rollbridge 0.1.48 → 0.1.54

package/README.md

@@ -576,6 +576,7 @@ Inspect state:
 
 ```bash
 rollbridge status --config rollbridge.js
+rollbridge status --no-logs --config rollbridge.js
 ```
 
 `status` reports each managed process's `state`, `pid`, recent `logs`, last
@@ -587,6 +588,10 @@ and why it last started (`lastStartReason`: `deploy`, `crash`, `manual`, or
 `rssBytes`, `memoryRestarts`, `lastMemoryRestartAt`, and `children` (the sampled
 process tree — each group member's `pid`, `command`, and `rssBytes`).
 
+For machine lifecycle attestations that do not need captured process output,
+pass `--no-logs`. It returns the same status projection while omitting only each
+release, service, and singleton process's `logs` array.
+
 Print the recent captured stdout/stderr per process (a one-shot snapshot of the
 retained `outputLines`, not a live stream):
 

package/docs/cli.md

@@ -253,7 +253,7 @@ stays safe.
 ## `status`
 
 ```
-rollbridge status [--config <path>]
+rollbridge status [--config <path>] [--no-logs]
 ```
 
 Prints the daemon status JSON: the active release id, the proxy address, and —
@@ -264,6 +264,12 @@ Memory-supervised processes also report `rssBytes`, `memoryRestarts`,
 `lastMemoryRestartAt`, and `children` (the process tree: each group member's
 `pid`, `command`, and `rssBytes`).
 
+`--no-logs` omits only the captured `logs` array from release, service, and
+singleton process statuses. Use it for bounded machine-readable lifecycle
+attestations that do not need process output. The equivalent control request is
+`{"command":"status","includeLogs":false}`; omitted `includeLogs` continues to
+return the complete status payload.
+
 `daemonRuntime` identifies the immutable Rollbridge runtime serving the proxy:
 its runtime `format`, package `version`, content `digest`, and absolute `path`.
 `ensure-daemon` uses this attestation before reusing a responsive daemon.

package/docs/generation-deployment-contract.md

@@ -0,0 +1,9 @@
+# Generation deployment contract
+
+Rollbridge treats web authority, jobs-generation authority, durable transition state, and old-release draining as separate concerns.
+
+A successful activation-lifecycle deployment starts and health-checks the candidate, waits for the old generation's retirement/quiescence acknowledgement, activates the candidate jobs generation, switches web authority, checkpoints `committed`, and returns. The acknowledged old generation then continues draining and stopping asynchronously; deployment completion does not wait for that later work.
+
+Failed candidates never receive traffic. Recovery is exact-authority and journaled; no operator should edit durable state. A degraded incumbent keeps web authority while jobs remain explicitly degraded until a fresh generation commits.
+
+Persistent guardians may retain old processes, but new release processes must use current lifecycle semantics. Lifecycle command failures must retain bounded stdout/stderr and stage metadata. Runtime content digest is authoritative; package versions are compatibility metadata rather than unique code identity.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rollbridge",
-  "version": "0.1.48",
+  "version": "0.1.54",
   "description": "Zero-downtime process supervisor and local traffic switcher for deploy-managed apps.",
   "keywords": [
     "deploy",

package/src/cli.js

@@ -41,6 +41,7 @@ export async function runCli(argv) {
     .option("--boot-attestation <digest>", "Opaque bootstrap ownership attestation (requires the complete bootstrap release tuple)")
     .option("--takeover-owner", "Boot and health-check before retiring the current external owner")
     .option("--replace-owner", "Resume a prepared durable owner replacement")
+    .option("--reset-retired-owner", "Reset missing guardian identity from the exact committed bootstrap")
     .addOption(new Option("--guardian-daemon-log-path <path>").hideHelp())
     .addOption(new Option("--guardian-daemon-pid-path <path>").hideHelp())
     .addOption(new Option("--guardian-daemon-start-timeout-ms <ms>").hideHelp())
@@ -88,6 +89,12 @@ export async function runCli(argv) {
       process.once("SIGTERM", () => { void shutdown() })
 
       if (options.takeoverOwner && (!bootstrap || !bootstrap.attestation)) throw new Error("Daemon --takeover-owner requires the complete bootstrap release tuple and --boot-attestation.")
+      if (options.resetRetiredOwner && (!bootstrap || options.takeoverOwner || options.replaceOwner)) throw new Error("Daemon --reset-retired-owner requires the complete bootstrap tuple and cannot be combined with owner takeover/replacement.")
+
+      if (options.resetRetiredOwner) {
+        startupPromise = daemon.resetRetiredOwnerRecovery()
+        await startupPromise
+      }
 
       if (options.replaceOwner) {
         if (bootstrap || options.takeoverOwner) throw new Error("Daemon --replace-owner cannot be combined with bootstrap takeover options.")
@@ -95,7 +102,7 @@ export async function runCli(argv) {
         await startupPromise
       }
 
