@crvouga/dev-fleet 0.7.0 → 0.9.0

package/src/cli/fleet-sync-plan.ts

@@ -1,6 +1,7 @@
 import { join } from 'node:path';
 import type { Standing } from '../state/sync';
 import type { Runner } from '../types';
+import { featureRemovals, workerFeatures } from '../worker-features';
 
 /** A tool whose pin changes between the applied and the selected revision. */
 export interface ToolChange {
@@ -31,6 +32,9 @@ export interface SyncPlan {
   tools: ToolChange[];
   restarts: Restart[];
   nodes: { node: string; from: string | null; to: string; changes: boolean }[];
+  /** What a sync removes from a worker because the fleet configuration
+   * turned one of its features off since it was last applied. */
+  removals: { node: string; removes: string[] }[];
 }
 
 /** The coding agents' CLIs: a new version is used by the next session, and a
@@ -84,16 +88,24 @@ export function toolChanges(
 }
 
 /** What restarts follow from the changes, as the playbooks and the toolchain
- * setup act on them.
+ * setup act on them. A worker's T3 restarts only while it runs no agent turn
+ * (`ansible/ubuntu/tasks/t3-restart.yml`) unless `--restart-busy` asks for it
+ * anyway: only then do running turns end.
  */
-export function restarts(tools: ToolChange[], files: string[]): Restart[] {
+export function restarts(
+  tools: ToolChange[],
+  files: string[],
+  restartBusy = false
+): Restart[] {
   const found: Restart[] = [];
+  const when = restartBusy
+    ? 'at once (--restart-busy): its running agent turns end.'
+    : 'once it runs no agent turn: running turns keep going and the restart is pending until then.';
   if (tools.some((change) => change.tool === 't3'))
     found.push({
       service: 't3',
-      reason:
-        'T3 is upgraded and restarted on every machine; its running agent turns end.',
-      endsRunningTurns: true,
+      reason: `T3 is upgraded on every worker and restarted ${when}`,
+      endsRunningTurns: restartBusy,
     });
   else if (
     files.some((file) =>
@@ -102,9 +114,8 @@ export function restarts(tools: ToolChange[], files: string[]): Restart[] {
   )
     found.push({
       service: 't3',
-      reason:
-        'The managed T3 policy may change: a T3 that has not loaded it is restarted, and its running agent turns end.',
-      endsRunningTurns: true,
+      reason: `The managed T3 policy may change: a T3 that has not loaded it is restarted ${when}`,
+      endsRunningTurns: restartBusy,
     });
   const agents = tools.filter((change) => AGENT_TOOLS.includes(change.tool));
   if (agents.length)
@@ -136,6 +147,11 @@ export async function syncPlan(
     state: Standing;
     nodes: string[];
     sources: string[];
+    /** `--restart-busy`: a T3 restart does not wait for idle. */
+    restartBusy?: boolean;
+    /** The fleet configuration last applied (from the fleet state), when
+     * there is one, and the one this sync applies. */
+    definitions?: { applied: unknown; selected: unknown };
   },
   run: Runner
 ): Promise<SyncPlan> {
@@ -163,16 +179,54 @@ export async function syncPlan(
     revision: { from: input.from, to: input.to },
     known: changes !== null,
     tools: changes?.tools ?? [],
-    restarts: changes ? restarts(changes.tools, changes.files) : [],
+    restarts: changes
+      ? restarts(changes.tools, changes.files, input.restartBusy === true)
+      : [],
     nodes: input.nodes.map((node) => ({
       node,
       from: input.from,
       to: input.to,
       changes: differs,
     })),
+    removals: input.definitions ? removals(input.nodes, input.definitions) : [],
   };
 }
 
