rollbridge 0.1.13 → 0.1.14

package/README.md

@@ -409,11 +409,12 @@ rollbridge daemon --config /srv/ticket-server/rollbridge.js \
 ```
 
 The four bootstrap inputs are all-or-nothing and use absolute config/release
-paths. Rollbridge binds its proxy and control listeners, activates the release
-through the normal deploy path, and stays foreground. A failed activation stops
-only processes started by that attempt and exits non-zero; persisted processes
-from a previous daemon are reported as orphans and are never recovered or killed
-implicitly; their live PID records remain in `statePath` for explicit recovery.
+paths. Rollbridge binds its proxy, activates the release through the normal
+deploy path, then exposes the control socket and stays foreground. A failed
+activation stops only processes started by that attempt and exits non-zero;
+persisted processes from a previous daemon are reported as orphans and are never
+recovered or killed implicitly; their live PID records remain in `statePath` for
+explicit recovery.
 
 Start the daemon only when it is not already running:
 

package/docs/cli.md

@@ -35,11 +35,12 @@ such as systemd (see `examples/rollbridge.service`).
 
 For boot/crash recovery, pass an explicit absolute `--config` and all three
 release options together. Rollbridge validates every bootstrap input before it
-binds listeners or starts processes, then binds the listeners and activates that
-exact release through the same deploy path used by the control socket: services,
+binds listeners or starts processes, then binds the proxy and activates that
+exact release through the normal deploy path: services,
 companions, the proxied process and health check, traffic switching, singletons,
-and service-template refresh. It then remains in the foreground with the normal
-signal behavior.
+and service-template refresh. Only after activation succeeds does it expose the
+control socket, preventing another deployment from overlapping bootstrap. It
+then remains in the foreground with the normal signal behavior.
 
 Bootstrap paths must be absolute and normalized, the release path must be an
 accessible directory, and release id/revision values accept letters, numbers,
@@ -47,10 +48,10 @@ dots, underscores, and hyphens (maximum 200 characters, beginning with a letter
 or number). Supplying only some bootstrap options, or an invalid value, exits
 non-zero before listeners start. Activation failure emits a structured
 `bootstrap activation failed` event, cleans up processes owned by that attempt,
-and exits non-zero without inventing an active release. `statePath` entries from
-a previous daemon remain advisory orphans: bootstrap never runs recovery and
-never signals those processes, and retains their live PID records in `statePath`
-for explicit recovery.
+and exits non-zero without exposing the control socket or inventing an active
+release. `statePath` entries from a previous daemon remain advisory orphans:
+bootstrap never runs recovery and never signals those processes, and retains
+their live PID records in `statePath` for explicit recovery.
 
 With no release options, daemon behavior is unchanged: it starts listener-only
 and waits for control-socket deployments.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rollbridge",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Zero-downtime process supervisor and local traffic switcher for deploy-managed apps.",
   "keywords": [
     "deploy",

package/src/cli.js

@@ -39,7 +39,7 @@ export async function runCli(argv) {
       const config = await loadConfig(configPath)
       const daemon = new RollbridgeDaemon({config, configPath})
 
-      await daemon.start()
+      await daemon.start({exposeControl: !bootstrap})
 
       const shutdown = async () => {
         await daemon.shutdown()
@@ -52,6 +52,7 @@ export async function runCli(argv) {
       if (bootstrap) {
         try {
           await daemon.deploy(bootstrap)
+          await daemon.exposeControl()
         } catch {
           daemon.logger("bootstrap activation failed", {releaseId: bootstrap.releaseId, status: "error"})
           await daemon.shutdown()

package/src/daemon.js

@@ -64,11 +64,29 @@ export default class RollbridgeDaemon {
     this.proxy.on("error", (error, req, res) => this.onProxyError(error, req, res))
   }
 
-  /** @returns {Promise<void>} Starts proxy and control listeners. */
-  async start() {
+  /**
+   * Starts daemon listeners.
+   * @param {{exposeControl?: boolean}} [options] - Whether to expose the control socket immediately.
+   * @returns {Promise<void>} Resolves when the requested listeners are ready.
