cronwatch 0.9.0 → 0.11.0

data/lib/cronwatch/cron_pattern.rb

@@ -7,6 +7,8 @@ require_relative "walker"
 module Cronwatch
   # A cron expression's fields, and the next time they match. What is
   # accepted, and which times match, follow croner; Fugit parses the values.
+  #
+  # @api private
   class CronPattern
     NICKNAMES = {
       "@yearly" => "0 0 1 1 *", "@annually" => "0 0 1 1 *", "@monthly" => "0 0 1 * *", "@weekly" => "0 0 * * 0",
@@ -27,14 +29,15 @@ module Cronwatch
 
     def initialize(text)
       fields, dom, dow = croner_fields(text)
-      cron = begin
-        Fugit::Cron.parse(fields.each_with_index.map { |f, i| i == 3 ? dom : (i == 5 ? dow : f) }.join(" "))
-      rescue StandardError
-        nil
-      end
+      # Fugit refuses a date no month has ("30 2"), and drops a month the
+      # days cannot fall in ("31 2,3" reads as March alone). Croner keeps
+      # both, so the days are read with every month and the months with
+      # every day, and a date no month has is a cron that never fires.
+      cron = fugit(fields.each_with_index.map { |f, i| i == 3 ? dom : (i == 4 ? "*" : (i == 5 ? dow : f)) })
+      months = fugit(["0", "0", "0", "*", fields[4], "*"])
       # Croner accepts a few forms Fugit does not read (a range with #, a day of
-      # the month with L after it, a date no month has). Those are refused.
-      raise ArgumentError, "CronPattern: '#{text}' uses a form the Ruby port does not read" unless cron
+      # the month with L after it). Those are refused.
+      raise ArgumentError, "CronPattern: '#{text}' uses a form the Ruby port does not read" unless cron && months
 
       @seconds = flags(cron.seconds, 60, 0)
       @minutes = flags(cron.minutes, 60, 0)
@@ -45,7 +48,7 @@ module Cronwatch
       else
         cron.monthdays.each { |d| @days[d - 1] = true if d.positive? }
       end
-      @months = flags(cron.months, 12, 1)
+      @months = flags(months.months, 12, 1)
       @weekdays = Array.new(7, 0)
       if cron.weekdays.nil?
         @weekdays.fill(ANY_NTH)
@@ -75,6 +78,12 @@ module Cronwatch
 
     private
 
+    def fugit(fields)
+      Fugit::Cron.parse(fields.join(" "))
+    rescue StandardError
+      nil
+    end
+
     def flags(values, size, base)
       return Array.new(size, true) if values.nil?
 

data/lib/cronwatch/deprecation.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Cronwatch
+  # Warns that a name is deprecated: it still works through 1.x and goes in
+  # 2.0. The warning is Ruby's own deprecation category, so it shows where
+  # Ruby's deprecation warnings show (`ruby -w`, `-W:deprecated`, or
+  # `Warning[:deprecated] = true`) and points at the caller's line.
+  #
+  # @api private
+  module Deprecation
+    module_function
+
+    def warn(old, replacement, uplevel: 2)
+      Kernel.warn("[cronwatch] #{old} is deprecated and goes in 2.0; use #{replacement}",
+                  uplevel: uplevel, category: :deprecated)
+    end
+  end
+end

data/lib/cronwatch/duration.rb

@@ -2,6 +2,8 @@
 
 module Cronwatch
   # "15m", "1h30m", "90s", "2d", or a number of milliseconds.
+  #
+  # @api private
   module Duration
     UNIT_MS = { "ms" => 1, "s" => 1000, "m" => 60_000, "h" => 3_600_000, "d" => 86_400_000, "w" => 604_800_000 }.freeze
     PART = Regexp.new("(\\d+(?:\\.\\d+)?)[#{JS::WHITESPACE}]*(ms|s|m|h|d|w)")

