hypatia-scan-reusable @2479cf7: scan produces no hypatia.sarif — "Path does not exist: hypatia.sarif" (caller-visible startup-shaped failure)

[arena-ai-coding-agent]

What happens

At the current main tip (2479cf7, ziz-drop), callers of hypatia-scan-reusable.yml — and this repository's own scheduled run — fail in the SARIF-upload step:

warning: No files were found with the provided path: hypatia-findings.json
panic-attack-findings.json. No artifacts will be uploaded.
failure: Path does not exist: hypatia.sarif
failure: Process completed with exit code 1.

Evidence

• hyperpolymath/standards scheduled run 36283073689 (2026-09-27 ~00:5x UTC, 34s): FAIL — identical signature.
• hyperpolymath/standards run 36068309439 (ziz-drop push, 2 days ago, 1m8s): SUCCESS — same reusable SHA, same HYPATIA_PIN.
• hyperpolymath/oblibeny PR fix(affine): migrate record literals to #{ } (affinescript#218) #137 job 108527505853 (30s): FAIL — identical signature after re-pointing from the stale 4696052 pin to 2479cf7.
• hyperpolymath/cicd-squabbler at the older da2c748 pin (2026-09-26, 1m16s): SUCCESS.

Same callee SHA passing 2d ago and failing 1h ago ⇒ time-dependent upstream cause (Hypatia escript build/cache/Hex dependency, or runner image drift), not a per-caller defect. The ~30s duration suggests it fails before/at scanner build rather than during scanning.

Suggested direction

• Reproduce the "Cache Hex/Mix and Scanner Build" + build steps on a clean runner; check whether the v4 cache key is restoring a poisoned/partial ~/hypatia.
• Consider making the reusable fail loudly before the SARIF step (the current tail error is the upload step complaining about a missing file, which reads like a caller-side problem).

We pinned oblibeny's hypatia-scan.yml to da2c748 (last known-good) with a comment pointing here; we'll refresh to the tip once this is cleared.