-      if (!options.takeoverOwner && !options.replaceOwner) {
+      if (!options.takeoverOwner && !options.replaceOwner && !options.resetRetiredOwner) {
         try {
           startupPromise = daemon.start({exposeControl: !bootstrap})
           await startupPromise
@@ -266,11 +273,12 @@ export async function runCli(argv) {
   program
     .command("status")
     .option("-c, --config <path>", "Config file path (defaults to rollbridge.js)")
+    .option("--no-logs", "Omit captured stdout/stderr from process statuses")
     .action(async (options) => {
       const configPath = await resolveConfigPath(options.config)
       const config = await loadConfig(configPath)
       const response = await sendControlCommand({
-        command: {command: "status"},
+        command: {command: "status", ...(options.logs ? {} : {includeLogs: false})},
         path: config.control.path
       })
 

package/src/daemon.js

@@ -27,6 +27,10 @@ const STATE_PERSIST_INTERVAL_MS = 5000
  * @typedef {"candidate_ready" | "retiring_previous" | "previous_retired" | "activating_candidate" | "restoring_previous" | "retiring_failed_candidate" | "degraded_active" | "committed_pending" | "committed" | "restoring_committed"} GenerationTransitionPhase
  * @typedef {{activationError?: string, activationLifecycle?: boolean, candidateReleaseId: string, candidateReleasePath: string, candidateRevision: string, compensationError?: string, configDigest: string, degradedIncumbent?: boolean, error?: string, journalRevision?: number, phase: GenerationTransitionPhase, previousReleaseId: string | null, startedAt: string, updatedAt: string}} GenerationTransition
  * @typedef {{activeReleaseId: string | null, application: string, bootstrap: BootstrapIdentity | undefined, control: import("./config.js").ControlConfig, daemonPid: number, daemonRuntime: import("./daemon-runtime.js").DaemonRuntimeIdentity | undefined, generationTransition?: GenerationTransition, ownerRecovery: {configDigest: string, ready: boolean} | undefined, ownerTransition?: OwnerTransition, orphans: {id: string, pid: number, releaseId: string | null}[], proxy: {host: string, port: number | undefined, upstreamHost: string}, releaseReferences: {releaseId: string, releasePath: string}[], releases: import("./release-group.js").ReleaseStatus[], services: ProcessStatus[], singletons: ProcessStatus[]}} DaemonStatus
+ * @typedef {Omit<import("./managed-process.js").ManagedProcessStatus, "logs">} ManagedProcessStatusWithoutLogs
+ * @typedef {Omit<import("./release-group.js").ReleaseStatus, "processes"> & {processes: ManagedProcessStatusWithoutLogs[]}} ReleaseStatusWithoutLogs
+ * @typedef {Omit<ProcessStatus, "process"> & {process: ManagedProcessStatusWithoutLogs}} ProcessStatusWithoutLogs
+ * @typedef {Omit<DaemonStatus, "releases" | "services" | "singletons"> & {releases: ReleaseStatusWithoutLogs[], services: ProcessStatusWithoutLogs[], singletons: ProcessStatusWithoutLogs[]}} DaemonStatusWithoutLogs
  * @typedef {{configDigest: string, format: number, guardian: {pid?: number, socketPath: string, token: string}, reconnectGraceMs: number}} OwnerRecoveryMetadata
  * @typedef {DaemonStatus & {recovery: OwnerRecoveryMetadata, serviceReleaseIds?: Record<string, string>, singletonReleaseIds?: Record<string, string>}} OwnerRecoverySnapshot
  * @typedef {{authority: JsonValue, config: import("./config.js").RollbridgeConfig, listenerConnectionSources?: Record<string, Record<string, {http: number, websocket: number}>>, listenerSourceId?: string, recovery?: {command: JsonValue, reconnectGraceMs: number, startupTimeoutMs: number}, releaseConfigs?: Record<string, import("./config.js").RollbridgeConfig>, retiredListenerHandoff?: number, serviceReleaseIds?: Record<string, string>, singletonReleaseIds?: Record<string, string>, snapshot: OwnerRecoverySnapshot}} PrivateOwnerState
@@ -186,6 +190,28 @@ export default class RollbridgeDaemon {
     return true
   }
 
