rollbridge 0.1.47 → 0.1.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rollbridge",
-  "version": "0.1.47",
+  "version": "0.1.49",
   "description": "Zero-downtime process supervisor and local traffic switcher for deploy-managed apps.",
   "keywords": [
     "deploy",

package/src/daemon.js

@@ -1895,7 +1895,7 @@ export default class RollbridgeDaemon {
     if (transition.previousReleaseId !== identity.previousReleaseId) {
       throw new Error(`Generation transition previous release is ${transition.previousReleaseId}; refusing stale recovery for ${identity.previousReleaseId}`)
     }
-    if (transition.phase !== "activating_candidate" && transition.phase !== "restoring_previous" && transition.phase !== "retiring_failed_candidate" && transition.phase !== "degraded_active") {
+    if (transition.phase !== "activating_candidate" && transition.phase !== "retiring_previous" && transition.phase !== "restoring_previous" && transition.phase !== "retiring_failed_candidate" && transition.phase !== "degraded_active") {
       throw new Error(`Generation transition ${transition.candidateReleaseId} at ${transition.phase} is not a safe failed pre-commit transition`)
     }
     if (transition.phase === "degraded_active" && !identity.acceptRetiredIncumbent) {
@@ -1923,8 +1923,10 @@ export default class RollbridgeDaemon {
    * @returns {Promise<Record<string, JsonValue>>} Explicit degraded recovery result.
    */
   async acceptRetiredIncumbentTransition(transition) {
-    if (transition.phase !== "restoring_previous" && transition.phase !== "degraded_active") throw new Error(`Retired-incumbent recovery requires exactly restoring_previous; transition ${transition.candidateReleaseId} is at ${transition.phase}`)
-    if (!terminalRetirementFailure(transition.compensationError)) throw new Error("Retired-incumbent recovery requires a recorded restoration failure compatible with terminal retirement")
+    if (transition.phase !== "retiring_previous" && transition.phase !== "restoring_previous" && transition.phase !== "degraded_active") throw new Error(`Retired-incumbent recovery requires retiring_previous or restoring_previous; transition ${transition.candidateReleaseId} is at ${transition.phase}`)
+    const retirementFailure = transition.phase === "retiring_previous" ? transition.error : transition.compensationError
+
+    if (!terminalRetirementFailure(retirementFailure)) throw new Error("Retired-incumbent recovery requires a recorded restoration failure compatible with terminal retirement")
     if (!transition.previousReleaseId) throw new Error("Retired-incumbent recovery requires a retained previous release")
     const candidate = this.releases.get(transition.candidateReleaseId)
     const previous = this.releases.get(transition.previousReleaseId)
@@ -1934,7 +1936,9 @@ export default class RollbridgeDaemon {
     if (candidate.releasePath !== transition.candidateReleasePath || candidate.revision !== transition.candidateRevision || ownerConfigDigest(candidate.config) !== transition.configDigest) {
       throw new Error(`Generation transition candidate ${candidate.releaseId} does not retain its exact path, revision, and config authority`)
     }
-    if (candidate.state !== "draining" && candidate.state !== "stopped") throw new Error(`Failed candidate ${candidate.releaseId} must be retired before accepting a retired incumbent`)
+    const recoverableCandidateStates = transition.phase === "retiring_previous" ? ["starting", "draining", "stopped"] : ["draining", "stopped"]
+
+    if (!recoverableCandidateStates.includes(candidate.state)) throw new Error(`Failed candidate ${candidate.releaseId} must be retiring or retired before accepting a retired incumbent`)
     if (this.activeRelease !== previous) throw new Error(`Previous release ${previous.releaseId} is not the authoritative proxy target`)
     const activationConfig = previous.config.processes.find((processConfig) => processConfig.lifecycle.activateCommand !== undefined)
     const coordinator = activationConfig ? previous.getProcesses(activationConfig.id)[0]?.process : undefined
@@ -1958,6 +1962,7 @@ export default class RollbridgeDaemon {
 
     if (transition.phase === "degraded_active") return result
     const previousError = transition.error
+    const previousPhase = transition.phase
     const previousJournalRevision = transition.journalRevision
     const previousUpdatedAt = transition.updatedAt
 
@@ -1968,7 +1973,7 @@ export default class RollbridgeDaemon {
     try {
       await this.checkpointGenerationTransition()
     } catch (error) {
-      transition.phase = "restoring_previous"
+      transition.phase = previousPhase
       transition.error = previousError
       transition.journalRevision = previousJournalRevision
       transition.updatedAt = previousUpdatedAt
@@ -2962,7 +2967,8 @@ export function ownerReplacementTransitionAuthorityMatches(transfer, transition,
 function terminalRetirementFailure(failure) {
   return typeof failure === "string" && (
     /^Cannot activate .+ generation from retired$/iu.test(failure) ||
-    /^activate command exited non-zero with status \d+$/u.test(failure)
+    /^activate command exited non-zero with status \d+$/u.test(failure) ||
+    /^Release .+ retirement quiescence failed: quiet command exited non-zero with status \d+$/u.test(failure)
   )
 }
 

package/test/rollbridge.test.js

@@ -799,7 +799,7 @@ test("explicit recovery stops the exact failed candidate and fences degraded inc
     await assert.rejects(() => exactRecovery({previousReleaseId: "wrong-v1"}), /refusing stale recovery/i)
     await assert.rejects(() => exactRecovery({revision: "wrong-v2"}), /exact same release, path, revision, and config authority/i)
     transition.phase = "retiring_failed_candidate"
-    await assert.rejects(() => exactRecovery(), /exactly restoring_previous/i)
+    await assert.rejects(() => exactRecovery(), /requires retiring_previous or restoring_previous/i)
     transition.phase = "restoring_previous"
     const terminalFailure = transition.compensationError
 
@@ -826,6 +826,16 @@ test("explicit recovery stops the exact failed candidate and fences degraded inc
     const persisted = /** @type {{generationTransition?: import("../src/json.js").JsonValue} | undefined} */ (await readState(fixture.statePath))
 
     assert.equal(/** @type {{phase?: string} | undefined} */ (persisted?.generationTransition)?.phase, "degraded_active")
+
+    transition.phase = "retiring_previous"
+    transition.error = "Release v1 retirement quiescence failed: quiet command exited non-zero with status 1"
+    transition.compensationError = undefined
+    candidate.state = "starting"
+    await daemon.checkpointGenerationTransition()
+    const legacyRecovery = await exactRecovery()
+
+    assert.equal(legacyRecovery.recoveryStatus, "retired_incumbent_accepted")
+    assert.equal(daemon.status().generationTransition?.phase, "degraded_active", "guarded recovery migrates a legacy terminal retirement fence")
     await assert.rejects(() => daemon.deploy({releaseId: "bad-v3", releasePath: fixture.root, revision: "bad-v3"}), /health check failed/i)
     assert.equal(daemon.status().generationTransition?.phase, "degraded_active")
     assert.equal(statusRelease(daemon, "v1").processes.find(({id}) => id === "web")?.pid, incumbentWebPid)