rollbridge 0.1.37 → 0.1.39

package/docs/cli.md

@@ -64,6 +64,16 @@ identity. Rollbridge does not calculate or interpret the digest.
 With no release options, daemon behavior is unchanged: it starts listener-only
 and waits for control-socket deployments.
 
+If an external owner retirement has already journaled a committed generation but
+cleared its active role, only a foreground bootstrap with that exact release id,
+path, revision, and config authority may restore it. Rollbridge waits for the
+retiring candidate processes to stop, journals `restoring_committed`, reconnects
+their existing guardian registrations, restarts that candidate, health-checks it,
+and restores its generation activation before completing singletons and exposing
+control. A later exact bootstrap resumes the journaled restart without duplicating
+processes. A mismatched tuple or a candidate that is still retiring fails closed
+without stopping other retained generations.
+
 `--takeover-owner` requires the complete bootstrap tuple. It bootstraps and
 health-checks the replacement before sending the current daemon the private
 retirement command. The current `performOwnerRetirement` path quiesces every

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rollbridge",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "description": "Zero-downtime process supervisor and local traffic switcher for deploy-managed apps.",
   "keywords": [
     "deploy",

package/src/cli.js

@@ -102,8 +102,13 @@ export async function runCli(argv) {
 
           daemon.logger("bootstrap activation failed", {releaseId: bootstrap.releaseId, status: "error", ...errorLogData(failure)})
 
-          if (config.ownerRecovery && daemon.activeRelease) {
-            await daemon.exposeControl()
+          if (config.ownerRecovery && daemon.releases.size > 0) {
+            if (daemon.activeRelease) {
+              await daemon.exposeControl()
+              return
+            }
+            await daemon.abandonOwnerRecoveryAttempt()
+            process.exitCode = 1
             return
           }
 

package/src/daemon.js

@@ -23,7 +23,7 @@ const STATE_PERSIST_INTERVAL_MS = 5000
  * @typedef {{attestation?: string, releaseId: string, releasePath: string, revision: string}} BootstrapIdentity
  * @typedef {{id: string, process: import("./managed-process.js").ManagedProcessStatus}} ProcessStatus
  * @typedef {{disruptive: true, mode: "legacy-first-upgrade", reason: string}} OwnerTransition
- * @typedef {"candidate_ready" | "retiring_previous" | "previous_retired" | "activating_candidate" | "committed_pending" | "committed"} GenerationTransitionPhase
+ * @typedef {"candidate_ready" | "retiring_previous" | "previous_retired" | "activating_candidate" | "committed_pending" | "committed" | "restoring_committed"} GenerationTransitionPhase
  * @typedef {{candidateReleaseId: string, candidateReleasePath: string, candidateRevision: string, configDigest: string, error?: string, phase: GenerationTransitionPhase, previousReleaseId: string | null, startedAt: string, updatedAt: string}} GenerationTransition
  * @typedef {{activeReleaseId: string | null, application: string, bootstrap: BootstrapIdentity | undefined, control: import("./config.js").ControlConfig, daemonPid: number, daemonRuntime: import("./daemon-runtime.js").DaemonRuntimeIdentity | undefined, generationTransition?: GenerationTransition, ownerRecovery: {configDigest: string} | undefined, ownerTransition?: OwnerTransition, orphans: {id: string, pid: number, releaseId: string | null}[], proxy: {host: string, port: number | undefined, upstreamHost: string}, releaseReferences: {releaseId: string, releasePath: string}[], releases: import("./release-group.js").ReleaseStatus[], services: ProcessStatus[], singletons: ProcessStatus[]}} DaemonStatus
  * @typedef {{configDigest: string, format: number, guardian: {pid?: number, socketPath: string, token: string}, reconnectGraceMs: number}} OwnerRecoveryMetadata
@@ -228,7 +228,7 @@ export default class RollbridgeDaemon {
     }
     this.generationTransition = snapshot.generationTransition ? {...snapshot.generationTransition} : undefined
     if (snapshot.activeReleaseId === null && snapshot.releases.length === 0) return
-    this.bootstrap = snapshot.bootstrap ? {...snapshot.bootstrap} : undefined
+    if (!this.bootstrap) this.bootstrap = snapshot.bootstrap ? {...snapshot.bootstrap} : undefined
     this.ownerTransition = snapshot.ownerTransition ? {...snapshot.ownerTransition} : undefined
     const singletonOwnerReleaseIds = new Set(Object.values(singletonReleaseIds))
 
