rollbridge 0.1.11 → 0.1.13

package/README.md

@@ -399,6 +399,22 @@ Start the daemon:
 rollbridge daemon --config rollbridge.js
 ```
 
+Start the daemon and bootstrap an exact prepared release before leaving it in
+the foreground (for example from a boot-time service manager):
+
+```bash
+rollbridge daemon --config /srv/ticket-server/rollbridge.js \
+  --release-path /srv/ticket-server/releases/20260813090000/ticket-server \
+  --release-id 20260813090000 --revision abc123
+```
+
+The four bootstrap inputs are all-or-nothing and use absolute config/release
+paths. Rollbridge binds its proxy and control listeners, activates the release
+through the normal deploy path, and stays foreground. A failed activation stops
+only processes started by that attempt and exits non-zero; persisted processes
+from a previous daemon are reported as orphans and are never recovered or killed
+implicitly; their live PID records remain in `statePath` for explicit recovery.
+
 Start the daemon only when it is not already running:
 
 ```bash
@@ -543,8 +559,12 @@ so its output goes to the journal (`journalctl -u rollbridge`). Key directives:
 The daemon is long-lived and survives deploys. **Deploy with
 `rollbridge deploy` (or `rollbridge deploy --ensure-daemon`), not
 `systemctl restart`** — pointing `--config` at a stable, daemon-wide file while
-release paths are passed per deploy. Use `command -v rollbridge` to find the
-absolute CLI path for `ExecStart`.
+release paths are passed per deploy. The daemon reloads compatible process and
+lifecycle config before each deploy, so updated graceful-stop deadlines govern
+the release being retired without interrupting the stable proxy. Listener and
+process-topology changes still require a daemon restart; see
+[`docs/config.md`](docs/config.md#config-reloads). Use `command -v rollbridge`
+to find the absolute CLI path for `ExecStart`.
 
 See [`docs/logging.md`](docs/logging.md) for where the daemon's JSON logs go
 (stdout / journald / the `--daemon-log-path` file) and how to rotate them — the

package/docs/cli.md

@@ -24,6 +24,7 @@ process-policy details.
 
 ```
 rollbridge daemon [--config <path>]
+                  [--release-path <path> --release-id <id> --revision <sha>]
 ```
 
 Runs the supervisor in the foreground: binds the stable proxy port and the
@@ -32,6 +33,28 @@ processes, closes the servers, removes the control socket, and exits `0`.
 Structured JSON log lines are written to stdout. Run it under a process manager
 such as systemd (see `examples/rollbridge.service`).
 
+For boot/crash recovery, pass an explicit absolute `--config` and all three
+release options together. Rollbridge validates every bootstrap input before it
+binds listeners or starts processes, then binds the listeners and activates that
+exact release through the same deploy path used by the control socket: services,
+companions, the proxied process and health check, traffic switching, singletons,
+and service-template refresh. It then remains in the foreground with the normal
+signal behavior.
+
+Bootstrap paths must be absolute and normalized, the release path must be an
+accessible directory, and release id/revision values accept letters, numbers,
+dots, underscores, and hyphens (maximum 200 characters, beginning with a letter
+or number). Supplying only some bootstrap options, or an invalid value, exits
+non-zero before listeners start. Activation failure emits a structured
+`bootstrap activation failed` event, cleans up processes owned by that attempt,
+and exits non-zero without inventing an active release. `statePath` entries from
+a previous daemon remain advisory orphans: bootstrap never runs recovery and
+never signals those processes, and retains their live PID records in `statePath`
+for explicit recovery.
+
+With no release options, daemon behavior is unchanged: it starts listener-only
+and waits for control-socket deployments.
+
 ## `ensure-daemon`
 
 ```
@@ -72,6 +95,14 @@ traffic to it, then drains and stops the previous release. Prints
 If the new release fails to start or health-check, the previous release stays
 active and the command errors.
 
+Before each deploy, the daemon reloads the config path it was started with.
+Compatible process and lifecycle changes apply to the new release and govern
+how the previous release retires, including updated `nonBlockingDrain`,
+`stopSignal`, `lifecycle`, and `gracefulStopMs` settings. The daemon adopts the
+new config only after the replacement release starts successfully. Changes to
+daemon-owned listeners or process topology fail the deploy with a restart
+instruction; see [Config reloads](config.md#config-reloads).
+
 - `--release-path <path>` (**required**) — path to the prepared release
   directory; available to process templates as `{{releasePath}}`.
 - `--release-id <id>` — identifier for the release. Defaults to `--revision`,

package/docs/config.md

@@ -17,6 +17,28 @@ export default {
 }
 ```
 
