rollbridge 0.1.28 → 0.1.30

package/test/owner-replacement.test.js

@@ -0,0 +1,772 @@
+// @ts-check
+
+import assert from "node:assert/strict"
+import {spawn} from "node:child_process"
+import {once} from "node:events"
+import fs from "node:fs/promises"
+import net from "node:net"
+import os from "node:os"
+import path from "node:path"
+import test from "node:test"
+import {fileURLToPath} from "node:url"
+import {sendControlCommand} from "../src/control-client.js"
+import {isLegacyGuardianPrepareDiagnostic} from "../src/daemon.js"
+import GuardianClient from "../src/guardian-client.js"
+import {findAvailablePort} from "../src/port-allocator.js"
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..")
+const binPath = path.join(repoRoot, "bin", "rollbridge")
+const dummyAppPath = path.join(repoRoot, "test", "fixtures", "dummy-app.js")
+const legacyDaemonPath = path.join(repoRoot, "test", "fixtures", "pre-split3-daemon-runner.js")
+
+test("first pre-split package upgrade is explicitly disruptive and later replacements are atomic", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-legacy-"))
+  const socketPath = path.join(root, "rollbridge.sock")
+  const nextSocketPath = path.join(root, "next.sock")
+  const statePath = path.join(root, "state.json")
+  const configPath = path.join(root, "rollbridge.cjs")
+  const daemonPidPath = path.join(root, "daemon.pid")
+  const releasePath = path.join(root, "v1")
+  const runtimePath = path.join(root, "runtime")
+  const firstPackagePath = path.join(root, "first-package")
+  const secondPackagePath = path.join(root, "second-package")
+  const proxyPort = await findAvailablePort({host: "127.0.0.1", range: {from: 25000, to: 25999}, usedPorts: new Set()})
+  let owner
+  let interruptedConnection
+  let retainedConnection
+  let blockedUpgradeGuardian
+  let currentControlPath = socketPath
+
+  try {
+    await fs.mkdir(releasePath)
+    await makeFifo(path.join(releasePath, "worker.fifo"))
+    await writeConfig(configPath, config({controlPath: socketPath, extraCompanion: false, proxyPort, statePath}))
+    owner = spawn(process.execPath, [legacyDaemonPath, "daemon", "--config", configPath], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(owner, "control socket listening")
+    assert.ok(owner.pid)
+    await fs.writeFile(daemonPidPath, `${owner.pid}\n`)
+    await sendControlCommand({command: {command: "deploy", releaseId: "v1", releasePath, revision: "v1"}, path: socketPath})
+    const legacyStatus = await sendControlCommand({command: {command: "status"}, path: socketPath})
+    const legacyWorkerPid = releaseProcessPid(legacyStatus, "v1", "worker")
+
+    interruptedConnection = await openWebSocket(proxyPort)
+    const interrupted = once(interruptedConnection, "close")
+    await prepareCandidatePackage(firstPackagePath)
+    await writeConfig(configPath, config({controlPath: socketPath, extraCompanion: true, proxyPort, statePath}))
+    const mismatchedUpgrade = await runEnsureDaemon({configPath, daemonPidPath, logPath: path.join(root, "mismatch.log"), packagePath: firstPackagePath, runtimePath})
+
+    assert.equal(mismatchedUpgrade.code, 1)
+    assert.match(await fs.readFile(path.join(root, "mismatch.log"), "utf8"), /legacy guardian bridge requires the incumbent config identity unchanged/)
+    assert.equal(interruptedConnection.destroyed, false, "config mismatch must leave the legacy listener serving")
+    assert.equal(releaseProcessPid(await sendControlCommand({command: {command: "status"}, path: socketPath}), "v1", "worker"), legacyWorkerPid)
+    await writeConfig(configPath, config({controlPath: socketPath, extraCompanion: false, proxyPort, statePath}))
+    blockedUpgradeGuardian = net.createServer()
+
+    await listenUnix(blockedUpgradeGuardian, `${statePath}.split3-guardian.sock`)
+    const blockedUpgrade = await runEnsureDaemon({configPath, daemonPidPath, logPath: path.join(root, "blocked.log"), packagePath: firstPackagePath, runtimePath})
+
+    assert.equal(blockedUpgrade.code, 1)
+    assert.match(await fs.readFile(path.join(root, "blocked.log"), "utf8"), /Legacy upgrade guardian socket .* already exists; refusing legacy upgrade/)
+    assert.equal(interruptedConnection.destroyed, false, "candidate preparation failure must leave the legacy listener serving")
+    assert.equal(releaseProcessPid(await sendControlCommand({command: {command: "status"}, path: socketPath}), "v1", "worker"), legacyWorkerPid)
+    await closeServer(blockedUpgradeGuardian)
+    const firstUpgrade = await run(process.execPath, [
+      path.join(firstPackagePath, "bin", "rollbridge"), "ensure-daemon", "--config", configPath,
+      "--daemon-runtime-path", runtimePath, "--daemon-log-path", path.join(root, "first.log"),
+      "--daemon-pid-path", daemonPidPath, "--daemon-start-timeout-ms", "3000"
+    ])
+
+    assert.equal(firstUpgrade.code, 0, `${firstUpgrade.stderr}\n${await fs.readFile(path.join(root, "first.log"), "utf8")}`)
+    assert.deepEqual(JSON.parse(firstUpgrade.stdout).ownerTransition, {