@@ -255,9 +255,10 @@ export default class RollbridgeDaemon {
     }
 
     if (snapshot.activeReleaseId !== null && !this.activeRelease) throw new Error(`Owner recovery state does not contain active release ${snapshot.activeReleaseId}.`)
-    const definitionRelease = this.activeRelease || [...this.releases.values()].at(-1)
+    const committedBootstrapRelease = this.committedBootstrapRelease()
+    const definitionRelease = this.activeRelease || committedBootstrapRelease || [...this.releases.values()].at(-1)
     if (!definitionRelease) throw new Error("Owner recovery state has no release definition for owned processes.")
-    if (!this.activeRelease && snapshot.singletons.length > 0) throw new Error("Owner recovery state has release-owned singletons without an active release identity.")
+    if (!this.activeRelease && !committedBootstrapRelease && snapshot.singletons.length > 0) throw new Error("Owner recovery state has release-owned singletons without an active release identity.")
     for (const serviceStatus of snapshot.services) {
       const processConfig = config.processes.find((candidate) => candidate.id === serviceStatus.id && candidate.policy === "service" && candidate.deployStrategy !== "handoff")
 
@@ -340,7 +341,7 @@ export default class RollbridgeDaemon {
       if (!transfer?.config || !transfer.snapshot) throw new Error("Committed owner published incomplete replacement state")
       const registeredProcesses = new Map((await this.guardian.inventory()).map(({key, provenance}) => [key, provenance]))
 
-      reservedProcessKey = legacyBridge ? undefined : ownerSnapshotProcessKeys(transfer.snapshot, transfer.singletonReleaseIds)
+      reservedProcessKey = legacyBridge ? undefined : reconstructableOwnerSnapshotProcessKeys(transfer.snapshot, transfer.singletonReleaseIds)
         .find((key) => registeredProcesses.has(key))
       if (reservedProcessKey) this.guardian.reserveProcessRecovery(reservedProcessKey, /** @type {string} */ (registeredProcesses.get(reservedProcessKey)))
       await this.restoreOwnerState(transfer.snapshot, {config: transfer.config, releaseConfigs: transfer.releaseConfigs, resumeDrains: false, singletonReleaseIds: transfer.singletonReleaseIds, synchronizeLifecycleRoles: false})
@@ -547,13 +548,14 @@ export default class RollbridgeDaemon {
     if (!releaseId || !connections || typeof connections !== "object" || Array.isArray(connections)) {
       throw new Error("Incumbent listener sent invalid connection state")
     }
-    const release = this.releases.get(releaseId)
-
-    if (!release) throw new Error(`Incumbent listener reported unknown release ${releaseId}`)
-    release.setTransferredConnections({
+    const transferredConnections = {
       http: requiredNonNegativeInteger(connections.http, "connections.http"),
       websocket: requiredNonNegativeInteger(connections.websocket, "connections.websocket")
-    })
+    }
+    const release = this.releases.get(releaseId)
+
+    if (!release && (transferredConnections.http > 0 || transferredConnections.websocket > 0)) throw new Error(`Incumbent listener reported unknown release ${releaseId}`)
+    if (release) release.setTransferredConnections(transferredConnections)
     if (this.incumbentListenerControl === session && ![...this.releases.values()].some((candidate) => candidate.hasTransferredConnections())) {
       this.incumbentListenerControl = undefined
       session.close()
@@ -1241,6 +1243,13 @@ export default class RollbridgeDaemon {
       this.assertExactGenerationTransition(transition, {config: nextConfig, releaseId: newReleaseId, releasePath, revision: revision || newReleaseId})
       return {activeReleaseId: newReleaseId, previousReleaseId: transition.previousReleaseId}
     }
+    if (transition?.phase === "committed" && !this.activeRelease && this.bootstrap && this.releases.get(transition.candidateReleaseId)?.state === "draining") {
+      this.assertExactGenerationTransition(transition, {config: nextConfig, releaseId: newReleaseId, releasePath, revision: revision || newReleaseId})
+      this.assertCommittedBootstrapRecoveryReady()
+      this.config = nextConfig
+      await this.updateGenerationTransition("restoring_committed")
+      return await this.resumeGenerationTransition()
+    }
     const release = new ReleaseGroup({
       config: nextConfig,
       logger: this.logger,
@@ -1386,6 +1395,16 @@ export default class RollbridgeDaemon {
       this.logger("traffic switched", {previousReleaseId: previousRelease?.releaseId ?? null, releaseId: release.releaseId})
     }
 
+    if (transition.phase === "restoring_committed") {
+      await this.resumeCommittedBootstrapGeneration(release)
+      release.activate()
+      this.activeRelease = release
+      transition.phase = "committed_pending"
+      transition.error = undefined
+      transition.updatedAt = new Date().toISOString()
+      this.logger("committed bootstrap generation restored", {releaseId: release.releaseId})
+    }
+
     if (transition.phase === "committed_pending") {
       await this.checkpointGenerationTransition()
       this.refreshServiceDefinitions(release)
@@ -1419,6 +1438,82 @@ export default class RollbridgeDaemon {
     }
   }
 
