react_on_rails_pro 17.0.0.rc.8 → 17.0.0.rc.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6013b40c199b7e3a943a2b2d77321d8f5481d9f6e5a63b9d02d8a52e1d91753b
-  data.tar.gz: e33168cb4f032e3ea0fcd9668eef969e0769dac6b9fb6d62da622205f9e1f9eb
+  metadata.gz: f76154cd40917f3cb62526a57ec696e6a9efedc600c99c62a8cdffd18afd30d5
+  data.tar.gz: 63a43241e6c89df22486834d03451a125282273fbf40ebd17efe2982316de860
 SHA512:
-  metadata.gz: c99af25077139ada7aa948a235c0020f95ae007ce0c4294bf73a4f12e561d63dd6138bb3f5b5e13cd52deffdc4c8b3d1fa5b8c892df47adde5fcd40d4a947762
-  data.tar.gz: 40d17fa6a656718d015ab0195974a135d199ea11c6db12b63ac4e3be5636bcf531fcc103908c1625facd68728e2f0ddc855d4c02b6fa4b6c52f123604ea7c6b4
+  metadata.gz: 41997c4eb40dbe7858f8ae734b11d4a9f12840eb022e94e00ead20ea6afe12be1949f840347379f46b7452f68b41b9c076737ea9c721fba0e772c4501f82806f
+  data.tar.gz: 34a525de9302065a00826c4042b41dcd82d8b97e3d5024200618b3f1eb62b04edb3924a3e4527e487484a7c05233225563ee26817159ed352249df4aed466bef

