kicks_liveness 0.1.0 → 0.1.2

data/docs/DESIGN.md

@@ -40,16 +40,17 @@ outside it can, so let the worker publish and let the probe read.
 
 Every `tick` seconds (10 by default) the worker checks, **in its own memory**,
 that its consumers are still subscribed, and touches a file on tmpfs. The probe
-loads one dependency-free Ruby file, reads the file's mtime, and exits with 0 or
-1.
+loads one dependency-free Ruby file, checks the marks' container generation and
+mtimes, and exits with 0 or 1.
 
 The probe therefore performs no network I/O and boots no framework, and the
-state it reads — the mark's mtime — comes from tmpfs, which is RAM. Be precise
-about the disk, though: starting the probe still loads the Ruby interpreter and
-two files of this gem from the image filesystem, and those reads are ordinary
-filesystem reads (usually served from page cache, but not guaranteed to be). The
-honest claim is not "no disk" but *no application boot, and no disk on the path
-that decides the answer* — which is what removes the defects above, not tuning.
+state it reads — the generation and mark mtimes — comes from procfs and tmpfs.
+Be precise about the disk, though: starting the probe still loads the Ruby
+interpreter and two files of this gem from the image filesystem, and those reads
+are ordinary filesystem reads (usually served from page cache, but not
+guaranteed to be). The honest claim is not "no disk" but *no application boot,
+and no disk on the path that decides the answer* — which is what removes the
+defects above, not tuning.
 
 ## The health predicate
 
@@ -112,6 +113,7 @@ silently. That is the thing to re-check when upgrading Bunny.
 
 ```
 <dir>/expected       how many forks the probe must wait for
+<dir>/generation     which container incarnation wrote this heartbeat
 <dir>/worker-<slot>  one per fork, refreshed every tick the fork is healthy
 <dir>/attempt-<slot> starts of a slot that has not become healthy yet
 ```
@@ -127,6 +129,24 @@ it: if the directory is wiped, `touch!` brings the slot marks back while
 rest of the pod's life. Rewriting it is also what lets a respawned set of forks
 correct a count that has been lowered.
 
+**`generation` closes a container-restart hole when the container owns PID 1.**
+Kubernetes preserves an `emptyDir` when it restarts a container inside the same
+pod. That is useful for an application cache elsewhere in the volume, but a
+fresh heartbeat from the dead process must not let the new container pass its
+one-shot `startupProbe`. On Linux, the worker and exec probe independently
+derive the same incarnation from the container's mount namespace and PID 1
+start time. Both `generation` and every slot mark carry it. Until the new
+container declares itself and every current fork publishes its own mark, files
+inherited from the previous container are rejected. Nothing outside the marks
+directory is removed.
+
+This guarantee assumes Kubernetes' default container-private PID namespace.
+With `shareProcessNamespace: true` PID 1 belongs to the pod sandbox, and with
+`hostPID: true` it is the node init process; neither restarts with the worker
+container. Under either setting the guard can accept an inherited fresh mark.
+Do not enable them on a pod whose startup probe relies on this guarantee; see
+[LIMITATIONS.md](LIMITATIONS.md#container-generations-require-linux-procfs-and-container-owned-pid-1).
+
 **Files are named by supervisor slot, not by PID.** A fork killed with SIGKILL
 is respawned into the same slot and overwrites its own file. Had the name
 contained a PID, that file would sit there stale forever and the probe would
@@ -143,12 +163,13 @@ probe sees either the old value or the new one.
 the single reason that the directory outlives the fork: a monitor caught in a
 respawn loop is a brand-new object every few hundred milliseconds and can hold
 no counter of its own. The file is removed once the slot becomes healthy, so in
-steady state the directory holds only `expected` and the `worker-<slot>` marks;
-what the counter is for is in
+steady state the directory holds `expected`, `generation`, and the
+`worker-<slot>` marks. What the counter is for is in
 [LIMITATIONS.md](LIMITATIONS.md#a-respawn-loop-is-reported-once-per-grace-window-not-once-per-respawn).
 
-The *contents* of `worker-<slot>` (timestamp, pid, slot) exist only for a human
-running `kubectl exec ... cat`. The probe decides on mtime alone.
+The timestamp, pid, and slot in `worker-<slot>` exist for a human running
+`kubectl exec ... cat`. Its generation is part of the probe contract; freshness
+still comes from mtime.
 
