diff --git a/.github/workflows/observe.yml b/.github/workflows/observe.yml
index 75b9e99..c449955 100644
--- a/.github/workflows/observe.yml
+++ b/.github/workflows/observe.yml
@@ -10,6 +10,9 @@ on:
         required: true
         default: "Bitcoin COVID-19"
 
+permissions:
+  contents: write
+
 jobs:
   observe:
     runs-on: ubuntu-latest
@@ -24,12 +27,24 @@ jobs:
         run: bun install --frozen-lockfile && bun run build
 
       - name: Run refract analysis
+        env:
+          # Via env rather than ${{ }} interpolation, so a page title cannot
+          # break out of the string and become shell.
+          PAGES: ${{ github.event.inputs.pages || 'Bitcoin' }}
         run: |
-          PAGES="${{ github.event.inputs.pages || 'Bitcoin' }}"
+          mkdir -p observations
           for PAGE in $PAGES; do
             echo "=== Observing: $PAGE ==="
-            node packages/cli/dist/src/cli.js analyze "$PAGE" --depth detailed --json \
-              > "observations/${PAGE//\//_}.json" 2>&1
+            # Analysis output goes to a temp file first: folding stderr into the
+            # JSON would commit an error message as though it were an
+            # observation, and a partial write on failure is worse than none.
+            if node packages/cli/dist/src/cli.js analyze "$PAGE" --depth detailed --json \
+              > "$RUNNER_TEMP/observation.json"; then
+              mv "$RUNNER_TEMP/observation.json" "observations/${PAGE//\//_}.json"
+            else
+              echo "::error::analysis failed for $PAGE"
+              exit 1
+            fi
           done
 
       - name: Commit observations
@@ -37,7 +52,7 @@ jobs:
           git config user.name "refract-bot"
           git config user.email "bot@refract-org.github.io"
           git add observations/
-          git diff --quiet && echo "No changes" || {
+          git diff --cached --quiet && echo "No changes" || {
             git commit -m "chore: daily observation $(date -u +%Y-%m-%d)"
             git push
           }
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index cce474c..00f13b6 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -24,15 +24,25 @@ jobs:
 
       - run: bun install --frozen-lockfile
       - run: bun run build
-      - run: bun test || echo "Tests had failures — publishing anyway"
+      - run: bun test
 
       - name: Publish packages
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
-          npm --version
-          # npm 10+ auto-exchanges OIDC token when --provenance is used
+          # Resolve npm from the Node toolchain explicitly. setup-bun puts a
+          # bun-backed `npm` earlier in PATH, and bun's implementation does not
+          # support OIDC token exchange — it fails with
+          # "missing authentication (run `bunx npm login`)", which is what killed
+          # every publish from v0.5.8 to v0.5.11.
+          NPM="$(dirname "$(which node)")/npm"
+          "$NPM" --version
+
           for pkg in packages/evidence-graph packages/ingestion packages/analyzers packages/cli packages/eval; do
-            echo "Publishing $pkg..."
-            cd $pkg
-            npm publish --access public --provenance || npm publish --access public || true
-            cd $OLDPWD
+            echo "::group::Publishing $pkg"
+            # No `|| true`. A failed publish must fail the run: v0.5.12 reported
+            # success while every package 404'd on PUT (npm's response to an
+            # unauthorized write), so the tag looked released and was not.
+            ( cd "$pkg" && "$NPM" publish --access public --provenance )
+            echo "::endgroup::"
           done