ci: run the full lane on stacked PRs, and refuse to report green when it did not (D18 #11)

.github/workflows/ci.yml

@@ -5,12 +5,33 @@ on:
     branches: 
       - master
   pull_request:
-    branches: 
-      - master
+    # D18 #11: this was `- master`, so a PR whose BASE was another PR's branch
+    # (a stack) matched nothing here and ran zero lanes. The only workflow
+    # without a branch filter is analysis.yaml (`pull_request_target`), so such
+    # a PR showed exactly one check — `comment` — and read as green while
+    # nothing had been compiled, tested, linted or nvcc'd. Six PRs sat in that
+    # state. Match every base branch; stacked PRs are normal here.
+    branches:
+      - '**'
   workflow_dispatch:
 
 name: Continuous integration
 
+# Widening the trigger above multiplies this workflow across every stacked PR,
+# so it must stop paying for superseded runs on the same ref — `ci.yml` is 12
+# jobs, the largest multiplier in the repo, and was the only workflow without
+# this. `cuda_compile_check.yaml` has carried the identical block for a while;
+# this is the same shape deliberately, not a new policy.
+#
+# The `head_ref || run_id` idiom is load-bearing: on `pull_request`, `head_ref`
+# is the source branch, so a new push cancels that PR's own in-flight run. On
+# `push`, `schedule` and `workflow_dispatch`, `head_ref` is empty and the
+# fallback `run_id` is unique per run — so master pushes and scheduled runs are
+# never cancelled by each other, only PR iterations are.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   check:
     name: Check
@@ -154,6 +175,60 @@ jobs:
           command: check
           args: --workspace
 
+  # D18 #11 GUARD — the job that makes "green" mean something.
+  #
+  # Fixing the `pull_request` branch filter above stops THIS instance, but the
+  # class of defect is "the real lanes did not run and their absence read as a
+  # pass". A branch filter is only one way to reach that state; a skipped job,
+  # a renamed job, a matrix that expands to nothing, or a `paths:` filter that
+  # excludes everything all reproduce it exactly.
+  #
+  # So: this job depends on every substantive lane, runs even when they fail or
+  # are skipped (`if: always()`), and fails unless each one actually SUCCEEDED.
+  # `skipped` and `cancelled` are failures here — that is the entire point.
+  # It also asserts the lane COUNT, so silently deleting a lane trips it rather
+  # than quietly shrinking what green covers.
+  #
+  # Make THIS the required status check in branch protection. It is the only
+  # job whose non-success is unambiguous, and unlike the individual lanes it
+  # cannot pass by not existing.
+  ci-complete:
+    name: CI complete
+    runs-on: ubuntu-latest
+    if: always()
+    needs:
+      - check
+      - check-metal
+      - test
+      - fmt
+      - clippy
+      - docs
+      - typos
+      - msrv
+    steps:
+      - name: Assert every lane ran and succeeded
+        env:
+          # Passed via env, not interpolated into the script, so a lane result
+          # can never be shell-injected.
+          LANE_RESULTS: ${{ join(needs.*.result, ' ') }}
+          EXPECTED_LANES: '8'
+        run: |
+          set -euo pipefail
+          echo "lane results: ${LANE_RESULTS}"
+          n=0
+          for r in ${LANE_RESULTS}; do
+            n=$((n + 1))
+            if [ "${r}" != "success" ]; then
+              echo "::error::A CI lane reported '${r}'. Refusing to report green."
+              exit 1
+            fi
+          done
+          if [ "${n}" -ne "${EXPECTED_LANES}" ]; then
+            echo "::error::Expected ${EXPECTED_LANES} lanes, saw ${n}. The job set drifted — update ci-complete's needs list deliberately, do not let green shrink silently."
+            exit 1
+          fi
+          echo "All ${n} lanes succeeded."
+
   # run `mlc` (`cargo install mlc`)
   # markdown-link-check:
   #   runs-on: ubuntu-latest

.github/workflows/cuda_compile_check.yaml

@@ -120,7 +120,10 @@ on:
       - "Cargo.lock"
       - ".github/workflows/cuda_compile_check.yaml"
   pull_request:
-    branches: [master]
+    # D18 #11: was [master], so stacked PRs never got the nvcc lane — the one
+    # lane that catches cuda-gated Rust, which a macOS `cargo check`
+    # structurally cannot type-check. Match every base branch.
+    branches: ['**']
     paths:
       - "**/*.rs"
       - "**/*.cu"