fix: Bugbot findings from promotion PR #383

scripts/lib/probe.sh

@@ -220,7 +220,7 @@ render_host_audit() {
 
   case "${INSTALL_TIER:-2}" in
     0) echo -e "  ${TB_HEADING}→ Install tier${RESET}  Tier 0 (zero root) — a container is already runnable; no privileged steps." ;;
-    1) echo -e "  ${TB_HEADING}→ Install tier${RESET}  Tier 1 — set up rootless Docker in your account (no admin needed)." ;;
+    1) echo -e "  ${TB_HEADING}→ Install tier${RESET}  Tier 1 — set up Docker for your account; a one-time admin step is still needed for now." ;;
     2)
       case "${INSTALL_TIER_REASON:-}" in
         needs-docker-desktop) echo -e "  ${TB_HEADING}→ Install tier${RESET}  Tier 2 — Docker isn't running; start/install Docker Desktop (needs admin once)." ;;

scripts/manifest.sha256

@@ -12,7 +12,7 @@ fd8d37d698c242ab081095625aa430bb91971db646e35393a02bbadd41325898  scripts/lib/gp
 32b5e879f6b27f1a67529d032d6c67cae885e7f60558a65a8037798d3c722b29  scripts/lib/install-cli.sh
 725a85e4927761d8362221012ad1b69b380e36ec7fcfcf4c04b801f0994bce5c  scripts/lib/provision.sh
 e2ea63d844e6649f1d3aaae9fd4733845a1a39df37d68abbaeda00330f9e1c7e  scripts/lib/assess.sh
-d15ddc3f5592bbac3caa5e68019260bd017b94156b48af4980292b27eaf40fc2  scripts/lib/probe.sh
+1db9b359d2abccd2a7c530ccf39fcd60fd1d3e4924cef4f420898c4fd0dacd31  scripts/lib/probe.sh
 446d83b15f1fdede9b999aa231a60635dec1d33a4356de448dbfdf9161ba8db9  scripts/lib/summary.sh
 77e03332ebfab1ef759c6148a57afcf479c02c5dc6cc7b0e0e680f58e20cd364  scripts/lib/diagnose.sh
 846844c4659c7d64c229b4a06dbb747428d1e518c4eba973f04e3f8e209fda9e  scripts/install-k8s.ps1

scripts/testdata/golden/00-install.golden

@@ -35,7 +35,7 @@ $ ./install-k8s.sh   # the plan, printed once before install begins
 
 
 
-$ ./install-k8s.sh   # the six running step headers (a-f), titles from install-k8s.sh
+$ ./install-k8s.sh   # the running step headers, titles from install-k8s.sh
   a) Checking your machine
 
   b) Installing what tracebloc needs

scripts/tests/copy-catalog.bats

@@ -8,7 +8,7 @@
 #  golden catalog (cli repo, internal/cli/testdata/golden/).
 #
 #  Two files, ordered like the run:
-#    00-install.golden  — banner, the "2. Installing" roadmap, the six running
+#    00-install.golden  — banner, the "2. Installing" roadmap, the running
 #                         step headers (titles read live from install-k8s.sh),
 #                         and --help.
 #    01-outcomes.golden — the state-branched final summary (connected / starting
@@ -58,6 +58,13 @@ check_golden() {
     cp "$actual" "$golden"
     return 0
   fi
+  # No golden yet → a bare `diff` just errors with "No such file"; point the
+  # reader at the regenerate command instead (a missing golden isn't drift).
+  if [ ! -f "$golden" ]; then
+    printf 'golden missing: %s\n' "$golden" >&2
+    printf 'regenerate with: TB_UPDATE_GOLDEN=1 bats scripts/tests/copy-catalog.bats\n' >&2
+    return 1
+  fi
   diff -u "$golden" "$actual"
 }
 
@@ -82,8 +89,8 @@ PROSE
   printf '\n$ ./install-k8s.sh   # the plan, printed once before install begins\n'
   print_roadmap
 
-  printf '\n$ ./install-k8s.sh   # the six running step headers (a-f), titles from install-k8s.sh\n'
-  sed -nE 's/.*step_header ([a-f]) "([^"]*)".*/\1 \2/p' "${SCRIPTS_DIR}/install-k8s.sh" \
+  printf '\n$ ./install-k8s.sh   # the running step headers, titles from install-k8s.sh\n'
+  sed -nE 's/.*step_header ([a-z]) "([^"]*)".*/\1 \2/p' "${SCRIPTS_DIR}/install-k8s.sh" \
     | while read -r letter title; do step_header "$letter" "$title"; done
 
   printf '\n\n------------------------------------------------------------\n--help\n------------------------------------------------------------\n'
@@ -109,7 +116,14 @@ PROSE
   local state
   for state in connected starting bad_creds image_pull crash; do
     printf '\n$ (install finished — %s)\n' "$state"
-    CLIENT_STATE="$state" print_summary 2>&1
+    # print_summary splits across stdout (the body) and stderr (the ✖ lead line
+    # on error states). Merge them through a single file — both fds share one
+    # file offset, so the bytes land in write order — rather than `2>&1` down a
+    # pipe, where the two streams can interleave differently across machines and
+    # flake the byte-exact diff.
+    local summary="${BATS_TEST_TMPDIR}/summary.${state}"
+    CLIENT_STATE="$state" print_summary >"$summary" 2>&1
+    cat "$summary"
   done
 
   printf '\n$ (connected, on macOS/Windows — the reboot footer differs)\n'

scripts/tests/probe.bats

@@ -159,13 +159,15 @@ setup() {
   assert_has "Tier 0" "$output"
 }
 
-@test "audit: Tier 1 panel shows the kernel row + rootless" {
+@test "audit: Tier 1 panel shows the kernel row + the one-time admin note" {
   OS=Linux; PROBE_RUNTIME_USABLE=0; PROBE_CGROUP2=1; PROBE_USERNS=1
   PROBE_PRIVILEGE=no_sudo; INSTALL_TIER=1; INSTALL_TIER_REASON=rootless-capable
   run render_host_audit
   assert_has "cgroup v2" "$output"
   assert_has "Tier 1" "$output"
-  assert_has "rootless" "$output"
+  # Tier 1 still runs the privileged install path (install_linux) until rootless
+  # Docker lands (#1177), so the audit must be honest about the one-time admin step.
+  assert_has "one-time admin" "$output"
 }
 
 @test "audit: Tier 2 no-userns names the disabled namespaces" {