rollbridge 0.1.35 → 0.1.37

package/test/owner-replacement.test.js

@@ -19,6 +19,476 @@ const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."
 const binPath = path.join(repoRoot, "bin", "rollbridge")
 const dummyAppPath = path.join(repoRoot, "test", "fixtures", "dummy-app.js")
 const legacyDaemonPath = path.join(repoRoot, "test", "fixtures", "pre-split3-daemon-runner.js")
+const partialGuardianPath = path.join(repoRoot, "test", "fixtures", "partial-owner-replacement-process-guardian.js")
+
+test("partial owner-replacement guardian crosses the authenticated legacy bridge before retired-owner commit", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-partial-"))
+  const socketPath = path.join(root, "rollbridge.sock")
+  const statePath = path.join(root, "state.json")
+  const configPath = path.join(root, "rollbridge.cjs")
+  const daemonPidPath = path.join(root, "daemon.pid")
+  const releasePath = path.join(root, "v1")
+  const packagePath = path.join(root, "candidate-package")
+  const runtimePath = path.join(root, "runtime")
+  const partialSocketPath = path.join(root, "partial-guardian.sock")
+  let owner
+  let partialGuardian
+  let retainedConnection
+  let backendGuardianIdentity
+
+  try {
+    await fs.mkdir(releasePath)
+    await makeFifo(path.join(releasePath, "worker.fifo"))
+    await writeConfig(configPath, config({controlPath: socketPath, extraCompanion: false, statePath}))
+    owner = spawn(process.execPath, [binPath, "daemon", "--config", configPath], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(owner, "control socket listening")
+    assert.ok(owner.pid)
+    await fs.writeFile(daemonPidPath, `${owner.pid}\n`)
+    await sendControlCommand({command: {command: "deploy", releaseId: "v1", releasePath, revision: "v1"}, path: socketPath})
+    const before = await sendControlCommand({command: {command: "status"}, path: socketPath})
+    const workerPid = releaseProcessPid(before, "v1", "worker")
+    const webPid = releaseProcessPid(before, "v1", "web")
+    const proxyPort = /** @type {{port?: number}} */ (before.proxy).port
+    const state = JSON.parse(await fs.readFile(statePath, "utf8"))
+
+    if (typeof proxyPort !== "number") throw new Error("Partial guardian fixture proxy is missing its bound port")
+
+    backendGuardianIdentity = {...state.recovery.guardian}
+    partialGuardian = await startPartialGuardian({
+      backendPath: state.recovery.guardian.socketPath,
+      mode: "partial",
+      socketPath: partialSocketPath,
+      token: state.recovery.guardian.token
+    })
+    state.recovery.guardian = {...state.recovery.guardian, pid: partialGuardian.pid, socketPath: partialSocketPath}
+    await fs.writeFile(statePath, `${JSON.stringify(state)}\n`)
+    retainedConnection = await openWebSocket(proxyPort)
+    const retainedClosed = once(retainedConnection, "close")
+    await fs.rm(socketPath)
+    await prepareCandidatePackage(packagePath)
+    const ownerExit = once(owner, "exit")
+    const ensured = await runEnsureDaemon({configPath, daemonPidPath, logPath: path.join(root, "candidate.log"), packagePath, runtimePath})
+
+    assert.equal(ensured.code, 0, `${ensured.stderr}\n${await fs.readFile(path.join(root, "candidate.log"), "utf8")}`)
+    assert.deepEqual(await ownerExit, [null, "SIGKILL"], "the exact authenticated incumbent boundary is crossed once")
+    await retainedClosed
+    const status = await sendControlCommand({command: {command: "status"}, path: socketPath})
+
+    assert.equal(status.activeReleaseId, "v1")
+    assert.equal(releaseProcessPid(status, "v1", "worker"), workerPid)
+    assert.equal(releaseProcessPid(status, "v1", "web"), webPid)
+    assert.deepEqual(status.ownerTransition, {
+      disruptive: true,
+      mode: "legacy-first-upgrade",
+      reason: "retained guardian and daemon lacked atomic replacement protocol"
+    })
+    const shutdown = sendControlCommand({command: {command: "shutdown"}, path: socketPath})
+
+    await fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n")
+    await shutdown
+  } finally {
+    retainedConnection?.destroy()
+    if (owner && owner.exitCode === null && owner.signalCode === null) {
+      const exited = once(owner, "exit")
+
+      owner.kill("SIGKILL")
+      await exited
+    }