+   */
+  async start({exposeControl = true} = {}) {
     await this.reportOrphans()
     await this.startProxy()
+    if (exposeControl) await this.exposeControl()
+  }
+
+  /** @returns {Promise<void>} Exposes control commands and begins periodic state persistence. */
+  async exposeControl() {
+    if (this.stopping) throw new Error("Rollbridge is shutting down")
+
     await this.startControlServer()
+
+    if (this.stopping) {
+      await this.closeServer(this.controlServer)
+      await fs.rm(this.config.control.path, {force: true})
+      throw new Error("Rollbridge is shutting down")
+    }
+
     this.startStatePersistence()
   }
 

package/test/daemon-bootstrap.test.js

@@ -47,7 +47,7 @@ test("daemon bootstrap activates the exact release through the foreground daemon
   const child = spawnDaemon(fixture, {releaseId: "release-42", revision: "abc123"})
 
   try {
-    await waitForLog(child, "traffic switched")
+    await waitForLog(child, "control socket listening")
     const status = await sendControlCommand({command: {command: "status"}, path: fixture.socketPath})
     const activeRelease = assertRelease(status, "release-42")
 
@@ -64,6 +64,33 @@ test("daemon bootstrap activates the exact release through the foreground daemon
   }
 })
 
+test("daemon bootstrap does not expose control deploys until activation completes", async () => {
+  const fixture = await createFixture({healthGate: true, healthTimeoutMs: 60000})
+  const started = waitForFile(fixture.startedPath)
+  const child = spawnDaemon(fixture, {releaseId: "bootstrap-release", revision: "bootstrap123"})
+
+  try {
+    await started
+    await assert.rejects(() => fs.stat(fixture.socketPath), {code: "ENOENT"})
+
+    await fs.writeFile(fixture.healthGatePath, "ready\n")
+    await waitForLog(child, "control socket listening")
+
+    const status = await sendControlCommand({command: {command: "status"}, path: fixture.socketPath})
+
+    assert.equal(status.activeReleaseId, "bootstrap-release")
+    assert.ok(Array.isArray(status.releases))
+    assert.equal(status.releases.length, 1)
+    assertRelease(status, "bootstrap-release")
+
+    child.kill("SIGTERM")
+    assert.equal((await once(child, "exit"))[0], 0)
+  } finally {
+    if (child.exitCode === null) child.kill("SIGKILL")
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
 test("plain daemon startup remains listener-only with no active release", async () => {
   const fixture = await createFixture()
   const child = spawn(process.execPath, [binPath, "daemon", "--config", fixture.configPath], {stdio: ["pipe", "pipe", "pipe"]})
@@ -182,7 +209,7 @@ test("daemon bootstrap reports but does not kill a live process from statePath",
   const child = spawnDaemon(fixture, {releaseId: "recovered", revision: "def456"})
 
   try {
-    await waitForLog(child, "traffic switched")
+    await waitForLog(child, "control socket listening")
     const status = await sendControlCommand({command: {command: "status"}, path: fixture.socketPath})
 
     assert.ok(leftover.pid !== undefined && isProcessAlive(leftover.pid))
@@ -228,10 +255,10 @@ test("failed daemon bootstrap preserves prior live process records in statePath"
 })
 
 /**
- * @param {{healthPath?: string, healthTimeoutMs?: number, multiProcessSignal?: boolean, persistState?: boolean}} [options] - Fixture options.
- * @returns {Promise<{configPath: string, gatePath: string, lifecyclePath: string, root: string, socketPath: string, startedPath: string, statePath: string, stoppedPath: string}>} Fixture paths.
+ * @param {{healthGate?: boolean, healthPath?: string, healthTimeoutMs?: number, multiProcessSignal?: boolean, persistState?: boolean}} [options] - Fixture options.
+ * @returns {Promise<{configPath: string, gatePath: string, healthGatePath: string, lifecyclePath: string, root: string, socketPath: string, startedPath: string, statePath: string, stoppedPath: string}>} Fixture paths.
  */
-async function createFixture({healthPath = "/ping", healthTimeoutMs = 1000, multiProcessSignal = false, persistState = false} = {}) {
+async function createFixture({healthGate = false, healthPath = "/ping", healthTimeoutMs = 1000, multiProcessSignal = false, persistState = false} = {}) {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-bootstrap-"))
   const socketPath = path.join(root, "control.sock")
   const statePath = path.join(root, "state.json")
@@ -239,9 +266,15 @@ async function createFixture({healthPath = "/ping", healthTimeoutMs = 1000, mult
   const stoppedPath = path.join(root, "stopped.pid")
   const lifecyclePath = path.join(root, "lifecycle.jsonl")
   const gatePath = path.join(root, "continue.fifo")
+  const healthGatePath = path.join(root, "health-ready")
   const configPath = path.join(root, "rollbridge.js")
   const command = `${JSON.stringify(process.execPath)} ${JSON.stringify(dummyAppPath)}`
   const lifecycleEnv = {ROLLBRIDGE_TEST_LIFECYCLE_PATH: lifecyclePath}
+  const webEnv = {
+    ROLLBRIDGE_TEST_STARTED_PATH: startedPath,
+    ROLLBRIDGE_TEST_STOPPED_PATH: stoppedPath,
+    ...(healthGate ? {ROLLBRIDGE_TEST_HEALTH_GATE_PATH: healthGatePath} : {})
+  }
   const config = {
