fix(ci): the install-register classifier and its enumeration cover npm publish

[KnockOutEZ]

Closes KnockOutEZ/wigolo-studio-run#195 (PX0 exit-9, SEC MED).

npm publish packs, and packing fires the root prepare hook — so release.yml's
publish step is a root prepare-firing step, and its WIGOLO_SKIP_PREPARE: '1' is what
makes the shipped tarball contain the dist/ every gate validated instead of a rebuild
produced at publish time (#171). The install register's classifier in
tests/unit/prepare-build.test.ts enumerated install verbs (ci|pack|install|i), so
that step never entered affected() and never appeared in the expected-affected list.

The issue's stated failure mode does not reproduce on tip d19c4271. Deleting the
env line already reds one arm: the pack/publish register added by 44b17e6f
(2026-08-28) classifies npm publish and names the step. Measured below rather than
argued. What was real is narrower and still worth closing: the install sweep's
expected-affected list is the enumeration a reader takes as every root step that fires
the hook, and it said the publish path was exempt — so a tidy-up deleting the
pack/publish block as "a duplicate of the sweep above" would have left the publish path
with no arm at all.

Mutation table — env block × guard verdict, before and after

Subject: release.yml / release / Publish wigolo (npm), WIGOLO_SKIP_PREPARE: '1'
deleted then restored by reverse-edit (never git checkout). Command:
npx vitest run tests/unit/prepare-build.test.ts, exit code read directly, never
through a pipe.

Condition	Install register — fires on exactly these steps	Install register — every one of them suppresses the hook	Publish register — the shipped dist/ is the validated one	New arm — synthetic un-suppressed publish	Suite
BEFORE · env present	green, publish step absent from the set	green — step invisible, never examined	green	RED — classifier returns []	1 failed | 28 passed (29)
BEFORE · env deleted	green — still invisible	green — the blind arm	RED, names the step	RED	1 failed | 27 passed (28)¹
AFTER · env present	green, publish step in the set	green	green	green	29 passed (29)
AFTER · env deleted	green	RED, names the step	RED, names the step	green	2 failed | 27 passed (29)

¹ measured on tip before the new arm existed, hence 28 tests.

Both post-fix failures print the same name:

+   "release.yml / release / Publish wigolo (npm)",

Red-first

a9111be5 (arm) is the direct parent of 7f87cc3e (fix). Against the tip classifier the
new arm reds with AssertionError: expected [] to deeply equal [ …(2) ] — an
un-suppressed root npm publish planted in a scratch workflow is classified as not
prepare-firing, so the sweep reports nothing at all.

The arm is an outside signal by construction: every other arm in that block can only
agree with the workflows that happen to exist, and a shape the classifier cannot see is a
shape no real workflow can red it with. So it plants the shape — an unguarded root
publish, a guarded root publish, and a sub-package publish with its own
working-directory — in a workflow directory under $TMPDIR, and runs the real
parser and the real classifier over it. steps() gained a directory parameter for
exactly this and nothing else; its default is unchanged.

Also

• Both registers now classify npm publish, by design, and neither block alone is
  load-bearing. The pack/publish block keeps the two arms that exist only there — a
  sub-package publish is a different root, and the explicit root build the opt-out
  depends on still precedes the publish. Recorded as A-195-1 with its reversal
  condition (the registers' verdicts diverging for one step).
• The pack/publish block's comment claimed npm publish is "the one shape the install
  register's alternation cannot see". True when written, false after this commit, so it
  is corrected in the same commit.

Non-goals held

No change to the publish flow or to any workflow — .github/workflows/release.yml is
byte-identical to tip (read-only reference; the mutations were applied and reversed). No
new gates. The install|i end-of-line anchoring blindness stays in its two existing
known-issues.md rows.

Verification

• npm run build — exit 0
• npm test — 12091 passed | 20 skipped | 7 todo (12118), 955 files passed / 5 skipped, zero
  ×, exit 0. The suite is 12090 → 12091, exactly the one new arm.
• npx tsc --noEmit — exit 0
• npm run gate:studio — exit 0 (tests/ type-check debt holds at baseline 363)

CI deferred — quota (CEO 2026-08-28); merged on local green.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 21365650-b807-41b8-840c-efe464b82a9a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}