+    partialGuardian?.kill("SIGTERM")
+    if (partialGuardian && partialGuardian.exitCode === null && partialGuardian.signalCode === null) await once(partialGuardian, "exit")
+    if (backendGuardianIdentity) {
+      const state = JSON.parse(await fs.readFile(statePath, "utf8").catch(() => "null"))
+
+      if (state?.recovery?.guardian?.socketPath === partialSocketPath) {
+        state.recovery.guardian = backendGuardianIdentity
+        await fs.writeFile(statePath, `${JSON.stringify(state)}\n`)
+      }
+    }
+    await stopGuardian(statePath)
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
+test("partial guardian replacement remains fenced through coordinator reconstruction", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-partial-fence-"))
+  const socketPath = path.join(root, "rollbridge.sock")
+  const statePath = path.join(root, "state.json")
+  const configPath = path.join(root, "rollbridge.cjs")
+  const releasePath = path.join(root, "v1")
+  const partialSocketPath = path.join(root, "partial-guardian.sock")
+  const restoreStarted = deferred()
+  const continueRestore = deferred()
+  let owner
+  let partialGuardian
+  let candidate = /** @type {RollbridgeDaemon | undefined} */ (undefined)
+  let contender = /** @type {GuardianClient | undefined} */ (undefined)
+  let backendGuardianIdentity
+  let replacementPromise = /** @type {Promise<void> | undefined} */ (undefined)
+
+  try {
+    await fs.mkdir(releasePath)
+    await makeFifo(path.join(releasePath, "worker.fifo"))
+    await writeConfig(configPath, config({controlPath: socketPath, extraCompanion: false, statePath}))
+    owner = spawn(process.execPath, [binPath, "daemon", "--config", configPath], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(owner, "control socket listening")
+    assert.ok(owner.pid)
+    await sendControlCommand({command: {command: "deploy", releaseId: "v1", releasePath, revision: "v1"}, path: socketPath})
+    const state = JSON.parse(await fs.readFile(statePath, "utf8"))
+
+    backendGuardianIdentity = {...state.recovery.guardian}
+    partialGuardian = await startPartialGuardian({
+      backendPath: backendGuardianIdentity.socketPath,
+      mode: "partial",
+      socketPath: partialSocketPath,
+      token: backendGuardianIdentity.token
+    })
+    state.recovery.guardian = {...backendGuardianIdentity, pid: partialGuardian.pid, socketPath: partialSocketPath}
+    await fs.writeFile(statePath, `${JSON.stringify(state)}\n`)
+    const replacement = new RollbridgeDaemon({
+      config: normalizeConfig(config({controlPath: socketPath, extraCompanion: false, statePath})),
+      configPath,
+      legacyIncumbentPid: owner.pid,
+      logger: () => {}
+    })
+    candidate = replacement
+    replacement.restoreOwnerState = async () => {
+      restoreStarted.resolve(undefined)
+      await continueRestore.promise
+      throw new Error("injected reconstruction stop after fence audit")
+    }
+    replacementPromise = replacement.replaceIncompatibleOwner()
+    void replacementPromise.catch(() => {})
+    await restoreStarted.promise
+    assert.equal(JSON.parse(await fs.readFile(statePath, "utf8")).recovery.guardian.socketPath, partialSocketPath)
+
+    let mutationError
+
+    try {
+      await sendControlCommand({command: {command: "restart", processId: "missing"}, path: socketPath})
+    } catch (error) {
+      mutationError = error
+    }
+    contender = new GuardianClient({pid: partialGuardian.pid, socketPath: partialSocketPath, token: backendGuardianIdentity.token})
+    await contender.connect()
+    let contenderError
+    let contenderPrepared
+
+    try {
+      contenderPrepared = await contender.prepareOwnerReplacement(
+        {configDigest: state.recovery.configDigest, runtime: state.daemonRuntime ?? null},
+        {configDigest: "contender", runtime: null}
+      )
+    } catch (error) {
+      contenderError = error
+    }
+    if (contenderPrepared) await contender.abortOwnerReplacement(contenderPrepared.replacementId)
+    contender.disconnect()
+    contender = undefined
+    continueRestore.resolve(undefined)
+    await assert.rejects(replacementPromise, /injected reconstruction stop after fence audit/)
+    replacementPromise = undefined
