches neither.
+const isBoxFailure = (e) => !!e && (e.stderr !== undefined || Array.isArray(e.output) || typeof e.syscall === 'string');
+
 async function repoPrivateInstance(inst, deps) {
   const { db, provisioning, log, apply } = deps;
   log(`repo-private ${inst.slug} (shape=${inst.hosting_shape}, status=${inst.status})`);
@@ -47,6 +53,10 @@ async function repoPrivateInstance(inst, deps) {
   try {
     wired = await ensurePrivateRepoAccess(inst, { ...deps, intendedPrivate: true });
   } catch (e) {
+    if (isBoxFailure(e) || isBoxFailure(e && e.cause)) {
+      log(`  [repo-private] deploy-key setup failed on the box: ${(e && e.message) || e}`);
+      return { ok: false, error: `${repo.owner}/${repo.name} is still public: its deploy key could not be set up on the server. Nothing on your side caused this, and trying again is safe.` };
+    }
     return { ok: false, error: (e && e.message) || String(e) };
   }
   if (!apply) {

package/scripts/gds/provision-repo.js

@@ -877,9 +877,9 @@ function deployKeyPath(inst) { return path.posix.join(standaloneRoot(inst), '.gi
 // widens only WHEN we wire: the key stays read-only and repository ADMIN is still
 // required. It also HARDENS the two soft skips — no credential, GitHub unreachable —
 // into refusals, because a caller that has committed to flipping cannot be handed an
-// unwired checkout. NO PRODUCTION CALLER SETS IT YET: the flip route and its
-// provisioning intent are splits (b) + (c) of task 1003078, which need a migration
-// this deliberately does not. The seam ships first so the ordering is settled.
+// unwired checkout. Its one caller is the `repo-private` runner leg
+// (provision-repo-private.js, task 1004193); the owner-facing route that enqueues that
+// intent is what remains (split (c) of task 1003078).
 async function ensurePrivateRepoAccess(inst, deps) {
   const { log, apply } = deps;
   const exec = deps.controlExec || deps.exec;
@@ -1011,7 +1011,7 @@ async function ensurePrivateRepoAccess(inst, deps) {
       throw new Error(`repository access is not admin: your granted credential can read ${repo.owner}/${repo.name}, but registering its deploy key needs repository ADMIN. Ask a repository admin to raise your access (or make the repository public), then try again.`);
     }
     // Plain sentence for the owner card — a transient GitHub hiccup must not read as jargon.
-    throw new Error(`deploy-key setup failed for ${repo.owner}/${repo.name}: ${e && e.message}. Nothing is wrong on your side — try again, and if it keeps failing make the repository public and retry.`);
+    throw new Error(`deploy-key setup failed for ${repo.owner}/${repo.name}: ${e && e.message}. Nothing is wrong on your side — try again, and if it keeps failing make the repository public and retry.`, { cause: e });
   }
   exec(`git -C ${root} remote set-url origin git@github.com:${repo.owner}/${repo.name}.git`);
   exec(`git -C ${root} config core.sshCommand "ssh -F /dev/null -i ${keyPath} -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"`);

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.978'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.980'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/blockers_page_ui.mjs

@@ -323,4 +323,10 @@ await test('resolving through the shared #/blocker/N overlay (otb:blocker-resolv
   assert.equal(after, before + 1, 'the queue re-fetched exactly once in response to the event');
 });
 
+await test('the sub-line reason prose has ONE source (blockers.html); JS never carries a copy (task 1003985)', () => {
+  const html = fs.readFileSync(path.join(HALL, 'blockers.html'), 'utf8');
+  assert.match(html, /Resolving one un-sticks every task waiting on it/, 'the static sub-line keeps the prose');
+  assert.doesNotMatch(BLOCKERS_JS_SRC, /un-sticks|only they can make/, 'blockers.js must not duplicate the prose');
+});
+
 summary();

package/tests/provision_repo_private.mjs

@@ -22,6 +22,8 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { execSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const P = require('../scripts/gds/provision.js');
@@ -128,6 +130,58 @@ await ta('GitHub unreachable during the wiring: ok:false (a retry), never a thro
   assert.equal(r.at(isFlip), -1);
 });
 
