rollbridge 0.1.30 → 0.1.32

package/test/owner-replacement.test.js

@@ -9,8 +9,9 @@ import os from "node:os"
 import path from "node:path"
 import test from "node:test"
 import {fileURLToPath} from "node:url"
+import {normalizeConfig} from "../src/config.js"
 import {sendControlCommand} from "../src/control-client.js"
-import {isLegacyGuardianPrepareDiagnostic} from "../src/daemon.js"
+import RollbridgeDaemon, {isLegacyGuardianPrepareDiagnostic} from "../src/daemon.js"
 import GuardianClient from "../src/guardian-client.js"
 import {findAvailablePort} from "../src/port-allocator.js"
 
@@ -248,6 +249,50 @@ test("ensure-daemon atomically replaces incompatible config, socket, and package
   }
 })
 
+test("same-authority replacement commits after a retired incumbent already removed its control socket", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-retired-control-"))
+  const socketPath = path.join(root, "rollbridge.sock")
+  const statePath = path.join(root, "state.json")
+  const releasePath = path.join(root, "v1")
+  const daemonConfig = normalizeConfig(config({controlPath: socketPath, extraCompanion: false, statePath}))
+  const owner = new RollbridgeDaemon({config: daemonConfig, logger: () => {}})
+  let replacement
+
+  try {
+    await fs.mkdir(releasePath)
+    await makeFifo(path.join(releasePath, "worker.fifo"))
+    await owner.start()
+    await owner.deploy({releaseId: "v1", releasePath, revision: "v1"})
+    await Promise.all([...owner.releases.values()].map((release) => release.quiesce()))
+    await owner.closeServer(owner.controlServer)
+    await owner.removeControlSocket()
+    await owner.closeServer(owner.proxyServer)
+    const retired = owner.status()
+    const processState = retired.releases[0]?.processes.map(({id, pid, state}) => ({id, pid, state}))
+
+    assert.deepEqual(processState?.map(({state}) => state), ["quiesced", "quiesced"])
+    assert.equal((await owner.guardian?.replacementStatus())?.ownerClaimed, true)
+    await assert.rejects(fs.access(socketPath), {code: "ENOENT"})
+
+    replacement = new RollbridgeDaemon({config: daemonConfig, logger: () => {}})
+    await replacement.replaceIncompatibleOwner()
+    const recovered = await sendControlCommand({command: {command: "status"}, path: socketPath})
+    const recoveredReleases = /** @type {{processes: {id: string, pid?: number, state: string}[]}[]} */ (recovered.releases)
+
+    assert.equal(recovered.activeReleaseId, "v1")
+    assert.deepEqual(recovered.releaseReferences, [{releaseId: "v1", releasePath}])
+    assert.deepEqual(recoveredReleases[0]?.processes.map(({id, pid, state}) => ({id, pid, state})), processState)
+  } finally {
+    const shutdown = replacement?.controlCommandsReady ? replacement.shutdown().catch(() => {}) : owner.shutdown().catch(() => {})
+
+    await Promise.all([fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n").catch(() => {}), shutdown])
+    owner.guardian?.disconnect()
+    replacement?.guardian?.disconnect()
+    await stopGuardian(statePath)
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
 test("replacement refuses to overwrite an unrelated live final control socket and preserves the owner", async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-fence-"))
   const oldSocketPath = path.join(root, "old.sock")
@@ -377,6 +422,100 @@ test("replacement transfers an unchanged fixed proxy listener without reusePort"
   }
 })
 
