kino 0.6.0 → 0.7.0

data/ext/kino/src/queue.rs

@@ -25,6 +25,21 @@ pub const TICK: Duration = Duration::from_millis(50);
 /// the difference and doesn't need to.
 type Taken = Option<BoxedCtx>;
 
+/// What a take does when its bounded wait times out: keep waiting (None),
+/// or end the loop because the pool scaler retired this slot. A retired
+/// lane worker first empties its own lane, one item per timeout: the
+/// dispatcher stopped feeding it when the flag went up (see
+/// registry::WorkerSlot::retire for the ordering), so whatever is
+/// still there is the last of it, and nothing already assigned is
+/// orphaned. Only reached with the queue momentarily empty, so the fast
+/// path pays nothing for it.
+fn after_timeout(slot: &WorkerSlot) -> Option<Taken> {
+    if !slot.retired.load(Ordering::SeqCst) {
+        return None;
+    }
+    Some(slot.lane_rx.as_ref().and_then(|rx| rx.try_recv().ok()))
+}
+
 /// Block until one request arrives (GVL released, interruptible).
 /// No busy-poll before parking, deliberately: the wake-per-request futex
 /// cost is real (~20% of cycles at saturation, per perf), but a measured
@@ -46,7 +61,7 @@ fn block_take(server: &ServerInner, slot: &Arc<WorkerSlot>) -> Result<Taken, Err
             let taken =
                 gvl::interruptible(&slot.interrupted, || match req_rx.recv_timeout(TICK) {
                     Ok(ctx) => Some(Some(ctx)),
-                    Err(flume::RecvTimeoutError::Timeout) => None,
+                    Err(flume::RecvTimeoutError::Timeout) => after_timeout(slot),
                     Err(flume::RecvTimeoutError::Disconnected) => Some(None),
                 })?;
             Ok(taken.flatten())
@@ -93,8 +108,10 @@ fn lane_take(server: &ServerInner, slot: &Arc<WorkerSlot>) -> Result<Taken, Erro
         match lane_rx.recv_timeout(TICK) {
             Ok(ctx) => Some(Some(ctx)),
             // Periodic steal so a backlog behind a slow sibling can't
-            // outlive a tick.
-            Err(flume::RecvTimeoutError::Timeout) => steal().map(Some),
+            // outlive a tick; a retired worker leaves instead.
+            Err(flume::RecvTimeoutError::Timeout) => {
+                after_timeout(slot).or_else(|| steal().map(Some))
+            }
             Err(flume::RecvTimeoutError::Disconnected) => Some(None),
         }
     });
@@ -235,3 +252,82 @@ pub fn respond_and_take(
     crate::request::respond_simple(ruby, request, status, headers, body)?;
     Worker::take_batch(ruby, &worker, max)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::registry::test_server;
+    use crate::request::test_ctx;
+
+    #[test]
+    fn a_take_keeps_waiting_after_a_timeout_unless_the_slot_is_retired() {
+        let server = test_server(false, 4);
+        server.register_worker();
+        let slot = server.slots.read()[0].clone();
+
+        assert!(after_timeout(&slot).is_none());
+    }
+
+    #[test]
+    fn a_retired_shared_queue_worker_ends_its_loop_at_the_next_timeout() {
+        let server = test_server(false, 4);
+        server.register_worker();
+        server.slots.read()[0].retire();
+        let slot = server.slots.read()[0].clone();
+
+        assert!(matches!(after_timeout(&slot), Some(None)));
+    }
+
+    #[test]
+    fn a_retired_lane_worker_drains_its_own_lane_before_leaving() {
+        let server = test_server(true, 4);
+        server.register_worker();
+        let slot = server.slots.read()[0].clone();
+        slot.lane_tx
+            .lock()
+            .as_ref()
+            .expect("lane open")
+            .send(test_ctx())
+            .expect("lane has room");
+        server.slots.read()[0].retire();
+
+        // One item still assigned to this lane: serve it, not orphan it.
+        assert!(matches!(after_timeout(&slot), Some(Some(_))));
+        // Lane empty now: leave.
+        assert!(matches!(after_timeout(&slot), Some(None)));
+    }
+
+    #[test]
+    fn a_retired_lane_worker_drains_every_item_one_per_timeout() {
+        let server = test_server(true, 4);
+        server.register_worker();
+        let slot = server.slots.read()[0].clone();
+        for _ in 0..3 {
+            slot.lane_tx
+                .lock()
+                .as_ref()
+                .expect("lane open")
+                .send(test_ctx())
+                .expect("lane has room");
+        }
+        server.slots.read()[0].retire();
+
+        for _ in 0..3 {
+            assert!(matches!(after_timeout(&slot), Some(Some(_))));
+        }
+        assert!(matches!(after_timeout(&slot), Some(None)));
+    }
+
+    #[test]
+    fn a_reset_slot_keeps_waiting_again() {
+        let server = test_server(false, 4);
+        server.register_worker();
+        let slot = server.slots.read()[0].clone();
+        slot.retire();
+        assert!(matches!(after_timeout(&slot), Some(None)));
+
+        slot.reset();
+
+        assert!(after_timeout(&slot).is_none());
+    }
+}

