cable_room 0.8.0.beta1 → 0.8.0.beta2

data/lib/cable_room/host/supervisor.rb

@@ -0,0 +1,301 @@
+# frozen_string_literal: true
+
+module CableRoom
+  class Host
+    # The parent process behind `cable_room server --workers N`. It forks N children, runs one
+    # block in each, replaces a child that dies, and passes SIGTERM and SIGINT on to every child
+    # before exiting itself. It never hosts a room, never subscribes the Bus, and never starts a
+    # Host thread: each child builds its own after the fork (`CableRoom.after_fork!`), so nothing
+    # with a socket or a thread behind it is ever shared between processes.
+    #
+    #   Supervisor.new(count: 2, logger: logger) { |index| run_a_host(index) }.run
+    #
+    # The block is the whole child: it runs right after the fork and its return value (an Integer,
+    # or nil for 0) is the child's exit status. The child leaves with `exit!`, so `at_exit` hooks
+    # the parent registered before forking don't run a second time in every child (Resque does
+    # the same for its forked workers). A block that raises is logged and exits 1, which makes
+    # the supervisor replace it.
+    #
+    # Restarts: a child that dies is replaced. One that ran for at least `stable_after` seconds
+    # comes back at once; one that died sooner is treated as failing to boot and comes back
+    # after a delay that doubles from `first_backoff` up to `max_backoff`. The delay only resets
+    # once a replacement stays up `stable_after` seconds, so the fastest any slot can cycle is
+    # once per `stable_after` seconds, and a broken app settles at one fork per slot every
+    # `max_backoff` seconds rather than thousands a second.
+    #
+    # Signals: SIGTERM and SIGINT to the parent are relayed to every live child, and the parent
+    # waits up to `shutdown_timeout` seconds for them to exit, then SIGKILLs whatever is left.
+    # A second SIGTERM or SIGINT while waiting doesn't wait any longer: it SIGKILLs the children
+    # at once. Either way the parent exits 0 once they're all gone. A signal sent to one child
+    # touches only that child: it exits, and the parent replaces it.
+    #
+    # The handlers do nothing but write a line to a pipe; the main loop reads the pipe, so no
+    # real work runs in signal context. SIGCHLD writes the same pipe to wake the loop when a
+    # child exits, and the loop also polls every `POLL_INTERVAL` seconds in case a wake-up is
+    # ever missed.
+    #
+    # If the parent itself dies without relaying anything (SIGKILL, a crash), each child notices
+    # through a second pipe (`watch_parent`) and stops as if it had been sent SIGTERM, so a dead
+    # supervisor never leaves orphaned workers hosting rooms.
+    class Supervisor
+      STOP_SIGNALS = %w[TERM INT].freeze
+      POLL_INTERVAL = 1
+
+      Worker = Struct.new(:index, :pid, :started_at)
+
+      attr_reader :count, :logger
+
+      def initialize(count:, logger:, stable_after: 5, first_backoff: 1, max_backoff: 30, shutdown_timeout: 25, &body)
+        raise ArgumentError, "count must be at least 1 (got #{count.inspect})" unless count.is_a?(Integer) && count >= 1
+        raise ArgumentError, "Supervisor needs a block to run in each worker" unless body
+
+        @count = count
+        @logger = logger
+        @stable_after = stable_after
+        @first_backoff = first_backoff
+        @max_backoff = max_backoff
+        @shutdown_timeout = shutdown_timeout
+        @body = body
+
+        @workers = {}      # index => Worker, for every live child
+        @restart_at = {}   # index => monotonic time to fork a replacement
+        @backoff = {}      # index => the delay used for that slot's last boot failure
+        @stopping = false
+        @kill_at = nil     # monotonic time to SIGKILL children that haven't exited
+      end
+
+      # Fork the workers and supervise them until a stop signal has arrived and every child has
+      # exited. Blocks. Returns the process exit status (0).
+      def run
+        @signal_reader, @signal_writer = IO.pipe
+        @lifeline_reader, @lifeline_writer = IO.pipe
+        previous_traps = install_traps
+
