Per-terminal CLI device pins (retire eval $(device connect)) + CI report/daemon hardening

.github/pr_generate_report_assets.sh

@@ -5,9 +5,9 @@
 # build to embed on https://block.github.io/trailblaze/reports/.
 #
 # This is SEPARATE from pr_generate_trailblaze_report.sh (which builds the CI
-# `trailblaze_report.html` index via `:trailblaze-report:run`). Here we drive the
-# `trailblaze report` CLI subcommand, which is the only entry point wired to the
-# `--storyboard` / `--webp` exporters.
+# `trailblaze_report.html` index). Both scripts drive the `trailblaze report` CLI
+# subcommand off the prebuilt uber JAR; this one passes `--storyboard` / `--webp`,
+# which are wired only on that subcommand.
 #
 # Intentionally NOT `set -e`: a missing encoder or a flaky capture must never red the
 # trail job. We emit clear diagnostics and exit 0 so the workflow's upload step still
@@ -38,15 +38,11 @@ else
   echo "WARNING: ffmpeg with libwebp_anim not found — the animated timeline.webp will be skipped."
 fi
 
-# The report HTML (and therefore the storyboard/webp, which screenshot it via headless
-# Playwright) renders from the WASM report template. In CI `./trailblaze` runs via Gradle
-# WITHOUT -Ptrailblaze.wasm=true, so we must materialize the template to the build-output
-# path that ReportTemplateResolver checks (trailblaze-report/build/report-template/).
-echo "Building WASM report template..."
-./gradlew :trailblaze-report:generateReportTemplate -Ptrailblaze.wasm=true || {
-  echo "ERROR: failed to build WASM report template — reports would render blank. Aborting asset gen."
-  exit 0
-}
+# The WASM report template ships embedded in the prebuilt uber JAR (the
+# `build-uber-jar` workflow job invokes Gradle with -Ptrailblaze.wasm=true,
+# which makes `packageUberJarForCurrentOS` depend on `bundleReportTemplate`).
+# `trailblaze report` resolves it from the JAR's classpath, so no separate
+# template build step is needed here.
 
 # Resolve the single session this trail produced. Session logs are per-session dirs under
 # $LOGS_DIR; skip the sibling `reports/` output dir. Newest wins if there's more than one.
@@ -61,7 +57,7 @@ echo "Using session: $SESSION_ID"
 # --max-size caps the animated WebP so it stays light on the docs page and well under
 # any inline limits; the HTML report itself is not size-capped (it's a download/link-out).
 echo "Exporting storyboard + animated WebP + interactive report..."
-./trailblaze report --id "$SESSION_ID" --output-dir "$OUT_DIR" \
+trailblaze report --id "$SESSION_ID" --output-dir "$OUT_DIR" \
   --storyboard --webp --no-gif --max-size=8MB
 
 echo "========================================="

.github/pr_generate_trailblaze_report.sh

@@ -1,26 +1,35 @@
 #!/usr/bin/env bash
+# Generate the CI `trailblaze_report.html` index for the trail run.
+#
+# Runs entirely off the prebuilt Trailblaze CLI installed on $PATH by the
+# upstream `build-uber-jar` job's `install-trailblaze-from-artifact.sh` step.
+# The WASM report template is bundled into the uber JAR's classpath (the
+# build-uber-jar job invokes Gradle with -Ptrailblaze.wasm=true), so there's
+# no separate `:trailblaze-ui:wasmJsBrowserProductionWebpack` /
+# `:trailblaze-report:run` Gradle dance — just one `trailblaze report` call.
 set -e
 
 TRAILBLAZE_LOGS_DIR="$(pwd)/trailblaze-logs"
 
 echo "========================================="
 
-# Check if logs directory exists and has content before attempting report generation
 if [ ! -d "$TRAILBLAZE_LOGS_DIR" ] || [ -z "$(ls -A "$TRAILBLAZE_LOGS_DIR" 2>/dev/null)" ]; then
   echo "WARNING: No logs found in $TRAILBLAZE_LOGS_DIR - skipping report generation"
   echo "========================================="
   exit 0
 fi
 