data/lib/cronwatch/environment.rb

@@ -1,14 +1,91 @@
 # frozen_string_literal: true
 
 module Cronwatch
-  # The app's environment, read one way everywhere: Rails.env when Rails is
-  # loaded, otherwise RAILS_ENV, then RACK_ENV. The SDK reads NODE_ENV.
+  # The app's environment, read as every CronWatch library reads it: the
+  # first of CRONWATCH_ENV, APP_ENV, then the app's own (Rails.env when Rails
+  # is loaded, else RAILS_ENV, then RACK_ENV) that holds more than spaces,
+  # trimmed and lowercased, with "prod" read as "production" and "dev",
+  # "local", "test" and "testing" as "development". None set is neither,
+  # which is the safe reading. The SDK reads NODE_ENV where this reads the
+  # app's own.
+  #
+  # @api private
   module Environment
-    DEVELOPMENT = %w[development test].freeze
+    # The variables read before the app's own, in order.
+    SHARED = %w[CRONWATCH_ENV APP_ENV].freeze
+    ALIASES = {
+      "prod" => "production", "dev" => "development", "local" => "development", "test" => "development",
+      "testing" => "development",
+    }.freeze
+    private_constant :SHARED, :ALIASES
 
     module_function
 
-    # "production", "development", ... or nil when nothing names one.
+    # "production", "development", "staging", ... or nil when nothing names one.
+    def environment
+      _, value = source
+      return nil if value.nil?
+
+      value = JS.trim(value).downcase
+      ALIASES.fetch(value, value)
+    end
+
+    # Where the environment was read from and its value as set:
+    # ["CRONWATCH_ENV", " dev"], ["Rails.env", "test"], or nil.
+    def source
+      SHARED.each do |variable|
+        value = ENV.fetch(variable, nil)
+        return [variable, value] if present?(value)
+      end
+      if defined?(::Rails) && ::Rails.respond_to?(:env)
+        env = ::Rails.env.to_s
+        return ["Rails.env", env] if present?(env)
+      end
+      %w[RAILS_ENV RACK_ENV].each do |variable|
+        value = ENV.fetch(variable, nil)
+        return [variable, value] if present?(value)
+      end
+      nil
+    end
+
+    def present?(value)
+      !value.nil? && !blank?(value)
+    end
+
+    # Whether a String is empty or only whitespace, as JavaScript's
+    # String.prototype.trim sees it (JS::WHITESPACE). Bytes that are not
+    # UTF-8 are not whitespace.
+    def blank?(value)
+      JS.trim(value.dup.force_encoding(Encoding::UTF_8).scrub).empty?
+    end
+
+    # A secret from the environment (CRONWATCH_TOKEN, CRON_SECRET): nil when
+    # the variable is unset, empty or only whitespace, so a blank value counts
+    # as not set and the routes fail closed. Any other value is used as it
+    # is, untrimmed.
+    def secret(variable)
+      value = ENV.fetch(variable, nil)
+      present?(value) ? value : nil
+    end
+
+    # A token or secret passed in code: a String, or nil. A String that is
+    # empty or only whitespace counts as not given (nil here; the caller
+    # tells that from nil the opt-out). Anything else (false, a number, a
+    # Symbol) raises TypeError naming the option, so it never becomes a
+    # password.
+    def secret_option(value, what)
+      return nil if value.nil?
+      unless value.is_a?(String)
+        kind = [true, false].include?(value) ? value.to_s : value.class.name
+        raise TypeError, "#{what} must be a String, or nil to opt out, not #{kind}"
+      end
+
+      blank?(value) ? nil : value
+    end
+
+    # The framework's own name for the environment, as it sets it: Rails.env
+    # when Rails is loaded, otherwise RAILS_ENV, then RACK_ENV, or nil. The
+    # section of a Solid Queue file is chosen by it, as Solid Queue does.
     def name
       if defined?(::Rails) && ::Rails.respond_to?(:env)
         env = ::Rails.env.to_s
@@ -17,13 +94,38 @@ module Cronwatch
       [ENV.fetch("RAILS_ENV", nil), ENV.fetch("RACK_ENV", nil)].find { |value| value && !value.empty? }
     end
 
