@@ -105,6 +105,15 @@ jobs:
         # finds the compiler three ways (in-tree build / PATH / dune exec),
         # so it exercises the same entry point a consumer has.
         run: ./examples/consumers/extension-boundary/build.sh
+      - name: WASM harness instantiation-idiom gate
+        if: ${{ !cancelled() }}
+        # tests/**/*.mjs must not mix the two WebAssembly.instantiate
+        # overloads (Module -> Instance vs BufferSource -> { module, instance }).
+        # A mix-up yields `undefined` and, before the codegen WASM runner was
+        # made fail-late, aborted the harness loop at the first bad file and
+        # silently masked every harness after it (33 of them).
+        # See tools/check-wasm-harness-idioms.sh.
+        run: ./tools/check-wasm-harness-idioms.sh
       - name: Run codegen WASM tests
         run: opam exec -- ./tools/run_codegen_wasm_tests.sh
       - name: Run codegen Bun-ESM tests (historical codegen-deno corpus)
 
@@ -4,9 +4,11 @@ import assert from 'node:assert/strict';
 import { readFile } from 'node:fs/promises';
 
 const buf = await readFile('./tests/codegen/dom_pilot_startup_error.wasm');
-const mod = new WebAssembly.Module(buf);
-const inst = (await WebAssembly.instantiate(mod, {
+// BufferSource overload -> { module, instance }. (Passing a WebAssembly.Module
+// instead resolves to the Instance itself; `.instance` would be undefined.
+// See tools/check-wasm-harness-idioms.mjs.)
+const { instance: inst } = await WebAssembly.instantiate(buf, {
   wasi_snapshot_preview1: { fd_write: () => 0 },
-})).instance;
+});
 assert.equal(inst.exports.main(), 0, 'dom pilot startupError compiled and ran');
 console.log('test_dom_pilot_startup_error.mjs OK');
@@ -4,9 +4,11 @@ import assert from 'node:assert/strict';
 import { readFile } from 'node:fs/promises';
 
 const buf = await readFile('./tests/codegen/dom_pilot_surface.wasm');
-const mod = new WebAssembly.Module(buf);
-const inst = (await WebAssembly.instantiate(mod, {
+// BufferSource overload -> { module, instance }. (Passing a WebAssembly.Module
+// instead resolves to the Instance itself; `.instance` would be undefined.
+// See tools/check-wasm-harness-idioms.mjs.)
+const { instance: inst } = await WebAssembly.instantiate(buf, {
   wasi_snapshot_preview1: { fd_write: () => 0 },
-})).instance;
+});
 assert.equal(inst.exports.main(), 0, 'dom pilot surface compiled and ran');
 console.log('test_dom_pilot_surface.mjs OK');
@@ -51,7 +51,12 @@ const imports = {
   },
 };
 