+  /** Re-establishes durable guardian ownership from an exact committed external-owner bootstrap. */
+  async resetRetiredOwnerRecovery() {
+    if (!this.statePath || !this.config.ownerRecovery || !this.bootstrap) throw new Error("Retired owner reset requires ownerRecovery, statePath, and the exact bootstrap tuple")
+    const state = await readState(this.statePath)
+    const snapshot = state && typeof state === "object" && !Array.isArray(state) ? /** @type {OwnerRecoverySnapshot} */ (state) : undefined
+    const transition = snapshot?.generationTransition
+    const persistedBootstrap = snapshot?.bootstrap
+    const exactBootstrap = snapshot?.activeReleaseId === this.bootstrap.releaseId &&
+      persistedBootstrap?.releaseId === this.bootstrap.releaseId && persistedBootstrap?.releasePath === this.bootstrap.releasePath && persistedBootstrap?.revision === this.bootstrap.revision &&
+      transition?.phase === "committed" && transition.candidateReleaseId === this.bootstrap.releaseId && transition.candidateReleasePath === this.bootstrap.releasePath && transition.candidateRevision === this.bootstrap.revision
+    if (!snapshot || snapshot.recovery?.guardian || !exactBootstrap) throw new Error("Retired owner reset requires an exact committed bootstrap with missing guardian identity")
+    const control = await inspectControlSocket(this.config.control.path)
+    if (control.alive) throw new Error(`Retired owner reset refuses responsive control owner at ${this.config.control.path}`)
+    this.guardianIdentity = {socketPath: `${this.statePath}.guardian.sock`, token: crypto.randomBytes(32).toString("hex")}
+    this.guardian = new GuardianClient(this.guardianIdentity)
+    await this.guardian.launch()
+    this.guardianIdentity.pid = this.guardian.pid
+    this.watchOwnerReplacementEvents()
+    await this.guardian.claimOwner(this.config.ownerRecovery.reconnectGraceMs ?? 30000, this.ownerAuthority())
+    this.logger("retired owner guardian reset prepared", {guardianPid: this.guardianIdentity.pid ?? null, releaseId: this.bootstrap.releaseId})
+  }
+
   /** Connects to the durable process guardian and reconstructs a matching persisted owner snapshot. */
   async initializeOwnerRecovery() {
     if (!this.statePath) throw new Error("ownerRecovery requires statePath")
@@ -1349,7 +1375,7 @@ export default class RollbridgeDaemon {
     }
 
     if (commandName === "status") {
-      return this.status()
+      return this.status({includeLogs: statusIncludeLogs(data.includeLogs)})
     }
 
     if (commandName === "events") {
@@ -1936,18 +1962,16 @@ export default class RollbridgeDaemon {
     if (candidate.releasePath !== transition.candidateReleasePath || candidate.revision !== transition.candidateRevision || ownerConfigDigest(candidate.config) !== transition.configDigest) {
       throw new Error(`Generation transition candidate ${candidate.releaseId} does not retain its exact path, revision, and config authority`)
     }
-    if (candidate.state !== "draining" && candidate.state !== "stopped") throw new Error(`Failed candidate ${candidate.releaseId} must be retired before accepting a retired incumbent`)
+    const recoverableCandidateStates = transition.phase === "retiring_previous" ? ["starting", "draining", "stopped"] : ["draining", "stopped"]
+
+    if (!recoverableCandidateStates.includes(candidate.state)) throw new Error(`Failed candidate ${candidate.releaseId} must be retiring or retired before accepting a retired incumbent`)
     if (this.activeRelease !== previous) throw new Error(`Previous release ${previous.releaseId} is not the authoritative proxy target`)
     const activationConfig = previous.config.processes.find((processConfig) => processConfig.lifecycle.activateCommand !== undefined)
     const coordinator = activationConfig ? previous.getProcesses(activationConfig.id)[0]?.process : undefined
-    if (!coordinator || coordinator.status().lifecycleRole !== "retired") throw new Error(`Previous release ${previous.releaseId} does not retain a retired generation coordinator`)
-    if (!releaseOwnsLiveProxyTraffic(previous)) throw new Error(`Previous release ${previous.releaseId} no longer owns live proxy/web traffic`)
-    await candidate.drainAndStop(candidate.config.proxy.drainTimeoutMs, candidate.config)
-    const candidateProcesses = candidate.status().processes
+    const missingRetiredCoordinator = !coordinator && /^Process .+ is not retained for reactivation$/u.test(retirementFailure ?? "")
 
-    if (candidate.state !== "stopped" || candidateProcesses.some(({pid, state}) => pid !== undefined || (state !== "stopped" && state !== "failed"))) {
-      throw new Error(`Failed candidate ${candidate.releaseId} did not fully stop during retired-incumbent recovery`)
-    }
+    if ((!coordinator && !missingRetiredCoordinator) || (coordinator && coordinator.status().lifecycleRole !== "retired")) throw new Error(`Previous release ${previous.releaseId} does not retain a retired or terminally absent generation coordinator`)
+    if (!releaseOwnsLiveProxyTraffic(previous)) throw new Error(`Previous release ${previous.releaseId} no longer owns live proxy/web traffic`)
     if (this.activeRelease !== previous || !releaseOwnsLiveProxyTraffic(previous)) throw new Error(`Previous release ${previous.releaseId} lost live proxy/web authority during retired-incumbent recovery`)
     const result = /** @type {Record<string, JsonValue>} */ ({
       activeReleaseId: previous.releaseId,
@@ -1958,7 +1982,10 @@ export default class RollbridgeDaemon {
       recoveryStatus: "retired_incumbent_accepted"
     })
 
-    if (transition.phase === "degraded_active") return result
+    if (transition.phase === "degraded_active") {
+      if (candidate.state !== "stopped") void this.drainAndPrune(candidate, candidate.config)
+      return result
+    }
     const previousError = transition.error
     const previousPhase = transition.phase
     const previousJournalRevision = transition.journalRevision
@@ -1982,6 +2009,7 @@ export default class RollbridgeDaemon {
       }
       throw new Error(`retired-incumbent recovery checkpoint failed: ${error instanceof Error ? error.message : String(error)}`, {cause: error})
     }
+    if (candidate.state !== "stopped") void this.drainAndPrune(candidate, candidate.config)
     this.logger("retired incumbent accepted as jobs-degraded", result)
     return result
   }
@@ -2886,8 +2914,25 @@ export default class RollbridgeDaemon {
     return this.proxyPort
   }
 