-    # Development or test: Cronwatch::Web without a token serves only then.
+    # Development (including test): Cronwatch::Web without a token serves only then.
     def development?
-      DEVELOPMENT.include?(name)
+      environment == "development"
     end
 
     def production?
-      name == "production"
+      environment == "production"
+    end
+
+    # Whether development was named by the app rather than by its server,
+    # for the dashboard's own token (Cronwatch::Web). Puma, Unicorn, Thin
+    # and rackup set RACK_ENV to "development" when nothing names an
+    # environment, so under one of them, in production too, RACK_ENV alone
+    # reads "development". There it takes CRONWATCH_ENV, APP_ENV, Rails.env
+    # or RAILS_ENV to say development; any other value of RACK_ENV that reads
+    # as development ("test", "dev") still counts, as no server sets it.
+    def stated_development?
+      return false unless development?
+
+      variable, value = source
+      return true unless variable == "RACK_ENV" && JS.trim(value).downcase == "development"
+
+      !defaulting_server?
+    end
+
+    # A server that sets RACK_ENV when it is unset is running this process.
+    def defaulting_server?
+      return true if defined?(::Puma::Server) || defined?(::Puma::Launcher) || defined?(::Unicorn::HttpServer) ||
+                     defined?(::Thin::Server) || defined?(::Rackup::Server)
+
+      # Rack 2 autoloads its server: counted only once it has loaded.
+      defined?(::Rack) && ::Rack.const_defined?(:Server, false) && ::Rack.autoload?(:Server).nil?
     end
   end
 end

data/lib/cronwatch/evaluate.rb

@@ -4,6 +4,8 @@ module Cronwatch
   # Pure decisions about a job's health. Each function takes the current state
   # and returns the new state plus the alerts that should go out. Nothing here
   # touches a store or a network, which is what makes it testable.
+  #
+  # @api private
   module Evaluate
     DEFAULT_GRACE_MS = 10 * 60_000
     DEFAULT_TIMEOUT_MS = 60 * 60_000
@@ -35,6 +37,14 @@ module Cronwatch
       [ms, MAX_DURATION_MS].min
     end
 
+    # When a silence of `ms` from `now` ends: a whole millisecond, never past
+    # MAX_DURATION_MS (2**53 - 1), however long the silence asked for. Every
+    # port sharing the store reads it back unchanged, where a larger number
+    # could wrap to a time long past and send alerts during the silence.
+    def silence_end(now, ms)
+      [now + (ms >= MAX_DURATION_MS ? MAX_DURATION_MS : ms.floor), MAX_DURATION_MS].min
+    end
+
     # The version a stored state counts as for compare_and_set_state: its
     # `version` when that is a whole number from 0 to MAX_DURATION_MS
     # (2**53 - 1), else 0, as when it is absent. The SQL stores read it the
@@ -61,28 +71,145 @@ module Cronwatch
       [count, MAX_DURATION_MS].min.to_i
     end
 
+    # A JSON number, as JavaScript's typeof value === "number" sees one
+    # read from JSON: an Integer or a Float (never true or false).
+    def json_number?(value)
+      value.is_a?(Integer) || value.is_a?(Float)
+    end
+
     def empty_state(job)
       JobState.new(job: job, open: {}, consecutive_failures: 0, silenced_until: nil, last_alert_at: nil,
                    pending_recovery: [], undelivered: [])
     end
 
-    # A stored state with every field present, or a fresh one. State written by an older version lacks the newer fields.
+    # A stored state with every field present, or a fresh one. State written
+    # by an older version lacks the newer fields. `sending` is the exception:
+    # it is there only while it holds an alert (see hold_alerts).
+    #
+    # Read leniently, since a foreign, hand-edited or damaged row must affect
+    # only its own job, and the next write puts it right: a state that is not
+    # an object reads as none; `open` keeps only its entries whose value is a
+    # number (anything but an object reads as {}); `silenced_until` and
+    # `last_alert_at` that are not numbers read as nil; `pending_recovery`
+    # keeps only its conditions (strings as stored), and `undelivered` only
+    # its entries that are objects (a list of neither shape reads as []).
+    # Unknown fields are kept as written.
     def normalize_state(state, job)
+      state = JobState.from_h(state)
       return empty_state(job) if state.nil?
 
-      state = JobState.from_h(state)
+      sending = state.sending
+      open = state.open.is_a?(Hash) ? state.open.select { |_, at| json_number?(at) } : {}
+      pending = state.pending_recovery.is_a?(Array) ? state.pending_recovery.grep(Symbol) : []
+      undelivered = state.undelivered.is_a?(Array) ? state.undelivered.grep(Alert) : []
       JobState.new(
         job: state.job.nil? ? job : state.job,
-        open: (state.open || {}).dup,
+        open: open,
         consecutive_failures: failure_count(state),
-        silenced_until: state.silenced_until,
-        last_alert_at: state.last_alert_at,
-        pending_recovery: (state.pending_recovery || []).dup,
-        undelivered: (state.undelivered || []).dup,
+        silenced_until: json_number?(state.silenced_until) ? state.silenced_until : nil,
+        last_alert_at: json_number?(state.last_alert_at) ? state.last_alert_at : nil,
+        pending_recovery: pending,
+        undelivered: undelivered,
         version: state.version,
+        sending: sending.is_a?(Array) && !sending.empty? ? sending.dup : nil,
+        # Fields a newer release wrote, carried through every write.
+        extra: state.extra,
       )
     end
 