+test("owner replacement preserves committed generation metadata without firing lifecycle hooks", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-generation-"))
+  const oldSocketPath = path.join(root, "old.sock")
+  const newSocketPath = path.join(root, "new.sock")
+  const statePath = path.join(root, "state.json")
+  const configPath = path.join(root, "rollbridge.cjs")
+  const releasePath = path.join(root, "v1")
+  const lifecycleLogPath = path.join(root, "generation.lifecycle")
+  let owner
+  let candidate
+
+  try {
+    await fs.mkdir(releasePath)
+    await makeFifo(path.join(releasePath, "worker.fifo"))
+    await writeConfig(configPath, config({activationLogPath: lifecycleLogPath, controlPath: oldSocketPath, extraCompanion: false, statePath}))
+    owner = spawn(process.execPath, [binPath, "daemon", "--config", configPath], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(owner, "control socket listening")
+    await sendControlCommand({command: {command: "deploy", releaseId: "v1", releasePath, revision: "v1"}, path: oldSocketPath})
+    assert.equal(await fs.readFile(lifecycleLogPath, "utf8"), "activate:v1\n")
+
+    await writeConfig(configPath, config({activationLogPath: lifecycleLogPath, controlPath: newSocketPath, extraCompanion: true, statePath}))
+    candidate = spawn(process.execPath, [binPath, "daemon", "--config", configPath, "--replace-owner"], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(candidate, "owner replacement committed")
+
+    const status = await sendControlCommand({command: {command: "status"}, path: newSocketPath})
+    const generationTransition = status.generationTransition
+
+    assert.equal(status.activeReleaseId, "v1")
+    assert.ok(generationTransition && typeof generationTransition === "object" && !Array.isArray(generationTransition))
+    assert.equal(generationTransition.phase, "committed")
+    assert.equal(await fs.readFile(lifecycleLogPath, "utf8"), "activate:v1\n", "owner replacement must not reactivate an already committed generation")
+
+    const shutdown = sendControlCommand({command: {command: "shutdown"}, path: newSocketPath})
+    await fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n")
+    await shutdown
+  } finally {
+    for (const child of [owner, candidate]) if (child && child.exitCode === null && child.signalCode === null) child.kill("SIGKILL")
+    await stopGuardian(statePath)
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
+test("owner replacement preserves a failed generation transition without retrying its hook", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-failed-generation-"))
+  const oldSocketPath = path.join(root, "old.sock")
+  const newSocketPath = path.join(root, "new.sock")
+  const statePath = path.join(root, "state.json")
+  const configPath = path.join(root, "rollbridge.cjs")
+  const lifecycleLogPath = path.join(root, "generation.lifecycle")
+  const v1Path = path.join(root, "v1")
+  const v2Path = path.join(root, "v2")
+  let owner
+  let candidate
+  const failedConfig = (/** @type {string} */ controlPath, /** @type {boolean} */ extraCompanion) => {
+    const raw = config({activationLogPath: lifecycleLogPath, controlPath, extraCompanion, statePath})
+    const processes = /** @type {Record<string, import("../src/json.js").JsonValue>[]} */ (raw.processes)
+    const generationMain = processes.find((processConfig) => processConfig.id === "generation-main")
+    const lifecycle = /** @type {Record<string, import("../src/json.js").JsonValue>} */ (generationMain?.lifecycle)
+
+    lifecycle.activateCommand = `[ "$ROLLBRIDGE_RELEASE_ID" != v2 ] || exit 24; printf 'activate:%s\\n' "$ROLLBRIDGE_RELEASE_ID" >> ${JSON.stringify(lifecycleLogPath)}`
+    return raw
+  }
+
+  try {
+    await Promise.all([fs.mkdir(v1Path), fs.mkdir(v2Path)])
+    await Promise.all([makeFifo(path.join(v1Path, "worker.fifo")), makeFifo(path.join(v2Path, "worker.fifo"))])
+    await writeConfig(configPath, failedConfig(oldSocketPath, false))
+    owner = spawn(process.execPath, [binPath, "daemon", "--config", configPath], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(owner, "control socket listening")
+    await sendControlCommand({command: {command: "deploy", releaseId: "v1", releasePath: v1Path, revision: "v1"}, path: oldSocketPath})
+    await assert.rejects(sendControlCommand({command: {command: "deploy", releaseId: "v2", releasePath: v2Path, revision: "v2"}, path: oldSocketPath}), /activate command exited non-zero/)
+    assert.equal(await fs.readFile(lifecycleLogPath, "utf8"), "activate:v1\nretire:v1\n")
+
+    await writeConfig(configPath, failedConfig(newSocketPath, true))
+    candidate = spawn(process.execPath, [binPath, "daemon", "--config", configPath, "--replace-owner"], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(candidate, "owner replacement committed")
+    const status = await sendControlCommand({command: {command: "status"}, path: newSocketPath})
+    const generationTransition = status.generationTransition
+
+    assert.ok(generationTransition && typeof generationTransition === "object" && !Array.isArray(generationTransition))
+    assert.equal(generationTransition.phase, "activating_candidate")
+    assert.match(String(generationTransition.error), /activate command exited non-zero/)
+    assert.equal(await fs.readFile(lifecycleLogPath, "utf8"), "activate:v1\nretire:v1\n", "replacement must preserve, not retry, the failed activation")
+
+    const shutdown = sendControlCommand({command: {command: "shutdown"}, path: newSocketPath})
+    await Promise.all([v1Path, v2Path].map((releasePath) => fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n")))
+    await shutdown
+  } finally {
+    for (const child of [owner, candidate]) if (child && child.exitCode === null && child.signalCode === null) child.kill("SIGKILL")
+    await stopGuardian(statePath)
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
 test("replacement publishes an unchanged control path only after incumbent retirement", async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-same-control-"))
   const socketPath = path.join(root, "rollbridge.sock")
@@ -473,10 +612,10 @@ test("prepared replacement fences incumbent mutations until abort", async () =>
 })
 
