diff --git a/.github/scripts/verify-docs-deployment.mjs b/.github/scripts/verify-docs-deployment.mjs
new file mode 100644
index 000000000..9594a1883
--- /dev/null
+++ b/.github/scripts/verify-docs-deployment.mjs
@@ -0,0 +1,616 @@
+// Asserts that the GitHub Pages deployment *this* workflow run produced is the
+// one the live docs site is actually serving.
+//
+// Why this exists (issue #1268). A release PR always edits docs/guide/**, which
+// matches the `push: branches: [main]` path filter in docs.yml, and the release
+// tag then points at that same merge commit. Both runs hand
+// `actions/deploy-pages` the same `pages_build_version` — it is `github.sha`,
+// and the action exposes no input to override it — so the two deployments
+// collide under one identity and one of them is silently stranded. Every job
+// goes green, the deployment reports success, and `gh-pages` is byte-correct;
+// the only symptom is that the live site keeps showing the previous release.
+//
+// Nothing else in the pipeline ever looks at the live site, so no amount of
+// green CI could catch that. This gate is cause-agnostic: it fails whenever the
+// bytes on the live site did not come from this run, whatever stranded them.
+//
+// Run it locally against a deployed site with:
+//   DOCS_BASE_URL=https://microsoft.github.io/microsoft-ui-reactor/ \
+//   DOCS_EXPECTED_RUN_ID=123 DOCS_EXPECTED_RUN_ATTEMPT=1 \
+//   DOCS_EXPECTED_VERSIONS='[{"version":"main","aliases":[]}]' \
+//   DOCS_PUBLISHED_VERSIONS='["main"]' \
+//   node .github/scripts/verify-docs-deployment.mjs
+//
+// The decision logic is a pure function so it can be tested without a network:
+// see .github/scripts/verify-docs-deployment.test.mjs.
+
+import { randomUUID } from "node:crypto";
+import { pathToFileURL } from "node:url";
+
+export const STAMP_PATH = "deploy-stamp.json";
+export const VERSIONS_PATH = "versions.json";
+export const ROOT_INDEX_PATH = "index.html";
+export const LATEST_ALIAS = "latest";
+
+/**
+ * Per-request ceiling. Deliberately well under the polling window so a stalled
+ * connection costs one round rather than the whole budget, and under the job's
+ * own timeout so the failure is this gate's diagnostic rather than a silent
+ * runner kill.
+ */
+export const DEFAULT_REQUEST_TIMEOUT_MS = 20_000;
+
+/**
+ * Timeout signal for one request, plus the handle to cancel it.
+ *
+ * Deliberately not `AbortSignal.timeout()`: that timer is unref'd, so it does
+ * not hold the event loop open and never fires when nothing else is pending.
+ * Real traffic hides this because the socket keeps the loop alive, but it made
+ * the regression suite hang and take the rest of the file down with it. A
+ * plain `setTimeout` fires reliably, and cancelling it after the request
+ * settles stops a fast response from leaving a 20s timer behind.
+ */
+function defaultCreateTimeout(ms) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(new Error(`timed out after ${ms}ms`)), ms);
+  return { signal: controller.signal, cancel: () => clearTimeout(timer) };
+}
+
+/**
+ * The page a version probe fetches.
+ *
+ * Explicitly `index.html` rather than the bare directory: a bare directory is
+ * only equivalent on a server that has no directory listing. GitHub Pages 404s
+ * a directory whose index is missing, but a plain static server answers 200
+ * with a generated listing — which quietly turns a broken deployment into a
+ * passing probe when this gate is exercised locally.
+ */
+function versionIndex(version) {
+  return `${version}/index.html`;
+}
+
+/**
+ * @typedef {{ ok: boolean, status: number|null, body: string|null, error: string|null }} Probe
+ * @typedef {{ version: string, title?: string, aliases?: string[] }} VersionEntry
+ */
+
+/** Human-readable shorthand for what a probe actually returned. */
+export function describeProbe(probe) {
+  if (!probe) return "not attempted";
+  if (probe.error) return `request failed: ${probe.error}`;
+  return `HTTP ${probe.status}`;
+}
+
+function parseJson(text) {
+  try {
+    return { value: JSON.parse(text ?? ""), error: null };
+  } catch (err) {
+    return { value: null, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+function aliasHolder(entries, alias) {
+  const match = entries.find((entry) => (entry?.aliases ?? []).includes(alias));
+  return match ? match.version : null;
+}
+
+/**
+ * Picks the version directories worth fetching.
+ *
+ * `targets` are the versions this run actually published, because those are the
+ * ones whose bytes are new on the live site. Probing only the `latest` holder
+ * would miss them: publishing a backported tag deliberately does not move
+ * `latest` (see the "Publish the release version" step in docs.yml), and a
+ * `main` push republishes `main` while `latest` sits on a release. In both
+ * cases a broken new directory would pass as long as `versions.json` listed it.
+ * The `latest` holder is probed as well, since it is what the site root serves.
+ *
+ * `control` is any *other* published version, fetched with an identical request
+ * shape: it is the positive control that separates "the probe cannot see the
+ * site at all" from "the site is serving someone else's deployment". A no-match
+ * is not a measurement until the same probe is shown able to match.
+ */
+export function selectProbeTargets(expectedVersions, publishedVersions = []) {
+  const entries = Array.isArray(expectedVersions) ? expectedVersions : [];
+  const published = Array.isArray(publishedVersions) ? publishedVersions.filter(Boolean) : [];
+  const latest = aliasHolder(entries, LATEST_ALIAS);
+
+  // Deliberately not intersected with `expectedVersions`. A recorded version
+  // that the site does not list is a real inconsistency, and dropping it here
+  // would shrink the probe set on exactly the run that needs it most; evaluate()
+  // reports it instead.
+  const targets = [];
+  for (const version of published) {
+    if (!targets.includes(version)) targets.push(version);
+  }
+
+  // Only reached when the caller could not say what it published; keeps the
+  // gate meaningful rather than probing nothing at all.
+  if (targets.length === 0) {
+    const fallback =
+      latest ?? entries.find((entry) => entry?.version === "main")?.version ?? entries[0]?.version ?? null;
+    if (fallback) targets.push(fallback);
+  }
+
+  if (latest && !targets.includes(latest)) targets.push(latest);
+
+  const control =
+    entries.map((entry) => entry?.version).find((version) => version && !targets.includes(version)) ?? null;
+
+  return { targets, control };
+}
+
+/**
+ * The version or alias a mike-generated site root forwards to, or null when the
+ * document does not look like one.
+ *
+ * Parsed rather than substring-matched. `set-default` writes the target into a
+ * `location.replace(...)` call and a `<noscript>` meta refresh, but the same
+ * document also contains a human-visible `<a href="...">`. A contains() check
+ * would accept a root that redirects to `not-latest/` (which contains
+ * `latest/`), or one whose only mention of the expected target is that link
+ * while the actual redirect points somewhere else.
+ */
+export function parseRootRedirect(html) {
+  const text = typeof html === "string" ? html : "";
+
+  // What a browser with scripting actually follows.
+  const script = text.match(/location\s*\.\s*replace\(\s*["']([^"']+)["']/);
+  if (script) return normaliseTarget(script[1]);
+
+  const meta = text.match(/http-equiv=["']refresh["'][^>]*content=["'][^"']*url=\s*([^"'\s]+)/i);
+  if (meta) return normaliseTarget(meta[1]);
+
+  return null;
+}
+
+function normaliseTarget(target) {
+  return target.replace(/^\.?\//, "").replace(/\/+$/, "");
+}
+
+/**
+ * The version or alias the site root should redirect to.
+ *
+ * mike's `set-default` writes a root index.html that forwards to whichever
+ * version or alias is default — `latest` once any release exists, and `main`
+ * during the window before the first one. Returns null when neither is
+ * published, because the workflow's own fallback is ambiguous there and a
+ * guessed expectation would be worse than none.
+ */
+export function expectedRootTarget(expectedVersions) {
+  const entries = Array.isArray(expectedVersions) ? expectedVersions : [];
+  if (aliasHolder(entries, LATEST_ALIAS)) return LATEST_ALIAS;
+  if (entries.some((entry) => entry?.version === "main")) return "main";
+  return null;
+}
+
+/**
+ * Classifies one round of observations. Pure — no clock, no network.
+ *
+ * @returns {{ status: "pass"|"stranded"|"probe-broken", failures: {kind: string, message: string}[], evidence: string[], liveRunId: string|null }}
+ */
+export function evaluate({
+  expectedRunId,
+  expectedRunAttempt,
+  expectedVersions,
+  publishedVersions = [],
+  observations,
+}) {
+  const { stamp, versions, control, root, alias } = observations;
+  const failures = [];
+  const evidence = [];
+  let liveRunId = null;
+
+  // --- The per-run oracle. ---------------------------------------------
+  // Comparing the live version list alone is vacuous for a `main` push:
+  // `mike deploy main` republishes an existing version, so the version *set*
+  // is unchanged and the comparison passes whether or not this run's
+  // deployment ever landed. The stamp is what makes the check mean something
+  // on every trigger.
+  if (!stamp?.ok) {
+    failures.push({
+      kind: "stamp-unreachable",
+      message: `${STAMP_PATH} did not respond 200 (${describeProbe(stamp)}).`,
+    });
+  } else {
+    const parsed = parseJson(stamp.body);
+    if (parsed.error !== null) {
+      failures.push({
+        kind: "stamp-unparseable",
+        message: `${STAMP_PATH} responded 200 but is not JSON (${parsed.error}).`,
+      });
+    } else {
+      evidence.push(`${STAMP_PATH} responded 200 with parseable JSON`);
+      liveRunId = parsed.value?.run_id == null ? null : String(parsed.value.run_id);
+      const liveAttempt = parsed.value?.run_attempt == null ? null : String(parsed.value.run_attempt);
+      const live = `${liveRunId ?? "(no run_id)"} attempt ${liveAttempt ?? "(unknown)"}`;
+      const expected = `${expectedRunId} attempt ${expectedRunAttempt}`;
+
+      // The attempt is part of the identity, not decoration. `run_id` is stable
+      // across re-runs, so a full "Re-run all jobs" republishes under the same
+      // id — and if that deployment is stranded while the previous attempt's
+      // artifact stays live, an id-only comparison passes on someone else's
+      // bytes.
+      //
+      // Compared against the attempt that produced *the artifact*, exported by
+      // the publish job, rather than this job's own `github.run_attempt`.
+      // Re-running only the failed `deploy` job reuses the original publish, so
+      // the stamp legitimately carries the older attempt and the verify job's
+      // own counter would disagree with it on every partial re-run.
+      if (liveRunId !== String(expectedRunId) || liveAttempt !== String(expectedRunAttempt)) {
+        failures.push({
+          kind: "stamp-stale",
+          message:
+            `The live site is serving run ${live} (sha ${parsed.value?.sha ?? "unknown"}), ` +
+            `not the artifact this run published (${expected}). ` +
+            "Whatever stranded it, the bytes this run published are not the bytes being served.",
+        });
+      }
+    }
+  }
+
+  // --- Defence in depth: the version list and one rendered page. -------
+  if (!versions?.ok) {
+    failures.push({
+      kind: "versions-unreachable",
+      message: `${VERSIONS_PATH} did not respond 200 (${describeProbe(versions)}).`,
+    });
+  } else {
+    const parsed = parseJson(versions.body);
+    if (parsed.error !== null || !Array.isArray(parsed.value)) {
+      failures.push({
+        kind: "versions-unparseable",
+        message:
+          `${VERSIONS_PATH} responded 200 but is not a JSON array ` +
+          `(${parsed.error ?? "parsed to a non-array"}).`,
+      });
+    } else {
+      evidence.push(`${VERSIONS_PATH} responded 200 with a parseable array`);
+      const live = parsed.value;
+      const liveNames = new Set(live.map((entry) => entry?.version));
+      const missing = (expectedVersions ?? [])
+        .map((entry) => entry?.version)
+        .filter((name) => name && !liveNames.has(name));
+      if (missing.length > 0) {
+        failures.push({
+          kind: "versions-missing",
+          message:
+            `The live ${VERSIONS_PATH} is missing ${missing.join(", ")}. ` +
+            `It lists: ${[...liveNames].join(", ") || "(nothing)"}.`,
+        });
+      }
+
+      const expectedLatest = aliasHolder(expectedVersions ?? [], LATEST_ALIAS);
+      const liveLatest = aliasHolder(live, LATEST_ALIAS);
+      if (expectedLatest !== null && liveLatest !== expectedLatest) {
+        failures.push({
+          kind: "latest-mismatch",
+          message:
+            `The live '${LATEST_ALIAS}' alias points at ${liveLatest ?? "nothing"}, ` +
+            `but this run published it on ${expectedLatest}.`,
+        });
+      }
+    }
+  }
+
+  // The publishing steps and mike produce these two lists independently, so a
+  // name in one and not the other means the run does not know what it wrote.
+  // The workflow fails earlier on this, which makes reaching it here a sign
+  // that the earlier guard was bypassed rather than a routine outcome.
+  const declared = new Set((expectedVersions ?? []).map((entry) => entry?.version));
+  const unlisted = (publishedVersions ?? []).filter((version) => version && !declared.has(version));
+  if (unlisted.length > 0) {
+    failures.push({
+      kind: "published-version-unlisted",
+      message:
