rollbridge 0.1.38 → 0.1.39

package/docs/cli.md

@@ -64,6 +64,16 @@ identity. Rollbridge does not calculate or interpret the digest.
 With no release options, daemon behavior is unchanged: it starts listener-only
 and waits for control-socket deployments.
 
+If an external owner retirement has already journaled a committed generation but
+cleared its active role, only a foreground bootstrap with that exact release id,
+path, revision, and config authority may restore it. Rollbridge waits for the
+retiring candidate processes to stop, journals `restoring_committed`, reconnects
+their existing guardian registrations, restarts that candidate, health-checks it,
+and restores its generation activation before completing singletons and exposing
+control. A later exact bootstrap resumes the journaled restart without duplicating
+processes. A mismatched tuple or a candidate that is still retiring fails closed
+without stopping other retained generations.
+
 `--takeover-owner` requires the complete bootstrap tuple. It bootstraps and
 health-checks the replacement before sending the current daemon the private
 retirement command. The current `performOwnerRetirement` path quiesces every

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rollbridge",
-  "version": "0.1.38",
+  "version": "0.1.39",
   "description": "Zero-downtime process supervisor and local traffic switcher for deploy-managed apps.",
   "keywords": [
     "deploy",

package/src/cli.js

@@ -102,8 +102,13 @@ export async function runCli(argv) {
 
           daemon.logger("bootstrap activation failed", {releaseId: bootstrap.releaseId, status: "error", ...errorLogData(failure)})
 
-          if (config.ownerRecovery && daemon.activeRelease) {
-            await daemon.exposeControl()
+          if (config.ownerRecovery && daemon.releases.size > 0) {
+            if (daemon.activeRelease) {
+              await daemon.exposeControl()
+              return
+            }
+            await daemon.abandonOwnerRecoveryAttempt()
+            process.exitCode = 1
             return
           }
 

package/src/daemon.js

@@ -23,7 +23,7 @@ const STATE_PERSIST_INTERVAL_MS = 5000
  * @typedef {{attestation?: string, releaseId: string, releasePath: string, revision: string}} BootstrapIdentity
  * @typedef {{id: string, process: import("./managed-process.js").ManagedProcessStatus}} ProcessStatus
  * @typedef {{disruptive: true, mode: "legacy-first-upgrade", reason: string}} OwnerTransition
- * @typedef {"candidate_ready" | "retiring_previous" | "previous_retired" | "activating_candidate" | "committed_pending" | "committed"} GenerationTransitionPhase
+ * @typedef {"candidate_ready" | "retiring_previous" | "previous_retired" | "activating_candidate" | "committed_pending" | "committed" | "restoring_committed"} GenerationTransitionPhase
  * @typedef {{candidateReleaseId: string, candidateReleasePath: string, candidateRevision: string, configDigest: string, error?: string, phase: GenerationTransitionPhase, previousReleaseId: string | null, startedAt: string, updatedAt: string}} GenerationTransition
  * @typedef {{activeReleaseId: string | null, application: string, bootstrap: BootstrapIdentity | undefined, control: import("./config.js").ControlConfig, daemonPid: number, daemonRuntime: import("./daemon-runtime.js").DaemonRuntimeIdentity | undefined, generationTransition?: GenerationTransition, ownerRecovery: {configDigest: string} | undefined, ownerTransition?: OwnerTransition, orphans: {id: string, pid: number, releaseId: string | null}[], proxy: {host: string, port: number | undefined, upstreamHost: string}, releaseReferences: {releaseId: string, releasePath: string}[], releases: import("./release-group.js").ReleaseStatus[], services: ProcessStatus[], singletons: ProcessStatus[]}} DaemonStatus
  * @typedef {{configDigest: string, format: number, guardian: {pid?: number, socketPath: string, token: string}, reconnectGraceMs: number}} OwnerRecoveryMetadata
@@ -228,7 +228,7 @@ export default class RollbridgeDaemon {
     }
     this.generationTransition = snapshot.generationTransition ? {...snapshot.generationTransition} : undefined
     if (snapshot.activeReleaseId === null && snapshot.releases.length === 0) return
-    this.bootstrap = snapshot.bootstrap ? {...snapshot.bootstrap} : undefined
+    if (!this.bootstrap) this.bootstrap = snapshot.bootstrap ? {...snapshot.bootstrap} : undefined
     this.ownerTransition = snapshot.ownerTransition ? {...snapshot.ownerTransition} : undefined
     const singletonOwnerReleaseIds = new Set(Object.values(singletonReleaseIds))
 
