rollbridge 0.1.12 → 0.1.13

package/README.md

@@ -399,6 +399,22 @@ Start the daemon:
 rollbridge daemon --config rollbridge.js
 ```
 
+Start the daemon and bootstrap an exact prepared release before leaving it in
+the foreground (for example from a boot-time service manager):
+
+```bash
+rollbridge daemon --config /srv/ticket-server/rollbridge.js \
+  --release-path /srv/ticket-server/releases/20260813090000/ticket-server \
+  --release-id 20260813090000 --revision abc123
+```
+
+The four bootstrap inputs are all-or-nothing and use absolute config/release
+paths. Rollbridge binds its proxy and control listeners, activates the release
+through the normal deploy path, and stays foreground. A failed activation stops
+only processes started by that attempt and exits non-zero; persisted processes
+from a previous daemon are reported as orphans and are never recovered or killed
+implicitly; their live PID records remain in `statePath` for explicit recovery.
+
 Start the daemon only when it is not already running:
 
 ```bash

package/docs/cli.md

@@ -24,6 +24,7 @@ process-policy details.
 
 ```
 rollbridge daemon [--config <path>]
+                  [--release-path <path> --release-id <id> --revision <sha>]
 ```
 
 Runs the supervisor in the foreground: binds the stable proxy port and the
@@ -32,6 +33,28 @@ processes, closes the servers, removes the control socket, and exits `0`.
 Structured JSON log lines are written to stdout. Run it under a process manager
 such as systemd (see `examples/rollbridge.service`).
 
+For boot/crash recovery, pass an explicit absolute `--config` and all three
+release options together. Rollbridge validates every bootstrap input before it
+binds listeners or starts processes, then binds the listeners and activates that
+exact release through the same deploy path used by the control socket: services,
+companions, the proxied process and health check, traffic switching, singletons,
+and service-template refresh. It then remains in the foreground with the normal
+signal behavior.
+
+Bootstrap paths must be absolute and normalized, the release path must be an
+accessible directory, and release id/revision values accept letters, numbers,
+dots, underscores, and hyphens (maximum 200 characters, beginning with a letter
+or number). Supplying only some bootstrap options, or an invalid value, exits
+non-zero before listeners start. Activation failure emits a structured
+`bootstrap activation failed` event, cleans up processes owned by that attempt,
+and exits non-zero without inventing an active release. `statePath` entries from
+a previous daemon remain advisory orphans: bootstrap never runs recovery and
+never signals those processes, and retains their live PID records in `statePath`
+for explicit recovery.
+
+With no release options, daemon behavior is unchanged: it starts listener-only
+and waits for control-socket deployments.
+
 ## `ensure-daemon`
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rollbridge",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "Zero-downtime process supervisor and local traffic switcher for deploy-managed apps.",
   "keywords": [
     "deploy",

package/src/cli.js

@@ -30,7 +30,11 @@ export async function runCli(argv) {
   program
     .command("daemon")
     .option("-c, --config <path>", "Config file path (defaults to rollbridge.js)")
+    .option("--release-path <path>", "Bootstrap release path (requires --config, --release-id, and --revision)")
+    .option("--release-id <id>", "Bootstrap release id (requires --config, --release-path, and --revision)")
+    .option("--revision <sha>", "Bootstrap revision (requires --config, --release-path, and --release-id)")
     .action(async (options) => {
+      const bootstrap = await validateDaemonBootstrapOptions(options)
       const configPath = await resolveConfigPath(options.config)
       const config = await loadConfig(configPath)
       const daemon = new RollbridgeDaemon({config, configPath})
@@ -44,6 +48,17 @@ export async function runCli(argv) {
 
       process.once("SIGINT", () => { void shutdown() })
       process.once("SIGTERM", () => { void shutdown() })
+
+      if (bootstrap) {
+        try {
+          await daemon.deploy(bootstrap)
+        } catch {
+          daemon.logger("bootstrap activation failed", {releaseId: bootstrap.releaseId, status: "error"})
+          await daemon.shutdown()
+          process.exitCode = 1
+          return
+        }
+      }
     })
 
   program
@@ -696,6 +711,49 @@ async function validateConfigFile(configPath) {
   }
 }
 
+/**
+ * Validates the daemon's optional all-or-nothing bootstrap release interface before
+ * config loading or listener startup.
+ * @param {{config?: string, releaseId?: string, releasePath?: string, revision?: string}} options - Daemon CLI options.
+ * @returns {Promise<{releaseId: string, releasePath: string, revision: string} | undefined>} Validated bootstrap metadata.
+ */
+async function validateDaemonBootstrapOptions(options) {
+  const bootstrapValues = [options.releasePath, options.releaseId, options.revision]
+  const bootstrapRequested = bootstrapValues.some((value) => value !== undefined)
+
+  if (!bootstrapRequested) return undefined
+
+  if (!options.config || bootstrapValues.some((value) => value === undefined)) {
+    throw new Error("Daemon bootstrap options --config, --release-path, --release-id, and --revision must be provided together.")
+  }
+
+  if (!path.isAbsolute(options.config)) throw new Error("Daemon bootstrap --config must be an absolute path.")
+  if (path.normalize(options.config) !== options.config) throw new Error("Daemon bootstrap --config must be normalized and must not contain unsafe traversal segments.")
+  if (!path.isAbsolute(/** @type {string} */ (options.releasePath))) throw new Error("Daemon bootstrap --release-path must be an absolute path.")
+  if (path.normalize(/** @type {string} */ (options.releasePath)) !== options.releasePath) throw new Error("Daemon bootstrap --release-path must be normalized and must not contain unsafe traversal segments.")
+
+  const releaseId = /** @type {string} */ (options.releaseId)
+  const revision = /** @type {string} */ (options.revision)
+  const safeIdentifier = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/
+
+  if (!safeIdentifier.test(releaseId)) throw new Error("Daemon bootstrap --release-id must be a non-empty safe identifier containing only letters, numbers, dots, underscores, and hyphens.")
+  if (!safeIdentifier.test(revision)) throw new Error("Daemon bootstrap --revision must be a non-empty safe identifier containing only letters, numbers, dots, underscores, and hyphens.")
+
+  let releaseStat
+
+  try {
+    releaseStat = await fsPromises.stat(/** @type {string} */ (options.releasePath))
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error)
+
+    throw new Error(`Daemon bootstrap --release-path is not accessible: ${reason}`, {cause: error})
+  }
+
+  if (!releaseStat.isDirectory()) throw new Error("Daemon bootstrap --release-path must name a directory.")
+
+  return {releaseId, releasePath: /** @type {string} */ (options.releasePath), revision}
+}
+
 /**
  * Starts a daemon when needed and waits until it accepts status commands.
  * @param {object} args - Options.

package/src/daemon.js

@@ -56,6 +56,7 @@ export default class RollbridgeDaemon {
     this.statePath = config.statePath
     this.persistTimer = /** @type {ReturnType<typeof setInterval> | undefined} */ (undefined)
     this.pendingWrite = /** @type {Promise<void> | undefined} */ (undefined)
+    this.startingReleases = /** @type {Set<ReleaseGroup>} */ (new Set())
     // Still-alive managed processes left by a previous daemon (from statePath), captured at
     // startup and surfaced in status(). The daemon cannot re-manage them, only report them.
     this.orphans = /** @type {{id: string, pid: number, releaseId: string | null}[]} */ ([])
@@ -334,19 +335,26 @@ export default class RollbridgeDaemon {
       releaseId: newReleaseId,
       releasePath,
       revision,
-      servicePorts: this.servicePorts
+      servicePorts: this.servicePorts,
+      shouldStart: () => !this.stopping
     })
 
     this.logger("deploy starting", {releaseId: newReleaseId, releasePath, revision})
     const startedServices = /** @type {string[]} */ ([])
 
