[dmccoystephenson]

Summary

• Stage B test expansion: the existing "A re-run of the same version fails by default" and "A wrong token fails" steps assert only that the step failed, not which case "$status" arm produced the failure or what the caller is told. A new step runs deploy.sh directly against the CI arcade and checks:
  • the 409 arm's ::error:: message ("bump version.txt, or set skip-existing: true for re-runs"),
  • the 401/403 arm's ::error:: message, including the "Check the ARCADE_TOKEN secret and the token_sha256 in games.yaml" hint (a fresh, unused version is sent so the refusal cannot come from the 409 arm instead),
  • the ::notice:: line printed when skip-existing swallows a 409.
• README "Tests" paragraph updated to list these checks.
• Characterization only: deploy.sh and action.yml are unchanged.

No tracking issue — gap found during triage.

Issue #10 is deferred again: it still awaits the owner's compatibility decision (strict true/false versus case-insensitive) recorded on the issue.

Test plan

• Test / deploy-to-a-real-arcade green, with the new step "Refused uploads say what to do, and skip-existing leaves a notice" executed.
• action.yml and test.yml parse as YAML locally.

Compatibility

Backward-compatible for @v1 callers: no input, output, or script change.

This PR touches .github/workflows/test.yml, so it is held for manual review rather than merged automatically.

This PR description was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).

🤖 Generated with Claude Code

---

drafted by Claude on behalf of Daniel Stephenson

[dmccoystephenson]

Self-review rubric (CI-anchored, run 39571347148 on head 84f4f44):

• Scope: PASS — only .github/workflows/test.yml (one new step) and the README "Tests" paragraph are changed; both serve the same test expansion.
• Tests-new: PASS — the 409 arm, the 401/403 arm, and the skip-existing notice line each have an assertion in "Refused uploads say what to do, and skip-existing leaves a notice". The job log shows the step executed: "Uploading fixture 1.0.0 …" (the 409 call) and "Uploading fixture 9.9.9 …" (the wrong-token call), and the step passed.
• Tests-fix: N/A — no bug fix; deploy.sh is unchanged (characterization only).
• Sibling structure: PASS — expect_refusal mirrors the existing expect_error helper (stderr captured to $RUNNER_TEMP, grep -F, sed 's/^::/: :/' dump on mismatch).
• Sibling renames: N/A — nothing renamed.
• Docs: PASS — README "Tests" paragraph names the new checks; no input, output, or script change, so the Inputs table and Outputs line are unaffected.
• Issue resolution: N/A — no Closes; the PR body records the gap as found during triage, and activate and skip-existing silently treat any non-exact value as the default #10 is deferred pending the owner's decision.
• CI: PASS — Test / deploy-to-a-real-arcade green on the PR head.
• Input/Output parity: PASS — action.yml and deploy.sh are untouched.
• Token hygiene: PASS — the test token reaches deploy.sh only via ARCADE_TOKEN in the environment, as the existing noslug step already does; $TEST_TOKEN is a hardcoded non-secret.
• Compatibility: PASS — no public-interface change.

Observations:

• .github/workflows/test.yml:73 — the wrong-token call sends an unused version (9.9.9), so the refusal comes from the auth check and cannot come from the 409 arm. The (40 prefix covers both 401 and 403, because which status the server returns is not pinned here.
• .github/workflows/test.yml:75 — the skip-existing call writes its outputs to the step's GITHUB_OUTPUT. The step has no id, so nothing reads them.
• Weakness: the assertions match deploy.sh's exact wording, so any rewording of those messages must update this step as well. That is intended for a characterization test.

Held for manual review: .github/workflows/* is on the do-not-auto-merge list.

This review was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).

---

drafted by Claude on behalf of Daniel Stephenson

[dmccoystephenson]

Correction to the self-review above: the two observations cite the wrong lines. The wrong-token call is at .github/workflows/test.yml:97, not :73, and the skip-existing call is at .github/workflows/test.yml:99, not :75. The findings themselves are unchanged.

This comment was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).

---

drafted by Claude on behalf of Daniel Stephenson