data/CONTEXT.md

@@ -0,0 +1,135 @@
+# React on Rails Pro — Rolling Deploy
+
+How the Node Renderer bundle cache is warmed so that during a rolling deploy —
+when old and new app versions run side by side — no SSR request pays the
+cold-bundle penalty. Covers the seeding mechanism and how it interacts with the
+deploy pipeline (build vs. release, staging-to-production promotion).
+
+## Language
+
+**Rolling deploy**:
+The window where old (draining) and new app instances run side by side, both
+sending SSR requests to the Node Renderer fleet.
+
+**Draining bundle**:
+The bundle hash that draining old Rails instances still request during the
+overlap; the new renderer fleet must serve it warm.
+_Avoid_: "old bundle" (old relative to what? — the draining bundle is defined by
+what is live-and-draining in _this environment_, not by build order).
+
+**Pre-seed**:
+Staging previous bundle hashes into the new renderer cache before it serves
+traffic, so **draining bundle** requests hit warm cache instead of the **410
+fallback**.
+_Avoid_: warmup (means the per-request lazy cache fill, the opposite of this).
+
+**Pre-seed source**:
+The deployment(s) the pre-seed pulls bundles from — resolved from that
+environment's `rolling_deploy_previous_urls` (HTTP adapter) at the moment the
+seed runs. The source is whatever environment's config is in effect _when and
+where the seed executes_.
+
+**Build-time seed**:
+Pre-seed baked into the image during `assets:precompile`. Uses the _building_
+environment's config and a _snapshot_ of its then-live bundle. Frozen into the
+image layer.
+
+**Release-time seed** (a.k.a. **boot seed**):
+Pre-seed run by the _target_ environment's renderer container at container boot
+via `rake react_on_rails_pro:pre_seed_renderer_cache`, resolving that
+environment's _actually-live_ bundle at that moment. Readiness-gated.
+_Avoid_: "runtime seed" (ambiguous with the per-request 410 path).
+
+**Multi-source seed**:
+A build-time seed whose **pre-seed source** is a _list_ of endpoints (the
+built-in HTTP adapter's `rolling_deploy_previous_urls` accepts more than one).
+Staging seeds from both staging and production so the promoted image is born
+prod-ready.
+
+**Promotion model**:
+Production is deployed by promoting the _exact staging image_, not by building a
+fresh production image. Consequence: the image's **build-time seed** used the
+_staging_ pipeline's config and a snapshot taken at staging-build time — never
+production's.
+
+**410 fallback**:
+The self-healing but slow per-request cold path: cache miss → `410 Gone` → Rails
+ships the bundle to the renderer → retry, repeating per request until cached.
+The thing pre-seeding exists to avoid.
+
+**Seed correctness (R1)**:
+The requirement that the new renderer fleet holds the exact **draining bundle**
+for _this_ environment at _this_ release.
+
+**Deploy ordering (R2)**:
+The requirement that the new renderer fleet is live and cache-warm _before_ new
+Rails takes traffic, and old renderers stay up until old Rails drains. Also
+called **renderer-before-Rails**.
+
+## Relationships
+
+- A **rolling deploy** has one **draining bundle** per bundle kind (server, and
+  RSC when enabled) that the new renderer fleet must serve warm.
+- **Pre-seed** eliminates the **410 fallback** for the **draining bundle**;
+  without it, every draining-bundle request pays the cold path.
+- **Seed correctness (R1)** and **Deploy ordering (R2)** are independent and
+  _both_ required. R2 alone (a delay) cannot rescue a wrong seed; R1 alone
+  cannot rescue Rails cutting over before the renderer is warm.
+- Under the **promotion model**, a **build-time seed** _cannot_ satisfy R1: it
+  runs in the staging pipeline against a staging snapshot, but production's
+  **draining bundle** is only known at the (later, sometimes-skipped) promotion.
+- Fix: set staging's **pre-seed source** to **production**, so the promoted
+  image is born prod-ready (build-time seed = prod's live bundle). This bounds
+  the blast radius but goes stale across _two pending promotions_.
+- The residual staleness window (two images built before either is promoted) is
+  closed by a **release-time seed** at promotion, which resolves production's
+  actually-live **draining bundle**.
+- Staging seeding prod bundles means staging's _own_ rolling deploys cold-miss
+  (staging drains staging's-previous, which is not seeded). Accepted: staging
+  SSR performance during deploys is not a goal.
+
+### Three layers of defense
+
+Correctness is layered; each layer bounds the failure the prior one leaves open.
+
+1. **Multi-source build-time seed** — the image is born prod-ready; failure floor
+   if the boot seed can't reach the live endpoint. (Correct for a single pending
+   promotion.)
+2. **Boot seed (release-time)** — the correctness path: pulls the _actually-live_
+   **draining bundle** at container start, closing the two-pending-promotions
+   window. Subsumes layer 1's correctness; layer 1 remains only as a fallback.
+3. **Deploy ordering (R2)** — renderer live+warm before Rails; readiness gates on
+   the boot seed _completing_ (not succeeding — a failed seed degrades to the 410
+   fallback rather than wedging the deploy).
+
+**Interdependency:** the **boot seed** returns the correct **draining bundle**
+_only because_ the renderer boots before Rails (R2). Before new Rails is live,
+the environment's live endpoint is still served by the draining old pods, so it
+advertises the draining hash. If Rails cut over first, the live endpoint would
+advertise the _new_ hash and the boot seed would miss the very bundle it needs.
+Layer 2 depends on Layer 3.
+
+## Example dialogue
+
+> **Dev:** "We promote the staging image to prod, and pre-seed is on. Why is
+> prod SSR still slow after a rolling deploy?"
+> **Domain expert:** "Because the **build-time seed** ran in the staging
+> pipeline — the image holds staging's previous bundle, not prod's **draining
+> bundle**. The seed was correct for the wrong environment."
+> **Dev:** "So if staging's **pre-seed source** points at production, the
+> promoted image is already prod-ready?"
+> **Domain expert:** "For a single pending promotion, yes. Two pending
+> promotions still go stale — that's why promotion also runs a **release-time
+> seed** against prod's live bundle."
+> **Dev:** "And that's enough?"
+> **Domain expert:** "That's **R1**. You still need **R2** — the new renderer
+> fleet live and warm before Rails cuts over — or you get the 410 storm anyway."
+
+## Flagged ambiguities
+
+- "old bundle" was used to mean both the build-predecessor and the live-draining
+  bundle — resolved: the term of record is **draining bundle**, defined by what
+  is live in the target environment, not by build order.
+- "the delay" (R2) was initially read as a fix for the slow-SSR report — resolved:
+  the report is an R1 (wrong-seed) failure; the delay is a necessary but separate
+  R2 concern.

