amadan
edge: a bad static promote is a live outage — stale() has no prior version after a route reload Issue open
Migrated from github.com/carlosframework/platform issue #365, opened 2026-08-29. GitHub issues are closed for this repo; see AGENTS.md, "Work is tracked on amadan, not GitHub".
Still outstanding: A bad static promote is a live outage: stale() has no prior version after a route reload, and extraction buffers the whole tar.
---
Observed 2026-08-29 06:59–07:02 UTC on apt.carlosframework.com (static app bab/apt-carlosframework, flagship IE edge) while cutting v0.17.0.
What happened: a release with a malformed site tarball (a leading ./ directory entry — hand-built with tar -czf … -C site . rather than by carlos ship on the directory) was promoted to canary/apt. extractSiteTar failed on every request (stage v0.17.0-1: open /data/static/bab/apt-carlosframework/.extract-NNN: is a directory) and the edge answered 502 "static site unavailable" on every path for ~3 minutes until a good release was promoted over it.
Expected: staticSite.stale() is documented to keep serving the last good version when a new release fails to stage. It didn't — the handler had no prior version to fall back to, because the edge had restarted at 03:35 UTC and the static handler appears to be rebuilt on route reload, so "last good" was empty. A bad promote is therefore a hard outage, not a degraded stay-on-old.
Also seen: ensureExtracted reads the whole tar (187 MB here) into memory before extracting.
Suggested shape: seed the handler's last-good from the already-extracted on-disk version at reload (they're all kept under /data/static/<acct>/<app>/), so a restart never forgets what was serving; stream the extract. Related: the static extract dir is never GC'd (1.3 G on IE, every version since v0.5.0-1) — release-GC PR #339 covers /opt/carlos/versions only.
🤖 Generated with Claude Code