+  /**
+   * Returns the retained candidate only when the foreground bootstrap exactly proves the
+   * committed transition that an external owner retirement left without an active role.
+   * @returns {ReleaseGroup | undefined} Exact committed bootstrap candidate.
+   */
+  committedBootstrapRelease() {
+    const bootstrap = this.bootstrap
+    const transition = this.generationTransition
+
+    if (!bootstrap || !transition || (transition.phase !== "committed" && transition.phase !== "restoring_committed") || transition.candidateReleaseId !== bootstrap.releaseId || transition.candidateReleasePath !== bootstrap.releasePath || transition.candidateRevision !== bootstrap.revision || transition.configDigest !== ownerConfigDigest(this.config)) return undefined
+    const release = this.releases.get(bootstrap.releaseId)
+
+    if (!release || release.releasePath !== bootstrap.releasePath || release.revision !== bootstrap.revision) return undefined
+    return release
+  }
+
+  /**
+   * Fails closed before journaling recovery unless external retirement has fully stopped
+   * the exact candidate and daemon-owned processes.
+   * @returns {void}
+   */
+  assertCommittedBootstrapRecoveryReady() {
+    const release = this.committedBootstrapRelease()
+
+    if (!release) throw new Error("Committed generation has no exact foreground bootstrap recovery proof")
+    release.assertCommittedGenerationStopped()
+    const ownedProcesses = [
+      ...this.services.values(),
+      ...this.singletons.values()
+    ]
+    const stillRetiring = ownedProcesses.find((processInstance) => {
+      const {pid, state} = processInstance.status()
+      return pid !== undefined || (state !== "stopped" && state !== "failed")
+    })
+
+    if (stillRetiring) throw new Error(`Committed generation daemon process ${stillRetiring.id} is still retiring; exact bootstrap recovery will retry after it stops`)
+    for (const [singletonId, singletonReleaseId] of this.singletonReleaseIds) {
+      if (singletonReleaseId !== release.releaseId) throw new Error(`Committed generation singleton ${singletonId} belongs to retained release ${singletonReleaseId}`)
+    }
+  }
+
+  /**
+   * Resumes a durably journaled committed-candidate restart. Running processes are
+   * necessarily owned by this exact recovery phase; stopped processes are restarted.
+   * Singleton completion remains in the established committed_pending phase.
+   * @param {ReleaseGroup} release - Exact committed candidate.
+   * @returns {Promise<void>}
+   */
+  async resumeCommittedBootstrapGeneration(release) {
+    if (this.generationTransition?.phase !== "restoring_committed" || release !== this.committedBootstrapRelease()) {
+      throw new Error("Committed bootstrap recovery is not durably journaled for this exact candidate")
+    }
+    const resumableStates = new Set(["failed", "running", "stopped"])
+    const invalidProcess = [...this.services.values(), ...this.singletons.values()].find((processInstance) => {
+      const {pid, state} = processInstance.status()
+      return !resumableStates.has(state) || (state === "running") !== (pid !== undefined)
+    })
+
+    if (invalidProcess) throw new Error(`Committed bootstrap recovery found daemon process ${invalidProcess.id} outside its journaled restart states`)
+    release.assertCommittedGenerationRecoverable()
+
+    try {
+      for (const processInstance of this.services.values()) {
+        await processInstance.start("deploy")
+      }
+      await release.restartCommittedGeneration()
+      await release.activateGeneration()
+    } catch (error) {
+      await Promise.allSettled([
+        release.abortCommittedGenerationRestart(),
+        ...[...this.services.values()].map((processInstance) => processInstance.stop())
+      ])
+      throw error
+    }
+  }
+
   /** @param {GenerationTransitionPhase} phase - Durable phase to enter. */
   async updateGenerationTransition(phase) {
     if (!this.generationTransition) throw new Error("No release generation transition to update")
@@ -1454,6 +1549,7 @@ export default class RollbridgeDaemon {
   shouldResumeDrain(release) {
     const transition = this.generationTransition
 
+    if (release === this.committedBootstrapRelease()) return false
     return !transition || transition.phase === "committed_pending" || transition.phase === "committed" || transition.previousReleaseId !== release.releaseId
   }
 
@@ -2121,6 +2217,27 @@ function ownerSnapshotProcessKeys(snapshot, singletonReleaseIds = {}) {
   return keys
 }
 