     application: "bootstrap-test",
     control: {path: socketPath},
@@ -249,7 +282,7 @@ async function createFixture({healthPath = "/ping", healthTimeoutMs = 1000, mult
       {command: `trap '' TERM; printf '%s\\n' '{"event":"shutdown"}' >> ${JSON.stringify(lifecyclePath)}; kill -TERM "$ROLLBRIDGE_TEST_DAEMON_PID"; printf '{"event":"started","pid":%s,"processId":"database","replicaIndex":"0"}\\n' "$$" >> ${JSON.stringify(lifecyclePath)}; read ignored < ${JSON.stringify(gatePath)}`, env: lifecycleEnv, id: "database", policy: "service"},
       {command: `exec ${command}`, env: lifecycleEnv, id: "worker", policy: "companion", replicas: 2},
       {command: `exec ${command}`, env: lifecycleEnv, health: {path: healthPath, timeoutMs: healthTimeoutMs}, id: "web", policy: "proxied", port: {from: 0, to: 0}}
-    ] : [{command, env: {ROLLBRIDGE_TEST_STARTED_PATH: startedPath, ROLLBRIDGE_TEST_STOPPED_PATH: stoppedPath}, health: {path: healthPath, timeoutMs: healthTimeoutMs}, id: "web", policy: "proxied", port: {from: 0, to: 0}}],
+    ] : [{command, env: webEnv, health: {path: healthPath, timeoutMs: healthTimeoutMs}, id: "web", policy: "proxied", port: {from: 0, to: 0}}],
     proxy: {host: "127.0.0.1", port: 0},
     ...(persistState ? {statePath} : {})
   }
@@ -264,7 +297,7 @@ async function createFixture({healthPath = "/ping", healthTimeoutMs = 1000, mult
   }
 
   await fs.writeFile(configPath, `${setup}module.exports = ${JSON.stringify(config, null, 2)}\n`)
-  return {configPath, gatePath, lifecyclePath, root, socketPath, startedPath, statePath, stoppedPath}
+  return {configPath, gatePath, healthGatePath, lifecyclePath, root, socketPath, startedPath, statePath, stoppedPath}
 }
 
 /**

package/test/fixtures/dummy-app.js

@@ -15,7 +15,7 @@ if (process.env.ROLLBRIDGE_TEST_STARTED_PATH) {
 
 const server = http.createServer((request, response) => {
   if (request.url === "/ping") {
-    if (healthFails) {
+    if (healthFails || (process.env.ROLLBRIDGE_TEST_HEALTH_GATE_PATH && !fs.existsSync(process.env.ROLLBRIDGE_TEST_HEALTH_GATE_PATH))) {
       response.writeHead(500, {"Content-Type": "application/json"})
       response.end(JSON.stringify({message: "bad release"}))
       return

package/test/package-metadata.test.js

@@ -1,12 +1,16 @@
 // @ts-check
 
 import assert from "node:assert/strict"
+import {execFile} from "node:child_process"
 import fs from "node:fs/promises"
+import os from "node:os"
 import path from "node:path"
 import test from "node:test"
 import {fileURLToPath} from "node:url"
+import {promisify} from "node:util"
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..")
+const execFileAsync = promisify(execFile)
 
 test("package.json declares publish metadata", async () => {
   const pkg = JSON.parse(await fs.readFile(path.join(repoRoot, "package.json"), "utf8"))
@@ -27,3 +31,38 @@ test("a LICENSE file matching the declared license exists", async () => {
   assert.match(license, /MIT License/)
   assert.match(license, /Copyright \(c\) \d{4} kaspernj/)
 })
+
+test("package manifest excludes unexpected operational and coverage files", async (t) => {
+  const fixtureRoot = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-pack-"))
+  t.after(() => fs.rm(fixtureRoot, {force: true, recursive: true}))
+
+  await fs.cp(repoRoot, fixtureRoot, {
+    filter: (source) => {
+      const relative = path.relative(repoRoot, source)
+      return relative !== ".git" && relative !== "node_modules" && relative !== "tmp"
+    },
+    recursive: true,
+  })
+
+  const unexpectedTmpPath = path.join(fixtureRoot, "tmp", "worker-control", "unexpected-transcript.jsonl")
+  const unexpectedCoveragePath = path.join(fixtureRoot, "coverage", "unexpected.txt")
+  await Promise.all([
+    fs.mkdir(path.dirname(unexpectedTmpPath), {recursive: true}),
+    fs.mkdir(path.dirname(unexpectedCoveragePath), {recursive: true}),
+  ])
+  await Promise.all([
+    fs.writeFile(unexpectedTmpPath, '{"operational":"state"}\n'),
+    fs.writeFile(unexpectedCoveragePath, "unexpected coverage output\n"),
+  ])
+
+  const {stdout} = await execFileAsync("npm", ["pack", "--dry-run", "--json"], {cwd: fixtureRoot})
+  /** @type {Array<{path: string}>} */
+  const packageFiles = JSON.parse(stdout)[0].files
+  const packagePaths = packageFiles.map((file) => file.path)
+
+  for (const requiredPath of ["LICENSE", "README.md", "bin/rollbridge", "package.json", "src/cli.js"]) {
+    assert.ok(packagePaths.includes(requiredPath), `expected package to include ${requiredPath}`)
+  }
+  assert.ok(!packagePaths.some((packagePath) => packagePath === "tmp" || packagePath.startsWith("tmp/")))
+  assert.ok(!packagePaths.some((packagePath) => packagePath === "coverage" || packagePath.startsWith("coverage/")))
+})

package/tmp/worker-control/rollbridge-bootstrap/activity-3.jsonl

@@ -1,28 +0,0 @@
-{"type":"controller-started","pid":23,"at":1786618711548}
-{"type":"provider-started","provider":"codex","pid":34,"at":1786618711553}
-{"type":"session-available","provider":"codex","sessionId":"019ffac6-1176-7023-8f14-82bae745817f","at":1786618712506}
-{"type":"activity","provider":"codex","kind":"lifecycle","at":1786618712506}
