Full codebase analysis: fail-loud pass + low-hanging correctness fixes

[mostlymaxi]

What

Two commits from a full review of all four crates, CI, and release plumbing. The complete findings document lives in #91 (kept out of the tree per review); the actionable remainder is tracked in #87 (fan-out re-tagging), #88 (hook type-checking), #89 (release hardening), #90 (validation/cleanup batch).

1. Fail loud on silent collision and misuse paths:

• Typed Collector::enter (TypeId per Argo name): two different fns mapping to one template name panic at emit — previously one template silently won and both call sites dispatched to it.
• Duplicate same-named #[fragment]s / PVC types with differing contents panic in BuildCtx::collect (bare-name registries silently last-won; fragments carry secret! declarations, so this was not just "extra mounts").
• resolved_secrets: required-wins optionality merge, plus a panic when distinct (name, key) pairs flatten to one ATHENA_SEC_* env var — reproduced with ("a.b","k") vs ("a-b","k") both emitting ATHENA_SEC_A_B__K, one silently shadowing the other in-pod. (Host mounts are immune — they key by hash.) munge doc updated to state the lossy-flattening limitation.
• artifact_ident collisions (a.b vs a-b) and unregistered-PVC lookups panic at emit instead of emitting broken templates that fail far away in-pod.
• #[inject] misuse is a spanned compile error: malformed bodies (previously silently demoted the arg to a normal parameter), Artifact<..> args (silently dropped), and non-trailing inject args — positional wiring handed the caller's values to the wrong inputs; compiled clean, broke at submit. CONTAINER.md updated ("allowed anywhere" → trailing-only).
• host!/load_artifact*! surplus args hit the compile_error! gate instead of being silently dropped.
• CLI: missing/malformed athena.toml is a clean exit-2 error on every consumer command instead of a panic — including doctor, which used to panic on the very config it diagnoses (now a red check). cargo metadata failures pass through cargo's stderr; emit --out I/O errors die cleanly; --node-selector validates before any cluster write; forced --update re-applies are labeled forced; live-spec parse failures are logged instead of silently reading as drift.
• Dead code removed (Collector::add_builder, doctor's missing vec); the host_nested_in_macro fixture no longer pins toolchain-dependent rustc notes (it drifted on stable 1.97).

2. Low-hanging correctness bugs:

• emulate no longer uploads output artifacts (or prints the return) from a failed container run — the S3 keys are the same ones deployed workflows read, so a crash's partial outputs clobbered live data.
• init's "Next:" hint suggested submit <name>-pipeline -y, which passes the template name as the BINARY positional and can't work.
• retry(limit = N) no longer wraps u32→i32 to a negative limit; char literals JSON-encode their value ('a' shipped as "'a'" and failed the in-pod decode); byte/byte-string literals get a spanned error.
• Mid-body return in a #[workflow] is a spanned error — trailing statements still ran as DAG tasks and a later return overwrote the output task (last-wins, the opposite of Rust).
• UTF-8-safe truncation in the arg-preview error path.

Testing

Five new core unit tests (enter/secret/artifact guards), eight new trybuild fixtures, full cargo test --workspace + clippy clean. The importing-example golden caught (and I fixed) a regression in my first cut of the surplus-arg check — the layered test architecture works.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AzynLVNz1o2QJY14PkTGCq