+## Config reloads
+
+The daemon reloads the config file it was started with before every deploy and
+rollback. Compatible changes apply to the replacement release, daemon-wide
+service restart definitions, and the retirement of the previous release. This
+means changes to process commands, environment, health checks, lifecycle hooks,
+`nonBlockingDrain`, stop signals, graceful-stop timeouts, restart policies, and
+memory supervision do not require restarting the stable proxy daemon. Updated
+retirement settings also apply to processes that were started by the previous
+release.
+
+The replacement config is adopted only after the new release starts and passes
+its health check. Invalid config, an incompatible change, or a failed release
+leaves the previous config and release active.
+
+Settings that own daemon listeners or change the managed-process topology still
+require a daemon restart: `application`, `control`, `statePath`, `proxy.host`,
+`proxy.port`, `proxy.upstreamHost`, and changes to process ids, count, `policy`,
+`deployStrategy`, `replicas`, or `port`. A deploy with one of these changes
+fails before starting the replacement and names the settings that require a
+restart.
+
 ## Top-level fields
 
 | Field | Type | Default | Description |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rollbridge",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Zero-downtime process supervisor and local traffic switcher for deploy-managed apps.",
   "keywords": [
     "deploy",

package/src/cli.js

@@ -30,10 +30,14 @@ export async function runCli(argv) {
   program
     .command("daemon")
     .option("-c, --config <path>", "Config file path (defaults to rollbridge.js)")
+    .option("--release-path <path>", "Bootstrap release path (requires --config, --release-id, and --revision)")
+    .option("--release-id <id>", "Bootstrap release id (requires --config, --release-path, and --revision)")
+    .option("--revision <sha>", "Bootstrap revision (requires --config, --release-path, and --release-id)")
     .action(async (options) => {
+      const bootstrap = await validateDaemonBootstrapOptions(options)
       const configPath = await resolveConfigPath(options.config)
       const config = await loadConfig(configPath)
-      const daemon = new RollbridgeDaemon({config})
+      const daemon = new RollbridgeDaemon({config, configPath})
 
       await daemon.start()
 
@@ -44,6 +48,17 @@ export async function runCli(argv) {
 
       process.once("SIGINT", () => { void shutdown() })
       process.once("SIGTERM", () => { void shutdown() })
+
+      if (bootstrap) {
+        try {
+          await daemon.deploy(bootstrap)
+        } catch {
+          daemon.logger("bootstrap activation failed", {releaseId: bootstrap.releaseId, status: "error"})
+          await daemon.shutdown()
+          process.exitCode = 1
+          return
+        }
+      }
     })
 
   program
@@ -696,6 +711,49 @@ async function validateConfigFile(configPath) {
   }
 }
 