 /**
- * @param {{controlPath: string, extraCompanion: boolean, proxyPort?: number, statePath: string}} options - Fixture options.
+ * @param {{activationLogPath?: string, controlPath: string, extraCompanion: boolean, proxyPort?: number, statePath: string}} options - Fixture options.
  * @returns {Record<string, import("../src/json.js").JsonValue>} Raw fixture config.
  */
-function config({controlPath, extraCompanion, proxyPort = 0, statePath}) {
+function config({activationLogPath, controlPath, extraCompanion, proxyPort = 0, statePath}) {
   const command = `${JSON.stringify(process.execPath)} ${JSON.stringify(dummyAppPath)}`
   const processes = /** @type {Record<string, import("../src/json.js").JsonValue>[]} */ ([
     {
@@ -489,6 +628,17 @@ function config({controlPath, extraCompanion, proxyPort = 0, statePath}) {
     {command, health: {intervalMs: 25, path: "/ping", timeoutMs: 3000}, id: "web", policy: "proxied", port: {from: 0, to: 0}}
   ])
 
+  if (activationLogPath) processes.unshift({
+    command: `${JSON.stringify(process.execPath)} -e ${JSON.stringify("setInterval(() => {}, 1000)")}`,
+    deployStrategy: "handoff",
+    id: "generation-main",
+    lifecycle: {
+      activateCommand: `printf 'activate:%s\\n' "$ROLLBRIDGE_RELEASE_ID" >> ${JSON.stringify(activationLogPath)}`,
+      quietCommand: `printf 'retire:%s\\n' "$ROLLBRIDGE_RELEASE_ID" >> ${JSON.stringify(activationLogPath)}`
+    },
+    policy: "service",
+    port: {from: 23000, to: 23999}
+  })
   if (extraCompanion) processes.splice(1, 0, {command: `${JSON.stringify(process.execPath)} -e ${JSON.stringify("setInterval(() => {}, 1000)")}`, id: "metrics", policy: "companion"})
   return {
     application: "owner-replacement-test",

package/test/rollbridge.test.js

@@ -505,6 +505,277 @@ test("candidate activation retires jobs-main with its workers without waiting fo
   }
 })
 
