@bongos/core 1.19.990 → 1.19.992

package/modules/hall-ui/public/goal-map.js

@@ -27,6 +27,7 @@
   const SVGNS = 'http://www.w3.org/2000/svg';
   const kit = window.OTBKit;
   const lib = window.OTBGoalMapLib;
+  const textFit = window.OTBTextFit;
   const { escapeHtml } = window.OTB;
   const $ = (id) => document.getElementById(id);
 
@@ -47,7 +48,18 @@
 
   // ---- the map -----------------------------------------------------------------
 
-  function drawGraph(a, lay, cats) {
+  // Node text is fitted to MEASURED width, not a character count (task 1004204;
+  // the forest's fix, task 1004200). Measuring needs the svg in the document, so
+  // drawGraph collects each line into `lines` and renderGraph fits them after
+  // appending. The clipPath is the backstop for a map drawn while hidden.
+  const TEXT_X = 16;
+  function fitNodeText(lines, maxWidth) {
+    lines.forEach(({ el, full }) => {
+      el.textContent = textFit.fitText(full, maxWidth, (s) => { el.textContent = s; return el.getComputedTextLength(); });
+    });
+  }
+
+  function drawGraph(a, lay, cats, lines) {
     const svg = svgEl('svg', {
       class: 'gm-svg', viewBox: `0 0 ${lay.width} ${lay.height}`, width: lay.width, height: lay.height,
       role: 'img', 'aria-labelledby': 'gm-cap', focusable: 'false',
@@ -55,6 +67,8 @@
     const defs = svgEl('defs', {}, svg);
     const marker = svgEl('marker', { id: 'gm-arrow', viewBox: '0 0 10 10', refX: 9, refY: 5, markerWidth: 7, markerHeight: 7, orient: 'auto' }, defs);
     svgEl('path', { class: 'gm-arrowhead', d: 'M0 0 L10 5 L0 10 z' }, marker);
+    const clip = svgEl('clipPath', { id: 'gm-text-clip' }, defs);
+    svgEl('rect', { width: lay.nodeW, height: lay.nodeH }, clip);
 
     const edges = svgEl('g', { class: 'gm-edges' }, svg);
     lay.edges.forEach((e) => {
@@ -78,9 +92,12 @@
         + ` — waits on ${lib.plural(n.depends_on || 0, 'goal')}, needed by ${lib.plural(n.depended_on_by || 0, 'goal')}`;
       svgEl('rect', { class: 'gm-card', width: p.w, height: p.h, rx: 8 }, g);
       svgEl('rect', { class: 'gm-stripe', width: 6, height: p.h, rx: 3 }, g);
-      text(g, 'gm-name', 16, 22, lib.clip(lib.displayTitle(n), lib.TITLE_CHARS));
-      text(g, 'gm-cat', 16, 38, lib.clip(cat, lib.SUB_CHARS));
-      text(g, 'gm-tasks', 16, 53, `${n.task_done} of ${lib.plural(n.task_total, 'task')} done`);
+      [['gm-name', 22, lib.displayTitle(n)], ['gm-cat', 38, cat], ['gm-tasks', 53, `${n.task_done} of ${lib.plural(n.task_total, 'task')} done`]]
+        .forEach(([cls, y, full]) => {
+          const el = text(g, cls, TEXT_X, y, full);
+          el.setAttribute('clip-path', 'url(#gm-text-clip)');
+          lines.push({ el, full });
+        });
       const trackW = p.w - 32;
       svgEl('rect', { class: 'gm-weight-track', x: 16, y: 60, width: trackW, height: 3, rx: 1.5 }, g);
       const frac = lib.weightOf(n.task_total, maxTotal);
@@ -103,7 +120,13 @@
         </figcaption>
         <div class="gm-scroll" id="gm-scroll" tabindex="0" role="region" aria-label="Goal map — scrolls sideways inside this box"></div>
       </figure>`;
-    $('gm-scroll').appendChild(drawGraph(a, lib.layout(a), cats));
+    const lay = lib.layout(a);
+    const lines = [];
+    $('gm-scroll').appendChild(drawGraph(a, lay, cats, lines));
+    const fit = () => fitNodeText(lines, lay.nodeW - 2 * TEXT_X);
+    fit();
+    // A web font that lands after the first fit changes every width.
+    if (document.fonts && document.fonts.status !== 'loaded') document.fonts.ready.then(fit);
   }
 