+    this.startingReleases.add(release)
+
     try {
       await this.ensureServices(release, startedServices)
       await release.start()
+      if (this.stopping) throw new Error("Rollbridge is shutting down")
     } catch (error) {
       this.logger("deploy failed", {error: error instanceof Error ? error.message : String(error), releaseId: newReleaseId})
+      await release.stop()
       await this.stopStartedServices(startedServices)
       throw error
+    } finally {
+      this.startingReleases.delete(release)
     }
 
     const previousRelease = this.activeRelease
@@ -467,6 +475,7 @@ export default class RollbridgeDaemon {
     await release.allocatePorts()
 
     for (const processConfig of release.config.processes) {
+      if (this.stopping) throw new Error("Rollbridge is shutting down")
       if (processConfig.policy !== "service" || processConfig.deployStrategy === "handoff") continue
       if (this.services.has(processConfig.id)) continue
 
@@ -486,6 +495,8 @@ export default class RollbridgeDaemon {
         delete this.servicePorts[processConfig.id]
         throw error
       }
+
+      if (this.stopping) throw new Error("Rollbridge is shutting down")
     }
   }
 
@@ -532,12 +543,14 @@ export default class RollbridgeDaemon {
    */
   async replaceSingletons(release) {
     for (const processConfig of this.config.processes) {
+      if (this.stopping) throw new Error("Rollbridge is shutting down")
       if (processConfig.policy !== "singleton") continue
 
       const previous = this.singletons.get(processConfig.id)
 
       if (previous) {
         await previous.stop()
+        if (this.stopping) throw new Error("Rollbridge is shutting down")
       }
 
       const singleton = release.buildProcess(processConfig)
@@ -688,9 +701,7 @@ export default class RollbridgeDaemon {
     if (!this.statePath || this.stopping) return
 
     const statePath = this.statePath
-    // Drop the orphans view from the snapshot: it reflects a *previous* daemon's leftovers, not
-    // this daemon's own managed state, and is recomputed from the persisted processes on restart.
-    const {orphans: _orphans, ...status} = this.status()
+    const status = this.status()
     const snapshot = {...status, events: this.eventLog.recent(), persistedAt: new Date().toISOString()}
 
     // Serialize writes (and track the tail) so shutdown can wait for an in-flight write before
@@ -742,17 +753,24 @@ export default class RollbridgeDaemon {
     this.proxy.close()
     await Promise.allSettled([...this.services.values()].map((processInstance) => processInstance.stop()))
     await Promise.allSettled([...this.singletons.values()].map((processInstance) => processInstance.stop()))
+    await Promise.allSettled([...this.startingReleases].map((release) => release.stop()))
     await Promise.allSettled([...this.releases.values()].map((release) => release.stop()))
     await this.closeServer(this.proxyServer)
     await this.closeServer(this.controlServer)
     await fs.rm(this.config.control.path, {force: true})
 
-    // A clean shutdown leaves no orphans, so remove the state file rather than leaving stale
-    // pids. Wait for any in-flight write first so it can't recreate the file afterward (no new
-    // writes start: stopping is set and the persist timer is cleared above).
+    // Wait for any in-flight write first so it can't recreate or overwrite the final state (no
+    // new writes start: stopping is set and the persist timer is cleared above). Prior-daemon
+    // orphans are not owned by this daemon, so retain their records until they are confirmed gone.
     if (this.statePath) {
       if (this.pendingWrite) await this.pendingWrite
-      await clearState(this.statePath)
+      const orphans = this.orphans.filter((orphan) => isProcessAlive(orphan.pid))
+
+      if (orphans.length > 0) {
+        await writeState(this.statePath, {activeReleaseId: null, orphans, releases: [], services: [], singletons: []})
+      } else {
+        await clearState(this.statePath)
+      }
     }
   }
 

package/src/release-group.js

@@ -40,8 +40,9 @@ export default class ReleaseGroup extends EventEmitter {
    * @param {string} args.releasePath - Release path.
    * @param {string | undefined} args.revision - Revision.
    * @param {Record<string, number>} [args.servicePorts] - Ports already owned by daemon-wide services.
+   * @param {() => boolean} [args.shouldStart] - Whether bootstrap may create another process.
    */
-  constructor({config, logger, releaseId, releasePath, revision, servicePorts = {}}) {
+  constructor({config, logger, releaseId, releasePath, revision, servicePorts = {}, shouldStart = () => true}) {
     super()
 
     this.config = config
@@ -57,6 +58,7 @@ export default class ReleaseGroup extends EventEmitter {
     this.nonBlockingDrainIds = /** @type {Set<string>} */ (new Set())
     this.ports = /** @type {Record<string, number>} */ ({})
     this.servicePorts = servicePorts
+    this.shouldStart = shouldStart
     this.portsAllocated = false
     this.drainStartedAt = /** @type {string | undefined} */ (undefined)
     this.activatedAt = /** @type {string | undefined} */ (undefined)
@@ -72,6 +74,8 @@ export default class ReleaseGroup extends EventEmitter {
 
       for (const processConfig of this.releaseProcessStartOrder()) {
         for (let index = 0; index < processConfig.replicas; index += 1) {
+          if (!this.shouldStart()) throw new Error("Rollbridge is shutting down")
+
           const instanceId = replicaInstanceId(processConfig, index)
           const processInstance = this.buildProcess(processConfig, {count: processConfig.replicas, index, instanceId})
 
@@ -87,6 +91,8 @@ export default class ReleaseGroup extends EventEmitter {
             host: this.config.proxy.upstreamHost,
             port: this.ports[processConfig.id]
           })
+
+          if (!this.shouldStart()) throw new Error("Rollbridge is shutting down")
         }
       }
     } catch (error) {

package/src/state-store.js

@@ -86,6 +86,14 @@ export function liveProcesses(state, alive = isProcessAlive) {
   try {
     const snapshot = /** @type {import("./daemon.js").DaemonStatus} */ (state)
 