+    assert.match(mutationError instanceof Error ? mutationError.message : "", /fenced while an owner replacement is prepared/)
+    assert.match(contenderError instanceof Error ? contenderError.message : "", /another owner replacement candidate is already prepared/i)
+    assert.notEqual(JSON.parse(await fs.readFile(statePath, "utf8")).recovery.guardian.socketPath, `${statePath}.split3-guardian.sock`)
+    assert.equal((await sendControlCommand({command: {command: "status"}, path: socketPath})).daemonPid, owner.pid)
+    const shutdown = sendControlCommand({command: {command: "shutdown"}, path: socketPath})
+
+    await fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n")
+    await shutdown
+  } finally {
+    continueRestore.resolve(undefined)
+    contender?.disconnect()
+    await replacementPromise?.catch(() => undefined)
+    candidate?.guardian?.disconnect()
+    if (owner && owner.exitCode === null && owner.signalCode === null) {
+      const exited = once(owner, "exit")
+
+      owner.kill("SIGKILL")
+      await exited
+    }
+    partialGuardian?.kill("SIGTERM")
+    if (partialGuardian && partialGuardian.exitCode === null && partialGuardian.signalCode === null) await once(partialGuardian, "exit")
+    if (backendGuardianIdentity) {
+      const state = JSON.parse(await fs.readFile(statePath, "utf8").catch(() => "null"))
+
+      if (state?.recovery?.guardian?.socketPath === partialSocketPath) {
+        state.recovery.guardian = backendGuardianIdentity
+        await fs.writeFile(statePath, `${JSON.stringify(state)}\n`)
+      }
+    }
+    await stopGuardian(statePath)
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
+test("partial guardian replacement persists the coordinator only after ownership confirmation", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-partial-persist-"))
+  const socketPath = path.join(root, "rollbridge.sock")
+  const statePath = path.join(root, "state.json")
+  const configPath = path.join(root, "rollbridge.cjs")
+  const releasePath = path.join(root, "v1")
+  const partialSocketPath = path.join(root, "partial-guardian.sock")
+  const ownershipConfirmationStarted = deferred()
+  const continueOwnershipConfirmation = deferred()
+  let owner
+  let partialGuardian
+  let candidate = /** @type {RollbridgeDaemon | undefined} */ (undefined)
+  let backendGuardianIdentity
+  let replacementPromise = /** @type {Promise<void> | undefined} */ (undefined)
+
+  try {
+    await fs.mkdir(releasePath)
+    await makeFifo(path.join(releasePath, "worker.fifo"))
+    await writeConfig(configPath, config({controlPath: socketPath, extraCompanion: false, statePath}))
+    owner = spawn(process.execPath, [binPath, "daemon", "--config", configPath], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(owner, "control socket listening")
+    assert.ok(owner.pid)
+    await sendControlCommand({command: {command: "deploy", releaseId: "v1", releasePath, revision: "v1"}, path: socketPath})
+    const state = JSON.parse(await fs.readFile(statePath, "utf8"))
+
+    backendGuardianIdentity = {...state.recovery.guardian}
+    partialGuardian = await startPartialGuardian({
+      backendPath: backendGuardianIdentity.socketPath,
+      mode: "partial",
+      socketPath: partialSocketPath,
+      token: backendGuardianIdentity.token
+    })
+    state.recovery.guardian = {...backendGuardianIdentity, pid: partialGuardian.pid, socketPath: partialSocketPath}
+    await fs.writeFile(statePath, `${JSON.stringify(state)}\n`)
+    const replacement = new RollbridgeDaemon({
+      config: normalizeConfig(config({controlPath: socketPath, extraCompanion: false, statePath})),
+      configPath,
+      legacyIncumbentPid: owner.pid,
+      logger: () => {}
+    })
+    const restoreOwnerState = replacement.restoreOwnerState.bind(replacement)
+
+    candidate = replacement
+    replacement.restoreOwnerState = async (...args) => {
+      await restoreOwnerState(...args)
+      const coordinator = replacement.guardian
+
+      if (!coordinator) throw new Error("Partial guardian persistence fixture is missing its coordinator")
+      const completeLegacyOwnerClaim = coordinator.completeLegacyOwnerClaim.bind(coordinator)
+
+      coordinator.completeLegacyOwnerClaim = async (replacementId) => {
+        ownershipConfirmationStarted.resolve(undefined)