+    # ---------------------------------------------------------------- delivery
+
+    # Alerts kept per job for retry, and per job being sent; past it the oldest go.
+    MAX_UNDELIVERED = 20
+
+    # How long an alert in `sending` is left to the process sending it.
+    # Longer than any send takes: at most three alerts go out together, each
+    # with 25 seconds of triage and 15 of channels.
+    SEND_LEASE_MS = 5 * 60_000
+
+    # A state and how many alerts the queue let go to make it.
+    Held = Struct.new(:state, :dropped, keyword_init: true) do
+      def to_h = { "state" => state.to_h, "dropped" => dropped }
+    end
+
+    # Identifies an alert across retries, and in `sending`. `at` is printed
+    # as JavaScript prints a number.
+    def alert_key(alert)
+      at = alert.at
+      run = alert.run
+      "#{alert.type}|#{at.is_a?(Numeric) ? JS.number(at) : at}|#{run.id if run.is_a?(Run)}"
+    end
+
+    # `alerts` added to the undelivered queue: one with the same key as a
+    # queued alert replaces it where it stands, the rest go at the end, and
+    # only the newest MAX_UNDELIVERED stay. `dropped` counts those let go.
+    def queue_undelivered(state, alerts)
+      following = clone_state(state)
+      by_key = alerts.to_h { |alert| [alert_key(alert), alert] }
+      queue = following.undelivered.map { |alert| by_key.fetch(alert_key(alert), alert) }
+      known = queue.to_set { |alert| alert_key(alert) }
+      queue.concat(alerts.reject { |alert| known.include?(alert_key(alert)) })
+      following.undelivered = queue.last(MAX_UNDELIVERED)
+      Held.new(state: following, dropped: [0, queue.length - MAX_UNDELIVERED].max)
+    end
+
+    # The outbox. Alerts just composed are written with the state that opens
+    # their condition, before any is sent, so a process that stops part way
+    # does not lose them: into `sending`, each with its lease ending at
+    # `until_at`, when this process sends them, or (deliver: :check) straight
+    # into the undelivered queue for a check elsewhere. `dropped` counts
+    # alerts let go past MAX_UNDELIVERED.
+    def hold_alerts(state, alerts, until_at, deferred)
+      return Held.new(state: state, dropped: 0) if alerts.empty?
+      return queue_undelivered(state, alerts) if deferred
+
+      following = clone_state(state)
+      entries = (following.sending || []) + alerts.map { |alert| { "until" => until_at, "alert" => alert } }
+      following.sending = entries.last(MAX_UNDELIVERED)
+      Held.new(state: following, dropped: [0, entries.length - MAX_UNDELIVERED].max)
+    end
+
+    # Alerts in `sending` whose lease ran out by `now`: the process sending
+    # them stopped before it recorded how the send went. They go to the
+    # undelivered queue, where the retry sends them (with triage, which is
+    # never stored with them here) or drops them as stale. An entry that is
+    # not a Hash with an alert is dropped; one without a numeric `until`
+    # counts as run out.
+    def release_sending(state, now)
+      sending = state.sending.is_a?(Array) ? state.sending : []
+      lapsed, held = sending.partition { |entry| !(entry.is_a?(Hash) && entry["until"].is_a?(Numeric) && entry["until"] > now) }
+      return Held.new(state: state, dropped: 0) if lapsed.empty?
+
+      kept = state.dup
+      kept.sending = held
+      queue_undelivered(kept, lapsed.filter_map { |entry| sending_alert(entry) })
+    end
+
+    # How a send went. Delivered and stale alerts leave the queue; failed
+    # ones replace their queued copy, so a triage made on this attempt is
+    # kept, or join the queue. Every one of them leaves `sending`.
+    # last_alert_at moves only on a delivery. `dropped` counts alerts let go
+    # past MAX_UNDELIVERED.
+    def record_sent(state, delivered, failed, stale, now)
+      following = clone_state(state)
+      done = (delivered + stale).to_set { |alert| alert_key(alert) }
+      following.undelivered = following.undelivered.reject { |alert| done.include?(alert_key(alert)) }
+      sent = (delivered + failed + stale).to_set { |alert| alert_key(alert) }
+      held = (following.sending || []).reject do |entry|
+        alert = sending_alert(entry)
+        alert && sent.include?(alert_key(alert))
+      end
+      following.sending = held.empty? ? nil : held
+      following.last_alert_at = now if delivered.any?
+      queue_undelivered(following, failed)
+    end
+
+    # The alert of an entry of `sending`, or nil when it has none, or one
+    # that did not parse as an alert (which could not be sent either).
+    def sending_alert(entry)
+      entry.is_a?(Hash) && entry["alert"].is_a?(Alert) ? entry["alert"] : nil
+    end
+
     def clone_state(state)
       normalize_state(state, state.job)
     end
@@ -340,11 +467,19 @@ module Cronwatch
     # is dropped rather than sent late. An alert for a condition is stale once
     # that condition has closed, or has closed and opened again (it opened at a
     # time other than the alert's). A recovery is stale when any condition it
-    # names is open again; while they all stay closed it is kept.
+    # names is open again; while they all stay closed it is kept. From a
+    # foreign or damaged row: an alert whose `at` is not a number, and a
+    # recovery whose `details.after` is not a list of conditions, are stale.
     def stale_alert?(alert, state)
-      return Array(alert.details[:after]).any? { |condition| state.open.key?(condition.to_sym) } if alert.type == :recovered
+      if alert.type == :recovered
+        # One whose details say nothing of what it recovers from cannot be judged, and goes.
+        after = alert.details.is_a?(Hash) ? alert.details[:after] : nil
+        return true unless after.is_a?(Array)
 