+        `This run reported publishing ${unlisted.join(", ")}, but the artifact's version list does not contain ` +
+        `${unlisted.length === 1 ? "it" : "them"}. The two are produced independently, so they must agree.`,
+    });
+  }
+
+  // The URL readers actually land on. mike writes it only via `set-default`,
+  // and it is the one page no version directory covers, so a stale or broken
+  // root is invisible to every other check here.
+  const rootTarget = expectedRootTarget(expectedVersions);
+  if (root) {
+    if (!root.probe?.ok) {
+      failures.push({
+        kind: "root-unreachable",
+        message: `The site root did not respond 200 (${describeProbe(root.probe)}).`,
+      });
+    } else {
+      evidence.push("the site root responded 200");
+      if (rootTarget) {
+        const actual = parseRootRedirect(root.probe.body);
+        if (actual === null) {
+          failures.push({
+            kind: "root-unparseable",
+            message:
+              "The site root responded 200 but carries no recognisable redirect. " +
+              "`mike set-default` writes one, so a root without it sends readers nowhere.",
+          });
+        } else if (actual !== rootTarget) {
+          failures.push({
+            kind: "root-mistargeted",
+            message:
+              `The site root redirects to '${actual}/', not '${rootTarget}/'. Readers landing on the ` +
+              "bare URL would be sent somewhere other than the version this run made default.",
+          });
+        }
+      }
+    }
+  }
+
+  for (const target of observations.targets ?? []) {
+    if (!target.probe?.ok) {
+      failures.push({
+        kind: "target-unreachable",
+        message: `${target.version}/ did not respond 200 (${describeProbe(target.probe)}).`,
+      });
+    } else {
+      evidence.push(`${target.version}/ responded 200`);
+    }
+  }
+
+  if (control?.probe?.ok) {
+    evidence.push(`the positive control ${control.version}/ responded 200`);
+  }
+
+  // The `latest` alias is its own copied tree, and the site root forwards to
+  // it, so a broken `latest/` 404s every reader arriving at the bare URL even
+  // when the version it aliases is perfectly healthy.
+  if (alias) {
+    if (!alias.probe?.ok) {
+      failures.push({
+        kind: "alias-unreachable",
+        message:
+          `${alias.version}/ did not respond 200 (${describeProbe(alias.probe)}). ` +
+          "The site root forwards there, so readers landing on the bare URL would get nothing.",
+      });
+    } else {
+      evidence.push(`${alias.version}/ responded 200`);
+    }
+  }
+
+  if (failures.length === 0) {
+    return { status: "pass", failures, evidence, liveRunId };
+  }
+
+  // A probe that cannot see *any* known-good content proves nothing about the
+  // content it failed to find, so say so rather than blaming the deployment.
+  if (evidence.length === 0) {
+    return { status: "probe-broken", failures, evidence, liveRunId };
+  }
+  return { status: "stranded", failures, evidence, liveRunId };
+}
+
+/**
+ * Fetches one URL with a unique cache-busting key, so a pass can never come
+ * from a CDN entry that predates this deployment.
+ *
+ * The base is normalised to end in `/` first: relative resolution drops the
+ * last path segment otherwise, so a `page_url` of
+ * `https://owner.github.io/repo` would send every probe to
+ * `https://owner.github.io/versions.json` and report the whole site missing.
+ */
+export async function probe(
+  baseUrl,
+  path,
+  {
+    fetchImpl = fetch,
+    uuid = randomUUID,
+    requestTimeoutMs = DEFAULT_REQUEST_TIMEOUT_MS,
+    createTimeout = defaultCreateTimeout,
+  } = {},
+) {
+  const base = baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
+  const url = new URL(path, base);
+  url.searchParams.set("nc", uuid());
+
+  // Bounded: neither fetch nor response.text() times out on its own, and
+  // observe() awaits every probe together, so one stalled connection would
+  // otherwise hold the whole polling loop past its deadline and swallow the
+  // diagnostic the job exists to print.
+  const timeout = createTimeout(requestTimeoutMs);
+  try {
+    const response = await fetchImpl(url.toString(), {
+      cache: "no-store",
+      redirect: "follow",
+      signal: timeout.signal,
+    });
+    const body = await response.text();
+
+    // A followed redirect means the requested path is *not* what served this
+    // response, so accepting on the final status alone would let a missing
+    // version directory pass by bouncing to a healthy page.
+    if (response.redirected) {
+      return {
+        ok: false,
+        status: response.status,
+        body,
+        error: `redirected to ${response.url ?? "an unknown location"}`,
+      };
+    }
+
+    return { ok: response.status === 200, status: response.status, body, error: null };
+  } catch (err) {
+    return { ok: false, status: null, body: null, error: err instanceof Error ? err.message : String(err) };
+  } finally {
+    timeout.cancel();
+  }
+}
+
+async function observe(baseUrl, expectedVersions, publishedVersions, deps) {
+  const { targets, control } = selectProbeTargets(expectedVersions, publishedVersions);
+  const latest = aliasHolder(expectedVersions ?? [], LATEST_ALIAS);
+
+  // Built as a labelled list rather than positional destructuring: the probe
+  // set is conditional, and an off-by-one there would silently swap two
+  // results instead of failing.
+  const jobs = [
+    { key: "stamp", path: STAMP_PATH },
+    { key: "versions", path: VERSIONS_PATH },
+    { key: "root", path: ROOT_INDEX_PATH },
+    // `mike deploy --alias-type copy` publishes `latest/` as its own tree, and
+    // the site root forwards there, so a missing `latest/index.html` 404s every
+    // reader arriving at the bare URL. Probing the version that *owns* the
+    // alias does not cover it: they are separate directories.
+    ...(latest ? [{ key: "alias", path: versionIndex(LATEST_ALIAS) }] : []),
+    ...targets.map((version) => ({ key: "target", version, path: versionIndex(version) })),
+    ...(control ? [{ key: "control", version: control, path: versionIndex(control) }] : []),
+  ];
+
+  const results = await Promise.all(jobs.map((job) => probe(baseUrl, job.path, deps)));
+
+  const observations = { stamp: null, versions: null, root: null, alias: null, targets: [], control: null };
+  jobs.forEach((job, i) => {
+    const result = results[i];
+    if (job.key === "target") observations.targets.push({ version: job.version, probe: result });
+    else if (job.key === "control") observations.control = { version: job.version, probe: result };
+    else if (job.key === "alias") observations.alias = { version: LATEST_ALIAS, probe: result };
+    else if (job.key === "root") observations.root = { probe: result };
+    else observations[job.key] = result;
+  });
+  return observations;
+}
+
+/**
+ * Polls the live site until it serves this run's artifact, or the window closes.
+ *
+ * Pages propagation is not instantaneous, so a single shot would turn ordinary
+ * latency into a red release. Polling on *any* non-pass verdict is deliberate:
+ * a stale stamp is exactly what a deployment still propagating looks like.
+ */
+export async function verifyDeployment({
+  baseUrl,
+  expectedRunId,
+  expectedRunAttempt,
+  expectedVersions,
+  publishedVersions = [],
+  timeoutMs = 600_000,
+  intervalMs = 15_000,
+  requestTimeoutMs = DEFAULT_REQUEST_TIMEOUT_MS,
+  fetchImpl = fetch,
+  uuid = randomUUID,
+  createTimeout = defaultCreateTimeout,
+  now = () => Date.now(),
+  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  log = console.log,
+}) {
+  const deadline = now() + timeoutMs;
+  let attempt = 0;
+  let verdict;
+
+  for (;;) {
+    attempt += 1;
+    const observations = await observe(baseUrl, expectedVersions, publishedVersions, {
+      fetchImpl,
+      uuid,
+      requestTimeoutMs,
+      createTimeout,
+    });
+    verdict = {
+      ...evaluate({ expectedRunId, expectedRunAttempt, expectedVersions, publishedVersions, observations }),
+      attempt,
+    };
+
+    if (verdict.status === "pass") return verdict;
+
+    if (now() >= deadline) return verdict;
+
+    log(
+      `Attempt ${attempt}: ${verdict.status} — ${verdict.failures[0]?.message ?? "no detail"} ` +
+        `Retrying in ${Math.round(intervalMs / 1000)}s.`,
+    );
+    await sleep(intervalMs);
+  }
+}
+
+/** Renders a verdict as GitHub Actions annotations. Returns the process exit code. */
+export function report(verdict, { baseUrl, expectedRunId, expectedRunAttempt, log = console.log, err = console.error } = {}) {
+  if (verdict.status === "pass") {
+    log(`The live site at ${baseUrl} is serving run ${expectedRunId} attempt ${expectedRunAttempt}.`);
+    for (const line of verdict.evidence) log(`  ✓ ${line}`);
+    return 0;
+  }
+
+  const headline =
+    verdict.status === "probe-broken"
+      ? `Could not read ${baseUrl} at all, so the deployment is unverified. ` +
+        "Not one probe returned known-good content, so this says nothing about the deployment itself — treat it as a broken check, not a stranded deploy."
+      : `${baseUrl} is not serving the artifact this run published (issue #1268). ` +
+        "Re-serve it by dispatching the Publish docs workflow on main — the artifact is the whole gh-pages branch, so any allowed ref republishes every version.";
+
+  // Everything on one stream, so the annotation and the observations it rests
+  // on cannot interleave out of order in the run log.
+  err(`::error::${headline}`);
+  for (const failure of verdict.failures) err(`::error::  ${failure.kind}: ${failure.message}`);
+  for (const line of verdict.evidence) err(`  ✓ ${line} — so the probe itself works`);
+  err(`Gave up after ${verdict.attempt} attempt(s).`);
+
+  return verdict.status === "probe-broken" ? 2 : 1;
+}
+
+/** Signals a bad invocation, so the CLI block can exit 3 without a stack trace. */
+class UsageError extends Error {}
+
+function requireEnv(name) {
+  const value = process.env[name];
+  if (!value) throw new UsageError(`${name} is required.`);
+  return value;
+}
+
+function requireJsonArrayEnv(name) {
+  const parsed = parseJson(requireEnv(name));
+  if (parsed.error !== null || !Array.isArray(parsed.value)) {
+    throw new UsageError(`${name} is not a JSON array: ${parsed.error ?? "parsed to a non-array"}`);
+  }
+  return parsed.value;
+}
+
+// `import.meta.main` is Node 24+; compare URLs so this also runs on Node 20/22.
+// pathToFileURL rather than string concatenation: a Windows drive letter would
+// otherwise parse as the URL host and never match.
+const invokedDirectly = Boolean(process.argv[1]) && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (invokedDirectly) {
+  try {
+    const baseUrl = requireEnv("DOCS_BASE_URL");
+    const expectedRunId = requireEnv("DOCS_EXPECTED_RUN_ID");
+
+    // The attempt that produced the artifact, not this job's own counter. See
+    // the stamp comparison in evaluate() for why the two differ on a partial
+    // re-run, and why an id-only check goes false-green on a full one.
+    const expectedRunAttempt = requireEnv("DOCS_EXPECTED_RUN_ATTEMPT");
+    const expectedVersions = requireJsonArrayEnv("DOCS_EXPECTED_VERSIONS");
+
+    // Required rather than defaulted: without it the probe silently falls back
+    // to the `latest` holder, which is exactly the blind spot that lets a
+    // broken backported-tag or `main` directory pass. A wiring mistake should
+    // be loud.
+    const publishedVersions = requireJsonArrayEnv("DOCS_PUBLISHED_VERSIONS");
+
+    const verdict = await verifyDeployment({
+      baseUrl,
+      expectedRunId,
+      expectedRunAttempt,
+      expectedVersions,
+      publishedVersions,
+      timeoutMs: Number(process.env.DOCS_VERIFY_TIMEOUT_SECONDS ?? 600) * 1000,
+      intervalMs: Number(process.env.DOCS_VERIFY_INTERVAL_SECONDS ?? 15) * 1000,
+    });
+
+    // `process.exitCode` rather than `process.exit()`. On POSIX — which is
+    // where this runs — writes to a piped stdout/stderr are asynchronous, and
+    // `process.exit()` tears the process down without draining them. The whole
+    // value of a failing run here is the annotations explaining *what* the live
+    // site was serving, so truncating them loses exactly the output the gate
+    // exists to produce. Setting the code lets node exit once the loop drains,
+    // which flushes. (Not reproducible on Windows, where those pipes are
+    // synchronous.)
+    process.exitCode = report(verdict, { baseUrl, expectedRunId, expectedRunAttempt });
+  } catch (err) {
+    if (!(err instanceof UsageError)) throw err;
+    console.error(`::error::${err.message}`);
+    process.exitCode = 3;
+  }
+}
diff --git a/.github/scripts/verify-docs-deployment.test.mjs b/.github/scripts/verify-docs-deployment.test.mjs
new file mode 100644
index 000000000..0ed9f149f
--- /dev/null
+++ b/.github/scripts/verify-docs-deployment.test.mjs
@@ -0,0 +1,677 @@
+// Regression tests for verify-docs-deployment.mjs — the gate that decides
+// whether the live docs site is serving the artifact this workflow run
+// published (issue #1268).
+//
+// Run directly with `node .github/scripts/verify-docs-deployment.test.mjs`, or
+// let CI run it through DocsDeploymentVerifierTests in
+// tests/Reactor.DocPipeline.Tests.
+//
+// Every case asserts a verdict the product code must *compute*: deleting any
+// one of the four comparisons in evaluate() reddens at least one case here.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import {
+  DEFAULT_REQUEST_TIMEOUT_MS,
+  evaluate,
+  expectedRootTarget,
+  parseRootRedirect,
+  probe,
+  report,
+  selectProbeTargets,
+  verifyDeployment,
+} from "./verify-docs-deployment.mjs";
