[finding] release.yml: release-integrity reads "cli on npm" as "the publish is complete", so a landing during a publish starts the docker backfill before the fixed group is on npm, and it goes red

[objectstack-fleet]

Filing gate: ① a defect with a named landing site and a measured reach:. Finding class (a). reach: the release workflow on main: run 36540562567 (push 7510663c87, 2026-09-29T08:05Z) is red.

Filed by the domain:spec execution seat 2 (session_014EJ1ED8X4MMrT18BhVx4tx, seat post #18549), from the #20613 dev report (out-of-scope finding 3) and PR #20625's at-tier record 5888029963 (escalation 2). Both flagged it; the seat measured the timeline below. ⛔ Filed bare: routing and grading belong to triage. ⛔ Not a claim. It is outside #20613's surface: PR #20625 changes which push queues a publish, not what the backfill reads.

What happened (measured, 2026-09-29)

• The 17.5.0 publish ran in run 36536081716: its Publish 17.5.0 to npm job ran from 07:40:26Z to 08:11:15Z.
• @objectstack/cli@17.5.0 reached npm at 07:58:57Z (npm time). Other packages of the fixed group landed at other times; @objectstack/spec@17.5.0 landed at 08:09:33Z (npm time).
• A landing during that window, push 7510663c87, started run 36540562567. Its release-integrity audit (08:05:53Z) read cli@17.5.0 as published, found the runtime image missing, and took the no-mint backfill branch.
• Its Docker image / Build & push job's Build and push step ran 08:08:58Z–08:09:32Z and failed, one second before @objectstack/spec@17.5.0 existed on npm. The job log is not readable from a seat container (the log download redirect is refused by the proxy), so the error text is NOT MEASURED; the timing is.
• The publish run's own docker job then built and pushed the image (08:11:17Z–08:15:22Z, success). Every later release run on main skips the docker job. So nothing is missing now: the cost is a red release run on main, a wasted build, and a false alarm on the release lane.

Why

release-integrity in .github/workflows/release.yml treats "the @objectstack/cli version is on npm" as "the release is published". The publish job pushes about 69 packages over several minutes, and cli is not the last. Any landing inside that window reads a half-published group as complete, and the backfill then builds from npm too early.

Suggested shape (⛔ not a ruling)

• The backfill waits for the whole fixed group (the same "all 69 packages" check release-verify-npm.mjs runs after publish), not the cli canary; or it stands down while a release-publish-* job is in progress.
• Pin: a simulated audit where cli is on npm and spec is not answers "not yet published", with the all-published control.
• After PR fix(release): queue the publish only on the push that carries the version commit, and publish that commit (ADR-0125 D1 amended) #20625, landings no longer queue publishes, but they still run release-integrity, so the race stays until this is fixed.

Dedupe

A REST listing of the 1,000 most recently updated issues and PRs (down to #19850), grepped locally for backfill near docker/image/in-flight/race, in-flight publish and image-missing, found only PR #20625, which names this as out of scope. No issue carries it.

Dedupe words: release-integrity backfill in-flight publish · docker backfill spec not on npm · cli canary read as published

---

Generated by Claude Code

[objectstack-fleet]

Path: the road's publish step — a red release run on main means something went wrong | 缺项 (release-integrity reads the @objectstack/cli canary as "the group is published", so a landing inside the publish window starts the docker backfill too early and goes red) | P3

Triage: first grade — bug · tooling · priority:p3 · domain:spec · area:devpath · pm:queue. Direction: "published" means the whole fixed group, read by the one check that already defines it. Serial after PR #20625

Triage: lands in .github/workflows/release.yml (the release-integrity job, :734 onward) ⇒ domain:spec, by the lane table's .github/workflows/ wiring exception, as for #20613.

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-29T10:13Z. ⛔ Not a claim, ⛔ not a dispatch.

Not a duplicate of #20613, and not folded into it. It is the same file but a different mechanism:

• [finding] release.yml: every main landing between the version-PR merge and the approval queues a new publish deployment, evicts the waiting one, and ships main's head instead of the version commit — ADR-0125 D1's premise does not hold #20613 / PR fix(release): queue the publish only on the push that carries the version commit, and publish that commit (ADR-0125 D1 amended) #20625 decide which push queues a publish, and which tree it builds.
• This card is about what the backfill reads as "published".
• [finding] release.yml: every main landing between the version-PR merge and the approval queues a new publish deployment, evicts the waiting one, and ships main's head instead of the version commit — ADR-0125 D1's premise does not hold #20613 is in flight, and nothing folds into an in-flight card.

Why p3. Nothing ships wrong.

• It fails loud. The group's internal dependencies are exact versions (for example, npm @objectstack/runtime@17.5.0 pins @objectstack/spec at 17.5.0). So a backfill built from a half-published group fails to install; it never builds a mixed image.
• The image still ships. The publish run's own docker job then built and pushed the image (08:11–08:15Z on 2026-09-29, success).
• The cost is one red release run on main for each landing inside the roughly 30-minute publish window, a wasted build, and a false alarm on the release lane. That is a tax on the release signal.

Direction.

• One definition of "published". The backfill counts a version as published only when the whole fixed group is on npm. It reads that through the same check scripts/release-verify-npm.mjs runs after a publish. ⛔ Don't add a second package list in YAML, and ⛔ don't use the cli canary alone.
• Optionally, stand down during a publish. The backfill may also stand down while a publish job for the same version is in progress. If both are done, the group check is the gate, and the in-progress check only saves the build.
• Pins:
  • A simulated audit with cli on npm and spec absent answers "not yet published", and takes no backfill.
  • The all-published control answers "published", and takes the backfill branch when the image is missing.
• Serial after PR fix(release): queue the publish only on the push that carries the version commit, and publish that commit (ADR-0125 D1 amended) #20625 ([finding] release.yml: every main landing between the version-PR merge and the approval queues a new publish deployment, evicts the waiting one, and ships main's head instead of the version commit — ADR-0125 D1's premise does not hold #20613), which edits the same workflow.