-  /** @returns {DaemonStatus} Status payload. */
-  status() {
+  /**
+   * @overload
+   * @returns {DaemonStatus} Full status payload.
+   */
+  /**
+   * @overload
+   * @param {{includeLogs: false}} options - Log-free status response options.
+   * @returns {DaemonStatusWithoutLogs} Log-free status payload.
+   */
+  /**
+   * @overload
+   * @param {{includeLogs: boolean}} options - Status response options.
+   * @returns {DaemonStatus | DaemonStatusWithoutLogs} Status payload.
+   */
+  /**
+   * @param {{includeLogs?: boolean}} [options] - Status response options.
+   * @returns {DaemonStatus | DaemonStatusWithoutLogs} Status payload.
+   */
+  status({includeLogs = true} = {}) {
     // Re-check liveness and prune the dead permanently, so the list self-clears as the operator
     // stops the leftovers (e.g. via `rollbridge recover`). Pruning (not just filtering) matters:
     // a cleared orphan must not reappear if the OS later recycles its pid for an unrelated process.
@@ -2897,7 +2942,7 @@ export default class RollbridgeDaemon {
     const singletonOwnerReleaseIds = new Set(this.singletonReleaseIds.values())
     const transitionReleaseIds = this.generationTransitionReleaseIds()
 
-    return {
+    const status = {
       activeReleaseId: this.activeRelease ? this.activeRelease.releaseId : null,
       application: this.config.application,
       bootstrap: this.bootstrap ? {...this.bootstrap} : undefined,
@@ -2928,6 +2973,8 @@ export default class RollbridgeDaemon {
         process: processInstance.status()
       }))
     }
+
+    return includeLogs ? status : withoutStatusProcessLogs(status)
   }
 }
 
@@ -2939,6 +2986,50 @@ export function ownerConfigDigest(config) {
   return crypto.createHash("sha256").update(JSON.stringify(config)).digest("hex")
 }
 
+/**
+ * Removes captured output from a live status response without changing any other status field.
+ * @param {DaemonStatus} status - Full status payload.
+ * @returns {DaemonStatusWithoutLogs} Log-free status payload.
+ */
+function withoutStatusProcessLogs(status) {
+  return {
+    ...status,
+    releases: status.releases.map((release) => ({
+      ...release,
+      processes: release.processes.map(withoutProcessLogs)
+    })),
+    services: status.services.map(({process, ...service}) => ({
+      ...service,
+      process: withoutProcessLogs(process)
+    })),
+    singletons: status.singletons.map(({process, ...singleton}) => ({
+      ...singleton,
+      process: withoutProcessLogs(process)
+    }))
+  }
+}
+
+/**
+ * @param {import("./managed-process.js").ManagedProcessStatus} processStatus - Full managed-process status.
+ * @returns {ManagedProcessStatusWithoutLogs} Status without captured process output.
+ */
+function withoutProcessLogs(processStatus) {
+  const {logs: _logs, ...withoutLogs} = processStatus
+
+  return withoutLogs
+}
+
+/**
+ * @param {JsonValue} value - Optional status request field.
+ * @returns {boolean} Whether captured process output is included.
+ */
+function statusIncludeLogs(value) {
+  if (value === undefined) return true
+  if (typeof value !== "boolean") throw new Error("includeLogs must be a boolean")
+
+  return value
+}
+
 /**
  * @param {PrivateOwnerState} transfer - Authenticated private incumbent state.
  * @param {GenerationTransition} transition - Unresolved generation transition.
@@ -2966,6 +3057,7 @@ function terminalRetirementFailure(failure) {
   return typeof failure === "string" && (
     /^Cannot activate .+ generation from retired$/iu.test(failure) ||
     /^activate command exited non-zero with status \d+$/u.test(failure) ||
+    /^Process .+ is not retained for reactivation$/u.test(failure) ||
     /^Release .+ retirement quiescence failed: quiet command exited non-zero with status \d+$/u.test(failure)
   )
 }

package/src/process-guardian.js

@@ -631,7 +631,11 @@ async function execute(request, socket) {
       },
       shouldRestart: () => record.desired
     }
-    const managedProcess = legacyGuardian
+    // Only process keys inventoried from the legacy guardian remain delegated to it.
+    // New release processes must be owned by the current guardian so current lifecycle
+    // fields (including activation timeouts) are enforced instead of downgraded by an
+    // older guardian protocol implementation.
+    const managedProcess = recoversLegacyProcess && legacyGuardian
       ? legacyGuardian.process(request.key, managedDefinition)
       : new ManagedProcess(managedDefinition)
 

package/src/release-group.js

@@ -1,5 +1,6 @@
 // @ts-check
 
+import {spawn} from "node:child_process"
 import {EventEmitter} from "node:events"
 import ManagedProcess from "./managed-process.js"
 import {findAvailablePort} from "./port-allocator.js"
@@ -14,6 +15,40 @@ import {waitForHealth} from "./health.js"
  * @typedef {{count?: number, guardianKey?: string, index?: number, instanceId?: string, shouldRestart?: () => boolean}} BuildProcessOptions
  */
 
