Print a refused hosted remove's error once (B77)

The hosted unwind leg prints each refusal as `Error: …` when it happens;
remove then printed the same message again on its way out (plus "The
manifest was not modified." on the manifest-backed path). A human run
now gets the refusal once, followed by the manifest note where it
applies. The --json envelope is unchanged and still carries the whole
message.

Regression test remove_hosted_revert_failure_prints_the_error_once
covers the manifest-backed and hosted-only paths; it fails on the old
rendering (the refusal appeared twice).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-cli/src/commands/remove.rs

@@ -778,8 +778,7 @@ pub async fn run(args: RemoveArgs) -> i32 {
                     leg
                 }
                 Err(err) => {
-                    let (code, msg) = hosted_unwind_error(err, true);
-                    emit_error_envelope(args.common.json, args.common.dry_run, code, msg);
+                    emit_hosted_unwind_error(&args.common, err, true);
                     return 1;
                 }
             };
@@ -1336,6 +1335,20 @@ fn hosted_unwind_error(err: HostedUnwindError, manifest_backed: bool) -> (&'stat
     )
 }
 
+/// Report a stopped hosted unwind. JSON carries the whole message in the
+/// error envelope. A human run already saw `Error: <why>` — the hosted leg
+/// prints each refusal as it happens — so only the manifest-backed path's
+/// extra fact is added; printing the refusal again would show the same
+/// error twice (B77).
+fn emit_hosted_unwind_error(common: &GlobalArgs, err: HostedUnwindError, manifest_backed: bool) {
+    let (code, msg) = hosted_unwind_error(err, manifest_backed);
+    if common.json {
+        emit_error_envelope(true, common.dry_run, code, msg);
+    } else if manifest_backed {
+        eprintln!("The manifest was not modified.");
+    }
+}
+
 /// Remove path for identifiers that match ONLY hosted lockfile pins (no
 /// manifest entry, no vendor-ledger entry): confirm, restore each pin's
 /// upstream registry entry, and report `Removed`/`hosted_reverted` events. Like the ledger-only vendored path,
@@ -1405,8 +1418,7 @@ async fn remove_hosted_only(
         Ok(leg) => leg,
         Err(err) => {
             track_patch_remove_failed("hosted redirect revert failed", api_token, org_slug).await;
-            let (code, msg) = hosted_unwind_error(err, false);
-            emit_error_envelope(args.common.json, args.common.dry_run, code, msg);
+            emit_hosted_unwind_error(&args.common, err, false);
             return 1;
         }
     };

crates/socket-patch-cli/tests/remove/covgap_commands_remove.rs

@@ -1018,6 +1018,40 @@ fn remove_hosted_only_revert_failure_fails_closed() {
     assert_eq!(read_bytes(&lock_path), lock_before, "lock untouched");
 }
 
+/// B77: a human (non-JSON) hosted remove whose restore is refused prints
+/// the refusal ONCE. The hosted leg prints each refusal as it happens;
+/// remove used to print the same `Error:` line again on its way out.
+/// Covers the manifest-backed path (which adds that the manifest was not
+/// modified) and the hosted-only path.
+#[test]
+fn remove_hosted_revert_failure_prints_the_error_once() {
+    let needle = "annot restore pkg:npm/left-pad@1.3.0 to its upstream registry entry";
+    for manifest_backed in [true, false] {
+        let tmp = tempfile::tempdir().expect("tempdir");
+        let lock_path = tmp.path().join("package-lock.json");
+        std::fs::write(&lock_path, redirected_lock_text()).unwrap();
+        if manifest_backed {
+            write_manifest_files_empty(tmp.path(), NPM_PURL, NPM_UUID);
+        }
+        let (code, stdout, stderr) = run_remove(tmp.path(), &[NPM_PURL, "--yes", "--offline"], &[]);
+        assert_eq!(
+            code, 1,
+            "manifest_backed={manifest_backed}: stdout=\n{stdout}\nstderr=\n{stderr}"
+        );
+        assert_eq!(
+            stderr.matches(needle).count(),
+            1,
+            "manifest_backed={manifest_backed}: the refusal must print exactly once; \
+             stderr=\n{stderr}"
+        );
+        assert_eq!(
+            stderr.contains("The manifest was not modified."),
+            manifest_backed,
+            "manifest_backed={manifest_backed}: stderr=\n{stderr}"
+        );
+    }
+}
+
 // ---------------------------------------------------------------------------
 // 10. Restored-lockfile write failure (main flow + hosted-only). Unix-only;
 //     skipped where directory modes are not enforced (root).