fix(proxy): survive a reload instead of cutting the response - #304

Open

codeslake wants to merge 101 commits into

cnighswonger:mainfrom

codeslake:fix/zero-downtime-reload

Commits on Aug 15, 2026

proxy: survive a reload instead of cutting the response

codeslake
and
claude
committed
fff0e86
proxy: keep the reload survivable without widening what it can break

codeslake
and
claude
committed
ff73514
test(reload): do not assert the co-bind row where the runtime cannot co-bind

codeslake
and
claude
committed
17ab7e7
proxy: let the guard say 'no opinion', and retire what it claimed before refusing

codeslake
and
claude
committed
3bee2f7
proxy: keep the reload from cutting sessions on every platform we run

codeslake
and
claude
committed
e73674f
proxy: serve a socket the supervisor holds, so a reload never unbinds the port

codeslake
and
claude
committed
43de0ff
proxy: hold the advertised port so a proxy restart never strands a session

codeslake
and
claude
committed
e4c84bb
test(reload): never derive a pid that could signal our own process group

codeslake
and
claude
committed
5624339
test(held-port): give the held-port cases their own file

codeslake
and
claude
committed
94ebfd5
proxy: run supervised without a service manager, and clear the record a restart causes

codeslake
and
claude
committed
70ee3bb
proxy: advertise run-service in --help

codeslake
and
claude
committed
5dde736
test: stop the suite sleeping through what it could observe

codeslake
and
claude
committed
57780a9
test: bound the new concurrency by cores, not by nothing

codeslake
and
claude
committed
5909670
fix(launcher): publish our CA when run-service starts the proxy, not only --remote-control

codeslake
and
claude
committed
8e3ee9e
test(reload): let the stream outlive the successor's boot, not a stopwatch

codeslake
and
claude
committed
9a925f6
fix(launcher): run-service takes the port over instead of leaving old code serving

codeslake
and
claude
committed
2cbc913
fix(proxy): exit with the holder instead of orphaning a port nobody reclaims

codeslake
and
claude
committed
9ceeb88
fix(proxy): put a holder back on the port when the old one dies

codeslake
and
claude
committed
3f4cdb7
fix(launcher): key holder detection on the subcommand, not the bin name

codeslake
and
claude
committed
978b6eb
fix(launcher): stop the holder stealing accepts from the proxy it supervises

codeslake
and
claude
committed
05817cd
fix(launcher): read the incumbent's parent, and stop the backoff being bypassed

codeslake
and
claude
committed
e6d4682
test(held-port): assert what the holder guarantees, not what it cannot

codeslake
and
claude
committed
78c1017
fix(launcher): make an upgrade actually upgrade

codeslake
and
claude
committed
e2a6d58
fix(launcher): decide upgrades by content hash, not by path

codeslake
and
claude
committed
db2c0e9
test: guard that a green run means the cases were collected

codeslake
and
claude
committed
028fd98
test(reload): retry the final health probe past a fixture-stolen socket

codeslake
and
claude
committed
0306900
fix(proxy): refuse to start when the upstream is our own address

codeslake
and
claude
committed
13ac0f6
fix(proxy): stop the launching shell deciding a service upstream and port

codeslake
and
claude
committed
d8e9831
feat(health): report the port we bound and whether the upstream loops

codeslake
and
claude
committed
fbab5f2
test(wrapper): bound the waits on a SIGTERMed child

codeslake
and
claude
committed
7e29893
docs(holder): record that never-letting-go measures worse in node

codeslake
and
claude
committed
d1d7a9b
test: bound every wait on a child that was signalled

codeslake
and
claude
committed
e3be754
test: bound the last unbounded child wait, and guard the shape mechanically

codeslake
and
claude
committed
14d0ce2
feat(holder): restart the proxy onto a deploy, opt-in

codeslake
and
claude
committed
8178d2d
fix(holder): the off switch has to cover the deploy watcher too

codeslake
and
claude
committed
8c98e54
test(watcher): assert what the watcher did, not that a pid held still

codeslake
and
claude
committed
861dd50
test: an exported switch must not change what the suite measures

codeslake
and
claude
committed
b83b799
test: reap the detached successor the orphan case creates

codeslake
and
claude
committed
51e3d28
test: pin the reaper as an assertion, not a comment

codeslake
and
claude
committed
1e6bf12
test(held-port): assert the window the holder actually has, with its size

codeslake
and
claude
committed
6151766
fix(holder): an unreadable source must not look like an idle watcher

codeslake
and
claude
committed
6d509e9
fix(forward-proxy): CONNECT never consulted the fallback chain, so every /login died

codeslake
and
claude
committed
7b59c53
fix(holder): stop when nobody is left to stop us — 151 orphans, 9.17 GiB

codeslake
and
claude
committed
26f3d8e
fix(proxy): a killed holder left its proxy alive forever

codeslake
and
claude
committed
49c0129
fix(holder): hold the port without accepting on it, and never fork a rival

codeslake
and
claude
committed
d3e8c44
fix(holder): the orphan guard killed the normal launch — opt in, not on

codeslake
and
claude
committed
60a63ff
fix(proxy): a dead holder cost 138 requests because we exited before its replacement was up

codeslake
and
claude
committed
ba4628c
fix(proxy): a handover successor is not the holder's child, and must not judge it

codeslake
and
claude
committed
53e8701
docs(proxy): prove the handover guard is reachable, instead of assuming

codeslake
and
claude
committed
328c18c
fix(proxy): a log line could kill the process it was describing

codeslake
and
claude
committed
83ac7ac
fix(holder): take the port with SIGHUP, because SIGTERM means hand it on