+      disruptive: true,
+      mode: "legacy-first-upgrade",
+      reason: "pre-split guardian and daemon lacked atomic replacement protocol"
+    })
+    await interrupted
+    const bridged = await sendControlCommand({command: {command: "status"}, path: socketPath})
+
+    assert.deepEqual(bridged.ownerTransition, {
+      disruptive: true,
+      mode: "legacy-first-upgrade",
+      reason: "pre-split guardian and daemon lacked atomic replacement protocol"
+    })
+    assert.equal(releaseProcessPid(bridged, "v1", "worker"), legacyWorkerPid)
+    assert.equal(bridged.activeReleaseId, "v1")
+
+    retainedConnection = await openWebSocket(proxyPort)
+    let retainedConnectionClosed = false
+    retainedConnection.once("close", () => { retainedConnectionClosed = true })
+    await prepareCandidatePackage(secondPackagePath)
+    await writeConfig(configPath, config({controlPath: nextSocketPath, extraCompanion: true, proxyPort, statePath}))
+    const secondUpgrade = await run(process.execPath, [
+      path.join(secondPackagePath, "bin", "rollbridge"), "ensure-daemon", "--config", configPath,
+      "--daemon-runtime-path", runtimePath, "--daemon-log-path", path.join(root, "second.log"),
+      "--daemon-pid-path", daemonPidPath, "--daemon-start-timeout-ms", "3000"
+    ])
+
+    assert.equal(secondUpgrade.code, 0, `${secondUpgrade.stderr}\n${await fs.readFile(path.join(root, "second.log"), "utf8")}`)
+    currentControlPath = nextSocketPath
+    assert.equal(retainedConnectionClosed, false, "protocol-capable replacement must retain established proxy connections")
+    const replaced = await sendControlCommand({command: {command: "status"}, path: nextSocketPath})
+
+    assert.equal(releaseProcessPid(replaced, "v1", "worker"), legacyWorkerPid)
+    assert.equal(replaced.activeReleaseId, "v1")
+    retainedConnection.destroy()
+    const shutdown = sendControlCommand({command: {command: "shutdown"}, path: nextSocketPath})
+    await fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n")
+    await shutdown
+  } finally {
+    interruptedConnection?.destroy()
+    retainedConnection?.destroy()
+    if (blockedUpgradeGuardian?.listening) await closeServer(blockedUpgradeGuardian).catch(() => undefined)
+    if (owner && owner.exitCode === null && owner.signalCode === null) owner.kill("SIGKILL")
+    try {
+      const status = await sendControlCommand({command: {command: "status"}, path: currentControlPath})
+
+      if (status.activeReleaseId) {
+        const shutdown = sendControlCommand({command: {command: "shutdown"}, path: currentControlPath}).catch(() => undefined)
+        await Promise.all([fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n").catch(() => undefined), shutdown])
+      }
+    } catch (_error) {
+      // The exact fixture daemon is already stopped or failed before publishing control.
+    }
+    await stopGuardian(statePath)
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
+test("ensure-daemon owns and reports the exact candidate exit before readiness", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-candidate-exit-"))
+  const configPath = path.join(root, "rollbridge.cjs")
+  const evidencePath = path.join(root, "candidate.json")
+  const packagePath = path.join(root, "candidate-package")
+  const runtimePath = path.join(root, "runtime")
+  const socketPath = path.join(root, "rollbridge.sock")
+  const statePath = path.join(root, "state.json")
+
+  try {
+    await writeConfig(configPath, config({controlPath: socketPath, extraCompanion: false, statePath}))
+    await prepareCandidatePackage(packagePath)
+    await installCandidateExit(packagePath, evidencePath, 47)
+    const ensured = await run(process.execPath, [
+      path.join(packagePath, "bin", "rollbridge"), "ensure-daemon", "--config", configPath,
+      "--daemon-runtime-path", runtimePath, "--daemon-log-path", path.join(root, "daemon.log"),
+      "--daemon-pid-path", path.join(root, "daemon.pid"), "--daemon-start-timeout-ms", "3000"
+    ])
+    const candidate = JSON.parse(await fs.readFile(evidencePath, "utf8"))
+
+    assert.equal(candidate.ppid, ensured.pid, "the recorded process must be the candidate spawned by this exact ensuring CLI")
+    assert.notEqual(candidate.pid, ensured.pid)
+    assert.deepEqual(candidate.argv.slice(2), ["daemon", "--config", configPath])
+    assert.equal(ensured.code, 1)
+    assert.match(ensured.stderr, new RegExp(`Rollbridge daemon candidate ${candidate.pid} exited before readiness \\(code 47, signal none\\)`))
+    assert.doesNotMatch(ensured.stderr, /did not become ready within/)
+  } finally {
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
+test("legacy disruptive bridge rejects non-protocol guardian failures exactly", () => {
+  assert.equal(isLegacyGuardianPrepareDiagnostic("Guardian prepare-owner-replacement requires a process key"), true)
+  assert.equal(isLegacyGuardianPrepareDiagnostic("Unknown guardian command: prepare-owner-replacement"), true)