@@ -255,9 +255,10 @@ export default class RollbridgeDaemon {
     }
 
     if (snapshot.activeReleaseId !== null && !this.activeRelease) throw new Error(`Owner recovery state does not contain active release ${snapshot.activeReleaseId}.`)
-    const definitionRelease = this.activeRelease || [...this.releases.values()].at(-1)
+    const committedBootstrapRelease = this.committedBootstrapRelease()
+    const definitionRelease = this.activeRelease || committedBootstrapRelease || [...this.releases.values()].at(-1)
     if (!definitionRelease) throw new Error("Owner recovery state has no release definition for owned processes.")
-    if (!this.activeRelease && snapshot.singletons.length > 0) throw new Error("Owner recovery state has release-owned singletons without an active release identity.")
+    if (!this.activeRelease && !committedBootstrapRelease && snapshot.singletons.length > 0) throw new Error("Owner recovery state has release-owned singletons without an active release identity.")
     for (const serviceStatus of snapshot.services) {
       const processConfig = config.processes.find((candidate) => candidate.id === serviceStatus.id && candidate.policy === "service" && candidate.deployStrategy !== "handoff")
 
@@ -1242,6 +1243,13 @@ export default class RollbridgeDaemon {
       this.assertExactGenerationTransition(transition, {config: nextConfig, releaseId: newReleaseId, releasePath, revision: revision || newReleaseId})
       return {activeReleaseId: newReleaseId, previousReleaseId: transition.previousReleaseId}
     }
+    if (transition?.phase === "committed" && !this.activeRelease && this.bootstrap && this.releases.get(transition.candidateReleaseId)?.state === "draining") {
+      this.assertExactGenerationTransition(transition, {config: nextConfig, releaseId: newReleaseId, releasePath, revision: revision || newReleaseId})
+      this.assertCommittedBootstrapRecoveryReady()
+      this.config = nextConfig
+      await this.updateGenerationTransition("restoring_committed")
+      return await this.resumeGenerationTransition()
+    }
     const release = new ReleaseGroup({
       config: nextConfig,
       logger: this.logger,
@@ -1387,6 +1395,16 @@ export default class RollbridgeDaemon {
       this.logger("traffic switched", {previousReleaseId: previousRelease?.releaseId ?? null, releaseId: release.releaseId})
     }
 
+    if (transition.phase === "restoring_committed") {
+      await this.resumeCommittedBootstrapGeneration(release)
+      release.activate()
+      this.activeRelease = release
+      transition.phase = "committed_pending"
+      transition.error = undefined
+      transition.updatedAt = new Date().toISOString()
+      this.logger("committed bootstrap generation restored", {releaseId: release.releaseId})
+    }
+
     if (transition.phase === "committed_pending") {
       await this.checkpointGenerationTransition()
       this.refreshServiceDefinitions(release)
@@ -1420,6 +1438,82 @@ export default class RollbridgeDaemon {
     }
   }
 
