querysub 0.568.0 → 0.569.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "querysub",
-  "version": "0.568.0",
+  "version": "0.569.0",
   "main": "index.js",
   "license": "MIT",
   "note1": "note on node-forge fork, see https://github.com/digitalbazaar/forge/issues/744 for details",

package/src/deployManager/components/ServiceDetailPage.tsx

@@ -82,28 +82,6 @@ export class ServiceDetailPage extends qreact.Component {
         });
     }
 
-    private confirmForceDeployNow(deployConfig: ServiceConfig) {
-        let modal: { close: () => void } | undefined;
-        modal = showModal({
-            content: <div className={css.fixed.pos(0, 0).size("100vw", "100vh").hsla(0, 0, 0, 0.5).display("flex").alignItems("center").justifyContent("center")}>
-                <div className={css.vbox(12).pad2(20).hsl(0, 0, 12).colorhsl(0, 0, 90).bord2(0, 0, 40) + " keepModalsOpen"}>
-                    <div className={css.boldStyle.fontSize(16)}>🚀 Deploy?</div>
-                    <div>{deployConfig.parameters.overlapTime
-                        ? `This config goes live now. The old instances keep running for ${formatTime(deployConfig.parameters.overlapTime)} before shutting down.`
-                        : "This config goes live now. The old instances are shut down as soon as the new ones are up, so anything still connected to them is dropped."}</div>
-                    <div className={css.hbox(10)}>
-                        <Button hue={0} onClick={() => {
-                            modal && modal.close();
-                            deployConfig.parameters.releaseTime = Date.now();
-                            this.deployConfig(deployConfig);
-                        }}>🚀 Deploy</Button>
-                        <Button onClick={() => modal && modal.close()}>Cancel</Button>
-                    </div>
-                </div>
-            </div>,
-        });
-    }
-
     // Shows the `${name}` variables found in the command, and lets each picked machine entry set its own values for them (which converts machineIds to the { machineId, variables } form).
     private renderTemplateVariables(config: ServiceConfig) {
         let templateVariables = getCommandTemplateVariables(config.parameters.command);
@@ -601,7 +579,9 @@ export class ServiceDetailPage extends qreact.Component {
                             disabled={this.state.isDeploying}
                             title="Changes the scheduled deploy to go live immediately"
                             onClick={() => {
-                                this.confirmForceDeployNow(deepCloneJSON(stripReleaseState(originalConfig)));
+                                let deployConfig = deepCloneJSON(stripReleaseState(originalConfig));
+                                deployConfig.parameters.releaseTime = Date.now();
+                                this.deployConfig(deployConfig);
                             }}>
                             ⚡ Force Schedule Now
                         </button>
@@ -656,7 +636,7 @@ export class ServiceDetailPage extends qreact.Component {
                             disabled={this.state.isDeploying}
                             title="Deploys now; the old instances keep running for the overlap before shutting down"
                             onClick={() => {
-                                this.confirmForceDeployNow(makeDeployConfig());
+                                this.deployConfig(makeDeployConfig());
                             }}>
                             {this.state.isDeploying && "⏳ Deploying..." || "🚀 Deploy"}
                         </button>
@@ -665,7 +645,7 @@ export class ServiceDetailPage extends qreact.Component {
                             disabled={this.state.isDeploying}
                             title="Deploys now AND shuts the old instances down as soon as the new ones are up (overlap of 0)"
                             onClick={() => {
-                                this.confirmForceDeployNow(makeDeployConfig(0));
+                                this.deployConfig(makeDeployConfig(0));
                             }}>
                             Deploy, No Overlap
                         </button>