+/**
+ * Validates the daemon's optional all-or-nothing bootstrap release interface before
+ * config loading or listener startup.
+ * @param {{config?: string, releaseId?: string, releasePath?: string, revision?: string}} options - Daemon CLI options.
+ * @returns {Promise<{releaseId: string, releasePath: string, revision: string} | undefined>} Validated bootstrap metadata.
+ */
+async function validateDaemonBootstrapOptions(options) {
+  const bootstrapValues = [options.releasePath, options.releaseId, options.revision]
+  const bootstrapRequested = bootstrapValues.some((value) => value !== undefined)
+
+  if (!bootstrapRequested) return undefined
+
+  if (!options.config || bootstrapValues.some((value) => value === undefined)) {
+    throw new Error("Daemon bootstrap options --config, --release-path, --release-id, and --revision must be provided together.")
+  }
+
+  if (!path.isAbsolute(options.config)) throw new Error("Daemon bootstrap --config must be an absolute path.")
+  if (path.normalize(options.config) !== options.config) throw new Error("Daemon bootstrap --config must be normalized and must not contain unsafe traversal segments.")
+  if (!path.isAbsolute(/** @type {string} */ (options.releasePath))) throw new Error("Daemon bootstrap --release-path must be an absolute path.")
+  if (path.normalize(/** @type {string} */ (options.releasePath)) !== options.releasePath) throw new Error("Daemon bootstrap --release-path must be normalized and must not contain unsafe traversal segments.")
+
+  const releaseId = /** @type {string} */ (options.releaseId)
+  const revision = /** @type {string} */ (options.revision)
+  const safeIdentifier = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/
+
+  if (!safeIdentifier.test(releaseId)) throw new Error("Daemon bootstrap --release-id must be a non-empty safe identifier containing only letters, numbers, dots, underscores, and hyphens.")
+  if (!safeIdentifier.test(revision)) throw new Error("Daemon bootstrap --revision must be a non-empty safe identifier containing only letters, numbers, dots, underscores, and hyphens.")
+
+  let releaseStat
+
+  try {
+    releaseStat = await fsPromises.stat(/** @type {string} */ (options.releasePath))
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error)
+
+    throw new Error(`Daemon bootstrap --release-path is not accessible: ${reason}`, {cause: error})
+  }
+
+  if (!releaseStat.isDirectory()) throw new Error("Daemon bootstrap --release-path must name a directory.")
+
+  return {releaseId, releasePath: /** @type {string} */ (options.releasePath), revision}
+}
+
 /**
  * Starts a daemon when needed and waits until it accepts status commands.
  * @param {object} args - Options.

package/src/config.js

@@ -1,6 +1,8 @@
 // @ts-check
 
 import fs from "node:fs/promises"
+import {createHash} from "node:crypto"
+import {createRequire} from "node:module"
 import os from "node:os"
 import path from "node:path"
 import {pathToFileURL} from "node:url"
@@ -27,6 +29,7 @@ import {pathToFileURL} from "node:url"
 
 const PROCESS_POLICIES = new Set(["proxied", "companion", "singleton", "service"])
 const DEFAULT_CONFIG_FILENAMES = ["rollbridge.js"]
+const commonJsRequire = createRequire(import.meta.url)
 
 /**
  * Imports a JavaScript config module without validating it.
@@ -38,7 +41,13 @@ const DEFAULT_CONFIG_FILENAMES = ["rollbridge.js"]
  */
 export async function parseConfigFile(configPath) {
   const absolutePath = path.resolve(configPath)
-  const moduleNamespace = await import(pathToFileURL(absolutePath).href)
+  const configUrl = pathToFileURL(absolutePath)
+  const configSource = await fs.readFile(absolutePath)
+
+  configUrl.searchParams.set("rollbridgeConfig", createHash("sha256").update(configSource).digest("hex"))
+  delete commonJsRequire.cache[commonJsRequire.resolve(absolutePath)]
+
+  const moduleNamespace = await import(configUrl.href)
   const exported = moduleNamespace.default
 
   if (exported === undefined) {

package/src/daemon.js

@@ -3,7 +3,9 @@
 import fs from "node:fs/promises"
 import http from "node:http"
 import net from "node:net"
+import {isDeepStrictEqual} from "node:util"
 import httpProxy from "http-proxy"
+import {loadConfig} from "./config.js"
 import EventLog from "./event-log.js"
 import ReleaseGroup from "./release-group.js"
 import {clearState, isProcessAlive, liveProcesses, readState, writeState} from "./state-store.js"
@@ -23,10 +25,12 @@ export default class RollbridgeDaemon {
   /**
    * @param {object} args - Options.
    * @param {import("./config.js").RollbridgeConfig} args.config - Rollbridge config.
+   * @param {string} [args.configPath] - Config file path to reload before deploys.
    * @param {(message: string, data?: Record<string, JsonValue>) => void} [args.logger] - Logger.
    */
-  constructor({config, logger}) {
+  constructor({config, configPath, logger}) {
     this.config = config
+    this.configPath = configPath
     this.eventLog = new EventLog(EVENT_HISTORY_LIMIT)
 