+  /**
+   * Returns the retained candidate only when the foreground bootstrap exactly proves the
+   * committed transition that an external owner retirement left without an active role.
+   * @returns {ReleaseGroup | undefined} Exact committed bootstrap candidate.
+   */
+  committedBootstrapRelease() {
+    const bootstrap = this.bootstrap
+    const transition = this.generationTransition
+
+    if (!bootstrap || !transition || (transition.phase !== "committed" && transition.phase !== "restoring_committed") || transition.candidateReleaseId !== bootstrap.releaseId || transition.candidateReleasePath !== bootstrap.releasePath || transition.candidateRevision !== bootstrap.revision || transition.configDigest !== ownerConfigDigest(this.config)) return undefined
+    const release = this.releases.get(bootstrap.releaseId)
+
+    if (!release || release.releasePath !== bootstrap.releasePath || release.revision !== bootstrap.revision) return undefined
+    return release
+  }
+
+  /**
+   * Fails closed before journaling recovery unless external retirement has fully stopped
+   * the exact candidate and daemon-owned processes.
+   * @returns {void}
+   */
+  assertCommittedBootstrapRecoveryReady() {
+    const release = this.committedBootstrapRelease()
+
+    if (!release) throw new Error("Committed generation has no exact foreground bootstrap recovery proof")
+    release.assertCommittedGenerationStopped()
+    const ownedProcesses = [
+      ...this.services.values(),
+      ...this.singletons.values()
+    ]
+    const stillRetiring = ownedProcesses.find((processInstance) => {
+      const {pid, state} = processInstance.status()
+      return pid !== undefined || (state !== "stopped" && state !== "failed")
+    })
+
+    if (stillRetiring) throw new Error(`Committed generation daemon process ${stillRetiring.id} is still retiring; exact bootstrap recovery will retry after it stops`)
+    for (const [singletonId, singletonReleaseId] of this.singletonReleaseIds) {
+      if (singletonReleaseId !== release.releaseId) throw new Error(`Committed generation singleton ${singletonId} belongs to retained release ${singletonReleaseId}`)
+    }
+  }
+
+  /**
+   * Resumes a durably journaled committed-candidate restart. Running processes are
+   * necessarily owned by this exact recovery phase; stopped processes are restarted.
+   * Singleton completion remains in the established committed_pending phase.
+   * @param {ReleaseGroup} release - Exact committed candidate.
+   * @returns {Promise<void>}
+   */
+  async resumeCommittedBootstrapGeneration(release) {
+    if (this.generationTransition?.phase !== "restoring_committed" || release !== this.committedBootstrapRelease()) {
+      throw new Error("Committed bootstrap recovery is not durably journaled for this exact candidate")
+    }
+    const resumableStates = new Set(["failed", "running", "stopped"])
+    const invalidProcess = [...this.services.values(), ...this.singletons.values()].find((processInstance) => {
+      const {pid, state} = processInstance.status()
+      return !resumableStates.has(state) || (state === "running") !== (pid !== undefined)
+    })
+
+    if (invalidProcess) throw new Error(`Committed bootstrap recovery found daemon process ${invalidProcess.id} outside its journaled restart states`)
+    release.assertCommittedGenerationRecoverable()
+
+    try {
+      for (const processInstance of this.services.values()) {
+        await processInstance.start("deploy")
+      }
+      await release.restartCommittedGeneration()
+      await release.activateGeneration()
+    } catch (error) {
+      await Promise.allSettled([
+        release.abortCommittedGenerationRestart(),
+        ...[...this.services.values()].map((processInstance) => processInstance.stop())
+      ])
+      throw error
+    }
+  }
+
   /** @param {GenerationTransitionPhase} phase - Durable phase to enter. */
   async updateGenerationTransition(phase) {
     if (!this.generationTransition) throw new Error("No release generation transition to update")
@@ -1455,6 +1549,7 @@ export default class RollbridgeDaemon {
   shouldResumeDrain(release) {
     const transition = this.generationTransition
 
+    if (release === this.committedBootstrapRelease()) return false
     return !transition || transition.phase === "committed_pending" || transition.phase === "committed" || transition.previousReleaseId !== release.releaseId
   }
 

package/src/release-group.js

@@ -276,6 +276,61 @@ export default class ReleaseGroup extends EventEmitter {
     await instance.process.activateStrict()
   }
 