+
+const THIS_RUN = "35774072302";
+const OTHER_RUN = "35773982188";
+
+// `run_id` is stable across re-run attempts, so the attempt is part of the
+// identity: a full "Re-run all jobs" republishes under the same id.
+const THIS_ATTEMPT = "1";
+
+const EXPECTED_VERSIONS = [
+  { version: "main", title: "main (development)", aliases: [] },
+  { version: "0.1.0-preview.16", title: "0.1.0-preview.16", aliases: ["latest"] },
+  { version: "0.1.0-preview.15", title: "0.1.0-preview.15", aliases: [] },
+];
+
+// What a release-tag run publishes: the tag holds `latest` because it is newest.
+const PUBLISHED_RELEASE = ["0.1.0-preview.16"];
+
+function ok(body) {
+  return { ok: true, status: 200, body, error: null };
+}
+
+function notFound() {
+  return { ok: false, status: 404, body: "", error: null };
+}
+
+function unreachable() {
+  return { ok: false, status: null, body: null, error: "getaddrinfo ENOTFOUND" };
+}
+
+// The real mike root stub: a script redirect, a noscript meta refresh, and a
+// human-visible link, all naming the same target.
+const ROOT_STUB = `<!DOCTYPE html><html><head>
+  <noscript><meta http-equiv="refresh" content="1; url=latest/" /></noscript>
+  <script>window.location.replace("latest/" + window.location.search + window.location.hash);</script>
+</head><body>Redirecting to <a href="latest/">latest/</a>...</body></html>`;
+
+/** A healthy live site: this run's stamp, the full version list, every page. */
+function healthy(overrides = {}, published = PUBLISHED_RELEASE) {
+  const { targets, control } = selectProbeTargets(EXPECTED_VERSIONS, published);
+  return {
+    stamp: ok(JSON.stringify({ run_id: THIS_RUN, run_attempt: THIS_ATTEMPT, sha: "459f7234" })),
+    versions: ok(JSON.stringify(EXPECTED_VERSIONS)),
+    root: { probe: ok(ROOT_STUB) },
+    alias: { version: "latest", probe: ok("<html>") },
+    targets: targets.map((version) => ({ version, probe: ok("<html>") })),
+    control: control ? { version: control, probe: ok("<html>") } : null,
+    ...overrides,
+  };
+}
+
+function verdictFor(observations, expectedVersions = EXPECTED_VERSIONS, publishedVersions = PUBLISHED_RELEASE) {
+  return evaluate({
+    expectedRunId: THIS_RUN,
+    expectedRunAttempt: THIS_ATTEMPT,
+    expectedVersions,
+    publishedVersions,
+    observations,
+  });
+}
+
+test("probe targets cover the published version and the latest holder", () => {
+  assert.deepEqual(selectProbeTargets(EXPECTED_VERSIONS, PUBLISHED_RELEASE), {
+    targets: ["0.1.0-preview.16"],
+    control: "main",
+  });
+});
+
+// A backported tag publishes its version without moving `latest`, so probing
+// only the alias holder would never touch the directory this run just wrote.
+test("a backported tag is probed alongside the untouched latest holder", () => {
+  const { targets, control } = selectProbeTargets(EXPECTED_VERSIONS, ["0.1.0-preview.15"]);
+  assert.deepEqual(targets, ["0.1.0-preview.15", "0.1.0-preview.16"]);
+  assert.equal(control, "main");
+});
+
+test("a main push probes main, which does not hold latest", () => {
+  const { targets } = selectProbeTargets(EXPECTED_VERSIONS, ["main"]);
+  assert.deepEqual(targets, ["main", "0.1.0-preview.16"]);
+});
+
+test("a backfill probes every version it published", () => {
+  const { targets } = selectProbeTargets(EXPECTED_VERSIONS, ["0.1.0-preview.15", "0.1.0-preview.16"]);
+  assert.deepEqual(targets, ["0.1.0-preview.15", "0.1.0-preview.16"]);
+});
+
+test("probe targets fall back to the latest holder when nothing was reported", () => {
+  assert.deepEqual(selectProbeTargets(EXPECTED_VERSIONS, []).targets, ["0.1.0-preview.16"]);
+});
+
+test("probe targets fall back to main when nothing holds latest", () => {
+  const unreleased = [{ version: "main", aliases: [] }];
+  assert.deepEqual(selectProbeTargets(unreleased, []), { targets: ["main"], control: null });
+});
+
+test("a published version the live site never listed is reported, not silently dropped", () => {
+  // The recorded list and versions.json are produced independently, so a name
+  // in one and not the other means the run does not know what it wrote.
+  const published = ["0.9.9-never-published"];
+  const { targets } = selectProbeTargets(EXPECTED_VERSIONS, published);
+  assert.deepEqual(targets, ["0.9.9-never-published", "0.1.0-preview.16"]);
+
+  const verdict = verdictFor(healthy({}, published), EXPECTED_VERSIONS, published);
+  assert.equal(verdict.status, "stranded");
+  assert.ok(verdict.failures.some((f) => f.kind === "published-version-unlisted"));
+  assert.match(
+    verdict.failures.find((f) => f.kind === "published-version-unlisted").message,
+    /0\.9\.9-never-published/,
+  );
+});
+
+test("the expected site-root target follows latest, then main", () => {
+  assert.equal(expectedRootTarget(EXPECTED_VERSIONS), "latest");
+  assert.equal(expectedRootTarget([{ version: "main", aliases: [] }]), "main");
+  assert.equal(expectedRootTarget([{ version: "0.1.0", aliases: [] }]), null);
+});
+
+// The URL readers land on. mike writes it only via `set-default`, so no version
+// directory covers it and a stale root is invisible to every other check.
+test("a site root that 404s is stranded", () => {
+  const verdict = verdictFor(healthy({ root: { probe: notFound() } }));
+  assert.equal(verdict.status, "stranded");
+  assert.ok(verdict.failures.some((f) => f.kind === "root-unreachable"));
+});
+
+test("a site root redirecting to the wrong version is stranded", () => {
+  const stale = ROOT_STUB.replace(/latest\//g, "main/");
+  const verdict = verdictFor(healthy({ root: { probe: ok(stale) } }));
+  assert.equal(verdict.status, "stranded");
+  assert.ok(verdict.failures.some((f) => f.kind === "root-mistargeted"));
+});
+
+test("the root redirect target is parsed, not substring-matched", () => {
+  assert.equal(parseRootRedirect(ROOT_STUB), "latest");
+  assert.equal(parseRootRedirect('<script>window.location.replace("0.1.0-preview.16/")</script>'), "0.1.0-preview.16");
+  assert.equal(parseRootRedirect('<noscript><meta http-equiv="refresh" content="1; url=main/" /></noscript>'), "main");
+  assert.equal(parseRootRedirect("<html>no redirect here</html>"), null);
+});
+
+// `not-latest/` contains `latest/`, so a contains() check accepted it.
+test("a root redirecting to a name containing the target is stranded", () => {
+  const impostor = ROOT_STUB.replace(/latest\//g, "not-latest/");
+  const verdict = verdictFor(healthy({ root: { probe: ok(impostor) } }));
+  assert.equal(verdict.status, "stranded");
+  const failure = verdict.failures.find((f) => f.kind === "root-mistargeted");
+  assert.ok(failure);
+  assert.match(failure.message, /not-latest\//);
+});
+
+// The expected target present only in decoration, while the real redirect
+// points elsewhere.
+test("a root whose only mention of the target is an unrelated link is stranded", () => {
+  const misleading =
+    '<script>window.location.replace("main/" + window.location.search);</script>' +
+    '<body>See also <a href="latest/">latest/</a></body>';
+  const verdict = verdictFor(healthy({ root: { probe: ok(misleading) } }));
+  assert.equal(verdict.status, "stranded");
+  assert.ok(verdict.failures.some((f) => f.kind === "root-mistargeted"));
+});
+
+test("a root with no recognisable redirect at all is stranded", () => {
+  const verdict = verdictFor(healthy({ root: { probe: ok("<html><body>hello</body></html>") } }));
+  assert.equal(verdict.status, "stranded");
+  assert.ok(verdict.failures.some((f) => f.kind === "root-unparseable"));
+});
+
+// `--alias-type copy` makes `latest/` a separate tree from the version it
+// aliases, and the site root forwards to it, so it needs its own probe.
+test("a broken latest alias is stranded even when its version is healthy", () => {
+  const verdict = verdictFor(healthy({ alias: { version: "latest", probe: notFound() } }));
+  assert.equal(verdict.status, "stranded");
+  assert.deepEqual(
+    verdict.failures.map((f) => f.kind),
+    ["alias-unreachable"],
+  );
+  assert.match(verdict.failures[0].message, /site root forwards there/);
+});
+
+test("the site root is not judged when no default can be determined", () => {
+  const unknown = [{ version: "0.1.0", aliases: [] }];
+  const verdict = evaluate({
+    expectedRunId: THIS_RUN,
+    expectedRunAttempt: THIS_ATTEMPT,
+    expectedVersions: unknown,
+    publishedVersions: ["0.1.0"],
+    observations: {
+      stamp: ok(JSON.stringify({ run_id: THIS_RUN, run_attempt: THIS_ATTEMPT })),
+      versions: ok(JSON.stringify(unknown)),
+      root: { probe: ok("<html>nothing recognisable</html>") },
+      targets: [{ version: "0.1.0", probe: ok("<html>") }],
+      control: null,
+    },
+  });
+  assert.equal(verdict.status, "pass");
+});
+
+test("a live site serving this run passes", () => {
+  const verdict = verdictFor(healthy());
+  assert.equal(verdict.status, "pass");
+  assert.deepEqual(verdict.failures, []);
+  assert.equal(verdict.liveRunId, THIS_RUN);
+});
+
+// The reported bug, exactly: gh-pages was byte-correct, the deployment reported
+// success, and the live site was serving the *other* run's artifact.
+test("a stamp from another run is stranded and names both runs", () => {
+  const verdict = verdictFor(
+    healthy({ stamp: ok(JSON.stringify({ run_id: OTHER_RUN, run_attempt: THIS_ATTEMPT, sha: "459f7234" })) }),
+  );
+  assert.equal(verdict.status, "stranded");
+  assert.deepEqual(
+    verdict.failures.map((f) => f.kind),
+    ["stamp-stale"],
+  );
+  assert.match(verdict.failures[0].message, new RegExp(OTHER_RUN));
+  assert.match(verdict.failures[0].message, new RegExp(THIS_RUN));
+});
+
+test("a numeric run_id still matches the string this run is identified by", () => {  const verdict = verdictFor(healthy({ stamp: ok(JSON.stringify({ run_id: Number(THIS_RUN), run_attempt: Number(THIS_ATTEMPT) })) }));
+  assert.equal(verdict.status, "pass");
+});
+
+// "Re-run all jobs" keeps the same run_id and increments the attempt, so an
+// id-only comparison would accept the *previous* attempt's artifact if the
+// new deployment were stranded — a false green on exactly the recovery path
+// an operator reaches for after a failure.
+test("a full re-run is not satisfied by the previous attempt's artifact", () => {
+  const verdict = evaluate({
+    expectedRunId: THIS_RUN,
+    expectedRunAttempt: "2",
+    expectedVersions: EXPECTED_VERSIONS,
+    publishedVersions: PUBLISHED_RELEASE,
+    observations: healthy(), // still serving attempt 1
+  });
+  assert.equal(verdict.status, "stranded");
+  const failure = verdict.failures.find((f) => f.kind === "stamp-stale");
+  assert.ok(failure);
+  assert.match(failure.message, /attempt 1/);
+  assert.match(failure.message, /attempt 2/);
+});
+
+// Re-running only the failed `deploy` job reuses the original publish artifact,
+// so the live stamp legitimately carries the older attempt. Comparing against
+// this job's own github.run_attempt would redden every partial re-run.
+test("a deploy-only re-run still matches the artifact that publish built", () => {
+  const verdict = evaluate({
+    expectedRunId: THIS_RUN,
+    expectedRunAttempt: THIS_ATTEMPT, // from needs.publish.outputs, not this job
+    expectedVersions: EXPECTED_VERSIONS,
+    publishedVersions: PUBLISHED_RELEASE,
+    observations: healthy(),
+  });
+  assert.equal(verdict.status, "pass");
+});
+
+test("a missing run_attempt in the stamp is stranded rather than assumed", () => {
+  const verdict = verdictFor(
+    healthy({ stamp: ok(JSON.stringify({ run_id: THIS_RUN, sha: "459f7234" })) }),
+  );
+  assert.equal(verdict.status, "stranded");
+  assert.ok(verdict.failures.some((f) => f.kind === "stamp-stale"));
+});
+
+test("a site that has never served a stamp is stranded, not passing", () => {
+  const verdict = verdictFor(healthy({ stamp: notFound() }));
+  assert.equal(verdict.status, "stranded");
+  assert.deepEqual(
+    verdict.failures.map((f) => f.kind),
+    ["stamp-unreachable"],
+  );
+  assert.match(verdict.failures[0].message, /HTTP 404/);
+});
+
+test("a stamp that is not JSON is stranded", () => {
+  const verdict = verdictFor(healthy({ stamp: ok("<html>404</html>") }));
+  assert.equal(verdict.status, "stranded");
+  assert.deepEqual(
+    verdict.failures.map((f) => f.kind),
+    ["stamp-unparseable"],
+  );
+});
+
+test("a version this run published but the live site lacks is stranded", () => {
+  const stale = EXPECTED_VERSIONS.filter((v) => v.version !== "0.1.0-preview.16");
+  const verdict = verdictFor(healthy({ versions: ok(JSON.stringify(stale)) }));
+  assert.equal(verdict.status, "stranded");
+  assert.ok(verdict.failures.some((f) => f.kind === "versions-missing"));
+  assert.match(
+    verdict.failures.find((f) => f.kind === "versions-missing").message,
+    /0\.1\.0-preview\.16/,
+  );
+});
+
+test("latest sitting on the wrong version is stranded", () => {
+  const dragged = EXPECTED_VERSIONS.map((v) => ({
+    ...v,
+    aliases: v.version === "0.1.0-preview.15" ? ["latest"] : [],
+  }));
+  const verdict = verdictFor(healthy({ versions: ok(JSON.stringify(dragged)) }));
+  assert.equal(verdict.status, "stranded");
+  assert.ok(verdict.failures.some((f) => f.kind === "latest-mismatch"));
+});
+
+test("a live site carrying extra newer versions still passes", () => {
+  const newer = [{ version: "0.1.0-preview.17", aliases: [] }, ...EXPECTED_VERSIONS];
+  const verdict = verdictFor(healthy({ versions: ok(JSON.stringify(newer)) }));
+  assert.equal(verdict.status, "pass");
+});
+
+test("a published version whose directory 404s is stranded", () => {
+  const { targets } = selectProbeTargets(EXPECTED_VERSIONS, PUBLISHED_RELEASE);
+  const verdict = verdictFor(
+    healthy({ targets: targets.map((version) => ({ version, probe: notFound() })) }),