+  for (const diagnostic of [
+    "Unknown guardian command: deploy",
+    "Unknown guardian command: prepare-owner-replacement ",
+    "Guardian authentication failed",
+    "connect ECONNREFUSED /tmp/guardian.sock",
+    "Process guardian connection closed while awaiting prepare-owner-replacement",
+    "Guardian owner authority mismatch",
+    "Malformed guardian response"
+  ]) assert.equal(isLegacyGuardianPrepareDiagnostic(diagnostic), false, diagnostic)
+})
+
+test("ensure-daemon atomically replaces incompatible config, socket, and package authority", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-"))
+  const oldSocketPath = path.join(root, "old.sock")
+  const newSocketPath = path.join(root, "new.sock")
+  const statePath = path.join(root, "state.json")
+  const configPath = path.join(root, "rollbridge.cjs")
+  const runtimePath = path.join(root, "runtime")
+  const packagePath = path.join(root, "candidate-package")
+  const v1Path = path.join(root, "v1")
+  const v2Path = path.join(root, "v2")
+  let owner
+
+  try {
+    await Promise.all([fs.mkdir(v1Path), fs.mkdir(v2Path)])
+    await makeFifo(path.join(v1Path, "worker.fifo"))
+    await makeFifo(path.join(v2Path, "worker.fifo"))
+    await writeConfig(configPath, config({controlPath: oldSocketPath, extraCompanion: false, statePath}))
+    owner = spawn(process.execPath, [binPath, "daemon", "--config", configPath], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(owner, "control socket listening")
+    await sendControlCommand({command: {command: "deploy", releaseId: "v1", releasePath: v1Path, revision: "v1"}, path: oldSocketPath})
+    const before = await sendControlCommand({command: {command: "status"}, path: oldSocketPath})
+    const oldRuntime = /** @type {{digest: string}} */ (before.daemonRuntime)
+    const workerPid = releaseProcessPid(before, "v1", "worker")
+
+    await prepareCandidatePackage(packagePath, {dropCommitResponse: true})
+    await writeConfig(configPath, config({controlPath: newSocketPath, extraCompanion: true, statePath}))
+    const ensured = await run(process.execPath, [
+      path.join(packagePath, "bin", "rollbridge"), "ensure-daemon", "--config", configPath,
+      "--daemon-runtime-path", runtimePath, "--daemon-log-path", path.join(root, "daemon.log"),
+      "--daemon-pid-path", path.join(root, "daemon.pid"), "--daemon-start-timeout-ms", "3000"
+    ])
+
+    const daemonLog = await fs.readFile(path.join(root, "daemon.log"), "utf8")
+
+    assert.equal(ensured.code, 0, `${ensured.stderr}\n${daemonLog}`)
+    const transferred = await sendControlCommand({command: {command: "status"}, path: newSocketPath})
+    const newRuntime = /** @type {{digest: string, path: string}} */ (transferred.daemonRuntime)
+
+    assert.equal(transferred.activeReleaseId, "v1")
+    assert.deepEqual(transferred.releaseReferences, [{releaseId: "v1", releasePath: v1Path}])
+    assert.equal(releaseProcessPid(transferred, "v1", "worker"), workerPid)
+    assert.notEqual(newRuntime.digest, oldRuntime.digest)
+    assert.equal(path.dirname(newRuntime.path), runtimePath)
+
+    await fs.rm(packagePath, {force: true, recursive: true})
+    await sendControlCommand({command: {command: "deploy", releaseId: "v2", releasePath: v2Path, revision: "v2"}, path: newSocketPath})
+    const deployed = await sendControlCommand({command: {command: "status"}, path: newSocketPath})
+
+    assert.equal(deployed.activeReleaseId, "v2")
+    assert.deepEqual(deployed.releaseReferences, [
+      {releaseId: "v1", releasePath: v1Path},
+      {releaseId: "v2", releasePath: v2Path}
+    ])
+    assert.equal(releaseProcessPid(deployed, "v1", "worker"), workerPid)
+
+    const shutdown = sendControlCommand({command: {command: "shutdown"}, path: newSocketPath})
+    await Promise.all([
+      fs.writeFile(path.join(v1Path, "worker.fifo"), "drained\n"),
+      fs.writeFile(path.join(v2Path, "worker.fifo"), "drained\n")
+    ])
+    await shutdown
+  } finally {
+    if (owner && owner.exitCode === null && owner.signalCode === null) owner.kill("SIGKILL")
+    await stopGuardian(statePath)
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
+test("replacement refuses to overwrite an unrelated live final control socket and preserves the owner", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-fence-"))
+  const oldSocketPath = path.join(root, "old.sock")
+  const occupiedSocketPath = path.join(root, "occupied.sock")
+  const statePath = path.join(root, "state.json")
+  const configPath = path.join(root, "rollbridge.cjs")
+  const blockerSockets = new Set()
+  const blocker = net.createServer((socket) => {
+    blockerSockets.add(socket)
+    socket.once("close", () => blockerSockets.delete(socket))
+    socket.end(`${JSON.stringify({application: "unrelated", status: "success"})}\n`)
+  })
+  let owner
+
+  try {
+    await fs.mkdir(path.join(root, "v1"))
+    await makeFifo(path.join(root, "v1", "worker.fifo"))
+    await writeConfig(configPath, config({controlPath: oldSocketPath, extraCompanion: false, statePath}))
