Publish completed packages when a peer build fails

bin/build

@@ -320,6 +320,20 @@ echo "  Skipped:        ${#SKIPPED_PACKAGES[@]} (up-to-date or excluded)"
 echo "  Failed:         ${#FAILED_PACKAGES[@]}"
 echo "  Blocked:        ${#BLOCKED_PACKAGES[@]}"
 
+# The release caller supplies a fresh directory. A completed result
+# distinguishes package failures from an interrupted/failed orchestrator;
+# only artifacts belonging to fully successful builds may be published.
+if [[ -n "${OMARCHY_BUILD_RESULT_DIR:-}" ]]; then
+  mkdir -p "$OMARCHY_BUILD_RESULT_DIR"
+  : > "$OMARCHY_BUILD_RESULT_DIR/artifacts"
+  for package in "${SUCCESSFUL_PACKAGES[@]}"; do
+    cat "$PLAN_DIR/artifacts/$package" >> "$OMARCHY_BUILD_RESULT_DIR/artifacts"
+  done
+  printf '%s\n' "${FAILED_PACKAGES[@]}" | sed '/^$/d' > "$OMARCHY_BUILD_RESULT_DIR/failed"
+  printf '%s\n' "${BLOCKED_PACKAGES[@]}" | sed '/^$/d' > "$OMARCHY_BUILD_RESULT_DIR/blocked"
+  touch "$OMARCHY_BUILD_RESULT_DIR/complete"
+fi
+
 if (( ${#FAILED_PACKAGES[@]} + ${#BLOCKED_PACKAGES[@]} )); then
   if (( ${#FAILED_PACKAGES[@]} )); then
     echo "Failed packages:"
@@ -330,7 +344,9 @@ if (( ${#FAILED_PACKAGES[@]} + ${#BLOCKED_PACKAGES[@]} )); then
     printf '  - %s\n' "${BLOCKED_PACKAGES[@]}"
   fi
   print_warning "Some packages failed (see details above)"
-  exit 1
+  # Reserved for a completed run with unsuccessful packages. Other failures
+  # must not let release publish arbitrary files left in the workspace.
+  exit 2
 fi
 
 print_success "Build completed successfully!"

bin/release

@@ -138,11 +138,43 @@ if [[ "$DRY_RUN" == true ]]; then
 else
   print_info "Step 1/6: Building packages..."
 fi
-"$BUILD_ROOT/bin/build" "${BUILD_ARGS[@]}" || {
+BUILD_RESULT_DIR=$(mktemp -d)
+trap 'rm -rf "$BUILD_RESULT_DIR"' EXIT
+build_status=0
+OMARCHY_BUILD_RESULT_DIR="$BUILD_RESULT_DIR" "$BUILD_ROOT/bin/build" "${BUILD_ARGS[@]}" || build_status=$?
+partial=false
+if [[ "$build_status" == 2 && -f "$BUILD_RESULT_DIR/complete" && "$DRY_RUN" != true ]]; then
+  if [[ "${OMARCHY_DEFER_RUNTIME_DEPS:-false}" == true ]]; then
+    print_error "The deferred release pair must succeed together; nothing will be published"
+    notify_error "Release failed: Incomplete release pair" "$RELEASE_CONTEXT"
+    exit 1
+  fi
+  partial=true
+  while IFS= read -r file; do
+    [[ -f "$BUILD_OUTPUT_DIR/$file" ]] || {
+      print_error "Completed build artifact is missing: $file"
+      notify_error "Release failed: Missing completed artifact" "$RELEASE_CONTEXT"
+      exit 1
+    }
+  done < "$BUILD_RESULT_DIR/artifacts"
+  # Exclude partial split outputs or leftovers from failed builds. Moving
+  # them out of the flat publication directory keeps them available for
+  # diagnosis without handing them to sign/promote.
+  unpublished=""
+  for path in "$BUILD_OUTPUT_DIR"/*.pkg.tar.*; do
+    [[ -f "$path" ]] || continue
+    file=${path##*/}
+    if ! grep -Fxq -- "${file%.sig}" "$BUILD_RESULT_DIR/artifacts"; then
+      [[ -n "$unpublished" ]] || unpublished=$(mktemp -d "$BUILD_OUTPUT_DIR/.unpublished.XXXXXX")
+      mv -- "$path" "$unpublished/"
+    fi
+  done
+  print_warning "Some packages failed; publishing the completed packages before retrying the failures"
+elif [[ "$build_status" != 0 ]]; then
   print_error "Build failed"
   notify_error "Release failed: Build step failed" "$RELEASE_CONTEXT"
   exit 1
-}
+fi
 
 if [[ "$DRY_RUN" == true ]]; then
   echo ""
@@ -155,6 +187,12 @@ BUILT_COUNT=$(grep -c '' <<<"$BUILT_FILES")
 [[ -z "$BUILT_FILES" ]] && BUILT_COUNT=0
 print_info "Built $BUILT_COUNT package(s) this run"
 
+if [[ "$partial" == true && "$BUILT_COUNT" == 0 ]]; then
+  print_error "No completed packages to publish"
+  notify_error "Release failed: No completed packages" "$RELEASE_CONTEXT"
+  exit 1
+fi
+
 # Step 2: Sign
 echo ""
 print_info "Step 2/6: Signing packages..."
@@ -213,7 +251,16 @@ if ((BUILT_COUNT > 0)); then
   summary+="<br><br><strong>$BUILT_COUNT package(s) published:</strong>"
   summary+="$(format_package_list_html "$BUILT_FILES")"
   summary+="<br><br>Live at https://pkgs.omarchy.org/$MIRROR/$ARCH/"
-  notify_success "Release published: $MIRROR" "$summary"
+  if [[ "$partial" == true ]]; then
+    failed=$(tr '\n' ' ' < "$BUILD_RESULT_DIR/failed" | basecamp_html_escape)
+    blocked=$(tr '\n' ' ' < "$BUILD_RESULT_DIR/blocked" | basecamp_html_escape)
+    [[ -z "$failed" ]] || summary+="<br><br>Failed: $failed"
+    [[ -z "$blocked" ]] || summary+="<br>Blocked by failed dependencies: $blocked"
+    summary+="<br>Published packages will be skipped on retry; failed packages remain queued."
+    notify_info "Partial release published: $MIRROR" "$summary"
+  else
+    notify_success "Release published: $MIRROR" "$summary"
+  fi
 else
   # Rare by construction: a release only runs when the version check queued
   # work, so publishing nothing means the check and the builder disagreed
@@ -228,4 +275,10 @@ else
 fi
 
 echo ""
+if [[ "$partial" == true ]]; then
+  print_warning "Completed packages published; unsuccessful packages remain for retry"
+  # Preserve the scheduled queue and failure backoff. The next version
+  # check/build compares against the updated repository and skips successes.
+  exit 1
+fi
 print_success "Release workflow completed successfully!"