   function renderLegend(cats) {

package/modules/hall-ui/public/goals.html

@@ -249,6 +249,8 @@
 <!-- task 1003480: the per-goal dependency forest's pure model + layout —
      goal-map-lib.js's sibling, loaded before the renderer that draws it. -->
 <script src="/builders/goal-forest-lib.js"></script>
+<!-- tasks 1004200/1004204: measured-width title fitting, shared with the goal map. -->
+<script src="/builders/text-fit.js"></script>
 <!-- task 1003480: the forest's own drawing module — goal-map.js's sibling,
      carved out of goals-render.js to keep that file under the size ratchet.
      Loaded before goals-render.js, which calls window.OTBGoalForestRender(ctx). -->

package/modules/hall-ui/public/text-fit.js

@@ -0,0 +1,58 @@
+// text-fit.js — fit a line of text to a MEASURED width (task 1004200, shared by
+// task 1004204). Proportional glyphs vary too much for any character budget to
+// fit a fixed box, so every SVG card title is cut by its measured width instead.
+// `measure` is always the caller's (getComputedTextLength in the page, a fake in
+// tests), so this file stays DOM-free. Loaded by both the goal forest and the
+// goal map.
+(function (root, factory) {
+  var mod = factory();
+  if (typeof module !== 'undefined' && module.exports) module.exports = mod;
+  else root.OTBTextFit = mod;
+}(typeof self !== 'undefined' ? self : this, function () {
+  'use strict';
+
+  // The longest code-point prefix of `chars` that measures within maxWidth with
+  // `suffix` appended ('' if none does). Code points, so an emoji is never split.
+  function longestPrefix(chars, maxWidth, measure, suffix) {
+    var best = '';
+    var lo = 1;
+    var hi = chars.length;
+    while (lo <= hi) {
+      var mid = (lo + hi) >> 1;
+      var cand = chars.slice(0, mid).join('').replace(/\s+$/, '');
+      if (measure(cand + suffix) <= maxWidth) { best = cand; lo = mid + 1; } else { hi = mid - 1; }
+    }
+    return best;
+  }
+
+  // fitText — `text` whole if it fits, else its longest prefix that fits with an ellipsis.
+  function fitText(text, maxWidth, measure) {
+    var t = String(text == null ? '' : text);
+    if (measure(t) <= maxWidth) return t;
+    return longestPrefix(Array.from(t), maxWidth, measure, '…') + '…';
+  }
+
+  // fitLines — `text` wrapped at spaces into at most `maxLines` lines of maxWidth,
+  // the last ellipsised when the rest will not fit. A word wider than a whole
+  // line is broken where it runs out of room, the way the browser would.
+  function fitLines(text, maxWidth, maxLines, measure) {
+    var rest = String(text == null ? '' : text).replace(/\s+/g, ' ').trim();
+    var lines = [];
+    while (rest && lines.length < maxLines - 1 && measure(rest) > maxWidth) {
+      var words = rest.split(' ');
+      var line = '';
+      for (var i = 0; i < words.length; i++) {
+        var next = line ? line + ' ' + words[i] : words[i];
+        if (measure(next) > maxWidth) break;
+        line = next;
+      }
+      if (!line) line = longestPrefix(Array.from(words[0]), maxWidth, measure, '') || Array.from(words[0])[0];
+      lines.push(line);
+      rest = rest.slice(line.length).trim();
+    }
+    if (rest) lines.push(fitText(rest, maxWidth, measure));
+    return lines;
+  }
+
+  return { fitText: fitText, fitLines: fitLines };
+}));