codeslake
and
claude
committed
964e926
fix(proxy): clear the socket-activation env before anything can spawn

codeslake
and
claude
committed
e8d9752
feat(holder): replace a holder by handing the socket on, not by dropping it

codeslake
and
claude
committed
fbe5016
fix(proxy): an orphaned proxy could never put a holder back

codeslake
and
claude
committed
03bdd31
test(sweep): remove the two temp dirs this fixture makes per call

codeslake
and
claude
committed
94a6ece
fix(proxy): clear the holder marker where it stops being true

codeslake
and
claude
committed
ea67005
feat(holder): publish the holder's own bytes on /health

codeslake
and
claude
committed
4dc57b8
fix(holder): hash our own bytes at load, not on first spawn

codeslake
and
claude
committed
eba6d20
docs(holder): the fingerprint publish order buys the opposite of what it said

codeslake
and
claude
committed
63761ae
fix(holder): stop keeping a gap listener whose listen() failed

codeslake
and
claude
committed
c5155fa
test(server): reap the successors this file breeds, so npm test can exit

codeslake
and
claude
committed
adc419e
fix(proxy): a released port must not resurrect its own holder

codeslake
and
claude
committed
705e643
docs(proxy): correct why the release guard exists — I got the cause wrong

codeslake
and
claude
committed
43733e3
fix(proxy): the self-heal's exit condition could not answer on a mac

codeslake
and
claude
committed
2975758
test(holder): make the release guard's case actually kill its mutation

codeslake
and
claude
committed
4f92cfd
feat(holder): the held port CARRIES while no proxy is up, instead of hanging

codeslake
and
claude
committed
634413e
feat(holder): carry the held port even when there is no hop left

codeslake
and
claude
committed
4bffe1d
feat(holder): carry the port in the window a dead child leaves behind

codeslake
and
claude
committed
fb66147
feat(holder): keep the address carrying when CCF itself is turned off

codeslake
and
claude
committed
88adfc9
fix(health): publish the hop CONNECTs actually leave through

codeslake
and
claude
committed
c97d135
fix(holder): stop the standby relay from eating the port it exists to save

codeslake
and
claude
committed
1f24ba1
fix(holder): ask again until the address is actually free, and stop lying about it

codeslake
and
claude
committed
4b74737
fix(holder): unblock the restart ladder, quieten the standby, and guard the tunnel edges

codeslake
and
claude
committed
3f088b3
perf(holder): cut the stall a request pays when the whole lineage dies

codeslake
and
claude
committed
c1c3e89
perf(holder): take the address the instant the holder is gone, not once it is proven free

codeslake
and
claude
committed
cc02354
fix(health): fingerprint the launcher LAYER, so a relay-only change is visible

codeslake
and
claude
committed
c3e3603
fix(health): walk the launcher directory instead of naming its files

codeslake
and
claude
committed
7bfe731
fix(holder): a surplus run-service must leave, not compete for the address

codeslake
and
claude
committed
412124a
fix(health): keep the suite's own stand-ins out of the layer fingerprint

codeslake
and
claude
committed
bcf5165
test(held-port): keep the 503 body, so a red run names which of the two answered

codeslake
and
claude
committed
167a42b
test(held-port): stop the fixtures leaking a corp proxy's address into a red run

codeslake
and
claude
committed
cc283bf
test(held-port): one definition of what counts as an outage, not four

codeslake
and
claude
committed
3effcdb
test(handover): answer the split-request hop once, not once per read

codeslake
and
claude
committed
da2ffa4
test: make the write-after-end shape impossible to paste back in

codeslake
and
claude
committed
6cc8c5b
fix: a deploy that changes nothing, and a /health field that names the wrong hop

codeslake
and
claude
committed
7440a9c
fix: CACHE_FIX_REQUIRE_HOP guarded the tunnel and left the main path open

codeslake
and
claude
committed
33c8951
fix: a fast upstream failure hung the client instead of answering 502

codeslake
and
claude
committed
a7c7622
fix: successorServing asked lsof a narrower question than it asked /proc

codeslake
and
claude
committed
eca7ad9
test: prove the client-abandon abort is load-bearing, after two tries that did not

codeslake
and
claude
committed
570fea4
fix: port 0 was made reachable without being made to work

codeslake
and
claude
committed
ba143de
fix: the gap relay took one hop from the chain and called that the chain

codeslake
and
claude
committed
cd1708c
fix: an emptied chain kept publishing the hop it no longer had

codeslake
and
claude
committed
1befff8
fix: keep the address serving when a probe, a parse, or a spawn fails

codeslake
and
claude
committed
3a0a43a
test(gap-relay): stop the fixture racing its own child for the socket, which hung CI

codeslake
and
claude
committed
a7d97e3
comments: retire the claim that the pin reads our /health fields

codeslake
and
claude
committed
58246d0
proxy: stop announcing a fault on every healthy start

codeslake
and
claude
committed
c4934a6
fix(proxy): a lost stdout/stderr reader must not wedge the proxy

codeslake
and
claude
committed
94e1953
fix(launcher): bound every shell-out, so a sick machine cannot hang the proxy

codeslake
and
claude
committed
bfad124

Commits on Aug 17, 2026

fix(proxy): answer the reviews, and make the guards able to fail

codeslake
and
claude
committed
84e0472
test: let the runner size its own parallelism, so Node 20 CI stops flaking

codeslake
and
claude
committed
cc225f6
test: close three ways the parallelism guard could be walked past

codeslake
and
claude
committed
6d5c9a3