runner: never embed a fossil screenshot from a collided run dir (#45)

runner/harness/results.py

@@ -27,6 +27,7 @@ from __future__ import annotations
 
 import json
 import os
+import shutil
 import xml.etree.ElementTree as ET
 
 from . import level as level_mod
@@ -35,6 +36,17 @@ from . import level as level_mod
 # The dashboard serves these read-only at /runs/<run_id>/... (U0.4). Overridable for tests.
 RUNS_DIR_DEFAULT = "/var/lib/cc-ci-runs"
 
+# The artifact files/dirs a run OWNS in its run dir (written fresh every run).
+_OWNED_ARTIFACTS = (
+    "results.json",
+    "summary.html",
+    "summary.png",
+    "badge.svg",
+    "lint.txt",
+    "screenshot.png",
+    "junit",
+)
+
 
 def runs_dir() -> str:
     return os.environ.get("CCCI_RUNS_DIR", RUNS_DIR_DEFAULT)
@@ -49,6 +61,31 @@ def run_id() -> str:
     return os.environ.get("CCCI_APP_DOMAIN") or os.environ.get("CCCI_RUN_ID") or "manual"
 
 
+def fresh_artifact_dir(path: str) -> str:
+    """Ensure the run artifact dir holds no stale artifacts from a PREVIOUS run with the same id.
+
+    Drone build numbers restarted when its DB was re-created (2026-09-27) while /var/lib/cc-ci-runs
+    still holds old-era dirs numbered into the thousands — a new build reusing an old number would
+    otherwise mix old artifacts into the new run's card (observed 2026-10-05: !testme gitea build 35
+    collided with a May-31 run 35 and embedded custom-html-tiny's fossil screenshot.png, because
+    screenshot.capture() skips its snap when out_path already exists). Removes ONLY the files/dirs
+    this run owns (see _OWNED_ARTIFACTS); anything else in the dir is left untouched. Best-effort
+    (R7): never raises into the run."""
+    os.makedirs(path, exist_ok=True)
+    for name in _OWNED_ARTIFACTS:
+        p = os.path.join(path, name)
+        if os.path.isdir(p):
+            shutil.rmtree(p, ignore_errors=True)
+        else:
+            try:
+                os.remove(p)
+            except FileNotFoundError:
+                pass
+            except OSError:
+                pass  # R7: a stuck file must never fail the run — the card is best-effort anyway
+    return path
+
+
 def junit_file(junit_dir: str, tier: str, source: str, path: str) -> str:
     """Deterministic per-(tier,source,file) JUnit XML path under junit_dir."""
     base = os.path.splitext(os.path.basename(path))[0]

runner/harness/screenshot.py

@@ -142,12 +142,13 @@ def capture(domain: str, out_path: str, *, recipe_meta: dict | None = None) -> s
                 page = context.new_page()
                 if hook is not None:
                     # Recipe-specific safe view (post-login etc.). The hook owns navigation +
-                    # the no-secret-page guarantee; it should call page.screenshot itself, but if
-                    # it doesn't, we still snap the resulting page below. SCREENSHOT(page, ctx) —
-                    # the uniform ctx convention (rcust P3).
+                    # the no-secret-page guarantee; we ALWAYS snap the page after it returns.
+                    # Never trust a pre-existing out_path: a recycled run artifact dir (drone
+                    # build numbers restarted 2026-09-27 while old-era dirs linger) must not get
+                    # its fossil screenshot embedded (observed 2026-10-05, !testme gitea #10
+                    # build 35). SCREENSHOT(page, ctx) — the uniform ctx convention (rcust P3).
                     hook(page, meta_mod.hook_ctx(domain, recipe_meta))
-                    if not os.path.exists(out_path):
-                        _snap_with_blank_retry(page, out_path)
+                    _snap_with_blank_retry(page, out_path)
                 else:
                     # Default: landing page. Accept any rendered status (200 or an auth redirect to a
                     # login form) — both are credential-free and representative of "the app is up".

runner/run_recipe_ci.py

@@ -1184,6 +1184,10 @@ def main() -> int:
     # {tier,source,file,rc,junit} record; after the run we assemble results.json (per-stage/per-test +
     # level) into the artifact dir. Best-effort — never changes the verdict (R7).
     run_artifact_dir = os.path.join(results_mod.runs_dir(), results_mod.run_id())
+    # Collision guard (2026-10-05): drone build numbers restarted when its DB was re-created while
+    # old-era run dirs (same numbers, other recipes' artifacts — e.g. a fossil screenshot.png) are
+    # still on disk. Wipe the files THIS run owns so nothing stale survives into the card.
+    results_mod.fresh_artifact_dir(run_artifact_dir)
     junit_dir = os.path.join(run_artifact_dir, "junit")
     records: list[dict] = []