+
+/**
+ * Runs a lifecycle authority command in the current daemon so nested legacy guardians
+ * cannot silently downgrade lifecycle timeout semantics for newly deployed processes.
+ * @param {{command: string, cwd: string, env: Record<string, string>, label: string, timeoutMs: number}} options - Command contract.
+ * @returns {Promise<void>} Completion after an acknowledged command.
+ */
+async function runLifecycleCommand({command, cwd, env, label, timeoutMs}) {
+  await /** @type {Promise<void>} */ (new Promise((resolve, reject) => {
+    const child = spawn(command, {cwd, detached: true, env: {...process.env, ...env}, shell: true, stdio: "ignore"})
+    let settled = false
+    /** @param {Error | undefined} error - Completion failure. */
+    /** @param {Error | undefined} error - Completion failure. */
+    const finish = (error) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      if (error) reject(error)
+      else resolve()
+    }
+    const timer = setTimeout(() => {
+      if (child.pid) {
+        try { process.kill(-child.pid, "SIGKILL") } catch { /* The command already exited. */ }
+      }
+      finish(new Error(`${label} timed out after ${timeoutMs}ms`))
+    }, timeoutMs)
+    child.once("error", finish)
+    child.once("exit", (code, signal) => {
+      if (code === 0) finish(undefined)
+      else finish(new Error(`${label} exited non-zero with ${signal ? `signal ${signal}` : `status ${code ?? "unknown"}`}`))
+    })
+  }))
+}
+
 /**
  * @param {string} id - Process id.
  * @returns {string} Environment suffix.
@@ -276,7 +311,19 @@ export default class ReleaseGroup extends EventEmitter {
     const [instance] = this.getProcesses(processConfig.id)
 
     if (!instance) throw new Error(`Generation activation process ${processConfig.id} is not running for release ${this.releaseId}`)
-    await instance.process.activateStrict()
+    if (instance.process.constructor.name === ManagedProcess.name) {
+      await instance.process.activateStrict()
+    } else {
+      const definition = this.processDefinition(processConfig)
+      await runLifecycleCommand({
+        command: /** @type {string} */ (processConfig.lifecycle.activateCommand),
+        cwd: /** @type {string} */ (definition.cwd),
+        env: /** @type {Record<string, string>} */ (definition.env),
+        label: "activate command",
+        timeoutMs: processConfig.lifecycle.activateTimeoutMs ?? 30000
+      })
+      await instance.process.setLifecycleRole("active")
+    }
   }
 
   /** Restores the retained generation coordinator to its active role in place. */

package/test/control-protocol.test.js

@@ -6,6 +6,7 @@ import net from "node:net"
 import os from "node:os"
 import path from "node:path"
 import test, {after, before} from "node:test"
+import {fileURLToPath} from "node:url"
 import RollbridgeDaemon from "../src/daemon.js"
 import {normalizeConfig} from "../src/config.js"
 import {sendControlCommand} from "../src/control-client.js"
@@ -13,6 +14,9 @@ import {sendControlCommand} from "../src/control-client.js"
 let root = ""
 let socketPath = ""
 let daemon = /** @type {RollbridgeDaemon | undefined} */ (undefined)
+const currentDir = path.dirname(fileURLToPath(import.meta.url))
+const dummyAppPath = path.join(currentDir, "fixtures", "dummy-app.js")
+const runningProcessCommand = `${JSON.stringify(process.execPath)} -e ${JSON.stringify("setInterval(() => {}, 1000)")}`
 
 before(async () => {
   root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-control-"))
@@ -21,7 +25,11 @@ before(async () => {
   const config = normalizeConfig({
     application: "rollbridge-control-test",
     control: {path: socketPath},
-    processes: [{command: "true", id: "web", policy: "proxied", port: {from: 0, to: 0}}],
+    processes: [
+      {command: runningProcessCommand, id: "beacon", policy: "service", port: {from: 0, to: 0}},
+      {command: `${JSON.stringify(process.execPath)} ${JSON.stringify(dummyAppPath)}`, health: {intervalMs: 50, path: "/ping", timeoutMs: 3000}, id: "web", policy: "proxied", port: {from: 0, to: 0}},
+      {command: runningProcessCommand, id: "jobs-main", policy: "singleton"}
+    ],
     proxy: {host: "127.0.0.1", port: 0}
   })
 