-{"type":"activity","provider":"codex","kind":"delta","at":1786618717893}
-{"type":"activity","provider":"codex","kind":"tool","at":1786618723182}
-{"type":"activity","provider":"codex","kind":"tool","at":1786618730240}
-{"type":"activity","provider":"codex","kind":"tool","at":1786618740515}
-{"type":"activity","provider":"codex","kind":"tool","at":1786618746269}
-{"type":"activity","provider":"codex","kind":"delta","at":1786618770657}
-{"type":"activity","provider":"codex","kind":"tool","at":1786618811295}
-{"type":"activity","provider":"codex","kind":"tool","at":1786618816349}
-{"type":"activity","provider":"codex","kind":"tool","at":1786618859240}
-{"type":"activity","provider":"codex","kind":"tool","at":1786618872926}
-{"type":"activity","provider":"codex","kind":"delta","at":1786618889245}
-{"type":"activity","provider":"codex","kind":"tool","at":1786618908545}
-{"type":"activity","provider":"codex","kind":"tool","at":1786618913878}
-{"type":"activity","provider":"codex","kind":"delta","at":1786618934507}
-{"type":"activity","provider":"codex","kind":"tool","at":1786618940248}
-{"type":"activity","provider":"codex","kind":"tool","at":1786618945887}
-{"type":"activity","provider":"codex","kind":"tool","at":1786618960106}
-{"type":"activity","provider":"codex","kind":"tool","at":1786618969417}
-{"type":"activity","provider":"codex","kind":"delta","at":1786618976649}
-{"type":"activity","provider":"codex","kind":"tool","at":1786618996642}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619006003}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619014397}
-{"type":"activity","provider":"codex","kind":"delta","at":1786619021770}
-{"type":"terminal","provider":"codex","state":"completed","exitCode":0,"at":1786619026150}

package/tmp/worker-control/rollbridge-bootstrap/current-head-review-activity.jsonl

@@ -1,13 +0,0 @@
-{"type":"controller-started","pid":23,"at":1786619870796}
-{"type":"provider-started","provider":"codex","pid":34,"at":1786619870799}
-{"type":"session-available","provider":"codex","sessionId":"019ffad7-bed8-7861-911f-83cd5de11373","at":1786619871013}
-{"type":"activity","provider":"codex","kind":"lifecycle","at":1786619871014}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619877574}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619886232}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619894201}
-{"type":"activity","provider":"codex","kind":"delta","at":1786619899492}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619905754}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619921741}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619931957}
-{"type":"activity","provider":"codex","kind":"delta","at":1786619937323}
-{"type":"terminal","provider":"codex","state":"completed","exitCode":0,"at":1786620000478}

package/tmp/worker-control/rollbridge-bootstrap/current-head-review-transcript.jsonl

@@ -1 +0,0 @@
-{"version":1,"type":"delegated_result","state":"completed","exitCode":0,"conclusion":"I’ll perform a read-only review of the full uncommitted diff, then trace the daemon bootstrap lifecycle through its existing implementation and focused tests. I’ll avoid edits and the full test suite, and report only material, reproducible issues—or `PASS`.The repaired state preservation path is present, and the focused tests cover the two accepted lifecycle fixes. I’m now checking concurrency boundaries beneath `deploy()`—especially whether `ReleaseGroup.start()` and process/service startup remain safely stoppable when shutdown overlaps activation—and validating persistence shape compatibility.- High — [src/daemon.js:747](/home/dev/rollbridge/src/daemon.js:747): shutdown snapshots `services`, `singletons`, and `startingReleases` only once, while the concurrent bootstrap deployment can continue creating processes. `ReleaseGroup.start()` has no cancellation check inside its process/replica loop ([src/release-group.js:73](/home/dev/rollbridge/src/release-group.js:73)), and singleton replacement similarly continues after each await ([src/daemon.js:539](/home/dev/rollbridge/src/daemon.js:539)). If SIGTERM arrives while an early service, companion replica, or singleton is starting/stopping, shutdown may finish its snapshot while deployment starts a later process. The signal handler then calls `process.exit(0)` ([src/cli.js:44](/home/dev/rollbridge/src/cli.js:44)), potentially leaving that detached child running and unrecorded. The new signal test only uses one release process and signals during its health wait, so it does not cover this realistic multi-process race.","continuationHandle":"019ffad7-bed8-7861-911f-83cd5de11373"}

package/tmp/worker-control/rollbridge-bootstrap/fs-probe-10.jsonl

@@ -1 +0,0 @@
-probe\n

package/tmp/worker-control/rollbridge-bootstrap/plan.md

@@ -1,9 +0,0 @@
-# Rollbridge daemon bootstrap plan
-
-1. Add focused CLI/daemon bootstrap tests first, covering all-or-nothing and safe absolute input validation before binding, exact activation through the normal deploy path, structured failure with attempt-owned cleanup and non-zero exit, unchanged plain-daemon startup, and preservation/reporting of live `statePath` orphans.