package/src/deployManager/components/deployButtons.tsx

@@ -101,32 +101,6 @@ export class UpdateButtons extends qreact.Component<{
             }
         });
     }
-    private confirmDeployAllNow(outdatedServices: ServiceConfig[], latestRef: string, noOverlap: boolean) {
-        let modal: { close: () => void } | undefined;
-        modal = showFullscreenModal({
-            content: <div className={css.vbox(12).pad2(20)}>
-                <div className={css.boldStyle.fontSize(16)}>⚡ Deploy all {outdatedServices.length} services now?</div>
-                <div>{noOverlap
-                    ? "The old instances are shut down as soon as the new ones are up (overlap of 0), so anything still connected to them is dropped."
-                    : "The old instances keep running for their configured overlap before shutting down, so connections have somewhere to go while clients move across."}</div>
-                <div className={css.hbox(10)}>
-                    <button
-                        className={css.pad2(12, 8).button + (noOverlap && css.bord2(0, 90, 30).hsl(0, 85, 65).colorhsl(0, 0, 100).fontWeight("bold") || css.bord2(45, 80, 35).hsl(45, 85, 82))}
-                        onClick={() => {
-                            modal && modal.close();
-                            this.deployAll(outdatedServices, latestRef, noOverlap);
-                        }}>
-                        ⚡ Deploy Now
-                    </button>
-                    <button
-                        className={css.pad2(12, 8).button.bord2(0, 0, 20).hsl(0, 0, 100)}
-                        onClick={() => modal && modal.close()}>
-                        Cancel
-                    </button>
-                </div>
-            </div>
-        });
-    }
     render() {
         let controller = MachineServiceController(SocketFunction.browserNodeId());
         const gitInfo = controller.getGitInfo();
@@ -185,7 +159,7 @@ export class UpdateButtons extends qreact.Component<{
                     disabled={this.state.isDeploying}
                     title="Deploys now; the old instances keep running for their configured overlap before shutting down"
                     onClick={() => {
-                        this.confirmDeployAllNow(outdatedServices, gitInfo.latestRef, false);
+                        this.deployAll(outdatedServices, gitInfo.latestRef, false);
                     }}
                 >
                     <div>
@@ -205,7 +179,7 @@ export class UpdateButtons extends qreact.Component<{
                     disabled={this.state.isDeploying}
                     title="Deploys now AND shuts the old instances down as soon as the new ones are up (overlap of 0)"
                     onClick={() => {
-                        this.confirmDeployAllNow(outdatedServices, gitInfo.latestRef, true);
+                        this.deployAll(outdatedServices, gitInfo.latestRef, true);
                     }}
                 >
                     <div>

package/src/deployManager/machineApplyMainCode.ts

@@ -26,8 +26,8 @@ import { PromiseObj } from "../promise";
 import path from "path";
 import { fsExistsAsync } from "../fs";
 import { ALIVE_WINDOW_FOREVER, ParametersTimelineEntry, syncParametersTimelineFiles } from "./parametersTimeline";
-import { getScreenName, getFutureScreenName, getRetiringScreenName, getTmuxPrefix, getScreenState, isScreenRunningProcess, getProcessStartTime, ensureProcessRecord, runScreenCommand, killScreen, streamProcessOutput } from "./processManager";
-import { ProcessRecord, syncProcessRecords, writeProcessRecord, listProcessRecords, getProcessLogPath } from "./processLogs";
+import { getScreenName, getFutureScreenName, getTmuxPrefix, getScreenState, isScreenRunningProcess, getProcessStartTime, ensureProcessRecord, runScreenCommand, killScreen, streamProcessOutput, readServiceNodeId, removeServiceNode, takeoverScreen, scheduleTakeover } from "./processManager";
+import { ProcessRecord, syncProcessRecords, writeProcessRecord, listProcessRecords, findRunningRecord, getProcessLogPath } from "./processLogs";
 
 
 
@@ -137,17 +137,6 @@ async function notifyNodeShutdown(screenName: string, nodeId: string, time: numb
         console.warn(`Error notifying ${screenName} (${nodeId}) of its scheduled shutdown (will retry on the next resync): ${e.stack}`);
     }
 }
-async function notifyServiceShutdown(screenName: string, time: number) {
-    if (notifiedShutdowns.get(screenName) === time) return;
-    let nodeIdFile = os.homedir() + "/" + SERVICE_FOLDER + screenName + "/" + SERVICE_NODE_FILE_NAME;
-    if (!await fsExistsAsync(nodeIdFile)) {
-        console.log(`No nodeId file found for ${screenName}, cannot notify it of its scheduled shutdown yet (will retry on the next resync)`);
-        return;
-    }
-    let nodeId = await fs.promises.readFile(nodeIdFile, "utf8");
-    await notifyNodeShutdown(screenName, nodeId, time);
-}
-
 