data/ext/kino/src/registry.rs

@@ -21,7 +21,11 @@ pub const STATE_DRAINING: u8 = 2;
 /// "ractor" or "threaded", never "auto".
 pub struct Topology {
     pub mode: String,
+    /// The pool floor: the configured worker count.
     pub workers: usize,
+    /// The pool ceiling: equal to `workers` for a fixed pool. HTTP/2
+    /// admission (SETTINGS_MAX_CONCURRENT_STREAMS) is advertised from it.
+    pub max_workers: usize,
     pub threads: usize,
     pub batch: usize,
 }
@@ -113,6 +117,13 @@ pub struct ServerInner {
     pub respawns: AtomicU64,
     /// Replacements spawned by the quarantine monitor (Relaxed, advisory).
     pub quarantine_replacements: AtomicU64,
+    /// Workers staying in the pool (a worker told to retire no longer
+    /// counts), reported by the Ruby pool as it grows and shrinks; starts
+    /// at the floor. Relaxed, advisory.
+    pub active_workers: AtomicUsize,
+    /// Pool scaler events (Relaxed, advisory).
+    pub scale_ups: AtomicU64,
+    pub scale_downs: AtomicU64,
     pub topology: Topology,
     pub https: bool,
     /// HTTP/2 serving (ALPN over TLS, prior-knowledge h2c on plaintext);
@@ -158,6 +169,11 @@ pub struct WorkerSlot {
     /// Set by the quarantine monitor when this slot is abandoned as wedged:
     /// excluded from wedge detection, and its busy_ms is reported as 0.
     pub quarantined: std::sync::atomic::AtomicBool,
+    /// Set by the pool scaler to send this slot's worker home: the lane
+    /// dispatcher skips it, and the take loop ends at its next idle tick
+    /// (a request already taken finishes first). Cleared by `reset` when
+    /// the slot is handed to a new worker.
+    pub retired: std::sync::atomic::AtomicBool,
 }
 
 /// Per-lane depth cap: small, so a slow handler can only ever delay this
@@ -251,8 +267,35 @@ impl WorkerSlot {
             in_flight: AtomicUsize::new(0),
             last_started_ms: AtomicU64::new(0),
             quarantined: std::sync::atomic::AtomicBool::new(false),
+            retired: std::sync::atomic::AtomicBool::new(false),
         }
     }
+
+    /// Send this slot's worker home once it is idle. The flag is raised
+    /// under the lane lock, the same lock the lane dispatcher holds while
+    /// it checks the flag and sends: any dispatch that saw "not retired"
+    /// has landed in the lane before the worker can see the flag and
+    /// drain, so no request is orphaned.
+    pub fn retire(&self) {
+        let _lane = self.lane_tx.lock();
+        self.retired.store(true, Ordering::SeqCst);
+    }
+
+    /// Return a retired slot to its fresh state so a new worker can take
+    /// it over (slots are never removed; recycling keeps the registry
+    /// from growing with every scale-up). The lane channel stays, the new
+    /// occupant simply starts taking from it; the quarantine mark stays
+    /// too, a quarantined slot is never handed out.
+    pub fn reset(&self) {
+        let _lane = self.lane_tx.lock();
+        self.current.lock().clear();
+        self.retired.store(false, Ordering::SeqCst);
+        self.parked.store(false, Ordering::SeqCst);
+        self.interrupted.store(false, Ordering::SeqCst);
+        self.served.store(0, Ordering::Relaxed);
+        self.in_flight.store(0, Ordering::Relaxed);
+        self.last_started_ms.store(0, Ordering::Relaxed);
+    }
 }
 