+console.log('\nrunner leg — a failure on the box never reaches the owner\'s card verbatim:');
+
+// Real Node error objects, not hand-built lookalikes: the leg recognises a box failure by
+// its shape, so the test must throw the shape execSync and fs actually produce.
+function realExecError() {
+  try { execSync(`"${process.execPath}" -e "process.stderr.write('Saving key /home/runner/.ssh/deploy-demo failed');process.exit(3)"`, { stdio: 'pipe' }); }
+  catch (e) { return e; }
+  throw new Error('expected the child to fail');
+}
+function realFsError() {
+  try { readFileSync('/srv/instances/demo/.ssh/no-such-key.pub'); } catch (e) { return e; }
+  throw new Error('expected the read to fail');
+}
+const BOX_DETAIL = /Command failed|process\.exit|[\\/]home[\\/]runner|[\\/]srv[\\/]instances|ENOENT|ssh-keygen|stderr/;
+
+for (const [label, patch] of [
+  ['ssh-keygen fails while minting the key', (d) => { d.exec = (cmd) => { if (/ssh-keygen/.test(cmd)) throw realExecError(); return { ok: true, stdout: '' }; }; }],
+  ['git config fails while wiring the checkout', (d) => { d.exec = (cmd) => { if (/core\.sshCommand/.test(cmd)) throw realExecError(); return { ok: true, stdout: '' }; }; }],
+  ['the new key file cannot be read', (d) => { d.fsImpl = { ...d.fsImpl, readFileSync: () => { throw realFsError(); } }; }],
+  ['ssh-keygen fails on the key-in-use retry (wrapped as a deploy-key setup failure)', (d) => {
+    d.githubRepos = { ...d.githubRepos, addDeployKey: async () => { throw Object.assign(new Error('GitHub refused the key — it is already registered somewhere'), { code: 'key_in_use', status: 422 }); } };
+    let keygens = 0;
+    d.exec = (cmd) => { if (/ssh-keygen/.test(cmd) && ++keygens === 2) throw realExecError(); return { ok: true, stdout: '' }; };
+  }],
+]) {
+  await ta(`${label}: a fixed sentence — no command line, box path or stderr — and NO flip`, async () => {
+    // Arrange
+    const r = recorder();
+    patch(r.deps);
+    // Act
+    const out = await repoPrivateInstance(liveStandalone, r.deps);
+    // Assert
+    assert.equal(out.ok, false);
+    assert.doesNotMatch(out.error, BOX_DETAIL, out.error);
+    assert.match(out.error, /example-owner\/demo is still public/);
+    assert.match(out.error, /trying again is safe/);
+    assert.equal(r.at(isFlip), -1, 'nothing was flipped');
+    assert.ok(r.logs.some((l) => /\[repo-private\]/.test(l) && BOX_DETAIL.test(l)), 'the raw detail goes to the runner log for the operator');
+  });
+}
+
+await ta('a GitHub network failure during key registration keeps its GitHub sentence — not mistaken for a box failure', async () => {
+  // fetch's own error hangs the socket detail (syscall) one level down, on its cause.
+  const fetchFailed = Object.assign(new TypeError('fetch failed'), { cause: Object.assign(new Error('connect ECONNREFUSED'), { code: 'ECONNREFUSED', syscall: 'connect' }) });
+  const r = recorder();
+  r.deps.githubRepos = { ...r.deps.githubRepos, listDeployKeys: async () => { throw fetchFailed; } };
+  const out = await repoPrivateInstance(liveStandalone, r.deps);
+  assert.equal(out.ok, false);
+  assert.match(out.error, /deploy-key setup failed for example-owner\/demo: fetch failed/);
+  assert.equal(r.at(isFlip), -1);
+});
+
 await ta('the flip itself refused (403): ok:false, says the repository is STILL public and a retry is safe', async () => {
   const e = Object.assign(new Error('GitHub refused the change for this account'), { code: 'not_repo_admin', status: 403 });
   const r = recorder({ flipFails: e });

package/tests/rot_inbox.mjs

@@ -616,6 +616,16 @@ test('row builders emit the CSS classes style.css actually defines, not ginbox__
     'rotRowHtml must emit the defined ginbox__body/ginbox__actions classes');
 });
 
+test('the nod, removal and rot lists use the defined .ginbox list class, not ginbox__list (task 1003982)', () => {
+  assert.match(STYLE_SRC, /^\.ginbox\s*\{[^}]*list-style:\s*none/m, 'style.css must define .ginbox with list-style: none');
+  assert.doesNotMatch(GOAL_INBOX_SRC, /ginbox__list/,
+    '.ginbox__list is undefined in style.css — with it the browser default bullets and 40px indent leak through');
+  for (const fn of ['nodRowHtml', 'removalRowHtml', 'rotRowHtml']) {
+    assert.match(GOAL_INBOX_SRC, new RegExp(`<ul class="ginbox">\\$\\{[^\\n]*?map\\(${fn}\\)`),
+      `the list built from ${fn} must be <ul class="ginbox">`);
+  }
+});
+
 test('acting on a rot line refreshes the ROT slice, not the goals list', () => {
   assert.match(GOAL_INBOX_SRC, /ROT_TOASTS\[verb\] \|\| 'Done\.', loadRot\)/,
     'refreshing the wrong slice leaves the acted-on row sitting there — the task-1003066 lesson');