@@ -92,3 +100,55 @@ test("a known command missing a required field returns a field error", async ()
   assert.equal(response.status, "error")
   assert.equal(response.error, "releasePath is required")
 })
+
+test("status can omit process logs without changing the default status payload", async () => {
+  assert.ok(daemon)
+  await daemon.deploy({releaseId: "v1", releasePath: root, revision: "v1"})
+
+  const full = /** @type {import("../src/daemon.js").DaemonStatus} */ (await sendControlCommand({command: {command: "status"}, path: socketPath}))
+  const compact = /** @type {import("../src/daemon.js").DaemonStatusWithoutLogs} */ (await sendControlCommand({command: {command: "status", includeLogs: false}, path: socketPath}))
+  const invalid = await sendRawControlLine(JSON.stringify({command: "status", includeLogs: "false"}))
+
+  assert.ok(full.releases[0]?.processes.every((processStatus) => Array.isArray(processStatus.logs)))
+  assert.ok(full.services.every(({process: processStatus}) => Array.isArray(processStatus.logs)))
+  assert.ok(full.singletons.every(({process: processStatus}) => Array.isArray(processStatus.logs)))
+  assert.deepEqual(statusWithoutProcessUptimes(compact), statusWithoutProcessUptimes({
+    ...full,
+    releases: full.releases.map((release) => ({
+      ...release,
+      processes: release.processes.map(({logs: _logs, ...processStatus}) => processStatus)
+    })),
+    services: full.services.map(({process, ...service}) => ({
+      ...service,
+      process: (({logs: _logs, ...processStatus}) => processStatus)(process)
+    })),
+    singletons: full.singletons.map(({process, ...singleton}) => ({
+      ...singleton,
+      process: (({logs: _logs, ...processStatus}) => processStatus)(process)
+    }))
+  }))
+  assert.equal(invalid.status, "error")
+  assert.equal(invalid.error, "includeLogs must be a boolean")
+})
+
+/**
+ * @param {import("../src/daemon.js").DaemonStatus | import("../src/daemon.js").DaemonStatusWithoutLogs} status - Status response.
+ * @returns {Record<string, import("../src/json.js").JsonValue>} Status without volatile process uptime.
+ */
+function statusWithoutProcessUptimes(status) {
+  return {
+    ...status,
+    releases: status.releases.map((release) => ({
+      ...release,
+      processes: release.processes.map(({uptimeMs: _uptimeMs, ...processStatus}) => processStatus)
+    })),
+    services: status.services.map(({process, ...service}) => ({
+      ...service,
+      process: (({uptimeMs: _uptimeMs, ...processStatus}) => processStatus)(process)
+    })),
+    singletons: status.singletons.map(({process, ...singleton}) => ({
+      ...singleton,
+      process: (({uptimeMs: _uptimeMs, ...processStatus}) => processStatus)(process)
+    }))
+  }
+}

package/test/guardian-client.test.js

@@ -70,6 +70,21 @@ test("guardian runs a strict activation lifecycle command for the exact register
   }
 })
 
+test("guardian preserves a custom activation timeout in the registered process definition", async () => {
+  const fixture = await createGuardian()
+  const processInstance = fixture.client.process("candidate-activation-timeout", {
+    ...definition("candidate-activation-timeout"),
+    lifecycle: {activateCommand: "sleep 0.05", activateTimeoutMs: 10, drainTimeoutMs: 0}
+  })
+
+  try {
+    await processInstance.start()
+    await assert.rejects(() => processInstance.activateStrict(), /activate command timed out after 10ms/i)
+  } finally {
+    await cleanupGuardian(fixture)
+  }
+})
+
 test("client reactivates a retained process through a guardian without the reactivation command", async () => {
   const fixture = await createGuardian()
   const lifecyclePath = path.join(fixture.root, "lifecycle.log")
@@ -1501,6 +1516,14 @@ test("first upgrade migrates a real pre-split guardian without replacing its own
     assert.deepEqual(await upgraded.stageOwnerReplacement(prepared.replacementId, {authority: nextAuthority, snapshot: ownerState.snapshot}), {committed: true})
     await committed
     assert.equal(restored.status().pid, legacyPid)
+
+    const currentProcess = upgraded.process("release:v2:current-worker", {
+      ...definition("current-worker"),
+      lifecycle: {activateCommand: "sleep 0.05", activateTimeoutMs: 10, drainTimeoutMs: 0}
+    })
+    await currentProcess.start()
+    await assert.rejects(() => currentProcess.activateStrict(), /activate command timed out after 10ms/i)
+    assert.equal(restored.status().pid, legacyPid)
     await upgraded.shutdown()
     await upgraded.guardianExit()
   } finally {

package/test/logs.test.js

@@ -91,6 +91,13 @@ test("logs CLI prints captured output per managed process", async () => {
     assert.ok(web, "expected a web entry in the JSON output")
     assert.match(web.source, /release v1 \(active\)/)
     assert.ok(Array.isArray(web.logs))
+
+    lines.length = 0
+    await runCli(["node", "rollbridge", "status", "--no-logs", "-c", path.join(root, "rollbridge.js")])
+
+    const status = JSON.parse(lines.join("\n"))
+
+    assert.equal("logs" in status.releases[0].processes[0], false)
   } finally {
     console.log = originalLog
     await daemon.shutdown()