-echo "Building Compose Web/WASM UI..."
-./gradlew :trailblaze-ui:wasmJsBrowserProductionWebpack -Ptrailblaze.wasm=true
-UI_EXIT_CODE=$?
-echo "UI build exit code: $UI_EXIT_CODE"
-
 echo "Generating Trailblaze report..."
-./gradlew :trailblaze-report:run --args="$TRAILBLAZE_LOGS_DIR" -Ptrailblaze.wasm=true
-REPORT_EXIT_CODE=$?
-echo "Report generation exit code: $REPORT_EXIT_CODE"
+trailblaze report --output-dir "$TRAILBLAZE_LOGS_DIR"
+
+# `trailblaze report --output-dir` writes `report.html` under the canonical name; the
+# downstream artifact step (.github/pr_create_artifacts.sh) and the workflow upload
+# paths still expect the legacy `trailblaze_report.html` name. Rename in place to
+# avoid cascading the change into four workflow files. Best-effort: a missing input
+# means the CLI emitted nothing (already logged above) and we just skip silently.
+if [ -f "$TRAILBLAZE_LOGS_DIR/report.html" ]; then
+  mv -f "$TRAILBLAZE_LOGS_DIR/report.html" "$TRAILBLAZE_LOGS_DIR/trailblaze_report.html"
+fi
 
 echo "Checking for generated report..."
 if [ -f "$TRAILBLAZE_LOGS_DIR/trailblaze_report.html" ]; then
@@ -29,6 +38,6 @@ if [ -f "$TRAILBLAZE_LOGS_DIR/trailblaze_report.html" ]; then
 else
   echo "✗ Report NOT found at expected location"
   echo "Searching for report files..."
-  find "$(pwd)" -name "trailblaze_report.html" -o -name "*report*.html" 2>/dev/null || echo "No report files found"
+  find "$(pwd)" -name "trailblaze_report.html" -o -name "report.html" -o -name "*report*.html" 2>/dev/null || echo "No report files found"
 fi
 echo "========================================="

.github/workflows/github-pages.yml

@@ -37,12 +37,22 @@ jobs:
 
       - name: Fetch latest report-gallery assets
         # Pull the report assets (storyboard.webp / timeline.webp / report.html) from the
-        # most recent SUCCESSFUL trail run on main and overwrite the committed placeholders
-        # in the build workspace. Because this workflow and the trail workflows both run on
-        # the same push, we intentionally use the previous green run — a one-commit lag.
+        # most recent trail run on main and overwrite the committed placeholders in the
+        # build workspace. Because this workflow and the trail workflows both run on the
+        # same push, we intentionally use the previous run — a one-commit lag.
         #
-        # Best-effort: any miss (no successful run yet, expired artifact, fork without the
-        # token) leaves the committed placeholders in place so `mkdocs build --strict` still
+        # We deliberately do NOT filter on `--status success`. The trail workflows
+        # (`wikipedia-trails.yml` etc.) gate their own success/failure on a terminal
+        # "Fail if trails failed" step that fires AFTER artifact upload, so a job marked
+        # `failure` can still carry usable assets. Falling back to the previous green run
+        # would let a single transient trail-side error stale-pin the docs gallery for
+        # days; instead we trust the artifact presence and let `gh run download` below
+        # decide. If the latest run truly produced nothing (genuine breakage upstream of
+        # the export), `gh run download` silently no-ops and the committed placeholders
+        # survive — same graceful fallback as a missing artifact.
+        #
+        # Best-effort: any miss (no run yet, expired artifact, fork without the token)
+        # leaves the committed placeholders in place so `mkdocs build --strict` still
         # succeeds. Never fail the deploy over a missing showcase asset.
         continue-on-error: true
         env:
@@ -52,7 +62,7 @@ jobs:
           fetch_assets() {
             local workflow="$1" dest="$2"
             local run_id
-            run_id="$(gh run list --workflow="$workflow" --branch main --status success \
+            run_id="$(gh run list --workflow="$workflow" --branch main \
               --limit 1 --json databaseId --jq '.[0].databaseId')"
             if [ -z "$run_id" ] || [ "$run_id" = "null" ]; then
               echo "  no successful $workflow run found — keeping committed placeholders"