+        await continueOwnershipConfirmation.promise
+        await completeLegacyOwnerClaim(replacementId)
+      }
+    }
+    replacementPromise = replacement.replaceIncompatibleOwner()
+    void replacementPromise.catch(() => {})
+    await ownershipConfirmationStarted.promise
+    assert.notEqual(
+      JSON.parse(await fs.readFile(statePath, "utf8")).recovery.guardian.socketPath,
+      `${statePath}.split3-guardian.sock`,
+      "durable state must not name the coordinator before its legacy ownership claim is confirmed"
+    )
+    continueOwnershipConfirmation.resolve(undefined)
+    await replacementPromise
+    replacementPromise = undefined
+    const shutdown = replacement.shutdown()
+
+    await fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n")
+    await shutdown
+    candidate = undefined
+  } finally {
+    continueOwnershipConfirmation.resolve(undefined)
+    await replacementPromise?.catch(() => undefined)
+    if (candidate?.controlServer || candidate?.proxyServer) {
+      const shutdown = candidate.shutdown().catch(() => undefined)
+
+      await fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n").catch(() => undefined)
+      await shutdown
+    }
+    candidate?.guardian?.disconnect()
+    if (owner && owner.exitCode === null && owner.signalCode === null) {
+      const exited = once(owner, "exit")
+
+      owner.kill("SIGKILL")
+      await exited
+    }
+    partialGuardian?.kill("SIGTERM")
+    if (partialGuardian && partialGuardian.exitCode === null && partialGuardian.signalCode === null) await once(partialGuardian, "exit")
+    if (backendGuardianIdentity) {
+      const state = JSON.parse(await fs.readFile(statePath, "utf8").catch(() => "null"))
+
+      if (state?.recovery?.guardian?.socketPath === partialSocketPath) {
+        state.recovery.guardian = backendGuardianIdentity
+        await fs.writeFile(statePath, `${JSON.stringify(state)}\n`)
+      }
+    }
+    await stopGuardian(statePath)
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
+test("failed partial upgrade resumes an incumbent retired release drain", {timeout: 5000}, async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-partial-drain-"))
+  const socketPath = path.join(root, "rollbridge.sock")
+  const statePath = path.join(root, "state.json")
+  const configPath = path.join(root, "rollbridge.cjs")
+  const v1Path = path.join(root, "v1")
+  const v2Path = path.join(root, "v2")
+  const partialSocketPath = path.join(root, "partial-guardian.sock")
+  let owner
+  let partialGuardian
+  let retainedConnection
+  let candidate = /** @type {RollbridgeDaemon | undefined} */ (undefined)
+  let backendGuardianIdentity
+
+  try {
+    await Promise.all([fs.mkdir(v1Path), fs.mkdir(v2Path)])
+    await Promise.all([makeFifo(path.join(v1Path, "worker.fifo")), makeFifo(path.join(v2Path, "worker.fifo"))])
+    await writeConfig(configPath, config({controlPath: socketPath, extraCompanion: false, statePath}))
+    owner = spawn(process.execPath, [binPath, "daemon", "--config", configPath], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(owner, "control socket listening")
+    assert.ok(owner.pid)
+    await sendControlCommand({command: {command: "deploy", releaseId: "v1", releasePath: v1Path, revision: "v1"}, path: socketPath})
+    const v1Status = await sendControlCommand({command: {command: "status"}, path: socketPath})
+    const proxyPort = /** @type {{port?: number}} */ (v1Status.proxy).port
+
+    if (typeof proxyPort !== "number") throw new Error("Partial guardian drain fixture proxy is missing its bound port")
+    retainedConnection = await openWebSocket(proxyPort)
+    await sendControlCommand({command: {command: "deploy", releaseId: "v2", releasePath: v2Path, revision: "v2"}, path: socketPath})
+    const draining = await sendControlCommand({command: {command: "status"}, path: socketPath})
+
+    assert.equal(releaseState(draining, "v1"), "draining")
+    const state = JSON.parse(await fs.readFile(statePath, "utf8"))
+
+    backendGuardianIdentity = {...state.recovery.guardian}
+    partialGuardian = await startPartialGuardian({
+      backendPath: backendGuardianIdentity.socketPath,
+      mode: "wrong-provenance",
+      socketPath: partialSocketPath,