+    owner = spawn(process.execPath, [binPath, "daemon", "--config", configPath], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(owner, "control socket listening")
+    await sendControlCommand({command: {command: "deploy", releaseId: "v1", releasePath: path.join(root, "v1"), revision: "v1"}, path: oldSocketPath})
+    await new Promise((resolve, reject) => blocker.listen(occupiedSocketPath, () => resolve(undefined)).once("error", reject))
+    await writeConfig(configPath, config({controlPath: occupiedSocketPath, extraCompanion: true, statePath}))
+
+    const replacement = await run(process.execPath, [
+      binPath, "ensure-daemon", "--config", configPath,
+      "--daemon-runtime-path", path.join(root, "runtime"), "--daemon-log-path", path.join(root, "daemon.log"),
+      "--daemon-pid-path", path.join(root, "daemon.pid"), "--daemon-start-timeout-ms", "1500"
+    ])
+
+    assert.notEqual(replacement.code, 0)
+    assert.match(await fs.readFile(path.join(root, "daemon.log"), "utf8"), /final control socket.*already answers another live process/)
+    assert.equal((await sendControlCommand({command: {command: "status"}, path: oldSocketPath})).activeReleaseId, "v1")
+
+    const shutdown = sendControlCommand({command: {command: "shutdown"}, path: oldSocketPath})
+    await fs.writeFile(path.join(root, "v1", "worker.fifo"), "drained\n")
+    await shutdown
+  } finally {
+    if (owner && owner.exitCode === null && owner.signalCode === null) owner.kill("SIGKILL")
+    for (const socket of blockerSockets) socket.destroy()
+    if (blocker.listening) await new Promise((resolve) => blocker.close(() => resolve(undefined)))
+    await stopGuardian(statePath)
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
+test("a committed replacement crash converges from stale public state", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-crash-"))
+  const oldSocketPath = path.join(root, "old.sock")
+  const newSocketPath = path.join(root, "new.sock")
+  const statePath = path.join(root, "state.json")
+  const configPath = path.join(root, "rollbridge.cjs")
+  const releasePath = path.join(root, "v1")
+  let owner
+  let candidate
+  let recovered
+
+  try {
+    await fs.mkdir(releasePath)
+    await makeFifo(path.join(releasePath, "worker.fifo"))
+    await writeConfig(configPath, config({controlPath: oldSocketPath, extraCompanion: false, statePath}))
+    owner = spawn(process.execPath, [binPath, "daemon", "--config", configPath], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(owner, "control socket listening")
+    await sendControlCommand({command: {command: "deploy", releaseId: "v1", releasePath, revision: "v1"}, path: oldSocketPath})
+    const staleState = await fs.readFile(statePath, "utf8")
+
+    await writeConfig(configPath, config({controlPath: newSocketPath, extraCompanion: true, statePath}))
+    candidate = spawn(process.execPath, [binPath, "daemon", "--config", configPath, "--replace-owner"], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(candidate, "owner replacement committed")
+    candidate.kill("SIGKILL")
+    await once(candidate, "exit")
+    await fs.writeFile(statePath, staleState)
+
+    recovered = spawn(process.execPath, [binPath, "daemon", "--config", configPath, "--replace-owner"], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(recovered, "owner replacement committed")
+    const status = await sendControlCommand({command: {command: "status"}, path: newSocketPath})
+
+    assert.equal(status.activeReleaseId, "v1")
+    assert.deepEqual(status.releaseReferences, [{releaseId: "v1", releasePath}])
+    const shutdown = sendControlCommand({command: {command: "shutdown"}, path: newSocketPath})
+    await fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n")
+    await shutdown
+  } finally {
+    for (const child of [owner, candidate, recovered]) {
+      if (child && child.exitCode === null && child.signalCode === null) child.kill("SIGKILL")
+    }
+    await stopGuardian(statePath)
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
+test("replacement transfers an unchanged fixed proxy listener without reusePort", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-fixed-proxy-"))
+  const oldSocketPath = path.join(root, "old.sock")
+  const newSocketPath = path.join(root, "new.sock")
+  const statePath = path.join(root, "state.json")
+  const configPath = path.join(root, "rollbridge.cjs")
+  const releasePath = path.join(root, "v1")
+  const proxyPort = await findAvailablePort({host: "127.0.0.1", range: {from: 24000, to: 24999}, usedPorts: new Set()})
+  let owner
+  let candidate
+
+  try {
+    await fs.mkdir(releasePath)
+    await makeFifo(path.join(releasePath, "worker.fifo"))
+    await writeConfig(configPath, config({controlPath: oldSocketPath, extraCompanion: false, proxyPort, statePath}))
+    owner = spawn(process.execPath, [binPath, "daemon", "--config", configPath], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(owner, "control socket listening")