data/Gemfile.lock

@@ -9,7 +9,7 @@ GIT
 PATH
   remote: ..
   specs:
-    react_on_rails (17.0.0.rc.8)
+    react_on_rails (17.0.0.rc.9)
       addressable
       connection_pool
       execjs (~> 2.5)
@@ -20,14 +20,14 @@ PATH
 PATH
   remote: .
   specs:
-    react_on_rails_pro (17.0.0.rc.8)
+    react_on_rails_pro (17.0.0.rc.9)
       async (>= 2.29)
       async-http (~> 0.95)
       execjs (~> 2.9)
       io-endpoint (~> 0.17.0)
       jwt (>= 2.5, < 4)
       nokogiri (>= 1.12, < 2)
-      react_on_rails (= 17.0.0.rc.8)
+      react_on_rails (= 17.0.0.rc.9)
 
 GEM
   remote: https://rubygems.org/

data/app/helpers/react_on_rails_pro_helper.rb

@@ -1260,8 +1260,14 @@ module ReactOnRailsProHelper
     render_options = create_render_options(react_component_name, options)
     json_stream = server_rendered_react_component(render_options)
     json_stream.transform do |chunk|
-      html = chunk.delete("html") || ""
-      metadata = chunk.to_json
+      # Read `html` without removing it. This chunk may be owned by StreamCache,
+      # which buffers a reference to it and writes it to Rails.cache after the
+      # stream completes. Mutating it here (e.g. `chunk.delete("html")`) would
+      # tear the payload out of the buffered Hash, so prerender caching would
+      # persist an empty payload and every cache hit would serve zero bytes.
+      # See https://github.com/shakacode/react_on_rails/issues/4550.
+      html = chunk["html"] || ""
+      metadata = chunk.except("html").to_json
       content_bytes = html.bytesize.to_s(16).rjust(8, "0")
       "#{metadata}\t#{content_bytes}\n#{html}".html_safe
     end

data/docs/adr/0001-boot-seed-rolling-deploy-bundles.md

@@ -0,0 +1,38 @@
+# Seed rolling-deploy bundles at renderer boot, not only at build
+
+**Status:** accepted
+
+When the production image is produced by **promoting the staging image**
+(`upstream: hichee-staging` in Control Plane), a build-time pre-seed cannot know
+production's live **draining bundle**: it runs in the staging pipeline against a
+staging snapshot, and promotion happens later and is sometimes skipped. We
+therefore have the **node-renderer container pull the target environment's
+actually-live bundle at boot** (`rake react_on_rails_pro:pre_seed_renderer_cache`,
+readiness-gated) as the correctness path, and keep the build-time seed as a
+fallback floor.
+
+## Considered options
+
+- **Build-time seed only (status quo).** Rejected: structurally wrong under the
+  promotion model — the image holds staging's previous bundle, and even a
+  multi-source build-time seed (staging + production) goes stale across two
+  pending promotions.
+- **Build a dedicated production image instead of promoting staging.** Rejected:
+  fights the promotion model (the point of promotion is shipping the exact
+  artifact tested on staging) and still goes stale if a prod image is ever built
+  ahead of its release.
+- **Boot seed only.** Rejected in favor of belt-and-suspenders: a boot seed that
+  can't reach the live endpoint would fall all the way back to the per-request
+  410 path. Keeping the build-time multi-source seed bounds that failure to a
+  small, rare miss.
+
+## Consequences
+
+- Correctness of the boot seed **depends on deploy ordering (R2)**: the renderer
+  must boot before Rails, so the environment's live endpoint still advertises the
+  draining hash. If Rails cut over first, the boot seed would fetch the new hash
+  and miss the draining one.
+- Readiness gates on the boot seed **completing, not succeeding** — a failed seed
+  degrades to the 410 fallback rather than wedging the deploy.
+- Staging seeds production bundles, so staging's own rolling deploys cold-miss.
+  Accepted: staging SSR performance during deploys is not a goal.