 static REGISTRY: OnceLock<RwLock<HashMap<u64, Arc<ServerInner>>>> = OnceLock::new();
@@ -350,9 +393,13 @@ pub fn test_server(lanes: bool, queue_depth: usize) -> Arc<ServerInner> {
         state: std::sync::atomic::AtomicU8::new(STATE_BOOTING),
         respawns: AtomicU64::new(0),
         quarantine_replacements: AtomicU64::new(0),
+        active_workers: AtomicUsize::new(0),
+        scale_ups: AtomicU64::new(0),
+        scale_downs: AtomicU64::new(0),
         topology: Topology {
             mode: "threaded".to_string(),
             workers: 0,
+            max_workers: 0,
             threads: 0,
             batch: 1,
         },
@@ -491,6 +538,18 @@ mod tests {
         assert_eq!(server.topology.batch, 1);
     }
 
+    #[test]
+    fn pool_counters_start_at_the_configured_floor() {
+        let server = test_server(false, 4);
+        assert_eq!(
+            server.active_workers.load(Ordering::Relaxed),
+            server.topology.workers
+        );
+        assert_eq!(server.topology.max_workers, server.topology.workers);
+        assert_eq!(server.scale_ups.load(Ordering::Relaxed), 0);
+        assert_eq!(server.scale_downs.load(Ordering::Relaxed), 0);
+    }
+
     #[test]
     fn fresh_slot_has_zeroed_per_worker_sensors() {
         let server = test_server(false, 4);
@@ -510,6 +569,88 @@ mod tests {
         assert_eq!(server.quarantine_replacements.load(Ordering::Relaxed), 0);
     }
 
+    #[test]
+    fn fresh_slot_is_not_retired() {
+        let server = test_server(false, 4);
+        server.register_worker();
+        assert!(!server.slots.read()[0].retired.load(Ordering::Relaxed));
+    }
+
+    #[test]
+    fn retire_then_reset_returns_a_slot_to_its_fresh_state() {
+        let server = test_server(true, 4);
+        server.register_worker();
+        let slot = server.slots.read()[0].clone();
+        slot.parked.store(true, Ordering::Relaxed);
+        slot.interrupted.store(true, Ordering::Relaxed);
+        slot.served.store(5, Ordering::Relaxed);
+        slot.in_flight.store(1, Ordering::Relaxed);
+        slot.last_started_ms.store(9, Ordering::Relaxed);
+        slot.current.lock().push(std::sync::Weak::new());
+
+        slot.retire();
+        assert!(slot.retired.load(Ordering::Relaxed));
+
+        slot.reset();
+        assert!(!slot.retired.load(Ordering::Relaxed));
+        assert!(!slot.parked.load(Ordering::Relaxed));
+        assert!(!slot.interrupted.load(Ordering::Relaxed));
+        assert_eq!(slot.served.load(Ordering::Relaxed), 0);
+        assert_eq!(slot.in_flight.load(Ordering::Relaxed), 0);
+        assert_eq!(slot.last_started_ms.load(Ordering::Relaxed), 0);
+        assert!(slot.current.lock().is_empty());
+        // The lane survives reuse: the next occupant takes from it.
+        assert!(slot.lane_tx.lock().is_some());
+    }
+
+    #[test]
+    fn reset_keeps_a_quarantine_mark() {
+        let server = test_server(false, 4);
+        server.register_worker();
+        let slot = server.slots.read()[0].clone();
+        slot.quarantined.store(true, Ordering::Relaxed);
+
+        slot.retire();
+        slot.reset();
+
+        // A wedged slot stays flagged even if it ever came back around.
+        assert!(slot.quarantined.load(Ordering::Relaxed));
+    }
+
+    #[test]
+    fn retire_releases_the_lane_lock() {
+        let server = test_server(true, 4);
+        server.register_worker();
+        let slot = server.slots.read()[0].clone();
+
+        slot.retire();
+
+        assert!(slot.lane_tx.try_lock().is_some());
+    }
+
+    #[test]
+    fn retire_waits_for_a_dispatcher_holding_the_lane_lock() {
+        let server = test_server(true, 4);
+        server.register_worker();
+        let slot = server.slots.read()[0].clone();
+
+        // A dispatcher that has already read "not retired" and is sending.
+        let sending = slot.lane_tx.lock();
+        let retiring = std::thread::spawn({
+            let slot = slot.clone();
+            move || slot.retire()
+        });
+        std::thread::sleep(Duration::from_millis(30));
+        assert!(
+            !slot.retired.load(Ordering::SeqCst),
+            "the flag must not go up under a dispatcher's lock"
+        );
+
+        drop(sending);
+        retiring.join().expect("retire thread");
+        assert!(slot.retired.load(Ordering::SeqCst));
+    }
+
     #[test]
     fn queue_histogram_buckets_by_wait() {
         let h = QueueHistogram::new();