+test("opt-in generation lifecycle retires the old generation before activating and committing the candidate", async () => {
+  const fixture = await createFixture({handoffService: true, handoffServiceActivate: true, nonBlockingDrainWorker: true, webDependsOnService: true})
+  const daemon = await startDaemon(fixture.config)
+
+  try {
+    await daemon.deploy({releaseId: "v1", releasePath: fixture.root, revision: "v1"})
+    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1"])
+    assert.equal(daemon.status().activeReleaseId, "v1")
+
+    await daemon.deploy({releaseId: "v2", releasePath: fixture.root, revision: "v2"})
+
+    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "retire:v1", "activate:v2"])
+    assert.equal(daemon.status().activeReleaseId, "v2")
+    assert.equal(daemon.status().generationTransition?.phase, "committed")
+  } finally {
+    await daemon.shutdown()
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("generation commit is durable before awaited post-transition work", async () => {
+  const fixture = await createFixture({handoffService: true, handoffServiceActivate: true, includeSingleton: true, webDependsOnService: true})
+  const daemon = await startDaemon(fixture.config)
+  const replaceSingletons = daemon.replaceSingletons.bind(daemon)
+  /** @type {() => void} */
+  let markReplacementStarted = () => {}
+  /** @type {() => void} */
+  let releaseReplacement = () => {}
+  const replacementStarted = new Promise((resolve) => { markReplacementStarted = () => resolve(undefined) })
+  const replacementGate = new Promise((resolve) => { releaseReplacement = () => resolve(undefined) })
+  /** @type {Promise<Record<string, import("../src/json.js").JsonValue>> | undefined} */
+  let deployPromise
+
+  try {
+    await daemon.deploy({releaseId: "v1", releasePath: fixture.root, revision: "v1"})
+    daemon.replaceSingletons = async (release) => {
+      if (release.releaseId === "v2") {
+        markReplacementStarted()
+        await replacementGate
+      }
+      await replaceSingletons(release)
+    }
+
+    deployPromise = daemon.deploy({releaseId: "v2", releasePath: fixture.root, revision: "v2"})
+    await replacementStarted
+
+    const persisted = /** @type {{activeReleaseId?: string, generationTransition?: {phase?: string}, singletonReleaseIds?: Record<string, string>} | undefined} */ (await readState(fixture.statePath))
+
+    assert.equal(daemon.status().activeReleaseId, "v2")
+    assert.equal(persisted?.activeReleaseId, "v2")
+    assert.equal(persisted?.generationTransition?.phase, "committed_pending")
+    assert.equal(persisted?.singletonReleaseIds?.["jobs-main"], "v1")
+
+    releaseReplacement()
+    await deployPromise
+    assert.equal(daemon.status().generationTransition?.phase, "committed")
+  } finally {
+    releaseReplacement()
+    await deployPromise?.catch(() => {})
+    await daemon.shutdown()
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("exact committed retry finishes pending singleton replacement before success", async () => {
+  const fixture = await createFixture({handoffService: true, handoffServiceActivate: true, includeSingleton: true, singletonCwd: "{{releasePath}}/{{releaseId}}", webDependsOnService: true})
+  const daemon = await startDaemon(fixture.config)
+
+  await fs.mkdir(path.join(fixture.root, "v1"))
+
+  try {
+    await daemon.deploy({releaseId: "v1", releasePath: fixture.root, revision: "v1"})
+    await assert.rejects(() => daemon.deploy({releaseId: "v2", releasePath: fixture.root, revision: "v2"}), /ENOENT/)
+
+    assert.equal(daemon.status().activeReleaseId, "v2", "traffic remains durably committed")
+    assert.equal(daemon.status().generationTransition?.phase, "committed_pending")
+    assert.notEqual(daemon.status().singletons[0]?.process.state, "running")
+
+    await fs.mkdir(path.join(fixture.root, "v2"))
+    await daemon.deploy({releaseId: "v2", releasePath: fixture.root, revision: "v2"})
+
+    assert.equal(daemon.status().generationTransition?.phase, "committed")
+    assert.equal(daemon.status().singletons[0]?.process.state, "running")
+    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "retire:v1", "activate:v2"])
+  } finally {
+    await daemon.shutdown()
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("first generation is not committed when its activation acknowledgement fails", async () => {
+  const fixture = await createFixture({handoffService: true, handoffServiceActivate: true, handoffServiceActivateFailure: "v1", nonBlockingDrainWorker: true, webDependsOnService: true})