+    if (Array.isArray(snapshot.orphans)) {
+      for (const orphan of snapshot.orphans) {
+        if (typeof orphan.id === "string" && typeof orphan.pid === "number" && (typeof orphan.releaseId === "string" || orphan.releaseId === null) && alive(orphan.pid)) {
+          live.push({id: orphan.id, pid: orphan.pid, releaseId: orphan.releaseId})
+        }
+      }
+    }
+
     for (const release of snapshot.releases) {
       for (const process of release.processes) {
         if (typeof process.pid === "number" && alive(process.pid)) live.push({id: process.id, pid: process.pid, releaseId: release.releaseId})

package/test/daemon-bootstrap.test.js

@@ -0,0 +1,363 @@
+// @ts-check
+
+import assert from "node:assert/strict"
+import {spawn} from "node:child_process"
+import {once} from "node:events"
+import fs from "node:fs/promises"
+import os from "node:os"
+import path from "node:path"
+import test from "node:test"
+import {fileURLToPath} from "node:url"
+import {sendControlCommand} from "../src/control-client.js"
+import {isProcessAlive, liveProcesses, readState, writeState} from "../src/state-store.js"
+
+const currentDir = path.dirname(fileURLToPath(import.meta.url))
+const binPath = path.join(currentDir, "..", "bin", "rollbridge")
+const dummyAppPath = path.join(currentDir, "fixtures", "dummy-app.js")
+
+test("daemon bootstrap requires complete, safe, absolute inputs before binding listeners", async (t) => {
+  const cases = [
+    {args: ["--config", "CONFIG", "--release-path", "RELEASE", "--release-id", "v1"], message: /must be provided together/},
+    {args: ["--config", "relative/config.js", "--release-path", "RELEASE", "--release-id", "v1", "--revision", "abc123"], message: /--config must be an absolute path/},
+    {args: ["--config", "CONFIG", "--release-path", "relative/release", "--release-id", "v1", "--revision", "abc123"], message: /--release-path must be an absolute path/},
+    {args: ["--config", "CONFIG", "--release-path", "RELEASE", "--release-id", "unsafe id", "--revision", "abc123"], message: /--release-id/},
+    {args: ["--config", "CONFIG", "--release-path", "RELEASE", "--release-id", "v1", "--revision", "unsafe revision"], message: /--revision/}
+  ]
+
+  for (const testCase of cases) {
+    await t.test(testCase.message.source, async () => {
+      const fixture = await createFixture()
+      const args = testCase.args.map((arg) => arg === "CONFIG" ? fixture.configPath : arg === "RELEASE" ? fixture.root : arg)
+
+      try {
+        const result = await runDaemon(args)
+
+        assert.notEqual(result.code, 0)
+        assert.match(result.stderr, testCase.message)
+        await assert.rejects(() => fs.stat(fixture.socketPath), {code: "ENOENT"})
+      } finally {
+        await fs.rm(fixture.root, {force: true, recursive: true})
+      }
+    })
+  }
+})
+
+test("daemon bootstrap activates the exact release through the foreground daemon", async () => {
+  const fixture = await createFixture()
+  const child = spawnDaemon(fixture, {releaseId: "release-42", revision: "abc123"})
+
+  try {
+    await waitForLog(child, "traffic switched")
+    const status = await sendControlCommand({command: {command: "status"}, path: fixture.socketPath})
+    const activeRelease = assertRelease(status, "release-42")
+
+    assert.equal(activeRelease.releasePath, fixture.root)
+    assert.equal(activeRelease.revision, "abc123")
+    assert.ok(status.proxy && typeof status.proxy === "object" && !Array.isArray(status.proxy) && typeof status.proxy.port === "number")
+    assert.equal((await fetch(`http://127.0.0.1:${status.proxy.port}/release`).then((response) => response.text())).trim(), "release-42")
+
+    child.kill("SIGTERM")
+    assert.equal((await once(child, "exit"))[0], 0)
+  } finally {
+    if (child.exitCode === null) child.kill("SIGKILL")
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("plain daemon startup remains listener-only with no active release", async () => {
+  const fixture = await createFixture()
+  const child = spawn(process.execPath, [binPath, "daemon", "--config", fixture.configPath], {stdio: ["pipe", "pipe", "pipe"]})
+
+  try {
+    await waitForLog(child, "control socket listening")
+    const status = await sendControlCommand({command: {command: "status"}, path: fixture.socketPath})
+
+    assert.equal(status.activeReleaseId, null)
+    assert.deepEqual(status.releases, [])
+
+    child.kill("SIGTERM")
+    assert.equal((await once(child, "exit"))[0], 0)
+  } finally {
+    if (child.exitCode === null) child.kill("SIGKILL")
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("SIGTERM during bootstrap activation follows the daemon shutdown path", async () => {
+  const fixture = await createFixture({healthPath: "/never-ready", healthTimeoutMs: 60000})
+  const started = waitForFile(fixture.startedPath)
+  const child = spawnDaemon(fixture, {releaseId: "slow-release", revision: "slow123"})
+
+  try {
+    const managedPid = Number(await started)
+    child.kill("SIGTERM")
+
+    const [code, signal] = await once(child, "exit")
+
+    assert.equal(code, 0)
+    assert.equal(signal, null)
+    assert.equal(await fs.readFile(fixture.stoppedPath, "utf8"), String(managedPid))
+    await assert.rejects(() => fs.stat(fixture.socketPath), {code: "ENOENT"})
+  } finally {
+    if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL")
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("SIGTERM during multi-process bootstrap owns every process started after shutdown begins", async () => {
+  const fixture = await createFixture({multiProcessSignal: true})
+  const shutdownStarted = waitForLifecycleEvent(fixture.lifecyclePath, (event) => event.event === "shutdown")
+  const child = spawnDaemon(fixture, {releaseId: "multi-release", revision: "multi123"})
+  let output = ""
+
+  child.stdout.setEncoding("utf8").on("data", (chunk) => { output += chunk })
+
+  try {
+    await shutdownStarted
+    await fs.writeFile(fixture.gatePath, "continue\n")
+    const [code, signal] = await once(child, "exit")
+    const events = (await fs.readFile(fixture.lifecyclePath, "utf8")).trim().split("\n").map((line) => JSON.parse(line))
+    const shutdownIndex = events.findIndex((event) => event.event === "shutdown")
+    const startedAfterShutdown = events.slice(shutdownIndex + 1).filter((event) => event.event === "started")
+    const records = output.trim().split("\n").filter(Boolean).map((line) => JSON.parse(line))
+    const recordedPids = new Set(records.filter((record) => record.message === "process started").map((record) => record.data?.pid))
+
+    assert.equal(code, 0)
+    assert.equal(signal, null)
+    assert.notEqual(shutdownIndex, -1)
+    assert.ok(startedAfterShutdown.length > 0, `fixture must start a later bootstrap process after triggering shutdown: ${JSON.stringify(events)}`)
+    assert.deepEqual(startedAfterShutdown.filter((event) => !recordedPids.has(event.pid)), [])
+    for (const event of startedAfterShutdown) assert.equal(isProcessAlive(event.pid), false, `expected process ${event.pid} to be stopped before daemon exit`)
+  } finally {
+    if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL")
+
+    try {
+      const events = (await fs.readFile(fixture.lifecyclePath, "utf8")).trim().split("\n").filter(Boolean).map((line) => JSON.parse(line))
+
+      for (const event of events) {
+        if (event.event === "started" && isProcessAlive(event.pid)) process.kill(-event.pid, "SIGKILL")
+      }
+    } catch {
+      // The fixture may exit before creating its lifecycle log.
+    }
+
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("failed daemon bootstrap reports a structured failure, cleans its processes, and exits non-zero", async () => {
+  const fixture = await createFixture({healthPath: "/never-ready", healthTimeoutMs: 100})
+
+  try {
+    const result = await runDaemon([
+      "--config", fixture.configPath,
+      "--release-path", fixture.root,
+      "--release-id", "bad-release",
+      "--revision", "bad123"
+    ])
+    const records = result.output.split("\n").filter(Boolean).map((line) => JSON.parse(line))
+    const failure = records.find((record) => record.message === "bootstrap activation failed")
+
+    assert.notEqual(result.code, 0)
+    assert.deepEqual(failure?.data, {releaseId: "bad-release", status: "error"})
+    assert.ok(records.some((record) => record.message === "release startup process status" && record.data?.phase === "after cleanup" && record.data?.state === "stopped"))
+    await assert.rejects(() => fs.stat(fixture.socketPath), {code: "ENOENT"})
+  } finally {