data/lib/react_on_rails_pro/configuration.rb

@@ -38,7 +38,7 @@ module ReactOnRailsPro
       remote_bundle_cache_adapter: Configuration::DEFAULT_REMOTE_BUNDLE_CACHE_ADAPTER,
       rolling_deploy_adapter: Configuration::DEFAULT_ROLLING_DEPLOY_ADAPTER,
       rolling_deploy_token: Configuration::DEFAULT_ROLLING_DEPLOY_TOKEN,
-      rolling_deploy_previous_url: Configuration::DEFAULT_ROLLING_DEPLOY_PREVIOUS_URL,
+      rolling_deploy_previous_urls: Configuration::DEFAULT_ROLLING_DEPLOY_PREVIOUS_URLS,
       rolling_deploy_mount_path: Configuration::DEFAULT_ROLLING_DEPLOY_MOUNT_PATH,
       ssr_timeout: Configuration::DEFAULT_SSR_TIMEOUT,
       ssr_pre_hook_js: nil,
@@ -79,7 +79,7 @@ module ReactOnRailsPro
     DEFAULT_REMOTE_BUNDLE_CACHE_ADAPTER = nil
     DEFAULT_ROLLING_DEPLOY_ADAPTER = nil
     DEFAULT_ROLLING_DEPLOY_TOKEN = nil
-    DEFAULT_ROLLING_DEPLOY_PREVIOUS_URL = nil
+    DEFAULT_ROLLING_DEPLOY_PREVIOUS_URLS = nil
     DEFAULT_ROLLING_DEPLOY_MOUNT_PATH = "/react_on_rails_pro/rolling_deploy"
     # Minimum bearer-token length when using the built-in HTTP rolling-deploy adapter.
     # 32 chars matches SecureRandom.hex(16) and rules out obviously low-entropy values
@@ -112,7 +112,7 @@ module ReactOnRailsPro
                   :renderer_http_pool_timeout, :renderer_http_pool_warn_timeout,
                   :dependency_globs, :excluded_dependency_globs, :rendering_returns_promises,
                   :remote_bundle_cache_adapter, :rolling_deploy_adapter,
-                  :rolling_deploy_token, :rolling_deploy_previous_url, :rolling_deploy_mount_path,
+                  :rolling_deploy_token, :rolling_deploy_previous_urls, :rolling_deploy_mount_path,
                   :ssr_pre_hook_js, :assets_to_copy,
                   :renderer_request_retry_limit, :throw_js_errors, :ssr_timeout,
                   :profile_server_rendering_js_code, :raise_non_shell_server_rendering_errors, :enable_rsc_support,
@@ -201,7 +201,7 @@ module ReactOnRailsPro
                    tracing: nil,
                    dependency_globs: nil, excluded_dependency_globs: nil, rendering_returns_promises: nil,
                    remote_bundle_cache_adapter: nil, rolling_deploy_adapter: nil,
-                   rolling_deploy_token: nil, rolling_deploy_previous_url: nil,
+                   rolling_deploy_token: nil, rolling_deploy_previous_urls: nil,
                    rolling_deploy_mount_path: nil,
                    ssr_pre_hook_js: nil, assets_to_copy: nil,
                    renderer_request_retry_limit: nil, throw_js_errors: nil, ssr_timeout: nil,
@@ -229,7 +229,7 @@ module ReactOnRailsPro
       self.remote_bundle_cache_adapter = remote_bundle_cache_adapter
       self.rolling_deploy_adapter = rolling_deploy_adapter
       self.rolling_deploy_token = rolling_deploy_token
-      self.rolling_deploy_previous_url = rolling_deploy_previous_url
+      self.rolling_deploy_previous_urls = rolling_deploy_previous_urls
       # Constructor nil/blank means "use the default"; configure-block assignment
       # can still set nil/blank later to opt out of the engine auto-mount.
       self.rolling_deploy_mount_path = rolling_deploy_mount_path.presence || DEFAULT_ROLLING_DEPLOY_MOUNT_PATH
@@ -407,8 +407,8 @@ module ReactOnRailsPro
 
     # Only fires when the user has selected the built-in HTTP adapter. Custom
     # adapters that re-use the new config knobs for their own reasons are not
-    # forced through this validation. We do not validate previous_url here:
-    # an unset URL is a valid "discovery off; this is the upload-only side of
+    # forced through this validation. We do not validate previous_urls here:
+    # an unset list is a valid "discovery off; this is the upload-only side of
     # a one-way deploy" mode (the adapter returns [] for previous_bundle_hashes).
     def validate_rolling_deploy_http_adapter_config
       return unless rolling_deploy_http_adapter?

