rollbridge 0.1.30 → 0.1.31

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rollbridge",
-  "version": "0.1.30",
+  "version": "0.1.31",
   "description": "Zero-downtime process supervisor and local traffic switcher for deploy-managed apps.",
   "keywords": [
     "deploy",

package/src/daemon.js

@@ -300,6 +300,7 @@ export default class RollbridgeDaemon {
     let stagingControlPath
     let finalControlPublished = false
     let listenersYielded = false
+    let retiredIncumbentControl = false
     let retainIncumbentControl = false
     let incumbentControl = legacyBridge?.incumbentControl
 
@@ -325,22 +326,31 @@ export default class RollbridgeDaemon {
       if (legacyBridge) {
         await this.crossLegacyDisruptiveBoundary(legacyBridge)
       } else if (preparedStatus.ownerClaimed) {
-        incumbentControl = await openControlSession(transfer.snapshot.control.path)
-        const listenerSession = incumbentControl
-
-        incumbentControl.onEvent((event) => this.handleIncumbentListenerEvent(event, listenerSession))
-        await incumbentControl.request({
-          command: "yield-owner-listeners",
-          control: transfer.snapshot.control.path === this.config.control.path,
-          proxy: true,
-          replacementId: prepared.replacementId
-        })
-        listenersYielded = true
+        try {
+          incumbentControl = await openControlSession(transfer.snapshot.control.path)
+        } catch (error) {
+          if (!error || typeof error !== "object" || !("code" in error) || error.code !== "ENOENT") throw error
+          retiredIncumbentControl = true
+        }
+        if (incumbentControl) {
+          const listenerSession = incumbentControl
+
+          incumbentControl.onEvent((event) => this.handleIncumbentListenerEvent(event, listenerSession))
+          await incumbentControl.request({
+            command: "yield-owner-listeners",
+            control: transfer.snapshot.control.path === this.config.control.path,
+            proxy: true,
+            replacementId: prepared.replacementId
+          })
+          listenersYielded = true
+        }
       }
       if (sharedFixedProxy) await this.startProxy()
-      await fs.rename(stagingControlPath, this.config.control.path)
-      finalControlPublished = true
-      this.boundControlPath = this.config.control.path
+      if (!retiredIncumbentControl) {
+        await fs.rename(stagingControlPath, this.config.control.path)
+        finalControlPublished = true
+        this.boundControlPath = this.config.control.path
+      }
       const committed = this.guardian.waitForEvent("replacement-committed")
       const staged = await this.guardian.stageOwnerReplacement(prepared.replacementId, {
         authority: this.ownerAuthority(),
@@ -350,18 +360,27 @@ export default class RollbridgeDaemon {
       })
 
       if (!staged.committed) {
-        try {
-          if (!incumbentControl) throw new Error("Owner replacement incumbent control session is unavailable")
-          await incumbentControl.request({command: "commit-owner-replacement", replacementId: prepared.replacementId})
-        } catch (error) {
-          const status = await this.guardian.replacementStatus()
-
-          if (status.committedReplacementId !== prepared.replacementId || !status.ownerClaimed) throw error
-          this.logger("owner replacement commit response lost; guardian commit confirmed", {replacementId: prepared.replacementId})
+        if (retiredIncumbentControl) {
+          await this.guardian.commitRetiredOwnerReplacement(prepared.replacementId)
+        } else {
+          try {
+            if (!incumbentControl) throw new Error("Owner replacement incumbent control session is unavailable")
+            await incumbentControl.request({command: "commit-owner-replacement", replacementId: prepared.replacementId})
+          } catch (error) {
+            const status = await this.guardian.replacementStatus()
+
+            if (status.committedReplacementId !== prepared.replacementId || !status.ownerClaimed) throw error
+            this.logger("owner replacement commit response lost; guardian commit confirmed", {replacementId: prepared.replacementId})
+          }
         }
       }
       await committed
       committedAuthority = true
+      if (retiredIncumbentControl) {
+        await fs.rename(stagingControlPath, this.config.control.path)
+        finalControlPublished = true
+        this.boundControlPath = this.config.control.path
+      }
       if (!legacyBridge && incumbentControl && [...this.releases.values()].some((release) => release.hasTransferredConnections())) {
         this.incumbentListenerControl = incumbentControl
         retainIncumbentControl = true

package/src/guardian-client.js

@@ -194,6 +194,11 @@ export default class GuardianClient {
     await this.request({command: "commit-owner-replacement", replacementId})
   }
 