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("daemon bootstrap reports but does not kill a live process from statePath", async () => {
+  const fixture = await createFixture({persistState: true})
+  const leftover = spawn(process.execPath, ["-e", "setInterval(() => {}, 1000)"], {stdio: "ignore"})
+
+  await once(leftover, "spawn")
+  await writeState(fixture.statePath, {
+    activeReleaseId: "previous",
+    releases: [{processes: [{id: "worker", pid: leftover.pid}], releaseId: "previous"}],
+    services: [],
+    singletons: []
+  })
+
+  const child = spawnDaemon(fixture, {releaseId: "recovered", revision: "def456"})
+
+  try {
+    await waitForLog(child, "traffic switched")
+    const status = await sendControlCommand({command: {command: "status"}, path: fixture.socketPath})
+
+    assert.ok(leftover.pid !== undefined && isProcessAlive(leftover.pid))
+    assert.deepEqual(status.orphans, [{id: "worker", pid: leftover.pid, releaseId: "previous"}])
+
+    child.kill("SIGTERM")
+    await once(child, "exit")
+
+    assert.deepEqual(liveProcesses(await readState(fixture.statePath)), [{id: "worker", pid: leftover.pid, releaseId: "previous"}])
+  } finally {
+    if (child.exitCode === null) child.kill("SIGKILL")
+    leftover.kill("SIGKILL")
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("failed daemon bootstrap preserves prior live process records in statePath", async () => {
+  const fixture = await createFixture({healthPath: "/never-ready", healthTimeoutMs: 100, persistState: true})
+  const leftover = spawn(process.execPath, ["-e", "setInterval(() => {}, 1000)"], {stdio: "ignore"})
+
+  await once(leftover, "spawn")
+  await writeState(fixture.statePath, {
+    activeReleaseId: "previous",
+    releases: [{processes: [{id: "worker", pid: leftover.pid}], releaseId: "previous"}],
+    services: [],
+    singletons: []
+  })
+
+  try {
+    const result = await runDaemon([
+      "--config", fixture.configPath,
+      "--release-path", fixture.root,
+      "--release-id", "bad-release",
+      "--revision", "bad123"
+    ])
+
+    assert.notEqual(result.code, 0)
+    assert.deepEqual(liveProcesses(await readState(fixture.statePath)), [{id: "worker", pid: leftover.pid, releaseId: "previous"}])
+  } finally {
+    leftover.kill("SIGKILL")
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+/**
+ * @param {{healthPath?: string, healthTimeoutMs?: number, multiProcessSignal?: boolean, persistState?: boolean}} [options] - Fixture options.
+ * @returns {Promise<{configPath: string, gatePath: string, lifecyclePath: string, root: string, socketPath: string, startedPath: string, statePath: string, stoppedPath: string}>} Fixture paths.
+ */
+async function createFixture({healthPath = "/ping", healthTimeoutMs = 1000, multiProcessSignal = false, persistState = false} = {}) {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-bootstrap-"))
+  const socketPath = path.join(root, "control.sock")
+  const statePath = path.join(root, "state.json")
+  const startedPath = path.join(root, "started.pid")
+  const stoppedPath = path.join(root, "stopped.pid")
+  const lifecyclePath = path.join(root, "lifecycle.jsonl")
+  const gatePath = path.join(root, "continue.fifo")
+  const configPath = path.join(root, "rollbridge.js")
+  const command = `${JSON.stringify(process.execPath)} ${JSON.stringify(dummyAppPath)}`
+  const lifecycleEnv = {ROLLBRIDGE_TEST_LIFECYCLE_PATH: lifecyclePath}
+  const config = {
+    application: "bootstrap-test",
+    control: {path: socketPath},
+    processes: multiProcessSignal ? [
+      {command: `trap '' TERM; printf '%s\\n' '{"event":"shutdown"}' >> ${JSON.stringify(lifecyclePath)}; kill -TERM "$ROLLBRIDGE_TEST_DAEMON_PID"; printf '{"event":"started","pid":%s,"processId":"database","replicaIndex":"0"}\\n' "$$" >> ${JSON.stringify(lifecyclePath)}; read ignored < ${JSON.stringify(gatePath)}`, env: lifecycleEnv, id: "database", policy: "service"},
+      {command: `exec ${command}`, env: lifecycleEnv, id: "worker", policy: "companion", replicas: 2},
+      {command: `exec ${command}`, env: lifecycleEnv, health: {path: healthPath, timeoutMs: healthTimeoutMs}, id: "web", policy: "proxied", port: {from: 0, to: 0}}
+    ] : [{command, env: {ROLLBRIDGE_TEST_STARTED_PATH: startedPath, ROLLBRIDGE_TEST_STOPPED_PATH: stoppedPath}, health: {path: healthPath, timeoutMs: healthTimeoutMs}, id: "web", policy: "proxied", port: {from: 0, to: 0}}],
+    proxy: {host: "127.0.0.1", port: 0},
+    ...(persistState ? {statePath} : {})
+  }
+
+  const setup = multiProcessSignal ? "process.env.ROLLBRIDGE_TEST_DAEMON_PID = String(process.pid)\n" : ""
+
+  if (multiProcessSignal) {
+    const fifo = spawn("mkfifo", [gatePath])
+    const [code] = await once(fifo, "exit")
+
+    assert.equal(code, 0)
+  }
+
+  await fs.writeFile(configPath, `${setup}module.exports = ${JSON.stringify(config, null, 2)}\n`)
+  return {configPath, gatePath, lifecyclePath, root, socketPath, startedPath, statePath, stoppedPath}
+}
+
+/**
+ * @param {string} filePath - JSON-lines event path.
+ * @param {(event: Record<string, import("../src/json.js").JsonValue>) => boolean} matches - Event predicate.
+ * @returns {Promise<Record<string, import("../src/json.js").JsonValue>>} First matching event.
+ */
+async function waitForLifecycleEvent(filePath, matches) {
+  const watcher = fs.watch(path.dirname(filePath))
+
+  try {
+    for await (const event of watcher) {
+      if (event.filename !== path.basename(filePath)) continue
+
+      const records = (await fs.readFile(filePath, "utf8")).trim().split("\n").filter(Boolean).map((line) => JSON.parse(line))
+      const match = records.find(matches)
+
+      if (match) return match
+    }
+  } finally {
+    await watcher.return?.()
+  }
+
+  throw new Error(`File watcher ended before a matching event was written to ${filePath}`)
+}
+
+/**
+ * @param {string} filePath - File whose creation is the synchronization point.
+ * @returns {Promise<string>} File contents once created.
+ */
+async function waitForFile(filePath) {
+  const watcher = fs.watch(path.dirname(filePath))
+
+  try {
+    for await (const event of watcher) {
+      if (event.filename === path.basename(filePath)) return await fs.readFile(filePath, "utf8")
+    }
+  } finally {
+    await watcher.return?.()
+  }
+
+  throw new Error(`File watcher ended before ${filePath} was created`)
+}
+
+/**
+ * @param {{configPath: string, root: string}} fixture - Fixture paths.
+ * @param {{releaseId: string, revision: string}} release - Bootstrap metadata.
+ * @returns {import("node:child_process").ChildProcessWithoutNullStreams} Spawned daemon.
+ */
+function spawnDaemon(fixture, release) {
+  return spawn(process.execPath, [binPath, "daemon", "--config", fixture.configPath, "--release-path", fixture.root, "--release-id", release.releaseId, "--revision", release.revision], {stdio: ["pipe", "pipe", "pipe"]})
+}
+
+/**
+ * @param {string[]} args - Daemon arguments.
+ * @returns {Promise<{code: number | null, output: string, stderr: string}>} Completed process result.
+ */
+async function runDaemon(args) {
+  const child = spawn(process.execPath, [binPath, "daemon", ...args], {stdio: ["ignore", "pipe", "pipe"]})
+  let output = ""
+  let stderr = ""
+
+  child.stdout.setEncoding("utf8").on("data", (chunk) => { output += chunk })
+  child.stderr.setEncoding("utf8").on("data", (chunk) => { stderr += chunk })
+  const [code] = await once(child, "exit")
+
+  return {code, output, stderr}
+}
+
+/**
+ * @param {import("node:child_process").ChildProcessWithoutNullStreams} child - Spawned daemon.
+ * @param {string} message - Structured log message to await.
+ * @returns {Promise<void>} Resolves after the message is observed.
+ */
+async function waitForLog(child, message) {
+  child.stdout.setEncoding("utf8")
+
+  for await (const chunk of child.stdout) {
+    if (String(chunk).includes(`"message":"${message}"`)) return
+  }
+
+  throw new Error(`Daemon exited before logging ${message}`)
+}
+
+/**
+ * @param {Record<string, import("../src/json.js").JsonValue>} status - Daemon status.
+ * @param {string} releaseId - Expected release id.
+ * @returns {Record<string, import("../src/json.js").JsonValue>} Matching release status.
+ */
+function assertRelease(status, releaseId) {
+  assert.ok(Array.isArray(status.releases))
+  const release = status.releases.find((candidate) => candidate && typeof candidate === "object" && "releaseId" in candidate && candidate.releaseId === releaseId)
+
+  assert.ok(release && typeof release === "object" && !Array.isArray(release))
+  return release
+}