+  );
+  assert.equal(verdict.status, "stranded");
+  assert.deepEqual(
+    verdict.failures.map((f) => f.kind),
+    ["target-unreachable"],
+  );
+});
+
+// The reviewer's case: a backported tag does not move `latest`, so a gate that
+// only probed the alias holder would pass while the directory this run just
+// published was broken.
+test("a broken backported directory is stranded even though latest is fine", () => {
+  const published = ["0.1.0-preview.15"];
+  const { targets, control } = selectProbeTargets(EXPECTED_VERSIONS, published);
+  const verdict = verdictFor({
+    stamp: ok(JSON.stringify({ run_id: THIS_RUN, run_attempt: THIS_ATTEMPT })),
+    versions: ok(JSON.stringify(EXPECTED_VERSIONS)),
+    targets: targets.map((version) => ({
+      version,
+      probe: version === "0.1.0-preview.15" ? notFound() : ok("<html>"),
+    })),
+    control: control ? { version: control, probe: ok("<html>") } : null,
+  });
+  assert.equal(verdict.status, "stranded");
+  assert.deepEqual(
+    verdict.failures.map((f) => f.kind),
+    ["target-unreachable"],
+  );
+  assert.match(verdict.failures[0].message, /0\.1\.0-preview\.15/);
+});
+
+// The positive control. Without it, a probe that cannot reach the site at all
+// is indistinguishable from a site that is serving the wrong deployment, and
+// the gate would blame the release for a broken network.
+test("a probe that sees no known-good content anywhere reports probe-broken", () => {
+  const { targets, control } = selectProbeTargets(EXPECTED_VERSIONS, PUBLISHED_RELEASE);
+  const verdict = verdictFor({
+    stamp: unreachable(),
+    versions: unreachable(),
+    targets: targets.map((version) => ({ version, probe: unreachable() })),
+    control: { version: control, probe: unreachable() },
+  });
+  assert.equal(verdict.status, "probe-broken");
+  assert.deepEqual(verdict.evidence, []);
+});
+
+test("a reachable versions.json keeps a stamp failure classified as stranded", () => {
+  const { targets, control } = selectProbeTargets(EXPECTED_VERSIONS, PUBLISHED_RELEASE);
+  const verdict = verdictFor({
+    stamp: notFound(),
+    versions: ok(JSON.stringify(EXPECTED_VERSIONS)),
+    targets: targets.map((version) => ({ version, probe: notFound() })),
+    control: { version: control, probe: notFound() },
+  });
+  assert.equal(verdict.status, "stranded");
+  assert.ok(verdict.evidence.length > 0);
+});
+
+test("the poll loop returns as soon as the deployment propagates", async () => {
+  let clock = 0;
+  let stampFetches = 0;
+  const requested = [];
+  const fetchImpl = async (url) => {
+    requested.push(url);
+    if (url.includes("deploy-stamp.json")) {
+      // The first round still serves the other run; the second serves this one.
+      stampFetches += 1;
+      const servedRun = stampFetches === 1 ? OTHER_RUN : THIS_RUN;
+      return { status: 200, text: async () => JSON.stringify({ run_id: servedRun, run_attempt: THIS_ATTEMPT }) };
+    }
+    if (url.includes("versions.json")) {
+      return { status: 200, text: async () => JSON.stringify(EXPECTED_VERSIONS) };
+    }
+    if (url.includes("/docs/index.html")) {
+      return { status: 200, text: async () => ROOT_STUB };
+    }
+    return { status: 200, text: async () => "<html>" };
+  };
+
+  const verdict = await verifyDeployment({
+    baseUrl: "https://example.test/docs/",
+    expectedRunId: THIS_RUN,
+    expectedRunAttempt: THIS_ATTEMPT,
+    expectedVersions: EXPECTED_VERSIONS,
+    publishedVersions: PUBLISHED_RELEASE,
+    timeoutMs: 60_000,
+    intervalMs: 1_000,
+    fetchImpl,
+    uuid: () => "fixed",
+    now: () => clock,
+    sleep: async (ms) => {
+      clock += ms;
+    },
+    log: () => {},
+  });
+
+  assert.equal(verdict.status, "pass");
+  assert.equal(verdict.attempt, 2);
+
+  // The driver must actually request these, not just decide it should.
+  assert.ok(requested.some((url) => url.includes("/0.1.0-preview.16/index.html?nc=")));
+  assert.ok(requested.some((url) => url.includes("/docs/index.html?nc=")));
+  assert.ok(requested.some((url) => url.includes("/latest/index.html?nc=")));
+});
+
+test("the poll loop gives up once the window closes", async () => {
+  let clock = 0;
+  const fetchImpl = async (url) => {
+    if (url.includes("deploy-stamp.json")) {
+      return { status: 200, text: async () => JSON.stringify({ run_id: OTHER_RUN, run_attempt: THIS_ATTEMPT }) };
+    }
+    if (url.includes("versions.json")) {
+      return { status: 200, text: async () => JSON.stringify(EXPECTED_VERSIONS) };
+    }
+    if (url.includes("/docs/index.html")) {
+      return { status: 200, text: async () => ROOT_STUB };
+    }
+    return { status: 200, text: async () => "<html>" };
+  };
+
+  const verdict = await verifyDeployment({
+    baseUrl: "https://example.test/docs/",
+    expectedRunId: THIS_RUN,
+    expectedVersions: EXPECTED_VERSIONS,
+    publishedVersions: PUBLISHED_RELEASE,
+    timeoutMs: 3_000,
+    intervalMs: 1_000,
+    fetchImpl,
+    uuid: () => "fixed",
+    now: () => clock,
+    sleep: async (ms) => {
+      clock += ms;
+    },
+    log: () => {},
+  });
+
+  assert.equal(verdict.status, "stranded");
+  assert.equal(verdict.attempt, 4);
+});
+
+// A cached response predating the deployment would make every check pass
+// against content this run never produced, so the key must be both present and
+// different on every request.
+test("every probe carries a unique cache-busting key", async () => {
+  const seen = [];
+  let counter = 0;
+  const fetchImpl = async (url) => {
+    seen.push(url);
+    return { status: 200, text: async () => "{}" };
+  };
+
+  await probe("https://example.test/docs/", "versions.json", {
+    fetchImpl,
+    uuid: () => `k${(counter += 1)}`,
+  });
+  await probe("https://example.test/docs/", "versions.json", {
+    fetchImpl,
+    uuid: () => `k${(counter += 1)}`,
+  });
+
+  assert.deepEqual(seen, [
+    "https://example.test/docs/versions.json?nc=k1",
+    "https://example.test/docs/versions.json?nc=k2",
+  ]);
+});
+
+// actions/deploy-pages happens to emit a trailing slash today, but relative URL
+// resolution drops the last segment without one — every probe would silently
+// move to the domain root and report the whole site missing.
+test("a base URL without a trailing slash still resolves inside the site", async () => {
+  const seen = [];
+  const fetchImpl = async (url) => {
+    seen.push(url);
+    return { status: 200, text: async () => "{}" };
+  };
+
+  await probe("https://owner.github.io/repo", "versions.json", { fetchImpl, uuid: () => "k" });
+  await probe("https://owner.github.io/repo/", "0.1.0-preview.16/index.html", { fetchImpl, uuid: () => "k" });
+
+  assert.deepEqual(seen, [
+    "https://owner.github.io/repo/versions.json?nc=k",
+    "https://owner.github.io/repo/0.1.0-preview.16/index.html?nc=k",
+  ]);
+});
+
+test("a transport failure becomes a probe result rather than a throw", async () => {  const result = await probe("https://example.test/docs/", "versions.json", {
+    fetchImpl: async () => {
+      throw new Error("socket hang up");
+    },
+    uuid: () => "fixed",
+  });
+  assert.deepEqual(result, { ok: false, status: null, body: null, error: "socket hang up" });
+});
+
+// Neither fetch nor response.text() times out on its own, and observe() awaits
+// every probe together, so one stalled connection would hold the polling loop
+// past its deadline and swallow the diagnostic the job exists to print.
+test("a stalled request is bounded rather than hanging forever", async () => {
+  const started = Date.now();
+  const result = await probe("https://example.test/docs/", "versions.json", {
+    // Settles only when the abort signal fires, as a real socket would.
+    fetchImpl: (url, options) =>
+      new Promise((_, reject) => {
+        options.signal.addEventListener("abort", () => reject(new Error("The operation was aborted")));
+      }),
+    uuid: () => "fixed",
+    requestTimeoutMs: 25,
+  });
+
+  assert.equal(result.ok, false);
+  assert.equal(result.status, null);
+  assert.match(result.error, /abort/i);
+  assert.ok(Date.now() - started < 5_000, "the probe should give up quickly, not hang");
+});
+
+test("a body that never finishes streaming is bounded too", async () => {
+  const result = await probe("https://example.test/docs/", "versions.json", {
+    fetchImpl: async (url, options) => ({
+      status: 200,
+      text: () =>
+        new Promise((_, reject) => {
+          options.signal.addEventListener("abort", () => reject(new Error("terminated")));
+        }),
+    }),
+    uuid: () => "fixed",
+    requestTimeoutMs: 25,
+  });
+  assert.equal(result.ok, false);
+  assert.match(result.error, /terminated/);
+});
+
+test("every probe carries an abort signal and a sane default ceiling", async () => {
+  let seenOptions = null;
+  await probe("https://example.test/docs/", "versions.json", {
+    fetchImpl: async (url, options) => {
+      seenOptions = options;
+      return { status: 200, text: async () => "{}" };
+    },
+    uuid: () => "fixed",
+  });
+  assert.ok(seenOptions.signal, "no abort signal was passed to fetch");
+  assert.ok(
+    DEFAULT_REQUEST_TIMEOUT_MS < 15_000 * 2,
+    "the per-request ceiling must stay well under the polling window",
+  );
+});
+
+// AbortSignal.timeout() is unref'd, so it never fires when nothing else holds
+// the event loop open. Real traffic hides that because the socket keeps the
+// loop alive; the regression suite does not, and a probe that cannot time out
+// hangs the whole file. The default must own a timer that actually fires.
+test("the default request timeout fires with nothing else on the event loop", async () => {
+  const started = Date.now();
+  const result = await probe("https://example.test/docs/", "versions.json", {
+    fetchImpl: (url, options) =>
+      new Promise((_, reject) => {
+        options.signal.addEventListener("abort", () => reject(options.signal.reason ?? new Error("aborted")));
+      }),
+    uuid: () => "fixed",
+    requestTimeoutMs: 30,
+    // No createTimeout override: this exercises the shipped default.
+  });
+
+  assert.equal(result.ok, false);
+  assert.match(result.error, /timed out after 30ms/);
+  assert.ok(Date.now() - started < 5_000, "the default timeout must fire, not hang");
+});
+
+test("a settled request cancels its timer instead of leaving it pending", async () => {
+  let cancelled = false;
+  const result = await probe("https://example.test/docs/", "versions.json", {
+    fetchImpl: async () => ({ status: 200, redirected: false, text: async () => "{}" }),
+    uuid: () => "fixed",
+    createTimeout: () => ({ signal: new AbortController().signal, cancel: () => { cancelled = true; } }),
+  });
+  assert.equal(result.ok, true);
+  assert.ok(cancelled, "a fast response must not leave a 20s timer behind");
+});
+
+test("a probe that was redirected elsewhere is not accepted as served", async () => {
+  // `redirect: "follow"` reports the *final* status, so a missing version
+  // directory that bounces to a healthy page would otherwise look like a 200
+  // for the path that does not exist.
+  const result = await probe("https://example.test/docs/", "0.1.0-preview.14/index.html", {
+    fetchImpl: async () => ({
+      status: 200,
+      redirected: true,
+      url: "https://example.test/docs/latest/index.html",
+      text: async () => "<html>the latest page</html>",
+    }),
+    uuid: () => "fixed",
+  });
+
+  assert.equal(result.ok, false);
+  assert.match(result.error, /redirected to https:\/\/example\.test\/docs\/latest\/index\.html/);
+});
+
+test("a direct 200 is still accepted", async () => {
+  const result = await probe("https://example.test/docs/", "versions.json", {
+    fetchImpl: async () => ({ status: 200, redirected: false, text: async () => "[]" }),
+    uuid: () => "fixed",
+  });
+  assert.equal(result.ok, true);
+  assert.equal(result.error, null);
+});
+
+// `process.exit()` tears the process down without draining a piped stdout or
+// stderr, which on POSIX are written asynchronously. A failing run's whole
+// value is the annotations naming what the live site was serving, so losing
+// them loses the gate's output. Not reproducible on Windows, where those pipes
+// are synchronous — hence a source assertion rather than a behavioural one.
+test("the script never exits in a way that can truncate its diagnostics", async () => {
+  const { readFile } = await import("node:fs/promises");
+  const source = await readFile(new URL("./verify-docs-deployment.mjs", import.meta.url), "utf8");
+
+  // Comments stripped: the reasoning for avoiding process.exit() names it.
+  const code = source
+    .replace(/\/\*[\s\S]*?\*\//g, "")
+    .split("\n")
+    .filter((line) => !line.trimStart().startsWith("//"))
+    .join("\n");
+
+  assert.doesNotMatch(code, /process\.exit\s*\(/, "use process.exitCode so node flushes before exiting");
+  assert.match(code, /process\.exitCode\s*=/);
+});
+
+test("exit codes separate a stranded deploy from a broken probe", () => {
+  const silence = () => {};
+  assert.equal(report({ ...verdictFor(healthy()), attempt: 1 }, { log: silence, err: silence }), 0);
+  assert.equal(
+    report({ ...verdictFor(healthy({ stamp: notFound() })), attempt: 1 }, { log: silence, err: silence }),
+    1,
+  );
+  const broken = verdictFor({
+    stamp: unreachable(),
+    versions: unreachable(),
+    targets: [],
+    control: null,
+  });
+  assert.equal(report({ ...broken, attempt: 1 }, { log: silence, err: silence }), 2);
+});
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index a9e6b5ed6..ac8ab11a4 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -34,18 +34,49 @@ permissions: {}
 