+        count.times { |index| start_worker(index) }
+
+        loop do
+          wait_for_wakeup
+          reap_exited_workers
+          break if @stopping && @workers.empty?
+
+          if @stopping
+            kill_stragglers if now >= @kill_at
+          else
+            start_due_restarts
+          end
+        end
+
+        logger.info "all workers exited"
+        0
+      ensure
+        # If we're leaving for any reason other than "every child is gone" (a bug, say), don't
+        # orphan the children: tell them to stop too. Then hand the signals back.
+        relay("TERM") if @workers.any?
+        previous_traps&.each { |sig, handler| trap(sig, handler) }
+        [@signal_reader, @signal_writer, @lifeline_reader, @lifeline_writer].each { |io| io&.close }
+      end
+
+      # Ask the supervisor to shut down as if `signal` had arrived: relay it to every worker and
+      # exit once they're gone. Safe from any thread and from a trap handler; the work happens on
+      # the thread running `run`.
+      def stop!(signal = "TERM")
+        wake(signal)
+      end
+
+      def stopping?
+        @stopping
+      end
+
+      # Pids of the children alive right now.
+      def worker_pids
+        @workers.values.map(&:pid)
+      end
+
+      private
+
+      # ---- The parent ----------------------------------------------------------------------
+
+      def install_traps
+        (STOP_SIGNALS + %w[CHLD]).to_h do |sig|
+          [sig, trap(sig) { wake(sig) }]
+        end
+      end
+
+      # Runs in signal context, so it does the one thing that's safe there: a non-blocking write
+      # to the pipe. A full pipe means plenty of wake-ups are already queued, so dropping is fine.
+      def wake(signal)
+        @signal_writer&.write_nonblock("#{signal}\n")
+      rescue IO::WaitWritable, IOError, Errno::EPIPE
+        nil
+      end
+
+      # Sleep until a signal or child exit wakes us, a restart or the kill deadline is due, or
+      # the poll interval passes. Any stop signal on the pipe starts (or escalates) the shutdown.
+      def wait_for_wakeup
+        timeout = [POLL_INTERVAL, seconds_until_next_restart, seconds_until_kill].compact.min
+        ready, = IO.select([@signal_reader], nil, nil, timeout)
+        return unless ready
+
+        pending = begin
+          @signal_reader.read_nonblock(4096)
+        rescue IO::WaitReadable, EOFError
+          ""
+        end
+        pending.split("\n").each { |signal| begin_stopping(signal) if STOP_SIGNALS.include?(signal) }
+      end
+
+      def begin_stopping(signal)
+        if @stopping
+          # A second Ctrl-C or TERM: whoever sent it doesn't want to wait for a graceful stop
+          logger.warn "got SIG#{signal} again, killing #{@workers.size} worker(s) now"
+          relay("KILL")
+          @kill_at = Float::INFINITY
+          return
+        end
+
+        @stopping = true
+        @restart_at.clear
+        @kill_at = now + @shutdown_timeout
+        logger.info "got SIG#{signal}, relaying to #{@workers.size} worker(s) and waiting up to #{@shutdown_timeout}s for them"
+        relay(signal)
+      end
+
+      # Past the shutdown deadline: kill what's left, once (the next reap collects them)
+      def kill_stragglers
+        logger.warn "#{@workers.size} worker(s) still running after #{@shutdown_timeout}s, killing them"
+        relay("KILL")
+        @kill_at = Float::INFINITY
+      end
+
+      def relay(signal)
+        @workers.each_value do |worker|
+          Process.kill(signal, worker.pid)
+        rescue Errno::ESRCH
+          nil # already gone; the next reap logs it
+        end
+      end
+
+      def reap_exited_workers
+        @workers.values.each do |worker|
+          status = begin
+            _, status = Process.wait2(worker.pid, Process::WNOHANG)
+            status
+          rescue Errno::ECHILD
+            :unknown # someone else reaped it; treat it as gone
+          end
+          next if status.nil?
+
+          @workers.delete(worker.index)
+          uptime = now - worker.started_at
+          reason = describe_exit(status)
+
+          if @stopping