+      token: backendGuardianIdentity.token
+    })
+    state.recovery.guardian = {...backendGuardianIdentity, pid: partialGuardian.pid, socketPath: partialSocketPath}
+    await fs.writeFile(statePath, `${JSON.stringify(state)}\n`)
+    const replacement = new RollbridgeDaemon({
+      config: normalizeConfig(config({controlPath: socketPath, extraCompanion: false, statePath})),
+      configPath,
+      legacyIncumbentPid: owner.pid,
+      logger: () => {}
+    })
+
+    candidate = replacement
+    await assert.rejects(() => replacement.replaceIncompatibleOwner(), /provenance mismatch/)
+    assert.equal(owner.exitCode, null)
+    assert.equal(owner.signalCode, null)
+    const releaseDrained = waitForLog(owner, "release drained")
+
+    retainedConnection.destroy()
+    await fs.writeFile(path.join(v1Path, "worker.fifo"), "drained\n")
+    await releaseDrained
+    assert.equal(releaseState(await sendControlCommand({command: {command: "status"}, path: socketPath}), "v1"), "stopped")
+    const shutdown = sendControlCommand({command: {command: "shutdown"}, path: socketPath})
+
+    await fs.writeFile(path.join(v2Path, "worker.fifo"), "drained\n")
+    await shutdown
+  } finally {
+    retainedConnection?.destroy()
+    candidate?.guardian?.disconnect()
+    if (owner && owner.exitCode === null && owner.signalCode === null) owner.kill("SIGKILL")
+    partialGuardian?.kill("SIGTERM")
+    if (partialGuardian && partialGuardian.exitCode === null && partialGuardian.signalCode === null) await once(partialGuardian, "exit")
+    if (backendGuardianIdentity) {
+      const state = JSON.parse(await fs.readFile(statePath, "utf8").catch(() => "null"))
+
+      if (state?.recovery?.guardian?.socketPath === partialSocketPath) {
+        state.recovery.guardian = backendGuardianIdentity
+        await fs.writeFile(statePath, `${JSON.stringify(state)}\n`)
+      }
+    }
+    await stopGuardian(statePath)
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
+test("partial guardian classification failures preserve the incumbent, children, and retained stream", async (t) => {
+  for (const fault of ["malformed-capability", "wrong-pid", "wrong-provenance"]) {
+    await t.test(fault, async () => {
+      const root = await fs.mkdtemp(path.join(os.tmpdir(), `rollbridge-owner-replacement-partial-${fault}-`))
+      const socketPath = path.join(root, "rollbridge.sock")
+      const statePath = path.join(root, "state.json")
+      const configPath = path.join(root, "rollbridge.cjs")
+      const releasePath = path.join(root, "v1")
+      const partialSocketPath = path.join(root, "partial-guardian.sock")
+      let owner
+      let partialGuardian
+      let retainedConnection
+      let candidate = /** @type {RollbridgeDaemon | undefined} */ (undefined)
+
+      try {
+        await fs.mkdir(releasePath)
+        await makeFifo(path.join(releasePath, "worker.fifo"))
+        await writeConfig(configPath, config({controlPath: socketPath, extraCompanion: false, statePath}))
+        owner = spawn(process.execPath, [binPath, "daemon", "--config", configPath], {stdio: ["ignore", "pipe", "pipe"]})
+        await waitForLog(owner, "control socket listening")
+        assert.ok(owner.pid)
+        await sendControlCommand({command: {command: "deploy", releaseId: "v1", releasePath, revision: "v1"}, path: socketPath})
+        const before = await sendControlCommand({command: {command: "status"}, path: socketPath})
+        const processPids = [releaseProcessPid(before, "v1", "worker"), releaseProcessPid(before, "v1", "web")]
+        const proxyPort = /** @type {{port?: number}} */ (before.proxy).port
+        const state = JSON.parse(await fs.readFile(statePath, "utf8"))
+        const backendIdentity = {...state.recovery.guardian}
+
+        if (typeof proxyPort !== "number") throw new Error("Partial guardian failure fixture proxy is missing its bound port")
+        partialGuardian = await startPartialGuardian({
+          backendPath: backendIdentity.socketPath,
+          mode: fault === "wrong-provenance" ? fault : fault === "malformed-capability" ? fault : "partial",
+          socketPath: partialSocketPath,
+          token: backendIdentity.token
+        })
+        state.recovery.guardian = {
+          ...backendIdentity,