data/lib/react_on_rails_pro/rolling_deploy_adapters/http.rb

@@ -38,11 +38,19 @@ module ReactOnRailsPro
     # Configuration (see docs/pro/rolling-deploy-adapters.md):
     #
     #   ReactOnRailsPro.configure do |config|
-    #     config.rolling_deploy_adapter      = ReactOnRailsPro::RollingDeployAdapters::Http
-    #     config.rolling_deploy_token        = ENV.fetch("ROLLING_DEPLOY_TOKEN")
-    #     config.rolling_deploy_previous_url = ENV["ROLLING_DEPLOY_PREVIOUS_URL"]
+    #     config.rolling_deploy_adapter       = ReactOnRailsPro::RollingDeployAdapters::Http
+    #     config.rolling_deploy_token         = ENV.fetch("ROLLING_DEPLOY_TOKEN")
+    #     config.rolling_deploy_previous_urls = ENV["ROLLING_DEPLOY_PREVIOUS_URLS"]
     #   end
     #
+    # `rolling_deploy_previous_urls` accepts a single URL string, a comma-
+    # separated string, or an Array of URL strings. Discovery unions the bundle
+    # hashes advertised by every endpoint; fetch tries each endpoint in order and
+    # returns the first that has the requested hash. Seeding from more than one
+    # endpoint (e.g. staging + production) lets an image built in one environment
+    # and promoted to another carry the promotion target's draining bundle. See
+    # docs/pro/rolling-deploy-adapters.md#promotion-deploys-need-a-release-time-boot-seed.
+    #
     # Error contract matches the rolling_deploy_adapter protocol: every
     # exception is caught and reported as a warning so a failed seed degrades
     # to the runtime 410-retry fallback rather than failing the build.
@@ -81,19 +89,59 @@ module ReactOnRailsPro
 
       class << self
         def previous_bundle_hashes
-          base = configured_previous_url
-          return [] if base.nil?
+          bases = configured_previous_urls
+          return [] if bases.empty?
 
           if token_missing?
             return warn_and_return("rolling_deploy_token is not configured; skipping manifest fetch",
                                    [])
           end
 
-          response = http_get(
-            URI("#{base}/manifest"),
-            read_timeout: MANIFEST_READ_TIMEOUT_SECONDS
-          )
-          return warn_and_return("manifest returned HTTP #{response.code}", []) unless response.is_a?(Net::HTTPSuccess)
+          # Union across every configured endpoint. A single endpoint failing
+          # (down, 404, malformed manifest) yields [] for that base and does not
+          # abort discovery for the others — the point of multiple endpoints is
+          # resilience, so one unreachable source must not blank the rest.
+          bases.flat_map { |base| manifest_hashes(base) }.uniq
+        end
+
+        def fetch(bundle_hash)
+          return nil if hash_invalid?(bundle_hash)
+
+          bases = configured_previous_urls
+          return nil if bases.empty?
+
+          if token_missing?
+            return warn_and_return("rolling_deploy_token is not configured; skipping fetch(#{bundle_hash.inspect})",
+                                   nil)
+          end
+
+          # Try each endpoint in order; return the first that has the hash. A
+          # given hash is content-addressed, so whichever endpoint serves it
+          # returns identical bytes — first hit wins.
+          bases.each do |base|
+            payload = fetch_from(base, bundle_hash)
+            return payload if payload
+          end
+          nil
+        end
+
+        # Intentional no-op. The running Rails server IS the artifact store —
+        # bundle + companion assets are already on local disk where the
+        # mountable BundlesController will serve them on the next deploy's
+        # build CI. Documented in docs/pro/rolling-deploy-adapters.md.
+        def upload(_bundle_hash, bundle:, assets:)
+          # See class doc above.
+        end
+
+        private
+
+        # One endpoint's manifest hashes, or [] on any failure so a single bad
+        # endpoint cannot abort discovery across the others.
+        def manifest_hashes(base)
+          response = http_get(URI("#{base}/manifest"), read_timeout: MANIFEST_READ_TIMEOUT_SECONDS)
+          unless response.is_a?(Net::HTTPSuccess)
+            return warn_and_return("manifest at #{base} returned HTTP #{response.code}", [])
+          end
 
           parsed = JSON.parse(response.body)
           # Filter manifest hashes through SAFE_HASH_PATTERN before returning
@@ -107,19 +155,13 @@ module ReactOnRailsPro
             .reject(&:empty?)
             .grep(ReactOnRailsPro::RollingDeploy::SAFE_HASH_PATTERN)
         rescue StandardError => e
-          warn_and_return("previous_bundle_hashes failed: #{e.class}: #{e.message}", [])
+          warn_and_return("previous_bundle_hashes for #{base} failed: #{e.class}: #{e.message}", [])
         end
 
