fix: a half written record is named for what it is, not called somebody else's - #72

Stability report finding T5. Reproduced on today's tree before fixing.

What was wrong

This tool has two markers for a file it started and did not finish:

Both survive a hard kill. Only the first was recognised, so verify reported our own half written manifest as extra - the word it uses for a file somebody else put in the directory. A person was told their fixtures were polluted by something this tool had written itself.

$ touch out/manifest.json.tfg-writing
$ tfg verify out/manifest.json
  extra     manifest.json.tfg-writing        <- before
  leftover  manifest.json.tfg-writing        <- after

The part worth reading

The argument against this was already written down, and it did not help. From the comment on core.PartialMarker:

A second spelling would mean verify reports our own leftovers as files it knows nothing about, which is what it did until 2026-08-03.

It was written, applied to one marker, and then the other marker arrived with its literal duplicated - an unexported constant in core/replace.go and a bare literal in manifest.go - and no reader taught about either.

So there are two guards, and the second is the one that matters:

• TestAHalfWrittenRecordIsNamedForWhatItIs - the behaviour
• TestEachLeftoverMarkerIsSpelledInOnePlace - the source. This one would have caught the original defect, and the behaviour one would not have caught it coming back.

A written reason is a claim until something can turn red on it.

Two sentences, on purpose

A half written generated file costs nothing - the manifest does not describe it, nothing is missing, delete it.

A half written record is the one case where somebody has to look: the run was saving the list of what it produced, so the directory can hold finished files that nothing lists, and cleanup cannot remove those (untouchable rule 7). It now says that.

A mutation that routes the record through the other sentence is in the set.

Checks

• Three mutations, all caught
• A fourth repointed: staleness.py found the existing audit.go entry had gone stale on the very line this changes
• preflight --quick green on all 12 checks

Not fixed here, and measured rather than assumed

verify still reports a second manifest and that run's files as extra when two runs share a directory through output.manifest - which is what that setting exists to permit. Two runs with different target ids, both exit 0:

$ tfg verify two/a.json
  extra     b.json
  extra     beta_0001.txt
  extra     beta_0002.txt
  extra     beta_0003.txt
exit=7

Four differences, not one. The report (T8) described only the manifest file, so recognising it would fix one of four. What the rest should be is a question about what verify <manifest> means when a directory is shared, which is a contract decision rather than a fix.

🤖 Generated with Claude Code