+          pid: fault === "wrong-pid" ? backendIdentity.pid : partialGuardian.pid,
+          socketPath: partialSocketPath
+        }
+        await fs.writeFile(statePath, `${JSON.stringify(state)}\n`)
+        retainedConnection = await openWebSocket(proxyPort)
+        let retainedClosed = false
+
+        retainedConnection.once("close", () => { retainedClosed = true })
+        const replacement = new RollbridgeDaemon({
+          config: normalizeConfig(config({controlPath: socketPath, extraCompanion: false, statePath})),
+          configPath,
+          legacyIncumbentPid: owner.pid,
+          logger: () => {}
+        })
+        candidate = replacement
+        const expected = fault === "malformed-capability"
+          ? /invalid owner-replacement capability response/
+          : fault === "wrong-pid"
+            ? /does not own socket|does not match the retained guardian command and socket/
+            : /provenance mismatch/
+
+        await assert.rejects(() => replacement.replaceIncompatibleOwner(), expected)
+        assert.equal(owner.exitCode, null)
+        assert.equal(owner.signalCode, null)
+        assert.equal(retainedClosed, false)
+        assert.equal(retainedConnection.destroyed, false)
+        for (const pid of processPids) assert.doesNotThrow(() => process.kill(pid, 0))
+        assert.equal(releaseProcessPid(await sendControlCommand({command: {command: "status"}, path: socketPath}), "v1", "worker"), processPids[0])
+        await assert.rejects(fs.access(`${statePath}.split3-guardian.sock`), {code: "ENOENT"})
+
+        const shutdown = sendControlCommand({command: {command: "shutdown"}, path: socketPath})
+
+        await fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n")
+        await shutdown
+      } finally {
+        retainedConnection?.destroy()
+        candidate?.guardian?.disconnect()
+        if (owner && owner.exitCode === null && owner.signalCode === null) owner.kill("SIGKILL")
+        partialGuardian?.kill("SIGTERM")
+        if (partialGuardian && partialGuardian.exitCode === null && partialGuardian.signalCode === null) await once(partialGuardian, "exit")
+        await stopGuardian(statePath)
+        await fs.rm(root, {force: true, recursive: true})
+      }
+    })
+  }
+})
 
 test("first pre-split package upgrade is explicitly disruptive and later replacements are atomic", async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-legacy-"))
@@ -81,7 +551,7 @@ test("first pre-split package upgrade is explicitly disruptive and later replace
     assert.deepEqual(JSON.parse(firstUpgrade.stdout).ownerTransition, {
       disruptive: true,
       mode: "legacy-first-upgrade",
-      reason: "pre-split guardian and daemon lacked atomic replacement protocol"
+      reason: "retained guardian and daemon lacked atomic replacement protocol"
     })
     await interrupted
     const bridged = await sendControlCommand({command: {command: "status"}, path: socketPath})
@@ -89,7 +559,7 @@ test("first pre-split package upgrade is explicitly disruptive and later replace
     assert.deepEqual(bridged.ownerTransition, {
       disruptive: true,
       mode: "legacy-first-upgrade",
-      reason: "pre-split guardian and daemon lacked atomic replacement protocol"
+      reason: "retained guardian and daemon lacked atomic replacement protocol"
     })
     assert.equal(releaseProcessPid(bridged, "v1", "worker"), legacyWorkerPid)
     assert.equal(bridged.activeReleaseId, "v1")
@@ -393,16 +863,24 @@ test("cross-version replacement fails closed without dropping a retained WebSock
   }
 })
 
-test("same-authority replacement commits with committed-owner proof after the incumbent control socket is removed", async () => {
+test("cross-version replacement preserves committed-owner proof until commit then recovers every process", async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-committed-proof-"))
   const socketPath = path.join(root, "rollbridge.sock")
   const statePath = path.join(root, "state.json")
+  const compatibilitySocketPath = path.join(root, "retained-guardian.sock")
   const releasePath = path.join(root, "v1")
   const daemonConfig = normalizeConfig(config({controlPath: socketPath, extraCompanion: false, statePath}))
   const owner = new RollbridgeDaemon({config: daemonConfig, logger: () => {}})
+  const compatibilitySockets = new Set()
   const candidateProcessKey = "release:candidate:worker"
   const committedOwnerProcessKey = "release:v1:worker"
+  const candidateRecoveredKeys = new Set()
+  let compatibilityGuardian
   let committedProcessKey
+  let recoveredKeysAtCommit = /** @type {Set<string> | undefined} */ (undefined)
+  let retainedConnection
+  let retainedConnectionClosed = false
+  let retainedGuardianSocketPath = /** @type {string | undefined} */ (undefined)
   /** @type {RollbridgeDaemon | undefined} */
   let replacement
 
@@ -421,14 +899,66 @@ test("same-authority replacement commits with committed-owner proof after the in
       key: candidateProcessKey,
       provenance: ownerProcess.provenance
     })
-    await Promise.all([...owner.releases.values()].map((release) => release.quiesce()))
+    const running = owner.status()
+    const processState = running.releases[0]?.processes.map(({id, pid, state}) => ({id, pid, state}))
+    const expectedProcessKeys = new Set(running.releases[0]?.processes.map(({id}) => `release:v1:${id}`))
+    const proxyPort = /** @type {{port?: number}} */ (running.proxy).port
+
+    assert.deepEqual(processState?.map(({state}) => state), ["running", "running"])
+    if (typeof proxyPort !== "number") throw new Error("Retained owner proxy is missing its port")
+    retainedConnection = await openWebSocket(proxyPort)
+    retainedConnection.once("close", () => { retainedConnectionClosed = true })
     await owner.closeServer(owner.controlServer)
     await owner.removeControlSocket()
-    await owner.closeServer(owner.proxyServer)
-    const retired = owner.status()
-    const processState = retired.releases[0]?.processes.map(({id, pid, state}) => ({id, pid, state}))
+    const state = JSON.parse(await fs.readFile(statePath, "utf8"))
+    const guardianSocketPath = state.recovery.guardian.socketPath
+
+    if (typeof guardianSocketPath !== "string") throw new Error("Retained guardian state is missing its socket path")
+    retainedGuardianSocketPath = guardianSocketPath
+    compatibilityGuardian = net.createServer((candidateSocket) => {
+      const guardianSocket = net.createConnection(guardianSocketPath)
+      let buffer = ""
+
+      compatibilitySockets.add(candidateSocket)
+      compatibilitySockets.add(guardianSocket)
+      candidateSocket.setEncoding("utf8")
+      candidateSocket.once("close", () => {
+        compatibilitySockets.delete(candidateSocket)
+        guardianSocket.destroy()
+      })
+      guardianSocket.once("close", () => {
+        compatibilitySockets.delete(guardianSocket)
+        candidateSocket.destroy()
+      })
+      guardianSocket.on("data", (chunk) => candidateSocket.write(chunk))
+      candidateSocket.on("data", (chunk) => {
+        buffer += chunk
+        let newline = buffer.indexOf("\n")
+
+        while (newline >= 0) {
+          const line = buffer.slice(0, newline)
+          const request = JSON.parse(line)
+
+          buffer = buffer.slice(newline + 1)
+          if (request.command === "register") candidateRecoveredKeys.add(request.key)
+          if (request.command === "commit-retired-owner-replacement") {
+            committedProcessKey = request.key
+            recoveredKeysAtCommit = new Set(candidateRecoveredKeys)
+            if (candidateRecoveredKeys.has(request.key)) {
+              candidateSocket.write(`${JSON.stringify({error: `Guardian ${request.command} requires the committed owner`, id: request.id})}\n`)
+              newline = buffer.indexOf("\n")
+              continue
+            }
+          }
+          guardianSocket.write(`${line}\n`)
+          newline = buffer.indexOf("\n")
+        }
+      })
+    })
+    await listenUnix(compatibilityGuardian, compatibilitySocketPath)
+    state.recovery.guardian.socketPath = compatibilitySocketPath
+    await fs.writeFile(statePath, `${JSON.stringify(state)}\n`)
 
-    assert.deepEqual(processState?.map(({state}) => state), ["quiesced", "quiesced"])
     assert.equal((await owner.guardian?.replacementStatus())?.ownerClaimed, true)
     await assert.rejects(fs.access(socketPath), {code: "ENOENT"})
 
@@ -455,14 +985,33 @@ test("same-authority replacement commits with committed-owner proof after the in
 
