builtin:red-skills reports ok after four failed sub-steps, including two non-zero exits

[filipeforattini]

Observed on red-dev 1.0.50. This is the defect that made #229 and #230 invisible: the run said everything was fine.

Evidence

Verbatim from ~/.local/state/red-dev/2026-08-19T15-24-31-084-install-core.log:

info converge red-skills — a managed item, so the provider decides what changes — via builtin:red-skills
:: builtin: red-skills
skip red-skills already wired into claude, codex, redcode
:: claude: refreshing red-skills against red-skills
✔ Successfully updated marketplace: red-skills
Checking for updates for plugin "dev@red-skills" at user scope…
✘ Failed to update plugin "dev@red-skills": Plugin source not found at ~/.red-skills/current/plugins/dev
warn claude: claude plugin update dev@red-skills exited 1
:: codex: refreshing red-skills against red-skills
Error: marketplace `red-skills` is not configured as a Git marketplace
warn codex: codex plugin marketplace upgrade red-skills exited 1
:: opencode: refreshing red-skills against red-skills
warn opencode: .../scripts/install-opencode.sh could not be run: EACCES: permission denied, posix_spawn
:: redcode: refreshing red-skills against red-skills
warn redcode: .../scripts/install-opencode.sh could not be run: EACCES: permission denied, posix_spawn
 ok  red-skills applied in 2.3s
[43/46] red-skills             builtin:red-skills           applied   2286ms

Four sub-steps failed — two with a non-zero exit, two with EACCES — and the item is counted applied. The run summary said "converged, except one item waiting for rights", naming only ssh-server. Every host this step exists to wire was left unwired, and the summary a person reads says the opposite.

Three separate things here

1. Failures are downgraded to warnings and dropped. warn ... exited 1 should not resolve to ok. Either the sub-step is required (fail the item) or optional (say so, and say which hosts were skipped and why).
2. EACCES on scripts/install-opencode.sh. The composed set restores script modes (restoreScriptModes in copyTree); the raw mise tree that current pointed at does not, so the executable bit is absent. Any path that can become current needs the same treatment — or the step should invoke the script through its interpreter instead of posix_spawning it.
3. codex: marketplace is not configured as a Git marketplace looks like a genuine incompatibility between a directory-source marketplace and codex plugin marketplace upgrade, worth its own decision — but today it is invisible because it is folded into the same swallowed warning.

Expected

An item that could not do its work does not report ok. grep failed over a transcript is documented as the whole technique for finding what went wrong; that only holds if failures are recorded as failures.

Related

• Two owners write ~/.red-skills/current, and the standalone installer's target has no plugins/ #229, A converge never checks that ~/.red-skills/current resolves to the recorded active set #230 — what the swallowed failures were hiding.
• Spec Spec: one local RedSkills package set for the complete workstation #201.