 The directory must be on tmpfs — in Kubernetes, an `emptyDir` with
 `medium: Memory`. Put it on a real disk and the probe starts depending on the
@@ -249,7 +270,7 @@ check.
 
 ## What is configurable, and where
 
-| | Where | Why |
+| Setting | Where | Why |
 |---|---|---|
 | `logger`, `enabled`, `startup_grace_ticks` | application config block | only the worker needs them |
 | `tick` | either, and the config block wins | only the worker reads it, so two sources cannot contradict each other |
@@ -281,13 +302,27 @@ makes every mark stale on arrival, so the probe can never pass again. They fall
 back to the default too.
 
 Setting `tick` from the application is held to a stricter standard: a
-non-positive value raises `ArgumentError`. The environment gets a silent fallback
-because a ConfigMap typo must not bring a worker down, whereas an initializer is
-code, and code should fail loudly at boot, where the developer is looking.
+non-positive value raises `ArgumentError`, as does a value greater than or equal
+to `max_age`: such a monitor would inevitably let a healthy mark go stale. The
+environment gets a silent fallback for values that cannot be parsed. If its
+effective tick is greater than or equal to `max_age`, configuration emits a
+warning on stderr and uses the default tick when it is safe, or half of `max_age`
+otherwise. A ConfigMap typo must not bring a worker down, whereas an initializer
+is code and should fail loudly at boot, where the developer is looking.
+
+`startup_grace_ticks` must be a positive integer. It is compared directly with
+an integer counter; accepting zero, a float, or a string would silently disable
+the escalation that is supposed to diagnose a worker that never subscribes.
 
 The logger defaults to `Sneakers.logger` but is resolved lazily, because at the
 time the configuration object is built it may not be set up yet.
 
+Logging is diagnostic; the heartbeat is the liveness contract. An exception
+raised by a custom logger is therefore swallowed at the logging boundary. It
+cannot prevent a healthy tick from writing its mark, abort monitor startup, or
+escape the loop's error handler and kill the monitor thread. No fallback message
+is attempted through the same broken logger.
+
 ## Logging: events, not the pulse
 
 The pulse lives in the mtime of a file; writing a log line every tick would only

data/docs/KUBERNETES.md

@@ -46,6 +46,21 @@ Without `medium: Memory` an `emptyDir` is backed by the node's disk, and the
 probe starts depending on the disk again — which is one of the things it exists
 to avoid.
 
+An `emptyDir` deliberately survives a restart of the container inside its pod.
+That keeps a Bootsnap or other application cache under `/opt/app/tmp` warm for
+the next attempt, but it also leaves the previous process's heartbeat files in
+`health/`. The gem does not clear the volume or that directory. Instead it
+records the current Linux container generation separately and in every slot
+mark. A fresh mark from the previous container is rejected until every fork in
+the current one has subscribed and published its own mark, so preserving the
+cache cannot make `startupProbe` succeed early.
+
+That guarantee assumes the default container-private PID namespace. Do not set
+`shareProcessNamespace: true` or `hostPID: true` on a pod that relies on it: in
+either topology PID 1 survives a worker-container restart, and the generation
+guard can accept an inherited fresh mark. See
+[LIMITATIONS.md](LIMITATIONS.md#container-generations-require-linux-procfs-and-container-owned-pid-1).
+
 ## Why the command looks like that
 
 **`bundle exec kicks-liveness` is the standard command.** It works regardless
@@ -104,6 +119,12 @@ executable is found regardless of `BUNDLE_PATH`, which is why it is the standard
 command. Run bare, it depends on the gem's `bin` directory being on `PATH`,
 which is not something to rely on in a manifest.
 
+Keep the worker and probe on the same gem version. Since 0.1.2 the heartbeat
+protocol includes a container generation; a newer probe correctly rejects the
+generation-less files written by an older worker. `bundle exec` guarantees that
+both sides resolve from the same bundle. If the faster form below installs a
+second copy in `GEM_HOME`, rebuild that copy on every gem upgrade too.
+
 ### Where your image puts its gems
 
 Before replacing the standard command with plain Ruby, run this against your
@@ -286,15 +307,18 @@ redelivered.
 