+/** Per worker, what turning its features off removes. Nothing is known to
+ * be removed from a worker the applied configuration does not name. */
+function removals(
+  nodes: string[],
+  definitions: { applied: unknown; selected: unknown }
+): SyncPlan['removals'] {
+  const workers = (definition: unknown): Record<string, unknown>[] => {
+    const list =
+      typeof definition === 'object' && definition !== null
+        ? (definition as Record<string, unknown>)['workers']
+        : undefined;
+    return Array.isArray(list)
+      ? list.filter(
+          (entry): entry is Record<string, unknown> =>
+            typeof entry === 'object' && entry !== null
+        )
+      : [];
+  };
+  return nodes.flatMap((node) => {
+    const before = workers(definitions.applied).find(
+      (entry) => entry['id'] === node
+    );
+    if (!before) return [];
+    const network = workers(definitions.selected).find(
+      (entry) => entry['id'] === node
+    )?.['network'] as { user?: unknown } | undefined;
+    const removes = featureRemovals(
+      workerFeatures(definitions.applied, node),
+      workerFeatures(definitions.selected, node),
+      typeof network?.user === 'string' ? network.user : 'the worker user'
+    );
+    return removes.length ? [{ node, removes }] : [];
+  });
+}
+
 export const planSources = (workspace: string, root: string): string[] => [
   workspace,
   join(root, 'source'),
@@ -196,5 +250,7 @@ export function planText(plan: SyncPlan): string {
     );
   for (const restart of plan.restarts)
     lines.push(`  Restarts ${restart.service}: ${restart.reason}`);
+  for (const removal of plan.removals ?? [])
+    lines.push(`  Removes from ${removal.node}: ${removal.removes.join(', ')}`);
   return lines.join('\n');
 }

package/src/cli/fleet-sync-records.ts

@@ -0,0 +1,113 @@
+import type { FleetDefinition, MachineDefinition } from '../definition';
+import { readRosterText } from '../state/roster';
+import { changeWorkers, readWorkerStates } from '../state/workers';
+import { parseConfig } from '../config';
+import type { Check, FleetNode, Runner } from '../types';
+import {
+  lifecycleServices,
+  retireWorker,
+  type NodeLifecycleServices,
+} from './fleet-node-lifecycle';
+
+/** The workers of the fleet as worker records describe them come and go
+ * with the records: a record that appears is a declared worker, enrolled by
+ * the next sync like any other; one that disappears is retired by the same
+ * path as fleet-node-retire. fleet-sync calls this before it reads the
+ * roster. It records which workers came from records, so that only those
+ * are ever retired by themselves; a worker removed from fleet.json by hand
+ * must still be retired first.
+ */
+export async function reconcileRecords(
+  definition: FleetDefinition,
+  roster: string,
+  run: Runner,
+  {
+    apply,
+    services = lifecycleServices,
+  }: {
+    apply: boolean;
+    services?: (roster: string) => NodeLifecycleServices;
+  }
+): Promise<Check[]> {
+  const states = readWorkerStates().workers;
+  const declared = new Set(definition.workers.map((worker) => worker.id));
+  const vanished = Object.entries(states)
+    .filter(([id, entry]) => entry.origin === 'records' && !declared.has(id))
+    .map(([id]) => id);
+  const entries = await rosterEntries(roster);
+  const lifecycle = { ...services(roster), run };
+  const checks: Check[] = [];
+  for (const id of vanished) {
+    const retired = await retireWorker(
+      gone(id, entries.get(id)),
+      entries.get(id),
+      lifecycle,
+      apply
+    );
+    const steps = (retired.data as { nodes: { checks: Check[] }[] }).nodes[0]!
+      .checks;
+    const failed = steps.filter((step) => step.status === 'fail');
+    checks.push(
+      failed.length
+        ? {
+            id: 'enrollment:record',
+            status: 'fail',
+            summary: 'WORKER_RECORD_RETIREMENT_FAILED',
+            remedy: {
+              action: `${id}'s worker record disappeared, and retiring it failed at ${failed.map((step) => step.id).join(', ')}. Follow that remedy, then run fleet-sync again.`,
+            },
+          }
+        : {
+            id: 'enrollment:record',
+            status: apply ? 'pass' : 'skip',
+            summary: `${apply ? '' : 'Planned: '}${id}'s worker record disappeared, so it is retired: ${steps.map((step) => step.id).join(', ')}.`,
+          }
+    );
+  }
+  const fresh = definition.workers.filter(
+    (worker) => worker.origin === 'records' && !states[worker.id]?.origin
+  );
+  if (apply && fresh.length)
+    await changeWorkers(lifecycle.state(), (current) =>
+      Object.fromEntries(
+        fresh.map((worker) => [
+          worker.id,
+          { ...current[worker.id], origin: 'records' as const },
+        ])
+      )
+    );
+  return checks;
+}
+
+async function rosterEntries(path: string): Promise<Map<string, FleetNode>> {
+  const text = await readRosterText(path).catch(() => null);
+  if (text === null) return new Map();
+  try {
+    return new Map(
+      parseConfig(JSON.parse(text) as unknown).nodes.map((node) => [
+        node.id,
+        node,
+      ])
+    );
+  } catch {
+    return new Map();
+  }
+}
+
+/** A worker whose record is gone, as far as retiring it needs: reached from
+ * declared data (so its pin is the fleet state's), under the name the roster
+ * last knew. Its user and ports are never used to retire it.
+ */
+function gone(id: string, entry: FleetNode | undefined): MachineDefinition {
+  return {
+    id,
+    os: 'linux',
+    origin: 'records',
+    network: {
+      tailscaleName: entry?.ssh ?? id,
+      user: 'root',
+      sshPort: 22,
+      t3Port: 3773,
+    },
+  };
+}

package/src/cli/fleet-sync-remote.ts

@@ -2,7 +2,8 @@ import { createHash } from 'node:crypto';
 import { IDES } from '../ide';
 import { enabled, workerChecks } from '../ide/orchestrate';
 import { idesOf } from '../ide/definition';
-import { rememberEnvironment } from '../t3/pairing';
+import { pairIfRequested, rememberEnvironment } from '../t3/pairing';
+import { managerT3 } from '../t3/peer-link';
 import { authorizePrivilege } from './fleet-sync-privilege';
 import { authorizeVault } from './fleet-sync-vault';
 import { managerFailure } from '../manager-failure';
@@ -15,13 +16,32 @@ import { FleetUsageError } from '../errors';
 import { selectNodes } from '../config';
 import { loadRoster } from './roster';
 import { enrolledRoster } from '../definition';
+import { readParked, readWorkerStates } from '../state/workers';
+import { withoutParked } from '../worker-parking';
+import { reconcileRecords } from './fleet-sync-records';
 import type { FleetDefinition } from '../definition';
 import { fleet as definition } from '../fleet-config';
 import { synchronizeManager } from '../manager-sync';
 import { inspectBootstrap } from '../manager-sync';
-import { prepareBootstrap, bootstrapRemote } from '../remote-bootstrap';
+import {
+  prepareBootstrap,
+  bootstrapRemote,
+  readsTailnetKey,
+} from '../remote-bootstrap';
+import { secret } from '../fleet-config';
+import { fleetTailnetControl, type TailnetControl } from '../tailnet-control';
+import { discoverTailnet, type TailnetComputer } from '../tailscale';
+import { deployWorker } from './fleet-sync-worker';
+import { packagePlaybook } from '../platform/ansible';
 import { machineRoot } from './fleet-sync';
-import type { Check, Runner } from '../types';
+import {
+  blocking,
+  type Check,
+  type FleetNode,
+  type NodeReport,
+  type Runner,
+} from '../types';
+import { diagnostic } from '../diagnostics';
 import type { DeployNode, ManagerReport } from '../manager-sync';
 import type { FleetSyncOptions } from './fleet-sync';
 import type { Settings } from './settings';
@@ -39,14 +59,35 @@ export async function selected(
   if (!options.revision)
     throw new FleetUsageError('An approved source revision is required.');
   const canonical = definition;
+  // Workers whose record disappeared are retired first (planned in a
+  // preview), so they are no longer in the roster.
+  const records = await reconcileRecords(canonical, settings.config, run, {
+    apply: Boolean(options.apply),
+  });
   let roster;
   try {
-    roster = enrolledRoster(canonical, await loadRoster(settings.config));
+    const declared = new Set(canonical.workers.map((worker) => worker.id));
+    const loaded = await loadRoster(settings.config);
+    roster = enrolledRoster(canonical, {
+      ...loaded,
+      nodes: loaded.nodes.filter(
+        (node) =>
+          declared.has(node.id) ||
+          readWorkerStates().workers[node.id]?.origin !== 'records'
+      ),
+    });
   } catch {
     return enrollmentRequired(canonical, options.revision);
   }
-  const nodes = selectNodes(roster, options.node ?? []);
-  const scoped = scopeDefinition(canonical, options.node);
+  // A parked worker is not contacted and never the canary.
+  const active = withoutParked(
+    scopeDefinition(canonical, options.node),
+    selectNodes(roster, options.node ?? []),
+    readParked(),
+    new Date()
+  );
+  const { nodes, definition: scoped } = active;
+  const notes = [...records, ...active.checks];
   const ui = interfaceOptions(options);
   const planFingerprint = createHash('sha256')
     .update(
@@ -65,12 +106,16 @@ export async function selected(
         'Manager connection bindings or target policy changed after approval. Inspect a fresh plan and approve it; no source preparation or node mutation occurred.'
       )
     );
-  const payload = options.apply
+  const prepared = options.apply
     ? await prepareBootstrap(machineRoot(), options.revision, run, {
         definition: canonical,
         checkout: settings.workspace,
       })
     : null;
+  const payload =
+    prepared && options.restartBusy
+      ? { ...prepared, restartBusy: true }
+      : prepared;
   const started = Date.now();
   const report = await synchronizeManager(
     {
@@ -79,6 +124,7 @@ export async function selected(
       revision: options.revision,
       apply: Boolean(options.apply),
       ...canary(canonical, options),
+      ...serial(options),
       progress: (node, phase) => ui.progress.step(node, phase),
       finished: (node) => ui.progress.finished(node),
       manager: () =>
@@ -97,22 +143,74 @@ export async function selected(
       ...ui,
       workspace: settings.workspace,
       roster: settings.config,
+      ...rebootOptions(options),
     })
   ).finally(() => ui.progress.stop());
+  if (options.enrollment) reportEnrollment(report, options.enrollment);
+  report.checks.push(...notes);
+  // A worker that could not be retired, like any other failed check of the
+  // fleet, means the run did not converge: it is not recorded as applied.
+  if (notes.some(blocking)) report.ok = false;
   if (settle) report.checks.push(await settle(report));
   return outcome(report, planFingerprint, started);
 }
 
