rollbridge 0.1.46 → 0.1.48

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rollbridge",
-  "version": "0.1.46",
+  "version": "0.1.48",
   "description": "Zero-downtime process supervisor and local traffic switcher for deploy-managed apps.",
   "keywords": [
     "deploy",

package/src/daemon.js

@@ -25,7 +25,7 @@ const STATE_PERSIST_INTERVAL_MS = 5000
  * @typedef {{id: string, process: import("./managed-process.js").ManagedProcessStatus}} ProcessStatus
  * @typedef {{disruptive: true, mode: "legacy-first-upgrade", reason: string}} OwnerTransition
  * @typedef {"candidate_ready" | "retiring_previous" | "previous_retired" | "activating_candidate" | "restoring_previous" | "retiring_failed_candidate" | "degraded_active" | "committed_pending" | "committed" | "restoring_committed"} GenerationTransitionPhase
- * @typedef {{activationError?: string, activationLifecycle?: boolean, candidateReleaseId: string, candidateReleasePath: string, candidateRevision: string, compensationError?: string, configDigest: string, error?: string, journalRevision?: number, phase: GenerationTransitionPhase, previousReleaseId: string | null, startedAt: string, updatedAt: string}} GenerationTransition
+ * @typedef {{activationError?: string, activationLifecycle?: boolean, candidateReleaseId: string, candidateReleasePath: string, candidateRevision: string, compensationError?: string, configDigest: string, degradedIncumbent?: boolean, error?: string, journalRevision?: number, phase: GenerationTransitionPhase, previousReleaseId: string | null, startedAt: string, updatedAt: string}} GenerationTransition
  * @typedef {{activeReleaseId: string | null, application: string, bootstrap: BootstrapIdentity | undefined, control: import("./config.js").ControlConfig, daemonPid: number, daemonRuntime: import("./daemon-runtime.js").DaemonRuntimeIdentity | undefined, generationTransition?: GenerationTransition, ownerRecovery: {configDigest: string, ready: boolean} | undefined, ownerTransition?: OwnerTransition, orphans: {id: string, pid: number, releaseId: string | null}[], proxy: {host: string, port: number | undefined, upstreamHost: string}, releaseReferences: {releaseId: string, releasePath: string}[], releases: import("./release-group.js").ReleaseStatus[], services: ProcessStatus[], singletons: ProcessStatus[]}} DaemonStatus
  * @typedef {{configDigest: string, format: number, guardian: {pid?: number, socketPath: string, token: string}, reconnectGraceMs: number}} OwnerRecoveryMetadata
  * @typedef {DaemonStatus & {recovery: OwnerRecoveryMetadata, serviceReleaseIds?: Record<string, string>, singletonReleaseIds?: Record<string, string>}} OwnerRecoverySnapshot
@@ -1620,6 +1620,7 @@ export default class RollbridgeDaemon {
       candidateReleasePath: release.releasePath,
       candidateRevision: release.revision,
       configDigest: ownerConfigDigest(nextConfig),
+      degradedIncumbent: transition?.phase === "degraded_active",
       journalRevision: 0,
       phase: activationLifecycle ? "candidate_ready" : "activating_candidate",
       previousReleaseId: previousRelease?.releaseId ?? null,
@@ -1651,7 +1652,7 @@ export default class RollbridgeDaemon {
     let retirementFailure = activationLifecycle ? undefined : previousRelease?.retirementError
 
     if (transition.phase === "candidate_ready") {
-      if (previousRelease) await this.updateGenerationTransition("retiring_previous")
+      if (previousRelease && !transition.degradedIncumbent) await this.updateGenerationTransition("retiring_previous")
       else await this.updateGenerationTransition("previous_retired")
     }
 
@@ -1894,7 +1895,7 @@ export default class RollbridgeDaemon {
     if (transition.previousReleaseId !== identity.previousReleaseId) {
       throw new Error(`Generation transition previous release is ${transition.previousReleaseId}; refusing stale recovery for ${identity.previousReleaseId}`)
     }
-    if (transition.phase !== "activating_candidate" && transition.phase !== "restoring_previous" && transition.phase !== "retiring_failed_candidate" && transition.phase !== "degraded_active") {
+    if (transition.phase !== "activating_candidate" && transition.phase !== "retiring_previous" && transition.phase !== "restoring_previous" && transition.phase !== "retiring_failed_candidate" && transition.phase !== "degraded_active") {
       throw new Error(`Generation transition ${transition.candidateReleaseId} at ${transition.phase} is not a safe failed pre-commit transition`)
     }
     if (transition.phase === "degraded_active" && !identity.acceptRetiredIncumbent) {
@@ -1922,8 +1923,10 @@ export default class RollbridgeDaemon {
    * @returns {Promise<Record<string, JsonValue>>} Explicit degraded recovery result.
    */
   async acceptRetiredIncumbentTransition(transition) {
-    if (transition.phase !== "restoring_previous" && transition.phase !== "degraded_active") throw new Error(`Retired-incumbent recovery requires exactly restoring_previous; transition ${transition.candidateReleaseId} is at ${transition.phase}`)
-    if (!terminalRetirementFailure(transition.compensationError)) throw new Error("Retired-incumbent recovery requires a recorded restoration failure compatible with terminal retirement")
+    if (transition.phase !== "retiring_previous" && transition.phase !== "restoring_previous" && transition.phase !== "degraded_active") throw new Error(`Retired-incumbent recovery requires retiring_previous or restoring_previous; transition ${transition.candidateReleaseId} is at ${transition.phase}`)
+    const retirementFailure = transition.phase === "retiring_previous" ? transition.error : transition.compensationError
+
+    if (!terminalRetirementFailure(retirementFailure)) throw new Error("Retired-incumbent recovery requires a recorded restoration failure compatible with terminal retirement")
     if (!transition.previousReleaseId) throw new Error("Retired-incumbent recovery requires a retained previous release")
     const candidate = this.releases.get(transition.candidateReleaseId)
     const previous = this.releases.get(transition.previousReleaseId)
@@ -1957,6 +1960,7 @@ export default class RollbridgeDaemon {
 