+/**
+ * Selects only committed guardian registrations that restoreOwnerState will reconstruct.
+ * @param {OwnerRecoverySnapshot} snapshot - Serialized owner process snapshot.
+ * @param {Record<string, string>} [singletonReleaseIds] - Exact singleton owner releases.
+ * @returns {string[]} Exact reconstructable guardian registration keys.
+ */
+function reconstructableOwnerSnapshotProcessKeys(snapshot, singletonReleaseIds = {}) {
+  const singletonOwnerReleaseIds = new Set(Object.values(singletonReleaseIds))
+  const releaseProcessKeys = new Set()
+
+  for (const release of snapshot.releases) {
+    const transitionCandidate = snapshot.generationTransition?.candidateReleaseId === release.releaseId && snapshot.generationTransition.phase !== "committed"
+    const singletonOwner = singletonOwnerReleaseIds.has(release.releaseId)
+
+    if (release.state !== "active" && release.state !== "draining" && !transitionCandidate && !singletonOwner) continue
+    for (const processStatus of release.processes) releaseProcessKeys.add(`release:${release.releaseId}:${processStatus.id}`)
+  }
+  return ownerSnapshotProcessKeys(snapshot, singletonReleaseIds)
+    .filter((key) => !key.startsWith("release:") || releaseProcessKeys.has(key))
+}
+
 /**
  * Canonicalizes the authenticated guardian inventory without relying on map insertion order.
  * @param {{key: string, provenance: string}[]} inventory - Guardian inventory response.

package/src/release-group.js

@@ -276,6 +276,61 @@ export default class ReleaseGroup extends EventEmitter {
     await instance.process.activateStrict()
   }
 
+  /**
+   * Restarts only the exact processes reconstructed for a committed generation.
+   * The caller must prove the durable transition identity before using this path.
+   */
+  async restartCommittedGeneration() {
+    this.assertCommittedGenerationRecoverable()
+    this.state = "starting"
+    try {
+      for (const processConfig of this.releaseProcessStartOrder()) {
+        const instances = this.getProcesses(processConfig.id)
+
+        if (instances.length !== processConfig.replicas) throw new Error(`Committed generation ${this.releaseId} is missing process ${processConfig.id}`)
+        for (const {process} of instances) await process.start("deploy", processConfig.lifecycle.activateCommand ? "candidate" : undefined)
+
+        if (processConfig.policy === "proxied" && processConfig.port && processConfig.health) {
+          await waitForHealth({
+            health: processConfig.health,
+            host: this.config.proxy.upstreamHost,
+            port: this.ports[processConfig.id]
+          })
+        }
+      }
+    } catch (error) {
+      await this.abortCommittedGenerationRestart()
+      throw error
+    }
+  }
+
+  /** Fails closed unless every exact candidate process has finished external retirement. */
+  assertCommittedGenerationStopped() {
+    if (this.state !== "draining") throw new Error(`Committed generation ${this.releaseId} is not retained as draining`)
+    const statuses = [...this.processes.values()].map((processInstance) => processInstance.status())
+
+    if (statuses.some(({pid, state}) => pid !== undefined || (state !== "stopped" && state !== "failed"))) {
+      throw new Error(`Committed generation ${this.releaseId} is still retiring; exact bootstrap recovery will retry after its processes stop`)
+    }
+  }
+
+  /** Accepts only process states produced after the exact recovery phase was journaled. */
+  assertCommittedGenerationRecoverable() {
+    if (this.state !== "draining" && this.state !== "starting") throw new Error(`Committed generation ${this.releaseId} is not retained in its journaled recovery state`)
+    const statuses = [...this.processes.values()].map((processInstance) => processInstance.status())
+    const resumableStates = new Set(["failed", "running", "stopped"])
+
+    if (statuses.some(({pid, state}) => !resumableStates.has(state) || (state === "running") !== (pid !== undefined))) {
+      throw new Error(`Committed generation ${this.releaseId} has a process outside its journaled restart states`)
+    }
+  }
+
+  /** Stops only a failed committed-bootstrap restart while retaining its exact identity. */
+  async abortCommittedGenerationRestart() {
+    await Promise.allSettled([...this.processes.values()].map((processInstance) => processInstance.stop()))
+    this.state = "draining"
+  }
+
   /** @returns {Promise<void>} Allocates all configured per-process ports. */
   async allocatePorts() {
     if (this.portsAllocated) return

package/test/owner-recovery.test.js

@@ -95,6 +95,259 @@ test("external owner retirement releases guardian authority without losing its g
   }
 })
 