-        def fetch(bundle_hash)
-          base = configured_previous_url
-          return nil if base.nil?
-          return nil if hash_invalid?(bundle_hash)
-
-          if token_missing?
-            return warn_and_return("rolling_deploy_token is not configured; skipping fetch(#{bundle_hash.inspect})",
-                                   nil)
-          end
-
+        # Fetch one hash from one endpoint. Returns the payload Hash or nil.
+        # Owns the temp dir lifecycle so a failed attempt cleans up before the
+        # caller tries the next endpoint into the same (hash-keyed) directory.
+        def fetch_from(base, bundle_hash)
           dir = bundle_dir(bundle_hash)
           FileUtils.mkdir_p(dir)
 
@@ -131,36 +173,37 @@ module ReactOnRailsPro
           result
         rescue StandardError => e
           cleanup_and_return(dir, nil) if dir
-          warn_and_return("fetch(#{bundle_hash.inspect}) failed: #{e.class}: #{e.message}", nil)
+          warn_and_return("fetch(#{bundle_hash.inspect}) from #{base} failed: #{e.class}: #{e.message}", nil)
         end
 
-        # Intentional no-op. The running Rails server IS the artifact store —
-        # bundle + companion assets are already on local disk where the
-        # mountable BundlesController will serve them on the next deploy's
-        # build CI. Documented in docs/pro/rolling-deploy-adapters.md.
-        def upload(_bundle_hash, bundle:, assets:)
-          # See class doc above.
+        # Normalize the configured previous URL(s) into a de-duplicated list of
+        # scheme-validated base URLs. Accepts a single string, a comma-separated
+        # string, or an Array (whose entries may themselves be comma-separated —
+        # convenient for `ENV["ROLLING_DEPLOY_PREVIOUS_URLS"]`).
+        def configured_previous_urls
+          raw = ReactOnRailsPro.configuration.rolling_deploy_previous_urls
+          Array(raw)
+            .flat_map { |entry| entry.to_s.split(",") }
+            .map(&:strip)
+            .reject(&:empty?)
+            .uniq
+            .filter_map { |url| normalize_previous_url(url) }
         end
 
-        private
-
-        def configured_previous_url
-          url = ReactOnRailsPro.configuration.rolling_deploy_previous_url.to_s.strip
-          return nil if url.empty?
-
+        def normalize_previous_url(url)
           uri = URI.parse(url.chomp("/"))
           unless %w[http https].include?(uri.scheme)
             Rails.logger.warn(
-              "#{LOG_PREFIX} rolling_deploy_previous_url has unsupported scheme " \
-              "#{uri.scheme.inspect}; expected http or https. Skipping discovery."
+              "#{LOG_PREFIX} rolling_deploy_previous_urls entry #{url.inspect} has unsupported scheme " \
+              "#{uri.scheme.inspect}; expected http or https. Skipping this entry."
             )
             return nil
           end
           uri.to_s
         rescue URI::InvalidURIError => e
           Rails.logger.warn(
-            "#{LOG_PREFIX} rolling_deploy_previous_url is not a valid URI: #{e.message}. " \
-            "Skipping discovery."
+            "#{LOG_PREFIX} rolling_deploy_previous_urls entry #{url.inspect} is not a valid URI: " \
+            "#{e.message}. Skipping this entry."
           )
           nil
         end
@@ -330,7 +373,7 @@ module ReactOnRailsPro
         # by surfacing the cleartext-token risk in build CI logs.
         #
         # Loopback hosts are intentionally exempt so developers running a
-        # local Rails server for `rolling_deploy_previous_url` during
+        # local Rails server for `rolling_deploy_previous_urls` during
         # development don't see noise on every build CI rehearsal — the
         # token never leaves the host in that case.
         LOOPBACK_HOST_PATTERN = /\A(localhost|127(?:\.\d{1,3}){3}|::1|\[::1\])\z/