     if (transition.phase === "degraded_active") return result
     const previousError = transition.error
+    const previousPhase = transition.phase
     const previousJournalRevision = transition.journalRevision
     const previousUpdatedAt = transition.updatedAt
 
@@ -1967,7 +1971,7 @@ export default class RollbridgeDaemon {
     try {
       await this.checkpointGenerationTransition()
     } catch (error) {
-      transition.phase = "restoring_previous"
+      transition.phase = previousPhase
       transition.error = previousError
       transition.journalRevision = previousJournalRevision
       transition.updatedAt = previousUpdatedAt
@@ -2961,7 +2965,8 @@ export function ownerReplacementTransitionAuthorityMatches(transfer, transition,
 function terminalRetirementFailure(failure) {
   return typeof failure === "string" && (
     /^Cannot activate .+ generation from retired$/iu.test(failure) ||
-    /^activate command exited non-zero with status \d+$/u.test(failure)
+    /^activate command exited non-zero with status \d+$/u.test(failure) ||
+    /^Release .+ retirement quiescence failed: quiet command exited non-zero with status \d+$/u.test(failure)
   )
 }
 

package/test/rollbridge.test.js

@@ -799,7 +799,7 @@ test("explicit recovery stops the exact failed candidate and fences degraded inc
     await assert.rejects(() => exactRecovery({previousReleaseId: "wrong-v1"}), /refusing stale recovery/i)
     await assert.rejects(() => exactRecovery({revision: "wrong-v2"}), /exact same release, path, revision, and config authority/i)
     transition.phase = "retiring_failed_candidate"
-    await assert.rejects(() => exactRecovery(), /exactly restoring_previous/i)
+    await assert.rejects(() => exactRecovery(), /requires retiring_previous or restoring_previous/i)
     transition.phase = "restoring_previous"
     const terminalFailure = transition.compensationError
 
@@ -826,6 +826,15 @@ test("explicit recovery stops the exact failed candidate and fences degraded inc
     const persisted = /** @type {{generationTransition?: import("../src/json.js").JsonValue} | undefined} */ (await readState(fixture.statePath))
 
     assert.equal(/** @type {{phase?: string} | undefined} */ (persisted?.generationTransition)?.phase, "degraded_active")
+
+    transition.phase = "retiring_previous"
+    transition.error = "Release v1 retirement quiescence failed: quiet command exited non-zero with status 1"
+    transition.compensationError = undefined
+    await daemon.checkpointGenerationTransition()
+    const legacyRecovery = await exactRecovery()
+
+    assert.equal(legacyRecovery.recoveryStatus, "retired_incumbent_accepted")
+    assert.equal(daemon.status().generationTransition?.phase, "degraded_active", "guarded recovery migrates a legacy terminal retirement fence")
     await assert.rejects(() => daemon.deploy({releaseId: "bad-v3", releasePath: fixture.root, revision: "bad-v3"}), /health check failed/i)
     assert.equal(daemon.status().generationTransition?.phase, "degraded_active")
     assert.equal(statusRelease(daemon, "v1").processes.find(({id}) => id === "web")?.pid, incumbentWebPid)
@@ -834,7 +843,7 @@ test("explicit recovery stops the exact failed candidate and fences degraded inc
     assert.equal(daemon.status().activeReleaseId, "v3")
     assert.equal(daemon.status().generationTransition?.phase, "committed")
     assert.equal(await fetchText(daemon, "/release"), "v3")
-    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "retire:v1", "retire:v2", "retire:bad-v3", "retire:v1", "activate:v3"])
+    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "retire:v1", "retire:v2", "retire:bad-v3", "activate:v3"], "fresh deployment must not re-retire a degraded incumbent generation")
   } finally {
     await daemon.shutdown()
     await fs.rm(fixture.root, {force: true, recursive: true})