+  /**
+   * Restarts only the exact processes reconstructed for a committed generation.
+   * The caller must prove the durable transition identity before using this path.
+   */
+  async restartCommittedGeneration() {
+    this.assertCommittedGenerationRecoverable()
+    this.state = "starting"
+    try {
+      for (const processConfig of this.releaseProcessStartOrder()) {
+        const instances = this.getProcesses(processConfig.id)
+
+        if (instances.length !== processConfig.replicas) throw new Error(`Committed generation ${this.releaseId} is missing process ${processConfig.id}`)
+        for (const {process} of instances) await process.start("deploy", processConfig.lifecycle.activateCommand ? "candidate" : undefined)
+
+        if (processConfig.policy === "proxied" && processConfig.port && processConfig.health) {
+          await waitForHealth({
+            health: processConfig.health,
+            host: this.config.proxy.upstreamHost,
+            port: this.ports[processConfig.id]
+          })
+        }
+      }
+    } catch (error) {
+      await this.abortCommittedGenerationRestart()
+      throw error
+    }
+  }
+
+  /** Fails closed unless every exact candidate process has finished external retirement. */
+  assertCommittedGenerationStopped() {
+    if (this.state !== "draining") throw new Error(`Committed generation ${this.releaseId} is not retained as draining`)
+    const statuses = [...this.processes.values()].map((processInstance) => processInstance.status())
+
+    if (statuses.some(({pid, state}) => pid !== undefined || (state !== "stopped" && state !== "failed"))) {
+      throw new Error(`Committed generation ${this.releaseId} is still retiring; exact bootstrap recovery will retry after its processes stop`)
+    }
+  }
+
+  /** Accepts only process states produced after the exact recovery phase was journaled. */
+  assertCommittedGenerationRecoverable() {
+    if (this.state !== "draining" && this.state !== "starting") throw new Error(`Committed generation ${this.releaseId} is not retained in its journaled recovery state`)
+    const statuses = [...this.processes.values()].map((processInstance) => processInstance.status())
+    const resumableStates = new Set(["failed", "running", "stopped"])
+
+    if (statuses.some(({pid, state}) => !resumableStates.has(state) || (state === "running") !== (pid !== undefined))) {
+      throw new Error(`Committed generation ${this.releaseId} has a process outside its journaled restart states`)
+    }
+  }
+
+  /** Stops only a failed committed-bootstrap restart while retaining its exact identity. */
+  async abortCommittedGenerationRestart() {
+    await Promise.allSettled([...this.processes.values()].map((processInstance) => processInstance.stop()))
+    this.state = "draining"
+  }
+
   /** @returns {Promise<void>} Allocates all configured per-process ports. */
   async allocatePorts() {
     if (this.portsAllocated) return

package/test/owner-recovery.test.js

@@ -95,6 +95,259 @@ test("external owner retirement releases guardian authority without losing its g
   }
 })
 