     const baseLogger = logger || ((message, data = {}) => console.log(JSON.stringify({at: new Date().toISOString(), data, message})))
@@ -52,6 +56,7 @@ export default class RollbridgeDaemon {
     this.statePath = config.statePath
     this.persistTimer = /** @type {ReturnType<typeof setInterval> | undefined} */ (undefined)
     this.pendingWrite = /** @type {Promise<void> | undefined} */ (undefined)
+    this.startingReleases = /** @type {Set<ReleaseGroup>} */ (new Set())
     // Still-alive managed processes left by a previous daemon (from statePath), captured at
     // startup and surfaced in status(). The daemon cannot re-manage them, only report them.
     this.orphans = /** @type {{id: string, pid: number, releaseId: string | null}[]} */ ([])
@@ -319,30 +324,42 @@ export default class RollbridgeDaemon {
   async deploy({releaseId, releasePath, revision}) {
     if (this.stopping) throw new Error("Rollbridge is shutting down")
 
+    const nextConfig = this.configPath ? await loadConfig(this.configPath) : this.config
+
+    this.assertReloadCompatible(nextConfig)
+
     const newReleaseId = releaseId || revision || new Date().toISOString().replace(/[^0-9]/g, "")
     const release = new ReleaseGroup({
-      config: this.config,
+      config: nextConfig,
       logger: this.logger,
       releaseId: newReleaseId,
       releasePath,
       revision,
-      servicePorts: this.servicePorts
+      servicePorts: this.servicePorts,
+      shouldStart: () => !this.stopping
     })
 
     this.logger("deploy starting", {releaseId: newReleaseId, releasePath, revision})
     const startedServices = /** @type {string[]} */ ([])
 
+    this.startingReleases.add(release)
+
     try {
       await this.ensureServices(release, startedServices)
       await release.start()
+      if (this.stopping) throw new Error("Rollbridge is shutting down")
     } catch (error) {
       this.logger("deploy failed", {error: error instanceof Error ? error.message : String(error), releaseId: newReleaseId})
+      await release.stop()
       await this.stopStartedServices(startedServices)
       throw error
+    } finally {
+      this.startingReleases.delete(release)
     }
 
     const previousRelease = this.activeRelease
 
+    this.config = nextConfig
     this.releases.set(release.releaseId, release)
     release.activate()
     this.activeRelease = release
@@ -352,7 +369,7 @@ export default class RollbridgeDaemon {
     await this.replaceSingletons(release)
 
     if (previousRelease) {
-      void this.drainAndPrune(previousRelease)
+      void this.drainAndPrune(previousRelease, nextConfig)
     }
 
     this.persistState()
@@ -363,6 +380,45 @@ export default class RollbridgeDaemon {
     }
   }
 