-      state.open[alert.type] != alert.at
+        return after.any? { |condition| !condition.is_a?(Symbol) || state.open.key?(condition) }
+      end
+      # One with no time cannot match an open condition.
+      !json_number?(alert.at) || state.open[alert.type] != alert.at
     end
 
     # How a job looks at a glance. Silence wins, then stuck, failing and late.

data/lib/cronwatch/flight.rb

@@ -3,8 +3,14 @@
 module Cronwatch
   class Client
     # One shared check: the first caller runs it, the others wait for its result.
+    #
+    # @api private
     class Flight
+      # The thread running the check.
+      attr_reader :owner
+
       def initialize
+        @owner = Thread.current
         @lock = Mutex.new
         @done = ConditionVariable.new
         @finished = false

data/lib/cronwatch/format.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 module Cronwatch
+  # @api private
   module Format
     NAMED = /\A[A-Za-z_$][A-Za-z0-9_$]*: /
 

data/lib/cronwatch/http.rb

@@ -7,8 +7,15 @@ require "uri"
 module Cronwatch
   # POSTs for the alert channels. Anything with `post(url, body, headers)`
   # returning a Response can stand in for it, which is how the tests run.
+  #
+  # @api private
   module HTTP
     TIMEOUT = 10
+    # The most of an answer's body read (1 MiB): a channel reads 200
+    # characters of a refusal, and a hostile or broken endpoint could
+    # otherwise stream gigabytes into the worker within the deadline.
+    # Reading stops there. A 2xx answer's body is not read at all.
+    MAX_BODY = 1_048_576
 
     Response = Struct.new(:status, :body, keyword_init: true) do
       def ok? = status >= 200 && status < 300
@@ -33,6 +40,8 @@ module Cronwatch
       # sends. Past the deadline before an answer, raises HTTP::TimeoutError;
       # past it while the body is still arriving, returns the answer with an
       # empty body, as the SDK's channels treat a body they could not read.
+      # A 2xx answer comes back with an empty body, unread, since no channel
+      # needs it; any other with at most MAX_BODY bytes of it.
       def post(url, body, headers)
         uri = HTTP.postable(url)
         deadline = HTTP.monotonic + @timeout
@@ -46,7 +55,11 @@ module Cronwatch
           conn.read_timeout = remaining
           conn.write_timeout = remaining
           conn.request(request) do |response|
-            return Response.new(status: response.code.to_i, body: read_body(conn, response, deadline))
+            status = response.code.to_i
+            # Returning from inside the block leaves the rest unread; the connection closes after.
+            return Response.new(status: status, body: "") if status >= 200 && status < 300
+
+            return Response.new(status: status, body: read_body(conn, response, deadline))
           end
         end
       rescue Net::OpenTimeout, Net::ReadTimeout, Net::WriteTimeout
@@ -65,17 +78,20 @@ module Cronwatch
 