+  const daemon = await startDaemon(fixture.config)
+
+  try {
+    await assert.rejects(() => daemon.deploy({releaseId: "v1", releasePath: fixture.root, revision: "v1"}), /activate command exited non-zero/)
+    const status = daemon.status()
+
+    assert.equal(status.activeReleaseId, null)
+    assert.equal(status.generationTransition?.phase, "activating_candidate")
+    assert.deepEqual(status.releaseReferences.map((reference) => reference.releaseId), ["v1"])
+  } finally {
+    await daemon.shutdown()
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("retirement failure retains the exact transition, blocks other deploys, and exact resume continues it", async () => {
+  const fixture = await createFixture({handoffService: true, handoffServiceActivate: true, handoffServiceQuietFailure: true, nonBlockingDrainWorker: true, webDependsOnService: true})
+  const daemon = await startDaemon(fixture.config)
+
+  try {
+    await daemon.deploy({releaseId: "v1", releasePath: fixture.root, revision: "v1"})
+    await assert.rejects(() => daemon.deploy({releaseId: "v2", releasePath: fixture.root, revision: "v2"}), /retirement quiescence failed/)
+
+    const failed = daemon.status()
+
+    assert.equal(failed.activeReleaseId, "v1")
+    assert.equal(failed.generationTransition?.phase, "retiring_previous")
+    assert.match(String(failed.generationTransition?.error), /quiet command exited non-zero/)
+    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1"])
+    await assert.rejects(() => daemon.deploy({releaseId: "v3", releasePath: fixture.root, revision: "v3"}), /transition.*v2.*unresolved/i)
+
+    await fs.writeFile(fixture.retirementGatePath, "allow\n")
+    await daemon.deploy({releaseId: "v2", releasePath: fixture.root, revision: "v2"})
+
+    assert.equal(daemon.status().activeReleaseId, "v2")
+    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "retire:v1", "activate:v2"])
+  } finally {
+    await daemon.shutdown()
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("candidate activation failure never reactivates old and exact resume activates only the candidate", async () => {
+  const fixture = await createFixture({handoffService: true, handoffServiceActivate: true, handoffServiceActivateFailure: true, nonBlockingDrainWorker: true, webDependsOnService: true})
+  const daemon = await startDaemon(fixture.config)
+
+  try {
+    await daemon.deploy({releaseId: "v1", releasePath: fixture.root, revision: "v1"})
+    await assert.rejects(() => daemon.deploy({releaseId: "v2", releasePath: fixture.root, revision: "v2"}), /activate command exited non-zero/)
+
+    const failed = daemon.status()
+
+    assert.equal(failed.activeReleaseId, "v1")
+    assert.equal(failed.generationTransition?.phase, "activating_candidate")
+    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "retire:v1"])
+
+    await fs.writeFile(fixture.activationGatePath, "allow\n")
+    await daemon.deploy({releaseId: "v2", releasePath: fixture.root, revision: "v2"})
+
+    assert.equal(daemon.status().activeReleaseId, "v2")
+    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "retire:v1", "activate:v2"])
+  } finally {
+    await daemon.shutdown()
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("unresolved generation transition fences stop, restart, and rollback mutations", async () => {
+  const fixture = await createFixture({handoffService: true, handoffServiceActivate: true, handoffServiceActivateFailure: true, nonBlockingDrainWorker: true, webDependsOnService: true})
+  const daemon = await startDaemon(fixture.config)
+
+  try {
+    await daemon.deploy({releaseId: "v1", releasePath: fixture.root, revision: "v1"})
+    await assert.rejects(() => daemon.deploy({releaseId: "v2", releasePath: fixture.root, revision: "v2"}), /activate command exited non-zero/)
+
+    await assert.rejects(() => daemon.stopRelease("v2"), /cannot stop.*generation transition.*unresolved/i)
+    await assert.rejects(() => daemon.restartProcesses({processId: "beacon"}), /cannot restart.*generation transition.*unresolved/i)
+    await assert.rejects(() => daemon.rollback({releaseId: "v2"}), /cannot rollback.*generation transition.*unresolved/i)
+
+    assert.notEqual(statusRelease(daemon, "v2").processes.find((entry) => entry.id === "web")?.state, "stopped")
+    await fs.writeFile(fixture.activationGatePath, "allow\n")
+    await daemon.deploy({releaseId: "v2", releasePath: fixture.root, revision: "v2"})
+    assert.equal(await fetchText(daemon, "/release"), "v2")
+  } finally {
+    await daemon.shutdown()