+  /**
+   * Rejects config changes that require rebinding daemon-owned resources or changing process topology.
+   * @param {import("./config.js").RollbridgeConfig} nextConfig - Freshly loaded config.
+   * @returns {void}
+   */
+  assertReloadCompatible(nextConfig) {
+    /** @type {string[]} */
+    const restartRequired = []
+
+    if (nextConfig.application !== this.config.application) restartRequired.push("application")
+    if (!isDeepStrictEqual(nextConfig.control, this.config.control)) restartRequired.push("control")
+    if (nextConfig.statePath !== this.config.statePath) restartRequired.push("statePath")
+
+    if (nextConfig.proxy.host !== this.config.proxy.host) restartRequired.push("proxy.host")
+    if (nextConfig.proxy.port !== this.config.proxy.port) restartRequired.push("proxy.port")
+    if (nextConfig.proxy.upstreamHost !== this.config.proxy.upstreamHost) restartRequired.push("proxy.upstreamHost")
+
+    if (nextConfig.processes.length !== this.config.processes.length) {
+      restartRequired.push("processes")
+    } else {
+      for (const processConfig of this.config.processes) {
+        const nextProcessConfig = nextConfig.processes.find((candidate) => candidate.id === processConfig.id)
+
+        if (!nextProcessConfig ||
+          nextProcessConfig.policy !== processConfig.policy ||
+          nextProcessConfig.deployStrategy !== processConfig.deployStrategy ||
+          nextProcessConfig.replicas !== processConfig.replicas ||
+          !isDeepStrictEqual(nextProcessConfig.port, processConfig.port)) {
+          restartRequired.push("processes")
+          break
+        }
+      }
+    }
+
+    if (restartRequired.length > 0) {
+      throw new Error(`Config changes to ${restartRequired.join(", ")} cannot be applied live; restart the Rollbridge daemon before deploying.`)
+    }
+  }
+
   /**
    * Rolls back to a previously-active release by re-running the deploy flow on its
    * retained metadata: it re-starts the target release, health-checks it, switches
@@ -418,7 +474,8 @@ export default class RollbridgeDaemon {
   async ensureServices(release, startedServices) {
     await release.allocatePorts()
 
-    for (const processConfig of this.config.processes) {
+    for (const processConfig of release.config.processes) {
+      if (this.stopping) throw new Error("Rollbridge is shutting down")
       if (processConfig.policy !== "service" || processConfig.deployStrategy === "handoff") continue
       if (this.services.has(processConfig.id)) continue
 
@@ -438,6 +495,8 @@ export default class RollbridgeDaemon {
         delete this.servicePorts[processConfig.id]
         throw error
       }
+
+      if (this.stopping) throw new Error("Rollbridge is shutting down")
     }
   }
 
@@ -473,20 +532,7 @@ export default class RollbridgeDaemon {
 
       const nextDefinition = release.buildProcess(processConfig, {shouldRestart: () => !this.stopping})
 
-      service.updateDefinition({
-        command: nextDefinition.command,
-        cwd: nextDefinition.cwd,
-        env: nextDefinition.env,
-        lifecycle: nextDefinition.lifecycle,
-        logger: nextDefinition.logger,
-        memory: nextDefinition.memory,
-        outputLines: nextDefinition.outputLines,
-        restart: nextDefinition.restart,
-        restartDelayMs: nextDefinition.restartDelayMs,
-        shouldRestart: nextDefinition.shouldRestart,
-        stopSignal: nextDefinition.stopSignal,
-        stopTimeoutMs: nextDefinition.stopTimeoutMs
-      })
+      service.updateDefinition(nextDefinition)
     }
   }
 
@@ -497,12 +543,14 @@ export default class RollbridgeDaemon {
    */
   async replaceSingletons(release) {
     for (const processConfig of this.config.processes) {
+      if (this.stopping) throw new Error("Rollbridge is shutting down")
       if (processConfig.policy !== "singleton") continue
 
       const previous = this.singletons.get(processConfig.id)
 
       if (previous) {
         await previous.stop()
+        if (this.stopping) throw new Error("Rollbridge is shutting down")
       }
 
       const singleton = release.buildProcess(processConfig)
@@ -611,11 +659,12 @@ export default class RollbridgeDaemon {
   /**
    * Drains and stops a retired release in the background, then prunes stopped releases.
    * @param {ReleaseGroup} release - Release to drain and stop.
+   * @param {import("./config.js").RollbridgeConfig} [config] - Refreshed config governing retirement.
    * @returns {Promise<void>} Resolves once drained, stopped, and pruned.
    */
-  async drainAndPrune(release) {
+  async drainAndPrune(release, config = this.config) {
     try {
-      await release.drainAndStop(this.config.proxy.drainTimeoutMs)
+      await release.drainAndStop(config.proxy.drainTimeoutMs, config)
       this.logger("release drained", {releaseId: release.releaseId})
     } catch (error) {
       this.logger("release drain failed", {error: error instanceof Error ? error.message : String(error), releaseId: release.releaseId})
@@ -652,9 +701,7 @@ export default class RollbridgeDaemon {
     if (!this.statePath || this.stopping) return
 
     const statePath = this.statePath
-    // Drop the orphans view from the snapshot: it reflects a *previous* daemon's leftovers, not
-    // this daemon's own managed state, and is recomputed from the persisted processes on restart.
-    const {orphans: _orphans, ...status} = this.status()
+    const status = this.status()
     const snapshot = {...status, events: this.eventLog.recent(), persistedAt: new Date().toISOString()}
 