+test("exact bootstrap restores the committed generation after external owner retirement", async () => {
+  const fixture = await createFixture()
+  const config = normalizeConfig(fixture.config, fixture.configPath)
+  const retired = new RollbridgeDaemon({config, configPath: fixture.configPath, logger: () => {}})
+  /** @type {RollbridgeDaemon | undefined} */
+  let recovered
+  const v1Path = await prepareRelease(fixture.root, "v1")
+  const v2Path = await prepareRelease(fixture.root, "v2")
+
+  try {
+    await retired.start()
+    await retired.deploy({releaseId: "v1", releasePath: v1Path, revision: "v1"})
+    await retired.deploy({releaseId: "v2", releasePath: v2Path, revision: "v2"})
+    const committed = retired.status()
+    const v1WorkerPid = releaseProcessPid(committed, "v1", "worker")
+    const retiredPids = [
+      ...(committed.releases.find(({releaseId}) => releaseId === "v2")?.processes.map(({pid}) => pid) || []),
+      ...committed.services.map(({process}) => process.pid),
+      ...committed.singletons.map(({process}) => process.pid)
+    ].filter((pid) => typeof pid === "number")
+
+    assert.equal(committed.activeReleaseId, "v2")
+    assert.equal(committed.generationTransition?.phase, "committed")
+    await retired.retireOwner({attestation: `sha256:${"a".repeat(64)}`})
+    await fs.writeFile(path.join(v2Path, "worker.fifo"), "drained\n")
+    await Promise.all(retiredPids.map((pid) => waitForProcessExit(pid, 3000)))
+
+    recovered = new RollbridgeDaemon({
+      bootstrap: {releaseId: "v2", releasePath: v2Path, revision: "v2"},
+      config,
+      configPath: fixture.configPath,
+      logger: () => {}
+    })
+    await recovered.start({exposeControl: false})
+    const recoveryOrder = /** @type {string[]} */ ([])
+    const recoveredCandidate = recovered.releases.get("v2")
+    const recoveredService = recovered.services.get("beacon")
+
+    assert.ok(recoveredCandidate && recoveredService && recovered.singletons.get("singleton"))
+    const activateGeneration = recoveredCandidate.activateGeneration.bind(recoveredCandidate)
+    const startService = recoveredService.start.bind(recoveredService)
+    const replaceSingletons = recovered.replaceSingletons.bind(recovered)
+
+    recoveredCandidate.activateGeneration = async () => {
+      recoveryOrder.push("activate")
+      await activateGeneration()
+    }
+    recoveredService.start = async (...args) => {
+      assert.equal(recovered?.generationTransition?.phase, "restoring_committed")
+      recoveryOrder.push("service")
+      await startService(...args)
+    }
+    recovered.replaceSingletons = async (...args) => {
+      recoveryOrder.push("singleton")
+      await replaceSingletons(...args)
+    }
+    await recovered.deploy({releaseId: "v2", releasePath: v2Path, revision: "v2"})
+    const active = recovered.status()
+
+    assert.equal(active.activeReleaseId, "v2")
+    assert.equal(active.generationTransition?.phase, "committed")
+    assert.equal(active.releases.find(({releaseId}) => releaseId === "v1")?.state, "draining")
+    assert.equal(releaseProcessPid(active, "v1", "worker"), v1WorkerPid)
+    assert.equal(isAlive(v1WorkerPid), true, "the retained previous generation must keep draining")
+    assert.equal(active.releases.find(({releaseId}) => releaseId === "v2")?.state, "active")
+    assert.ok(active.releases.find(({releaseId}) => releaseId === "v2")?.processes.every(({pid, state}) => typeof pid === "number" && state === "running"))
+    assert.ok(active.services.every(({process}) => typeof process.pid === "number" && process.state === "running"))
+    assert.ok(active.singletons.every(({process}) => typeof process.pid === "number" && process.state === "running"))
+    assert.deepEqual(recoveryOrder, ["service", "activate", "singleton"], "candidate activation must precede post-commit singleton completion")
+    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "retire:v1", "activate:v2", "retire:v2", "activate:v2"])
+  } finally {
+    if (recovered) {
+      const activeRecovery = recovered.status().activeReleaseId === "v2"
+      const shutdown = recovered.shutdown()
+
+      await fs.writeFile(path.join(v1Path, "worker.fifo"), "drained\n").catch(() => undefined)
+      if (activeRecovery) await fs.writeFile(path.join(v2Path, "worker.fifo"), "drained\n").catch(() => undefined)
+      await shutdown.catch(() => undefined)
+    }
+    retired.guardian?.disconnect()
+    await stopFixtureGuardian(fixture.statePath)
