fix(gate): stop observed release plans from clearing the revision under test

`just release-profile nightly code` ran the complete gate, passed every step
including `source.verify`, and then refused at `confirm-head`:

    tested-head is empty; refusing to publish a revision nothing recorded

Correct refusal, self-inflicted cause. Four contracts in
tests/capsem-release/ run a real release plan against a recording runner to
read back its argv, and `RecordHead` wrote that runner's empty capture over
the running gate's `tested-head`.

This is the same bug as the source state, and this morning's fix for that one
did not reach it. That fix taught the filesystem `Action` subclasses to check
`context.observing`; `RecordHead` writes through the `write_text` helper, which
no `Action` mediates. Claiming the fix covered "every action" was wrong -- it
covered the ones that happened to be actions.

`RecordHead` now checks the same flag as `RecordSourceState`, and the conftest
guard watches the set of files a run records its identity in rather than the
single one that had failed by then. Reverting the fix reds the guard on all
four contracts, by name, in one second -- which is the point: this cost an
hour of gate and one aborted release to find.

Author: ebursztein

CHANGELOG.md

@@ -67,6 +67,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- `release-profile` reached the step before publishing and refused, because
+  `tested-head` was empty: four contracts that run a release plan to read back
+  its argv had overwritten the running gate's record of the revision under
+  test. Same defect as the source state, and the fix for that one did not
+  reach here -- it taught the `Action` subclasses to check whether the plan was
+  being read or run, and `RecordHead` writes through the `write_text` helper
+  instead. The guard has been widened from one file to the set a run records
+  its identity in, so the next instance fails by name in seconds rather than
+  an hour into a release.
+
 - A fresh install materialized one profile's images and reported success. A
   channel's profiles own their images, so the release graph gives each its own
   asset release and the channel pointer can name at most one of them -- but

src/capsem/gate/releasehead.py

@@ -46,6 +46,13 @@ def render(self) -> str:
         return f"record the revision under test in {self._target.name}"
 
     def perform(self, context: Context) -> None:
+        if context.observing:
+            # Reading a release plan is not running one. A contract that runs
+            # the plan to read back its argv would otherwise overwrite the
+            # running gate's `tested-head` with the recording runner's empty
+            # capture, and `confirm-head` -- one step before publishing, an
+            # hour later -- refuses to publish a revision nothing recorded.
+            return
         head = context.runner.capture(["git", "rev-parse", "HEAD"])
         write_text(self._target, head)
         context.journal.note(f"qualifying {head}")

tests/conftest.py

@@ -577,7 +577,16 @@ def pytest_sessionfinish(session, exitstatus):
 # The gate's record of what it is qualifying belongs to the gate
 # ---------------------------------------------------------------------------
 
-_SOURCE_STATE = Path(__file__).resolve().parent.parent / "target/gate-source-state.json"
+_ROOT = Path(__file__).resolve().parent.parent
+#: What a run records about *what it is qualifying*. A suite that overwrites
+#: any of these makes the gate around it publish the wrong thing, or refuse to
+#: publish at all. Guarded as a set rather than one file, because the first
+#: version of this guard watched only the source state and let `tested-head`
+#: be clobbered by the same bug an hour later.
+_RUN_IDENTITY = (
+    _ROOT / "target/gate-source-state.json",
+    _ROOT / "target/release-preflight/tested-head",
+)
 
 
 @pytest.fixture(autouse=True)
@@ -596,17 +605,20 @@ def _the_running_gate_keeps_its_own_source_state(request):
     it. Whoever does this next finds out here instead, and the run survives:
     the file is put back before the failure propagates.
     """
-    before = _SOURCE_STATE.read_bytes() if _SOURCE_STATE.exists() else None
+    read = lambda path: path.read_bytes() if path.exists() else None  # noqa: E731
+    before = {path: read(path) for path in _RUN_IDENTITY}
     yield
-    after = _SOURCE_STATE.read_bytes() if _SOURCE_STATE.exists() else None
-    if after == before:
-        return
-    if before is None:
-        _SOURCE_STATE.unlink(missing_ok=True)
-    else:
-        _SOURCE_STATE.write_bytes(before)
-    raise AssertionError(
-        f"{request.node.nodeid} rewrote {_SOURCE_STATE.name}, which belongs to the "
-        f"gate running this suite. It wrote {after!r}. A test that runs a real "
-        "plan to read it must pass observing=True; see tests/helpers/gate.py."
-    )
+    for path, original in before.items():
+        after = read(path)
+        if after == original:
+            continue
+        if original is None:
+            path.unlink(missing_ok=True)
+        else:
+            path.write_bytes(original)
+        raise AssertionError(
+            f"{request.node.nodeid} rewrote {path.name}, which belongs to the "
+            f"gate running this suite. It wrote {after!r}. A test that runs a "
+            "real plan to read it must pass observing=True; see "
+            "tests/helpers/gate.py."
+        )