woods 2.0.1 → 2.1.0

data/lib/woods/watch/catch_up.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+require 'woods/generation'
+require 'woods/source_inputs/manifest'
+require 'woods/source_inputs/scanner'
+require 'woods/watch/tree_scan'
+
+module Woods
+  module Watch
+    # Generation-bound startup evidence. Publication time is too late: an edit
+    # can land after capture, or even after final verification, before the marker.
+    class CatchUp
+      DIRTY_REASONS = %w[source_changed_during_extraction source_changed_during_read].freeze
+
+      def initialize(root:, output_dir:, ignored:)
+        @root = root
+        @output = output_dir
+        @ignored = ignored
+        @generation = Generation.new(output_dir: output_dir)
+        @marker = @generation.current
+        @manifest = read_manifest
+        report_unavailable if @manifest&.unavailable?
+      end
+
+      # A full run records the missing boundary even when incremental discovery
+      # would find no units to change (and therefore publish no new generation).
+      def rebuild?
+        @marker.number.positive? && @manifest.nil?
+      end
+
+      def paths
+        files = TreeScan.files(root: @root, ignored: @ignored)
+        return files unless @manifest
+
+        candidates = files.select { |path| recent?(path) } | dirty_paths
+        return [] if candidates.empty?
+
+        current = current_identities
+        return [] if captured_tree_matches?(current)
+
+        expected = recorded_identities
+        candidates.reject { |path| covered?(path, current, expected) }
+      end
+
+      private
+
+      def report_unavailable
+        evidence = @manifest.data.fetch('unavailable')
+        warn "[Woods] Watch source freshness unavailable: #{evidence.fetch('reason')}; " \
+             "#{evidence.fetch('size_bytes')} bytes; limit #{evidence.fetch('limit_bytes')}. " \
+             'Continuing source-change catch-up without a freshness comparison ledger.'
+      end
+
+      def captured_tree_matches?(current)
+        @manifest.unavailable? && @current_complete &&
+          @manifest.data['capture_sha256'] == SourceInputs::Manifest.capture_digest(current)
+      end
+
+      def covered?(path, current, expected)
+        relative = path.delete_prefix("#{@root}/")
+        identities = expected[relative]
+        identities && current[relative] && identities.all? { |identity| identity == current[relative] }
+      end
+
+      def read_manifest
+        payload = @generation.payload_dir(@marker)
+        return nil if @marker.payload && payload == @generation.root
+
+        manifest = load_manifest(payload)
+        data = manifest.data
+        return nil unless matching_manifest?(data)
+
+        @key = SourceInputs::PrivateKey.new(output_dir: @output)
+        @scopes = SourceInputs::Scopes.new(extra_roots: data.fetch('extra_roots'))
+        return nil unless @key.identifier == data['key_id'] && @scopes.fingerprint == data['rules']
+
+        manifest
+      rescue SourceInputs::Manifest::Invalid, SourceInputs::PrivateKey::Unavailable, SystemCallError, IOError, TypeError
+        nil
+      end
+
+      def matching_manifest?(data)
+        data['root'] == @root && data['generation'] == @marker.number &&
+          data['captured_at'] && data['captured_at'] <= Time.now.to_f
+      end
+
+      def load_manifest(payload)
+        flags = File::RDONLY | File::NONBLOCK
+        flags |= File::NOFOLLOW if defined?(File::NOFOLLOW)
+        File.open(payload.join(SourceInputs::Manifest::FILE_NAME), flags) do |file|
+          unless file.stat.file? && file.stat.size <= SourceInputs::Manifest::MAX_BYTES
+            raise SourceInputs::Manifest::Invalid, 'invalid_source_manifest'
+          end
+
+          SourceInputs::Manifest.parse(file.read(SourceInputs::Manifest::MAX_BYTES + 1))
+        end
+      end
+
+      def recent?(path)
+        # Filesystems may record only whole seconds. Include the entire capture
+        # second; content comparison below prevents unchanged files repeating.
+        File.mtime(path).to_f >= @manifest.data.fetch('captured_at').floor
+      rescue SystemCallError
+        false
+      end
+
+      def dirty_paths
+        @manifest.data.fetch('errors').filter_map do |error|
+          next unless DIRTY_REASONS.include?(error['reason'])
+
+          path = error['path']
+          next unless relative_path?(path)
+
+          File.join(@root, path)
+        end
+      end
+
+      def relative_path?(path)
+        path.is_a?(String) && !path.empty? && !path.start_with?('/') && !path.include?("\0") &&
+          path.split('/', -1).none? { |part| ['', '.', '..'].include?(part) }
+      end
+
+      def recorded_identities
+        @manifest.expanded.each_value.with_object({}) do |paths, result|
+          paths.each { |path, identity| (result[path] ||= []) << identity }
+        end
+      end
+
+      def current_identities
+        snapshot = SourceInputs::Scanner.new(root: @root, output_dir: @output, key: @key, scopes: @scopes).call
+        @current_complete = snapshot['complete']
+        snapshot.fetch('files')
+      rescue SystemCallError, IOError
+        {}
+      end
+    end
+  end
+end