 ## Environment variables
 
-| Variable | Default | |
-|---|---|---|
-| `KICKS_LIVENESS_DIR` | `/opt/app/tmp/health` | marks directory, **must be on tmpfs** |
-| `KICKS_LIVENESS_MAX_AGE` | `45` | seconds after which a mark is stale |
-| `KICKS_LIVENESS_TICK` | `10` | interval between ticks |
+| Variable | Default | Purpose | Invalid or blank value |
+|---|---|---|---|
+| `KICKS_LIVENESS_DIR` | `/opt/app/tmp/health` | marks directory, **must be on tmpfs** | uses the default |
+| `KICKS_LIVENESS_MAX_AGE` | `45` | seconds after which a mark is stale | uses the default |
+| `KICKS_LIVENESS_TICK` | `10` | interval between ticks | uses the default, then the safety fallback below if needed |
 
 Keep `tick` well below `max_age`. A tick longer than half of `max_age` leaves no
 room for a single missed write, and a tick longer than `max_age` guarantees a
-restart loop.
+restart loop. If environment values produce `tick >= max_age`, the worker writes
+a WARN to stderr and uses the default tick when that is safe, or half of
+`max_age` otherwise. An initializer value with the same mismatch raises
+`ArgumentError`. The half-threshold remains the recommended operational margin.
 
 `KICKS_LIVENESS_DIR` is also what separates two runners that share a pod. An
 application running both `rake sneakers:run` and `rake sneakers:active_job` has
@@ -315,9 +339,8 @@ probe command pointed at its own directory — the probe reads
 `KICKS_LIVENESS_DIR` from its own environment, which the kubelet takes from the
 container it runs in.
 
-Garbage in a value does not crash the worker — it falls back to the default. An
-empty string counts as unset, which is what a ConfigMap gives you when a key is
-declared and left blank.
+An empty string counts as unset, which is what a ConfigMap gives you when a key
+is declared and left blank.
 
 ## Verifying on a live pod
 

data/docs/LIMITATIONS.md

@@ -80,20 +80,48 @@ see the respawn escalation below.
 
 ## Changing the worker count at runtime is not supported
 
-`ServerEngine` re-reads its configuration on SIGHUP, and a changed `workers`
-value scales the fork set. Scaling **up** is fine. Scaling **down** is only
-handled when the supervisor also restarts the forks, which is what the restart
-path does: the surviving monitors re-declare the current count on their next
-tick and the probe follows.
-
-What cannot be handled is a reload that lowers `workers` while leaving existing
-forks running. `reload_config` executes in the supervisor, and a fork holds its
-own copy of the configuration from the moment it was forked — so a fork cannot
-see the new number however often it looks. The declared count then stays too
-high, the marks for the retired slots go stale, and the probe fails until the
-pod restarts.
-
-If you scale workers, restart them.
+`ServerEngine` can re-read its configuration on SIGHUP and scale the fork set,
+but a fork holds its own copy of that configuration from the moment it was
+created. Every monitor re-declares that captured count on every tick.
+
+After a scale-up, old forks keep declaring the old count while new forks declare
+the new one. The shared `expected` file therefore depends on which fork wrote
+last; it can temporarily require the new slots, or incorrectly report the old
+set as complete. After a scale-down, the surviving forks keep declaring the old
+count and the retired slots eventually go stale. Neither direction is safe.
+
+If you change `workers`, restart the runner. Runtime scaling is not supported.
+
+## Container generations require Linux procfs and container-owned PID 1
+
+Kubernetes keeps an `emptyDir` across restarts of a container in the same pod.
+To prevent the next container from inheriting a fresh heartbeat, the worker and
+exec probe independently identify their shared incarnation from Linux procfs:
+the mount namespace plus PID 1 start time. No application cache is removed.
+
+The identifier also assumes that the container owns PID 1. With
+`shareProcessNamespace: true`, PID 1 is the pod sandbox, and with
+`hostPID: true` it is the node's init process; neither restarts when the worker
+container does, so the start-time half of the identifier stays constant. The
+mount namespace inode is then the only remaining signal, and the kernel
+normally hands the just-released inode back to the replacement container in an
+otherwise quiet pod. Under either setting the guard silently degrades to the
+0.1.1 freshness-only behavior and can accept a fresh mark from the previous
+container. Do not enable either setting on a pod whose `startupProbe` relies on
+this guarantee.
+
+If procfs is unavailable — for example, when using the gem outside a Linux
+container — generation detection falls back to the original freshness-only
+check. The worker and probe still function, but they cannot distinguish a fresh
+mark left by a previous process from one written by the current process. Linux
+Kubernetes, Docker, and Nomad containers expose the required procfs entries
+under their normal configuration.
+
+The worker and its exec probe must run in the **same container**. A neighbouring
+sidecar can mount the same `emptyDir`, but it has a different mount namespace
+and therefore treats the worker's marks as belonging to another container.
+Kubernetes exec probes already run inside the container they check; do not move
+`kicks-liveness` into a separate health sidecar.
 