+    await sendControlCommand({command: {command: "deploy", releaseId: "v1", releasePath, revision: "v1"}, path: oldSocketPath})
+    await writeConfig(configPath, config({controlPath: newSocketPath, extraCompanion: true, proxyPort, statePath}))
+
+    candidate = spawn(process.execPath, [binPath, "daemon", "--config", configPath, "--replace-owner"], {stdio: ["ignore", "pipe", "pipe"]})
+    const output = await collectUntilExitOrLog(candidate, "owner replacement committed")
+
+    assert.equal(output.message, "owner replacement committed", output.output)
+    const status = await sendControlCommand({command: {command: "status"}, path: newSocketPath})
+    const proxy = /** @type {{port: number}} */ (status.proxy)
+
+    assert.equal(proxy.port, proxyPort)
+    const shutdown = sendControlCommand({command: {command: "shutdown"}, path: newSocketPath})
+    await fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n")
+    await shutdown
+  } finally {
+    for (const child of [owner, candidate]) if (child && child.exitCode === null && child.signalCode === null) child.kill("SIGKILL")
+    await stopGuardian(statePath)
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
+test("replacement publishes an unchanged control path only after incumbent retirement", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-same-control-"))
+  const socketPath = path.join(root, "rollbridge.sock")
+  const statePath = path.join(root, "state.json")
+  const configPath = path.join(root, "rollbridge.cjs")
+  const releasePath = path.join(root, "v1")
+  let owner
+  let candidate
+
+  try {
+    await fs.mkdir(releasePath)
+    await makeFifo(path.join(releasePath, "worker.fifo"))
+    await writeConfig(configPath, config({controlPath: socketPath, extraCompanion: false, statePath}))
+    owner = spawn(process.execPath, [binPath, "daemon", "--config", configPath], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(owner, "control socket listening")
+    await sendControlCommand({command: {command: "deploy", releaseId: "v1", releasePath, revision: "v1"}, path: socketPath})
+    await writeConfig(configPath, config({controlPath: socketPath, extraCompanion: true, statePath}))
+
+    candidate = spawn(process.execPath, [binPath, "daemon", "--config", configPath, "--replace-owner"], {stdio: ["ignore", "pipe", "pipe"]})
+    const output = await collectUntilExitOrLog(candidate, "owner replacement committed")
+
+    assert.equal(output.message, "owner replacement committed", output.output)
+    assert.equal((await sendControlCommand({command: {command: "status"}, path: socketPath})).activeReleaseId, "v1")
+    const shutdown = sendControlCommand({command: {command: "shutdown"}, path: socketPath})
+    await fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n")
+    await shutdown
+  } finally {
+    for (const child of [owner, candidate]) if (child && child.exitCode === null && child.signalCode === null) child.kill("SIGKILL")
+    await stopGuardian(statePath)
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
+test("prepared replacement fences incumbent mutations until abort", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-cas-"))
+  const socketPath = path.join(root, "rollbridge.sock")
+  const statePath = path.join(root, "state.json")
+  const configPath = path.join(root, "rollbridge.cjs")
+  const v1Path = path.join(root, "v1")
+  const v2Path = path.join(root, "v2")
+  let owner
+  let transactionClient
+  let v2Started = false
+
+  try {
+    await Promise.all([fs.mkdir(v1Path), fs.mkdir(v2Path)])
+    await Promise.all([makeFifo(path.join(v1Path, "worker.fifo")), makeFifo(path.join(v2Path, "worker.fifo"))])
+    await writeConfig(configPath, config({controlPath: socketPath, extraCompanion: false, statePath}))
+    owner = spawn(process.execPath, [binPath, "daemon", "--config", configPath], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(owner, "control socket listening")
+    await sendControlCommand({command: {command: "deploy", releaseId: "v1", releasePath: v1Path, revision: "v1"}, path: socketPath})
+    const state = JSON.parse(await fs.readFile(statePath, "utf8"))
+    const authority = {configDigest: state.recovery.configDigest, runtime: state.daemonRuntime}
+
+    transactionClient = new GuardianClient(state.recovery.guardian)
+    await transactionClient.connect()
+    const prepared = await transactionClient.prepareOwnerReplacement(authority, {...authority, configDigest: "candidate-authority"})
+
+    await assert.rejects(
+      sendControlCommand({command: {command: "deploy", releaseId: "v2", releasePath: v2Path, revision: "v2"}, path: socketPath})
+        .then((response) => {
+          v2Started = true
+          return response
+        }),
+      /replacement.*prepared|mutation.*fenced/i
+    )
+    const retained = await sendControlCommand({command: {command: "status"}, path: socketPath})
+    assert.equal(retained.activeReleaseId, "v1")