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("journaled committed bootstrap recovery resumes after a restart begins", async () => {
+  const fixture = await createFixture()
+  const config = normalizeConfig(fixture.config, fixture.configPath)
+  const retired = new RollbridgeDaemon({config, configPath: fixture.configPath, logger: () => {}})
+  /** @type {RollbridgeDaemon | undefined} */
+  let interrupted
+  /** @type {RollbridgeDaemon | undefined} */
+  let recovered
+  const v1Path = await prepareRelease(fixture.root, "v1")
+  const v2Path = await prepareRelease(fixture.root, "v2")
+
+  try {
+    await retired.start()
+    await retired.deploy({releaseId: "v1", releasePath: v1Path, revision: "v1"})
+    await retired.deploy({releaseId: "v2", releasePath: v2Path, revision: "v2"})
+    const committed = retired.status()
+    const v1WorkerPid = releaseProcessPid(committed, "v1", "worker")
+    const retiringPids = [
+      ...(committed.releases.find(({releaseId}) => releaseId === "v2")?.processes.map(({pid}) => pid) || []),
+      ...committed.services.map(({process}) => process.pid),
+      ...committed.singletons.map(({process}) => process.pid)
+    ].filter((pid) => typeof pid === "number")
+
+    await retired.retireOwner({attestation: `sha256:${"b".repeat(64)}`})
+    await fs.writeFile(path.join(v2Path, "worker.fifo"), "drained\n")
+    await Promise.all(retiringPids.map((pid) => waitForProcessExit(pid, 3000)))
+
+    const bootstrap = {releaseId: "v2", releasePath: v2Path, revision: "v2"}
+    interrupted = new RollbridgeDaemon({bootstrap, config, configPath: fixture.configPath, logger: () => {}})
+    await interrupted.start({exposeControl: false})
+    interrupted.assertCommittedBootstrapRecoveryReady()
+    await interrupted.updateGenerationTransition("restoring_committed")
+    const candidate = interrupted.releases.get("v2")
+
+    assert.ok(candidate)
+    for (const processInstance of interrupted.services.values()) await processInstance.start("deploy")
+    await candidate.restartCommittedGeneration()
+    await interrupted.checkpointGenerationTransition()
+    const restarted = interrupted.status()
+    const restartedCandidatePids = restarted.releases.find(({releaseId}) => releaseId === "v2")?.processes.map(({pid}) => pid)
+    const restartedServicePids = restarted.services.map(({process}) => process.pid)
+
+    assert.equal(restarted.generationTransition?.phase, "restoring_committed")
+    assert.ok(restartedCandidatePids?.every((pid) => typeof pid === "number"))
+    await interrupted.retireCommittedOwner(undefined)
+    interrupted.guardian?.disconnect()
+
+    recovered = new RollbridgeDaemon({bootstrap, config, configPath: fixture.configPath, logger: () => {}})
+    await recovered.start({exposeControl: false})
+    const active = recovered.status()
+
+    assert.equal(active.activeReleaseId, "v2")
+    assert.equal(active.generationTransition?.phase, "committed")
+    assert.deepEqual(active.releases.find(({releaseId}) => releaseId === "v2")?.processes.map(({pid}) => pid), restartedCandidatePids)
+    assert.deepEqual(active.services.map(({process}) => process.pid), restartedServicePids)
+    assert.ok(active.singletons.every(({process}) => typeof process.pid === "number" && process.state === "running"))
+    assert.equal(releaseProcessPid(active, "v1", "worker"), v1WorkerPid)
+    assert.equal(isAlive(v1WorkerPid), true)
+    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "retire:v1", "activate:v2", "retire:v2", "activate:v2"])
+  } finally {
+    if (recovered) {
+      const shutdown = recovered.shutdown()
+
+      await Promise.all([v1Path, v2Path].map((releasePath) => fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n").catch(() => undefined)))
+      await shutdown.catch(() => undefined)
+    }
+    interrupted?.guardian?.disconnect()
+    retired.guardian?.disconnect()
+    await stopFixtureGuardian(fixture.statePath)
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("committed bootstrap tuple mismatches fail closed without singletons", async () => {
+  const fixture = await createFixture()
+  fixture.config.processes = /** @type {Record<string, import("../src/json.js").JsonValue>[]} */ (fixture.config.processes)
+    .filter((processConfig) => processConfig.id !== "singleton")
+  await writeConfig(fixture.configPath, fixture.config)
+  const config = normalizeConfig(fixture.config, fixture.configPath)
+  const retired = new RollbridgeDaemon({config, configPath: fixture.configPath, logger: () => {}})