-inst = (await WebAssembly.instantiate(mod, imports)).instance;
+// `mod` is a WebAssembly.Module (needed above for Module.imports), so the
+// Module overload applies and resolves to the Instance directly — this is
+// NOT the `{ module, instance }` BufferSource shape.
+// See tools/check-wasm-harness-idioms.mjs.
+inst = await WebAssembly.instantiate(mod, imports);
+assert.ok(inst instanceof WebAssembly.Instance, 'instantiate returned an Instance');
 const result = inst.exports.main();
 assert.equal(typeof result, 'number', 'combo ran without trap');
 console.log('test_wasi_fs_combo.mjs OK');
@@ -0,0 +1,111 @@
+// SPDX-License-Identifier: MPL-2.0
+// Guard: the two WebAssembly.instantiate overloads are not interchangeable.
+//
+//   WebAssembly.instantiate(BufferSource, imports) -> { module, instance }
+//   WebAssembly.instantiate(Module,       imports) -> Instance
+//
+// So `.instance` (or `const { instance } = ...`) is correct ONLY for the
+// BufferSource form. Applied to the Module form it is `undefined`, which is
+// how tests/codegen/test_dom_pilot_*.mjs and test_wasi_fs_combo.mjs crashed
+// with `TypeError: Cannot read properties of undefined (reading 'exports')`.
+//
+// Usage: node tools/check-wasm-harness-idioms.mjs [root]   (root defaults to .)
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+
+const ROOT = process.argv[2] ?? '.';
+const MODULE_DECL =
+  /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*new\s+WebAssembly\.Module\s*\(/g;
+
+function* walkMjs(dir) {
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    const p = join(dir, e.name);
+    if (e.isDirectory()) yield* walkMjs(p);
+    else if (e.isFile() && e.name.endsWith('.mjs')) yield p;
+  }
+}
+
+function matchingParen(src, openIdx) {
+  let depth = 0;
+  for (let i = openIdx; i < src.length; i++) {
+    const c = src[i];
+    if (c === '(') depth++;
+    else if (c === ')') {
+      depth--;
+      if (depth === 0) return i;
+    }
+  }
+  return -1;
+}
+
+const lineOf = (src, idx) => src.slice(0, idx).split('\n').length;
+
+const problems = [];
+const scanned = { files: 0, withModule: 0 };
+
+for (const file of walkMjs(join(ROOT, 'tests'))) {
+  scanned.files++;
+  const src = readFileSync(file, 'utf8');
+  const moduleVars = new Set();
+  for (const m of src.matchAll(MODULE_DECL)) moduleVars.add(m[1]);
+  if (moduleVars.size === 0) continue;
+  scanned.withModule++;
+  const rel = relative(ROOT, file).split(sep).join('/');
+
+  for (const v of moduleVars) {
+    const callRe = new RegExp(
+      `WebAssembly\\.instantiate\\(\\s*${v.replace(/\$/g, '\\$')}\\b`,
+      'g',
+    );
+    for (const m of src.matchAll(callRe)) {
+      const openIdx = src.indexOf('(', m.index + 'WebAssembly.instantiate'.length);
+      const closeIdx = matchingParen(src, openIdx);
+      if (closeIdx < 0) continue;
+      const after = src.slice(closeIdx + 1, closeIdx + 40);
+      const line = lineOf(src, m.index);
+      if (/^\s*\)?\s*\.\s*instance\b/.test(after)) {
+        problems.push(
+          `${rel}:${line}: WebAssembly.instantiate(${v}, …) is the Module overload ` +
+            `(resolves to an Instance), so a trailing \`.instance\` is undefined`,
+        );
+        continue;
+      }
+      // Reverse case: destructuring `{ instance }` out of the Module overload.
+      const stmtStart = Math.max(
+        src.lastIndexOf(';', m.index),
+        src.lastIndexOf('\n', m.index),
+        0,
+      );
+      const head = src.slice(stmtStart, m.index);
+      if (/\{\s*instance\s*(?::\s*[\w$]+\s*)?\}\s*=\s*(?:await\s*)?$/.test(head)) {
+        problems.push(
+          `${rel}:${line}: \`const { instance } = await WebAssembly.instantiate(${v}, …)\` ` +
+            `destructures the BufferSource result shape, not the Module one`,
+        );
+      }
+    }
+  }
+}
+
+if (problems.length > 0) {
+  console.error('WASM harness instantiation-idiom gate: FAILED\n');
+  for (const p of problems) console.error('  ' + p);
+  console.error(
+    `\n${problems.length} problem(s) in ${scanned.withModule} module-creating harness(es).` +
+      '\nFix: with a WebAssembly.Module argument, use the returned value directly;' +
+      '\n     with a BufferSource argument, destructure `{ instance }`.' +
+      '\nSee tools/check-wasm-harness-idioms.mjs for the full explanation.',
+  );
+  process.exit(1);
+}
+
+console.log(
+  `WASM harness instantiation-idiom gate: OK ` +
+    `(${scanned.files} harnesses scanned, ${scanned.withModule} create a WebAssembly.Module)`,
+);
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+# Gate: tests/**/*.mjs must not mix up the two WebAssembly.instantiate
+# overloads. Rationale, the exact failure mode it prevents, and the fix
+# recipe live in tools/check-wasm-harness-idioms.mjs.
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+exec node "$ROOT_DIR/tools/check-wasm-harness-idioms.mjs" "$ROOT_DIR"
@@ -11,7 +11,7 @@
 set -uo pipefail
 
 python3 - <<'PY'
-import os, pathlib, subprocess, urllib.parse
+import os, pathlib, re, subprocess, urllib.parse
 