+            logger.info "worker #{worker.index} (pid #{worker.pid}) #{reason} after #{uptime.round}s"
+          else
+            delay = restart_delay(worker.index, uptime)
+            @restart_at[worker.index] = now + delay
+            logger.warn "worker #{worker.index} (pid #{worker.pid}) #{reason} after #{uptime.round}s; " \
+                        "restarting #{delay.zero? ? 'now' : "in #{delay}s"}"
+          end
+        end
+      end
+
+      def describe_exit(status)
+        return "exited (status unknown)" if status == :unknown
+        return "killed by SIG#{Signal.signame(status.termsig)}" if status.signaled?
+
+        "exited with status #{status.exitstatus}"
+      end
+
+      # A worker that lived a while and then died gets replaced right away. One that died
+      # almost immediately most likely can't boot, so wait, and wait longer each time it happens.
+      def restart_delay(index, uptime)
+        if uptime >= @stable_after
+          @backoff.delete(index)
+          0
+        else
+          @backoff[index] = @backoff[index] ? [@backoff[index] * 2, @max_backoff].min : @first_backoff
+        end
+      end
+
+      def start_due_restarts
+        due = @restart_at.select { |_, at| at <= now }.keys
+        due.each do |index|
+          @restart_at.delete(index)
+          start_worker(index)
+        end
+      end
+
+      def seconds_until_next_restart
+        next_at = @restart_at.values.min
+        next_at && [next_at - now, 0].max
+      end
+
+      def seconds_until_kill
+        @kill_at && [@kill_at - now, 0].max
+      end
+
+      def start_worker(index)
+        pid = fork_worker(index)
+        @workers[index] = Worker.new(index, pid, now)
+        logger.info "forked worker #{index} (pid #{pid})"
+      end
+
+      def now
+        Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      end
+
+      # ---- The child -----------------------------------------------------------------------
+
+      def fork_worker(index)
+        Process.fork do
+          status = 1
+          begin
+            # The child inherits the parent's traps and both ends of its wake-up pipe. Neither
+            # belongs here: a relayed SIGTERM must reach the body's own handler (or kill the
+            # child by default) instead of writing to a pipe nobody in this process reads.
+            (STOP_SIGNALS + %w[CHLD]).each { |sig| trap(sig, "DEFAULT") }
+            @signal_reader.close
+            @signal_writer.close
+            @workers = {}
+
+            # Give up our copy of the lifeline's write end first, so a sibling can never keep the
+            # pipe open after the parent is gone; then watch the read end for the parent's death
+            @lifeline_writer.close
+            watch_parent(@lifeline_reader)
+
+            CableRoom.after_fork!
+
+            result = @body.call(index)
+            status = result.is_a?(Integer) ? result : 0
+          rescue SystemExit => e
+            status = e.status
+          rescue SignalException
+            raise # let Ruby end the process with the signal, so the parent sees which one
+          rescue Exception => e # rubocop:disable Lint/RescueException -- the child must not outlive a broken body
+            logger.error "worker #{index} (pid #{Process.pid}) crashed: #{e.class}: #{e.message}\n  #{e.backtrace&.first(10)&.join("\n  ")}"
+            status = 1
+          end
+
+          $stdout.flush
+          $stderr.flush
+          exit!(status)
+        end
+      end
+
+      # Once every child has closed its copy, the parent holds the only write end of the lifeline
+      # pipe, so a read here returns EOF exactly when the parent is gone: crashed, or SIGKILLed by
+      # the container. A worker must not carry on hosting rooms with nobody supervising it, so it
+      # stops itself the same way a relayed SIGTERM would stop it.
+      def watch_parent(reader)
+        thread = Thread.new do
+          reader.read(1)
+          Process.kill("TERM", Process.pid)
+        end
+        thread.name = "cable_room-supervisor-lifeline"
+        thread.report_on_exception = false
+        thread
+      end
+    end
+  end
+end

