fix: downgrade transient railway token-refresh failures from ERROR to WARN and continue with valid token #SUPERLOG

[superlog-app]

Summary

When Railway's OAuth token endpoint returns a transient server_error, the worker was logging it as ERROR (triggering an incident) and skipping the entire installation for the current pass — even though the access token is still valid for up to 5 more minutes.

Root cause

The token-refresh block fires when the token has less than TOKEN_REFRESH_MARGIN_MS (5 minutes) remaining. At that point accessToken already holds the valid stored token. On a transient Railway server error the old code returned early, abandoning the still-valid token for the whole pass. Concretely: error: "server_error" is RFC 6749's transient-server-error code — analogous to the status_500 / status_503 values that railway grant refresh failed and railway inventory read failed already handle as WARN with graceful fallback.

Remediation

• On a failed refresh, check whether the stored token has already expired:
  • Not yet expired → log WARN ("continuing with current token"), fall through using installation.accessToken; next pass will retry the refresh.
  • Already expired → log WARN ("token expired — skipping"), return as before; downstream Railway calls would fail anyway.
• Move the accessToken = refreshed.accessToken / saveTokens(...) lines into an else branch so they only execute on a successful refresh.
• Added two new tests in puller.test.ts covering both branches; all 8 tests pass.

---

Incident: yeasty-skunk — ERROR: railway token refresh failed

---

Was this PR helpful? Leave feedback — goes straight to the Superlog team.

---

Summary by cubic

Downgraded transient Railway token refresh failures to WARN and continue using the current valid token, avoiding false incidents and skipped pulls. If the token is already expired, we still skip but log WARN.

• Bug Fixes
  • On refresh server_error with a not-yet-expired token, log WARN and proceed with installation.accessToken.
  • If the token is expired, log WARN and skip; no ERROR logs.
  • Only update accessToken/refreshToken on successful refresh.
  • Added tests covering both paths in apps/worker/src/railway/puller.test.ts.

^{Written for commit 6cf6234. Summary will update on new commits.}

[superlog-app]

Observability review

• 1 warning

[superlog-app]

logs · warning — Record refresh error on the active span when falling through with a valid token

Add span.recordException(new Error(refreshed.error)) (without setting error status, since the pass succeeds) so that traces for passes that used a degraded token are distinguishable from fully healthy passes; without it an operator cannot tell from a trace alone that the token was not refreshed.

Useful? React with 👍 / 👎.