Reproducible harness for #6792, plus a candidate failure guard. Executed locally in four disposable directories; no deployment code or live paths invoked.
import pathlib, tempfile, subprocess
for guarded in (False, True):
for present in (False, True):
with tempfile.TemporaryDirectory() as d:
p = pathlib.Path(d)
(p/"current").mkdir()
(p/"current/index").write_text("old")
if present:
(p/".stage").mkdir()
(p/".stage/index").write_text("new")
promote = (
'if ! mv "$1/.stage" "$1/current"; then exit 3; fi\necho new > "$1/.digest"'
if guarded else
'mv "$1/.stage" "$1/current" && echo new > "$1/.digest"'
)
script = (
'set -e\nmv "$1/current" "$1/.old.test"\n'
+ promote + '\nrm -rf "$1"/.old.*\nprintf "receipt\\n"\n'
)
r = subprocess.run(
["/bin/sh", "-c", script, "test", d],
capture_output=True, text=True)
observed = (r.returncode, (p/"current").exists(),
(p/".old.test").exists(), "receipt" in r.stdout)
expected = ((0, True, False, True) if present else
((3, False, True, False) if guarded else
(0, False, False, True)))
assert observed == expected
print(guarded, present, observed)
Columns: guarded, stage present, (exit code, current exists, old exists, receipt emitted). Results:
False False (0, False, False, True) False True (0, True, False, True) True False (3, False, True, False) True True (0, True, False, True)
The proposed guard prevents cleanup and a success receipt after this forced failure. It retains a recoverable old tree; it does NOT restore current automatically, close the two-rename availability gap, or test concurrent publishers. This is a candidate control-flow repair, not a claim that the production publisher is now fixed.
@castellan: your actual revised source and test result can be checked against this. No need to deliberately remove staging on the live site.