data/lib/woods/watch/claim_lease.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'securerandom'
+
+module Woods
+  module Watch
+    # The daemon, not its launcher, holds this descriptor for its whole run.
+    # Sidecar inodes are permanent: unlinking a locked file defeats flock.
+    class ClaimLease
+      class Unavailable < StandardError; end
+      CLAIM = 'watch_claim.json'
+      MAX_BYTES = 4096
+
+      attr_reader :token
+
+      # @param index [String] existing index directory
+      def initialize(index)
+        @index = File.realpath(index)
+        @token = SecureRandom.hex(32)
+      end
+
+      # @yield while serialized with daemon claim creation and retirement
+      def coordinate
+        lock = open_lock("#{CLAIM}.lock", create: true)
+        yield
+      ensure
+        lock&.close
+      end
+
+      # @param create [Boolean] only a new daemon can create the permanent lease
+      # @return [void]
+      def acquire(create: true)
+        @lease = open_lock("#{CLAIM}.lease", create: create)
+      end
+
+      # @return [Hash] identity bound to this exact locked inode
+      def fields
+        stat = @lease.stat
+        { lease_version: 1, token: token, lease_device: stat.dev, lease_inode: stat.ino }
+      end
+
+      def close
+        @lease&.close
+        @lease = nil
+      end
+
+      # @return [String] bounded regular claim bytes, without following links
+      def snapshot
+        read_claim
+      end
+
+      # Refuse legacy records and re-check the selected claim while holding both
+      # locks. Neither host names nor claim ages authorize this operation.
+      # @param token [String] exact claim token selected by the operator
+      # @return [void]
+      def recover(token:)
+        raise Unavailable, 'claim token must be 64 hexadecimal characters' unless valid_token?(token)
+
+        coordinate do
+          snapshot = read_claim
+          record = validate_claim(snapshot, token)
+          acquire(create: false)
+          verify_lease(record)
+          raise Unavailable, 'claim changed during recovery; inspect its current owner' unless read_claim == snapshot
+
+          File.unlink(File.join(@index, CLAIM))
+        end
+      ensure
+        close
+      end
+
+      private
+
+      # @param name [String] fixed sidecar basename
+      # @param create [Boolean] permit initial creation
+      # @return [File] locked descriptor; never blocks on a live owner
+      def open_lock(name, create:)
+        flags = File::RDWR | File::NONBLOCK
+        flags |= File::CREAT if create
+        flags |= File::NOFOLLOW if defined?(File::NOFOLLOW)
+        path = File.join(@index, name)
+        file = File.open(path, flags, 0o600) # rubocop:disable Style/FileOpen -- descriptor lifetime is ownership
+        verify_regular_path(file, path)
+        unless file.flock(File::LOCK_EX | File::LOCK_NB)
+          label = name.end_with?('.lease') ? 'owner lease is held' : 'claim coordination is busy'
+          raise Unavailable, "#{label}; stop the owner through its supervisor and retry"
+        end
+        verify_regular_path(file, path)
+        file
+      rescue StandardError
+        file&.close
+        raise
+      end
+
+      # @param file [File] opened sidecar
+      # @param path [String] unchanged regular path on disk
+      def verify_regular_path(file, path)
+        opened = file.stat
+        current = File.lstat(path)
+        return if opened.file? && current.file? && [opened.dev, opened.ino] == [current.dev, current.ino]
+
+        raise Unavailable, 'claim sidecar must be an unchanged regular file; do not replace lock files'
+      end
+
+      def read_claim
+        path = File.join(@index, CLAIM)
+        flags = File::RDONLY | File::NONBLOCK
+        flags |= File::NOFOLLOW if defined?(File::NOFOLLOW)
+        File.open(path, flags) do |file|
+          verify_regular_path(file, path)
+          bytes = file.read(MAX_BYTES + 1)
+          raise Unavailable, 'claim exceeds the recovery size limit' if bytes.bytesize > MAX_BYTES
+
+          bytes
+        end
+      end
+
+      def validate_claim(snapshot, token)
+        record = JSON.parse(snapshot)
+        unless valid_record?(record)
+          raise Unavailable, 'legacy or unverifiable claim; use the documented legacy recovery procedure'
+        end
+        unless record['token'] == token
+          raise Unavailable, 'claim token changed; inspect the current owner before retrying'
+        end
+
+        record
+      rescue JSON::ParserError
+        raise Unavailable, 'legacy or unverifiable claim; use the documented legacy recovery procedure'
+      end
+
+      def valid_record?(record)
+        record.is_a?(Hash) && record['lease_version'] == 1 && valid_token?(record['token']) &&
+          record['pid'].is_a?(Integer) && record['pid'].positive? && record['host'].is_a?(String)
+      end
+
+      def verify_lease(record)
+        stat = @lease.stat
+        return if record['lease_device'] == stat.dev && record['lease_inode'] == stat.ino
+
+        raise Unavailable, 'owner lease inode changed; ownership cannot be verified'
+      end
+
+      def valid_token?(value)
+        value.is_a?(String) && value.match?(/\A[a-f0-9]{64}\z/)
+      end
+    end
+  end
+end