     // Serialize writes (and track the tail) so shutdown can wait for an in-flight write before
@@ -706,17 +753,24 @@ export default class RollbridgeDaemon {
     this.proxy.close()
     await Promise.allSettled([...this.services.values()].map((processInstance) => processInstance.stop()))
     await Promise.allSettled([...this.singletons.values()].map((processInstance) => processInstance.stop()))
+    await Promise.allSettled([...this.startingReleases].map((release) => release.stop()))
     await Promise.allSettled([...this.releases.values()].map((release) => release.stop()))
     await this.closeServer(this.proxyServer)
     await this.closeServer(this.controlServer)
     await fs.rm(this.config.control.path, {force: true})
 
-    // A clean shutdown leaves no orphans, so remove the state file rather than leaving stale
-    // pids. Wait for any in-flight write first so it can't recreate the file afterward (no new
-    // writes start: stopping is set and the persist timer is cleared above).
+    // Wait for any in-flight write first so it can't recreate or overwrite the final state (no
+    // new writes start: stopping is set and the persist timer is cleared above). Prior-daemon
+    // orphans are not owned by this daemon, so retain their records until they are confirmed gone.
     if (this.statePath) {
       if (this.pendingWrite) await this.pendingWrite
-      await clearState(this.statePath)
+      const orphans = this.orphans.filter((orphan) => isProcessAlive(orphan.pid))
+
+      if (orphans.length > 0) {
+        await writeState(this.statePath, {activeReleaseId: null, orphans, releases: [], services: [], singletons: []})
+      } else {
+        await clearState(this.statePath)
+      }
     }
   }
 

package/src/release-group.js

@@ -40,8 +40,9 @@ export default class ReleaseGroup extends EventEmitter {
    * @param {string} args.releasePath - Release path.
    * @param {string | undefined} args.revision - Revision.
    * @param {Record<string, number>} [args.servicePorts] - Ports already owned by daemon-wide services.
+   * @param {() => boolean} [args.shouldStart] - Whether bootstrap may create another process.
    */
-  constructor({config, logger, releaseId, releasePath, revision, servicePorts = {}}) {
+  constructor({config, logger, releaseId, releasePath, revision, servicePorts = {}, shouldStart = () => true}) {
     super()
 
     this.config = config
@@ -57,6 +58,7 @@ export default class ReleaseGroup extends EventEmitter {
     this.nonBlockingDrainIds = /** @type {Set<string>} */ (new Set())
     this.ports = /** @type {Record<string, number>} */ ({})
     this.servicePorts = servicePorts
+    this.shouldStart = shouldStart
     this.portsAllocated = false
     this.drainStartedAt = /** @type {string | undefined} */ (undefined)
     this.activatedAt = /** @type {string | undefined} */ (undefined)
@@ -72,6 +74,8 @@ export default class ReleaseGroup extends EventEmitter {
 
       for (const processConfig of this.releaseProcessStartOrder()) {
         for (let index = 0; index < processConfig.replicas; index += 1) {
+          if (!this.shouldStart()) throw new Error("Rollbridge is shutting down")
+
           const instanceId = replicaInstanceId(processConfig, index)
           const processInstance = this.buildProcess(processConfig, {count: processConfig.replicas, index, instanceId})
 
@@ -87,6 +91,8 @@ export default class ReleaseGroup extends EventEmitter {
             host: this.config.proxy.upstreamHost,
             port: this.ports[processConfig.id]
           })
+
+          if (!this.shouldStart()) throw new Error("Rollbridge is shutting down")
         }
       }
     } catch (error) {
@@ -232,6 +238,34 @@ export default class ReleaseGroup extends EventEmitter {
     })
   }
 