 
 
@@ -233,14 +222,13 @@ let lastLaunchedTimePerService = new Map<string, number>();
 
 const RELEASE_PREP_LEAD_TIME = timeInSecond * 30;
 
-// In-memory only: the old process's nodeId, captured just before the future instance starts (the new process overwrites the shared folder's nodeId file), so the old node can be force-removed when its screen is finally killed. Lost on apply restart, which is fine — node discovery times dead nodes out anyway.
-let takeoverOldNodeIds = new Map<string, string>();
-
 // Syncs the canonical folder to the new parameters (git + yarn install + parameters.json) and creates the future screen, which just echos when it will start. Idempotent.
 type FutureConfig = {
     canonicalScreenName: string;
     next: ServiceParameters;
     releaseTime: number;
+    /** When the old process's overlap runs out, so the takeover can be scheduled the moment the new one starts */
+    killTime: number;
     serviceId: string;
     index: number;
     machineId: string;
@@ -306,11 +294,6 @@ async function ensureFutureStarted(config: FutureConfig) {
     }
     await ensureFuturePrepared(config);
     let folder = os.homedir() + "/" + SERVICE_FOLDER + canonicalScreenName + "/";
-    let nodeIdFile = folder + SERVICE_NODE_FILE_NAME;
-    // Only the FIRST start can trust the file to hold the old process's nodeId — on a future-instance crash + restart it may already hold the future's own nodeId
-    if (!takeoverOldNodeIds.has(canonicalScreenName) && await fsExistsAsync(nodeIdFile)) {
-        takeoverOldNodeIds.set(canonicalScreenName, await fs.promises.readFile(nodeIdFile, "utf8"));
-    }
     console.log(green(`Starting future instance ${magenta(futureScreenName)} (release time reached)`));
     await runScreenCommand({
         screenName: futureScreenName,
@@ -324,9 +307,11 @@ async function ensureFutureStarted(config: FutureConfig) {
             parameters: next,
         },
     });
+    // The old process's overlap is counted from here, not from whenever a resync next comes around
+    scheduleTakeover({ canonicalScreenName, folder, killTime: config.killTime });
 }
 
-// Kills the old canonical screen (if any) and renames the future screen to the canonical name. The rename leaves the new process completely untouched, so the takeover is seamless. No-op when there is no future screen.
+/** The loop's route into the takeover: the timer scheduled at launch normally gets there first, and this is what catches up if we restarted and lost it. The takeover itself is shared, and locked, so the two can't interleave. */
 async function takeoverFutureScreen(config: {
     canonicalScreenName: string;
     screenNamesUsed: Set<string>;
@@ -336,35 +321,15 @@ async function takeoverFutureScreen(config: {
     let futureScreenName = getFutureScreenName(canonicalScreenName);
     let future = screenStateMap.get(futureScreenName);
     if (!future) return;
-    // The rename makes the future name vanish, but the caller's original screen list still has it — mark it used so the unused-screen cleanup doesn't try to kill a nonexistent session
+    // The renames make both the future and the retiring names vanish from the caller's screen list, so the unused-screen sweep must not try to kill them
     config.screenNamesUsed.add(futureScreenName);
-    if (screenStateMap.has(canonicalScreenName)) {
-        // The old screen is moved aside rather than waited on: the canonical name is free immediately, and its shutdown (Ctrl+C, then the hard kill) runs on its own without holding up this service or the next one.
-        let retiringScreenName = getRetiringScreenName(canonicalScreenName, Date.now());
-        let prefix = getTmuxPrefix();
-        await runPromise(`${prefix}tmux rename-session -t ${canonicalScreenName} ${retiringScreenName}`);
-        screenStateMap.delete(canonicalScreenName);
-        // Kept out of the unused-screen sweep, which would kill it a second time while it is already winding down
-        config.screenNamesUsed.add(retiringScreenName);
-        void killScreen({ screenName: retiringScreenName, skipNodeIdRemoval: true });
-        let oldNodeId = takeoverOldNodeIds.get(canonicalScreenName);
-        if (oldNodeId) {
-            void forceRemoveNode(oldNodeId);
-        }
-    }
-    takeoverOldNodeIds.delete(canonicalScreenName);
-    let prefix = getTmuxPrefix();
-    console.log(green(`Renaming future screen ${magenta(futureScreenName)} to ${magenta(canonicalScreenName)} (takeover complete)`));
-    await runPromise(`${prefix}tmux rename-session -t ${futureScreenName} ${canonicalScreenName}`);
+    let tookOver = await takeoverScreen({
+        canonicalScreenName,
+        folder: os.homedir() + "/" + SERVICE_FOLDER + canonicalScreenName + "/",
+    });
+    if (!tookOver) return;
     screenStateMap.set(canonicalScreenName, { ...future, screenName: canonicalScreenName });
     screenStateMap.delete(futureScreenName);
-    // Nothing to do to the logs: the future process has been writing to its own file all along, and keeps writing to it under the new session name. Its record still names the future session though, so point it at the name it now runs under.
-    let folder = os.homedir() + "/" + SERVICE_FOLDER + canonicalScreenName + "/";
-    for (let record of await listProcessRecords()) {
-        if (record.folder !== folder || record.screenName !== futureScreenName || record.deadTime !== undefined) continue;
-        record.screenName = canonicalScreenName;
-        await writeProcessRecord(record);
-    }
 }
 