data/lib/react_on_rails_pro/stream_cache.rb

@@ -65,7 +65,14 @@ module ReactOnRailsPro
 
         buffered_chunks = []
         @upstream_stream.each_chunk do |chunk|
-          buffered_chunks << chunk
+          # Snapshot the chunk before handing it downstream. A downstream consumer
+          # receives the same object we buffer here, and this buffered array is
+          # persisted to Rails.cache after the stream completes. If a consumer
+          # mutates its chunk (e.g. deleting a key while framing), an un-duped
+          # buffer would persist that mutation and serve a corrupted cache entry.
+          # A shallow dup keeps the cached copy intact regardless of the consumer.
+          # See https://github.com/shakacode/react_on_rails/issues/4550.
+          buffered_chunks << chunk.dup
           yield(chunk)
         end
         Rails.cache.write(@cache_key, buffered_chunks, @cache_options || {})

data/lib/react_on_rails_pro/version.rb

@@ -14,6 +14,6 @@
 # https://github.com/shakacode/react_on_rails/blob/main/REACT-ON-RAILS-PRO-LICENSE.md
 
 module ReactOnRailsPro
-  VERSION = "17.0.0.rc.8"
+  VERSION = "17.0.0.rc.9"
   PROTOCOL_VERSION = "2.0.0"
 end

data/sig/react_on_rails_pro/configuration.rbs

@@ -34,7 +34,7 @@ module ReactOnRailsPro
     DEFAULT_REMOTE_BUNDLE_CACHE_ADAPTER: nil
     DEFAULT_ROLLING_DEPLOY_ADAPTER: nil
     DEFAULT_ROLLING_DEPLOY_TOKEN: nil
-    DEFAULT_ROLLING_DEPLOY_PREVIOUS_URL: nil
+    DEFAULT_ROLLING_DEPLOY_PREVIOUS_URLS: nil
     DEFAULT_ROLLING_DEPLOY_MOUNT_PATH: String
     DEFAULT_RENDERER_REQUEST_RETRY_LIMIT: Integer
     DEFAULT_THROW_JS_ERRORS: bool
@@ -70,7 +70,7 @@ module ReactOnRailsPro
     attr_accessor remote_bundle_cache_adapter: Module?
     attr_accessor rolling_deploy_adapter: Module?
     attr_accessor rolling_deploy_token: String?
-    attr_accessor rolling_deploy_previous_url: String?
+    attr_accessor rolling_deploy_previous_urls: (String | Array[String])?
     attr_accessor rolling_deploy_mount_path: String?
     attr_accessor ssr_pre_hook_js: String?
     attr_accessor assets_to_copy: Array[String]?
@@ -106,7 +106,7 @@ module ReactOnRailsPro
       ?remote_bundle_cache_adapter: Module?,
       ?rolling_deploy_adapter: Module?,
       ?rolling_deploy_token: String?,
-      ?rolling_deploy_previous_url: String?,
+      ?rolling_deploy_previous_urls: (String | Array[String])?,
       ?rolling_deploy_mount_path: String?,
       ?ssr_pre_hook_js: String?,
       ?assets_to_copy: Array[String]?,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: react_on_rails_pro
 version: !ruby/object:Gem::Version
-  version: 17.0.0.rc.8
+  version: 17.0.0.rc.9
 platform: ruby
 authors:
 - Justin Gordon
@@ -111,14 +111,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 17.0.0.rc.8
+        version: 17.0.0.rc.9
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 17.0.0.rc.8
+        version: 17.0.0.rc.9
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -194,6 +194,7 @@ files:
 - AGENTS.md
 - CHANGELOG.md
 - CLAUDE.md
+- CONTEXT.md
 - CONTRIBUTING.md
 - Gemfile
 - Gemfile.development_dependencies
@@ -208,6 +209,7 @@ files:
 - app/helpers/react_on_rails_pro_helper.rb
 - app/views/react_on_rails_pro/rsc_payload.text.erb
 - babel.config.js
+- docs/adr/0001-boot-seed-rolling-deploy-bundles.md
 - lib/react_on_rails_pro.rb
 - lib/react_on_rails_pro/assets_precompile.rb
 - lib/react_on_rails_pro/async_props_emitter.rb