-2. Run the new focused test file alone and record the expected RED result before production changes.
-3. Add the minimal foreground daemon bootstrap options and validation, then start listeners and call the existing `RollbridgeDaemon.deploy()` path; on activation failure, log a safe structured failure, shut down only objects owned by this attempt, and propagate failure.
-4. Update the CLI reference and README daemon usage, then run the changed focused test files individually, `npm run lint`, and `npm run typecheck`.
-5. Inspect the final diff/status and leave every change uncommitted for independent verification.
-
-Scope note: bootstrap requires explicit `--release-path`, `--release-id`, and `--revision` together with an explicit `--config`; values must be non-empty safe tokens where applicable and paths must be absolute, normalized, and usable. No orphan recovery or process killing is part of bootstrap.

package/tmp/worker-control/rollbridge-bootstrap/repair-activity.jsonl

@@ -1,3 +0,0 @@
-{"type":"controller-started","pid":23,"at":1786619408071}
-{"type":"provider-started","provider":"codex","pid":34,"at":1786619408074}
-{"type":"terminal","provider":"codex","state":"failed","exitCode":2,"at":1786619520214}

package/tmp/worker-control/rollbridge-bootstrap/repair-fresh-activity.jsonl

@@ -1,25 +0,0 @@
-{"type":"controller-started","pid":23,"at":1786619544825}
-{"type":"provider-started","provider":"codex","pid":34,"at":1786619544829}
-{"type":"session-available","provider":"codex","sessionId":"019ffad2-c71a-7522-9645-c45214c2ba90","at":1786619545505}
-{"type":"activity","provider":"codex","kind":"lifecycle","at":1786619545506}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619552059}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619560395}
-{"type":"activity","provider":"codex","kind":"delta","at":1786619567749}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619582034}
-{"type":"activity","provider":"codex","kind":"delta","at":1786619609721}
-{"type":"activity","provider":"codex","kind":"delta","at":1786619632612}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619657491}
-{"type":"activity","provider":"codex","kind":"delta","at":1786619692967}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619698926}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619706811}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619724983}
-{"type":"activity","provider":"codex","kind":"delta","at":1786619730097}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619736678}
-{"type":"activity","provider":"codex","kind":"delta","at":1786619742798}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619748670}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619754672}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619764194}
-{"type":"activity","provider":"codex","kind":"delta","at":1786619775649}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619780713}
-{"type":"activity","provider":"codex","kind":"delta","at":1786619786176}
-{"type":"terminal","provider":"codex","state":"completed","exitCode":0,"at":1786619829038}

package/tmp/worker-control/rollbridge-bootstrap/repair-fresh-transcript.jsonl

@@ -1 +0,0 @@
-{"version":1,"type":"delegated_result","state":"completed","exitCode":0,"conclusion":"I’ll resume in place and preserve the current worktree. I’ll first inspect the branch, repository guidance, lifecycle code, and existing tests; then I’ll add only focused deterministic regressions and capture their expected failures before touching production code.The root conflict is confirmed: startup reads prior live PIDs into an advisory in-memory list, but the first persistence snapshot deliberately drops that list, and shutdown then unconditionally removes the file. I’m going to make the regressions assert two boundaries directly: SIGTERM while bootstrap activation is provably in-flight, and recoverable prior PID records after bootstrap persistence plus shutdown/failure.The focused regressions are now in place without timing sleeps: the signal test gates on the daemon’s own “control socket listening” milestone, and persistence checks decode the actual state store through `liveProcesses`. I’m running only the bootstrap test file now to record the RED failures before production edits.RED is confirmed with exactly the three expected failures: bootstrap SIGTERM exits by signal instead of code 0, and both successful-shutdown and failed-activation paths lose the prior PID record. I’m now making the minimal ownership changes: register signal handling before activation, track the in-progress release as daemon-owned for shutdown, and carry advisory orphan records through snapshots and clean shutdown.The focused file is GREEN. I’m tightening the signal regression before final checks so it proves the managed child was actually started and then stopped—not just that the CLI intercepted SIGTERM early. The test will use a filesystem watch/marker handshake from the existing fixture, still with no sleeps or polling.The strengthened regression is GREEN and confirms the exact started PID received the daemon’s graceful stop before the CLI exited. The focused persistence regressions also remain GREEN. I’m moving to the requested static checks now, without running the full suite.`npm run lint` reached its bundled typecheck and found one narrow test typing issue: the async iterator’s optional `return` method. I’ve corrected that optional call and will re-run the focused test before repeating the requested checks.All requested test and static checks are now passing. I made one small documentation clarification because the durability behavior is operator-visible: live advisory orphan records remain in `statePath` for explicit recovery. I’m doing the final whitespace, diff, branch, and worktree inspection now; I will leave the existing `tmp/` and all unrelated candidate changes untouched.Implemented both HIGH lifecycle fixes on `feature/daemon-bootstrap-release`:\n\n- SIGINT/SIGTERM ownership is installed before bootstrap activation.