package/modules/provisioning/error-note.js

@@ -0,0 +1,33 @@
+'use strict';
+// error-note.js — the "we stopped trying" note (F19, task 1002720) belongs to the action
+// that wrote it (task 1004197).
+//
+// The intent runner's retire leg writes error_note AND error_note_action (provisioning_026).
+// A successful run releases only its own action's note: a restart that worked says nothing
+// about a domain that never attached, so another action's note stays on the card. The
+// owner's re-kick doors ask the same question — re-sent settings re-queue a push only over
+// a settings-apply note. A note with no recorded action predates the column and counts as
+// anyone's, which is how every note behaved before.
+//
+// Its own file because provisioning.js sits at the size ratchet.
+
+// Is there a note on this row that `action` wrote (or that nobody is recorded as writing)? PURE.
+function ownsErrorNote(inst, action) {
+  if (!inst || !inst.error_note) return false;
+  return inst.error_note_action == null || inst.error_note_action === action;
+}
+
+// Release the note after a successful run of `action`. One statement, so a note another
+// action writes in between is never erased. Same narrowness rule as recordDnsNote: no
+// status, no updated_at.
+async function clearErrorNote(db, id, action) {
+  const { rows } = await db.query(
+    `UPDATE provisioning_instances SET error_note = NULL, error_note_action = NULL
+      WHERE id = $1 AND error_note IS NOT NULL AND (error_note_action IS NULL OR error_note_action = $2)
+      RETURNING id`,
+    [id, action ?? null]
+  );
+  return rows[0] || null;
+}
+
+module.exports = { clearErrorNote, ownsErrorNote };

package/modules/provisioning/migrations/provisioning_026_error_note_action.sql

@@ -0,0 +1,20 @@
+-- provisioning_026_error_note_action.sql — record WHICH action wrote an instance's
+-- "we stopped trying" note (task 1004197; the F19 latch, task 1002720).
+--
+-- WHY. A retired intent writes error_note onto the project card, and a later successful run
+-- releases it. Without the author, "released" meant ANY success: a restart that worked erased
+-- a domain-attach note although the domain still was not attached, and a make-private that
+-- worked cleared nothing at all. With it, a success clears only the note its own action wrote,
+-- and the owner's re-kick doors (same settings / same address re-sent) fire only over a note
+-- their own action left.
+--
+-- NULL means "written before this column existed" (or never written); readers treat such a
+-- note as nobody's in particular, which is exactly how every note behaved before.
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS error_note_action text;
+
+COMMIT;

package/modules/provisioning/provisioning.js

@@ -1012,17 +1012,9 @@ async function recordDnsNote(db, id, note) {
   return rows[0] || null;
 }
 
-// Clear the error_note latch (task 1002720 / F19). The retire leg of the intent
-// runner sets it when work stops; a later SUCCESSFUL run must release it, or the
-// card shows "we stopped trying" forever on a healed instance. Same narrowness
-// rule: no status, no updated_at.
-async function clearErrorNote(db, id) {
-  const { rows } = await db.query(
-    `UPDATE provisioning_instances SET error_note = NULL WHERE id = $1 RETURNING id`,
-    [id]
-  );
-  return rows[0] || null;
-}
+// The error_note latch (task 1002720 / F19) belongs to the action that wrote it (task
+// 1004197, provisioning_026). Its own file: this one is at the size ratchet.
+const { clearErrorNote, ownsErrorNote } = require('./error-note.js');
 
