v0.6.2

Upgrading from v0.6.1 can use a rolling update.

- An output gate of a running handler is now admitted during a deploy swap.
  Before this change, the handler could block the swap until the swap's
  maximum age cancelled it.
- A one-follower node-log ensemble now recruits a second follower when a
  peer becomes available. Before this change, it stayed at one follower.
- When a handler fails on the node that owns a Durable Object, a forwarded
  `stub.fetch()` now rejects as it does for a local owner, and celld does not
  run the handler again. Before this change, the caller got a 500 response.
- LTX capture now recovers a WAL with a torn header when a database opens.
  Before this change, a later write could hide the torn header.
- An abandoned eviction no longer leaves background compaction paused for
  that cell, because the pause now ends with the handoff attempt.
- Epoch GC now runs on bucket-durability nodes as well as fleet nodes. A
  newly seen cell now waits behind overdue cells in the GC queue.
- WebSocket events now reach the Durable Object facet that accepted the
  socket. An outbound WebSocket that a facet opens now routes through the
  facet's root.
- A Worker response that carries a WebSocket for a request that did not
  upgrade now fails with a 500 and a `TypeError`, as in workerd.
- A fetch to a dynamically loaded Worker now honors the caller's
  `AbortSignal`.
- `self` is now defined as the global scope. A plain class that extends no
  runtime base can now be started as a Durable Object facet.
- A `celld dev` project without a `.dev.vars` file now reads Worker variables
  from `.env` and then `.env.local`, as `wrangler dev` does. The dotenv parser
  now accepts `export NAME=value` lines and quoted values that span several
  lines.
- The container image now includes `LICENSE` and a new `NOTICE` file under
  `/usr/share/doc/celld/`.

Co-authored-by: Ryan Dahl <ry@tinyclouds.org>
Co-authored-by: Yusuke "Taka" Tanaka <yusuktan@maguro.dev>
Co-authored-by: Josh Collinsworth <joshuajcollinsworth@gmail.com>
Co-authored-by: Bert Belder <bertbelder@gmail.com>

Author: 5 people

.github/workflows/release.yml

@@ -126,12 +126,14 @@ jobs:
           path: assets
           merge-multiple: true
 
-      # Assets are minimal: the binaries, nothing else. Integrity is the
-      # attestation plus GitHub's own immutable per-asset digests; gzip's
-      # CRC catches corruption in transit.
+      # Assets are minimal: the binaries plus LICENSE and NOTICE, which
+      # the third-party licenses require to travel with them. Integrity is
+      # the attestation plus GitHub's own immutable per-asset digests;
+      # gzip's CRC catches corruption in transit.
       - name: Check assets
         run: |
           set -euo pipefail
+          cp LICENSE NOTICE assets/
           cd assets
           for target in \
             x86_64-unknown-linux-gnu \

Cargo.lock

@@ -42,5 +42,6 @@ ARG CELLD_VERSION=unknown
 LABEL org.opencontainers.image.title="celld" \
       org.opencontainers.image.revision="${CELLD_COMMIT}" \
       org.opencontainers.image.version="${CELLD_VERSION}"
+COPY LICENSE NOTICE /usr/share/doc/celld/
 COPY --from=test /out/celld /usr/local/bin/celld
 ENTRYPOINT ["/usr/local/bin/celld"]

Dockerfile

@@ -0,0 +1,28 @@
+celld
+Copyright 2026 Deno Land Inc.
+
+celld is licensed under the Apache License 2.0; see LICENSE. Code adapted
+from Tokio is under the MIT License; see the header of
+crates/celld/tokio_select.rs.
+
+Third-party software
+--------------------
+
+celld uses lol_html, Cloudflare's HTML rewriting library (BSD-3-Clause,
+https://github.com/cloudflare/lol-html), to implement the HTMLRewriter
+API. lol_html depends on the following crates from the Servo project,
+which are licensed under the Mozilla Public License 2.0
+(https://mozilla.org/MPL/2.0/). celld binaries include them unmodified;
+cssparser-macros runs only at build time. Their source code is available
+at:
+
+  cssparser          https://crates.io/crates/cssparser
+  cssparser-macros   https://crates.io/crates/cssparser-macros
+  dtoa-short         https://crates.io/crates/dtoa-short
+  selectors          https://crates.io/crates/selectors
+
+The exact versions are recorded in Cargo.lock.
+
+All other dependencies are under permissive licenses (Apache-2.0, MIT,
+BSD-3-Clause, ISC, Unicode-3.0, Zlib, BSL-1.0, CC0-1.0,
+CDLA-Permissive-2.0); Cargo.lock lists them.

LICENSE.tokio

@@ -1,6 +1,6 @@
 [package]
 name = "celld"
-version = "0.6.1"
+version = "0.6.2"
 edition = "2021"
 rust-version = "1.94.1"
 license = "Apache-2.0"

NOTICE

@@ -390,6 +390,17 @@ impl Ownership {
     }
 }
 
+/// The identity that lets a request finish on a quiescing resident, where an
+/// ordinary request waits for the successor route. One field holds it, so a
+/// request cannot claim two identities.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum ResidentWork {
+    /// An event from this exact registered WebSocket.
+    WebSocket(u64),
+    /// The output gate for an effect that the cell's running work raised.
+    OutputGate,
+}
+
 pub enum Message {
     /// A periodic resource sample. The measuring is the shell's job; every
     /// decision that follows belongs to the core.
@@ -436,10 +447,9 @@ pub enum Message {
         /// settles this channel as soon as the ownership CAS is authoritative;
         /// the ordinary route reply remains pending until it is cancelled.
         handoff_accept: Option<HandoffAcceptWaiter>,
-        /// An event from this exact registered WebSocket can finish on a
-        /// quiescing resident. Ordinary requests carry no identity and wait
-        /// for the successor route.
-        websocket: Option<u64>,
+        /// Work that can finish on a quiescing resident. Ordinary requests
+        /// carry none and wait for the successor route.
+        resident_work: Option<ResidentWork>,
         reply: oneshot::Sender<Result<Routed, RequestError>>,
     },
     /// A caller disappeared before routing finished. The request identity is
@@ -1281,6 +1291,13 @@ impl AppHandle {
         self.request_with_mode(cell, false, None).await
     }
 