       private
 
-      # The body, read in chunks until the deadline; "" when it passes first.
+      # The body, read in chunks until it ends or MAX_BODY bytes have come,
+      # whichever is first; "" when the deadline passes first.
       def read_body(conn, response, deadline)
-        chunks = []
+        body = "".b
         conn.read_timeout = HTTP.remaining(deadline)
         response.read_body do |chunk|
           raise TimeoutError if HTTP.monotonic >= deadline
 
-          chunks << chunk
+          body << chunk.b.byteslice(0, MAX_BODY - body.bytesize)
+          break if body.bytesize >= MAX_BODY
+
           conn.read_timeout = HTTP.remaining(deadline)
         end
-        chunks.join.b
+        body
       rescue Net::ReadTimeout, TimeoutError
         ""
       end

data/lib/cronwatch/job.rb

@@ -95,9 +95,11 @@ module Cronwatch
   end
 
   # Collects a run's output and metrics while its block runs.
+  #
+  # @api private
   class RunRecorder
     # Lines are dropped from the front once the output is well past the cap;
-    # Output.cap trims it exactly at the end.
+    # Output.redact_and_cap trims it exactly at the end.
     KEEP = 64 * 1024
 
     attr_reader :context, :signal
@@ -136,8 +138,11 @@ module Cronwatch
       @lock.synchronize { @metrics[name] = value }
     end
 
+    # The lines still held (past 64 KB the oldest are let go), joined and not
+    # yet capped: the client redacts them first, then caps them
+    # (Output.redact_and_cap).
     def output
-      @lock.synchronize { @lines.empty? ? nil : Output.cap(@lines.join("\n")) }
+      @lock.synchronize { @lines.empty? ? nil : @lines.join("\n") }
     end
 
     # What an expect rule is checked against: everything logged, or when that

data/lib/cronwatch/js.rb

@@ -6,6 +6,8 @@ module Cronwatch
   # webhook bodies, so the gem reproduces them byte for byte: Math.round,
   # String(number), JSON.stringify, String.prototype.trim and lengths counted
   # in UTF-16 code units.
+  #
+  # @api private
   module JS
     # What JavaScript's \s and trim() treat as whitespace.
     WHITESPACE = "\\t\\n\\v\\f\\r \\u00a0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000\\ufeff"
@@ -40,8 +42,10 @@ module Cronwatch
       value - floor >= 0.5 ? floor + 1 : floor
     end
 
+    # Number.isFinite of the number as JavaScript would hold it: an Integer
+    # past a double's range is Infinity there, so it is not finite here.
     def finite?(value)
-      value.is_a?(Integer) || (value.is_a?(Numeric) && value.real? && value.to_f.finite?)
+      value.is_a?(Numeric) && value.real? && value.to_f.finite?
     end
 
     # Number.isInteger.
@@ -159,12 +163,44 @@ module Cronwatch
     end
 
     def quote(text)
+      if text.encoding == Encoding::UTF_8 && !text.valid_encoding? && text.b.match?(LONE)
+        # A lone surrogate (see lone_surrogate), written as JSON.stringify writes one.
+        parts = text.b.split(LONE_SPLIT).each_with_index.map do |part, i|
+          next quote(part.force_encoding(Encoding::UTF_8))[1...-1] if i.even?
+
+          bytes = part.bytes
+          format("\\u%04x", ((bytes[0] & 0x0F) << 12) | ((bytes[1] & 0x3F) << 6) | (bytes[2] & 0x3F))
+        end
+        return "\"#{parts.join}\""
+      end
       text = text.encode(Encoding::UTF_8, invalid: :replace, undef: :replace) unless text.encoding == Encoding::UTF_8 && text.valid_encoding?
       text = text.scrub unless text.valid_encoding?
       escaped = text.gsub(/["\\\u0000-\u001f]/) { |c| ESCAPES[c] || format("\\u%04x", c.ord) }
       "\"#{escaped}\""
     end
 