+  /** @param {string} replacementId - Same-authority transaction whose incumbent listener is absent. */
+  async commitRetiredOwnerReplacement(replacementId) {
+    await this.request({command: "commit-retired-owner-replacement", replacementId})
+  }
+
   /** @param {string} replacementId - Committed transaction awaiting incumbent retirement. */
   async finalizeOwnerReplacement(replacementId) {
     await this.request({command: "finalize-owner-replacement", replacementId})

package/src/process-guardian.js

@@ -297,6 +297,23 @@ async function execute(request, socket) {
     return {aborted: true}
   }
 
+  if (request.command === "commit-retired-owner-replacement") {
+    requireReplacement(socket, request)
+    if (!replacementOwnerState) throw new Error("Retired owner replacement transaction is not staged")
+    if (!isDeepStrictEqual(ownerAuthority(ownerState), replacementAuthority)) throw new Error("Retired owner replacement requires unchanged owner authority")
+    const controlPath = ownerControlPath(ownerState)
+
+    try {
+      await fs.lstat(controlPath)
+      throw new Error(`Retired owner control socket ${controlPath} still exists`)
+    } catch (error) {
+      if (!error || typeof error !== "object" || !("code" in error) || error.code !== "ENOENT") throw error
+    }
+    commitReplacement()
+    finalizeReplacementRetirement()
+    return {committed: true}
+  }
+
   if (request.command === "commit-owner-replacement") {
     requireOwner(socket, request.command)
     if (!replacementClient || request.replacementId !== replacementId || !replacementOwnerState) throw new Error("Owner replacement transaction is not the prepared ready candidate")
@@ -510,6 +527,21 @@ function ownerAuthority(state) {
   return state.authority
 }
 
+/**
+ * @param {import("./json.js").JsonValue | undefined} state - Committed transferable state.
+ * @returns {string} Exact incumbent public control path.
+ */
+function ownerControlPath(state) {
+  if (!state || typeof state !== "object" || Array.isArray(state) || !("snapshot" in state)) throw new Error("Guardian owner state is missing its committed snapshot")
+  const snapshot = state.snapshot
+
+  if (!snapshot || typeof snapshot !== "object" || Array.isArray(snapshot) || !("control" in snapshot)) throw new Error("Guardian owner snapshot is missing its control identity")
+  const control = snapshot.control
+
+  if (!control || typeof control !== "object" || Array.isArray(control) || !("path" in control) || typeof control.path !== "string") throw new Error("Guardian owner snapshot has an invalid control identity")
+  return control.path
+}
+
 /**
  * Stops accepting connections and closes every authority channel except the response caller.
  * @param {net.Socket} caller - Shutdown requester retained until it receives the response.

package/test/guardian-client.test.js

@@ -171,6 +171,37 @@ test("replacement staging rejects owner state published after prepare", async ()
   }
 })
 
+test("retired owner replacement requires unchanged authority and the exact control path absent", async () => {
+  const fixture = await createGuardian()
+  const candidate = new GuardianClient({socketPath: fixture.client.socketPath, token: fixture.token})
+  const controlPath = path.join(fixture.root, "rollbridge.sock")
+  const authority = {configDigest: "incumbent", runtime: null}
+  const nextAuthority = {configDigest: "candidate", runtime: null}
+  const snapshot = {activeReleaseId: "v1", control: {path: controlPath}}
+
+  try {
+    await fixture.client.publishOwnerState({authority, snapshot})
+    await candidate.connect()
+    const changed = await candidate.prepareOwnerReplacement(authority, nextAuthority)
+
+    await candidate.stageOwnerReplacement(changed.replacementId, {authority: nextAuthority, snapshot})
+    await assert.rejects(() => candidate.commitRetiredOwnerReplacement(changed.replacementId), /unchanged owner authority/)
+    await candidate.abortOwnerReplacement(changed.replacementId)
+
+    const occupied = await candidate.prepareOwnerReplacement(authority, authority)
+
+    await candidate.stageOwnerReplacement(occupied.replacementId, {authority, snapshot})
+    await fs.writeFile(controlPath, "occupied\n")
+    await assert.rejects(() => candidate.commitRetiredOwnerReplacement(occupied.replacementId), /control socket .* still exists/)
+    await candidate.abortOwnerReplacement(occupied.replacementId)
+    await fixture.client.shutdown()
+    await fixture.client.guardianExit()
+  } finally {
+    candidate.disconnect()
+    await cleanupGuardian(fixture)
+  }
+})
+
 test("first upgrade migrates a real pre-split guardian without replacing its owned process", async () => {
   const fixture = await createLegacyGuardian()
   const processDefinition = definition("legacy-worker")

