[helly25]

Pages timeouts currently hold the same queue that retains coverage, benchmark, and release data. Separate deployment from retention so report writers can continue while Pages is slow, and deploy the newest complete retained snapshot.

AG;DR

The shared coverage-pages queue has reached GitHub's 100-pending limit. Actual publisher annotations report a full queue; an observed deployment also spent ten minutes polling blank status before timing out. Its retained branch update had already succeeded.

• Keep all three producers serialized under coverage-pages with queue: max and cancellation disabled. Their artifact provenance checks, retention, rendering, metadata reconciliation, compaction, and branch pushes remain intact. Do not coalesce incoming source events: each producer imports its own artifacts.
• Move staging, Pages upload/deployment, live benchmark verification, and PR comments to Deploy retained site. It runs after successful producer completion or manual dispatch. Its separate job-level queue: single coalesces deployment notifications only and does not cancel a running deployment. Failed producer notifications cannot displace a valid pending deployment job.
• At checkout, pin the latest retained site snapshot and record its SHA. The deployer has read-only contents permission, never updates the retained branch, and executes only trusted main-branch tools. Producers explicitly require main after their Pages environment is removed; deployment retains that environment and the same explicit guard.
• Verify the actual deployed benchmark-index digest before updating comments. Reconcile every current PR represented by that snapshot, deduplicating platform records by source run/attempt and rechecking current PR heads and attempts through the existing validation. This preserves comments when several producers share one deployment; newer undeployed branch records never become comment input.
• Extend the existing helper with comment-retained, preserve required source identity arguments for existing operations, and declare the new workflow as Bazel test data. Make the coverage Git fixture disable signing locally so tests do not invoke a contributor's signing key.

Validation on the implementation base: seven affected Bazel targets passed on macOS (five executed and two cached in the final pass); all 114 corresponding direct tests passed on both macOS/Python 3.13 and Linux/Python 3.14 over SSH. All 199 transferred Linux test input hashes were verified. Tests cover multiple coalesced PRs, deduplicated platform updates, closed/stale attempts, source argument validation, producer serialization, main guards, deployment ordering, artwork, and compaction. Normal changed-file pre-commit and Trunk checks passed for all 16 files; local clang-tidy was skipped under the standing user instruction. Public-head CI and first hosted deployment remain required.

This is intentionally an isolated publication repair. It neither deletes historical data nor cancels queued publishers. Already queued legacy definitions still contain their old deployment steps, and rejected source events require separate ingestion replay. Full rendering remains inside the writer lock; removing that cost and recovering missing publications are tracked follow-ups. A manual pages_deploy.yml dispatch republishes already retained data without artifact ingestion or report regeneration.

GitHub documents the queue limit and replacement behavior in Control workflow concurrency.

Public integration and current qualification

The current signed head is df0aefe8099e190c7deca63f2dfb24e33feb3b8a, incorporating actual main f8d7efd5cdb2b0b06ac94283aa66c739711ec3aa after #1134. Normal combined merges preserve every original publication implementation blob and all newer qualified main runtime, test, report and configuration blobs. Both sets of shared TODO additions are retained; combined tree 959263065441981a68b9564d86e8f6cf42297e3d was independently checked. Normal signed commit and immediate push hooks passed; normal merge hooks intentionally skip redundant Trunk. No local clang-tidy, source retiming or unchanged C++ test repetition was performed.

Own current-main Test run 42388831116 completed successfully on signed head df0aefe8099e190c7deca63f2dfb24e33feb3b8a. All platform tests, GCC, sanitizers, coverage, CI clang-tidy, pre-commit, Trunk, release-site checks, final best-7-of-9 benchmark comparison and required done passed. All six initial measurement shards and the fourth/fifth macOS candidates succeeded under the normal adaptive policy. Exact predecessor-main Test 42388686269 also completed successfully. GitHub recognizes the pushed head on the actual current main. Prior-head successful checks and private qualification do not substitute for these checks. The previous head became behind when the user-requested #1134 merged; synchronization was pushed immediately after a clean combined merge, rather than deferring publication for other work. No agent canceled a CI run.

This is now the main root of the remaining publication/report chain. #1136 follows by ancestry but is not a prerequisite and must not delay a ready merge. Existing descendants retain their own heads. After merge, verify the first separately deployed immutable snapshot, live digest and current-head PR comments before considering hosted deployment recovery complete. Missing source events and queued legacy definitions still require the separate recovery work described above.

First hosted deployment after merge

Deploy retained site 42394462513 completed successfully from trusted main b8ba80cb615460d00896d219f667082faf2238fb. It pinned retained snapshot 82626619c06e69d43f46da37bd3bfeb1bca285ef; snapshot/staging/upload/deploy, live verification and comment reconciliation all actually succeeded. At 17:06:14 UTC the public benchmark index matched SHA-256 4d55bc2ad1a2387b601b916e75f71d98a5b599fb82ea81d6e892956d10e166df. No manual deployment or source rerun was needed.

The comment reconciler is silent on success. A read-only audit found no benchmark-overview marker comments on the 11 currently open PRs and no newly updated overviews; this does not establish that every current PR has eligible retained preview data. Missing-event ingestion and queued legacy definitions remain separate recovery work, rather than being claimed fixed by the successful deployment.