 // The caller's own instances, newest first.
 async function listInstancesForOwner(db, ownerBuilderId) {
@@ -1119,7 +1111,7 @@ async function setInstanceStatus(db, id, status, patch = {}) {
   const params = [id, status];
   const COLS = {
     domain: 'domain', db_name: 'db_name', port: 'port', tier: 'tier',
-    target_ref: 'target_ref', error_note: 'error_note',
+    target_ref: 'target_ref', error_note: 'error_note', error_note_action: 'error_note_action',
     cost_estimate_usd: 'cost_estimate_usd',
     provisioned_at: 'provisioned_at', torn_down_at: 'torn_down_at',
   };
@@ -1487,7 +1479,7 @@ module.exports = {
   isProvisionedHostname,
   getInstanceById, getInstanceBySlug, getInstanceByDomain, listInstancesForOwner, listAllInstances,
   // data access — verification overlay (task 1002696)
-  listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote,
+  listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote, ownsErrorNote,
   // data access — the owed-push marker (task 1003524)
   recordSettingsPushOwed,
   createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings, updateInstanceDetail,

package/modules/provisioning/routes/provisioning.js

@@ -901,7 +901,7 @@ module.exports = function provisioningRoutes() {
       // "send it again", and folding the second in is what makes that sentence
       // true: the re-send is unchanged, so it would otherwise hit "No change".
       const pushOwed = provisioning.settingsPushOwed(inst);
-      const policyResent = (!!inst.error_note || pushOwed) && policyTouched;
+      const policyResent = (provisioning.ownsErrorNote(inst, 'settings-apply') || pushOwed) && policyTouched;
       // Raising `artist_gate` to 'strict' also stamps WHEN (ADR 0241 §5 makes the
       // tightening non-retroactive, and the instance cannot honour that without the
       // date). It rides the same single UPDATE as the setting it belongs to, and is
@@ -1131,7 +1131,7 @@ module.exports = function provisioningRoutes() {
         // probe says the address doesn't answer — and nothing is in flight. A
         // healthy instance (no note, verified up or unprobed) keeps the
         // idempotent no-op below.
-        const needsRewire = inst.error_note || inst.last_verified_up === false;
+        const needsRewire = provisioning.ownsErrorNote(inst, 'domain-attach') || inst.last_verified_up === false;
         if (inst.status === 'active' && needsRewire && !(await provisioning.getOpenIntent(pool, id))) {
           const { created } = await provisioning.enqueueIntent(pool, id, 'domain-attach', 'api:self');
           if (created) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.990",
+  "version": "1.19.992",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.990",
+      "version": "1.19.992",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.990",
+  "version": "1.19.992",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision-core-upgrade.js

@@ -274,7 +274,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
     detail: served ? `core pin moved to ${served}` : `core pin moved to ${to}; the box did not answer /version, so this is unconfirmed`,
     actor: intent.requested_by || 'runner',
   }).catch(() => {});
-  if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id).catch(() => {});
+  if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id, 'core-upgrade').catch(() => {});
   log(served ? `  ✓ ${inst.slug} serves core ${served}` : `  ⚠ ${inst.slug} upgraded to ${to}, but did not answer /version — unconfirmed`);
   return { ok: true, served, confirmed: served === to };
 }

package/scripts/gds/provision-repo-private.js

@@ -89,6 +89,8 @@ async function repoPrivateInstance(inst, deps) {
     detail: `${repo.owner}/${repo.name} made private — the project now reads it with its own read-only deploy key${wired.minted ? ' (newly registered)' : ''}`,
     actor: 'runner',
   }).catch(() => {});
+  // A make-private that failed earlier left "still public" on the card; this run made it private.
+  if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id, 'repo-private').catch(() => {});
   log(`  ✓ ${repo.owner}/${repo.name} is private; ${inst.slug} reads it with its own deploy key`);
   return { ok: true, minted: !!wired.minted };
 }