 function sameRestartParameters(prevParametersJSON: string, next: ServiceParameters): boolean {
@@ -449,9 +414,9 @@ const resyncServicesBase = runInSerial(measureWrap(async function resyncServices
                 let canonicalScreenName = getScreenName({ serviceKey: record.parameters.key, index: i });
                 try {
                     if (isOverlapTime) {
-                        await ensureFutureStarted({ canonicalScreenName, next, releaseTime, serviceId: record.serviceId, index: i, machineId, screenNamesUsed, screenStateMap });
+                        await ensureFutureStarted({ canonicalScreenName, next, releaseTime, killTime, serviceId: record.serviceId, index: i, machineId, screenNamesUsed, screenStateMap });
                     } else {
-                        await ensureFuturePrepared({ canonicalScreenName, next, releaseTime, serviceId: record.serviceId, index: i, machineId, screenNamesUsed, screenStateMap });
+                        await ensureFuturePrepared({ canonicalScreenName, next, releaseTime, killTime, serviceId: record.serviceId, index: i, machineId, screenNamesUsed, screenStateMap });
                     }
                     // The canonical loop below writes the timeline, but it is skipped entirely when the OLD parameters aren't deployed (a release that turns deploy on). The new instance would then run with no timeline file saying when it takes over, so it is written here instead. The old parameters aren't running, so the future entry is the whole timeline.
                     if (!config.parameters.deploy) {
@@ -519,15 +484,14 @@ const resyncServicesBase = runInSerial(measureWrap(async function resyncServices
                 };
 
