gowalk-cicd 1.0.126 → 1.0.127

package/action/.daemux-version

@@ -1 +1 @@
-1.0.126
+1.0.127

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.126
+1.0.127

package/android-action/play-upload/owner.cjs

@@ -12,18 +12,39 @@ function evidence(status) {
   return 'release_write_status=error';
 }
 
+// Does the record name THIS run? That one question settles both halves of the
+// protocol -- a claim is won when the answer is yes, released when it is no --
+// and the answer does not depend on which write produced it.
+//
+// Both halves used to demand their OWN revision back from the read that
+// follows their write. GitHub's contents API is read-after-write eventual on a
+// branch ref, so that read can serve the previous blob for a moment, and a
+// write that had already landed then looked like a failure. Foundy run
+// 34345638488 (2026-09-09) released ownership twice -- both commits are on
+// app-robot-play-coordination, both wrote `owner: null` -- and still failed
+// `play_owner_release_unverified`, taking the app's first Play release with it.
+const held = (row, selected) => record.same(row.value.owner, selected.owner);
+
+// Seal owes two things, not one: the record must not name this run, AND no
+// claim write of ours may still be able to land. A record another holder has
+// taken settles both -- their write moved the blob, so a late CAS of ours can
+// only conflict. An UNOWNED record settles only the first, so seal still writes
+// once to move the revision itself, and then accepts any readback that no
+// longer names this run. (That fence used to be a side effect of releasing a
+// record we never held; a lost claim response relies on it.)
+const fenced = (row, selected) => row.value.owner !== null && !held(row, selected);
+
 async function seal(client, selected) {
   let detail = 'release_write_status=none';
   for (let attempt = 0; attempt < 3; attempt++) {
     const row = record.validate(await client.read(selected.path), selected);
-    if (row.value.owner !== null && !record.same(row.value.owner, selected.owner)) return;
+    if (fenced(row, selected)) return;
     const idle = record.replacement(row, null);
     // Reconcile a possibly applied write; keep only its status as evidence.
     try { detail = evidence(await client.write(selected.path, row, idle)); }
     catch { detail = evidence(undefined); }
     const after = record.validate(await client.read(selected.path), selected);
-    if (after.value.revision === idle.revision && after.value.owner === null) return;
-    if (after.value.owner !== null && !record.same(after.value.owner, selected.owner)) return;
+    if (!held(after, selected)) return;
   }
   const failure = new Error('play_owner_release_unverified');
   failure.detail = detail;
@@ -40,6 +61,12 @@ async function acquire(client, selected, attempted = () => {}, waiting = {}) {
   for (let attempt = 0; attempt < 3;) {
     if (waiting.signal?.aborted) throw new Error('play_owner_cancelled');
     const row = record.validate(await client.read(selected.path), selected);
+    // A record already naming THIS run is this run's own claim: the owner id is
+    // a UUID minted once per process, so no other writer can have put it there.
+    // Without this, a claim whose write landed but whose readback lagged came
+    // back on the next pass as a foreign live holder and the run waited out its
+    // own deadline against itself.
+    if (held(row, selected)) return;
     if (row.value.owner !== null) {
       const owner = row.value.owner;
       if (owner.kind !== 'ci' || !record.terminal(await client.run(owner), owner)) {
@@ -55,7 +82,7 @@ async function acquire(client, selected, attempted = () => {}, waiting = {}) {
     attempted();
     try { await client.write(selected.path, row, desired); } catch { /* Only exact readback may adopt it. */ }
     const after = record.validate(await client.read(selected.path), selected);
-    if (after.value.revision === desired.revision && record.same(after.value.owner, selected.owner)) return;
+    if (held(after, selected)) return;
   }
   throw new Error('play_owner_busy');
 }

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.126
+1.0.127

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.126",
+  "version": "1.0.127",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {