cursedops 0.21.0 → 0.21.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.21.0",
+	"version": "0.21.1",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the check that a launchd job imports only what the LOCKED versions of its packages export (a lib-preview overlay's extra subpath or name is a job that dies at the next forced reinstall), the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/smoke.ts

@@ -932,6 +932,54 @@ export const HEALTH_READ_MAX_TIME_SEC = 10;
 /** The init a smoke's `/healthz` read carries — `cursedops/edge-fetch` honors it; a plain `fetch` ignores it. */
 const healthRead: EdgeRequestInit = { maxTimeSec: HEALTH_READ_MAX_TIME_SEC };
 
+/** How long one address's between-versions answers are asked again before they are judged. */
+export const BETWEEN_VERSIONS_MS = 60_000;
+
+/**
+ * One address's allowance for answers of the edge BETWEEN VERSIONS — a 5xx, or no answer at all —
+ * after `/healthz` has settled. Shared by every question asked of that address, so a Worker that
+ * really 500s costs one window, not one per route.
+ *
+ * 🔴 Measured 2026-10-28 (forge task 3882): auth's production-first smoke settled `/healthz` on
+ * bea42b2f three reads in a row, and in the next seconds — six `secret put`s, six versions —
+ * `/account` answered 500 on the preview while the public host gave 200, and five census routes
+ * answered 500 on the public host while the preview gave 401. Judged once each, that rolled back a
+ * deploy whose stage, on the same bytes, passed all 28 checks minutes later. `/healthz` reads no
+ * session; the routes behind the D1 snapshot were still on the turning edge.
+ *
+ * Only the window's shapes are asked again. A REAL wrong answer — a private route that answers 200,
+ * a shell that is JSON — is judged on its first read, and a 5xx that outlasts the window is red.
+ */
+interface VersionWindow {
+	/** Ask until the answer is not between versions, or the window is spent; the LAST answer is judged. */
+	settle<T>(ask: () => Promise<T>, between: (answer: T) => boolean): Promise<{ answer: T; first: T | null; waitedMs: number }>;
+}
+
+function versionWindow(options: SteadyOptions = {}): VersionWindow {
+	const sleep = options.sleep ?? ((ms: number) => new Promise<void>((done) => setTimeout(done, ms)));
+	const now = options.now ?? Date.now;
+	let opened: number | null = null;
+	return {
+		async settle(ask, between) {
+			const asked = now();
+			let first: Awaited<ReturnType<typeof ask>> | null = null;
+			for (;;) {
+				const answer = await ask();
+				if (!between(answer)) return { answer, first, waitedMs: now() - asked };
+				first ??= answer;
+				opened ??= now();
+				if (now() - opened >= BETWEEN_VERSIONS_MS) return { answer, first, waitedMs: now() - asked };
+				await sleep(options.retryMs ?? 3_000);
+			}
+		},
+	};
+}
+
+/** `, after <first> for Ns` — the row's note that an answer was asked again, so a settle is never silent. */
+function settledNote(first: unknown, waitedMs: number): string {
+	return first === null ? "" : ` (${first} first, between versions — asked again for ${Math.round(waitedMs / 1000)}s)`;
+}
+
 /** One question a deploy must answer the NEW way — `null` when it does, else why not. */
 export interface ConvergenceProbe {
 	name: string;
@@ -1154,14 +1202,21 @@ export async function runWorkerSmoke(spec: WorkerSmokeSpec): Promise<number> {
 
 		// Each probe is anonymous and refused at the gate, so it is replay-safe whatever its method,
 		// and one that gets no answer even then is this check's red — never a crash of the whole smoke.
+		const versions = versionWindow(spec.steady);
 		const open: string[] = [];
+		const settled: string[] = [];
 		for (const route of spec.census) {
 			const probe: EdgeRequestInit = { method: route.method, replaySafe: true };
-			const answered = await ask(route.path, probe).then(
-				(res) => res.status,
-				(error: Error) => `no answer (${error.message})`,
+			const { answer, first, waitedMs } = await versions.settle(
+				() =>
+					ask(route.path, probe).then(
+						(res): number | string => res.status,
+						(error: Error) => `no answer (${error.message})`,
+					),
+				(a) => typeof a === "string" || a >= 500,
 			);
-			if (answered !== 401) open.push(`${route.method} ${route.path} → ${answered}`);
+			if (answer !== 401) open.push(`${route.method} ${route.path} → ${answer}${settledNote(first, waitedMs)}`);
+			else if (first !== null) settled.push(`${route.method} ${route.path}${settledNote(first, waitedMs)}`);
 		}
 		smoke.record(
 			`${tag} origin-gate`,
@@ -1169,7 +1224,7 @@ export async function runWorkerSmoke(spec: WorkerSmokeSpec): Promise<number> {
 			spec.census.length === 0
 				? "🔴 the route census is EMPTY, so this proves nothing"
 				: open.length === 0
-					? `all ${spec.census.length} private routes refuse an anonymous caller`
+					? `all ${spec.census.length} private routes refuse an anonymous caller${settled.length ? ` — ${settled.join(", ")}` : ""}`
 					: `🔴 ${open.join(", ")}`,
 		);
 
@@ -1177,15 +1232,25 @@ export async function runWorkerSmoke(spec: WorkerSmokeSpec): Promise<number> {
 		await spec.extraChecks?.({ tag, address, ask, health, record: (check, ok, detail) => smoke.record(check, ok, detail) });
 
 		for (const path of spec.shellPaths) {
-			const res = await ask(path, { headers: { accept: "text/html" } });
+			const { answer: res, first, waitedMs } = await versions.settle(
+				() => ask(path, { headers: { accept: "text/html" } }),
+				(r) => r.status >= 500,
+			);
 			const type = res.headers.get("content-type") ?? "";
-			smoke.record(`${tag} shell ${path}`, res.status === 200 && type.includes("text/html"), `${res.status} ${type}`);
+			smoke.record(
+				`${tag} shell ${path}`,
+				res.status === 200 && type.includes("text/html"),
+				`${res.status} ${type}${settledNote(first?.status ?? null, waitedMs)}`,
+			);
 		}
-		const miss = await ask("/assets/index-no-such-bundle.js");
+		const { answer: miss, first, waitedMs } = await versions.settle(
+			() => ask("/assets/index-no-such-bundle.js"),
+			(r) => r.status >= 500,
+		);
 		smoke.record(
 			`${tag} missing-bundle`,
 			miss.status === 404 && !(miss.headers.get("content-type") ?? "").includes("text/html"),
-			`a missing bundle is a miss — ${miss.status}`,
+			`a missing bundle is a miss — ${miss.status}${settledNote(first?.status ?? null, waitedMs)}`,
 		);
 	}
 	return await smoke.settle();