                 if (releaseInFlight) {
-                    // Tell the running instance when it will be shut down, so it (and everything talking to it) can wind down gracefully. Fire and forget: it is a courtesy to the process, and nothing about taking it down may wait on a call to the process we are taking down. Once the future instance may have started, the folder's nodeId file can belong to the NEW process, so from then on only the stashed old nodeId is safe to notify.
-                    if (!isOverlapTime) {
-                        void notifyServiceShutdown(screenName, killTime);
-                    } else {
-                        let oldNodeId = takeoverOldNodeIds.get(screenName);
-                        if (oldNodeId) {
-                            void notifyNodeShutdown(screenName, oldNodeId, killTime);
+                    // Tell the running instance when it will be shut down, so it (and everything talking to it) can wind down gracefully. Fire and forget: it is a courtesy to the process, and nothing about taking it down may wait on a call to the process we are taking down. The node comes off its own record, which was taken before any replacement could overwrite the folder's file.
+                    void (async () => {
+                        let running = await findRunningRecord(folder, screenName);
+                        let nodeId = running?.nodeId || await readServiceNodeId(folder);
+                        if (nodeId) {
+                            await notifyNodeShutdown(screenName, nodeId, killTime);
                         }
-                    }
+                    })();
                 } else {
                     // A finished release's future screen takes over here: kill the old screen, rename the future one — the new process itself is untouched, so the normal logic below just verifies it
                     await takeoverFutureScreen({ canonicalScreenName: screenName, screenNamesUsed, screenStateMap });
@@ -702,9 +666,15 @@ const resyncServicesBase = runInSerial(measureWrap(async function resyncServices
     for (let { screenName } of screenState) {
         if (screenNamesUsed.has(screenName)) continue;
         // Detached, so a screen that takes its full grace period to go down doesn't hold up the end of the resync
-        void killScreen({
-            screenName,
-        });
+        void (async () => {
+            // Nothing is replacing this one, so its registration and the file it wrote both go
+            let folder = root + screenName + "/";
+            let nodeId = (await findRunningRecord(folder, screenName))?.nodeId || await readServiceNodeId(folder);
+            if (nodeId) {
+                await removeServiceNode({ folder, nodeId, ownsFile: true });
+            }
+            await killScreen({ screenName });
+        })();
     }
 
     scheduleReleaseResync(upcomingReleases);

package/src/deployManager/processLogs.ts

@@ -30,6 +30,8 @@ export type ProcessRecord = {
     machineId: string;
     /** The start time the OS reports for the pid, which is also half of the launchId */
     startTime: number;
+    /** The node this process registered as, read out of the folder before any replacement is started - after that the file belongs to the replacement. Kept here so taking this process down needs nothing but its own record. */
+    nodeId?: string;
     /** When we first noticed the process was gone. Absent while it is running. */
     deadTime?: number;
     pid?: number;
@@ -99,6 +101,13 @@ while true; do
 done`;
 }
 
+/** The record of whatever process is currently running in a screen, if we have one. */
+export async function findRunningRecord(folder: string, screenName: string): Promise<ProcessRecord | undefined> {
+    return (await listProcessRecords()).find(x =>
+        x.folder === folder && x.screenName === screenName && x.deadTime === undefined
+    );
+}
+
 export async function writeProcessRecord(record: ProcessRecord): Promise<void> {
     await fs.promises.mkdir(path.join(record.folder, PROCESS_FOLDER), { recursive: true });
     await fs.promises.writeFile(getRecordPath(record.folder, record.launchId), JSON.stringify(record));

package/src/deployManager/processManager.ts

@@ -13,7 +13,8 @@ import { forceRemoveNode } from "../-f-node-discovery/NodeDiscovery";
 import { fsExistsAsync } from "../fs";
 import { PromiseObj } from "../promise";
 import { SERVICE_FOLDER, SERVICE_NODE_FILE_NAME } from "./machineSchema";
-import { ProcessRecord, createLaunchId, getLogPipeScript, getLogTailScript, getProcessLogPath, getPipeScriptPath, getTailScriptPath, listProcessRecords, writeProcessRecord } from "./processLogs";
+import { ProcessRecord, createLaunchId, getLogPipeScript, getLogTailScript, getProcessLogPath, getPipeScriptPath, getTailScriptPath, listProcessRecords, findRunningRecord, writeProcessRecord } from "./processLogs";
+import { setPreciseTimeout } from "../misc";
 
 // Running, inspecting and killing the tmux screens services run in. This layer only knows "here is a configuration, run it" - which version should be running when is the deploy logic's problem.
 