data/ext/kino/src/request.rs

@@ -492,7 +492,7 @@ fn coerce_str(value: Value) -> Result<RString, Error> {
     }
 }
 
-fn split_host_port(host: &str, default_port: u16) -> (String, u16) {
+pub(crate) fn split_host_port(host: &str, default_port: u16) -> (String, u16) {
     match host.rsplit_once(':') {
         Some((name, port)) if !name.is_empty() => match port.parse() {
             Ok(p) => (name.to_string(), p),

data/ext/kino/src/server.rs

@@ -68,6 +68,10 @@ pub fn server_start(ruby: &Ruby, config: magnus::RHash) -> Result<(u64, u16, Opt
     let log_requests: bool = cfg_opt(ruby, config, "log_requests")?.unwrap_or(false);
     let mode: String = cfg_opt(ruby, config, "mode")?.unwrap_or_else(|| "threaded".to_string());
     let workers: usize = cfg_opt(ruby, config, "workers")?.unwrap_or(0);
+    // Absent or below the floor means a fixed pool.
+    let max_workers: usize = cfg_opt::<usize>(ruby, config, "max_workers")?
+        .unwrap_or(workers)
+        .max(workers);
     let threads: usize = cfg_opt(ruby, config, "threads")?.unwrap_or(0);
     let batch: usize = cfg_opt(ruby, config, "batch")?.unwrap_or(1);
     let acceptor = match (&tls_cert, &tls_key) {
@@ -130,9 +134,13 @@ pub fn server_start(ruby: &Ruby, config: magnus::RHash) -> Result<(u64, u16, Opt
         state: std::sync::atomic::AtomicU8::new(registry::STATE_BOOTING),
         respawns: std::sync::atomic::AtomicU64::new(0),
         quarantine_replacements: std::sync::atomic::AtomicU64::new(0),
+        active_workers: std::sync::atomic::AtomicUsize::new(workers),
+        scale_ups: std::sync::atomic::AtomicU64::new(0),
+        scale_downs: std::sync::atomic::AtomicU64::new(0),
         topology: registry::Topology {
             mode,
             workers,
+            max_workers,
             threads,
             batch,
         },
@@ -383,6 +391,12 @@ fn advertised_streams(workers: usize, threads: usize) -> u32 {
     slots.clamp(8, 1024) as u32
 }
 
