# deploy/

Operational scripts, versioned here but **executed from outside this repository**.

A node's runtime directory (`/home/dev/lightwalletd`) holds only the binary and
its logs. The supervisor scripts live in `/home/dev/`:

| repo (source of truth) | deployed to        | invoked by                |
|------------------------|--------------------|---------------------------|
| `deploy/monitor_lwd.sh`| `/home/dev/monitor_lwd.sh` | `/home/dev/lwd_watchdog.sh` (cron, primary) |

## Why they are not run from here

This repository's working tree used to *be* the runtime directory, and
`monitor_lwd.sh` — the primary's live supervisor — was a tracked file inside it.
On 2026-08-26 a routine `git reset --hard` during an unrelated cherry-pick
reverted it to an older committed revision that (a) dropped `-cache-size 5000`,
making every relaunch warm the block cache from tip-400000, and (b) reintroduced
`wait "$LWD_PID" || true; EXIT_CODE=$?`, which reads the exit status of `|| true`
and is therefore always 0, so the monitor logged "exited cleanly. Not restarting."
and broke its loop on every exit including crashes — the bug behind an 11h48m
outage on 2026-08-21.

Nothing noticed at the time because the running monitor was executing an
already-deleted inode: the working copy was broken while the live process was
fine. It was recovered from `/proc/<pid>/fd/255`.

Deploying these from outside the working tree means no checkout, reset, rebase or
branch switch can reach a running supervisor.

## Changing one

Edit it here, commit, then copy to the node and let the next relaunch pick it up:

    cp deploy/monitor_lwd.sh /home/dev/monitor_lwd.sh.stage
    chmod 755 /home/dev/monitor_lwd.sh.stage
    mv -f /home/dev/monitor_lwd.sh.stage /home/dev/monitor_lwd.sh

`mv`, not `cp`: a rename cannot disturb a running process, and the currently
running monitor keeps its own inode until it next restarts.