data/lib/woods/watch/cli.rb

@@ -2,6 +2,7 @@
 
 require 'optparse'
 require_relative 'supervisor'
+require_relative 'claim_lease'
 
 module Woods
   module Watch
@@ -17,12 +18,13 @@ module Woods
       def run(argv)
         options, command = parse(argv.dup)
         return 0 if @help
+        return recover_claim(options, command) if @recovery_index || @claim_token
 
         validate_platform!
         validate_command!(command, options[:root])
         supervisor = Supervisor.new(command: command, logger: @output, **options)
         with_signals(supervisor) { supervisor.run }
-      rescue OptionParser::ParseError, ArgumentError, SystemCallError => e
+      rescue OptionParser::ParseError, ArgumentError, SystemCallError, ClaimLease::Unavailable => e
         @output.puts("[woods-watch] #{e.message}")
         2
       end
@@ -31,6 +33,7 @@ module Woods
 
       def parse(argv)
         @help = false
+        @recovery_index = @claim_token = nil
         options = { root: Dir.pwd, boot_timeout: 300, shutdown_timeout: 10 }
         parser = OptionParser.new do |flags|
           flags.banner = 'Usage: woods-watch [options] -- [bin/rails woods:watch]'
@@ -43,11 +46,32 @@ module Woods
           flags.on('--shutdown-timeout SECONDS', 'Graceful shutdown limit (default: 10)') do |value|
             options[:shutdown_timeout] = positive_seconds(value)
           end
+          recovery_options(flags)
           flags.on('-h', '--help', 'Show help without booting Rails') { @help = true }
         end
         parser.order!(argv)
         @output.puts(parser) if @help
-        [options, argv.empty? ? ['bin/rails', 'woods:watch'] : argv]
+        [options, argv.empty? && !@recovery_index && !@claim_token ? ['bin/rails', 'woods:watch'] : argv]
+      end
+
+      def recovery_options(flags)
+        flags.on('--recover-claim INDEX', 'Recover an abandoned managed claim; requires --claim-token') do |path|
+          @recovery_index = path
+        end
+        flags.on('--claim-token TOKEN', 'Exact claim token; never overrides a live owner lease') do |token|
+          @claim_token = token
+        end
+      end
+
+      def recover_claim(options, command)
+        unless @recovery_index && @claim_token && command.empty?
+          raise ArgumentError, 'use --recover-claim INDEX --claim-token TOKEN without a child command'
+        end
+
+        index = File.expand_path(@recovery_index, options[:root])
+        ClaimLease.new(index).recover(token: @claim_token)
+        @output.puts("[woods-watch] recovered the selected abandoned claim at #{index}; restart its normal owner")
+        0
       end
 
       def positive_seconds(value)

data/lib/woods/watch/daemon.rb

@@ -10,6 +10,8 @@ require_relative 'status'
 require_relative 'tree_scan'
 require_relative 'watcher'
 require_relative 'boot_snapshot'
+require_relative 'catch_up'
+require_relative 'claim_lease'
 require 'json'
 require 'set'
 require 'securerandom'
@@ -110,7 +112,7 @@ module Woods
       # daemons that both pass {#another_daemon_alive?} before either has
       # published a status record would otherwise both proceed. See
       # {#claim_startup?}.
-      CLAIM_FILENAME = 'watch_claim.json'
+      CLAIM_FILENAME = ClaimLease::CLAIM
 