 # Serialises Pages deployments *and* the gh-pages pushes below, so two runs can
 # never race for the same branch.
+#
+# `queue: max` is load-bearing, not a tidiness knob. The default (`single`)
+# keeps at most one *pending* run per group and cancels the previous one when a
+# new run queues. During a release that is reachable and costly: the merge's
+# `main` run holds the group, the release tag's run waits behind it, and any
+# further docs push to `main` would evict the tag run before it ever ran. The
+# release version would then never be written to gh-pages at all, and nothing
+# would fail. Queuing makes the tag run wait its turn instead (FIFO, up to 100
+# pending).
+#
+# `cancel-in-progress` is deliberately absent: it defaults to false, and
+# `queue: max` with `cancel-in-progress: true` is a workflow validation error.
 concurrency:
   group: pages
-  cancel-in-progress: false
+  queue: max
 
 env:
   MIKE_BRANCH: gh-pages
   LATEST_ALIAS: latest
   MAIN_VERSION: main
+  # Every publishing step appends the version it wrote to
+  # "$RUNNER_TEMP/$PUBLISHED_VERSIONS_FILE", and the artifact step turns that
+  # into a job output. The verify job probes exactly these directories: probing
+  # only the `latest` holder would skip a backported tag (which deliberately
+  # does not move `latest`) and skip `main` on a branch push, so a broken new
+  # directory could pass on the strength of its versions.json entry alone.
+  # Held as a bare filename because workflow-level env cannot expand
+  # $RUNNER_TEMP; every use joins the two.
+  PUBLISHED_VERSIONS_FILE: published-versions.txt
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    outputs:
+      # The exact version list the verify job must find on the live site, and
+      # the subset this run actually wrote. See the artifact step for why each
+      # exists.
+      versions: ${{ steps.artifact.outputs.versions }}
+      published: ${{ steps.artifact.outputs.published }}
+      # The attempt that produced the artifact. `github.run_attempt` read in
+      # the verify job would be wrong: re-running only the failed `deploy` job
+      # reuses this artifact, so its attempt legitimately trails the re-run's.
+      run_attempt: ${{ steps.artifact.outputs.run_attempt }}
     permissions:
       contents: write # mike commits the rendered site to gh-pages
     steps:
@@ -85,6 +116,7 @@ jobs:
         run: |
           mike deploy --branch "$MIKE_BRANCH" --push --alias-type copy \
             --title 'main (development)' "$MAIN_VERSION"
+          echo "$MAIN_VERSION" >> "$RUNNER_TEMP/$PUBLISHED_VERSIONS_FILE"
 