package/test/fixtures/dummy-app.js

@@ -1,6 +1,7 @@
 // @ts-check
 
 import crypto from "node:crypto"
+import fs from "node:fs"
 import http from "node:http"
 
 const port = Number(process.env.ROLLBRIDGE_PORT)
@@ -8,6 +9,10 @@ const releaseId = process.env.ROLLBRIDGE_RELEASE_ID || "unknown"
 const healthFails = releaseId.includes("bad")
 const sockets = new Set()
 
+if (process.env.ROLLBRIDGE_TEST_STARTED_PATH) {
+  fs.writeFileSync(process.env.ROLLBRIDGE_TEST_STARTED_PATH, String(process.pid))
+}
+
 const server = http.createServer((request, response) => {
   if (request.url === "/ping") {
     if (healthFails) {
@@ -59,6 +64,14 @@ server.on("upgrade", (request, socket) => {
 })
 
 process.on("SIGTERM", () => {
+  if (process.env.ROLLBRIDGE_TEST_LIFECYCLE_PATH) {
+    fs.appendFileSync(process.env.ROLLBRIDGE_TEST_LIFECYCLE_PATH, `${JSON.stringify({event: "stopped", pid: process.pid, processId: process.env.ROLLBRIDGE_PROCESS_ID, replicaIndex: process.env.ROLLBRIDGE_REPLICA_INDEX})}\n`)
+  }
+
+  if (process.env.ROLLBRIDGE_TEST_STOPPED_PATH) {
+    fs.writeFileSync(process.env.ROLLBRIDGE_TEST_STOPPED_PATH, String(process.pid))
+  }
+
   server.close(() => process.exit(0))
 
   if (sockets.size === 0) {
@@ -66,4 +79,14 @@ process.on("SIGTERM", () => {
   }
 })
 
-server.listen(port, "127.0.0.1")
+const recordStarted = () => {
+  if (process.env.ROLLBRIDGE_TEST_LIFECYCLE_PATH) {
+    fs.appendFileSync(process.env.ROLLBRIDGE_TEST_LIFECYCLE_PATH, `${JSON.stringify({event: "started", pid: process.pid, processId: process.env.ROLLBRIDGE_PROCESS_ID, replicaIndex: process.env.ROLLBRIDGE_REPLICA_INDEX})}\n`)
+  }
+}
+
+if (process.env.ROLLBRIDGE_PORT) {
+  server.listen(port, "127.0.0.1", recordStarted)
+} else {
+  recordStarted()
+}

package/tmp/worker-control/rollbridge-bootstrap/activity-3.jsonl

@@ -0,0 +1,28 @@
+{"type":"controller-started","pid":23,"at":1786618711548}
+{"type":"provider-started","provider":"codex","pid":34,"at":1786618711553}
+{"type":"session-available","provider":"codex","sessionId":"019ffac6-1176-7023-8f14-82bae745817f","at":1786618712506}
+{"type":"activity","provider":"codex","kind":"lifecycle","at":1786618712506}
+{"type":"activity","provider":"codex","kind":"delta","at":1786618717893}
+{"type":"activity","provider":"codex","kind":"tool","at":1786618723182}
+{"type":"activity","provider":"codex","kind":"tool","at":1786618730240}
+{"type":"activity","provider":"codex","kind":"tool","at":1786618740515}
+{"type":"activity","provider":"codex","kind":"tool","at":1786618746269}
+{"type":"activity","provider":"codex","kind":"delta","at":1786618770657}
+{"type":"activity","provider":"codex","kind":"tool","at":1786618811295}
+{"type":"activity","provider":"codex","kind":"tool","at":1786618816349}
+{"type":"activity","provider":"codex","kind":"tool","at":1786618859240}
+{"type":"activity","provider":"codex","kind":"tool","at":1786618872926}
+{"type":"activity","provider":"codex","kind":"delta","at":1786618889245}
+{"type":"activity","provider":"codex","kind":"tool","at":1786618908545}
+{"type":"activity","provider":"codex","kind":"tool","at":1786618913878}
+{"type":"activity","provider":"codex","kind":"delta","at":1786618934507}
+{"type":"activity","provider":"codex","kind":"tool","at":1786618940248}
+{"type":"activity","provider":"codex","kind":"tool","at":1786618945887}
+{"type":"activity","provider":"codex","kind":"tool","at":1786618960106}
+{"type":"activity","provider":"codex","kind":"tool","at":1786618969417}
+{"type":"activity","provider":"codex","kind":"delta","at":1786618976649}
+{"type":"activity","provider":"codex","kind":"tool","at":1786618996642}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619006003}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619014397}
+{"type":"activity","provider":"codex","kind":"delta","at":1786619021770}
+{"type":"terminal","provider":"codex","state":"completed","exitCode":0,"at":1786619026150}

package/tmp/worker-control/rollbridge-bootstrap/current-head-review-activity.jsonl

@@ -0,0 +1,13 @@
+{"type":"controller-started","pid":23,"at":1786619870796}
+{"type":"provider-started","provider":"codex","pid":34,"at":1786619870799}
+{"type":"session-available","provider":"codex","sessionId":"019ffad7-bed8-7861-911f-83cd5de11373","at":1786619871013}
+{"type":"activity","provider":"codex","kind":"lifecycle","at":1786619871014}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619877574}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619886232}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619894201}
+{"type":"activity","provider":"codex","kind":"delta","at":1786619899492}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619905754}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619921741}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619931957}
+{"type":"activity","provider":"codex","kind":"delta","at":1786619937323}
+{"type":"terminal","provider":"codex","state":"completed","exitCode":0,"at":1786620000478}

package/tmp/worker-control/rollbridge-bootstrap/current-head-review-transcript.jsonl