package/scripts/gds/provision.js

@@ -844,7 +844,7 @@ async function domainAttachInstance(inst, deps) {
       : null).catch(() => {});
     // Release the F19 latch: this run SUCCEEDED, so a "we stopped trying" note
     // from an earlier retired attach must not outlive its own recovery.
-    if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id).catch(() => {});
+    if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id, 'domain-attach').catch(() => {});
     await provisioning.recordEvent(db, {
       instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'domain-attached',
       detail: dnsSkipped
@@ -957,7 +957,7 @@ async function settingsApplyInstance(inst, deps) {
   if (probeIsVerdict && provisioning.recordLivenessProbe) await provisioning.recordLivenessProbe(db, inst.id, healthy).catch(() => {});
   // Release the F19 latch: this run SUCCEEDED, so a "we stopped trying" note
   // from an earlier retired push must not outlive its own recovery.
-  if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id).catch(() => {});
+  if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id, 'settings-apply').catch(() => {});
   await provisioning.recordEvent(db, {
     instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'settings-applied',
     detail: `settings pushed (${shown}) — web.env patched in place; ${outcome}`,
@@ -1038,8 +1038,8 @@ async function restartInstance(inst, deps) {
   // that HAS a domain. Silence after the whole budget is a verdict on any shape.
   const probeIsVerdict = healthy === false || (healthy === true && !inst.domain);
   if (probeIsVerdict && provisioning.recordLivenessProbe) await provisioning.recordLivenessProbe(db, inst.id, healthy).catch(() => {});
-  // A restart that worked retires any "we stopped trying" note left by earlier
-  // work (the F19 latch) — the note outliving its own recovery is the bug.
+  // A restart that worked retires the "we stopped trying" note a failed restart
+  // left (the F19 latch); another action's note stays (task 1004197).
   // DELIBERATELY gated on `healthy`, NOT on probeIsVerdict: the two answer
   // different questions. probeIsVerdict asks "may this run claim the instance is
   // UP?" — a loopback pass may not, for an instance whose address the sweep owns.
@@ -1047,7 +1047,7 @@ async function restartInstance(inst, deps) {
   // answered is that work finishing, whatever the public address does next.
   // Holding the note until the sweep agrees would leave a stale "nothing more
   // will happen" on the card of a project that just visibly recovered.
-  if (healthy && provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id).catch(() => {});
+  if (healthy && provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id, 'restart').catch(() => {});
   // Name WHAT was observed, not a verdict this probe cannot reach. healthzCmd is
   // loopback (127.0.0.1:<port>) while the liveness sweep probes the PUBLIC
   // https://<domain>/healthz — so an instance can answer here while DNS, Caddy or
@@ -1303,7 +1303,7 @@ async function cmdRunIntents(deps) {
           // CURRENT status makes the status write a no-op, so a healthy active
           // instance is never marked broken over a domain hiccup, but the card
           // can say why the work stopped.
-          await provisioning.setInstanceStatus(db, intent.instance_id, inst.status, { error_note: result.error || 'op failed' }).catch(() => {});
+          await provisioning.setInstanceStatus(db, intent.instance_id, inst.status, { error_note: result.error || 'op failed', error_note_action: intent.action }).catch(() => {});
         } else {
           await db.query(`UPDATE provisioning_intents SET state='pending', last_error=$2, updated_at=now() WHERE id=$1`, [intent.id, result.error || 'op failed']);
         }
@@ -1312,7 +1312,7 @@ async function cmdRunIntents(deps) {
     } catch (e) {
       await provisioning.resolveIntent(db, intent.id, 'error', e.message).catch(() => {});
       // Surface the failure on the instance too, so a stuck instance is visible.
-      await provisioning.setInstanceStatus(db, intent.instance_id, 'error', { error_note: e.message }).catch(() => {});
+      await provisioning.setInstanceStatus(db, intent.instance_id, 'error', { error_note: e.message, error_note_action: intent.action }).catch(() => {});
       errors++; log(`  ✖ intent #${intent.id}: ${e.message}`);
     }
   }

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.990'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.992'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_forest_lib.mjs

@@ -141,67 +141,6 @@ await test('describe states the numbers plainly, and an empty forest says so', (
   assert.equal(L.describe(L.analyse({})), 'No task in this goal depends on another task in this goal.');
 });
 