 def annotate(title, text, limit=60000):
     msg = urllib.parse.quote(text[:limit], safe="")
@@ -57,11 +57,50 @@ CASCADE = [
     ("face transformers", ["bash", "tools/run_face_transformer_tests.sh"]),
     ("no-extension-ts", ["bash", "tools/check-no-extension-ts.sh"]),
 ]
+BAD_LINE = re.compile(
+    r"(::error::|AssertionError|TypeError|ReferenceError|SyntaxError"
+    r"|\b[Ee]rror\b|FAIL|FAILED|✗|\bpanic\b|No such file|denied|not allowed)"
+)
+
+
+def digest(text, budget=700):
+    """Dense, capped summary of one cascade step.
+
+    GitHub truncates check-run annotations at ~4096 bytes, so a raw tail of
+    each step's output silently loses every step after the first oversized
+    one (compiler chatter is verbose). Report only the interesting lines.
+    """
+    lines = [l.rstrip() for l in text.splitlines() if l.strip()]
+    picked, seen = [], set()
+    for l in lines:
+        if not BAD_LINE.search(l):
+            continue
+        key = re.sub(r"\d+", "#", l)[:70]
+        if key in seen:
+            continue
+        seen.add(key)
+        picked.append(l)
+        if len(picked) == 5:
+            break
+    # The runner's own failure roll-call (names, not prose).
+    for l in lines:
+        if (l.startswith("  - ") or l.startswith("✗")) and l not in picked:
+            picked.append(l)
+        if len(picked) >= 8:
+            break
+    for l in lines[-2:]:
+        if l not in picked:
+            picked.append(l)
+    body = "\n".join("  ! " + l[:160] for l in picked)
+    return body[:budget] if body else "  (no error-like lines; rc shown above)"
+
+
 out = []
 for label, argv in CASCADE:
     rc, text = run(argv, timeout=900)
-    tail = text.splitlines()[-40:]
-    out.append(f"===== {label}: rc={rc} =====\n" + "\n".join(tail))
+    n = len(text.splitlines())
+    head = f"===== {label}: rc={rc} ({n} lines) ====="
+    out.append(head if rc == 0 else head + "\n" + digest(text))
 body = "\n\n".join(out)
 annotate("diag-cascade", body)
 summary("diag: masked cascade", body)
 
@@ -1,5 +1,15 @@
 #!/usr/bin/env bash
-set -euo pipefail
+# SPDX-License-Identifier: MPL-2.0
+# Compile every tests/codegen/*.affine fixture to wasm, then run every
+# tests/codegen/*.mjs harness against it.
+#
+# Deliberately NOT `set -e`: this runner collects failures and reports all of
+# them. It used to abort at the first failing harness, which meant that from
+# the moment tests/codegen/test_dom_pilot_startup_error.mjs landed, every
+# harness sorting after it (33 of them, up to test_while_loop.mjs) silently
+# stopped executing — a single bug masked a whole verification surface. Fail
+# loudly, fail late, fix in one pass.
+set -uo pipefail
 
 ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 TEST_DIR="$ROOT_DIR/tests/codegen"
@@ -17,19 +27,44 @@ fi
 
 echo "Using compiler: $COMPILER"
 
+compile_failures=()
 for src in "$TEST_DIR"/*.affine; do
   base="${src%.affine}"
   wasm="$base.wasm"
   echo "Compiling $(basename "$src") -> $(basename "$wasm")"
-  "${COMPILE_CMD[@]}" "$src" -o "$wasm"
+  if ! "${COMPILE_CMD[@]}" "$src" -o "$wasm"; then
+    compile_failures+=("$(basename "$src")")
+  fi
 done
 
-echo ""
+if [ "${#compile_failures[@]}" -gt 0 ]; then
+  echo ""
+  echo "::error::${#compile_failures[@]} fixture(s) failed to compile: ${compile_failures[*]}"
+  printf '  - %s\n' "${compile_failures[@]}"
+  exit 1
+fi
 
+echo ""
 echo "Running JS harnesses"
+harness_total=0
+harness_failures=()
 for js in "$TEST_DIR"/*.mjs; do
-  echo "node $(basename "$js")"
-  (cd "$ROOT_DIR" && node "${js#$ROOT_DIR/}")
+  name="$(basename "$js")"
+  harness_total=$((harness_total + 1))
+  echo "node $name"
+  if ! (cd "$ROOT_DIR" && node "${js#"$ROOT_DIR"/}"); then
+    echo "::error file=tests/codegen/$name::JS harness failed"
+    harness_failures+=("$name")
+  fi
 done
 
-echo "All codegen WASM tests passed."
+if [ "${#harness_failures[@]}" -gt 0 ]; then
+  echo ""
+  echo "::error::${#harness_failures[@]} of $harness_total JS harness(es) failed"
+  echo "Failed harnesses (full output above):"
+  printf '  - %s\n' "${harness_failures[@]}"
+  exit 1
+fi
+
+echo ""
+echo "All codegen WASM tests passed ($harness_total JS harnesses)."