package/test/owner-replacement.test.js

@@ -9,8 +9,9 @@ import os from "node:os"
 import path from "node:path"
 import test from "node:test"
 import {fileURLToPath} from "node:url"
+import {normalizeConfig} from "../src/config.js"
 import {sendControlCommand} from "../src/control-client.js"
-import {isLegacyGuardianPrepareDiagnostic} from "../src/daemon.js"
+import RollbridgeDaemon, {isLegacyGuardianPrepareDiagnostic} from "../src/daemon.js"
 import GuardianClient from "../src/guardian-client.js"
 import {findAvailablePort} from "../src/port-allocator.js"
 
@@ -248,6 +249,50 @@ test("ensure-daemon atomically replaces incompatible config, socket, and package
   }
 })
 
+test("same-authority replacement commits after a retired incumbent already removed its control socket", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-retired-control-"))
+  const socketPath = path.join(root, "rollbridge.sock")
+  const statePath = path.join(root, "state.json")
+  const releasePath = path.join(root, "v1")
+  const daemonConfig = normalizeConfig(config({controlPath: socketPath, extraCompanion: false, statePath}))
+  const owner = new RollbridgeDaemon({config: daemonConfig, logger: () => {}})
+  let replacement
+
+  try {
+    await fs.mkdir(releasePath)
+    await makeFifo(path.join(releasePath, "worker.fifo"))
+    await owner.start()
+    await owner.deploy({releaseId: "v1", releasePath, revision: "v1"})
+    await Promise.all([...owner.releases.values()].map((release) => release.quiesce()))
+    await owner.closeServer(owner.controlServer)
+    await owner.removeControlSocket()
+    await owner.closeServer(owner.proxyServer)
+    const retired = owner.status()
+    const processState = retired.releases[0]?.processes.map(({id, pid, state}) => ({id, pid, state}))
+
+    assert.deepEqual(processState?.map(({state}) => state), ["quiesced", "quiesced"])
+    assert.equal((await owner.guardian?.replacementStatus())?.ownerClaimed, true)
+    await assert.rejects(fs.access(socketPath), {code: "ENOENT"})
+
+    replacement = new RollbridgeDaemon({config: daemonConfig, logger: () => {}})
+    await replacement.replaceIncompatibleOwner()
+    const recovered = await sendControlCommand({command: {command: "status"}, path: socketPath})
+    const recoveredReleases = /** @type {{processes: {id: string, pid?: number, state: string}[]}[]} */ (recovered.releases)
+
+    assert.equal(recovered.activeReleaseId, "v1")
+    assert.deepEqual(recovered.releaseReferences, [{releaseId: "v1", releasePath}])
+    assert.deepEqual(recoveredReleases[0]?.processes.map(({id, pid, state}) => ({id, pid, state})), processState)
+  } finally {
+    const shutdown = replacement?.controlCommandsReady ? replacement.shutdown().catch(() => {}) : owner.shutdown().catch(() => {})
+
+    await Promise.all([fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n").catch(() => {}), shutdown])
+    owner.guardian?.disconnect()
+    replacement?.guardian?.disconnect()
+    await stopGuardian(statePath)
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
 test("replacement refuses to overwrite an unrelated live final control socket and preserves the owner", async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-fence-"))
   const oldSocketPath = path.join(root, "old.sock")