From 943fdb62672ab504c479b9bcd108e6f4704b6f09 Mon Sep 17 00:00:00 2001
From: KellyMichels <kellymic@gmail.com>
Date: Wed, 5 Aug 2026 18:39:07 -0500
Subject: [PATCH] fix(zdeploy): verify against the committed build stamp, and
 read 5-segment versions

Deploy verification expected buildNumber + 1, which was only correct while
a prebuild hook self-incremented the stamp during the image build. That hook
is gone (it produced versions matching no commit and left every build with a
dirty tree), so the check waited out its timeout and warned on every deploy
even when the deploy had succeeded.

Both verifier call sites now expect the committed label, and
Get-LabelFromBuildJsonObj understands the 5-segment scheme
v{major}.{rc}.{beta}.{alpha}.{build} while still reading the legacy
{productVersion, buildNumber} stamp for projects that haven't migrated.

Verified: both files parse; label fn returns v0.0.0.1.8 (5-segment) and
v1.0.0.70 (legacy).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 ZHelpers.ps1 |  6 ++++++
 zdeploy.ps1  | 13 ++++++++-----
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/ZHelpers.ps1 b/ZHelpers.ps1
index e497c20..cb9117c 100644
--- a/ZHelpers.ps1
+++ b/ZHelpers.ps1
@@ -185,6 +185,12 @@ function Read-JsonBuildVersion {
 function Get-LabelFromBuildJsonObj {
     param($obj)
     if (-not $obj) { return $null }
+    # Five-segment scheme: v{major}.{rc}.{beta}.{alpha}.{build}
+    if ($null -ne $obj.build -or $null -ne $obj.alpha) {
+        $alpha = if ($null -ne $obj.alpha) { [int]$obj.alpha } else { 1 }
+        return "v$([int]$obj.major).$([int]$obj.rc).$([int]$obj.beta).$alpha.$([int]$obj.build)"
+    }
+    # Legacy two-part stamp (projects not yet migrated): v{productVersion}.{buildNumber}
     return "v$([string]$obj.productVersion).$([int]$obj.buildNumber)"
 }
 
diff --git a/zdeploy.ps1 b/zdeploy.ps1
index cb034fc..f46417e 100644
--- a/zdeploy.ps1
+++ b/zdeploy.ps1
@@ -178,9 +178,12 @@ function Wait-VerifyStaticBuild {
         Write-Host "`n--- [$Key version] SKIPPED (no local build-version.json - see 'Enabling deploy verification' in README) ---" -ForegroundColor DarkYellow
         return
     }
-    $expBn = [int]$PreZipBuildState.buildNumber + 1
-    $pv    = [string]$PreZipBuildState.productVersion
-    $expectedLabel = "v$pv.$expBn"
+    # Expect the COMMITTED stamp, not +1: builds no longer self-bump (a
+    # prebuild hook incremented inside the image, so the served version
+    # matched no commit and every build dirtied the tree). The counter now
+    # advances deliberately — one version bump per merged PR — so "is the
+    # build I just packed live?" means an exact match.
+    $expectedLabel = Get-LabelFromBuildJsonObj $PreZipBuildState
     Write-Host "`n--- [$Key] Live build verification (expect $expectedLabel) ---" -ForegroundColor Cyan
     $containerName = $Proj.remote.containerName
     $deadline = (Get-Date).AddSeconds(45)
@@ -536,8 +539,8 @@ function Invoke-NextDeploy {
             }
         }
         if ($preZipBuild) {
-            $expBn = [int]$preZipBuild.buildNumber + 1
-            $expectedLabel = "v$([string]$preZipBuild.productVersion).$expBn"
+            # Committed stamp, not +1 — see the note in Wait-VerifyStaticBuild.
+            $expectedLabel = Get-LabelFromBuildJsonObj $preZipBuild
             Wait-VerifyApiBuild -Key $Key -Proj $Proj -ExpectedLabel $expectedLabel -TimeoutSec 60 | Out-Null
         } else {
             Write-Host "  (No public/build-version.json - version verification skipped. See 'Enabling deploy verification' in README.)" -ForegroundColor DarkYellow