\n- In-progress releases are daemon-owned and stopped during shutdown.\n- Prior-daemon orphan PID records remain persisted across snapshots, successful shutdown, and failed bootstrap activation.\n- Added deterministic regressions using explicit process/file handshakes—no sleeps or retries.\n- Updated documentation to describe recoverable orphan records.\n\nRED was confirmed with three expected failures before production edits. Final checks:\n\n- `node --test test/daemon-bootstrap.test.js` — 12 passed\n- `npm run lint` — passed\n- `npm run typecheck` — passed\n- `git diff --check` — passed\n\nFinal branch/status inspected. No full suite, commit, push, or deploy performed. Existing unrelated changes and `tmp/` remain untouched.","continuationHandle":"019ffad2-c71a-7522-9645-c45214c2ba90"}

package/tmp/worker-control/rollbridge-bootstrap/repair-transcript.jsonl

@@ -1 +0,0 @@
-{"version":1,"type":"delegated_result","state":"failed","exitCode":2,"continuationHandle":"019ffac6-1176-7023-8f14-82bae745817f"}

package/tmp/worker-control/rollbridge-bootstrap/review-activity.jsonl

@@ -1,14 +0,0 @@
-{"type":"controller-started","pid":23,"at":1786619089604}
-{"type":"provider-started","provider":"codex","pid":34,"at":1786619089609}
-{"type":"session-available","provider":"codex","sessionId":"019ffacb-d3c0-7f93-affa-c472258a1b8b","at":1786619089955}
-{"type":"activity","provider":"codex","kind":"lifecycle","at":1786619089955}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619096716}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619104649}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619110897}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619130819}
-{"type":"activity","provider":"codex","kind":"delta","at":1786619140752}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619146978}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619159062}
-{"type":"activity","provider":"codex","kind":"tool","at":1786619164311}
-{"type":"activity","provider":"codex","kind":"delta","at":1786619179382}
-{"type":"terminal","provider":"codex","state":"completed","exitCode":0,"at":1786619221045}

package/tmp/worker-control/rollbridge-bootstrap/review-transcript.jsonl

@@ -1 +0,0 @@
-{"version":1,"type":"delegated_result","state":"completed","exitCode":0,"conclusion":"I’ll review the exact working-tree candidate read-only, first inventorying repository instructions and the complete diff, then tracing the affected daemon/deploy/state/recovery paths and targeted tests. I won’t modify anything or run the full suite.The candidate is small and localized, but its safety claims depend heavily on existing daemon startup and deploy cleanup behavior. I’m tracing those internals now, including persisted-state loading and signal/exit handling, and will run only focused tests relevant to this interface.Two lifecycle interactions warrant direct verification: interruption during a slow bootstrap, and what remains recoverable in `statePath` when live prior-daemon processes were only reported. I’m checking those against focused existing/new tests and source behavior; no repository files will be changed.- High — [src/cli.js](/home/dev/rollbridge/src/cli.js:42): SIGINT/SIGTERM handlers are installed only after `daemon.deploy()` completes at line 46. A service-manager stop or restart during process startup or a long health check therefore performs Node’s default termination instead of `daemon.shutdown()`. Managed children are detached ([src/managed-process.js](/home/dev/rollbridge/src/managed-process.js:86)), so they can survive while the proxy/control socket and state are left unclean. This contradicts the documented “normal signal behavior” and is not covered by the bootstrap tests.\n\n- High — [src/daemon.js](/home/dev/rollbridge/src/daemon.js:677): After prior-daemon processes are read into the in-memory orphan list, startup immediately persists a new snapshot that deliberately excludes those orphans (lines 691–700), overwriting their only durable PID records. A later clean shutdown also deletes `statePath` (lines 750–755). Thus a live prior-daemon process is not killed, but becomes unrecoverable through `rollbridge recover` once bootstrap starts—or immediately when failed activation invokes shutdown. The test at [test/daemon-bootstrap.test.js](/home/dev/rollbridge/test/daemon-bootstrap.test.js:108) checks only process liveness and in-memory status, never preservation of the persisted orphan records. This conflicts with the documentation that previous `statePath` entries remain advisory orphans.","continuationHandle":"019ffacb-d3c0-7f93-affa-c472258a1b8b"}

package/tmp/worker-control/rollbridge-bootstrap/terminal-repair-activity.jsonl

@@ -1,3 +0,0 @@
-{"type":"controller-started","pid":23,"at":1786620029812}
-{"type":"provider-started","provider":"codex","pid":34,"at":1786620029815}
-{"type":"terminal","provider":"codex","state":"failed","exitCode":2,"at":1786620065194}

package/tmp/worker-control/rollbridge-bootstrap/terminal-repair-fresh-activity.jsonl

@@ -1,38 +0,0 @@
-{"type":"controller-started","pid":23,"at":1786620086602}
-{"type":"provider-started","provider":"codex","pid":34,"at":1786620086605}
-{"type":"session-available","provider":"codex","sessionId":"019ffadb-09f5-7460-bcd7-0db1e74e9935","at":1786620086862}
-{"type":"activity","provider":"codex","kind":"lifecycle","at":1786620086862}