+  /**
+   * Applies refreshed process definitions before retiring this release.
+   * @param {import("./config.js").RollbridgeConfig} config - Current deployment config.
+   * @returns {void}
+   */
+  refreshProcessDefinitions(config) {
+    this.config = config
+    this.handoffServiceIds.clear()
+    this.nonBlockingDrainIds.clear()
+
+    for (const processConfig of config.processes) {
+      const instances = this.getProcesses(processConfig.id)
+
+      for (let index = 0; index < instances.length; index += 1) {
+        const instance = instances[index]
+        const nextDefinition = this.buildProcess(processConfig, {
+          count: processConfig.replicas,
+          index,
+          instanceId: instance.id
+        })
+
+        instance.process.updateDefinition(nextDefinition)
+        if (processConfig.policy === "service" && processConfig.deployStrategy === "handoff") this.handoffServiceIds.add(instance.id)
+        if (processConfig.nonBlockingDrain) this.nonBlockingDrainIds.add(instance.id)
+      }
+    }
+  }
+
   /**
    * @param {import("./config.js").ProcessConfig} processConfig - Process config.
    * @param {{count: number, index: number}} replica - Replica index and total count.
@@ -325,13 +359,15 @@ export default class ReleaseGroup extends EventEmitter {
   /**
    * Starts draining and stops once existing connections close or timeout.
    * @param {number} timeoutMs - Drain timeout.
+   * @param {import("./config.js").RollbridgeConfig} [config] - Refreshed config governing retirement.
    * @returns {Promise<void>} Resolves when stopped.
    */
-  async drainAndStop(timeoutMs) {
+  async drainAndStop(timeoutMs, config = this.config) {
     if (this.state === "stopped") return
 
     this.state = "draining"
     this.drainStartedAt = new Date().toISOString()
+    this.refreshProcessDefinitions(config)
 
     // Stop nonBlockingDrain processes (e.g. job workers) immediately and in the background, so
     // their lifecycle drain runs as soon as the release is retired — in parallel with the

package/src/state-store.js

@@ -86,6 +86,14 @@ export function liveProcesses(state, alive = isProcessAlive) {
   try {
     const snapshot = /** @type {import("./daemon.js").DaemonStatus} */ (state)
 
+    if (Array.isArray(snapshot.orphans)) {
+      for (const orphan of snapshot.orphans) {
+        if (typeof orphan.id === "string" && typeof orphan.pid === "number" && (typeof orphan.releaseId === "string" || orphan.releaseId === null) && alive(orphan.pid)) {
+          live.push({id: orphan.id, pid: orphan.pid, releaseId: orphan.releaseId})
+        }
+      }
+    }
+
     for (const release of snapshot.releases) {
       for (const process of release.processes) {
         if (typeof process.pid === "number" && alive(process.pid)) live.push({id: process.id, pid: process.pid, releaseId: release.releaseId})

package/test/config-path.test.js

@@ -5,7 +5,7 @@ import fs from "node:fs/promises"
 import os from "node:os"
 import path from "node:path"
 import test from "node:test"
-import {resolveConfigPath} from "../src/config.js"
+import {loadConfig, resolveConfigPath} from "../src/config.js"
 import {runCli} from "../src/cli.js"
 
 const validConfig = {
@@ -65,6 +65,21 @@ test("resolveConfigPath throws an actionable error when no default config exists
   }
 })
 
+test("loadConfig reloads a changed CommonJS module", async () => {
+  const dir = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-cfgpath-"))
+  const configPath = await writeConfigModule(dir)
+
+  try {
+    assert.equal((await loadConfig(configPath)).application, "demo")
+
+    await fs.writeFile(configPath, `module.exports = ${JSON.stringify({...validConfig, application: "updated"}, null, 2)}\n`)
+
+    assert.equal((await loadConfig(configPath)).application, "updated")
+  } finally {
+    await fs.rm(dir, {force: true, recursive: true})
+  }
+})
+
 test("validate CLI command resolves the default config when --config is omitted", async () => {
   const dir = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-cfgpath-"))
   const originalCwd = process.cwd()