@@ -96,25 +96,48 @@ jobs:
   e2e:
     name: End-to-end (real code, real monitor, real parsers)
     runs-on: ubuntu-latest
+    # Debian, not the runner's Ubuntu, and deliberately.
+    #
+    # This suite exists to notice when a CODE's behaviour changes, so
+    # running it against a different distribution's build of that code
+    # reports differences that have nothing to do with ECCE.  It did:
+    # Ubuntu's quantum-espresso 6.7 aborts on this deck with a glibc
+    # FORTIFY buffer-overflow check inside pw.x, while Debian's build of
+    # the same upstream 6.7 runs it fine.  The overflow is latent in QE
+    # either way -- Ubuntu's hardening is simply stricter and catches it
+    # -- and neither the bug nor the difference is ECCE's.
+    #
+    # ECCE targets Debian, so this is also the platform whose answers
+    # matter.  Only this job moves: the others test our own Python,
+    # Perl and C++, where the distribution is not the variable.
+    container: debian:trixie
     # Bounded so a hung job cannot hold a runner slot for GitHub's
     # 6-hour default; see the concurrency note above.  Roomier than the
     # script suites because nwchem-openmpi is a large apt install; the
     # jobs themselves are seconds on these molecules.
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-
+      # BEFORE the checkout, which is not the usual order: a bare Debian
+      # image has neither git nor ca-certificates, and actions/checkout
+      # needs both.  Nothing here needs the repository.
+      #
       # MOPAC is Debian-packaged and runs a small molecule in seconds,
       # which is what makes this tier possible at all.  ORCA and
       # Gaussian cannot be installed here -- one is registration-walled,
       # the other licensed -- so they stay a developer-box tier and the
       # suite skips them by name rather than passing silently.
+      #
+      # No sudo: a container runs as root, and Debian's image has none.
       - name: Install dependencies
         run: |
-          sudo apt-get update
-          sudo apt-get install -y perl python3 mopac nwchem nwchem-openmpi \
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            ca-certificates git perl python3 \
+            mopac nwchem nwchem-openmpi \
             quantum-espresso quantum-espresso-data-sssp gromacs
 
+      - uses: actions/checkout@v4
+
       # Declare what this job installed.  Without this a code whose
       # binary is not where the suite looks simply skips, and the job
       # goes green with that coverage quietly gone -- which is exactly
 
@@ -124,6 +124,26 @@ conversion were dropped, and `ENTHALPY − ETHERM` must equal RT exactly.
 
 ## Codes
 
+## CI runs this on Debian, not the runner's Ubuntu
+
+The suite exists to notice when a **code's** behaviour changes, so
+running it against a different distribution's build of that code reports
+differences that have nothing to do with ECCE.
+
+It did. Ubuntu's `quantum-espresso` 6.7 aborts on the Si deck with a
+glibc FORTIFY buffer-overflow check inside `pw.x`; Debian's build of the
+same upstream 6.7 runs it. The overflow is latent in QE either way —
+Ubuntu's hardening is simply stricter and catches it — and neither the
+bug nor the difference belongs to ECCE.
+
+ECCE targets Debian, which is also the platform whose answers matter.
+Only this job moves; the others test our own Python, Perl and C++, where
+the distribution is not the variable.
+
+The apt step runs **before** the checkout, which is not the usual order:
+a bare Debian image has neither git nor ca-certificates, and
+`actions/checkout` needs both. Nothing in that step needs the repository.
+
 | Code | Tier | Notes |
 |---|---|---|
 | MOPAC | CI | Debian `mopac`; seconds per job |
 
@@ -24,6 +24,7 @@
 
 import argparse
 import os
+import re
 import shutil
 import sys
 import tempfile
@@ -65,6 +66,38 @@ def required_codes():
     return set(c.strip() for c in raw.split(',') if c.strip())
 
 
+#  Lines that are the code SAYING something went wrong, as opposed to
+#  the frames it printed afterwards.
+_ERROR_LINE = re.compile(
+    r'error|fatal|abort|overflow|stack smashing|not found|no such|'
+    r'cannot|unable|%%%%|\*\*\*', re.IGNORECASE)
+
+
+def _diagnosis(text):
+    """The lines worth showing from a failed run's output.
+
+    The tail alone is the wrong choice for a crash: a Fortran code that
+    aborts prints its message FIRST and then a backtrace, so the last
+    dozen lines are all "#14 0x... in ???" and the one line naming the
+    cause has scrolled off.  That is what the first version of this did,
+    and it reported a buffer overflow as a list of hex addresses.
+
+    So: the lines that look like a diagnosis, then the tail for context.
+    """
+    lines = [l.rstrip() for l in text.splitlines() if l.strip()]
+    if not lines:
+        return ['(the code produced no output)']
+
+    said = [l for l in lines if _ERROR_LINE.search(l)][:8]
+    tail = lines[-6:]
+
+    out = list(said)
+    for l in tail:
+        if l not in out:
+            out.append(l)
+    return out
+
+
 def run_case(case, verbose, keep, required=()):
     name = case['name']
     codedef = CASEDEFS.CODES[case['code']]
@@ -135,12 +168,11 @@ def run_case(case, verbose, keep, required=()):
                     detail = open(job_out, errors='replace').read()
                 except IOError:
                     detail = ''
-            tail = [l for l in detail.splitlines() if l.strip()][-12:]
             report.check(False,
                          'the code itself failed (exit %d) -- every property '
                          'below is missing because of that, not because of '
                          'the parsers:\n        %s'
-                         % (rc, '\n        '.join(tail)))
+                         % (rc, '\n        '.join(_diagnosis(detail))))
             return report
 
         report.check(True, 'code ran and produced output')