rollbridge 0.1.32 → 0.1.33

package/changelog.d/20260830-guardian-retired-replacement-process-key.md

@@ -0,0 +1,5 @@
+### Fixed
+
+- Carry an exact recovered guardian process key when a ready replacement commits
+  after the incumbent control listener has already retired, while retaining the
+  replacement transaction, authority, and registered-process fences.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rollbridge",
-  "version": "0.1.32",
+  "version": "0.1.33",
   "description": "Zero-downtime process supervisor and local traffic switcher for deploy-managed apps.",
   "keywords": [
     "deploy",

package/src/daemon.js

@@ -412,7 +412,10 @@ export default class RollbridgeDaemon {
 
       if (!staged.committed) {
         if (retiredIncumbentControl) {
-          await this.guardian.commitRetiredOwnerReplacement(prepared.replacementId)
+          const processKey = this.guardian.processes.keys().next().value
+
+          if (!processKey) throw new Error("Retired owner replacement requires an exact recovered guardian process registration")
+          await this.guardian.commitRetiredOwnerReplacement(prepared.replacementId, processKey)
         } else {
           try {
             if (!incumbentControl) throw new Error("Owner replacement incumbent control session is unavailable")

package/src/guardian-client.js

@@ -194,9 +194,12 @@ export default class GuardianClient {
     await this.request({command: "commit-owner-replacement", replacementId})
   }
 
-  /** @param {string} replacementId - Same-authority transaction whose incumbent listener is absent. */
-  async commitRetiredOwnerReplacement(replacementId) {
-    await this.request({command: "commit-retired-owner-replacement", replacementId})
+  /**
+   * @param {string} replacementId - Same-authority transaction whose incumbent listener is absent.
+   * @param {string} key - Exact recovered guardian process proving candidate reconstruction.
+   */
+  async commitRetiredOwnerReplacement(replacementId, key) {
+    await this.request({command: "commit-retired-owner-replacement", key, replacementId})
   }
 
   /** @param {string} replacementId - Committed transaction awaiting incumbent retirement. */

package/src/process-guardian.js

@@ -300,6 +300,7 @@ async function execute(request, socket) {
 
   if (request.command === "commit-retired-owner-replacement") {
     requireReplacement(socket, request)
+    requireProcess(request)
     if (!replacementOwnerState) throw new Error("Retired owner replacement transaction is not staged")
     if (!isDeepStrictEqual(ownerAuthority(ownerState), replacementAuthority)) throw new Error("Retired owner replacement requires unchanged owner authority")
     const controlPath = ownerControlPath(ownerState)
@@ -408,10 +409,7 @@ async function execute(request, socket) {
     return managedProcess.status()
   }
 
-  if (!request.key) throw new Error(`Guardian ${request.command} requires a process key`)
-  const record = processes.get(request.key)
-
-  if (!record) throw new Error(`Guardian process ${request.key} is not registered`)
+  const record = requireProcess(request)
 
   if (request.command !== "status") requireOwner(socket, request.command)
 
@@ -530,6 +528,18 @@ function requireReplacement(socket, request) {
   if (replacementClient !== socket || request.replacementId !== replacementId) throw new Error("Owner replacement transaction is not the prepared candidate")
 }
 
+/**
+ * @param {GuardianRequest} request - Keyed guardian request.
+ * @returns {{desired: boolean, process: ManagedProcess, provenance: string}} Exact registered process.
+ */
+function requireProcess(request) {
+  if (!request.key) throw new Error(`Guardian ${request.command} requires a process key`)
+  const record = processes.get(request.key)
+
+  if (!record) throw new Error(`Guardian process ${request.key} is not registered`)
+  return record
+}
+
 /**
  * @param {import("./json.js").JsonValue} state - Transfer state.
  * @returns {import("./json.js").JsonValue} Embedded authority fence.

package/test/guardian-client.test.js

@@ -210,32 +210,68 @@ test("replacement staging rejects owner state published after prepare", async ()
   }
 })
 
+test("retired owner replacement commit carries its exact recovered process key", async () => {
+  const client = new GuardianClient({socketPath: "/unused", token: "authenticated-capability"})
+  const replacementId = "prepared-replacement"
+  const processKey = "release:v1:worker"
+
+  client.request = async (request) => {
+    if (!request.key) throw new Error(`Guardian ${request.command} requires a process key`)
+    assert.deepEqual(request, {command: "commit-retired-owner-replacement", key: processKey, replacementId})
+    return {committed: true}
+  }
+
+  await client.commitRetiredOwnerReplacement(replacementId, processKey)
+})
+
 test("retired owner replacement requires unchanged authority and the exact control path absent", async () => {
   const fixture = await createGuardian()
   const candidate = new GuardianClient({socketPath: fixture.client.socketPath, token: fixture.token})
+  const contender = new GuardianClient({socketPath: fixture.client.socketPath, token: fixture.token})
   const controlPath = path.join(fixture.root, "rollbridge.sock")
+  const processKey = "release:v1:worker"
   const authority = {configDigest: "incumbent", runtime: null}
   const nextAuthority = {configDigest: "candidate", runtime: null}
   const snapshot = {activeReleaseId: "v1", control: {path: controlPath}}
 
   try {
+    await fixture.client.process(processKey, definition("worker")).recover()
     await fixture.client.publishOwnerState({authority, snapshot})
     await candidate.connect()
     const changed = await candidate.prepareOwnerReplacement(authority, nextAuthority)
 
     await candidate.stageOwnerReplacement(changed.replacementId, {authority: nextAuthority, snapshot})
-    await assert.rejects(() => candidate.commitRetiredOwnerReplacement(changed.replacementId), /unchanged owner authority/)
+    await assert.rejects(() => candidate.commitRetiredOwnerReplacement(changed.replacementId, processKey), /unchanged owner authority/)
     await candidate.abortOwnerReplacement(changed.replacementId)
 
     const occupied = await candidate.prepareOwnerReplacement(authority, authority)
 
     await candidate.stageOwnerReplacement(occupied.replacementId, {authority, snapshot})
     await fs.writeFile(controlPath, "occupied\n")
-    await assert.rejects(() => candidate.commitRetiredOwnerReplacement(occupied.replacementId), /control socket .* still exists/)
+    await assert.rejects(() => candidate.commitRetiredOwnerReplacement(occupied.replacementId, processKey), /control socket .* still exists/)
     await candidate.abortOwnerReplacement(occupied.replacementId)
-    await fixture.client.shutdown()
+
+    await fs.rm(controlPath)
+    const ready = await candidate.prepareOwnerReplacement(authority, authority)
+
+    await candidate.stageOwnerReplacement(ready.replacementId, {authority, snapshot})
+    await contender.connect()
+    await assert.rejects(
+      () => contender.request({command: "commit-retired-owner-replacement", key: processKey, replacementId: ready.replacementId}),
+      /not the prepared candidate/
+    )
+    await assert.rejects(
+      () => candidate.commitRetiredOwnerReplacement(ready.replacementId, "release:v1:wrong"),
+      /process .* is not registered/
+    )
+    const committed = candidate.waitForEvent("replacement-committed")
+
+    await candidate.commitRetiredOwnerReplacement(ready.replacementId, processKey)
+    await committed
+    await candidate.shutdown()
     await fixture.client.guardianExit()
   } finally {
+    contender.disconnect()
     candidate.disconnect()
     await cleanupGuardian(fixture)
   }