Recover local Sendico session after BFF network restarts (#57)

infra/local/scripts/bootstrap.sh

@@ -81,7 +81,7 @@ provision_agents() {
   if [ "$service" != sendico ] && ! cmp -s "infra/local/vault/$service.hcl" "$directory/config.hcl"; then
    cat "infra/local/vault/$service.hcl" | write "$directory/config.hcl" 444
    if compose ps --status running --services "$service" | grep -qx "$service"; then
-    compose up -d --no-deps --force-recreate --wait --wait-timeout 120 "$service"
+    recreate_services 120 "$service"
    fi
   fi
  done

infra/local/scripts/common.sh

@@ -21,6 +21,19 @@ compose() {
   docker compose --project-directory . -f infra/local/compose.yml --env-file "$STATE/images.env" "$@"
  fi
 }
+# A recreated BFF has a new container ID. Recreate its namespace-sharing session
+# in the same Compose operation so neither waits on the other's old namespace.
+recreate_services() {
+ recreate_timeout=$1; shift
+ case " $* " in
+  *' bff '*)
+   if [ -f "$STATE/sendico/settings.env" ]; then
+    case " $* " in *' sendico '*) ;; *) set -- "$@" sendico;; esac
+   fi
+   ;;
+ esac
+ compose up -d --no-deps --force-recreate --wait --wait-timeout "$recreate_timeout" "$@"
+}
 write() {
  target=$1; mode=${2:-600}
  mkdir -p "$(dirname "$target")"

infra/local/scripts/rotation.sh

@@ -10,7 +10,9 @@ rotation() (
   for pid in $workers; do wait "$pid" || true; done
   restore_failed=0
   vault database/roles/bff POST < "$WORK/original-role" >/dev/null || { echo 'ERROR: restore BFF role TTL manually' >&2; restore_failed=1; }
-  for service in frontend bff; do
+  restore_services='frontend bff'
+  if [ -f "$STATE/sendico/settings.env" ]; then restore_services='frontend sendico bff'; fi
+  for service in $restore_services; do
    if ! grep -qx "$service" "$WORK/running"; then compose stop "$service"; compose rm -f "$service"; fi
   done
   return "$restore_failed"
@@ -19,7 +21,7 @@ rotation() (
  trap 'exit 130' INT
  trap 'exit 143' TERM
  jq '.+{default_ttl:"12s",max_ttl:"24s"}' "$WORK/original-role" | vault database/roles/bff POST >/dev/null
- compose up -d --no-deps --force-recreate --wait --wait-timeout 90 bff frontend
+ recreate_services 90 bff frontend
  export_ca
  https -f https://localhost:5126/ > "$WORK/index"
  grep -q flutter_bootstrap "$WORK/index" || fail 'Frontend bundle is not served'

infra/local/scripts/test.sh

@@ -4,10 +4,48 @@ set -o pipefail
 # Shell syntax and static analysis cover the actual container shell scripts.
 shellcheck -s ash -x -S warning infra/local/scripts/dispatch.sh infra/local/scripts/test.sh
 shellcheck -x -S warning infra/local/tools.sh infra/local/scripts/start-service.sh infra/local/mongo/start.sh infra/local/nats/start.sh infra/local/vault/start.sh
-shellcheck -s ash -x -S warning infra/local/sendico/session.sh infra/local/sendico/check.sh
+shellcheck -s ash -x -S warning infra/local/sendico/session.sh infra/local/sendico/check.sh infra/local/sendico/network.sh
 . infra/local/scripts/common.sh
 . infra/local/scripts/images.sh
 . infra/local/scripts/bootstrap.sh
+# A transient DNS failure must reset the recovery counter, while sustained loss
+# must terminate only the owning session process so Docker can reattach it.
+(
+ . infra/local/sendico/network.sh
+ network_calls=0; network_recovered=0
+ sleep() { :; }
+ timeout() { [ "$1" = 5 ] || exit 1; shift; "$@"; }
+ getent() {
+  [ "$*" = 'hosts vault' ] || exit 1
+  network_calls=$((network_calls+1))
+  [ "$network_calls" = 3 ]
+ }
+ kill() {
+  [ "$*" = '-TERM 1234' ] && [ "$network_calls" = 6 ] || exit 1
+  network_recovered=1
+ }
+ watch_network 1234 2> "$WORK/network-recovery"
+ [ "$network_recovered" = 1 ] || exit 1
+ grep -q 'reattach BFF network' "$WORK/network-recovery"
+ for invalid_parent in '' 0 00 invalid; do
+  if watch_network "$invalid_parent"; then exit 1; fi
+ done
+)
+echo 'PASS: session network recovery tolerates transient DNS failures and targets its parent after sustained loss'
+(
+ STATE="$WORK/recreate-state"; mkdir -p "$STATE/sendico"
+ compose() { printf '%s\n' "$*" > "$WORK/recreate-command"; }
+ recreate_services 90 bff frontend
+ grep -qx 'up -d --no-deps --force-recreate --wait --wait-timeout 90 bff frontend' "$WORK/recreate-command"
+ touch "$STATE/sendico/settings.env"
+ recreate_services 90 bff frontend
+ grep -qx 'up -d --no-deps --force-recreate --wait --wait-timeout 90 bff frontend sendico' "$WORK/recreate-command"
+ recreate_services 120 bff sendico
+ grep -qx 'up -d --no-deps --force-recreate --wait --wait-timeout 120 bff sendico' "$WORK/recreate-command"
+ recreate_services 120 notifications
+ grep -qx 'up -d --no-deps --force-recreate --wait --wait-timeout 120 notifications' "$WORK/recreate-command"
+)
+echo 'PASS: BFF recreation pairs its configured session exactly once and preserves unrelated service scope'
 # Offline fixtures exercise stable selection, reject prereleases, and preserve pins.
 get() {
  case "$1" in