From 713216f4ab553777f1473c1b330d1751f7ab7811 Mon Sep 17 00:00:00 2001
From: Emi Griffith <me@emigriffith.dev>
Date: Fri, 24 Jul 2026 11:48:13 -0700
Subject: [PATCH] Roll the daemon with backend deploys in the Swarm stack
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The backend leg updated web/worker/lake but not daemon, so the first
backend roll after the stack gained the service left the daemon a release
behind web — a version skew across the /internal/* contract that pinning
one BACKEND_IMAGE_TAG exists to prevent. Same tolerate-missing pattern as
lake. Prod's daemon was rolled to the current image by hand.
---
 infra/deploy/stack/deploy-stack.sh | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/infra/deploy/stack/deploy-stack.sh b/infra/deploy/stack/deploy-stack.sh
index 15d8a99..c3badc2 100755
--- a/infra/deploy/stack/deploy-stack.sh
+++ b/infra/deploy/stack/deploy-stack.sh
@@ -166,13 +166,19 @@ else
       echo "==> Rolling web + worker + lake to $BACKEND_IMAGE"
       docker service update --with-registry-auth --detach=false --image "$BACKEND_IMAGE" "${STACK_NAME}_web"
       docker service update --with-registry-auth --detach=false --image "$BACKEND_IMAGE" "${STACK_NAME}_worker"
-      # lake ships in the same image; a stack file predating it has no service
-      # yet — the next SERVICE=all stack deploy creates it, so don't fail here.
-      if docker service inspect "${STACK_NAME}_lake" >/dev/null 2>&1; then
-        docker service update --with-registry-auth --detach=false --image "$BACKEND_IMAGE" "${STACK_NAME}_lake"
-      else
-        echo "   (no ${STACK_NAME}_lake service yet; created on the next full stack deploy)"
-      fi
+      # lake and daemon ship in the same image; a stack file predating either
+      # has no service yet — the next SERVICE=all stack deploy creates it, so
+      # don't fail here. The daemon especially must roll with web: they share
+      # the /internal/* contract, and a version skew between them is exactly
+      # what pinning one BACKEND_IMAGE_TAG exists to prevent (seen live: the
+      # first post-creation backend roll left the daemon a release behind).
+      for extra in lake daemon; do
+        if docker service inspect "${STACK_NAME}_${extra}" >/dev/null 2>&1; then
+          docker service update --with-registry-auth --detach=false --image "$BACKEND_IMAGE" "${STACK_NAME}_${extra}"
+        else
+          echo "   (no ${STACK_NAME}_${extra} service yet; created on the next full stack deploy)"
+        fi
+      done
       ;;
     frontend)
       echo "==> Rolling frontend to $FRONTEND_IMAGE"