data/lib/cable_room/host.rb

@@ -1,6 +1,8 @@
 require_relative 'host/worker_pool'
-require_relative 'host/action_cable_inbound'
+require_relative 'host/bus_inbound'
 require_relative 'host/runner'
+require_relative 'host/supervisor'
+require_relative 'host/placement'
 
 module CableRoom
   # One Host per process. It owns every Room running here: the worker pool their work runs on,
@@ -13,21 +15,72 @@ module CableRoom
   class Host
     BEAT_INTERVAL = 5.seconds
 
+    # Raised when a process that doesn't host rooms asks for its Host. With `room_host = :remote`
+    # only `cable_room server` hosts rooms; a web process must never start one.
+    class NotHosting < StandardError; end
+
+    NOT_HOSTING_MESSAGE =
+      "This process doesn't host rooms: CableRoom.room_host is :remote, so rooms run under " \
+      "`cable_room server`. Start rooms there (or call CableRoom::Host.start! first if this " \
+      "process really should host them).".freeze
+
+    @start_mutex = Mutex.new
+
     class << self
+      # The Host this process runs, or nil when it runs none (a web process in :remote, or an
+      # :inline process that hasn't started a room yet). Use this for introspection and cleanup,
+      # where "no rooms here" is a normal answer.
+      def current
+        @current
+      end
+
+      # The Host this process runs. In :inline every process hosts rooms, so the first caller
+      # builds it. In :remote only a process that declared itself a rooms host with `start!`
+      # (`cable_room server`) has one; anyone else gets NotHosting, so a room can never quietly
+      # start in the web tier because some code path reached for the Host.
       def instance
-        @instance ||= new
+        current || (CableRoom.inline? ? start! : raise(NotHosting, NOT_HOSTING_MESSAGE))
+      end
+
+      # Make this process a rooms host. Builds the Host once, with `options` (see `new`); later
+      # calls return the same one and ignore them. `cable_room server` calls this explicitly; in
+      # :inline `instance` calls it for you.
+      #
+      # In :remote it also starts the Host's Placement, so from then on this process hears
+      # `create: true` members' provision requests and races its peers for their rooms. In :inline
+      # nobody sends those (a member starts its room itself), so there's nothing to listen for.
+      def start!(**options)
+        @start_mutex.synchronize do
+          @current ||= begin
+            host = new(**options)
+            host.start_placement if CableRoom.remote?
+            host
+          rescue StandardError
+            host&.shutdown!
+            raise
+          end
+        end
+      end
+
+      # Swap this process's Host for `host` (nil allowed) and return the previous one. Only specs
+      # that play both process roles in one Ruby process need this: the web side has to see no
+      # Host while another Host runs the rooms.
+      def replace_current(host)
+        @start_mutex.synchronize { @current.tap { @current = host } }
       end
     end
 
-    attr_reader :scheduler, :inbound
+    attr_reader :scheduler, :inbound, :placement
 
     delegate :logger, to: :cable_server
 
-    # `inbound` is how rooms receive messages. Anything with ActionCableInbound's two methods works.
-    def initialize(inbound: ActionCableInbound.new)
+    # `inbound` is how rooms receive messages: by default the process-wide Bus, waiting up to
+    # `subscribe_timeout` seconds for Redis to confirm each room's subscriptions (a room's startup
+    # blocks on that). Anything with BusInbound's two methods works.
+    def initialize(inbound: nil, subscribe_timeout: Bus::DEFAULT_TIMEOUT)
       @runners = Set.new
       @monitor = Monitor.new
-      @inbound = inbound
+      @inbound = inbound || BusInbound.new(timeout: subscribe_timeout)
       @scheduler = Rufus::Scheduler.new
 