@@ -34,14 +35,45 @@ export function getFutureScreenName(canonicalScreenName: string): string {
 }
 
 
-async function removeOldNodeId(screenName: string) {
-    let nodeIdFile = os.homedir() + "/" + SERVICE_FOLDER + screenName + "/" + SERVICE_NODE_FILE_NAME;
-    if (await fsExistsAsync(nodeIdFile)) {
-        let nodeId = await fs.promises.readFile(nodeIdFile, "utf8");
-        console.log(green(`Removing node if for dead service on ${nodeIdFile}, node id ${nodeId}`));
-        await fs.promises.unlink(nodeIdFile);
-        await forceRemoveNode(nodeId);
+// Everything that touches a service's screens - the resync loop, and the timer that retires the old process at its kill time - runs under this, keyed by the canonical screen name. They fire at similar times by design, and a takeover is a rename dance that must not interleave with another one.
+const screenLocks = new Map<string, Promise<unknown>>();
+export function withScreenLock<T>(canonicalScreenName: string, run: () => Promise<T>): Promise<T> {
+    let previous = screenLocks.get(canonicalScreenName) || Promise.resolve();
+    let next = previous.then(run, run);
+    // Failures release the lock rather than poisoning every later operation on this screen
+    screenLocks.set(canonicalScreenName, next.then(() => { }, () => { }));
+    return next;
+}
+
+/** Whether a session exists, without listing every session and its panes - the takeover already knows the exact names it cares about. */
+async function screenExists(screenName: string): Promise<boolean> {
+    let prefix = getTmuxPrefix();
+    try {
+        await runPromise(`${prefix}tmux has-session -t ${screenName}`, { quiet: true });
+        return true;
+    } catch {
+        // has-session exits non-zero for "no such session", which is an answer, not a failure
+        return false;
+    }
+}
+
+/** The node the process in this folder registered as. Read it BEFORE starting a replacement in the same folder - once the replacement starts, the file is the replacement's. */
+export async function readServiceNodeId(folder: string): Promise<string | undefined> {
+    let nodeIdFile = path.join(folder, SERVICE_NODE_FILE_NAME);
+    if (!await fsExistsAsync(nodeIdFile)) return undefined;
+    return await fs.promises.readFile(nodeIdFile, "utf8");
+}
+
+/** Drops a process's node registration. The file is only removed when it is still that process's - a replacement has its own registration in the same file. */
+export async function removeServiceNode(config: { folder: string; nodeId: string; ownsFile: boolean }): Promise<void> {
+    console.log(green(`Removing the node registration ${config.nodeId} for the process in ${config.folder}`));
+    if (config.ownsFile) {
+        let nodeIdFile = path.join(config.folder, SERVICE_NODE_FILE_NAME);
+        if (await fsExistsAsync(nodeIdFile)) {
+            await fs.promises.unlink(nodeIdFile);
+        }
     }
+    await forceRemoveNode(config.nodeId);
 }
 
 export const getTmuxPrefix = lazy(() => {
@@ -195,9 +227,17 @@ export const runScreenCommand = measureWrap(async function runScreenCommand(conf
     }
     await runPromise(`${prefix}tmux new -s ${screenName} -d`);
 
-    await removeOldNodeId(screenName);
     let folder = config.folder || os.homedir() + "/" + SERVICE_FOLDER + screenName + "/";
 
+    // Read the outgoing process's node id onto its own record BEFORE this launch overwrites the file. Whoever takes that process down then has everything it needs on the record, instead of us having to remember not to touch a file that stopped being its own.
+    let outgoingNodeId = await readServiceNodeId(folder);
+    if (outgoingNodeId) {
+        for (let record of await listProcessRecords()) {
+            if (record.folder !== folder || record.deadTime !== undefined || record.nodeId) continue;
+            await writeProcessRecord({ ...record, nodeId: outgoingNodeId });
+        }
+    }
+
     // The pane we are about to run the command in identifies the process: its pid, and the start time the OS reports for that pid. Both can be re-checked against the machine later, so nothing downstream has to trust our bookkeeping about what is still running. The session was just created, so this pid is always new.
     let panePid = (await getScreenState(false)).find(x => x.screenName === screenName)?.pid;
     if (!panePid) {
@@ -267,10 +307,60 @@ async function setupPipePane(config: { screenName: string; folder: string; launc
     await runPromise(`${prefix}tmux pipe-pane -t ${config.screenName} 'bash ${pipeScript}'`);
 }
 