     assert.equal(recovered.activeReleaseId, "v1")
     assert.equal(committedProcessKey, committedOwnerProcessKey)
+    assert.equal(recoveredKeysAtCommit?.has(committedOwnerProcessKey), false)
+    assert.deepEqual(candidateRecoveredKeys, expectedProcessKeys)
+    assert.equal([...replacement.guardian?.processes.keys() || []][0], candidateProcessKey)
+    assert.equal(retainedConnectionClosed, false, "successful compatibility handoff must preserve retained connections")
+    assert.equal(retainedConnection.destroyed, false, "successful compatibility handoff must leave the retained listener serving")
     assert.deepEqual(recovered.releaseReferences, [{releaseId: "v1", releasePath}])
     assert.deepEqual(recoveredReleases[0]?.processes.map(({id, pid, state}) => ({id, pid, state})), processState)
+    for (const {pid} of processState || []) {
+      if (typeof pid !== "number") throw new Error("Retained process is missing its PID")
+      assert.doesNotThrow(() => process.kill(pid, 0))
+    }
   } finally {
+    if (retainedGuardianSocketPath) {
+      const cleanupState = JSON.parse(await fs.readFile(statePath, "utf8"))
+
+      cleanupState.recovery.guardian.socketPath = retainedGuardianSocketPath
+      await fs.writeFile(statePath, `${JSON.stringify(cleanupState)}\n`)
+    }
     const shutdown = replacement?.controlCommandsReady ? replacement.shutdown().catch(() => {}) : owner.shutdown().catch(() => {})
 
+    retainedConnection?.destroy()
+    await owner.closeServer(owner.proxyServer)
     await Promise.all([fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n").catch(() => {}), shutdown])
     owner.guardian?.disconnect()
     replacement?.guardian?.disconnect()
+    for (const socket of compatibilitySockets) socket.destroy()
+    if (compatibilityGuardian?.listening) await closeServer(compatibilityGuardian)
     await stopGuardian(statePath)
     await fs.rm(root, {force: true, recursive: true})
   }
@@ -891,6 +1440,32 @@ async function runEnsureDaemon({configPath, daemonPidPath, logPath, packagePath,
   ])
 }
 
+/**
+ * Starts an authenticated protocol proxy that exposes the exact partial guardian surface.
+ * @param {{backendPath: string, mode: string, socketPath: string, token: string}} options - Fixture identity.
+ * @returns {Promise<import("node:child_process").ChildProcess>} Ready guardian proxy.
+ */
+async function startPartialGuardian({backendPath, mode, socketPath, token}) {
+  const child = spawn(process.execPath, [partialGuardianPath, socketPath, backendPath, mode], {
+    stdio: ["ignore", "ignore", "ignore", "ipc"]
+  })
+
+  await new Promise((resolve, reject) => {
+    child.once("error", reject)
+    child.once("exit", (code) => reject(new Error(`Partial guardian exited before readiness with status ${code}`)))
+    child.once("message", (message) => {
+      if (message && typeof message === "object" && "error" in message) reject(new Error(String(message.error)))
+      else resolve(undefined)
+    })
+    child.send({token}, (error) => {
+      if (error) reject(error)
+    })
+  })
+  if (child.connected) await once(child, "disconnect")
+  assert.ok(child.pid)
+  return child
+}
+
 /**
  * @param {net.Server} server - Unix server.
  * @param {string} socketPath - Unix socket path.
@@ -934,6 +1509,27 @@ function releaseProcessPid(status, releaseId, processId) {
   return pid
 }
 
+/**
+ * @param {Record<string, import("../src/json.js").JsonValue>} status - Daemon status.
+ * @param {string} releaseId - Release identity.
+ * @returns {string} Release lifecycle state.
+ */
+function releaseState(status, releaseId) {
+  const releases = /** @type {{releaseId: string, state: string}[]} */ (status.releases)
+  const state = releases.find((release) => release.releaseId === releaseId)?.state
+
+  if (!state) throw new Error(`Missing release state for ${releaseId}`)
+  return state
+}
+
+/** @returns {{promise: Promise<void>, resolve: (value: void) => void}} Controllable event barrier. */
+function deferred() {
+  let resolve = /** @type {(value: void) => void} */ (() => {})
+  const promise = new Promise((promiseResolve) => { resolve = promiseResolve })
+
+  return {promise, resolve}
+}
+
 /**
  * @param {string} command - Executable.
  * @param {string[]} args - Arguments.