-// ---- fitting a title to its card (task 1004200) ------------------------------------
-
-// A proportional fake: wide capitals cost three times a narrow letter, so any
-// character budget that fits one title overflows the other.
-const WIDTHS = { W: 12, M: 11, i: 3, '…': 8, '🚀': 14 };
-const measure = (s) => Array.from(s).reduce((w, c) => w + (WIDTHS[c] ?? 6), 0);
-
-await test('fitText leaves a title that fits untouched', () => {
-  assert.equal(L.fitText('#7 Fix', 136, measure), '#7 Fix');
-});
-
-await test('fitText cuts to the MEASURED width, so wide glyphs keep fewer characters than narrow ones', () => {
-  const wide = L.fitText('W'.repeat(40), 136, measure);
-  const narrow = L.fitText('i'.repeat(80), 136, measure);
-  for (const s of [wide, narrow]) {
-    assert.ok(measure(s) <= 136, `${s} measures ${measure(s)}, past the box`);
-    assert.ok(s.endsWith('…'), 'a cut title says it was cut');
-  }
-  assert.ok(Array.from(narrow).length > 3 * Array.from(wide).length, 'no fixed character count could produce both');
-  assert.equal(wide, 'W'.repeat(10) + '…', 'the LONGEST prefix that fits: 10 W + … = 128px, 11 would be 140px');
-});
-
-await test('fitText never ends on a dangling space and never splits an emoji', () => {
-  const spaced = L.fitText('ab cd ef gh ij kl mn op qr', 62, measure);
-  assert.doesNotMatch(spaced, /\s…$/);
-  const emoji = L.fitText('🚀'.repeat(30), 60, measure);
-  assert.equal(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])/.test(emoji), false, 'no lone high surrogate');
-});
-
-await test('fitText returns a bare ellipsis when not even one character fits', () => {
-  assert.equal(L.fitText('WWW', 10, measure), '…');
-});
-
-await test('fitLines keeps a short title on one line, whole', () => {
-  assert.deepEqual(L.fitLines('#7 Fix', 136, 2, measure), ['#7 Fix']);
-});
-
-await test('fitLines wraps at a space, and a second line that fits is left whole', () => {
-  assert.deepEqual(L.fitLines('aaaa bbbb cccc dddd', 60, 2, measure), ['aaaa bbbb', 'cccc dddd']);
-  assert.deepEqual(L.fitLines('a   b\n c', 60, 2, measure), ['a b c'], 'runs of whitespace read as one space');
-});
-
-await test('fitLines ellipsises the LAST line when the title outruns every line, and no line overflows', () => {
-  const lines = L.fitLines('BV1.R26 — Real governance: the constitution becomes enforceable at last', 136, 2, measure);
-  assert.equal(lines.length, 2);
-  for (const l of lines) assert.ok(measure(l) <= 136, `"${l}" measures ${measure(l)}`);
-  assert.ok(lines[1].endsWith('…'));
-  assert.ok(!lines[0].endsWith('…'), 'only the last line is cut');
-});
-
-await test('fitLines breaks a word wider than a whole line instead of overflowing, and always finishes', () => {
-  const lines = L.fitLines('W'.repeat(40), 136, 2, measure);
-  assert.deepEqual(lines, ['W'.repeat(11), 'W'.repeat(10) + '…']);
-  assert.ok(L.fitLines('WWW', 5, 2, measure).length <= 2, 'a box narrower than one glyph still terminates');
-});
-
-await test('fitLines with one line is fitText', () => {
-  const t = 'Move the remaining hall pages onto the kit';
-  assert.deepEqual(L.fitLines(t, 90, 1, measure), [L.fitText(t, 90, measure)]);
-});
-
 // ---- purity -----------------------------------------------------------------------
 
 await test('the lib is pure: no DOM, no fetch, no cross-goal input', () => {

package/tests/goal_forest_page.mjs

@@ -25,6 +25,7 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
 const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
 const LIB_JS = read('goal-forest-lib.js');
+const FIT_JS = read('text-fit.js');
 const FOREST_RENDER_JS = read('goal-forest-render.js');
 const RENDER_JS = read('goals-render.js');
 