@@ -0,0 +1 @@
+{"version":1,"type":"delegated_result","state":"completed","exitCode":0,"conclusion":"I’ll perform a read-only review of the full uncommitted diff, then trace the daemon bootstrap lifecycle through its existing implementation and focused tests. I’ll avoid edits and the full test suite, and report only material, reproducible issues—or `PASS`.The repaired state preservation path is present, and the focused tests cover the two accepted lifecycle fixes. I’m now checking concurrency boundaries beneath `deploy()`—especially whether `ReleaseGroup.start()` and process/service startup remain safely stoppable when shutdown overlaps activation—and validating persistence shape compatibility.- High — [src/daemon.js:747](/home/dev/rollbridge/src/daemon.js:747): shutdown snapshots `services`, `singletons`, and `startingReleases` only once, while the concurrent bootstrap deployment can continue creating processes. `ReleaseGroup.start()` has no cancellation check inside its process/replica loop ([src/release-group.js:73](/home/dev/rollbridge/src/release-group.js:73)), and singleton replacement similarly continues after each await ([src/daemon.js:539](/home/dev/rollbridge/src/daemon.js:539)). If SIGTERM arrives while an early service, companion replica, or singleton is starting/stopping, shutdown may finish its snapshot while deployment starts a later process. The signal handler then calls `process.exit(0)` ([src/cli.js:44](/home/dev/rollbridge/src/cli.js:44)), potentially leaving that detached child running and unrecorded. The new signal test only uses one release process and signals during its health wait, so it does not cover this realistic multi-process race.","continuationHandle":"019ffad7-bed8-7861-911f-83cd5de11373"}

package/tmp/worker-control/rollbridge-bootstrap/fs-probe-10.jsonl

@@ -0,0 +1 @@
+probe\n

package/tmp/worker-control/rollbridge-bootstrap/plan.md

@@ -0,0 +1,9 @@
+# Rollbridge daemon bootstrap plan
+
+1. Add focused CLI/daemon bootstrap tests first, covering all-or-nothing and safe absolute input validation before binding, exact activation through the normal deploy path, structured failure with attempt-owned cleanup and non-zero exit, unchanged plain-daemon startup, and preservation/reporting of live `statePath` orphans.
+2. Run the new focused test file alone and record the expected RED result before production changes.
+3. Add the minimal foreground daemon bootstrap options and validation, then start listeners and call the existing `RollbridgeDaemon.deploy()` path; on activation failure, log a safe structured failure, shut down only objects owned by this attempt, and propagate failure.
+4. Update the CLI reference and README daemon usage, then run the changed focused test files individually, `npm run lint`, and `npm run typecheck`.
+5. Inspect the final diff/status and leave every change uncommitted for independent verification.
+
+Scope note: bootstrap requires explicit `--release-path`, `--release-id`, and `--revision` together with an explicit `--config`; values must be non-empty safe tokens where applicable and paths must be absolute, normalized, and usable. No orphan recovery or process killing is part of bootstrap.

package/tmp/worker-control/rollbridge-bootstrap/repair-activity.jsonl

@@ -0,0 +1,3 @@
+{"type":"controller-started","pid":23,"at":1786619408071}
+{"type":"provider-started","provider":"codex","pid":34,"at":1786619408074}
+{"type":"terminal","provider":"codex","state":"failed","exitCode":2,"at":1786619520214}

package/tmp/worker-control/rollbridge-bootstrap/repair-fresh-activity.jsonl

@@ -0,0 +1,25 @@
+{"type":"controller-started","pid":23,"at":1786619544825}
+{"type":"provider-started","provider":"codex","pid":34,"at":1786619544829}
+{"type":"session-available","provider":"codex","sessionId":"019ffad2-c71a-7522-9645-c45214c2ba90","at":1786619545505}
+{"type":"activity","provider":"codex","kind":"lifecycle","at":1786619545506}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619552059}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619560395}
+{"type":"activity","provider":"codex","kind":"delta","at":1786619567749}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619582034}
+{"type":"activity","provider":"codex","kind":"delta","at":1786619609721}
+{"type":"activity","provider":"codex","kind":"delta","at":1786619632612}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619657491}
+{"type":"activity","provider":"codex","kind":"delta","at":1786619692967}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619698926}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619706811}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619724983}
+{"type":"activity","provider":"codex","kind":"delta","at":1786619730097}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619736678}
+{"type":"activity","provider":"codex","kind":"delta","at":1786619742798}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619748670}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619754672}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619764194}
+{"type":"activity","provider":"codex","kind":"delta","at":1786619775649}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619780713}
+{"type":"activity","provider":"codex","kind":"delta","at":1786619786176}
+{"type":"terminal","provider":"codex","state":"completed","exitCode":0,"at":1786619829038}

package/tmp/worker-control/rollbridge-bootstrap/repair-fresh-transcript.jsonl

@@ -0,0 +1 @@
+{"version":1,"type":"delegated_result","state":"completed","exitCode":0,"conclusion":"I’ll resume in place and preserve the current worktree. I’ll first inspect the branch, repository guidance, lifecycle code, and existing tests; then I’ll add only focused deterministic regressions and capture their expected failures before touching production code.The root conflict is confirmed: startup reads prior live PIDs into an advisory in-memory list, but the first persistence snapshot deliberately drops that list, and shutdown then unconditionally removes the file. I’m going to make the regressions assert two boundaries directly: SIGTERM while bootstrap activation is provably in-flight, and recoverable prior PID records after bootstrap persistence plus shutdown/failure.The focused regressions are now in place without timing sleeps: the signal test gates on the daemon’s own “control socket listening” milestone, and persistence checks decode the actual state store through `liveProcesses`. I’m running only the bootstrap test file now to record the RED failures before production edits.RED is confirmed with exactly the three expected failures: bootstrap SIGTERM exits by signal instead of code 0, and both successful-shutdown and failed-activation paths lose the prior PID record. I’m now making the minimal ownership changes: register signal handling before activation, track the in-progress release as daemon-owned for shutdown, and carry advisory orphan records through snapshots and clean shutdown.The focused file is GREEN. I’m tightening the signal regression before final checks so it proves the managed child was actually started and then stopped—not just that the CLI intercepted SIGTERM early. The test will use a filesystem watch/marker handshake from the existing fixture, still with no sleeps or polling.The strengthened regression is GREEN and confirms the exact started PID received the daemon’s graceful stop before the CLI exited. The focused persistence regressions also remain GREEN. I’m moving to the requested static checks now, without running the full suite.`npm run lint` reached its bundled typecheck and found one narrow test typing issue: the async iterator’s optional `return` method. I’ve corrected that optional call and will re-run the focused test before repeating the requested checks.All requested test and static checks are now passing. I made one small documentation clarification because the durability behavior is operator-visible: live advisory orphan records remain in `statePath` for explicit recovery. I’m doing the final whitespace, diff, branch, and worktree inspection now; I will leave the existing `tmp/` and all unrelated candidate changes untouched.Implemented both HIGH lifecycle fixes on `feature/daemon-bootstrap-release`:\n\n- SIGINT/SIGTERM ownership is installed before bootstrap activation.\n- In-progress releases are daemon-owned and stopped during shutdown.\n- Prior-daemon orphan PID records remain persisted across snapshots, successful shutdown, and failed bootstrap activation.\n- Added deterministic regressions using explicit process/file handshakes—no sleeps or retries.\n- Updated documentation to describe recoverable orphan records.\n\nRED was confirmed with three expected failures before production edits. Final checks:\n\n- `node --test test/daemon-bootstrap.test.js` — 12 passed\n- `npm run lint` — passed\n- `npm run typecheck` — passed\n- `git diff --check` — passed\n\nFinal branch/status inspected. No full suite, commit, push, or deploy performed. Existing unrelated changes and `tmp/` remain untouched.","continuationHandle":"019ffad2-c71a-7522-9645-c45214c2ba90"}