+/// The pool can grow to its ceiling to meet what an h2 balancer sends, so
+/// the ceiling is the admission to advertise (the floor for a fixed pool).
+fn stream_capacity(topology: &registry::Topology) -> u32 {
+    advertised_streams(topology.max_workers, topology.threads)
+}
+
 fn conn_builder(http2: bool, max_streams: u32) -> auto::Builder<TokioExecutor> {
     let mut builder = auto::Builder::new(TokioExecutor::new());
     builder
@@ -418,7 +432,7 @@ async fn serve_connection<I>(
     I: tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin + Send + 'static,
 {
     let http2 = server.http2;
-    let max_streams = advertised_streams(server.topology.workers, server.topology.threads);
+    let max_streams = stream_capacity(&server.topology);
     let mut drain = server.shutdown_tx.subscribe();
     let service =
         service_fn(move |req| handle_request(server.clone(), remote_addr, local_addr, req));
@@ -712,6 +726,11 @@ fn try_dispatch(server: &ServerInner, mut ctx: BoxedCtx) -> Dispatch {
             let guard = slot.lane_tx.lock();
             let Some(tx) = guard.as_ref() else { continue };
             any_open = true;
+            // Checked under the lane lock, which WorkerSlot::retire also
+            // takes: see there for the ordering.
+            if slot.retired.load(Ordering::SeqCst) {
+                continue;
+            }
             match tx.try_send(ctx) {
                 Ok(()) => return Dispatch::Sent,
                 Err(flume::TrySendError::Full(c)) | Err(flume::TrySendError::Disconnected(c)) => {
@@ -900,7 +919,7 @@ pub fn queue_time(_ruby: &Ruby, server_id: u64) -> Result<(u64, f64), Error> {
 }
 
 /// One worker slot's [index, served, in_flight, busy_ms, quarantined] row.
-pub type WorkerStatRow = (usize, u64, usize, u64, bool);
+pub type WorkerStatRow = (usize, u64, usize, u64, bool, bool);
 
 /// Per-slot rows for Server#stats parity: [index, served, in_flight,
 /// busy_ms, quarantined] each. Empty when the server is gone.
@@ -910,7 +929,16 @@ pub fn worker_stats(_ruby: &Ruby, server_id: u64) -> Result<Vec<WorkerStatRow>,
     };
     Ok(crate::control::collect_worker_status(&server)
         .into_iter()
-        .map(|w| (w.index, w.served, w.in_flight, w.busy_ms, w.quarantined))
+        .map(|w| {
+            (
+                w.index,
+                w.served,
+                w.in_flight,
+                w.busy_ms,
+                w.quarantined,
+                w.retired,
+            )
+        })
         .collect())
 }
 
@@ -923,6 +951,61 @@ pub fn quarantine_slot(ruby: &Ruby, server_id: u64, worker_id: usize) -> Result<
     Ok(())
 }
 
+/// Send a slot's worker home once idle (pool scale-down); see
+/// registry::WorkerSlot::retire. An unknown id is a caller bug: raise.
+pub fn retire_slot(ruby: &Ruby, server_id: u64, worker_id: usize) -> Result<(), Error> {
+    if let Some(server) = registry::try_get(server_id) {
+        server.slot(ruby, worker_id)?.retire();
+    }
+    Ok(())
+}
+
+/// Hand a retired slot to a new worker (pool scale-up reusing a slot).
+pub fn reset_slot(ruby: &Ruby, server_id: u64, worker_id: usize) -> Result<(), Error> {
+    if let Some(server) = registry::try_get(server_id) {
+        server.slot(ruby, worker_id)?.reset();
+    }
+    Ok(())
+}
+
+/// The Ruby pool reports how many workers are alive and serving.
+pub fn set_active_workers(_ruby: &Ruby, server_id: u64, count: usize) -> Result<(), Error> {
+    if let Some(server) = registry::try_get(server_id) {
+        server.active_workers.store(count, Ordering::Relaxed);
+    }
+    Ok(())
+}
+
+/// One worker added by the pool scaler.
+pub fn record_scale_up(_ruby: &Ruby, server_id: u64) -> Result<(), Error> {
+    if let Some(server) = registry::try_get(server_id) {
+        server.scale_ups.fetch_add(1, Ordering::Relaxed);
+    }
+    Ok(())
+}
+
+/// One worker retired by the pool scaler.
+pub fn record_scale_down(_ruby: &Ruby, server_id: u64) -> Result<(), Error> {
+    if let Some(server) = registry::try_get(server_id) {
+        server.scale_downs.fetch_add(1, Ordering::Relaxed);
+    }
+    Ok(())
+}
+
+/// [active_workers, max_workers, scale_ups, scale_downs] for Server#stats.
+/// Zeros when the server is gone.
+pub fn pool_stats(_ruby: &Ruby, server_id: u64) -> Result<(usize, usize, u64, u64), Error> {
+    let Some(server) = registry::try_get(server_id) else {
+        return Ok((0, 0, 0, 0));
+    };
+    Ok((
+        server.active_workers.load(Ordering::Relaxed),
+        server.topology.max_workers,
+        server.scale_ups.load(Ordering::Relaxed),
+        server.scale_downs.load(Ordering::Relaxed),
+    ))
+}
+
 /// One replacement spawned by the quarantine monitor.
 pub fn record_quarantine_replacement(_ruby: &Ruby, server_id: u64) -> Result<(), Error> {
     if let Some(server) = registry::try_get(server_id) {
@@ -1355,6 +1438,32 @@ mod tests {
         assert_eq!(advertised_streams(8, 0), 200);
     }
 