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("active generation restores its exact lifecycle role after coordinator auto-restart", async () => {
+  const fixture = await createFixture({handoffService: true, handoffServiceActivate: true, webDependsOnService: true})
+  const daemon = await startDaemon(fixture.config)
+
+  try {
+    await daemon.deploy({releaseId: "v1", releasePath: fixture.root, revision: "v1"})
+    const coordinator = statusRelease(daemon, "v1").processes.find((entry) => entry.id === "beacon")
+
+    assert.ok(coordinator?.pid)
+    process.kill(-coordinator.pid, "SIGKILL")
+    await waitFor(async () => (await lifecycleEvents(fixture.lifecycleLogPath)).length === 2 && statusRelease(daemon, "v1").processes.find((entry) => entry.id === "beacon")?.state === "running", 3000)
+
+    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "activate:v1"])
+    assert.equal(statusRelease(daemon, "v1").processes.find((entry) => entry.id === "beacon")?.state, "running")
+    assert.equal(await fetchText(daemon, "/release"), "v1")
+  } finally {
+    await daemon.shutdown()
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("failed active-role restoration is loud and never reports the restarted coordinator running", async () => {
+  const fixture = await createFixture({handoffService: true, handoffServiceActivate: true, handoffServiceActivateFailure: "v1", webDependsOnService: true})
+  const daemon = await startDaemon(fixture.config)
+
+  await fs.writeFile(fixture.activationGatePath, "allow\n")
+
+  try {
+    await daemon.deploy({releaseId: "v1", releasePath: fixture.root, revision: "v1"})
+    await fs.rm(fixture.activationGatePath)
+    const coordinator = statusRelease(daemon, "v1").processes.find((entry) => entry.id === "beacon")
+
+    assert.ok(coordinator?.pid)
+    process.kill(-coordinator.pid, "SIGKILL")
+    await waitFor(() => {
+      const status = statusRelease(daemon, "v1").processes.find((entry) => entry.id === "beacon")
+
+      return status?.state === "failed" && status.restarts === 1
+    }, 3000)
+
+    const failed = statusRelease(daemon, "v1").processes.find((entry) => entry.id === "beacon")
+
+    assert.equal(failed?.lifecycleRole, "active")
+    assert.equal(failed?.restarts, 1, "role restoration failure must not create an internal retry loop")
+    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1"])
+  } finally {
+    await daemon.shutdown()
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("retired generation coordinator remains fenced after exit", async () => {
+  const fixture = await createFixture({handoffService: true, handoffServiceActivate: true, webDependsOnService: true})
+  const daemon = await startDaemon(fixture.config)
+  /** @type {WebSocket | undefined} */
+  let socket
+
+  try {
+    await daemon.deploy({releaseId: "v1", releasePath: fixture.root, revision: "v1"})
+    socket = await openWebSocket(daemon)
+    await daemon.deploy({releaseId: "v2", releasePath: fixture.root, revision: "v2"})
+    const coordinator = statusRelease(daemon, "v1").processes.find((entry) => entry.id === "beacon")
+    const coordinatorProcess = daemon.releases.get("v1")?.getProcess("beacon")
+
+    assert.ok(coordinator?.pid)
+    assert.ok(coordinatorProcess)
+    assert.equal(coordinator.lifecycleRole, "retired")
+    assert.equal(daemon.guardian?.processes.get("release:v1:beacon"), coordinatorProcess, "retirement refresh must preserve exact guardian event routing")
+    const exited = once(coordinatorProcess, "exit")
+
+    process.kill(-coordinator.pid, "SIGKILL")
+    const [exit] = await exited
+    const stopped = coordinatorProcess.status()
+
+    assert.equal(exit.code, null)
+    assert.equal(exit.id, "beacon")
+    assert.equal(exit.signal, "SIGKILL")
+    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "retire:v1", "activate:v2"])
+    assert.equal(stopped.lifecycleRole, "retired")
+    assert.equal(stopped.pid, undefined)
+    assert.equal(stopped.restarts, 0)
+    assert.equal(stopped.state, "stopped")
+    assert.equal(coordinatorProcess.restartTimer, undefined, "retired process must not queue a restart")
+  } finally {
+    socket?.close()
+    await daemon.shutdown()
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
 test("multiple retired jobs generations keep distinct endpoints and live references until completion", async () => {
   const fixture = await createFixture({handoffService: true, handoffServiceQuiet: true, webDependsOnService: true})
   const daemon = await startDaemon(fixture.config)
@@ -819,7 +1090,11 @@ test("persisted daemon state excludes process commands, environment values, and
 