+    assert.deepEqual(retained.releaseReferences, [{releaseId: "v1", releasePath: v1Path}])
+    await transactionClient.abortOwnerReplacement(prepared.replacementId)
+    await sendControlCommand({command: {command: "deploy", releaseId: "v2", releasePath: v2Path, revision: "v2"}, path: socketPath})
+    v2Started = true
+    const afterAbort = await sendControlCommand({command: {command: "status"}, path: socketPath})
+
+    assert.equal(afterAbort.activeReleaseId, "v2")
+    assert.deepEqual(afterAbort.releaseReferences, [
+      {releaseId: "v1", releasePath: v1Path},
+      {releaseId: "v2", releasePath: v2Path}
+    ])
+  } finally {
+    transactionClient?.disconnect()
+    await new Promise((resolve) => setImmediate(resolve))
+    if (owner && owner.exitCode === null && owner.signalCode === null) {
+      const shutdown = sendControlCommand({command: {command: "shutdown"}, path: socketPath}).catch(() => undefined)
+      const drains = [fs.writeFile(path.join(v1Path, "worker.fifo"), "drained\n").catch(() => undefined)]
+
+      if (v2Started) drains.push(fs.writeFile(path.join(v2Path, "worker.fifo"), "drained\n").catch(() => undefined))
+      await Promise.all([...drains, shutdown])
+      if (owner.exitCode === null && owner.signalCode === null) owner.kill("SIGKILL")
+    }
+    await stopGuardian(statePath)
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
+/**
+ * @param {{controlPath: string, extraCompanion: boolean, proxyPort?: number, statePath: string}} options - Fixture options.
+ * @returns {Record<string, import("../src/json.js").JsonValue>} Raw fixture config.
+ */
+function config({controlPath, extraCompanion, proxyPort = 0, statePath}) {
+  const command = `${JSON.stringify(process.execPath)} ${JSON.stringify(dummyAppPath)}`
+  const processes = /** @type {Record<string, import("../src/json.js").JsonValue>[]} */ ([
+    {
+      command: `${JSON.stringify(process.execPath)} -e ${JSON.stringify("setInterval(() => {}, 1000)")}`,
+      id: "worker",
+      lifecycle: {drainCommand: "read released < \"$ROLLBRIDGE_RELEASE_PATH/worker.fifo\"", drainTimeoutMs: 60000},
+      nonBlockingDrain: true,
+      policy: "companion"
+    },
+    {command, health: {intervalMs: 25, path: "/ping", timeoutMs: 3000}, id: "web", policy: "proxied", port: {from: 0, to: 0}}
+  ])
+
+  if (extraCompanion) processes.splice(1, 0, {command: `${JSON.stringify(process.execPath)} -e ${JSON.stringify("setInterval(() => {}, 1000)")}`, id: "metrics", policy: "companion"})
+  return {
+    application: "owner-replacement-test",
+    control: {path: controlPath},
+    ownerRecovery: {reconnectGraceMs: 3000},
+    processes,
+    proxy: {drainTimeoutMs: 100, forceStopTimeoutMs: 100, host: "127.0.0.1", port: proxyPort},
+    statePath
+  }
+}
+
+/**
+ * @param {string} destination - Candidate package path.
+ * @param {{dropCommitResponse?: boolean}} [options] - Fault injection.
+ * @returns {Promise<void>} Package preparation completion.
+ */
+async function prepareCandidatePackage(destination, options = {}) {
+  const {dropCommitResponse = false} = options
+
+  await fs.mkdir(destination, {recursive: true})
+  await Promise.all([
+    fs.cp(path.join(repoRoot, "bin"), path.join(destination, "bin"), {recursive: true}),
+    fs.cp(path.join(repoRoot, "src"), path.join(destination, "src"), {recursive: true}),
+    fs.cp(path.join(repoRoot, "node_modules"), path.join(destination, "node_modules"), {dereference: true, recursive: true}),
+    fs.copyFile(path.join(repoRoot, "package.json"), path.join(destination, "package.json"))
+  ])
+  await fs.appendFile(path.join(destination, "src", "cli.js"), "\n// distinct owner-replacement candidate closure\n")
+  if (dropCommitResponse) {
+    const clientPath = path.join(destination, "src", "control-client.js")
+    const source = await fs.readFile(clientPath, "utf8")
+    const marker = "export async function sendControlCommand({command, path}) {\n"
+    const injected = `${marker}  if (command.command === "commit-owner-replacement") {\n    return await new Promise((resolve, reject) => {\n      const socket = net.createConnection(path)\n      socket.once("error", reject)\n      socket.once("data", () => { socket.destroy(); reject(new Error("injected lost commit response")) })\n      socket.once("connect", () => socket.write(\`${"${JSON.stringify(command)}"}\\n\`))\n    })\n  }\n\n`
+    const sessionMarker = "    this.socket.write(`${JSON.stringify(command)}\\n`)\n    return await response\n"
+    const sessionInjection = "    this.socket.write(`${JSON.stringify(command)}\\n`)\n    const result = await response\n    if (command.command === \"commit-owner-replacement\") throw new Error(\"injected lost commit response\")\n    return result\n"
+
+    assert.ok(source.includes(marker))
+    assert.ok(source.includes(sessionMarker))
+    await fs.writeFile(clientPath, source.replace(marker, injected).replace(sessionMarker, sessionInjection))
+  }
+}
+
+/**
+ * Replaces only the copied package's daemon entry with an exact early-exit fixture.