package/test/owner-recovery.test.js

@@ -171,7 +171,7 @@ test("exact bootstrap restores the committed generation after external owner ret
     assert.ok(active.services.every(({process}) => typeof process.pid === "number" && process.state === "running"))
     assert.ok(active.singletons.every(({process}) => typeof process.pid === "number" && process.state === "running"))
     assert.deepEqual(recoveryOrder, ["service", "activate", "singleton"], "candidate activation must precede post-commit singleton completion")
-    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "retire:v1", "activate:v2", "retire:v2", "activate:v2"])
+    assert.deepEqual(await waitForLifecycleEvents(fixture.lifecycleLogPath, ["activate:v1", "retire:v1", "activate:v2", "retire:v2", "activate:v2"]), ["activate:v1", "retire:v1", "activate:v2", "retire:v2", "activate:v2"])
   } finally {
     if (recovered) {
       const activeRecovery = recovered.status().activeReleaseId === "v2"
@@ -307,7 +307,7 @@ test("journaled committed bootstrap recovery resumes after a restart begins", as
     assert.ok(active.singletons.every(({process}) => typeof process.pid === "number" && process.state === "running"))
     assert.equal(releaseProcessPid(active, "v1", "worker"), v1WorkerPid)
     assert.equal(isProcessRunning(v1WorkerPid), true)
-    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "retire:v1", "activate:v2", "retire:v2", "activate:v2"])
+    assert.deepEqual(await waitForLifecycleEvents(fixture.lifecycleLogPath, ["activate:v1", "retire:v1", "activate:v2", "retire:v2", "activate:v2"]), ["activate:v1", "retire:v1", "activate:v2", "retire:v2", "activate:v2"])
   } finally {
     if (recovered) {
       const shutdown = recovered.shutdown()
@@ -873,7 +873,7 @@ test("owner recovery preserves complete private transition authority across a ca
 
     assert.equal(recovered.status().activeReleaseId, "v2")
     assert.equal(recovered.status().generationTransition?.phase, "committed")
-    assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "retire:v1", "activate:v2"])
+    assert.deepEqual(await waitForLifecycleEvents(fixture.lifecycleLogPath, ["activate:v1", "retire:v1", "activate:v2"]), ["activate:v1", "retire:v1", "activate:v2"])
   } finally {
     if (recovered) await recovered.shutdown().catch(() => {})
     await stopFixtureGuardian(fixture.statePath)
@@ -988,6 +988,7 @@ test("owner recovery uses the owning release singleton definition during a commi
     assert.equal(pending.activeReleaseId, "v2")
     assert.equal(pending.generationTransition?.phase, "committed_pending")
     assert.equal(pending.singletonReleaseIds?.singleton, "v1")
+    await owner.persistState({throwOnError: true})
     await owner.retireCommittedOwner(undefined)
     owner.guardian?.disconnect()
 
@@ -1773,6 +1774,33 @@ async function lifecycleEvents(lifecycleLogPath) {
   return (await fs.readFile(lifecycleLogPath, "utf8")).trim().split("\n").filter(Boolean)
 }
 
+/**
+ * @param {string} lifecycleLogPath - Fixture lifecycle log.
+ * @param {string[]} expected - Exact lifecycle events to await.
+ * @returns {Promise<string[]>} The matching ordered events.
+ */
+async function waitForLifecycleEvents(lifecycleLogPath, expected) {
+  const watcher = fs.watch(lifecycleLogPath, {signal: AbortSignal.timeout(3000)})
+
+  try {
+    const events = await lifecycleEvents(lifecycleLogPath)
+
+    if (JSON.stringify(events) === JSON.stringify(expected)) return events
+    for await (const _event of watcher) {
+      const changedEvents = await lifecycleEvents(lifecycleLogPath)
+
+      if (JSON.stringify(changedEvents) === JSON.stringify(expected)) return changedEvents
+    }
+  } catch (error) {
+    if (error instanceof Error && error.name === "AbortError") throw new Error(`Timed out waiting for lifecycle events: ${JSON.stringify(expected)}`, {cause: error})
+    throw error
+  } finally {
+    await watcher.return?.()
+  }
+
+  throw new Error(`Timed out waiting for lifecycle events: ${JSON.stringify(expected)}`)
+}
+
 /**
  * @param {string} root - Fixture root.
  * @param {string} releaseId - Release id.

package/test/owner-replacement.test.js

@@ -1826,6 +1826,7 @@ test("owner replacement preserves accepted degraded incumbent web authority", as
       releasePath: v2Path,
       revision: "v2"
     }, path: socketPath})
+    await waitForReleaseState(socketPath, "v2", "stopped")
     const accepted = await sendControlCommand({command: {command: "status"}, path: socketPath})
 
     assert.equal(recovery.jobsStatus, "degraded")
@@ -1833,7 +1834,6 @@ test("owner replacement preserves accepted degraded incumbent web authority", as
     assert.equal(/** @type {{phase?: string}} */ (accepted.generationTransition).phase, "degraded_active")
     replacement = spawn(process.execPath, [binPath, "daemon", "--config", configPath, "--replace-owner"], {stdio: ["ignore", "pipe", "pipe"]})
     await waitForLog(replacement, "owner replacement committed")
-    await new Promise((resolve) => setTimeout(resolve, 250))
     const recovered = await sendControlCommand({command: {command: "status"}, path: socketPath})
     const response = await fetch(`http://127.0.0.1:${proxyPort}/release`)
 

package/test/rollbridge.test.js

@@ -505,7 +505,7 @@ test("candidate activation retires jobs-main with its workers without waiting fo
   }
 })
 
