TRACKING: Make silent failures loud — execution checklist (#421)

[Polichinel]

Execution checklist for #421. One line per issue, in the order they should be done. Tick as each merges to development.

Order

• EPIC: Make silent failures loud — the fails-green cluster #421 — EPIC: Make silent failures loud — the fails-green cluster (stays open until the last box is ticked)
• Story 1: Guard dependency floors against what the lockfile actually chose (C-337) #422 — Story 1: Guard dependency floors against what the lockfile actually chose (C-337) — merged as 2d4ad05 (test: a loose dependency floor freezes the version (C-337, #422) #430); registered C-342 along the way
• Story 2: Take HEARTBEAT_URL off the curl command line (C-331) #423 — Story 2: Take HEARTBEAT_URL off the curl command line (C-331) — merged as 085ef2a (fix: the heartbeat URL leaves the command line (C-331, #423) #432). Also surfaced C-344 (Tier 2, ~/.profile world-readable, every harvest credential) and C-345 (Tier 2, verification tooling reported a red suite as green)
• Story 3: Run the deploy gates somewhere other than one laptop (C-341) #424 — Story 3: Run the deploy gates somewhere other than one laptop (C-341) — merged as 554a19f (ci: run the deploy gates somewhere other than one laptop (C-341, C-342, #424) #435). C-342 resolved, C-341 narrowed; the issue's own gate table was wrong and implementing it as written would have asserted nothing
• Story 4: Guard the released version against its git tag (#363) #425 — Story 4: Guard the released version against its git tag (Release version can drift from the git tag with no guard (same gap views-faoapi hit at go-live) #363) — merged as a7e8e49 (test: the version gate could not fail, so it is gone (C-341, C-346, #425) #436). The gate could not fail in any state, so it was deleted rather than given a runner; C-341 resolved, C-346 registered (four surviving circular copies). Closes Release version can drift from the git tag with no guard (same gap views-faoapi hit at go-live) #363
• Story 5: Refuse pushes to merged branches, and read the merge method back (C-340) #426 — Story 5: Refuse pushes to merged branches, and read the merge method back (C-340)
• Story 6: Drill the OOM/SIGKILL path on the server (C-317) #427 — Story 6: Drill the OOM/SIGKILL path on the server (C-317) — done 2026-08-10, merged in docs(register): C-343 registered (Tier 2) and C-317 RESOLVED by live drill #431 (4f39443). C-317 resolved on observation; drill also found that a never-pinged check never alerts
• Story 8: Refuse to run when the deploy tag and the checked-out HEAD disagree (C-343) #434 — Story 8: Refuse to run when the deploy tag and the checked-out HEAD disagree (C-343) — added 2026-08-11, split out of Story 3: Run the deploy gates somewhere other than one laptop (C-341) #424's re-scope; a production shell change, not a CI one
• Story 7: Close the epic out honestly — register, docs, and what is left #428 — Story 7: Close the epic out honestly — register, docs, and what is left

Why this order

#422 and #423 first — smallest, fully local, no operator time, no interaction with anything else. They also establish the epic's shape: a test that fails today for a real reason.

#424 before #425 — Story 3 moves gates into CI; Story 4 adds a new gate. Adding the gate after the mechanism exists means it lands in the right place the first time.

#426 late — the only story that changes what happens on every git push. A hook that misfires blocks all work, so it should not be under a half-finished epic.

#427 any time — independent of the rest, and gated on operator availability rather than on code. Start it early if the operator is free; it has real elapsed-time waits.

#434 after #424. They are the same idea at two layers — CI's uv lock --check and the host's tag-vs-HEAD refusal — and having the cheap CI one first makes the production one easier to describe.

#428 last, strictly. It reports outcomes. Written earlier it would report predictions, and the difference between those two is the entire subject of this epic.

Per-story ritual — mandatory, no exceptions

Every story follows this, in order:

1. Branch from development, implement, open a PR
2. /code-review medium
3. /register-risk — address anything it registers
4. /review-diff
5. /register-risk — address anything it registers
6. If either /register-risk registered anything, return to step 1. Maximum 2 iterations.
7. /ship-it, push, merge to development

No branching off main, no PRs to main — everything through development.

Standing constraints for this epic

• WET before DRY. Three stories touch CI workflows and two add shell scripts. Duplicate first; a shared helper is not on this epic's scope. Premature abstraction here would itself be untested shared machinery.
• Skip, do not fail, where the environment cannot answer (C-320). Several of these gates cannot run in CI. pytest.skip with a reason that says why, and never a silent pass.
• One line per command when the operator runs anything (C-339 — a multi-line paste destroyed a 528 KB production log on 2026-08-03).
• No new merge-blocking checks for monitoring. Monitoring failures open issues; they do not redden pull requests.

Definition of done for the epic

The register is accurate — including where it says a concern is only narrowed. Every mechanism this epic touched has been observed doing its job, not merely believed to. #428 records both, and #421 closes.

[Polichinel]

Closed with epic #421. See that issue for why: the epic produced no product change, and this work is not worth its cost. Re-open on its own merits if it becomes so.