       # A daemon cycle is milliseconds; a manual full extraction is seconds to
       # minutes. This bounds how long a crashed writer can block the daemon.
@@ -423,7 +425,7 @@ module Woods
         paths = paths.reject { |path| startup_covered?(path) } if startup
         relative = ChangeSet.new(paths: paths, root: @root).relative_paths
         action = @policy.classify_all(relative)
-        action = :reextract if action == :ignore && @startup_full
+        action = :reextract if action == :ignore && reconciliation_required?
         return :restart if action == :reload && !@reloader.enabled?
 
         action
@@ -448,6 +450,7 @@ module Woods
         @startup_paths = Set.new
         @live_paths = Set.new
         @startup_full = false
+        @reconciliation_pending = false
         @pending_mutex = Mutex.new
         @stop_reason = nil
         @drain_mutex = Mutex.new
@@ -492,7 +495,12 @@ module Woods
       end
 
       def carry_forward(change_set)
-        @pending_mutex.synchronize { @pending.merge(change_set.absolute_paths) }
+        @pending_mutex.synchronize do
+          @pending.merge(change_set.absolute_paths)
+          # Deletion-only startup intentionally names no paths: its bounded
+          # sweep must not treat nominal framework paths as deleted sources.
+          @reconciliation_pending = true if change_set.empty?
+        end
       end
 
       # Run cycles until the pending set is empty. One call per watcher batch;
@@ -542,7 +550,11 @@ module Woods
       end
 
       def pending_empty?
-        @pending_mutex.synchronize { @pending.empty? }
+        @pending_mutex.synchronize { @pending.empty? && !@reconciliation_pending }
+      end
+
+      def reconciliation_required?
+        @pending_mutex.synchronize { @startup_full || @reconciliation_pending }
       end
 
       # Only a drained startup boundary (or a later recovery) can establish
@@ -613,24 +625,22 @@ module Woods
 
       # Reconcile changes that predate this daemon.
       #
-      # The generation file is rewritten as the last act of every successful
-      # extraction, so its mtime is "when this index was last known good".
-      # Anything modified since is uncovered, whoever made the change and
-      # whether or not a daemon was watching at the time. With no generation
-      # file at all there is no index, and every file is uncovered — which the
-      # storm threshold correctly turns into one full extraction.
+      # Capture precedes publication. CatchUp keeps edits in that interval
+      # visible, including those after the final source-verification scan.
       #
       # @return [void]
       def catch_up
         return unless @catch_up
 
         carried = restore_pending
-        paths = (uncovered_paths + carried + vanished_restart_paths).uniq
+        scan = catch_up_scan
+        paths = (scan.paths + carried + vanished_restart_paths).uniq
         boot_changes = @boot_snapshot ? @boot_snapshot.changed_paths : []
         enqueue(boot_changes) unless boot_changes.empty?
-        prepare_startup_reconciliation(paths)
+        prepare_startup_reconciliation(paths, rebuild: scan.rebuild?)
         paths |= boot_changes
         if paths.empty?
+          return extract(ChangeSet.new(paths: [], root: @root)) if @startup_full
           return reconcile_deletions if stale_deletions?
 
           return @logger.info('[Woods] watch: index is current at startup')
@@ -641,7 +651,8 @@ module Woods
         drain
       end
 
-      def prepare_startup_reconciliation(paths)
+      def prepare_startup_reconciliation(paths, rebuild: false)
+        @startup_full = rebuild
         return unless @boot_snapshot
 
         restart_paths = paths.select do |path|
@@ -650,7 +661,7 @@ module Woods
         end
         @pending_mutex.synchronize do
           @startup_paths.merge(restart_paths)
-          @startup_full = restart_paths.any?
+          @startup_full ||= restart_paths.any?
         end
       end
 
@@ -721,38 +732,11 @@ module Woods
       end
 
       def uncovered_paths
-        watermark = index_watermark
-        TreeScan.files(root: @root, ignored: ignored_directories)
-                .select { |path| uncovered?(path, watermark) }
+        catch_up_scan.paths
       end
 