           # Until a release version exists there is nothing for the site root to
           # redirect to, which would leave it a 404. Point the root at main for
@@ -113,6 +145,11 @@ jobs:
             mike deploy --branch "$MIKE_BRANCH" --push --alias-type copy "$version"
           fi
 
+          # Recorded only after mike has actually written the version, so the
+          # list the verify job probes never claims something that was not
+          # published.
+          echo "$version" >> "$RUNNER_TEMP/$PUBLISHED_VERSIONS_FILE"
+
       - name: Backfill release versions
         if: inputs.backfill_tags
         env:
@@ -161,6 +198,7 @@ jobs:
             else
               mike deploy --branch "$MIKE_BRANCH" --push --alias-type copy "${tag#v}"
             fi
+            echo "${tag#v}" >> "$RUNNER_TEMP/$PUBLISHED_VERSIONS_FILE"
             echo "::endgroup::"
           done
 
@@ -184,6 +222,7 @@ jobs:
           fi
 
       - name: Assemble the Pages artifact from every published version
+        id: artifact
         # `git archive` rather than a checkout: it materialises the branch
         # without leaving git metadata in the directory that gets uploaded.
         run: |
@@ -209,12 +248,86 @@ jobs:
           echo "Publishing these versions:"
           cat site/versions.json
 
+          # Stamps the artifact with the run that produced it, so the verify job
+          # can tell *this* deployment from any other one serving the same site.
+          #
+          # Comparing versions.json alone would be vacuous for a main push:
+          # `mike deploy main` republishes an existing version, so the version
+          # set is unchanged and the comparison passes whether or not this run's
+          # deployment ever landed. The run id is what makes the check mean
+          # something on every trigger.
+          #
+          # Written here rather than committed to gh-pages for the same reason
+          # 404.html is: it is a property of a deployment, not of a published
+          # version. Named without a leading `.` or `_` deliberately — Pages has
+          # historically excluded those, and an unservable stamp would fail
+          # every run.
+          jq -n \
+            --arg run_id "$GITHUB_RUN_ID" \
+            --arg run_attempt "$GITHUB_RUN_ATTEMPT" \
+            --arg run_url "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
+            --arg sha "$GITHUB_SHA" \
+            --arg ref "$GITHUB_REF" \
+            --arg published_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+            '{run_id: $run_id, run_attempt: $run_attempt, run_url: $run_url, sha: $sha, ref: $ref, published_at: $published_at}' \
+            > site/deploy-stamp.json
+          cat site/deploy-stamp.json
+
+          # Compact, because a job output is a single line.
+          echo "versions=$(jq -c . site/versions.json)" >> "$GITHUB_OUTPUT"
+
+          # The versions this run actually wrote, for the verify job to probe.
+          # Every trigger path publishes at least one (main push, release tag,
+          # or backfill), so an empty list means a publishing step stopped
+          # recording and the gate would quietly fall back to probing only the
+          # `latest` holder. Fail instead of verifying less than we think.
+          published_file="$RUNNER_TEMP/$PUBLISHED_VERSIONS_FILE"
+          if [ ! -s "$published_file" ]; then
+            echo "::error::No publishing step recorded a version in $published_file, so the verify job cannot know what to probe. Every trigger path must append the version it published."
+            exit 1
+          fi
+
+          published="$(jq -R -s -c 'split("\n") | map(select(length > 0)) | unique' < "$published_file")"
+
+          # The two lists are produced independently — one by the publishing
+          # steps, one by mike — so a divergence means the run does not actually
+          # know what it published. Fail here rather than letting the verify job
+          # quietly probe fewer directories than it should.
+          missing="$(jq -c --argjson published "$published" \
+            '(map(.version)) as $known | $published - $known' site/versions.json)"
+          if [ "$missing" != "[]" ]; then
+            echo "::error::These versions were recorded as published but are absent from site/versions.json: $missing. The publishing steps and mike disagree, so the verify job cannot be trusted to probe the right directories."
+            exit 1
+          fi
+
+          echo "This run published: $published"
+          echo "published=$published" >> "$GITHUB_OUTPUT"
+
+          # Exported so verify compares against the attempt that built these
+          # bytes. `run_id` alone is stable across re-runs, so a full "Re-run
+          # all jobs" would republish under the same identity and a stranded
+          # deployment could still match the previous attempt's live artifact.
+          echo "run_attempt=$GITHUB_RUN_ATTEMPT" >> "$GITHUB_OUTPUT"
+
       - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: site
 
   deploy:
     needs: publish
+    # A release commit produces two runs that hand actions/deploy-pages the
+    # same `pages_build_version` — it is github.sha, with no input to override
+    # it — so both deployments land under one identity and Pages may strand one
+    # of them (issue #1268).
+    #
+    # That duplicate is tolerated rather than avoided. Standing one run down
+    # requires predicting that the other will deploy, and every form of that
+    # prediction fails silently in the direction that matters: a pending tag
+    # run can be evicted, a stale local tag can name a release that no longer
+    # exists, an unreachable `origin` makes the check answer "no tag here", and
+    # the two runs are not guaranteed to enter the concurrency group in event
+    # order. Each of those skips the deployment *and* the verification below,
+    # which is strictly worse than a duplicate that `verify` can catch.
     runs-on: ubuntu-latest
     permissions:
       pages: write
@@ -222,6 +335,42 @@ jobs:
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
+    outputs:
+      page_url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
         uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
+
+  verify:
+    name: Verify the live deployment
+    needs: [publish, deploy]
+    runs-on: ubuntu-latest
+    permissions:
+      # Only to check out the verifier script. The job then reads a public site
+      # over HTTPS and writes nothing.
+      contents: read
+    # Comfortably above the poll window below, so a hung request surfaces as a
+    # timeout on this job rather than an open-ended run.
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22.13.0'
+
+      # `deploy` reporting success is not evidence that the site serves what
+      # this run built: a deployment can collide with another under the same
+      # pages_build_version and be stranded while every job stays green
+      # (issue #1268). This is the only step in the pipeline that looks at the
+      # live site, so it is the only one that can catch that.
+      - name: Assert the live site is serving this run's artifact
+        env:
+          DOCS_BASE_URL: ${{ needs.deploy.outputs.page_url }}
+          DOCS_EXPECTED_RUN_ID: ${{ github.run_id }}
+          DOCS_EXPECTED_RUN_ATTEMPT: ${{ needs.publish.outputs.run_attempt }}
+          DOCS_EXPECTED_VERSIONS: ${{ needs.publish.outputs.versions }}
+          DOCS_PUBLISHED_VERSIONS: ${{ needs.publish.outputs.published }}
+          DOCS_VERIFY_TIMEOUT_SECONDS: '600'
+          DOCS_VERIFY_INTERVAL_SECONDS: '15'
+        run: node .github/scripts/verify-docs-deployment.mjs
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 42c660613..54ba64a65 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -28,8 +28,28 @@ Conventions for contributors:
 
 ### Added
 
+- `Publish docs` now verifies the live site after deploying. The `publish` job stamps the
+  Pages artifact with the run that built it, and a new `verify` job polls
+  <https://microsoft.github.io/microsoft-ui-reactor/> until it is serving *that* run —
+  failing the workflow otherwise. Every probe carries a unique query key so a pass cannot
+  come from cached content, and an already-published version fetched with the same request
+  shape acts as a positive control, so a broken probe is reported as unverified rather than
+  blamed on the deployment. (issue #1268)
+
 ### Changed
 
+- A push to `main` and the release tag's own run both deploy the docs, as before. Standing
+  one of them down was tried and removed: every version of that check has to predict that
+  the other run will deploy, and each way the prediction fails (an evicted pending run, a
+  stale or deleted local tag, an unreachable `origin`, or the two runs entering the
+  concurrency group out of event order) skips the deployment *and* its verification, which
+  is worse than a duplicate the new `verify` job catches. (issue #1268)
+- The `Publish docs` concurrency group now sets `queue: max`. The Actions default keeps at
+  most one *pending* run per group and cancels the previous one when a new run queues, so a
+  docs push landing while a release tag's run waited behind `main` would evict the tag run
+  before it started — leaving the release unpublished. Runs now wait in FIFO order.
+  (issue #1268)
+
 ### Deprecated
 
 ### Removed
diff --git a/docs/contributing/release-runbook.md b/docs/contributing/release-runbook.md
index 8669f69fa..e5ae1c4a6 100644
--- a/docs/contributing/release-runbook.md
+++ b/docs/contributing/release-runbook.md
@@ -179,7 +179,9 @@ After pushing the tag:
 
 1. Confirm the GitHub `Package` workflow runs for the tag and creates a GitHub Release.
 2. Confirm the OneBranch official pipeline starts for the tag.
-3. Confirm the `Publish docs` workflow runs for the tag and that the new version is selectable at <https://microsoft.github.io/microsoft-ui-reactor/> (see [Versioned documentation site](#versioned-documentation-site)). Check **both** of its jobs: a green `publish` beside a red `deploy` means the environment refused the tag ref, and the site stays stale even though `gh-pages` is already correct — see [Which refs may deploy](#which-refs-may-deploy).
+3. Confirm the `Publish docs` workflow runs for the tag and that the new version is selectable at <https://microsoft.github.io/microsoft-ui-reactor/> (see [Versioned documentation site](#versioned-documentation-site)). Check **all three** of its jobs:
+   - a green `publish` beside a red `deploy` means the environment refused the tag ref, and the site stays stale even though `gh-pages` is already correct — see [Which refs may deploy](#which-refs-may-deploy);
+   - a green `deploy` beside a red `verify` means the deployment reported success but the live site did not confirm it. Read the annotation before concluding anything: `…is not serving the artifact this run published` means the deployment was stranded, while `Could not read … at all` means no probe reached known-good content and the run says nothing either way. The two call for different responses — see [Why a release commit deploys twice](#why-a-release-commit-deploys-twice).
 4. Approve the `Production_PublishNuGet` stage when ready to publish to NuGet.org.
 5. Verify the packages appear on NuGet.org.
 6. Install the released template package or a locally packed template and create a smoke app that restores against NuGet.org.
@@ -201,6 +203,9 @@ Nothing about this is manual on the happy path. `.github/workflows/docs.yml` han
 | Push to `main` touching the docs | Republishes the `main (development)` version |
 | Push of a `v*` tag | Publishes `<version>`, moves the `latest` alias to it, and repoints the site root |
 
+A release commit triggers both, and both deploy — see
+[Why a release commit deploys twice](#why-a-release-commit-deploys-twice).
+
 The site root redirects to whichever version holds the `latest` alias, so readers landing
 on the bare URL always get the newest release rather than unreleased `main`. Every version
 that does *not* hold `latest` renders the outdated-version banner defined in
@@ -249,6 +254,84 @@ Once the policy admits the ref, dispatch `Publish docs` on `main` to serve the s
 release: the artifact is the whole `gh-pages` branch, so a deploy from any allowed ref
 publishes every version already committed to it.
 