   try {
     await daemon.deploy({releaseId: "v1", releasePath: fixture.root, revision: "v1"})
-    await waitFor(() => Boolean(daemon.activeRelease?.getProcess("web")?.status().logs.some((entry) => entry.line === secret)))
+    const webProcess = daemon.activeRelease?.getProcess("web")
+
+    assert.ok(webProcess)
+    await recordedLogLine(webProcess, secret)
+    assert.ok(webProcess.status().logs.some((entry) => entry.line === secret), "secret output must be retained before persistence")
 
     daemon.persistState()
     await waitFor(async () => (await fs.readFile(fixture.statePath, "utf8")).includes('"activeReleaseId": "v1"'))
@@ -1358,19 +1633,30 @@ test("deploy can ensure the daemon before sending the release command", async ()
 })
 
 /**
- * @param {{companionReplicas?: number, handoffService?: boolean, handoffServiceQuiet?: boolean, handoffServiceQuietFailure?: boolean, includeCompanion?: boolean, includeService?: boolean, includeSingleton?: boolean, memoryLimitBytes?: number, nonBlockingDrainWorker?: boolean, persistState?: boolean, proxyHost?: string, singletonCwd?: string, webCommand?: string, webDependsOnService?: boolean, webHealthTimeoutMs?: number, workerStopDelayMs?: number}} [options] - Fixture options.
- * @returns {Promise<{config: import("../src/config.js").RollbridgeConfig, root: string, serviceLogPath: string, serviceQuietPath: string, singletonLogPath: string, statePath: string}>} Fixture data.
+ * @param {{companionReplicas?: number, handoffService?: boolean, handoffServiceActivate?: boolean, handoffServiceActivateFailure?: boolean | string, handoffServiceQuiet?: boolean, handoffServiceQuietFailure?: boolean, includeCompanion?: boolean, includeService?: boolean, includeSingleton?: boolean, memoryLimitBytes?: number, nonBlockingDrainWorker?: boolean, persistState?: boolean, proxyHost?: string, singletonCwd?: string, webCommand?: string, webDependsOnService?: boolean, webHealthTimeoutMs?: number, workerStopDelayMs?: number}} [options] - Fixture options.
+ * @returns {Promise<{activationGatePath: string, config: import("../src/config.js").RollbridgeConfig, lifecycleLogPath: string, retirementGatePath: string, root: string, serviceLogPath: string, serviceQuietPath: string, singletonLogPath: string, statePath: string}>} Fixture data.
  */
 async function createFixture(options = {}) {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-test-"))
   const serviceLogPath = path.join(root, "service.log")
   const serviceQuietPath = path.join(root, "service.quiet")
+  const lifecycleLogPath = path.join(root, "service.lifecycle")
+  const activationGatePath = path.join(root, "activation.allow")
+  const retirementGatePath = path.join(root, "retirement.allow")
   const singletonLogPath = path.join(root, "singleton.log")
   const statePath = path.join(root, "rollbridge.state.json")
   /** @type {Array<Record<string, import("../src/json.js").JsonValue>>} */
   const processes = []
 