       at_exit do
@@ -48,10 +101,46 @@ module CableRoom
       end
     end
 
-    # Start running a room here. The caller (Room::Base.ensure) has already taken the room's
-    # Redlock; the runner renews it from now on and releases it when the room dies.
-    def start_room(room_class, key, lock_info, watchdog_interval:, lock_duration:)
-      runner = Runner.new(self, room_class, key, lock_info, watchdog_interval:, lock_duration:)
+    # Start `room_class`'s room for `key` on this Host if nobody else is running it. Takes the
+    # room's Redlock first, so exactly one process wins; returns false when the lock is held.
+    # `Room::Base.ensure` calls this on the process Host; `cable_room server` (or a spec playing
+    # one) can call it on a Host it owns.
+    #
+    # `tenant` is the Apartment tenant the room runs in. It defaults to the caller's, which is
+    # right for a member's own request thread (:inline). A rooms process has no request tenant,
+    # so whatever starts a room there must pass it. The lock key, the room's stream names, and its
+    # startup all depend on it, so the whole start runs switched into it.
+    def ensure_room(room_class, key = nil, tenant: CableRoom.current_tenant)
+      CableRoom.with_tenant(tenant) do
+        lock_key = room_class.room_port_key(key)
+        # One attempt: a held lock means the room is already running, and retrying (Redlock's
+        # default is 3 retries, 200-250 ms apart) would park the caller's ActionCable worker for
+        # ~0.7 s on every `create: true` member's ping.
+        lock_info = CableRoom.lock_manager.lock(lock_key, room_class::LOCK_DURATION.in_milliseconds, retry_count: 0)
+        next false unless lock_info
+
+        begin
+          start_room(
+            room_class,
+            key,
+            lock_info,
+            watchdog_interval: room_class::WATCH_DOG_INTERVAL,
+            lock_duration: room_class::LOCK_DURATION,
+            tenant: tenant,
+          )
+        rescue => e
+          CableRoom.lock_manager.unlock(lock_info)
+          raise e
+        end
+
+        true
+      end
+    end
+
+    # Start running a room here. The caller (`ensure_room`) has already taken the room's Redlock;
+    # the runner renews it from now on and releases it when the room dies.
+    def start_room(room_class, key, lock_info, watchdog_interval:, lock_duration:, tenant: CableRoom.current_tenant)
+      runner = Runner.new(self, room_class, key, lock_info, watchdog_interval:, lock_duration:, tenant:)
       runner.start!
       runner
     end
@@ -95,6 +184,22 @@ module CableRoom
       @shutdown
     end
 
+    # Start hearing provision requests (see Host::Placement). `Host.start!` does this for a :remote
+    # rooms process; a Host built with `new` (a spec playing one) calls it itself. `options` go to
+    # Placement.new the first time; later calls restart the same Placement.
+    def start_placement(**options)
+      placement = @monitor.synchronize do
+        raise "Cannot start placement after shutdown" if @shutdown
+        @placement ||= Placement.new(self, **options)
+      end
+      placement.start
+    end
+
+    # Stop hearing requests and drop any claim still waiting. Nothing starts a room here after this.
+    def stop_placement
+      @placement&.stop
+    end
+
     # Stop everything: the beat, every room (gracefully, with a bounded wait), then the pool.
     # Runs once; later calls do nothing.
     def shutdown!
@@ -103,6 +208,8 @@ module CableRoom
         @shutdown = true
       end
 
+      # Stop claiming first: a room started after this point would only be shut down again
+      stop_placement
       scheduler.shutdown
       shutdown_rooms!
       worker_pool.executor.shutdown
@@ -110,6 +217,15 @@ module CableRoom
       worker_pool.executor.kill
     end
 
+    # Give this Host up without touching anything it holds. For a copy of a Host that a forked
+    # child inherited from its parent (see `CableRoom.after_fork!`): its rooms, locks, and threads
+    # belong to the parent, so the child must neither close those rooms nor let the `at_exit`
+    # hook above do it when the child exits. Marks it shut down so both are no-ops.
+    def abandon!
+      @shutdown = true
+      self
+    end
+
     # Ask every room to finish what it has queued and shut down, then give them up to
     # `wait` seconds to do it
     def shutdown_rooms!(wait: 15)