package/tmp/worker-control/rollbridge-bootstrap/repair-transcript.jsonl

@@ -0,0 +1 @@
+{"version":1,"type":"delegated_result","state":"failed","exitCode":2,"continuationHandle":"019ffac6-1176-7023-8f14-82bae745817f"}

package/tmp/worker-control/rollbridge-bootstrap/review-activity.jsonl

@@ -0,0 +1,14 @@
+{"type":"controller-started","pid":23,"at":1786619089604}
+{"type":"provider-started","provider":"codex","pid":34,"at":1786619089609}
+{"type":"session-available","provider":"codex","sessionId":"019ffacb-d3c0-7f93-affa-c472258a1b8b","at":1786619089955}
+{"type":"activity","provider":"codex","kind":"lifecycle","at":1786619089955}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619096716}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619104649}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619110897}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619130819}
+{"type":"activity","provider":"codex","kind":"delta","at":1786619140752}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619146978}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619159062}
+{"type":"activity","provider":"codex","kind":"tool","at":1786619164311}
+{"type":"activity","provider":"codex","kind":"delta","at":1786619179382}
+{"type":"terminal","provider":"codex","state":"completed","exitCode":0,"at":1786619221045}

package/tmp/worker-control/rollbridge-bootstrap/review-transcript.jsonl

@@ -0,0 +1 @@
+{"version":1,"type":"delegated_result","state":"completed","exitCode":0,"conclusion":"I’ll review the exact working-tree candidate read-only, first inventorying repository instructions and the complete diff, then tracing the affected daemon/deploy/state/recovery paths and targeted tests. I won’t modify anything or run the full suite.The candidate is small and localized, but its safety claims depend heavily on existing daemon startup and deploy cleanup behavior. I’m tracing those internals now, including persisted-state loading and signal/exit handling, and will run only focused tests relevant to this interface.Two lifecycle interactions warrant direct verification: interruption during a slow bootstrap, and what remains recoverable in `statePath` when live prior-daemon processes were only reported. I’m checking those against focused existing/new tests and source behavior; no repository files will be changed.- High — [src/cli.js](/home/dev/rollbridge/src/cli.js:42): SIGINT/SIGTERM handlers are installed only after `daemon.deploy()` completes at line 46. A service-manager stop or restart during process startup or a long health check therefore performs Node’s default termination instead of `daemon.shutdown()`. Managed children are detached ([src/managed-process.js](/home/dev/rollbridge/src/managed-process.js:86)), so they can survive while the proxy/control socket and state are left unclean. This contradicts the documented “normal signal behavior” and is not covered by the bootstrap tests.\n\n- High — [src/daemon.js](/home/dev/rollbridge/src/daemon.js:677): After prior-daemon processes are read into the in-memory orphan list, startup immediately persists a new snapshot that deliberately excludes those orphans (lines 691–700), overwriting their only durable PID records. A later clean shutdown also deletes `statePath` (lines 750–755). Thus a live prior-daemon process is not killed, but becomes unrecoverable through `rollbridge recover` once bootstrap starts—or immediately when failed activation invokes shutdown. The test at [test/daemon-bootstrap.test.js](/home/dev/rollbridge/test/daemon-bootstrap.test.js:108) checks only process liveness and in-memory status, never preservation of the persisted orphan records. This conflicts with the documentation that previous `statePath` entries remain advisory orphans.","continuationHandle":"019ffacb-d3c0-7f93-affa-c472258a1b8b"}

package/tmp/worker-control/rollbridge-bootstrap/terminal-repair-activity.jsonl

@@ -0,0 +1,3 @@
+{"type":"controller-started","pid":23,"at":1786620029812}
+{"type":"provider-started","provider":"codex","pid":34,"at":1786620029815}
+{"type":"terminal","provider":"codex","state":"failed","exitCode":2,"at":1786620065194}

package/tmp/worker-control/rollbridge-bootstrap/terminal-repair-fresh-activity.jsonl

@@ -0,0 +1,38 @@
+{"type":"controller-started","pid":23,"at":1786620086602}
+{"type":"provider-started","provider":"codex","pid":34,"at":1786620086605}
+{"type":"session-available","provider":"codex","sessionId":"019ffadb-09f5-7460-bcd7-0db1e74e9935","at":1786620086862}
+{"type":"activity","provider":"codex","kind":"lifecycle","at":1786620086862}
+{"type":"activity","provider":"codex","kind":"delta","at":1786620091884}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620098162}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620108101}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620130450}
+{"type":"activity","provider":"codex","kind":"delta","at":1786620181139}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620214551}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620233438}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620296843}
+{"type":"activity","provider":"codex","kind":"delta","at":1786620316811}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620326537}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620349522}
+{"type":"activity","provider":"codex","kind":"delta","at":1786620369610}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620386448}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620401793}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620419491}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620428258}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620467781}
+{"type":"activity","provider":"codex","kind":"delta","at":1786620478524}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620514191}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620519855}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620542628}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620597146}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620603744}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620610390}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620615895}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620629789}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620635487}
+{"type":"activity","provider":"codex","kind":"delta","at":1786620645508}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620651900}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620657807}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620663562}
+{"type":"activity","provider":"codex","kind":"tool","at":1786620670250}
+{"type":"activity","provider":"codex","kind":"delta","at":1786620682665}
+{"type":"terminal","provider":"codex","state":"completed","exitCode":0,"at":1786620740752}

package/tmp/worker-control/rollbridge-bootstrap/terminal-repair-fresh-transcript.jsonl