@@ -74,6 +75,7 @@ async function boot({ status = 200, fail = false, payload = { nodes: [], edges:
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   vm.runInContext(LIB_JS, sandbox, { filename: 'goal-forest-lib.js' });
+  vm.runInContext(FIT_JS, sandbox, { filename: 'text-fit.js' });
   vm.runInContext(FOREST_RENDER_JS, sandbox, { filename: 'goal-forest-render.js' });
   vm.runInContext(RENDER_JS, sandbox, { filename: 'goals-render.js' });
 

package/tests/goal_map_page.mjs

@@ -20,6 +20,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
 import { makeRunner, makeEl, walk } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -27,6 +28,7 @@ const HALL = path.join(ROOT, 'modules/hall-ui/public');
 const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
 const KIT_JS = read('hall-kit.js');
 const LIB_JS = read('goal-map-lib.js');
+const FIT_JS = read('text-fit.js');
 const PAGE_JS = read('goal-map.js');
 const PAGE_HTML = read('goal-map.html');
 const PAGE_CSS = read('goal-map.css');
@@ -52,6 +54,8 @@ async function boot(payload, { status = 200, fail = false } = {}) {
       const el = makeEl(tag);
       const orig = el.setAttribute.bind(el);
       el.setAttribute = (k, v) => { orig(k, v); if (k === 'class') el.className = String(v); if (k === 'id') el.id = String(v); };
+      // A proportional fake of SVGTextElement's measurement: a W is twice a letter.
+      if (tag === 'text') el.getComputedTextLength = () => Array.from(el.textContent).reduce((w, c) => w + (c === 'W' ? 12 : 6), 0);
       return el;
     },
   };
@@ -77,6 +81,7 @@ async function boot(payload, { status = 200, fail = false } = {}) {
   vm.createContext(sandbox);
   vm.runInContext(KIT_JS, sandbox, { filename: 'hall-kit.js' });
   vm.runInContext(LIB_JS, sandbox, { filename: 'goal-map-lib.js' });
+  vm.runInContext(FIT_JS, sandbox, { filename: 'text-fit.js' });
   vm.runInContext(PAGE_JS, sandbox, { filename: 'goal-map.js' });
   await settle();
   const $ = (id) => documentObj.getElementById(id);
@@ -131,6 +136,31 @@ await test('CATEGORY IS A WORD on every drawn node, not only a colour — and "N
   assert.ok(h.$('gm-legend').textContent.includes('Modules'), 'and the legend spells each category out');
 });
 
+await test('node text is fitted to its card by MEASURED width, clipped as a backstop, and kept whole in the tooltip and table (task 1004204)', async () => {
+  const wide = 'W'.repeat(60);
+  const long = 'Agents module — framework, runtime, and the whole event router rewrite';
+  const h = await boot({
+    nodes: [node(1, { title: wide, depended_on_by: 1 }), node(2, { title: 'Fix', depends_on: 1, category: { slug: 'x', label: long } })],
+    edges: [{ from: '2', to: '1', count: 1 }],
+    counts: {},
+  });
+  const lib = createRequire(import.meta.url)(path.join(HALL, 'goal-map-lib.js'));
+  const inner = lib.layout(lib.analyse({ nodes: [node(1), node(2)], edges: [] })).nodeW - 32;
+  const texts = h.svg().querySelectorAll('.gm-node').flatMap((g) => g.querySelectorAll('text'));
+  assert.equal(texts.length, 6, 'name, category and task count on each of two nodes');
+  for (const t of texts) {
+    assert.ok(t.getComputedTextLength() <= inner, `"${t.textContent}" measures ${t.getComputedTextLength()}px, past the card's ${inner}px`);
+    assert.equal(t.getAttribute('clip-path'), 'url(#gm-text-clip)');
+  }
+  assert.ok(h.svg().querySelector('#gm-text-clip'), 'the clip the lines point at exists');
+  const names = h.svg().querySelectorAll('.gm-name').map((t) => t.textContent);
+  assert.ok(names.includes('Fix'), 'a title that fits is left whole');
+  assert.ok(names.some((n) => /^W+…$/.test(n)), 'a wide title is cut by width and says so');
+  assert.ok(h.svg().querySelectorAll('.gm-cat').some((t) => t.textContent.endsWith('…')), 'the category line is fitted too');
+  assert.ok(h.svg().querySelectorAll('title').some((x) => x.textContent.includes(wide)), 'the full title is still readable on hover');
+  assert.ok(h.$('gm-table').textContent.includes(wide), 'and in the table');
+});
+
 // ---- the split is stated, the alone goals are a list ----------------------------------
 