-/** A revision new to the fleet is proven on the first declared worker before
- * the rest; repeating one that already converged everywhere needs no canary,
- * so every worker converges at once.
+/** Maintenance reboots go one worker at a time, and a worker that does not
+ * come back ready stops the others.
+ */
+function serial(options: FleetSyncOptions): { serial?: true } {
+  return options.maintenanceReboot ? { serial: true } : {};
+}
+
+function rebootOptions(options: FleetSyncOptions): {
+  readyBefore: string[];
+  maintenanceReboot?: true;
+  force?: true;
+} {
+  return {
+    readyBefore: options.readyBefore ?? [],
+    ...(options.maintenanceReboot ? { maintenanceReboot: true } : {}),
+    ...(options.force ? { force: true } : {}),
+  };
+}
+
+/** The workers this run enrolled, and why another was not: the checks land
+ * on the worker they are about.
+ */
+export function reportEnrollment(
+  report: ManagerReport,
+  enrollment: NonNullable<FleetSyncOptions['enrollment']>
+): void {
+  report.enrolled = enrollment.enrolled;
+  for (const { node, check } of enrollment.checks) {
+    const entry = report.nodes.find((candidate) => candidate.node === node);
+    if (!entry) continue;
+    entry.checks.unshift(check);
+    entry.diagnostics = entry.checks.map((each) => diagnostic(node, each));
+    if (blocking(check)) report.ok = false;
+  }
+}
+
+/** A revision new to the fleet is proven on one worker before the rest: the
+ * one `--canary` or fleet.json names, else the first declared worker, and
+ * the next reachable one when that cannot be reached. Repeating a revision
+ * that already converged everywhere needs no canary, so every worker
+ * converges at once.
  */
 function canary(
   canonical: FleetDefinition,
   options: FleetSyncOptions
 ): { canary?: string } {
-  const first = canonical.workers[0];
-  return first && !options.rolledOut ? { canary: first.id } : {};
+  if (
+    options.canary &&
+    !canonical.workers.some((worker) => worker.id === options.canary)
+  )
+    throw new FleetUsageError(
+      '--canary names a worker fleet.json does not declare.'
+    );
+  const preferred =
+    options.canary ?? canonical.canary ?? canonical.workers[0]?.id;
+  return preferred && !options.rolledOut ? { canary: preferred } : {};
 }
 