data/lib/cable_room/ports.rb

@@ -1,4 +1,17 @@
 module CableRoom
+  # The `ports[...]` DSL shared by a Room and by a member's RoomMembership. A port is a named
+  # lane between a room and its members; `ports[:x] << msg` sends on it and `ports[:x].stream`
+  # listens on it. Which transport that touches depends on which side you're on, and each side
+  # implements the three methods below:
+  #
+  #   * Member side (RoomMembership): sending publishes on the room's Bus channel for the port
+  #     (member→room); listening is an ActionCable stream (room→member).
+  #   * Room side (Room::Base and Room::HostAdapter): sending is an ActionCable broadcast on the
+  #     port's stream; listening subscribes on the Bus through the room's Host.
+  #
+  # So a member's `ports[:custom] << msg` and a room's `ports[:custom].stream` meet on the Bus,
+  # and a room's `ports[:custom] << msg` and a member's `ports[:custom].stream` meet on the
+  # ActionCable stream named by `room_port_key`. Neither side needs to know that.
   module Ports
     extend ActiveSupport::Concern
 
@@ -6,22 +19,19 @@ module CableRoom
       @ports_proxy ||= PortsProxy.new(self)
     end
 
-    # The member side, streaming through its ActionCable channel. Rooms override this (and
-    # close_streamed_ports!) in Room::HostAdapter to listen through their Host::Runner instead.
+    # Listen on `port`, handing each decoded message to the block. Ports streamed with
+    # `auto_close: true` are stopped by `close_streamed_ports!`.
     def stream_port(port, auto_close: true, &blk)
-      @cable_channel.stream_from(room_port_key(port), coder: ActiveSupport::JSON, &blk)
-      _streamed_ports << port if auto_close
+      raise NotImplementedError, "#{self.class} must implement stream_port"
     end
 
     def close_streamed_ports!
-      _streamed_ports.each do |port|
-        @cable_channel.stop_stream_from(room_port_key(port))
-      end
-      _streamed_ports.clear
+      raise NotImplementedError, "#{self.class} must implement close_streamed_ports!"
     end
 
+    # Send `data` on `port`.
     def port_transmit(port, data)
-      ActionCable.server.broadcast(room_port_key(port), data)
+      raise NotImplementedError, "#{self.class} must implement port_transmit"
     end
 
     protected

data/lib/cable_room/railtie.rb

@@ -14,11 +14,17 @@ module CableRoom
     runner do
     end
 
+    # Read CABLE_ROOM_HOST now so a bad value fails the boot, not the first room
+    initializer "cable_room.room_host" do
+      CableRoom.room_host
+    end
+
     initializer "cable_room.hook_action_cable_restart" do
       module ActionCableServerExtensions
-        # ActionCable restarts when the app reloads; stop every room with it
+        # ActionCable restarts when the app reloads; stop every room with it. A process that
+        # hosts no rooms (a web process in :remote) has nothing to stop.
         def restart
-          CableRoom::Host.instance.stop_all_rooms!
+          CableRoom::Host.current&.stop_all_rooms!
           super
         end
       end

data/lib/cable_room/room/base.rb

@@ -10,26 +10,13 @@ module CableRoom
       class << self
         # Start this room in the current process if nobody else is running it. Takes the room's
         # Redlock first, so exactly one process wins; returns false when the lock is held.
-        def ensure(key = nil)
-          lock_key = room_port_key(key)
-          # One attempt: a held lock means the room is already running, and retrying (Redlock's
-          # default is 3 retries, 200-250 ms apart) would park the caller's ActionCable worker for
-          # ~0.7 s on every `create: true` member's ping.
-          lock_info = CableRoom.lock_manager.lock(lock_key, self::LOCK_DURATION.in_milliseconds, retry_count: 0)
-          return false unless lock_info
-
-          Host.instance.start_room(
-            self,
-            key,
-            lock_info,
-            watchdog_interval: self::WATCH_DOG_INTERVAL,
-            lock_duration: self::LOCK_DURATION,
-          )
-
-          true
-        rescue => e
-          CableRoom.lock_manager.unlock(lock_info) if lock_info
-          raise e
+        # `tenant` defaults to the caller's (see Host#ensure_room).
+        #
+        # Only a process that hosts rooms can do this: every process in :inline, and only
+        # `cable_room server` in :remote. Anywhere else `Host.instance` raises Host::NotHosting
+        # rather than letting a room start where it doesn't belong.
+        def ensure(key = nil, tenant: CableRoom.current_tenant)
+          Host.instance.ensure_room(self, key, tenant: tenant)
         end
 
