feature-factory 0.8.6 → 0.8.7

package/WORKFLOW.md

@@ -177,7 +177,8 @@ reporting anything:
 A park that completes only step 1 is an unreported park with no recovery evidence, which is the state
 this sequence exists to prevent. Verify step 2 the way an outside observer would: qualified status
 reports `park_snapshot` as the published path, or `null` when no snapshot exists. Status reports the path
-only while the snapshot is a complete copy of the live plane by the step 3 inventory and its manifest still
+only while the snapshot is a complete copy of the live plane by the step 3 inventory — `factory.lock`
+excluded, since a heartbeat may land between the copy and the read — and its manifest still
 matches the live one byte for byte, so `null` also covers an interrupted or altered copy and a snapshot
 left by an earlier park: neither is evidence for this park. Publishing again is what makes it correspond.
 
@@ -243,7 +244,12 @@ and "clean up the prior copy" are contradictory instructions once that rename ha
    outside `P`; do not copy slice worktrees or any other part of `S`.
 3. **Verify.** Build source and destination inventories exactly as the completed archive does — every
    entry's relative path, type and mode, a SHA-256 for each regular file, a link target for each symlink,
-   sorted lexically — and require exact equality. An unverified staging tree is never published.
+   sorted lexically — and require exact equality, **excluding the plane-root `factory.lock` only**. That
+   one entry is session liveness rather than run state and is the only thing in the plane designed to
+   change on a timer, so comparing it fails whenever a heartbeat lands between reading the source and
+   reading the copy. The exclusion is that exact path and nothing else: a `factory.lock` anywhere below
+   the plane root is run state and must match. Qualified status excludes the same single path for the same
+   reason. An unverified staging tree is never published.
 4. **Commit.** With no snapshot at the canonical path, rename `.staging-$R` onto it; that rename is the
    commit point. With one present, first rename the canonical snapshot to `.prior-$R`, then rename
    `.staging-$R` onto the canonical path; that second rename is the commit point. If the first rename

package/bin/factory.js

@@ -23,7 +23,7 @@ import { resolveSpawnExecutable } from "../core/executable.js";
 import { dispatchInitPublication } from "./init-publication.js";
 import { CONTROL_PLANE, SCHEMA_VERSION, GATE_NAMES, GATE_STATUSES, MODES, SLICE_STATUSES, STEP_STATUSES, TERMINAL_STATUSES, repositoryRelativePath, validateRun } from "../state/schema.js";
 import {
-  claimSessionLock, inspectSessionLock, refreshSessionLock, releaseSessionLock, SessionLockHeldError,
+  claimSessionLock, inspectSessionLock, refreshSessionLock, releaseSessionLock, SESSION_LOCK_FILE, SessionLockHeldError,
 } from "../state/session-lock.js";
 
 export const COMMANDS = Object.freeze({
@@ -175,6 +175,15 @@ function briefDigestFor(decision, state, runDir) {
 function planeInventory(root) {
   const entries = [];
   const record = (rel, full) => {
+    // The session lock is liveness, not run state, and it is the one entry in the plane designed to change
+    // on a timer. Comparing it made every snapshot invalid within one heartbeat: a live park published a
+    // complete, byte-correct plane and `status` reported `park_snapshot: null` eleven seconds later,
+    // because the copy held `heartbeat_at` 23:28:25 and the plane had moved to 23:28:36. The whole point
+    // of the field was to answer "did the driver publish it", and it answered "no" for a snapshot that was
+    // there -- the same disagree-with-your-own-description defect the 0.8.3 work existed to remove,
+    // reintroduced by the check built to remove it. Every existing test publishes and reads back with no
+    // heartbeat in between, which is why three review rounds and a real park all missed it.
+    if (rel === SESSION_LOCK_FILE) return;
     const stat = lstatSync(full);
     const mode = (stat.mode & 0o7777).toString(8);
     if (stat.isSymbolicLink()) entries.push(`${rel} l ${mode} ${readlinkSync(full)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "feature-factory",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "description": "Durable, observed control plane for /feature runs. Host-agnostic: no opencode dependency.",
   "type": "module",
   "license": "MIT",