+ * @param {string} packagePath - Copied candidate package root.
+ * @param {string} evidencePath - Exact candidate identity record.
+ * @param {number} exitCode - Distinct candidate exit code.
+ * @returns {Promise<void>} Fixture installation completion.
+ */
+async function installCandidateExit(packagePath, evidencePath, exitCode) {
+  const binPath = path.join(packagePath, "bin", "rollbridge")
+  const source = `#!/usr/bin/env node
+import fs from "node:fs"
+
+if (process.argv[2] === "daemon") {
+  fs.writeFileSync(${JSON.stringify(evidencePath)}, JSON.stringify({argv: process.argv, pid: process.pid, ppid: process.ppid}))
+  process.exit(${exitCode})
+}
+
+const {runCli} = await import("../src/cli.js")
+await runCli(process.argv)
+`
+
+  await fs.writeFile(binPath, source, {mode: 0o755})
+}
+
+/**
+ * @param {{configPath: string, daemonPidPath: string, logPath: string, packagePath: string, runtimePath: string}} options - Ensure fixture paths.
+ * @returns {Promise<{code: number, stderr: string, stdout: string}>} Ensure result.
+ */
+async function runEnsureDaemon({configPath, daemonPidPath, logPath, packagePath, runtimePath}) {
+  return await run(process.execPath, [
+    path.join(packagePath, "bin", "rollbridge"), "ensure-daemon", "--config", configPath,
+    "--daemon-runtime-path", runtimePath, "--daemon-log-path", logPath,
+    "--daemon-pid-path", daemonPidPath, "--daemon-start-timeout-ms", "3000"
+  ])
+}
+
+/**
+ * @param {net.Server} server - Unix server.
+ * @param {string} socketPath - Unix socket path.
+ * @returns {Promise<void>} Listen completion.
+ */
+async function listenUnix(server, socketPath) {
+  await new Promise((resolve, reject) => {
+    server.once("error", reject)
+    server.listen(socketPath, () => resolve(undefined))
+  })
+}
+
+/**
+ * @param {net.Server} server - Server to close.
+ * @returns {Promise<void>} Close completion.
+ */
+async function closeServer(server) {
+  await new Promise((resolve) => server.close(() => resolve(undefined)))
+}
+
+/**
+ * @param {string} fifoPath - FIFO path.
+ * @returns {Promise<void>} FIFO creation completion.
+ */
+async function makeFifo(fifoPath) {
+  const child = spawn("mkfifo", [fifoPath])
+  assert.equal((await once(child, "exit"))[0], 0)
+}
+
+/**
+ * @param {Record<string, import("../src/json.js").JsonValue>} status - Status.
+ * @param {string} releaseId - Release id.
+ * @param {string} processId - Process id.
+ * @returns {number} Managed process pid.
+ */
+function releaseProcessPid(status, releaseId, processId) {
+  const releases = /** @type {{releaseId: string, processes: {id: string, pid?: number}[]}[]} */ (status.releases)
+  const pid = releases.find((release) => release.releaseId === releaseId)?.processes.find((processStatus) => processStatus.id === processId)?.pid
+
+  if (typeof pid !== "number") throw new Error(`Missing ${processId} pid for release ${releaseId}`)
+  return pid
+}
+
+/**
+ * @param {string} command - Executable.
+ * @param {string[]} args - Arguments.
+ * @returns {Promise<{code: number, pid: number, stderr: string, stdout: string}>} Child result.
+ */
+async function run(command, args) {
+  const child = spawn(command, args, {stdio: ["ignore", "pipe", "pipe"]})
+  let stdout = ""
+  let stderr = ""
+
+  child.stdout.setEncoding("utf8").on("data", (chunk) => { stdout += chunk })
+  child.stderr.setEncoding("utf8").on("data", (chunk) => { stderr += chunk })
+  const [code] = await once(child, "exit")
+  assert.ok(child.pid)
+  return {code, pid: child.pid, stderr, stdout}
+}
+
+/**
+ * @param {import("node:child_process").ChildProcess} child - Daemon.