 /** Saves the full JSON report, then renders the short human summary. */
@@ -165,8 +263,16 @@ function deployWithMonitoring(
     /** The manager's checkout, and the roster an identity is recorded in. */
     workspace: string;
     roster: string;
+    passwordLogin: boolean;
+    readyBefore: string[];
+    maintenanceReboot?: boolean;
+    force?: boolean;
   }
 ): DeployNode {
+  // Asked once per run, and only when a worker needs them.
+  let control: Promise<TailnetControl | null> | undefined;
+  let computers: Promise<TailnetComputer[]> | undefined;
+  const converge = convergeWorker(payload, canonical, run, ui);
   return async (node, revision) => {
     if (!payload || payload.revision !== revision)
       return {
@@ -183,18 +289,62 @@ function deployWithMonitoring(
           },
         ],
       };
+    return deployWorker(node, revision, {
+      definition: canonical,
+      playbook: packagePlaybook(run),
+      converge,
+      control: () =>
+        (control ??= fleetTailnetControl(canonical.tailnet, secret)),
+      computers: () =>
+        (computers ??= discoverTailnet(run).then((found) => found.computers)),
+      readyBefore: ui.readyBefore,
+      ...(ui.maintenanceReboot ? { maintenanceReboot: true } : {}),
+      ...(ui.force ? { force: true } : {}),
+      acceptsTailnetKey: readsTailnetKey(payload.script),
+    });
+  };
+}
+
+/** One converge of a worker: privilege, Vault, the bootstrap, then what is
+ * verified from the manager and the worker's monitoring.
+ */
+function convergeWorker(
+  payload: Awaited<ReturnType<typeof prepareBootstrap>>,
+  canonical: FleetDefinition,
+  run: Runner,
+  ui: {
+    progress: SyncProgress;
+    interactiveAuthorization: boolean;
+    workspace: string;
+    roster: string;
+    passwordLogin: boolean;
+  }
+) {
+  return async (
+    node: FleetNode,
+    revision: string,
+    tailnetKey?: string
+  ): Promise<NodeReport> => {
     // Password prompts need a quiet terminal: no spinner while authorizing.
     if (ui.interactiveAuthorization) {
       ui.progress.stop();
-      const checks = await authorizePrivilege(node, payload.authorizeSudo, run);
+      const checks = await authorizePrivilege(
+        node,
+        payload!.authorizeSudo,
+        run
+      );
       if (checks.length) return { node: node.id, checks };
     }
-    const vault = { interactive: ui.interactiveAuthorization };
+    const vault = {
+      interactive: ui.interactiveAuthorization,
+      passwordLogin: ui.passwordLogin,
+    };
     if (ui.interactiveAuthorization) ui.progress.stop();
     const before = await authorizeVault(node, vault, run);
     ui.progress.step(node.id, 'Converging (remote lock, install, verify)');
-    const result = await bootstrapRemote(node, payload, run, {
+    const result = await bootstrapRemote(node, payload!, run, {
       progress: (line) => ui.progress.step(node.id, line),
+      ...(tailnetKey ? { tailnetKey } : {}),
     });
     // A fresh node gets vault from the bootstrap; log it in now. Its provider
     // checks in this run predate the login, so the next sync verifies them.
@@ -212,6 +362,12 @@ function deployWithMonitoring(
         remember: async (id, identity) => {
           await rememberEnvironment(ui.roster, id, identity);
         },
+        pair: (target) =>
+          pairIfRequested(target, {
+            roster: ui.roster,
+            run,
+            manager: managerT3(run),
+          }),
       }))
     );
     if (
@@ -242,6 +398,7 @@ function scopeDefinition(canonical: FleetDefinition, ids?: string[]) {
 function interfaceOptions(options: FleetSyncOptions) {
   return {
     progress: syncProgress(!options.json),
+    passwordLogin: Boolean(options.vaultPasswordLogin),
     interactiveAuthorization: Boolean(
       options.interactiveAuthorization &&
       !options.json &&

package/src/cli/fleet-sync-schedule.ts

@@ -9,13 +9,19 @@ import {
   recordSchedule,
   type ScheduleRecord,
 } from '../state/history';
-import { scheduleCheck, SCHEDULE_INTERVAL_SECONDS } from '../schedule-check';
+import macos from '../../ansible/macos/policy.json';
+import { fleet } from '../fleet-config';
+import {
+  scheduleCheck,
+  scheduleIntervals,
+  SCHEDULE_INTERVAL_SECONDS,
+} from '../schedule-check';
 import type { Runner } from '../types';
 import type { CommandOutcome } from './contracts';
 import { machineRoot } from './fleet-sync';
 
