See PHI309. There is a window of time between when all builds pass and when Harbormaster actually publishes a revision out of draft.

If any other user tries to interact with the revision during that window, they'll pick up the undraft transaction as a side effect. However, they won't have permission to apply it and will be stopped by a validation error.

Instead, only automatically publish a revision if the actor is the revision author or some system/application user (essentially always Harbormaster).

• Added a echo ...; sleep(30); to HarbormasterBuildEngine->updateBuildable() before the applyTransactions() at the bottom.
• Wrote an "Always, run an HTTP request" Herald rule and Harbormaster build plan.
• Ran daemons with bin/phd debug task.
• Created a new revision with arc diff, as user A.
• Waited for phd to enter the race window.
• In a separate browser, as user B, submitted a comment via differential.revision.edit.
  • Before patch: edits during the race window were rejected with a validation error, "you don't have permission to request review".
  • After patch: edits go through cleanly.