-test("opt-in generation lifecycle retires the old generation before activating and committing the candidate", async () => {
+test("opt-in generation lifecycle acknowledges old retirement before activating the candidate", async () => {
   const fixture = await createFixture({handoffService: true, handoffServiceActivate: true, nonBlockingDrainWorker: true, webDependsOnService: true})
   const daemon = await startDaemon(fixture.config)
 
@@ -633,7 +633,7 @@ test("first generation is not committed when its activation acknowledgement fail
   }
 })
 
-test("retirement failure retains the exact transition, blocks other deploys, and exact resume continues it", async () => {
+test("retirement acknowledgement failure retains the exact transition, blocks other deploys, and exact resume continues it", async () => {
   const fixture = await createFixture({handoffService: true, handoffServiceActivate: true, handoffServiceQuietFailure: true, nonBlockingDrainWorker: true, webDependsOnService: true})
   const daemon = await startDaemon(fixture.config)
 
@@ -806,6 +806,8 @@ test("explicit recovery stops the exact failed candidate and fences degraded inc
     transition.compensationError = "incumbent activation was temporarily unavailable"
     await assert.rejects(() => exactRecovery(), /terminal retirement/i)
     transition.compensationError = terminalFailure
+    await incumbentCoordinator.setLifecycleRole("retired")
+    assert.equal(incumbentCoordinator.status().lifecycleRole, "retired")
     const checkpoint = daemon.checkpointGenerationTransition.bind(daemon)
 
     daemon.checkpointGenerationTransition = async () => { throw new Error("injected checkpoint failure") }
@@ -821,7 +823,7 @@ test("explicit recovery stops the exact failed candidate and fences degraded inc
     assert.equal(daemon.status().generationTransition?.phase, "degraded_active")
     assert.equal(statusRelease(daemon, "v1").processes.find(({id}) => id === "web")?.pid, incumbentWebPid)
     assert.equal(await fetchText(daemon, "/release"), "v1")
-    assert.equal(candidate.state, "stopped")
+    assert.ok(["draining", "stopped"].includes(candidate.state), "guarded recovery returns before failed-candidate drain completion")
     assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), eventsBeforeRecovery, "recovery must not activate either retained generation")
     const persisted = /** @type {{generationTransition?: import("../src/json.js").JsonValue} | undefined} */ (await readState(fixture.statePath))
 
@@ -830,11 +832,21 @@ test("explicit recovery stops the exact failed candidate and fences degraded inc
     transition.phase = "retiring_previous"
     transition.error = "Release v1 retirement quiescence failed: quiet command exited non-zero with status 1"
     transition.compensationError = undefined
+    candidate.state = "starting"
     await daemon.checkpointGenerationTransition()
     const legacyRecovery = await exactRecovery()
 
     assert.equal(legacyRecovery.recoveryStatus, "retired_incumbent_accepted")
     assert.equal(daemon.status().generationTransition?.phase, "degraded_active", "guarded recovery migrates a legacy terminal retirement fence")
+
+    transition.phase = "restoring_previous"
+    transition.compensationError = "Process background-jobs-main is not retained for reactivation"
+    daemon.releases.get("v1")?.processes.delete("beacon")
+    await daemon.checkpointGenerationTransition()
+    const absentCoordinatorRecovery = await exactRecovery()
+
+    assert.equal(absentCoordinatorRecovery.jobsStatus, "degraded")
+    assert.equal(daemon.status().generationTransition?.phase, "degraded_active", "terminally absent incumbent coordinator remains guarded jobs-degraded authority")
     await assert.rejects(() => daemon.deploy({releaseId: "bad-v3", releasePath: fixture.root, revision: "bad-v3"}), /health check failed/i)
     assert.equal(daemon.status().generationTransition?.phase, "degraded_active")
     assert.equal(statusRelease(daemon, "v1").processes.find(({id}) => id === "web")?.pid, incumbentWebPid)
@@ -1094,6 +1106,7 @@ test("retired generation coordinator remains fenced after exit", async () => {
     await daemon.deploy({releaseId: "v1", releasePath: fixture.root, revision: "v1"})
     socket = await openWebSocket(daemon)
     await daemon.deploy({releaseId: "v2", releasePath: fixture.root, revision: "v2"})
+    await waitFor(() => statusRelease(daemon, "v1").processes.find((entry) => entry.id === "beacon")?.lifecycleRole === "retired")
     const coordinator = statusRelease(daemon, "v1").processes.find((entry) => entry.id === "beacon")
     const coordinatorProcess = daemon.releases.get("v1")?.getProcess("beacon")