         # The stream name for a room, or for one of its ports: "RoomClass:key" or
@@ -42,14 +29,23 @@ module CableRoom
           stream_namer.broadcasting_for(full_key)
         end
 
+        # The Bus channel members publish on to reach a room's inbound `port`, and the one the
+        # room's Host subscribes to for it: `cr:{room_port_key}:in` for the main port and
+        # `cr:{room_port_key}:in:{port}` for a custom one (see Bus.inbound_channel).
+        def inbound_channel(room_key, port = ROOM_IN_CHANNEL)
+          port = port.to_s == ROOM_IN_CHANNEL.to_s ? nil : port.to_s
+          Bus.inbound_channel(self, room_key, port)
+        end
+
+        # Send a message to a room from anywhere in the app: the same Bus channel a member uses
         def send_message(room_key, data, port: ROOM_IN_CHANNEL)
-          ActionCable.server.broadcast(room_port_key(room_key, port), data)
+          CableRoom.bus.publish(inbound_channel(room_key, port), data)
         end
 
+        # Every instance of this room class running in this process. Empty when the process
+        # hosts no rooms (a web process in :remote).
         def locally_running_instances
-          Host.instance.runners.select do |runner|
-            runner.room_class == self
-          end.map(&:room)
+          Room.locally_open_rooms.select { |room| room.class == self }
         end
 
         private
@@ -97,6 +93,13 @@ module CableRoom
         port_transmit(ROOM_OUT_CHANNEL, data)
       end
 
+      # The room's sending side of Ports: room→member messages go out as an ActionCable
+      # broadcast on the stream named by `room_port_key(port)`. (The listening side is in
+      # Room::HostAdapter.) Public because `ports[:x] << msg` reaches it through a PortProxy.
+      def port_transmit(port, data)
+        ActionCable.server.broadcast(room_port_key(port), data)
+      end
+
       protected
 
       def room_class

data/lib/cable_room/room/host_adapter.rb

@@ -23,22 +23,27 @@ module CableRoom
         end
       end
 
-      # The room side of Ports#stream_port: listen on this room's inbound stream for `port`.
-      # `on_live` runs once the subscription is confirmed.
+      # The room's listening side of Ports: subscribe, through the Host, to the Bus channel
+      # members publish on for `port` (see Room::Base.inbound_channel). `on_live` runs once the
+      # subscription is confirmed.
       def stream_port(port, auto_close: true, on_live: nil, &blk)
-        @runner.subscribe(room_port_key(port), coder: ActiveSupport::JSON, on_live: on_live, &blk)
+        @runner.subscribe(inbound_channel(port), on_live: on_live, &blk)
         _streamed_ports << port if auto_close
       end
 
       def close_streamed_ports!
         _streamed_ports.each do |port|
-          @runner.unsubscribe(room_port_key(port))
+          @runner.unsubscribe(inbound_channel(port))
         end
         _streamed_ports.clear
       end
 
       protected
 
+      def inbound_channel(port)
+        self.class.inbound_channel(key, port)
+      end
+
       def start_periodic_timer(callback, every:)
         @runner.start_periodic_timer(-> { instance_exec(&callback) }, every: every)
       end

data/lib/cable_room/room.rb

@@ -20,8 +20,10 @@ module CableRoom
       autoload :Broadcasting
     end
 
+    # Every room running in this process. Asking never creates a Host, so a process that hosts
+    # no rooms (a web process in :remote) gets an empty list.
     def self.locally_open_rooms
-      Host.instance.rooms
+      Host.current&.rooms || []
     end
   end
 end