 ## A respawn loop is reported once per grace window, not once per respawn
 
@@ -115,6 +143,15 @@ reports the elapsed time and the number of starts:
 The number of starts is the diagnosis: it separates a slow start from a respawn
 loop at a glance.
 
+This unhealthy-run counter is scoped to the marks volume, not to the container
+generation. If a container is restarted before its slot has ever become
+healthy, the replacement continues the same count: its repeated `started:` line
+is suppressed, and an expired grace window may immediately report an ERROR that
+includes starts from the previous container. This is diagnostic state only; it
+does not participate in the probe result, and the first healthy tick removes
+it. Treat the count as "starts since this slot was last healthy in this pod",
+not "starts in this container".
+
 ## Do not install both `kicks` and `sneakers`
 
 The gem declares neither as a dependency, because at runtime it needs only the
@@ -126,7 +163,9 @@ executing the `sneakers` code while its lockfile says otherwise, and pulling in
 resolve.
 
 A loud failure gets fixed; a silent substitution does not. Keep exactly one of
-the two.
+the two. Bundler itself still accepts the combination, but `install!` now
+rejects a process in which both gems are activated before either set of hooks is
+installed.
 
 If neither is present, `install!` raises a `LoadError` naming both with their
 required versions.

data/docs/SETUP.md

@@ -10,7 +10,7 @@ having both is worse than it looks.
 
 Those two floors are exact, not aspirational: CI runs the suite against
 `kicks 3.0.0` and `sneakers 2.11.0` pinned, alongside the matrix that tracks the
-newest release of each. A `~>` matrix on its own would only ever prove that the
+current release of each. A `~>` matrix on its own would only ever prove that the
 latest version works.
 
 ```ruby
@@ -142,12 +142,15 @@ Set it only to point somewhere **other** than `Sneakers.logger`:
 config.logger = Rails.logger
 ```
 
-| Option | Default | |
-|---|---|---|
-| `logger` | `Sneakers.logger`, resolved lazily | where transitions are logged |
-| `enabled` | `true` | set to `false` in tests, so no thread is started |
-| `tick` | `10` | seconds between checks |
-| `startup_grace_ticks` | `6` | unhealthy ticks tolerated at startup before one ERROR |
+| Option | Default | Purpose | Valid values |
+|---|---|---|---|
+| `logger` | `Sneakers.logger`, resolved lazily | transition and error logs | logger-compatible object |
+| `enabled` | `true` | start the monitor thread | `true` or `false` |
+| `tick` | `10` | seconds between checks | positive number smaller than `max_age` |
+| `startup_grace_ticks` | `6` | unhealthy startup ticks before one ERROR | positive integer |
+
+Invalid combinations are rejected before the monitor starts instead of running
+one that is guaranteed to publish stale marks or never report a stalled startup.
 
 `dir` and `max_age` are **not** here — they come from environment variables
 only. See
@@ -171,11 +174,13 @@ Once workers are running, the marks directory is the other half of the answer:
 ```
 $ ls -l /opt/app/tmp/health/
 expected
+generation
 worker-0
 worker-1
 ```
 
-One `worker-<slot>` file per fork, plus `expected`. If `expected` is there and
-the slot files are not, the workers have not finished subscribing. A slot that
-keeps restarting without ever subscribing also leaves an `attempt-<slot>` file,
-which is removed as soon as that slot becomes healthy.
+One `worker-<slot>` file per fork, plus `expected` and the current container
+`generation`. If `expected` is there and the slot files are not, the workers
+have not finished subscribing. A slot that keeps restarting without ever
+subscribing also leaves an `attempt-<slot>` file, which is removed as soon as
+that slot becomes healthy.

data/docs/VERIFYING.md

@@ -30,14 +30,23 @@ it takes.
 
 ```bash
 spec/integration/verify.sh build   # image, into the engine the cluster uses
+spec/integration/verify.sh status  # print and verify the exact target
 spec/integration/verify.sh up      # namespace, broker, worker
 spec/integration/verify.sh down    # deletes the namespace
 ```
 
