The previous wrapper used 0 after a command block with set -e, which would exit before reaching the conditional. Stream errors directly to the log and check the fail flag instead. Defense: CI error visibility is part of the gate; a wrapper that swallows its own failure output is a broken wrapper.