+ * @param {string} message - Log message.
+ * @returns {Promise<void>} Resolves after the matching log event.
+ */
+async function waitForLog(child, message) {
+  assert.ok(child.stdout)
+  assert.ok(child.stderr)
+  child.stdout.setEncoding("utf8")
+  child.stderr.setEncoding("utf8")
+  await new Promise((resolve, reject) => {
+    let buffer = ""
+    let errors = ""
+    const onExit = () => finish(new Error(`daemon exited before ${message}: ${errors}`))
+    const onData = (/** @type {string} */ chunk) => {
+      buffer += chunk
+      for (const line of buffer.split("\n")) {
+        if (line && JSON.parse(line).message === message) return finish(undefined)
+      }
+    }
+    const finish = (/** @type {Error | undefined} */ error) => {
+      child.off("exit", onExit)
+      child.stdout?.off("data", onData)
+      child.stderr?.off("data", onError)
+      if (error) reject(error)
+      else resolve(undefined)
+    }
+
+    child.once("exit", onExit)
+    child.stdout?.on("data", onData)
+    const onError = (/** @type {string} */ chunk) => { errors += chunk }
+
+    child.stderr?.on("data", onError)
+  })
+}
+
+/**
+ * @param {import("node:child_process").ChildProcess} child - Daemon.
+ * @param {string} message - Expected log message.
+ * @returns {Promise<{message?: string, output: string}>} Exit output or matched message.
+ */
+async function collectUntilExitOrLog(child, message) {
+  assert.ok(child.stdout)
+  assert.ok(child.stderr)
+  const stdout = child.stdout
+  const stderr = child.stderr
+
+  stdout.setEncoding("utf8")
+  stderr.setEncoding("utf8")
+  let output = ""
+
+  return await new Promise((resolve) => {
+    const onData = (/** @type {string} */ chunk) => {
+      output += chunk
+      for (const line of output.split("\n")) {
+        if (!line) continue
+        try {
+          if (JSON.parse(line).message === message) return finish(message)
+        } catch (_error) {
+          // Non-JSON stderr remains part of the assertion diagnostic.
+        }
+      }
+    }
+    const finish = (/** @type {string | undefined} */ matched) => {
+      child.off("exit", onExit)
+      stdout.off("data", onData)
+      stderr.off("data", onData)
+      resolve({message: matched, output})
+    }
+    const onExit = () => finish(undefined)
+
+    child.once("exit", onExit)
+    stdout.on("data", onData)
+    stderr.on("data", onData)
+  })
+}
+
+/**
+ * Opens a live WebSocket through the Rollbridge proxy without a client dependency.
+ * @param {number} port - Proxy port.
+ * @returns {Promise<net.Socket>} Upgraded socket.
+ */
+async function openWebSocket(port) {
+  const socket = net.createConnection({host: "127.0.0.1", port})
+
+  await once(socket, "connect")
+  socket.write([
+    "GET /socket HTTP/1.1",
+    "Host: 127.0.0.1",
+    "Connection: Upgrade",
+    "Upgrade: websocket",
+    "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==",
+    "Sec-WebSocket-Version: 13",
+    "\r\n"
+  ].join("\r\n"))
+  const [response] = await once(socket, "data")
+
+  assert.match(String(response), /^HTTP\/1\.1 101 /)
+  return socket
+}
+
+/**
+ * @param {string} configPath - Config path.
+ * @param {Record<string, import("../src/json.js").JsonValue>} value - Config.
+ * @returns {Promise<void>} Config write completion.
+ */
+async function writeConfig(configPath, value) {
+  await fs.writeFile(configPath, `module.exports = ${JSON.stringify(value, null, 2)}\n`)
+}
+
+/** @param {string} statePath - State path. */
+async function stopGuardian(statePath) {
+  try {
+    const state = JSON.parse(await fs.readFile(statePath, "utf8"))
+    const identity = state.recovery?.guardian
+    const pid = identity?.pid
+
+    if (identity?.socketPath && identity.token) {
+      const client = new GuardianClient(identity)
+
+      try {
+        await client.connect()
+        for (const entry of await client.inventory()) {
+          if (entry.status.pid) {
+            try { process.kill(-entry.status.pid, "SIGKILL") } catch (error) {
+              if (!error || typeof error !== "object" || !("code" in error) || error.code !== "ESRCH") throw error
+            }
+          }
+        }
+      } finally {
+        client.disconnect()
+      }
+    }
+
+    if (typeof pid === "number") {
+      const command = (await fs.readFile(`/proc/${pid}/cmdline`, "utf8")).replaceAll("\0", " ")
+
+      if (!command.includes("process-guardian.js") || !command.includes(statePath)) throw new Error(`Refusing to stop unverified fixture guardian pid ${pid}`)
+      process.kill(pid, "SIGKILL")
+    }
+  } catch (error) {
+    if (!error || typeof error !== "object" || !("code" in error) || !["ENOENT", "ESRCH"].includes(String(error.code))) throw error
+  }
+}