-Every `kubectl` call in that script names its context and namespace explicitly.
-That is not politeness: a liveness experiment deletes queues and kills pods, and
-it must not be able to reach a real cluster because someone's current-context
-happened to point at one.
+Every `kubectl` call names its context and namespace explicitly, so the script
+never falls back to `current-context`. It will still operate on whichever target
+you configure: run `status` and inspect both values before `up` or `down`. The
+script labels namespaces it creates and refuses to apply to or delete an
+existing namespace without that ownership label.
+
+The default image uses Kicks. Build it with Sneakers instead without editing the
+fixture:
+
+```bash
+AMQP_WORKER_GEM=sneakers spec/integration/verify.sh build
+```
 
 Three things that cost time if you meet them the hard way:
 
@@ -88,11 +97,15 @@ spec/integration/verify.sh probe
 INFO: [liveness] slot 0: started: dir=/opt/app/tmp/health max_age=45s tick=10s processes=1 consumers=2
 INFO: [liveness] slot 0: waiting for 2 consumers
 INFO: [liveness] slot 0: healthy          # one tick later
-expected  worker-0                        # in the marks directory
+expected  generation  worker-0            # in the marks directory
 1 process(es) healthy                     # probe, exit 0
 ```
 
-The hooks fired inside a real ServerEngine fork, which no double can show.
+The hooks fired inside a real ServerEngine fork, which no double can show. On a
+fresh fixture the first attempt also prints `started:`. Do not use that line as
+the sole proof after a same-pod container restart: an inherited unhealthy-run
+counter deliberately suppresses repeated start lines, as described in
+[LIMITATIONS.md](LIMITATIONS.md#a-respawn-loop-is-reported-once-per-grace-window-not-once-per-respawn).
 
 ### 2. A stale mark
 
@@ -233,9 +246,9 @@ find them.
 ```
 INFO: [liveness] slot 0: started: ... processes=2 consumers=2
 INFO: [liveness] slot 1: started: ... processes=2 consumers=2
-expected  worker-0  worker-1      # expected contains "2"
-2 process(es) healthy             # exit 0
-worker-1 stale 120s > 45s         # exit 1 — staling either mark is enough
+expected  generation  worker-0  worker-1  # expected contains "2"
+2 process(es) healthy                     # exit 0
+worker-1 stale 120s > 45s                 # exit 1 — staling either mark is enough
 ```
 
 Both marks are required, not just the first.
@@ -322,6 +335,38 @@ pod is restarted. That is why the documented rule set pairs it with
 `absent_over_time`, and why an `up == 0` on the scrape job is worth having
 beside both.
 
+### 11. A private-PID container restart cannot inherit a healthy mark
+
+This scenario needs the fixture image but not Kubernetes or RabbitMQ. It starts
+a container that publishes a healthy mark into a named volume, restarts that
+same container, and delays the new writer for 15 seconds:
+
+```bash
+spec/integration/verify.sh build
+spec/integration/verify.sh generation-restart
+```
+
+During the delay the inherited mark is still fresh, but the probe must reject
+its old generation. Once the replacement writer publishes its own mark, the
+same probe must become healthy again. The command checks both transitions and
+prints output in this form:
+
+```
+before=mnt:[4026532686]:123456
+after=mnt:[4026532686]:123789
+inherited=heartbeat belongs to a previous container: worker has not started yet
+recovered=1 process(es) healthy
+```
+
+The namespace inode is allowed to be reused, as in the example above; the PID 1
+start time still distinguishes the two incarnations. The test removes its
+container and named volume on exit.
+
+This scenario covers the default container-private PID namespace. With
+`shareProcessNamespace: true` or `hostPID: true`, PID 1 survives the worker
+container restart and this guarantee does not hold; see
+[LIMITATIONS.md](LIMITATIONS.md#container-generations-require-linux-procfs-and-container-owned-pid-1).
+
 ## What to do with a disagreement
 
 Record it, then fix whichever is wrong — the code or the document. The numbers

data/lib/kicks_liveness/configuration.rb

@@ -17,20 +17,26 @@ module KicksLiveness
     # @return [Integer] unhealthy ticks tolerated at startup before one ERROR
     DEFAULT_STARTUP_GRACE_TICKS = 6
 
-    # @return [Integer] seconds between checks
-    attr_reader :tick