-{"type":"activity","provider":"codex","kind":"delta","at":1786620091884}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620098162}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620108101}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620130450}
-{"type":"activity","provider":"codex","kind":"delta","at":1786620181139}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620214551}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620233438}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620296843}
-{"type":"activity","provider":"codex","kind":"delta","at":1786620316811}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620326537}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620349522}
-{"type":"activity","provider":"codex","kind":"delta","at":1786620369610}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620386448}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620401793}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620419491}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620428258}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620467781}
-{"type":"activity","provider":"codex","kind":"delta","at":1786620478524}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620514191}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620519855}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620542628}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620597146}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620603744}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620610390}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620615895}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620629789}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620635487}
-{"type":"activity","provider":"codex","kind":"delta","at":1786620645508}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620651900}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620657807}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620663562}
-{"type":"activity","provider":"codex","kind":"tool","at":1786620670250}
-{"type":"activity","provider":"codex","kind":"delta","at":1786620682665}
-{"type":"terminal","provider":"codex","state":"completed","exitCode":0,"at":1786620740752}

package/tmp/worker-control/rollbridge-bootstrap/terminal-repair-fresh-transcript.jsonl

@@ -1 +0,0 @@
-{"version":1,"type":"delegated_result","state":"completed","exitCode":0,"conclusion":"I’ll focus only on the SIGTERM/bootstrap lifecycle race, preserve the current candidate changes, and avoid commits, pushes, deploys, the full suite, and any independent review. I’ll first inspect the existing daemon lifecycle/tests, add a handshake-driven regression, and run it alone to capture the required RED before touching production code.The race boundary is in three sequential creation loops: daemon-wide services, release-owned process/replica startup, and singleton replacement. I’m adding the regression at the CLI boundary with the first service command explicitly recording a “shutdown trigger” event and sending SIGTERM to the daemon itself; later service/replica commands record their PIDs, and every managed child records graceful stop. This avoids health-wait timing and gives an event-ordered proof without sleeps or polling.The focused regression is now a genuine RED for the accepted race: after the shutdown event, both worker replicas start, the daemon exits with code 0, and neither replica records a graceful stop. I’m implementing the narrow coordination boundary now: shutdown will wait for already-admitted deploy ownership to settle, then perform a final ownership sweep; failed/interrupted deploy cleanup will also stop its release explicitly. Prior-daemon advisory orphans remain outside these owned collections.The first fix run exposed a test-handshake issue rather than a lifecycle result: the fixture’s “started” record was emitted before its SIGTERM handler was installed, so a correctly stopped child could die without writing the stop acknowledgment. I moved that readiness event to the server-listening callback. The rerun is still active, so I’m checking whether the FIFO release handshake itself is now blocked before changing any production logic further.The repaired regression is GREEN and now checks the exact two required properties for every post-shutdown-start PID: it appears in the daemon’s managed-process records, and it is no longer alive before the signal handler exits. The fix does not adopt or sweep persisted orphan PIDs; it waits only for deploy promises admitted by this daemon and re-sweeps only its service/singleton/release ownership maps. I’m running the focused bootstrap file, then the directly affected daemon/release lifecycle files only.The full focused bootstrap file revealed an important compatibility constraint: waiting for the entire deploy promise also waits out an existing 60-second health check, delaying SIGTERM shutdown. I’m narrowing the fix to cancellation at every creation boundary instead. Because JavaScript cannot interleave between the cancellation check and registering a new owned process, shutdown’s snapshot will either own the current start or the loop will abort before creating the next one; health waits may remain in flight, but cannot create anything afterward.All relevant focused files are passing: the bootstrap integration file, release-group unit file, and daemon lifecycle integration file. Normal deploy, replicas, services, singletons, failed startup cleanup, shutdown persistence, and prior-orphan reporting remain green. I’m running the requested static checks now, then I’ll inspect the exact diff and worktree status without any further review pass.