+test("exact bootstrap restores the committed generation after external owner retirement", async () => {
+  const fixture = await createFixture()
+  const config = normalizeConfig(fixture.config, fixture.configPath)
+  const retired = new RollbridgeDaemon({config, configPath: fixture.configPath, logger: () => {}})
+  /** @type {RollbridgeDaemon | undefined} */
+  let recovered
+  const v1Path = await prepareRelease(fixture.root, "v1")
+  const v2Path = await prepareRelease(fixture.root, "v2")
+
+  try {
+    await retired.start()
+    await retired.deploy({releaseId: "v1", releasePath: v1Path, revision: "v1"})
+    await retired.deploy({releaseId: "v2", releasePath: v2Path, revision: "v2"})
+    const committed = retired.status()
+    const v1WorkerPid = releaseProcessPid(committed, "v1", "worker")
+    const retiredPids = [
+      ...(committed.releases.find(({releaseId}) => releaseId === "v2")?.processes.map(({pid}) => pid) || []),
+      ...committed.services.map(({process}) => process.pid),
+      ...committed.singletons.map(({process}) => process.pid)
+    ].filter((pid) => typeof pid === "number")
+
+    assert.equal(committed.activeReleaseId, "v2")
+    assert.equal(committed.generationTransition?.phase, "committed")
+    await retired.retireOwner({attestation: `sha256:${"a".repeat(64)}`})
+    await fs.writeFile(path.join(v2Path, "worker.fifo"), "drained\n")
+    await Promise.all(retiredPids.map((pid) => waitForProcessExit(pid, 3000)))
+
+    recovered = new RollbridgeDaemon({
+      bootstrap: {releaseId: "v2", releasePath: v2Path, revision: "v2"},
+      config,
+      configPath: fixture.configPath,
+      logger: () => {}
+    })
+    await recovered.start({exposeControl: false})
+    const recoveryOrder = /** @type {string[]} */ ([])
+    const recoveredCandidate = recovered.releases.get("v2")
+    const recoveredService = recovered.services.get("beacon")
+
+    assert.ok(recoveredCandidate && recoveredService && recovered.singletons.get("singleton"))
+    const activateGeneration = recoveredCandidate.activateGeneration.bind(recoveredCandidate)
+    const startService = recoveredService.start.bind(recoveredService)
+    const replaceSingletons = recovered.replaceSingletons.bind(recovered)
+
+    recoveredCandidate.activateGeneration = async () => {
+      recoveryOrder.push("activate")
+      await activateGeneration()
+    }
+    recoveredService.start = async (...args) => {
+      assert.equal(recovered?.generationTransition?.phase, "restoring_committed")
+      recoveryOrder.push("service")
+      await startService(...args)
+    }
+    recovered.replaceSingletons = async (...args) => {
+      recoveryOrder.push("singleton")
+      await replaceSingletons(...args)
+    }
+    await recovered.deploy({releaseId: "v2", releasePath: v2Path, revision: "v2"})
+    const active = recovered.status()
+
+    assert.equal(active.activeReleaseId, "v2")
+    assert.equal(active.generationTransition?.phase, "committed")
+    assert.equal(active.releases.find(({releaseId}) => releaseId === "v1")?.state, "draining")
+    assert.equal(releaseProcessPid(active, "v1", "worker"), v1WorkerPid)
+    assert.equal(isAlive(v1WorkerPid), true, "the retained previous generation must keep draining")
+    assert.equal(active.releases.find(({releaseId}) => releaseId === "v2")?.state, "active")
+    assert.ok(active.releases.find(({releaseId}) => releaseId === "v2")?.processes.every(({pid, state}) => typeof pid === "number" && state === "running"))
+    assert.ok(active.services.every(({process}) => typeof process.pid === "number" && process.state === "running"))
+    assert.ok(active.singletons.every(({process}) => typeof process.pid === "number" && process.state === "running"))
+    assert.deepEqual(recoveryOrder, ["service", "activate", "singleton"], "candidate activation must precede post-commit singleton completion")
+    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "retire:v1", "activate:v2", "retire:v2", "activate:v2"])
+  } finally {
+    if (recovered) {
+      const activeRecovery = recovered.status().activeReleaseId === "v2"
+      const shutdown = recovered.shutdown()
+
+      await fs.writeFile(path.join(v1Path, "worker.fifo"), "drained\n").catch(() => undefined)
+      if (activeRecovery) await fs.writeFile(path.join(v2Path, "worker.fifo"), "drained\n").catch(() => undefined)
+      await shutdown.catch(() => undefined)
+    }
+    retired.guardian?.disconnect()
+    await stopFixtureGuardian(fixture.statePath)