+  /** @type {RollbridgeDaemon | undefined} */
+  let recovered
+  const v1Path = await prepareRelease(fixture.root, "v1")
+  const v2Path = await prepareRelease(fixture.root, "v2")
+  const wrongPath = await prepareRelease(fixture.root, "wrong")
+
+  try {
+    await retired.start()
+    await retired.deploy({releaseId: "v1", releasePath: v1Path, revision: "v1"})
+    await retired.deploy({releaseId: "v2", releasePath: v2Path, revision: "v2"})
+    const committed = retired.status()
+    const v1WorkerPid = releaseProcessPid(committed, "v1", "worker")
+    const retiringPids = [
+      ...(committed.releases.find(({releaseId}) => releaseId === "v2")?.processes.map(({pid}) => pid) || []),
+      ...committed.services.map(({process}) => process.pid)
+    ].filter((pid) => typeof pid === "number")
+
+    await retired.retireOwner({attestation: `sha256:${"c".repeat(64)}`})
+    await fs.writeFile(path.join(v2Path, "worker.fifo"), "drained\n")
+    await Promise.all(retiringPids.map((pid) => waitForProcessExit(pid, 3000)))
+    recovered = new RollbridgeDaemon({
+      bootstrap: {releaseId: "v2", releasePath: v2Path, revision: "v2"},
+      config,
+      configPath: fixture.configPath,
+      logger: () => {}
+    })
+    await recovered.start({exposeControl: false})
+    const owner = recovered
+
+    await assert.rejects(
+      () => owner.deploy({releaseId: "v2", releasePath: wrongPath, revision: "v2"}),
+      /only the exact same release, path, revision, and config authority/u
+    )
+    await assert.rejects(
+      () => owner.deploy({releaseId: "v2", releasePath: v2Path, revision: "wrong"}),
+      /only the exact same release, path, revision, and config authority/u
+    )
+    const changedConfig = structuredClone(fixture.config)
+    const jobs = /** @type {Record<string, import("../src/json.js").JsonValue>[]} */ (changedConfig.processes)
+      .find((processConfig) => processConfig.id === "jobs")
+
+    assert.ok(jobs)
+    jobs.env = {.../** @type {Record<string, import("../src/json.js").JsonValue>} */ (jobs.env), MISMATCHED_AUTHORITY: "true"}
+    await writeConfig(fixture.configPath, changedConfig)
+    await assert.rejects(
+      () => owner.deploy({releaseId: "v2", releasePath: v2Path, revision: "v2"}),
+      /only the exact same release, path, revision, and config authority/u
+    )
+    await writeConfig(fixture.configPath, fixture.config)
+    await assert.rejects(
+      () => owner.deploy({releaseId: "wrong", releasePath: wrongPath, revision: "wrong"}),
+      /only the exact same release, path, revision, and config authority/u
+    )
+    const preserved = owner.status()
+
+    assert.equal(preserved.activeReleaseId, null)
+    assert.equal(preserved.generationTransition?.candidateReleaseId, "v2")
+    assert.equal(preserved.generationTransition?.phase, "committed")
+    assert.equal(preserved.releases.find(({releaseId}) => releaseId === "v2")?.state, "draining")
+    assert.equal(releaseProcessPid(preserved, "v1", "worker"), v1WorkerPid)
+    assert.equal(isAlive(v1WorkerPid), true)
+    assert.equal(preserved.releases.some(({releaseId}) => releaseId === "wrong"), false)
+
+    await owner.deploy({releaseId: "v2", releasePath: v2Path, revision: "v2"})
+    await Promise.all([
+      owner.stopRelease("v2"),
+      fs.writeFile(path.join(v2Path, "worker.fifo"), "drained\n")
+    ])
+    const afterIntentionalStop = await owner.deploy({releaseId: "wrong", releasePath: wrongPath, revision: "wrong"})
+
+    assert.equal(afterIntentionalStop.activeReleaseId, "wrong")
+    assert.equal(owner.status().activeReleaseId, "wrong")
+  } finally {
+    if (recovered) {
+      const activeReleaseId = recovered.status().activeReleaseId
+      const shutdown = recovered.shutdown()
+
+      await fs.writeFile(path.join(v1Path, "worker.fifo"), "drained\n").catch(() => undefined)
+      if (activeReleaseId === "v2") await fs.writeFile(path.join(v2Path, "worker.fifo"), "drained\n").catch(() => undefined)
+      if (activeReleaseId === "wrong") await fs.writeFile(path.join(wrongPath, "worker.fifo"), "drained\n").catch(() => undefined)
+      await shutdown.catch(() => undefined)
+    }
+    retired.guardian?.disconnect()
+    await stopFixtureGuardian(fixture.statePath)
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
 test("replacement owner reconstructs one active and two draining generations after abrupt daemon exit", async () => {
   const fixture = await createFixture()
   let owner = spawnDaemon(fixture.configPath)