+    # A surrogate code unit on its own, in the bytes UTF-8 would give it.
+    # They make the string invalid UTF-8, which Ruby's own methods refuse, so
+    # one is only ever the last thing added to text about to be written:
+    # quote writes it as \udXXX, as JSON.stringify does.
+    LONE = /\xED[\xA0-\xBF][\x80-\xBF]/n
+    LONE_SPLIT = /(\xED[\xA0-\xBF][\x80-\xBF])/n
+
+    def lone_surrogate(unit)
+      [0xED, 0x80 | ((unit >> 6) & 0x3F), 0x80 | (unit & 0x3F)].pack("C*").force_encoding(Encoding::UTF_8)
+    end
+
+    # String.prototype.slice(0, units) as JavaScript gives it: the first
+    # `units` UTF-16 code units, and the high surrogate of a pair the cut
+    # splits. Returns the head Ruby can hold (head16) and that surrogate's
+    # code unit, or nil when the cut splits no pair.
+    def slice16(text, units)
+      head = head16(text, units)
+      return [head, nil] if text.ascii_only? || head.length == text.length || length16(head) == units
+
+      [head, 0xD800 + ((text[head.length].ord - 0x10000) >> 10)]
+    end
+
     # Property order: array-index keys ascending, then the rest as inserted.
     def object_keys(hash)
       keys = hash.keys
@@ -184,5 +220,42 @@ module Cronwatch
     def parse(text)
       ::JSON.parse(text)
     end
+
+    DECIMAL = /\A[+-]?(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?\z/
+    RADIX = { "x" => 16, "o" => 8, "b" => 2 }.freeze
+
+    # Number(string): decimal, 0x/0o/0b, Infinity, or NaN; 0 for a string
+    # of only whitespace.
+    def to_number(value)
+      text = trim(value.dup.force_encoding(Encoding::UTF_8).scrub)
+      return 0 if text.empty?
+      # Ruby's Float() wants a digit on both sides of the point; JavaScript does not.
+      return Float(text.sub(/\A([+-]?)\./, "\\10.").sub(/\.(?=[eE]|\z)/, ".0")) if DECIMAL.match?(text)
+      return text.start_with?("-") ? -Float::INFINITY : Float::INFINITY if /\A[+-]?Infinity\z/.match?(text)
+
+      if (m = /\A0([xXoObB])([0-9a-fA-F]+)\z/.match(text))
+        return Integer(m[2], RADIX.fetch(m[1].downcase))
+      end
+
+      Float::NAN
+    rescue ArgumentError
+      Float::NAN
+    end
+
+    # A time or a count of milliseconds as a SQL column holds it: an Integer
+    # or a Float kept, a String that is not blank read as Number() reads it
+    # (Postgres hands BIGINT over as text), and nil when the result is not a
+    # finite number. A whole number in a Float comes back an Integer.
+    def finite_number(value)
+      n =
+        case value
+        when Integer, Float then value
+        when String then trim(value.dup.force_encoding(Encoding::UTF_8).scrub).empty? ? nil : to_number(value)
+        end
+      return nil unless finite?(n)
+      return n.to_i if n.is_a?(Float) && n == n.floor && n.abs <= MAX_SAFE_INTEGER
+
+      n
+    end
   end
 end

data/lib/cronwatch/monitored.rb

@@ -6,6 +6,8 @@ module Cronwatch
   # declared on Cronwatch.client. Needs nothing beyond the core, so Sidekiq
   # without Rails can use it. Loaded by cronwatch/scheduler, which schedule:
   # :from_scheduler and declare_from_scheduler! need.
+  #
+  # @api private
   module Monitored
     # What `cronwatch` is outside a monitored run: it takes log and metric
     # calls and drops them, so the job's code runs the same either way.
@@ -51,7 +53,10 @@ module Cronwatch
         client = Cronwatch.client
         @lock.synchronize do
           current = @registration
-          return current if current && current[0].equal?(client)
+          # Kept while the client still holds the job: one forgotten since
+          # (the dashboard's forget) is declared again, with its schedule,
+          # as the other ports' bridges declare it again before a check.
+          return current if current && current[0].equal?(client) && client.defined_jobs.any? { |d| d.name == @name }
 
           handle = client.job(@name, **resolve_locked)
           @registration = [client, handle].freeze