Summary

• Add a CHECK_FAILED exit=<n> cmd=<cmd> stdout sentinel for abnormal gstack-update-check failures.
• Preserve existing quiet behavior for up-to-date, snoozed, disabled, and network-unavailable checks.
• Keep telemetry fire-and-forget paths from triggering false CHECK_FAILED output.

Fixes #1974.

Root cause

Skill preambles invoke gstack-update-check with stderr suppressed and || true, so a local script crash was indistinguishable from an up-to-date/no-output result. With set -euo pipefail, state-file write/remove failures could terminate before the remote version was checked.

Verification

• bash -n bin/gstack-update-check
• bun test browse/test/gstack-update-check.test.ts test/skill-validation.test.ts → 369 pass, 0 fail on fork-base branch after cherry-picking the fix
• git diff --check
• bun run gen:skill-docs --dry-run --host claude → fresh
• bun run gen:skill-docs --dry-run --host codex → fresh
• bun run skill:check was attempted; it fails on pre-existing missing/stale optional host outputs (.factory, .kiro, .opencode, .slate, .cursor, .openclaw, .hermes, .gbrain). Claude and Codex generated outputs are fresh.

Autoreview

• Claude subagent review: no blocking findings. One non-blocking test determinism caveat noted for privileged/root runners.
• Codex review pass 1: requested exact preamble-wrapper coverage.
• Added exact two-leg generated preamble wrapper regression test.
• Codex final review: CLEAN: no findings.

Fork note

The branch is based on the current maxpetrusenkoagent/gstack:main fork tip because the fork cannot be server-synced past upstream workflow-file commits without GitHub workflow OAuth scope. The PR diff against garrytan/gstack:main contains only this focused fix.