 /** The launchd label and systemd unit already on running managers. */
-export const SCHEDULE_LABEL = 'personal-fleet-sync';
+export const SCHEDULE_LABEL = macos.fleetSync.label;
 const LABEL = SCHEDULE_LABEL;
 export type ScheduleAction =
   'enable' | 'pause' | 'resume' | 'disable' | 'status';
@@ -31,6 +37,8 @@ interface ScheduleInput {
   /** The manager's caches; tests name their own. */
   root?: string;
   now?: Date;
+  /** How often the schedule runs; `manager.schedule.syncMinutes` otherwise. */
+  intervalSeconds?: number;
 }
 
 /** The published package a schedule installs and runs: its name, exact
@@ -205,14 +213,16 @@ async function enableSchedule(
     return required(
       'The exact CLI package could not be installed in the managed manager runtime. No schedule was enabled.'
     );
+  const intervalSeconds =
+    input.intervalSeconds ?? scheduleIntervals(fleet.manager).syncSeconds;
   const result = platform.installScheduledJob({
     label: LABEL,
-    intervalSeconds: SCHEDULE_INTERVAL_SECONDS,
+    intervalSeconds,
     command: scheduledCommand(published, input.revision, prefix),
     logDir: join(root, 'logs'),
     env: scheduledEnvironment(),
   });
-  if (result.ok) remember(input, true);
+  if (result.ok) remember(input, true, intervalSeconds);
   return {
     exitCode: result.ok ? 0 : 1,
     data: {

package/src/cli/fleet-sync-state.ts

@@ -1,6 +1,6 @@
 import type { Enrollment } from '../machine/state';
 import { replicaCheck } from '../state/check';
-import { storeEnrollment } from '../state/enrollment';
+import { loadEnrollment, storeEnrollment } from '../state/enrollment';
 import { adoptEarlier } from '../state/legacy';
 import { databasePath, stateRoot } from '../state/paths';
 import { writeDocument } from '../state/store';
@@ -21,8 +21,12 @@ import type { Check } from '../types';
 export interface RunRecord {
   /** Before any machine changes: this revision is the approved one. */
   approve(): void;
-  /** Once the result is known. The check says whether the bucket holds it. */
-  settle(converged: boolean): Promise<Check>;
+  /** Once the result is known. The check says whether the bucket holds it.
+   * `applied` is the revision each worker that converged now holds: it is
+   * kept even when the fleet as a whole is not ready, and it is all a run
+   * scoped with --node records.
+   */
+  settle(ready: boolean, applied?: Record<string, string>): Promise<Check>;
   /** For a run that stopped before its result: its approval is still uploaded. */
   abandon(): Promise<void>;
 }
@@ -39,6 +43,10 @@ export function runRecord(
      * worker, a replacement manager) uses the one last applied.
      */
     definition?: string;
+    /** A run scoped with --node covers only the workers it selected: it
+     * records their revisions, never one applied for the whole fleet.
+     */
+    scoped?: boolean;
   }
 ): RunRecord {
   const env = state.env ?? process.env;
@@ -70,20 +78,33 @@ export function runRecord(
       }
       claimLease(state.context);
     },
-    async settle(converged) {
+    async settle(ready, applied = {}) {
       settled = true;
-      if (converged)
+      const converged = ready && state.scoped !== true;
+      if (converged || Object.keys(applied).length) {
+        // What was recorded since the approval stands: the run itself
+        // retires a worker whose record was removed, and another command
+        // may have. Only what this run decided is written over it.
+        const stored = (await loadEnrollment(null, env)) ?? approval;
         storeEnrollment(
           {
-            ...approval,
-            appliedRevision: revision,
-            ...(previous?.appliedRevision &&
-            previous.appliedRevision !== revision
-              ? { previousRevision: previous.appliedRevision }
+            ...stored,
+            ...(Object.keys(applied).length
+              ? { workers: { ...stored.workers, ...applied } }
+              : {}),
+            ...(converged
+              ? {
+                  appliedRevision: revision,
+                  ...(previous?.appliedRevision &&
+                  previous.appliedRevision !== revision
+                    ? { previousRevision: previous.appliedRevision }
+                    : {}),
+                }
               : {}),
           },
           env
         );
+      }
       // The fleet converged either way: a bucket problem is reported, not fatal.
       return replicaCheck(await publish().catch(() => 'unreachable' as const), {
         advisory: true,