`npm run lint` found one narrow JSDoc-only issue in the new handshake helper: this repository disallows `unknown` there and requires its `JsonValue` type. I’m correcting that annotation, then I’ll rerun the focused bootstrap file before repeating lint and the remaining requested checks.Implemented the terminal SIGTERM/bootstrap race repair without commit, push, deploy, full suite, or independent review.\n\nChanges:\n\n- Added cancellation checks before each service, release process/replica, and singleton creation boundary.\n- Registered in-progress releases as daemon-owned during bootstrap.\n- Interrupted deploy cleanup explicitly stops only its release and newly started services.\n- Prior-daemon advisory orphans remain untouched and recoverable.\n- Added a deterministic FIFO/event-handshake regression proving post-shutdown-start processes are recorded and dead before daemon exit.\n\nValidation:\n\n- Required RED confirmed: two worker replicas started after shutdown and survived unrecorded.\n- `node --test test/daemon-bootstrap.test.js` — 13 passed\n- `node --test test/release-group.test.js` — 3 passed\n- `node --test test/rollbridge.test.js` — 39 passed\n- `npm run lint` — passed\n- `npm run typecheck` — passed\n- `git diff --check` — passed\n\nThe first lint run found one test JSDoc type error; corrected and rerun successfully. Final status/diff inspected. Existing candidate changes and `tmp/` remain preserved and uncommitted.","continuationHandle":"019ffadb-09f5-7460-bcd7-0db1e74e9935"}

package/tmp/worker-control/rollbridge-bootstrap/terminal-repair-transcript.jsonl

@@ -1 +0,0 @@
-{"version":1,"type":"delegated_result","state":"failed","exitCode":2,"continuationHandle":"019ffad2-c71a-7522-9645-c45214c2ba90"}

package/tmp/worker-control/rollbridge-bootstrap/transcript-2.jsonl

@@ -1 +0,0 @@
-{"version":1,"type":"delegated_result","state":"failed","exitCode":2}

package/tmp/worker-control/rollbridge-bootstrap/transcript-3.jsonl

@@ -1 +0,0 @@
-{"version":1,"type":"delegated_result","state":"completed","exitCode":0,"conclusion":"I’ll inspect the repository guidance, daemon/CLI/control activation flow, and focused tests first. I’ll then create the feature branch and operational plan before making production edits, with the required RED test run recorded.The core path is clear: control-socket `deploy` already funnels through `RollbridgeDaemon.deploy()`, which owns service startup, release health, traffic switching, template refresh, singleton replacement, and failed-attempt cleanup. I’m narrowing the bootstrap work to CLI validation/orchestration around that same method, plus tests for early rejection, successful foreground activation, failure cleanup, and `statePath` orphan safety.I’ve created `feature/daemon-bootstrap-release` and written the scoped operational plan. The interface is intentionally all-or-nothing: bootstrap mode uses explicit `--config`, `--release-path`, `--release-id`, and `--revision`; it does not invoke orphan recovery or kill anything from persisted state. Next I’m adding the focused integration tests before touching production code.The first RED run failed before exercising the feature because dependencies are not installed (`ERR_MODULE_NOT_FOUND: commander`). I’m installing the locked dependencies, then I’ll rerun the same focused file to obtain a genuine missing-behavior RED before production edits.The focused bootstrap tests are now green after the minimal CLI orchestration change, including exact metadata activation, failed health-check cleanup/non-zero exit, and live orphan preservation. I’m adding the explicit plain-daemon regression case and documenting the new foreground interface; no changelog exists in this repository, so I’m following its README/CLI-reference convention.The focused file passes all eight assertions. The first lint run found only test-file style issues (four `no-useless-escape` errors plus JSDoc warnings); I’ve corrected those without changing behavior and am rerunning the focused test and required static checks.All required checks now pass. I’m doing the final diff/status audit for accidental generated or unrelated changes, confirming the branch and uncommitted state, and reviewing the bootstrap failure/shutdown path one last time against attempt ownership and orphan safety.Implemented on new branch `feature/daemon-bootstrap-release`; all changes remain uncommitted.\n\nKey changes:\n\n- Added all-or-nothing daemon bootstrap flags: `--config`, `--release-path`, `--release-id`, and `--revision`.\n- Validates inputs before listeners/processes start.\n- Uses the existing `RollbridgeDaemon.deploy()` activation path.\n- Emits structured bootstrap failure, cleans attempt-owned processes, and exits non-zero.\n- Preserves plain daemon behavior and does not kill `statePath` orphans.\n- Added focused integration coverage and updated README/CLI documentation.\n- Added the requested untracked [plan.md](/home/dev/rollbridge/tmp/worker-control/rollbridge-bootstrap/plan.md).\n\nValidation:\n\n- RED: `node --test test/daemon-bootstrap.test.js` — failed because daemon bootstrap options were unknown.\n- Final: `node --test test/daemon-bootstrap.test.js` — 10 passed, 0 failed.\n- `npm run lint` — passed.\n- `npm run typecheck` — passed.\n- `git diff --check` — passed.\n- Full test suite was not run, as requested.\n\nModified/untracked implementation files:\n\n- [src/cli.js](/home/dev/rollbridge/src/cli.js)\n- [test/daemon-bootstrap.test.js](/home/dev/rollbridge/test/daemon-bootstrap.test.js)\n- [README.md](/home/dev/rollbridge/README.md)\n- [docs/cli.md](/home/dev/rollbridge/docs/cli.md)\n\nNo commit, push, publish, deploy, or live-service modification was performed.","continuationHandle":"019ffac6-1176-7023-8f14-82bae745817f"}

package/tmp/worker-control/rollbridge-bootstrap/transcript.jsonl

@@ -1 +0,0 @@
-{"version":1,"type":"delegated_result","state":"failed","exitCode":2}