   if (options.includeService || options.handoffService) {
+    const activationFailureRelease = typeof options.handoffServiceActivateFailure === "string" ? options.handoffServiceActivateFailure : "v2"
+    const lifecycle = options.handoffServiceActivate ? {
+      activateCommand: `${options.handoffServiceActivateFailure ? `[ "$ROLLBRIDGE_RELEASE_ID" != ${JSON.stringify(activationFailureRelease)} ] || [ -f ${JSON.stringify(activationGatePath)} ] || exit 24; ` : ""}printf 'activate:%s\\n' "$ROLLBRIDGE_RELEASE_ID" >> ${JSON.stringify(lifecycleLogPath)}`,
+      quietCommand: `${options.handoffServiceQuietFailure ? `[ -f ${JSON.stringify(retirementGatePath)} ] || exit 23; ` : ""}printf 'retire:%s\\n' "$ROLLBRIDGE_RELEASE_ID" >> ${JSON.stringify(lifecycleLogPath)}`
+    } : options.handoffServiceQuiet || options.handoffServiceQuietFailure ? {
+      quietCommand: options.handoffServiceQuietFailure ? "exit 23" : `printf '%s\\n' "$ROLLBRIDGE_RELEASE_ID" >> ${JSON.stringify(serviceQuietPath)}`
+    } : undefined
+
     processes.push({
       command: `${JSON.stringify(process.execPath)} ${JSON.stringify(serviceAppPath)} --release={{releaseId}}`,
       ...(options.handoffService ? {deployStrategy: "handoff"} : {}),
@@ -1378,7 +1664,7 @@ async function createFixture(options = {}) {
         ROLLBRIDGE_SERVICE_LOG: serviceLogPath
       },
       id: "beacon",
-      ...(options.handoffServiceQuiet || options.handoffServiceQuietFailure ? {lifecycle: {quietCommand: options.handoffServiceQuietFailure ? "exit 23" : `printf '%s\\n' "$ROLLBRIDGE_RELEASE_ID" >> ${JSON.stringify(serviceQuietPath)}`}} : {}),
+      ...(lifecycle ? {lifecycle} : {}),
       policy: "service",
       port: options.handoffService ? {from: 15000, to: 15099} : {from: 0, to: 0},
       restartDelayMs: 50
@@ -1463,10 +1749,18 @@ async function createFixture(options = {}) {
       host: options.proxyHost || "127.0.0.1",
       port: 0
     },
-    ...(options.persistState ? {statePath} : {})
+    ...((options.persistState || options.handoffServiceActivate) ? {ownerRecovery: {reconnectGraceMs: 30000}, statePath} : {})
   })
 
-  return {config, root, serviceLogPath, serviceQuietPath, singletonLogPath, statePath}
+  return {activationGatePath, config, lifecycleLogPath, retirementGatePath, root, serviceLogPath, serviceQuietPath, singletonLogPath, statePath}
+}
+
+/**
+ * @param {string} lifecycleLogPath - Fixture lifecycle event file.
+ * @returns {Promise<string[]>} Ordered lifecycle events.
+ */
+async function lifecycleEvents(lifecycleLogPath) {
+  return (await fs.readFile(lifecycleLogPath, "utf8")).trim().split("\n").filter(Boolean)
 }
 
 /**
@@ -1604,6 +1898,39 @@ async function waitFor(callback, timeoutMs = 3000) {
   throw new Error("Timed out waiting for condition")
 }
 
+/**
+ * Resolves from retained output or the exact event that records it, and rejects if the
+ * supervised process exits first.
+ * @param {import("../src/managed-process.js").default} processInstance - Exact managed process.
+ * @param {string} line - Complete output line to observe.
+ * @returns {Promise<import("../src/managed-process.js").ManagedProcessLog>} Recorded log entry.
+ */
+async function recordedLogLine(processInstance, line) {
+  const retained = processInstance.status().logs.find((entry) => entry.line === line)
+
+  if (retained) return retained
+  return await new Promise((resolve, reject) => {
+    /** @param {import("../src/managed-process.js").ManagedProcessLog} entry - Newly retained output. */
+    const onLog = (entry) => {
+      if (entry.line !== line) return
+      cleanup()
+      resolve(entry)
+    }
+    /** @param {{code: number | null, signal: import("node:child_process").ChildProcess["signalCode"]}} exit - Exact process exit. */
+    const onExit = (exit) => {
+      cleanup()
+      reject(new Error(`Process ${processInstance.id} exited before recording expected output ${JSON.stringify(line)}: ${JSON.stringify(exit)}`))
+    }
+    const cleanup = () => {
+      processInstance.off("log", onLog)
+      processInstance.off("exit", onExit)
+    }
+
+    processInstance.on("log", onLog)
+    processInstance.once("exit", onExit)
+  })
+}
+
 /**
  * @param {RollbridgeDaemon} daemon - Daemon.
  * @param {string} processId - Process id within the active release.