Bun 1.2 Cluster Mode Worker Zero-Downtime Socket Handoff Standard

--- description: Bun 1.2 Cluster Mode Worker Zero-Downtime Socket Handoff Standard - Mandates deterministic zero-downtime socket handoff and file descriptor preservation across Bun 1.2 supervisor and worker processes. Guarantees zero dropped TCP connections during rolling reloads through SO_REUSEPORT socket sharing, IPC readiness handshakes, and graceful connection draining via Bun.serve. globs: src/**/*.ts, server/**/*.ts, cluster/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/bun-cluster-socket-handoff-zero-downtime-standard" --- # Bun 1.2 Cluster Mode Worker Zero-Downtime Socket Handoff Standard > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: Uncoordinated Worker Termination and Socket Unbinding During Rolling Reloads Causing ECONNRESET ## System Constraints You are a Principal Engineer enforcing the Bun 1.2 Cluster Mode Worker Zero-Downtime Socket Handoff Standard. Mandate that supervisor processes maintain listening socket integrity, workers bind via SO_REUSEPORT or explicit file descriptor inheritance, and old worker generations drain existing connections via server.stop(false) only after new workers signal an operational IPC ready state. ## Strict Guidelines - Engineers MUST ALWAYS enable 'reusePort: true' in Bun.serve() when running concurrent cluster worker processes across identical listening ports. - Engineers MUST NOT send termination signals (SIGTERM/SIGKILL) to existing worker processes until the incoming replacement worker explicitly communicates IPC readiness. - Services MUST invoke 'server.stop(false)' to initiate graceful draining of active TCP connections without abruptly rejecting in-flight HTTP requests. - Supervisor processes MUST enforce an upper-bound drain timeout (e.g., 30s) before escalating to a forceful SIGKILL on lagging worker processes. - Workers NEVER unbind listening sockets synchronously on SIGUSR2/SIGHUP without allowing replacement workers to fully attach and begin accepting connections. ## Bad vs Good Implementations ### Supervisor & Worker Rolling Reload Pattern in Bun 1.2 #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Terminating the active worker before the replacement worker has bound the port and established listen state creates an inevitable TCP connection gap where incoming SYN packets are refused. ```typescript import { spawn } from "bun"; // ANTI-PATTERN: Naive worker rotation killing before bind readiness let currentWorker = spawn(["bun", "run", "src/worker.ts"], { stdio: ["inherit", "inherit", "inherit", "ipc"] }); process.on("SIGHUP", () => { // Abruptly kills current worker before new worker is bound; results in connection drops (ECONNREFUSED) currentWorker.kill(); currentWorker = spawn(["bun", "run", "src/worker.ts"], { stdio: ["inherit", "inherit", "inherit", "ipc"] }); }); ``` #### Production Standard (Correct) > **Standard**: Utilizes SO_REUSEPORT for seamless dual-binding, defers retirement until the new worker sends 'WORKER_READY' over IPC, and drains existing connections gracefully using Bun.serve's server.stop(false). ```typescript import { spawn, type Subprocess } from "bun"; // PRODUCTION FIX: Readiness-gated rolling handoff with SO_REUSEPORT & graceful draining let activeWorker: Subprocess | null = null; async function spawnWorker(): Promise<Subprocess> { return new Promise((resolve) => { const worker = spawn(["bun", "run", "src/worker.ts"], { stdio: ["inherit", "inherit", "inherit", "ipc"], ipc(message) { if (message === "WORKER_READY") { resolve(worker); } }, }); }); } async function reload(): Promise<void> { const nextWorker = await spawnWorker(); if (activeWorker) { const retiringWorker = activeWorker; retiringWorker.send("DRAIN_AND_EXIT"); setTimeout(() => { try { retiringWorker.kill(); } catch {} }, 30000).unref(); } activeWorker = nextWorker; } activeWorker = await spawnWorker(); process.on("SIGHUP", reload); // Inside src/worker.ts: // const server = Bun.serve({ port: 3000, reusePort: true, fetch(req) { return new Response("OK"); } }); // process.send?.("WORKER_READY"); // process.on("message", async (msg) => { // if (msg === "DRAIN_AND_EXIT") { // server.stop(false); // Drains active connections gracefully // process.exit(0); // } // }); ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Bun 1.2 Cluster Mode Worker Zero-Downtime Socket Handoff Standard

Bun 1.2 Cluster Mode Worker Zero-Downtime Socket Handoff Standard defines an industrial-grade behavioral standard for backend engineering. Mandates deterministic zero-downtime socket handoff and file descriptor preservation across Bun 1.2 supervisor and worker processes. Guarantees zero dropped TCP connections during rolling reloads through SO_REUSEPORT socket sharing, IPC readiness handshakes, and graceful connection draining via Bun.serve. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Uncoordinated Worker Termination and Socket Unbinding During Rolling Reloads Causing ECONNRESET Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Uncoordinated Worker Termination and Socket Unbinding During Rolling Reloads Causing ECONNRESET	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enable 'reusePort

Engineers MUST ALWAYS enable 'reusePort: true' in Bun.serve() when running concurrent cluster worker processes across identical listening ports.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.