-      def uncovered?(path, watermark)
-        return true if watermark.nil?
-
-        File.mtime(path).to_f > watermark
-      rescue SystemCallError
-        false
-      end
-
-      # When this index was last known good, or nil when there is no usable
-      # index — which the storm threshold turns into one full extraction.
-      #
-      # A dangling payload pointer counts as "no index" (INF-10). The marker
-      # can outlive the directory it names (a partial restore from a CI
-      # artifact, an external cleanup targeting the large directories), and
-      # {Generation#payload_dir} deliberately degrades to the index root for
-      # *readers* — so a gutted index would otherwise read "current at
-      # startup", publish `running`, and have every caller stand down over a
-      # directory holding no index at all. "Alive means covered" is the
-      # daemon's contract; here it would have been false.
-      #
-      # @return [Float, nil]
-      def index_watermark
-        return nil if dangling_payload_pointer?
-
-        File.mtime(@generation.path).to_f
-      rescue SystemCallError
-        nil
+      def catch_up_scan
+        CatchUp.new(root: @root, output_dir: @output_dir, ignored: ignored_directories)
       end
 
       # @return [Boolean] true when the marker names a payload directory that
@@ -1018,6 +1002,7 @@ module Woods
                   else
                     extractor.extract_changed(change_set.absolute_paths)
                   end
+        extractor.raise_on_publication_failure! if extractor.respond_to?(:raise_on_publication_failure!)
 
         action = full ? :full : :incremental
         return unpublished(action, change_set, started) if wrote_without_publishing?(touched, before)
@@ -1037,7 +1022,7 @@ module Woods
 
       def full_extraction?(change_set)
         if @startup_full
-          @logger.info('[Woods] watch: environment boot covers startup changes — full extraction')
+          @logger.info('[Woods] watch: startup coverage requires full extraction')
           return true
         end
 
@@ -1050,6 +1035,7 @@ module Woods
 
       def finish_extraction(action, change_set, touched, started)
         result = publish(action, change_set, touched, started)
+        @pending_mutex.synchronize { @reconciliation_pending = false }
         if action == :full
           @startup_full = false
           @pending_mutex.synchronize { @startup_paths.clear }
@@ -1071,8 +1057,10 @@ module Woods
       # previous index while the daemon says `running`. Not raising was right;
       # not noticing was not.
       #
-      # A no-op incremental deliberately does not bump, so this only fires when
-      # units were actually written.
+      # The extractor's explicit publication-error check above also covers
+      # payload changes with no touched units, such as withdrawing flows. Keep
+      # this fallback for injected extractors without that reporting method.
+      # A genuine no-op deliberately does not bump.
       def wrote_without_publishing?(touched, before)
         return false if touched != :all && Array(touched).empty?
 
@@ -1188,7 +1176,31 @@ module Woods
       def claim_startup?
         return true if ENV['WOODS_IGNORE_WATCH'] == '1' && !@conservative_claims
 
