ci: the diagnostics publisher must not be able to fail the gate

[compusophy]

Found the honest way: #26 went red with a green gate. verify on the pull_request event failed at publish diagnostics — three steps after the wasm check, the test gate and clippy had all passed.

! [remote rejected] HEAD -> diagnostics (cannot lock ref 'refs/heads/diagnostics':
  is at 5fa28ad… but expected 794430c…)

The step ran if: always() and force-pushed to a single diagnostics branch, so the push- and pull_request-triggered runs of the same commit reached it together, one lost the ref lock, and its non-zero exit took the whole job with it.

two defects

• It published on success. The workflow's own header says "on any failure this workflow publishes"; the code said always(). Every green run therefore overwrote the failure log the next reader needed — the same words-vs-code gap build item 3 named as this project's recurring failure mode. Now if: failure().
• It could fail the job. The push is retried three times with backoff, then gives up with a ::warning:: and exit 0. A lost diagnostics log costs a reader one click into the job log printed directly above it. A red gate over one costs a landing.

This is D9's shape applied to CI: an escape hatch that only works when things are fine is not an escape hatch, and a diagnostic that breaks the thing it observes is not a diagnostic.

guard

the_diagnostics_publisher_cannot_turn_a_green_gate_red in tests/ci_gate.rs, verified in both directions — flipping the step back to always() reds it:

test the_diagnostics_publisher_cannot_turn_a_green_gate_red ... FAILED
the diagnostics step must run only on failure. `always()` publishes green runs,
which CLOBBERS the failure log that is the entire point of the diagnostics branch.

workflow_source() now normalizes \r\n. This checkout has core.autocrlf=true and every multi-line shape guard would otherwise go red locally while CI passed — the trap boot_reconcile fell into in #16, recurring exactly as the board predicted.

note for reading a red PR here

ci runs twice per PR (push and pull_request). When one is green and the other red on the same sha, the difference is not the code — look at which step failed before assuming the gate caught something. That is written into memory/status.md.

bash ci/run_tests.sh → unit tests + 20 suites + clippy. smoke-preview will be red for the usual Vercel Deployment Protection reason.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vanish	Building	Preview	Aug 26, 2026 8:58pm