+### Why a release commit deploys twice
+
+A release PR always edits `docs/guide/**` — the `{{reactorVersion}}` substitutions — so the
+push that merges it matches the workflow's path filter, and the release tag then points at
+that same merge commit. Left alone, that produces **two** `Publish docs` runs with an
+identical `github.sha`.
+
+That is a problem because `actions/deploy-pages` sends `pages_build_version = github.sha`
+and exposes no input to override it, so both runs create a Pages deployment under one
+identity. One wins and the other is silently stranded: every job green, the deployment
+reporting `success`, `gh-pages` byte-correct — and the live site still showing the previous
+release. That is exactly what happened cutting 0.1.0-preview.16, and it went unnoticed for
+2h25m (issue #1268).
+
+What prevents it now:
+
+- The `verify` job polls the live site after every deployment and asserts that the artifact
+  being served is the one **that run** produced. This is the part that carries correctness,
+  and it is the only thing in the pipeline that looks at the live site at all.
+
+**The duplicate deployment is tolerated, not avoided.** Standing one of the two runs down
+sounds obvious, and it was tried; every form of it requires *predicting* that the other run
+will deploy, and each way that prediction can fail is silent in the direction that matters:
+
+- a still-pending tag run can be cancelled by a later docs push, so the run deferred to
+  never happens;
+- a tag deleted or re-cut on `origin` after checkout leaves a stale local tag that still
+  points at the commit;
+- an unreachable `origin` makes the check answer "no tag here" from stale data;
+- the two runs are not guaranteed to enter the concurrency group in the order their events
+  fired, so the tag run can deploy an artifact that predates the branch run's `main`.
+
+Each of those skips the deployment **and** its verification together, leaving the site stale
+with every job green — strictly worse than a duplicate deployment that `verify` catches and
+reports. So both runs deploy, and a stranded one turns red.
+
+**The concurrency queue still matters.** The workflow's concurrency block sets `queue: max`.
+Under the Actions default (`queue: single`) only one run may be *pending* per group, and a
+newly queued run cancels the previous pending one. During a release that is reachable: the
+merge's `main` run holds the group, the tag run waits behind it, and any further docs push
+to `main` evicts the tag run before it ever starts — so the release version never reaches
+`gh-pages` at all, with nothing failing. `queue: max` makes runs wait in FIFO order instead.
+Removing it silently re-arms that failure, which is why `DocsDeployWiringTests` asserts it.
+
+`verify` distinguishes two failures, and they call for different responses:
+
+| Annotation | Meaning | What to do |
+| --- | --- | --- |
+| `…is not serving the artifact this run published` | The deployment was stranded. It names the run id the live site *is* serving. | Dispatch `Publish docs` on `main` (below). |
+| `Could not read … at all, so the deployment is unverified` | Not one probe reached known-good content, so the run says nothing about the deployment. | Treat it as a broken check: confirm the site is up, then re-run the job. |
+
+Every probe uses a unique `?nc=` query key, so a pass cannot come from a cached response,
+and an already-published version is fetched with the identical request shape as a positive
+control — a no-match is not a measurement until the same probe is shown able to match.
+
+What `verify` actually asserts, beyond the stamp: that the live `versions.json` contains
+every version the artifact declared and puts `latest` where this run put it; that each
+version **this run published** serves its own `index.html` (not just the `latest` holder,
+which a backported tag deliberately does not move and a `main` push never touches); and
+that the site root — the URL readers land on, written only by `mike set-default` — responds
+and still forwards to the expected default. The list of versions a run published is
+recorded by the publishing steps and cross-checked against mike's own `versions.json`
+before the artifact is uploaded, so the two cannot drift apart unnoticed.
+
+**The remedy, verified.** Dispatch `Publish docs` on `main`. The `publish` job assembles the
+artifact from the whole `gh-pages` branch, so any allowed ref re-serves every published
+version. With no `backfill_tags` the release step is skipped, and `mike set-default` runs
+only `if ! mike list latest` — `latest` already exists — so it **cannot drag `latest`
+backwards**. This is what restored preview.16.
+
+The gate's own oracle is `deploy-stamp.json` at the site root: `publish` writes it into the
+artifact with the run id that built it, and `verify` asserts the live copy matches. It is
+refreshed from the workflow on every deploy rather than committed to `gh-pages`, for the
+same reason `404.html` is — it describes a deployment, not a published version. Comparing
+`versions.json` alone would not do: `mike deploy main` republishes an existing version, so
+on a `main` push the version set is unchanged and the comparison would pass whether or not
+the deployment ever landed.
+
 ### Legacy unversioned links
 