package/test/owner-replacement.test.js

@@ -10,7 +10,7 @@ import path from "node:path"
 import test from "node:test"
 import {fileURLToPath} from "node:url"
 import {normalizeConfig} from "../src/config.js"
-import {sendControlCommand} from "../src/control-client.js"
+import {openControlSession, sendControlCommand} from "../src/control-client.js"
 import RollbridgeDaemon, {isLegacyGuardianPrepareDiagnostic} from "../src/daemon.js"
 import GuardianClient from "../src/guardian-client.js"
 import {findAvailablePort} from "../src/port-allocator.js"
@@ -1188,6 +1188,88 @@ test("owner replacement preserves committed generation metadata without firing l
   }
 })
 
+test("owner replacement excludes stopped retained releases from reserved process recovery", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-stopped-proof-"))
+  const oldSocketPath = path.join(root, "old.sock")
+  const newSocketPath = path.join(root, "new.sock")
+  const statePath = path.join(root, "state.json")
+  const configPath = path.join(root, "rollbridge.cjs")
+  const v1Path = path.join(root, "v1")
+  const v2Path = path.join(root, "v2")
+  let owner
+  let candidate
+
+  try {
+    await Promise.all([fs.mkdir(v1Path), fs.mkdir(v2Path)])
+    await Promise.all([makeFifo(path.join(v1Path, "worker.fifo")), makeFifo(path.join(v2Path, "worker.fifo"))])
+    await writeConfig(configPath, config({controlPath: oldSocketPath, extraCompanion: false, statePath}))
+    owner = spawn(process.execPath, [binPath, "daemon", "--config", configPath], {stdio: ["ignore", "pipe", "pipe"]})
+    await waitForLog(owner, "control socket listening")
+    await sendControlCommand({command: {command: "deploy", releaseId: "v1", releasePath: v1Path, revision: "v1"}, path: oldSocketPath})
+    const stopped = sendControlCommand({command: {command: "stop", releaseId: "v1"}, path: oldSocketPath})
+
+    await fs.writeFile(path.join(v1Path, "worker.fifo"), "drained\n")
+    await stopped
+    await sendControlCommand({command: {command: "deploy", releaseId: "v2", releasePath: v2Path, revision: "v2"}, path: oldSocketPath})
+    const before = await sendControlCommand({command: {command: "status"}, path: oldSocketPath})
+    const activeWorkerPid = releaseProcessPid(before, "v2", "worker")
+    const retained = /** @type {{releaseId: string, state: string}[]} */ (before.releases)
+
+    assert.equal(retained.find(({releaseId}) => releaseId === "v1")?.state, "stopped")
+    const persisted = JSON.parse(await fs.readFile(statePath, "utf8"))
+    const guardian = new GuardianClient(persisted.recovery.guardian)
+
+    await guardian.connect()
+    assert.ok((await guardian.inventory()).some(({key}) => key === "release:v1:worker"), "stopped release registration remains in authenticated guardian inventory")
+    guardian.disconnect()
+    await writeConfig(configPath, config({controlPath: newSocketPath, extraCompanion: true, statePath}))
+    candidate = spawn(process.execPath, [binPath, "daemon", "--config", configPath, "--replace-owner"], {stdio: ["ignore", "pipe", "pipe"]})
+    const output = await collectUntilExitOrLog(candidate, "owner replacement committed")
+
+    assert.equal(output.message, "owner replacement committed", output.output)
+    const recovered = await sendControlCommand({command: {command: "status"}, path: newSocketPath})
+
+    assert.equal(recovered.activeReleaseId, "v2")
+    assert.equal(releaseProcessPid(recovered, "v2", "worker"), activeWorkerPid)
+    assert.equal(/** @type {{releaseId: string}[]} */ (recovered.releases).some(({releaseId}) => releaseId === "v1"), false)
+    const shutdown = sendControlCommand({command: {command: "shutdown"}, path: newSocketPath})
+
+    await fs.writeFile(path.join(v2Path, "worker.fifo"), "drained\n")
+    await shutdown
+  } finally {
+    for (const child of [owner, candidate]) if (child && child.exitCode === null && child.signalCode === null) child.kill("SIGKILL")
+    await stopGuardian(statePath)
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
+test("pruned release connection completion closes the incumbent listener session", () => {
+  const daemon = new RollbridgeDaemon({
+    config: normalizeConfig(config({controlPath: "/unused/control.sock", extraCompanion: false, statePath: "/unused/state.json"})),
+    logger: () => {}
+  })
+  let closeCount = 0
+  const session = {close: () => { closeCount += 1 }}
+  const controlSession = /** @type {Awaited<ReturnType<typeof openControlSession>>} */ (session)
+
+  daemon.releases = /** @type {Map<string, import("../src/release-group.js").default>} */ (new Map([
+    ["active", /** @type {import("../src/release-group.js").default} */ ({hasTransferredConnections: () => false})]
+  ]))
+  daemon.incumbentListenerControl = controlSession
+  daemon.handleIncumbentListenerEvent({connections: {http: 0, websocket: 0}, event: "owner-connection-state", releaseId: "pruned"}, session)
+
+  assert.equal(closeCount, 1)
+  assert.equal(daemon.incumbentListenerControl, undefined)
+
+  daemon.incumbentListenerControl = controlSession
+  assert.throws(
+    () => daemon.handleIncumbentListenerEvent({connections: {http: 1, websocket: 0}, event: "owner-connection-state", releaseId: "pruned"}, session),
+    /unknown release pruned/
+  )
+  assert.equal(closeCount, 1)
+  assert.equal(daemon.incumbentListenerControl, session)
+})
+
 test("owner replacement preserves a failed generation transition without retrying its hook", async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-owner-replacement-failed-generation-"))
   const oldSocketPath = path.join(root, "old.sock")