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("journaled committed bootstrap recovery resumes after a restart begins", async () => {
+  const fixture = await createFixture()
+  const config = normalizeConfig(fixture.config, fixture.configPath)
+  const retired = new RollbridgeDaemon({config, configPath: fixture.configPath, logger: () => {}})
+  /** @type {RollbridgeDaemon | undefined} */
+  let interrupted
+  /** @type {RollbridgeDaemon | undefined} */
+  let recovered
+  const v1Path = await prepareRelease(fixture.root, "v1")
+  const v2Path = await prepareRelease(fixture.root, "v2")
+
+  try {
+    await retired.start()
+    await retired.deploy({releaseId: "v1", releasePath: v1Path, revision: "v1"})
+    await retired.deploy({releaseId: "v2", releasePath: v2Path, revision: "v2"})
+    const committed = retired.status()
+    const v1WorkerPid = releaseProcessPid(committed, "v1", "worker")
+    const retiringPids = [
+      ...(committed.releases.find(({releaseId}) => releaseId === "v2")?.processes.map(({pid}) => pid) || []),
+      ...committed.services.map(({process}) => process.pid),
+      ...committed.singletons.map(({process}) => process.pid)
+    ].filter((pid) => typeof pid === "number")
+
+    await retired.retireOwner({attestation: `sha256:${"b".repeat(64)}`})
+    await fs.writeFile(path.join(v2Path, "worker.fifo"), "drained\n")
+    await Promise.all(retiringPids.map((pid) => waitForProcessExit(pid, 3000)))
+
+    const bootstrap = {releaseId: "v2", releasePath: v2Path, revision: "v2"}
+    interrupted = new RollbridgeDaemon({bootstrap, config, configPath: fixture.configPath, logger: () => {}})
+    await interrupted.start({exposeControl: false})
+    interrupted.assertCommittedBootstrapRecoveryReady()
+    await interrupted.updateGenerationTransition("restoring_committed")
+    const candidate = interrupted.releases.get("v2")
+
+    assert.ok(candidate)
+    for (const processInstance of interrupted.services.values()) await processInstance.start("deploy")
+    await candidate.restartCommittedGeneration()
+    await interrupted.checkpointGenerationTransition()
+    const restarted = interrupted.status()
+    const restartedCandidatePids = restarted.releases.find(({releaseId}) => releaseId === "v2")?.processes.map(({pid}) => pid)
+    const restartedServicePids = restarted.services.map(({process}) => process.pid)
+
+    assert.equal(restarted.generationTransition?.phase, "restoring_committed")
+    assert.ok(restartedCandidatePids?.every((pid) => typeof pid === "number"))
+    await interrupted.retireCommittedOwner(undefined)
+    interrupted.guardian?.disconnect()
+
+    recovered = new RollbridgeDaemon({bootstrap, config, configPath: fixture.configPath, logger: () => {}})
+    await recovered.start({exposeControl: false})
+    const active = recovered.status()
+
+    assert.equal(active.activeReleaseId, "v2")
+    assert.equal(active.generationTransition?.phase, "committed")
+    assert.deepEqual(active.releases.find(({releaseId}) => releaseId === "v2")?.processes.map(({pid}) => pid), restartedCandidatePids)
+    assert.deepEqual(active.services.map(({process}) => process.pid), restartedServicePids)
+    assert.ok(active.singletons.every(({process}) => typeof process.pid === "number" && process.state === "running"))
+    assert.equal(releaseProcessPid(active, "v1", "worker"), v1WorkerPid)
+    assert.equal(isAlive(v1WorkerPid), true)
+    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "retire:v1", "activate:v2", "retire:v2", "activate:v2"])
+  } finally {
+    if (recovered) {
+      const shutdown = recovered.shutdown()
+
+      await Promise.all([v1Path, v2Path].map((releasePath) => fs.writeFile(path.join(releasePath, "worker.fifo"), "drained\n").catch(() => undefined)))
+      await shutdown.catch(() => undefined)
+    }
+    interrupted?.guardian?.disconnect()
+    retired.guardian?.disconnect()
+    await stopFixtureGuardian(fixture.statePath)
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
+test("committed bootstrap tuple mismatches fail closed without singletons", async () => {
+  const fixture = await createFixture()
+  fixture.config.processes = /** @type {Record<string, import("../src/json.js").JsonValue>[]} */ (fixture.config.processes)
+    .filter((processConfig) => processConfig.id !== "singleton")
+  await writeConfig(fixture.configPath, fixture.config)
+  const config = normalizeConfig(fixture.config, fixture.configPath)
+  const retired = new RollbridgeDaemon({config, configPath: fixture.configPath, logger: () => {}})