+    # Seconds between checks. An incompatibility warning for an environment
+    # fallback is delayed until this value is actually used, so an initializer
+    # can override it or disable the monitor without a misleading warning.
+    # @return [Numeric]
+    def tick
+      warn_incompatible_environment_tick_once
+      @tick
+    end
     # @return [Integer] unhealthy ticks tolerated at startup before one ERROR
-    attr_accessor :startup_grace_ticks
+    attr_reader :startup_grace_ticks
     # @return [Logger, nil] explicit logger; defaults to +Sneakers.logger+
     attr_accessor :logger
     # @param value [Boolean] set false to start no monitor thread, e.g. in tests
     attr_writer :enabled
 
     def initialize
-      @tick = Heartbeat.env_int(:tick, DEFAULT_TICK)
       @startup_grace_ticks = DEFAULT_STARTUP_GRACE_TICKS
       @enabled = true
       @logger = nil
+      @tick = environment_tick
     end
 
     # @return [Boolean]
@@ -39,20 +45,36 @@ module KicksLiveness
     end
 
     # A tick is what the monitor thread sleeps on, so a non-positive value is
-    # not a setting but a broken monitor. The environment gets a silent fallback
-    # instead (see {Heartbeat.env_int}) because a ConfigMap typo must not bring
-    # a worker down; an initializer is code, and code should say so at boot,
-    # where the developer is looking.
+    # not a setting but a broken monitor. An initializer is code, and code
+    # should fail loudly at boot, where the developer is looking. Environment
+    # input is resolved separately by {#environment_tick}, with a safe fallback.
     #
-    # @param seconds [Integer]
+    # @param seconds [Numeric]
     # @raise [ArgumentError] if not a positive number
-    # @return [Integer]
+    # @return [Numeric]
     def tick=(seconds)
       raise ArgumentError, "tick must be a positive number, got #{seconds.inspect}" unless positive_number?(seconds)
+      raise ArgumentError, "tick must be less than max_age (#{max_age}s), got #{seconds.inspect}" if seconds >= max_age
 
+      @incompatible_environment_tick = nil
       @tick = seconds
     end
 
+    # The monitor compares an integer tick counter with this value. Accepting
+    # zero, a float, or a string would silently prevent the startup escalation
+    # from ever firing.
+    #
+    # @param ticks [Integer]
+    # @raise [ArgumentError] unless +ticks+ is a positive integer
+    # @return [Integer]
+    def startup_grace_ticks=(ticks)
+      unless ticks.is_a?(Integer) && ticks.positive?
+        raise ArgumentError, "startup_grace_ticks must be a positive integer, got #{ticks.inspect}"
+      end
+
+      @startup_grace_ticks = ticks
+    end
+
     # Read-only, sourced from the environment so that it matches what the probe
     # sees.
     # @return [String] marks directory
@@ -76,6 +98,47 @@ module KicksLiveness
 
     private
 
+    def environment_tick
+      raw = Heartbeat.env_raw(:tick)
+      seconds = Heartbeat.env_int(:tick, DEFAULT_TICK)
+      threshold = max_age
+      return seconds if seconds < threshold
+
+      fallback = [DEFAULT_TICK, threshold / 2.0].min
+      @incompatible_environment_tick = [seconds, threshold, fallback, raw]
+      fallback
+    end
+
+    def warn_incompatible_environment_tick_once
+      warning = @incompatible_environment_tick
+      return unless warning
+
+      @incompatible_environment_tick = nil
+      warn_incompatible_environment_tick(*warning)
+    end
+
+    def warn_incompatible_environment_tick(seconds, threshold, fallback, raw)
+      Kernel.warn(
+        "WARN [liveness] effective tick=#{seconds}s (#{environment_tick_source(raw)}) must be less than " \
+        "KICKS_LIVENESS_MAX_AGE=#{threshold}s; using #{fallback}s"
+      )
+    rescue StandardError
+      # Configuration recovery must not become a worker boot failure merely
+      # because stderr is unavailable or warning output has been overridden.
+      nil
+    end
+
+    def environment_tick_source(raw)
+      return 'default' if raw.nil?
+
+      value = Integer(raw)
+      return "KICKS_LIVENESS_TICK=#{raw}" if value.positive?
+
+      "default after invalid KICKS_LIVENESS_TICK=#{raw.inspect}"
+    rescue ArgumentError, TypeError
+      "default after invalid KICKS_LIVENESS_TICK=#{raw.inspect}"
+    end
+
     def positive_number?(value)
       value.is_a?(Numeric) && value.positive?
     end