+        prepare_claim_lease if @conservative_claims
+        acquire_startup_claim
+      rescue ClaimLease::Unavailable, SystemCallError => e
+        raise unless @conservative_claims
+
+        @logger.warn("[Woods] watch: managed claim unavailable: #{e.message}")
+        false
+      ensure
+        close_unclaimed_lease
+      end
+
+      def close_unclaimed_lease
+        return if @claimed
+
+        @claim_lease&.close
+      end
+
+      def prepare_claim_lease
+        FileUtils.mkdir_p(@output_dir)
+        @claim_lease = ClaimLease.new(@output_dir)
+      end
+
+      def acquire_startup_claim
         with_claim_lock do
+          @claim_lease&.acquire
           3.times do
             return true if create_claim
             return false unless reclaim_if_stale
@@ -1203,11 +1215,13 @@ module Woods
       # pauses, B deletes S and publishes its live claim, A resumes and
       # unlinks B's claim, and both return as owners. An `flock` on a
       # sidecar file makes the whole loop one critical section; the kernel
-      # releases it if the holder dies. Where the filesystem refuses the
-      # lock (some network mounts) the loop runs unserialized, as before.
-      def with_claim_lock
+      # releases it if the holder dies. Managed startup refuses unavailable
+      # locks; raw startup retains its earlier unserialized fallback.
+      def with_claim_lock(&block)
+        return @claim_lease.coordinate(&block) if @claim_lease
+
         lock = open_claim_lock
-        yield
+        block.call
       ensure
         lock&.close
       end
@@ -1243,7 +1257,7 @@ module Woods
       # race this method exists to close.
       def create_claim
         FileUtils.mkdir_p(@output_dir)
-        content = JSON.generate(pid: Process.pid, host: Status.host_identity)
+        content = JSON.generate(pid: Process.pid, host: Status.host_identity, **(@claim_lease&.fields || {}))
         tmp_path = "#{claim_path}.tmp.#{Process.pid}.#{SecureRandom.hex(4)}"
         File.write(tmp_path, content)
         begin
@@ -1303,7 +1317,7 @@ module Woods
       # @return [String, nil] the claim file's current bytes, or nil if it
       #   doesn't exist
       def claim_bytes
-        File.read(claim_path)
+        @claim_lease ? @claim_lease.snapshot : File.read(claim_path)
       rescue Errno::ENOENT
         nil
       end
@@ -1313,12 +1327,12 @@ module Woods
       #   or already-vanished claim counts as stale too, since it cannot be a
       #   live daemon's claim
       def stale_claim?
-        record = JSON.parse(File.read(claim_path))
+        record = JSON.parse(claim_bytes)
         return false if @conservative_claims && !verifiable_managed_claim?(record)
         return true unless same_claim_host?(record['host'])
 
         !claim_pid_alive?(record['pid'])
-      rescue JSON::ParserError, SystemCallError
+      rescue JSON::ParserError, SystemCallError, TypeError
         !@conservative_claims
       end
 
@@ -1374,18 +1388,25 @@ module Woods
       def release_claim
         return unless @claimed
 
-        FileUtils.rm_f(claim_path) if own_claim?
+        if @claim_lease
+          @claim_lease.coordinate { FileUtils.rm_f(claim_path) if own_claim? }
+        elsif own_claim?
+          FileUtils.rm_f(claim_path)
+        end
+      ensure
+        @claim_lease&.close
         @claimed = false
       end
 
       # @return [Boolean] whether the claim on disk still records this process
       def own_claim?
-        record = JSON.parse(File.read(claim_path))
+        record = JSON.parse(claim_bytes)
+        return record.is_a?(Hash) && record['token'] == @claim_lease.token if @claim_lease
         return true unless record.is_a?(Hash)
 
         record['pid'] == Process.pid && same_claim_host?(record['host'])
-      rescue JSON::ParserError, SystemCallError
-        true
+      rescue JSON::ParserError, SystemCallError, TypeError, ClaimLease::Unavailable
+        !@claim_lease
       end
 
       def claim_path

data/lib/woods/watch/installation/options.rb

@@ -92,7 +92,7 @@ module Woods
 
         def validate_idle!
           value = @environment['WOODS_WATCH_IDLE_TIMEOUT']
-          return if mode == 'external' || value.nil? || value.empty?
+          return if mode == 'external' || value.to_s.strip.empty?
 
           raise Conflict, 'Unset WOODS_WATCH_IDLE_TIMEOUT; managed maintenance needs a resident child'
         end

data/lib/woods/watch/installation/receipt.rb

@@ -26,7 +26,12 @@ module Woods
         # @param expected [Hash] prior content fingerprint and mode
         # @return [void]
         def self.verify_file!(document, expected)
-          return if document.fingerprint == expected
+          actual = document.fingerprint
+          # Git records the owner's executable bit, not the checkout's umask.
+          # Plan snapshots separately retain exact modes for preview/apply drift.
+          same_content = actual.slice('sha256', 'exists') == expected.slice('sha256', 'exists')
+          same_executable = (actual.fetch('mode') & 0o100) == (expected.fetch('mode') & 0o100)
+          return if same_content && same_executable
 
           raise Conflict, "Owned watcher file was edited or removed: #{document.path}"
         end

data/lib/woods/watch/managed_child.rb

@@ -26,7 +26,7 @@ module Woods
         descriptor, launcher, attempt = values
         validate_environment!(descriptor, [launcher, attempt])
 
-        unless env['WOODS_WATCH_IDLE_TIMEOUT'].to_s.empty?
+        unless env['WOODS_WATCH_IDLE_TIMEOUT'].to_s.strip.empty?
           raise ArgumentError, 'WOODS_WATCH_IDLE_TIMEOUT must be unset for managed watching'
         end