+/** Retires whatever is running under the canonical name and renames the future screen onto it. Everything it needs is derived from the two names, so it costs two `has-session` checks - the kill time is when this runs, not when a resync gets around to it. Returns whether there was a future screen to take over. */
+export async function takeoverScreen(config: { canonicalScreenName: string; folder: string }): Promise<boolean> {
+    let { canonicalScreenName, folder } = config;
+    return await withScreenLock(canonicalScreenName, async () => {
+        let futureScreenName = getFutureScreenName(canonicalScreenName);
+        if (!await screenExists(futureScreenName)) return false;
+        let prefix = getTmuxPrefix();
+        if (await screenExists(canonicalScreenName)) {
+            let retiringScreenName = getRetiringScreenName(canonicalScreenName, Date.now());
+            // Its record carries the node it registered as, taken before the replacement started - the file in the folder belongs to the replacement now, so it is left alone
+            let outgoing = await findRunningRecord(folder, canonicalScreenName);
+            await runPromise(`${prefix}tmux rename-session -t ${canonicalScreenName} ${retiringScreenName}`);
+            if (outgoing) {
+                await writeProcessRecord({ ...outgoing, screenName: retiringScreenName });
+                if (outgoing.nodeId) {
+                    void removeServiceNode({ folder, nodeId: outgoing.nodeId, ownsFile: false });
+                }
+            }
+            // Detached: the canonical name is already free, so nothing waits on the old process winding down
+            void killScreen({ screenName: retiringScreenName });
+        }
+        console.log(green(`Renaming future screen ${futureScreenName} to ${canonicalScreenName} (takeover complete)`));
+        await runPromise(`${prefix}tmux rename-session -t ${futureScreenName} ${canonicalScreenName}`);
+        let incoming = await findRunningRecord(folder, futureScreenName);
+        if (incoming) {
+            await writeProcessRecord({ ...incoming, screenName: canonicalScreenName });
+        }
+        return true;
+    });
+}
+
+// canonical screen name -> the takeover we already have scheduled for it
+const scheduledTakeovers = new Map<string, { time: number; cancel: () => void }>();
+
+/** Schedules the takeover for the moment the old process's overlap runs out. The resync loop still does the same takeover whenever it notices the time has passed, which is what recovers this if we restart and lose the timer. */
+export function scheduleTakeover(config: { canonicalScreenName: string; folder: string; killTime: number }): void {
+    let { canonicalScreenName, folder, killTime } = config;
+    let existing = scheduledTakeovers.get(canonicalScreenName);
+    if (existing?.time === killTime) return;
+    existing?.cancel();
+    console.log(green(`Scheduling the takeover of ${canonicalScreenName} for ${new Date(killTime).toISOString()}`));
+    let cancel = setPreciseTimeout({
+        time: killTime,
+        callback: () => {
+            scheduledTakeovers.delete(canonicalScreenName);
+            void takeoverScreen({ canonicalScreenName, folder });
+        },
+    });
+    scheduledTakeovers.set(canonicalScreenName, { time: killTime, cancel });
+}
+
+// Kills a screen and nothing else. Which node the process registered as, and whether that registration should be dropped, is the deploy logic's business - it reads the node id off the process's record, which was taken before any replacement could overwrite the file.
 export const killScreen = measureWrap(async function killScreen(config: {
     screenName: string;
-    // During a takeover the folder's nodeId file already belongs to the NEW process, so the old screen's kill must not remove it
-    skipNodeIdRemoval?: boolean;
 }) {
     console.log(red(`Killing screen ${config.screenName} (Ctrl+C, then killing the session in ${formatTime(SHUTDOWN_GRACE_TIME)})`));
     let prefix = getTmuxPrefix();
@@ -278,9 +368,6 @@ export const killScreen = measureWrap(async function killScreen(config: {
     await runPromise(`${prefix}tmux send-keys -t ${config.screenName} 'C-c' Enter`);
     await delay(SHUTDOWN_GRACE_TIME);
     await runPromise(`${prefix}tmux kill-session -t ${config.screenName}`);
-    if (!config.skipNodeIdRemoval) {
-        await removeOldNodeId(config.screenName);
-    }
 });
 
 /** Streams one process's log: everything already in it, then everything appended after. One process, one file - nothing here has to reason about which process a byte came from. */