 await test('the stand-alone goals are a LIST, never dots, and the split is stated in the page head', async () => {
@@ -225,6 +255,7 @@ await test('the page has its h1 in static markup (so every state has one) and lo
   assert.match(PAGE_HTML, /<h1 class="page-head__h">Goal map<\/h1>/);
   assert.ok(PAGE_HTML.indexOf('goal-map-lib.js') > -1 && PAGE_HTML.indexOf('goal-map-lib.js') < PAGE_HTML.indexOf('goal-map.js'));
   assert.ok(PAGE_HTML.indexOf('hall-kit.js') < PAGE_HTML.indexOf('goal-map.js'));
+  assert.ok(PAGE_HTML.indexOf('text-fit.js') > -1 && PAGE_HTML.indexOf('text-fit.js') < PAGE_HTML.indexOf('goal-map.js'));
 });
 
 await test('it takes NO nav slot (the sky’s rule) — the Goals page is its door', () => {

package/tests/provision_repo_private.mjs

@@ -92,6 +92,22 @@ await ta('the deploy key is registered and the checkout re-pointed BEFORE the re
   assert.equal(r.timeline[flip][2], 'example-owner/demo', 'the flip targets the project repository');
 });
 
+await ta('a make-private that worked releases the note an earlier retired make-private left (task 1004197); a failed one does not', async () => {
+  // Arrange
+  const ok = recorder();
+  const bad = recorder({ flipFails: new Error('GitHub said no') });
+  const cleared = [];
+  for (const r of [ok, bad]) r.deps.provisioning.clearErrorNote = async (_db, id, action) => { cleared.push({ id, action, r }); };
+  // Act
+  const good = await repoPrivateInstance(liveStandalone, ok.deps);
+  const failed = await repoPrivateInstance(liveStandalone, bad.deps);
+  // Assert
+  assert.equal(good.ok, true);
+  assert.equal(failed.ok, false);
+  assert.deepEqual(cleared.map(({ id, action }) => ({ id, action })), [{ id: 18, action: 'repo-private' }], 'cleared once, by the run that worked, scoped to its own action');
+  assert.equal(cleared[0].r, ok);
+});
+
 await ta('the wiring is a PRE-flip wiring — it runs although GitHub still reports the repository public', async () => {
   const r = recorder();
   await repoPrivateInstance(liveStandalone, r.deps);

package/tests/provisioning_domain_attach.mjs

@@ -245,6 +245,17 @@ await ta('same domain again RE-ENQUEUES when the wiring stopped — the owner re
   assert.match(res.body.message, /Wiring that address again/);
 });
 
+await ta('another action\'s note is NOT a re-wire: the same address re-sent over a retired RESTART\'s note stays the no-op (task 1004197)', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com', error_note: 'could not restart spike', error_note_action: 'restart' } });
+  const res = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.queued, false, 'a restart note says nothing about the wiring');
+  assert.equal(enqueueCalls.length, 0);
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com', error_note: 'DNS preflight failed', error_note_action: 'domain-attach' } });
+  const own = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });
+  assert.equal(own.body.queued, true, 'its OWN retired attach still re-kicks');
+});
+
 await ta('a verified-DOWN address re-enqueues too; an open intent keeps the no-op', async () => {
   reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com', last_verified_up: false } });
   const res = await post('/provisioning/instances/18/domain', { domain: 'spike.cloudbongos.com' });