 Before versioning, pages lived at unversioned paths such as
diff --git a/tests/Reactor.DocPipeline.Tests/DocsDeployWiringTests.cs b/tests/Reactor.DocPipeline.Tests/DocsDeployWiringTests.cs
new file mode 100644
index 000000000..a25deed9e
--- /dev/null
+++ b/tests/Reactor.DocPipeline.Tests/DocsDeployWiringTests.cs
@@ -0,0 +1,224 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using Xunit;
+using YamlDotNet.RepresentationModel;
+
+namespace Microsoft.UI.Reactor.Cli.Docs.Tests;
+
+/// <summary>
+/// Structural assertions on <c>.github/workflows/docs.yml</c>, covering the
+/// wiring that turns a stranded Pages deployment from silent into red
+/// (issue #1268).
+///
+/// The bug these guard against is not "the gate reports the wrong answer" — the
+/// node suite in <see cref="DocsDeploymentVerifierTests"/> covers that — it is
+/// "the gate is still present but no longer connected to anything". Each seam
+/// below fails open if it is quietly removed: without the stamp the verifier
+/// compares a version list that a <c>main</c> push never changes; without
+/// <c>needs: deploy</c> the verifier reads the site before the deployment; and
+/// without <c>github.run_id</c> as the expected value, the comparison it makes
+/// is a tautology. A workflow file is not covered by any compiler, so these are
+/// asserted here rather than assumed.
+/// </summary>
+public sealed class DocsDeployWiringTests
+{
+    private static readonly YamlMappingNode Workflow = LoadWorkflow();
+    private static readonly YamlMappingNode Jobs = Map(Workflow, "jobs");
+
+    [Fact]
+    public void Publish_exposes_the_published_version_list()
+    {
+        var outputs = Map(Map(Jobs, "publish"), "outputs");
+
+        Assert.Equal("${{ steps.artifact.outputs.versions }}", Scalar(outputs, "versions"));
+        Assert.Equal("${{ steps.artifact.outputs.published }}", Scalar(outputs, "published"));
+        Assert.Equal("${{ steps.artifact.outputs.run_attempt }}", Scalar(outputs, "run_attempt"));
+    }
+
+    [Fact]
+    public void Every_deployment_is_verified()
+    {
+        var deploy = Map(Jobs, "deploy");
+
+        // The duplicate deployment a release commit produces is tolerated on
+        // purpose. Every way of standing one run down requires predicting that
+        // the other will deploy, and each form of that prediction fails
+        // silently — skipping the verification below along with the
+        // deployment, which is worse than a duplicate `verify` can catch.
+        Assert.Null(Scalar(deploy, "if"));
+        Assert.Equal("${{ steps.deployment.outputs.page_url }}", Scalar(Map(deploy, "outputs"), "page_url"));
+    }
+
+    [Fact]
+    public void Pending_runs_queue_instead_of_evicting_each_other()
+    {
+        var concurrency = Map(Workflow, "concurrency");
+
+        // Under the Actions default (`queue: single`) a later docs push evicts
+        // a still-pending tag run, so that run never publishes its version to
+        // `gh-pages` at all. The release is then lost outright with no job
+        // failing anywhere, which is why this setting is asserted rather than
+        // left to a comment.
+        Assert.Equal("max", Scalar(concurrency, "queue"));
+
+        // `queue: max` plus `cancel-in-progress: true` is a workflow validation
+        // error, which would take the whole workflow offline rather than fail
+        // one job.
+        Assert.NotEqual("true", Scalar(concurrency, "cancel-in-progress"));
+    }
+
+    [Fact]
+    public void The_artifact_carries_a_stamp_identifying_the_run_that_built_it()
+    {
+        var run = StepRun("publish", "artifact");
+
+        // Without the stamp the gate falls back to comparing versions.json,
+        // which a `main` push never changes — so the check would pass whether
+        // or not this run's deployment ever landed.
+        //
+        // Matched as a redirect, not as a bare mention: the step also cats the
+        // file back out for the log, and a substring check alone stays green
+        // when the write itself is removed.
+        Assert.Matches(@">\s*site/deploy-stamp\.json", run);
+        Assert.Contains("$GITHUB_RUN_ID", run, StringComparison.Ordinal);
+
+        // Named without a leading `.` or `_`: Pages has historically excluded
+        // those, and an unservable stamp would fail every run.
+        Assert.DoesNotContain("site/.deploy-stamp", run, StringComparison.Ordinal);
+        Assert.DoesNotContain("site/_deploy-stamp", run, StringComparison.Ordinal);
+
+        Assert.Contains("versions=", run, StringComparison.Ordinal);
+        Assert.Contains("$GITHUB_OUTPUT", run, StringComparison.Ordinal);
+
+        // The versions this run published drive which directories verify
+        // probes. Without them the probe silently narrows to the `latest`
+        // holder, which never covers a backported tag or a `main` push.
+        Assert.Matches(@"published=", run);
+        Assert.Contains("PUBLISHED_VERSIONS_FILE", run, StringComparison.Ordinal);
+
+        // The recorded list and mike's versions.json are produced
+        // independently. Without this cross-check a divergence would quietly
+        // shrink what verify probes instead of failing.
+        Assert.Contains("site/versions.json", run, StringComparison.Ordinal);
+        Assert.Matches(@"missing\b", run);
+    }
+
+    [Theory]
+    [InlineData("Publish the main version")]
+    [InlineData("Publish the release version")]
+    [InlineData("Backfill release versions")]
+    public void Every_publishing_step_records_what_it_published(string stepName)
+    {
+        var step = Steps("publish").Single(s => Scalar(s, "name") == stepName);
+
+        // Comments stripped first: these steps explain themselves in prose that
+        // names the very commands being located, and a comment mentioning
+        // `mike deploy` after the write would invert the ordering check.
+        var run = string.Join(
+            "\n",
+            Scalar(step, "run")!
+                .Split('\n')
+                .Where(line => !line.TrimStart().StartsWith("#", StringComparison.Ordinal)));
+
+        // The artifact step hard-fails on an empty list, so a step that stops
+        // recording turns into a red run rather than a quieter gate — but only
+        // if every step records in the first place.
+        var write = run.LastIndexOf("$RUNNER_TEMP/$PUBLISHED_VERSIONS_FILE", StringComparison.Ordinal);
+        Assert.True(write >= 0, $"'{stepName}' records nothing, so verify cannot know what to probe.");
+
+        // And only if it records *after* publishing. Recording first means a
+        // failed `mike deploy` still names a version as published, so verify
+        // would go looking for a directory that was never written and blame the
+        // deployment for it. Asserting the mention alone would not notice the
+        // write moving back above the deploy.
+        var deployed = run.LastIndexOf("mike deploy", StringComparison.Ordinal);
+        Assert.True(deployed >= 0, $"'{stepName}' does not deploy anything.");
+        Assert.True(
+            write > deployed,
+            $"'{stepName}' records the version it published before `mike deploy` runs, so a failed "
+                + "publish would still be reported to the verify job as a directory to probe.");
+    }
+
+    [Fact]
+    public void A_verify_job_runs_after_the_deployment_and_reads_the_live_site()
+    {
+        var verify = Map(Jobs, "verify");
+
+        var needs = ((YamlSequenceNode)verify.Children["needs"]).Children
+            .Select(n => ((YamlScalarNode)n).Value)
+            .ToArray();
+        Assert.Contains("publish", needs);
+        Assert.Contains("deploy", needs);
+
+        var step = Steps("verify").Single(s => Scalar(s, "run")?.Contains("verify-docs-deployment.mjs", StringComparison.Ordinal) == true);
+        var env = Map(step, "env");
+
+        Assert.Equal("${{ needs.deploy.outputs.page_url }}", Scalar(env, "DOCS_BASE_URL"));
+        Assert.Equal("${{ github.run_id }}", Scalar(env, "DOCS_EXPECTED_RUN_ID"));
+
+        // The attempt that built the artifact, not this job's own counter:
+        // re-running only `deploy` reuses the artifact, so `github.run_attempt`
+        // here would disagree with the stamp on every partial re-run.
+        Assert.Equal("${{ needs.publish.outputs.run_attempt }}", Scalar(env, "DOCS_EXPECTED_RUN_ATTEMPT"));
+        Assert.Equal("${{ needs.publish.outputs.versions }}", Scalar(env, "DOCS_EXPECTED_VERSIONS"));
+        Assert.Equal("${{ needs.publish.outputs.published }}", Scalar(env, "DOCS_PUBLISHED_VERSIONS"));
+    }
+
+    [Fact]
+    public void The_verifier_and_its_regression_suite_are_present()
+    {
+        var repoRoot = FindRepoRoot();
+        var paths = new[] { "verify-docs-deployment.mjs", "verify-docs-deployment.test.mjs" }
+            .Select(name => Path.Join(repoRoot, ".github", "scripts", name));
+
+        foreach (var path in paths)
+        {
+            Assert.True(File.Exists(path), $"Missing {path}, which docs.yml runs after every Pages deployment.");
+        }
+    }
+
+    private static IEnumerable<YamlMappingNode> Steps(string job) =>
+        ((YamlSequenceNode)Map(Jobs, job).Children["steps"]).Children.Cast<YamlMappingNode>();
+
+    private static string StepRun(string job, string stepId)
+    {
+        var step = Steps(job).SingleOrDefault(s => Scalar(s, "id") == stepId);
+        Assert.NotNull(step);
+        var run = Scalar(step!, "run");
+        Assert.False(string.IsNullOrWhiteSpace(run), $"Step '{stepId}' in job '{job}' has no run block.");
+        return run!;
+    }
+
+    private static YamlMappingNode Map(YamlMappingNode parent, string key)
+    {
+        var found = parent.Children.TryGetValue(new YamlScalarNode(key), out var value);
+        Assert.True(found, $"Expected a '{key}' mapping.");
+        return (YamlMappingNode)value!;
+    }
+
+    private static string? Scalar(YamlMappingNode parent, string key) =>
+        parent.Children.TryGetValue(new YamlScalarNode(key), out var value) ? ((YamlScalarNode)value).Value : null;
+
+    private static YamlMappingNode LoadWorkflow()
+    {
+        var path = Path.Join(FindRepoRoot(), ".github", "workflows", "docs.yml");
+        var stream = new YamlStream();
+        using var reader = new StringReader(File.ReadAllText(path));
+        stream.Load(reader);
+        return (YamlMappingNode)stream.Documents[0].RootNode;
+    }
+
+    private static string FindRepoRoot()
+    {
+        var dir = Directory.GetCurrentDirectory();
+        while (dir is not null)
+        {
+            if (File.Exists(Path.Join(dir, "Reactor.slnx")) || Directory.Exists(Path.Join(dir, ".git")))
+                return dir;
+            dir = Path.GetDirectoryName(dir);
+        }
+        throw new InvalidOperationException("Reactor repo root not found from test cwd.");
+    }
+}
diff --git a/tests/Reactor.DocPipeline.Tests/DocsDeploymentVerifierTests.cs b/tests/Reactor.DocPipeline.Tests/DocsDeploymentVerifierTests.cs
new file mode 100644
index 000000000..e76bbb72d
--- /dev/null
+++ b/tests/Reactor.DocPipeline.Tests/DocsDeploymentVerifierTests.cs
@@ -0,0 +1,145 @@
+using System;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using Xunit;
+
+namespace Microsoft.UI.Reactor.Cli.Docs.Tests;
+
+/// <summary>
+/// Runs the regression suite for <c>.github/scripts/verify-docs-deployment.mjs</c>,
+/// the gate that decides whether the live docs site is serving the artifact a
+/// <c>Publish docs</c> run produced (issue #1268).
+///
+/// That script is the only thing in the pipeline that looks at the live site.
+/// Everything else — the strict build, the mike push, the Pages deployment —
+/// stayed green while a release was stranded, so a mistake in this one file is
+/// a mistake in the only signal that can catch the bug it exists for.
+///
+/// The cases live in JavaScript next to the script so a release engineer can
+/// run them with plain <c>node</c>; this test exists so CI runs them too. It is
+/// wired into the <c>docs-build</c> job, which is armed whenever a non-Markdown
+/// file changes — and both the script and its test script qualify.
+/// </summary>
+public sealed class DocsDeploymentVerifierTests
+{
+    /// <summary>
+    /// Floor for the number of cases the node suite must run, so it cannot be
+    /// quietly reduced to one passing case while the xUnit gate stays green.
+    /// Raising it as cases are added is optional; lowering it is a decision.
+    /// </summary>
+    private const int MinimumCases = 45;
+
+    /// <summary>
+    /// Ceiling for the node subprocess. The suite runs in well under a second,
+    /// so this only ever fires on a hang; generous enough that a slow cold
+    /// start on a loaded runner is not mistaken for one.
+    /// </summary>
+    private static readonly TimeSpan SubprocessTimeout = TimeSpan.FromMinutes(3);
+
+    [Fact]
+    public async Task Deployment_verifier_cases_pass()
+    {
+        var repoRoot = FindRepoRoot();
+        var testScript = Path.Join(repoRoot, ".github", "scripts", "verify-docs-deployment.test.mjs");
+
+        Assert.True(
+            File.Exists(testScript),
+            $"Missing {testScript}. The docs-deployment gate is unverified without it.");
+
+        using var process = Process.Start(new ProcessStartInfo
+        {
+            FileName = "node",
+            // `--test` is redundant when the file registers tests on import,
+            // but it makes the invocation canonical rather than relying on
+            // that. TAP explicitly because node's default reporter varies with
+            // the node version and whether stdout is a TTY, and the
+            // completeness check below reads the summary counters it emits.
+            ArgumentList = { "--test", "--test-reporter=tap", testScript },
+            WorkingDirectory = repoRoot,
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            UseShellExecute = false,
+            CreateNoWindow = true,
+        })!;
+
+        // Bounded and killed on expiry. A hung `node` — which this suite has
+        // already produced once, when an unref'd abort timer left a probe
+        // pending — would otherwise sit here until the CI job's own timeout,
+        // reporting nothing useful and leaving the process behind.
+        using var timeout = CancellationTokenSource.CreateLinkedTokenSource(TestContext.Current.CancellationToken);
+        timeout.CancelAfter(SubprocessTimeout);
+        var cancellationToken = timeout.Token;
+
+        // Start both reads before awaiting exit: a child that fills one pipe
+        // buffer blocks on the write while the parent waits for it to exit.
+        var stdoutTask = process.StandardOutput.ReadToEndAsync(cancellationToken);
+        var stderrTask = process.StandardError.ReadToEndAsync(cancellationToken);
+
+        try
+        {
+            await process.WaitForExitAsync(cancellationToken);
+        }
+        catch (OperationCanceledException)
+        {
+            try
+            {
+                process.Kill(entireProcessTree: true);
+            }
+            catch (InvalidOperationException)
+            {
+                // Already exited between the timeout firing and the kill.
+            }
+
+            Assert.Fail(
+                $"node did not finish within {SubprocessTimeout.TotalSeconds:0} seconds running "
+                    + "verify-docs-deployment.test.mjs. A case is hanging — most likely a probe whose "
+                    + "timeout never fires, which is not observable from the TAP summary because the "
+                    + "runner cancels the remaining cases instead of failing them.");
+        }
+
+        var stdout = await stdoutTask;
+        var output = string.Join(
+            Environment.NewLine,
+            new[] { stdout, await stderrTask }.Where(s => !string.IsNullOrWhiteSpace(s)));
+
+        // Fails rather than skips when node is absent, for the same reason
+        // SiteRootRedirectTests does: every GitHub-hosted runner ships node, so
+        // a missing interpreter is a broken environment — and a test that
+        // quietly opts out when its fixture fails is a test that cannot fail.
+        Assert.True(
+            process.ExitCode == 0,
+            $".github/scripts/verify-docs-deployment.test.mjs failed (exit {process.ExitCode}):{Environment.NewLine}{output}");
+
+        // An exit code of zero is also what `node` returns for a file that
+        // registered no tests at all, and a positive pass count alone would
+        // still be satisfied by a suite gutted to a single case. Assert a floor
+        // instead: growth is fine, silent shrinkage is not.
+        var match = Regex.Match(stdout, @"^# pass (\d+)$", RegexOptions.Multiline);
+        Assert.True(match.Success, $"No TAP pass count in the runner output:{Environment.NewLine}{output}");
+
+        var passed = int.Parse(match.Groups[1].Value, CultureInfo.InvariantCulture);
+        Assert.True(
+            passed >= MinimumCases,
+            $"Only {passed} cases ran, below the {MinimumCases} this suite is expected to carry. "
+                + "The live-site verifier is the only check that can catch a stranded deployment, so its "
+                + "regression suite must not shrink. If cases were deliberately removed or merged, lower "
+                + $"{nameof(MinimumCases)} in this file with the reason in the commit message.");
+    }
+
+    private static string FindRepoRoot()
+    {
+        var dir = Directory.GetCurrentDirectory();
+        while (dir is not null)
+        {
+            if (File.Exists(Path.Join(dir, "Reactor.slnx")) || Directory.Exists(Path.Join(dir, ".git")))
+                return dir;
+            dir = Path.GetDirectoryName(dir);
+        }
+        throw new InvalidOperationException("Reactor repo root not found from test cwd.");
+    }
+}
diff --git a/tests/Reactor.DocPipeline.Tests/Reactor.DocPipeline.Tests.csproj b/tests/Reactor.DocPipeline.Tests/Reactor.DocPipeline.Tests.csproj
index c6fb85c4f..1574b5ba9 100644
--- a/tests/Reactor.DocPipeline.Tests/Reactor.DocPipeline.Tests.csproj
+++ b/tests/Reactor.DocPipeline.Tests/Reactor.DocPipeline.Tests.csproj
@@ -21,6 +21,10 @@
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="xunit.v3" />
     <PackageReference Include="xunit.runner.visualstudio" />
+    <!-- DocsDeployWiringTests parses .github/workflows/docs.yml structurally.
+         Referenced explicitly rather than leaned on transitively through
+         Reactor.Cli, so dropping it there cannot silently break this suite. -->
+    <PackageReference Include="YamlDotNet" />
     <PackageReference Include="coverlet.collector">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>