+    /// Route the output gate for an effect raised inside one of `cell`'s
+    /// handlers. See `ResidentWork::OutputGate`.
+    pub async fn gate_request(&self, cell: String) -> Result<Routed, RequestError> {
+        self.request_with_mode(cell, false, Some(ResidentWork::OutputGate))
+            .await
+    }
+
     /// Route one test request and retain which asynchronous seam produced the
     /// result. The shipping method keeps its compact public result, while this
     /// receipt prevents an inference from `NodeFenced` or an error string.
@@ -1313,16 +1330,21 @@ impl AppHandle {
         cell: String,
         websocket: u64,
     ) -> Result<Routed, RequestError> {
-        self.request_with_mode(cell, false, Some(websocket)).await
+        self.request_with_mode(cell, false, Some(ResidentWork::WebSocket(websocket)))
+            .await
     }
 
     async fn request_with_mode(
         &self,
         cell: String,
         capacity_handoff: bool,
-        websocket: Option<u64>,
+        resident_work: Option<ResidentWork>,
     ) -> Result<Routed, RequestError> {
-        match self.request_path(cell, capacity_handoff, websocket).await.1 {
+        match self
+            .request_path(cell, capacity_handoff, resident_work)
+            .await
+            .1
+        {
             RequestPathOutcome::Returned(result) => result,
             RequestPathOutcome::SubmissionFailure | RequestPathOutcome::ReplyChannelClosed => {
                 Err(RequestError::NodeFenced)
@@ -1334,7 +1356,7 @@ impl AppHandle {
         &self,
         cell: String,
         capacity_handoff: bool,
-        websocket: Option<u64>,
+        resident_work: Option<ResidentWork>,
     ) -> (u64, RequestPathOutcome) {
         let request = crate::asyncrt::next_core_request();
         let (reply, receive) = oneshot::channel();
@@ -1345,7 +1367,7 @@ impl AppHandle {
                 cell,
                 capacity_handoff,
                 handoff_accept: None,
-                websocket,
+                resident_work,
                 reply,
             })
             .is_err()
@@ -1383,7 +1405,7 @@ impl AppHandle {
                     released_epoch,
                     reply: accept_reply,
                 }),
-                websocket: None,
+                resident_work: None,
                 reply: route_reply,
             })
             .is_err()
@@ -2684,7 +2706,7 @@ impl Actor {
                 cell,
                 capacity_handoff,
                 handoff_accept,
-                websocket,
+                resident_work,
                 reply,
             } => {
                 self.pending.insert(request, reply);
@@ -2695,14 +2717,20 @@ impl Actor {
                 self.begin_route_if_cold(&cell);
                 self.request_cells.insert(request, cell.clone());
                 self.drive(
-                    if let Some(websocket) = websocket {
+                    if let Some(ResidentWork::WebSocket(websocket)) = resident_work {
                         Event::WebSocketRequestAt {
                             request,
                             cell: cell.clone(),
                             websocket,
                             now_ms: now_ms(),
                             now_mono_ms: crate::asyncrt::mono_ms(),
                         }
+                    } else if resident_work == Some(ResidentWork::OutputGate) {
+                        Event::GateRequestAt {
+                            request,
+                            cell: cell.clone(),
+                            now_mono_ms: crate::asyncrt::mono_ms(),
+                        }
                     } else if ownership_handoff {
                         Event::HandoffRequestAt {
                             request,

crates/celld/Cargo.toml

@@ -344,7 +344,7 @@ pub(crate) fn gc_options_from_arguments(
     if !dry_run {
         bail!(
             "celld cell gc deletes nothing itself; pass --dry-run to report what the owners \
-             would delete, and give CELLD_LTX_RETENTION_SECS a positive value on the fleet to \
+             would delete, and give CELLD_LTX_RETENTION_SECS a positive value on the nodes to \
              let them"
         );
     }
@@ -366,12 +366,13 @@ and prints the candidates: the epochs below the chain's base, except the
 newest epoch, the epoch before it, and each epoch whose newest object is
 younger than the grace. This command reads the bucket and writes nothing.
 
-The owners delete fewer, later, or none: only a fleet node with a
-positive CELLD_LTX_RETENTION_SECS deletes, with that grace instead of
---grace-secs; a paged cell waits until its local file is complete; an
-inactive cell waits until it is active again; a cell that is not paged
-waits until its activation has a write, so a cell that is only read
-deletes nothing; and one pass deletes at most 64 epochs of a cell.
+The owners delete fewer, later, or none: only a node with a positive
+CELLD_LTX_RETENTION_SECS deletes, in either CELLD_DURABILITY mode, with
+that grace instead of --grace-secs; a paged cell waits until its local
+file is complete; an inactive cell waits until it is active again; a cell
+that is not paged waits until its activation has a write, so a cell that
+is only read deletes nothing; and one pass deletes at most 64 epochs of a
+cell.
 
 OPTIONS:
   --dry-run           Required; report without deleting