+  /** @type {RollbridgeDaemon | undefined} */
+  let recovered
+  const v1Path = await prepareRelease(fixture.root, "v1")
+  const v2Path = await prepareRelease(fixture.root, "v2")
+  const wrongPath = await prepareRelease(fixture.root, "wrong")
+
+  try {
+    await retired.start()
+    await retired.deploy({releaseId: "v1", releasePath: v1Path, revision: "v1"})
+    await retired.deploy({releaseId: "v2", releasePath: v2Path, revision: "v2"})
+    const committed = retired.status()
+    const v1WorkerPid = releaseProcessPid(committed, "v1", "worker")
+    const retiringPids = [
+      ...(committed.releases.find(({releaseId}) => releaseId === "v2")?.processes.map(({pid}) => pid) || []),
+      ...committed.services.map(({process}) => process.pid)
+    ].filter((pid) => typeof pid === "number")
+
+    await retired.retireOwner({attestation: `sha256:${"c".repeat(64)}`})
+    await fs.writeFile(path.join(v2Path, "worker.fifo"), "drained\n")
+    await Promise.all(retiringPids.map((pid) => waitForProcessExit(pid, 3000)))
+    recovered = new RollbridgeDaemon({
+      bootstrap: {releaseId: "v2", releasePath: v2Path, revision: "v2"},
+      config,
+      configPath: fixture.configPath,
+      logger: () => {}
+    })
+    await recovered.start({exposeControl: false})
+    const owner = recovered
+
+    await assert.rejects(
+      () => owner.deploy({releaseId: "v2", releasePath: wrongPath, revision: "v2"}),
+      /only the exact same release, path, revision, and config authority/u
+    )
+    await assert.rejects(
+      () => owner.deploy({releaseId: "v2", releasePath: v2Path, revision: "wrong"}),
+      /only the exact same release, path, revision, and config authority/u
+    )
+    const changedConfig = structuredClone(fixture.config)
+    const jobs = /** @type {Record<string, import("../src/json.js").JsonValue>[]} */ (changedConfig.processes)
+      .find((processConfig) => processConfig.id === "jobs")
+
+    assert.ok(jobs)
+    jobs.env = {.../** @type {Record<string, import("../src/json.js").JsonValue>} */ (jobs.env), MISMATCHED_AUTHORITY: "true"}
+    await writeConfig(fixture.configPath, changedConfig)
+    await assert.rejects(
+      () => owner.deploy({releaseId: "v2", releasePath: v2Path, revision: "v2"}),
+      /only the exact same release, path, revision, and config authority/u
+    )
+    await writeConfig(fixture.configPath, fixture.config)
+    await assert.rejects(
+      () => owner.deploy({releaseId: "wrong", releasePath: wrongPath, revision: "wrong"}),
+      /only the exact same release, path, revision, and config authority/u
+    )
+    const preserved = owner.status()
+
+    assert.equal(preserved.activeReleaseId, null)
+    assert.equal(preserved.generationTransition?.candidateReleaseId, "v2")
+    assert.equal(preserved.generationTransition?.phase, "committed")
+    assert.equal(preserved.releases.find(({releaseId}) => releaseId === "v2")?.state, "draining")
+    assert.equal(releaseProcessPid(preserved, "v1", "worker"), v1WorkerPid)
+    assert.equal(isAlive(v1WorkerPid), true)
+    assert.equal(preserved.releases.some(({releaseId}) => releaseId === "wrong"), false)
+
+    await owner.deploy({releaseId: "v2", releasePath: v2Path, revision: "v2"})
+    await Promise.all([
+      owner.stopRelease("v2"),
+      fs.writeFile(path.join(v2Path, "worker.fifo"), "drained\n")
+    ])
+    const afterIntentionalStop = await owner.deploy({releaseId: "wrong", releasePath: wrongPath, revision: "wrong"})
+
+    assert.equal(afterIntentionalStop.activeReleaseId, "wrong")
+    assert.equal(owner.status().activeReleaseId, "wrong")
+  } finally {
+    if (recovered) {
+      const activeReleaseId = recovered.status().activeReleaseId
+      const shutdown = recovered.shutdown()
+
+      await fs.writeFile(path.join(v1Path, "worker.fifo"), "drained\n").catch(() => undefined)
+      if (activeReleaseId === "v2") await fs.writeFile(path.join(v2Path, "worker.fifo"), "drained\n").catch(() => undefined)
+      if (activeReleaseId === "wrong") await fs.writeFile(path.join(wrongPath, "worker.fifo"), "drained\n").catch(() => undefined)
+      await shutdown.catch(() => undefined)
+    }
+    retired.guardian?.disconnect()
+    await stopFixtureGuardian(fixture.statePath)
+    await fs.rm(fixture.root, {force: true, recursive: true})
+  }
+})
+
 test("replacement owner reconstructs one active and two draining generations after abrupt daemon exit", async () => {
   const fixture = await createFixture()
   let owner = spawnDaemon(fixture.configPath)