@@ -0,0 +1 @@
+{"version":1,"type":"delegated_result","state":"completed","exitCode":0,"conclusion":"I’ll focus only on the SIGTERM/bootstrap lifecycle race, preserve the current candidate changes, and avoid commits, pushes, deploys, the full suite, and any independent review. I’ll first inspect the existing daemon lifecycle/tests, add a handshake-driven regression, and run it alone to capture the required RED before touching production code.The race boundary is in three sequential creation loops: daemon-wide services, release-owned process/replica startup, and singleton replacement. I’m adding the regression at the CLI boundary with the first service command explicitly recording a “shutdown trigger” event and sending SIGTERM to the daemon itself; later service/replica commands record their PIDs, and every managed child records graceful stop. This avoids health-wait timing and gives an event-ordered proof without sleeps or polling.The focused regression is now a genuine RED for the accepted race: after the shutdown event, both worker replicas start, the daemon exits with code 0, and neither replica records a graceful stop. I’m implementing the narrow coordination boundary now: shutdown will wait for already-admitted deploy ownership to settle, then perform a final ownership sweep; failed/interrupted deploy cleanup will also stop its release explicitly. Prior-daemon advisory orphans remain outside these owned collections.The first fix run exposed a test-handshake issue rather than a lifecycle result: the fixture’s “started” record was emitted before its SIGTERM handler was installed, so a correctly stopped child could die without writing the stop acknowledgment. I moved that readiness event to the server-listening callback. The rerun is still active, so I’m checking whether the FIFO release handshake itself is now blocked before changing any production logic further.The repaired regression is GREEN and now checks the exact two required properties for every post-shutdown-start PID: it appears in the daemon’s managed-process records, and it is no longer alive before the signal handler exits. The fix does not adopt or sweep persisted orphan PIDs; it waits only for deploy promises admitted by this daemon and re-sweeps only its service/singleton/release ownership maps. I’m running the focused bootstrap file, then the directly affected daemon/release lifecycle files only.The full focused bootstrap file revealed an important compatibility constraint: waiting for the entire deploy promise also waits out an existing 60-second health check, delaying SIGTERM shutdown. I’m narrowing the fix to cancellation at every creation boundary instead. Because JavaScript cannot interleave between the cancellation check and registering a new owned process, shutdown’s snapshot will either own the current start or the loop will abort before creating the next one; health waits may remain in flight, but cannot create anything afterward.All relevant focused files are passing: the bootstrap integration file, release-group unit file, and daemon lifecycle integration file. Normal deploy, replicas, services, singletons, failed startup cleanup, shutdown persistence, and prior-orphan reporting remain green. I’m running the requested static checks now, then I’ll inspect the exact diff and worktree status without any further review pass.`npm run lint` found one narrow JSDoc-only issue in the new handshake helper: this repository disallows `unknown` there and requires its `JsonValue` type. I’m correcting that annotation, then I’ll rerun the focused bootstrap file before repeating lint and the remaining requested checks.Implemented the terminal SIGTERM/bootstrap race repair without commit, push, deploy, full suite, or independent review.\n\nChanges:\n\n- Added cancellation checks before each service, release process/replica, and singleton creation boundary.\n- Registered in-progress releases as daemon-owned during bootstrap.\n- Interrupted deploy cleanup explicitly stops only its release and newly started services.\n- Prior-daemon advisory orphans remain untouched and recoverable.\n- Added a deterministic FIFO/event-handshake regression proving post-shutdown-start processes are recorded and dead before daemon exit.\n\nValidation:\n\n- Required RED confirmed: two worker replicas started after shutdown and survived unrecorded.\n- `node --test test/daemon-bootstrap.test.js` — 13 passed\n- `node --test test/release-group.test.js` — 3 passed\n- `node --test test/rollbridge.test.js` — 39 passed\n- `npm run lint` — passed\n- `npm run typecheck` — passed\n- `git diff --check` — passed\n\nThe first lint run found one test JSDoc type error; corrected and rerun successfully. Final status/diff inspected. Existing candidate changes and `tmp/` remain preserved and uncommitted.","continuationHandle":"019ffadb-09f5-7460-bcd7-0db1e74e9935"}

package/tmp/worker-control/rollbridge-bootstrap/terminal-repair-transcript.jsonl

@@ -0,0 +1 @@
+{"version":1,"type":"delegated_result","state":"failed","exitCode":2,"continuationHandle":"019ffad2-c71a-7522-9645-c45214c2ba90"}

package/tmp/worker-control/rollbridge-bootstrap/transcript-2.jsonl

@@ -0,0 +1 @@
+{"version":1,"type":"delegated_result","state":"failed","exitCode":2}

package/tmp/worker-control/rollbridge-bootstrap/transcript-3.jsonl

@@ -0,0 +1 @@
+{"version":1,"type":"delegated_result","state":"completed","exitCode":0,"conclusion":"I’ll inspect the repository guidance, daemon/CLI/control activation flow, and focused tests first. I’ll then create the feature branch and operational plan before making production edits, with the required RED test run recorded.The core path is clear: control-socket `deploy` already funnels through `RollbridgeDaemon.deploy()`, which owns service startup, release health, traffic switching, template refresh, singleton replacement, and failed-attempt cleanup. I’m narrowing the bootstrap work to CLI validation/orchestration around that same method, plus tests for early rejection, successful foreground activation, failure cleanup, and `statePath` orphan safety.I’ve created `feature/daemon-bootstrap-release` and written the scoped operational plan. The interface is intentionally all-or-nothing: bootstrap mode uses explicit `--config`, `--release-path`, `--release-id`, and `--revision`; it does not invoke orphan recovery or kill anything from persisted state. Next I’m adding the focused integration tests before touching production code.The first RED run failed before exercising the feature because dependencies are not installed (`ERR_MODULE_NOT_FOUND: commander`). I’m installing the locked dependencies, then I’ll rerun the same focused file to obtain a genuine missing-behavior RED before production edits.The focused bootstrap tests are now green after the minimal CLI orchestration change, including exact metadata activation, failed health-check cleanup/non-zero exit, and live orphan preservation. I’m adding the explicit plain-daemon regression case and documenting the new foreground interface; no changelog exists in this repository, so I’m following its README/CLI-reference convention.The focused file passes all eight assertions. The first lint run found only test-file style issues (four `no-useless-escape` errors plus JSDoc warnings); I’ve corrected those without changing behavior and am rerunning the focused test and required static checks.All required checks now pass. I’m doing the final diff/status audit for accidental generated or unrelated changes, confirming the branch and uncommitted state, and reviewing the bootstrap failure/shutdown path one last time against attempt ownership and orphan safety.Implemented on new branch `feature/daemon-bootstrap-release`; all changes remain uncommitted.\n\nKey changes:\n\n- Added all-or-nothing daemon bootstrap flags: `--config`, `--release-path`, `--release-id`, and `--revision`.\n- Validates inputs before listeners/processes start.\n- Uses the existing `RollbridgeDaemon.deploy()` activation path.\n- Emits structured bootstrap failure, cleans attempt-owned processes, and exits non-zero.\n- Preserves plain daemon behavior and does not kill `statePath` orphans.\n- Added focused integration coverage and updated README/CLI documentation.\n- Added the requested untracked [plan.md](/home/dev/rollbridge/tmp/worker-control/rollbridge-bootstrap/plan.md).\n\nValidation:\n\n- RED: `node --test test/daemon-bootstrap.test.js` — failed because daemon bootstrap options were unknown.\n- Final: `node --test test/daemon-bootstrap.test.js` — 10 passed, 0 failed.\n- `npm run lint` — passed.\n- `npm run typecheck` — passed.\n- `git diff --check` — passed.\n- Full test suite was not run, as requested.\n\nModified/untracked implementation files:\n\n- [src/cli.js](/home/dev/rollbridge/src/cli.js)\n- [test/daemon-bootstrap.test.js](/home/dev/rollbridge/test/daemon-bootstrap.test.js)\n- [README.md](/home/dev/rollbridge/README.md)\n- [docs/cli.md](/home/dev/rollbridge/docs/cli.md)\n\nNo commit, push, publish, deploy, or live-service modification was performed.","continuationHandle":"019ffac6-1176-7023-8f14-82bae745817f"}

package/tmp/worker-control/rollbridge-bootstrap/transcript.jsonl

@@ -0,0 +1 @@
+{"version":1,"type":"delegated_result","state":"failed","exitCode":2}