+    #[test]
+    fn stream_capacity_is_advertised_from_the_pool_ceiling() {
+        // An elastic pool grows to meet load an h2 balancer sends, so the
+        // ceiling, not the floor, is the admission to advertise.
+        let topology = registry::Topology {
+            mode: "ractor".to_string(),
+            workers: 2,
+            max_workers: 8,
+            threads: 3,
+            batch: 1,
+        };
+        assert_eq!(stream_capacity(&topology), 24);
+    }
+
+    #[test]
+    fn stream_capacity_of_a_fixed_pool_is_its_slot_count() {
+        let topology = registry::Topology {
+            mode: "threaded".to_string(),
+            workers: 4,
+            max_workers: 4,
+            threads: 3,
+            batch: 1,
+        };
+        assert_eq!(stream_capacity(&topology), 12);
+    }
+
     #[tokio::test]
     async fn streams_beyond_the_advertised_cap_queue_instead_of_failing() {
         use http_body_util::Full;
@@ -1566,4 +1675,110 @@ mod tests {
         assert!(matches!(try_dispatch(&server, test_ctx()), Dispatch::Sent));
         assert_eq!(server.lane_depths(), Some(vec![0, 2]));
     }
+
+    #[test]
+    fn dispatch_skips_retired_lanes() {
+        let server = test_server(true, 4);
+        server.register_worker();
+        server.register_worker();
+        server.slots.read()[0].retire();
+
+        // A retiring worker gets nothing new: both land on slot 1.
+        assert!(matches!(try_dispatch(&server, test_ctx()), Dispatch::Sent));
+        assert!(matches!(try_dispatch(&server, test_ctx()), Dispatch::Sent));
+        assert_eq!(server.lane_depths(), Some(vec![0, 2]));
+    }
+
+    #[test]
+    fn dispatch_retries_rather_than_closing_when_only_retired_lanes_remain() {
+        let server = test_server(true, 4);
+        server.register_worker();
+        server.slots.read()[0].retire();
+
+        // Retired is not draining: the caller keeps retrying until the
+        // queue timeout, so a replacement worker can still pick this up.
+        assert!(matches!(
+            try_dispatch(&server, test_ctx()),
+            Dispatch::Full(_)
+        ));
+    }
+
+    #[test]
+    fn dispatch_skips_a_retired_lane_even_when_it_is_the_only_awake_one() {
+        let server = test_server(true, 4);
+        server.register_worker();
+        server.register_worker();
+        server.slots.read()[0].retire();
+        server.slots.read()[1].parked.store(true, Ordering::Relaxed);
+
+        // The second pass (parked lanes allowed) still skips the retired one.
+        assert!(matches!(try_dispatch(&server, test_ctx()), Dispatch::Sent));
+        assert_eq!(server.lane_depths(), Some(vec![0, 1]));
+    }
+
+    #[test]
+    fn dispatch_keeps_retrying_when_the_other_lanes_are_closed() {
+        let server = test_server(true, 4);
+        server.register_worker();
+        server.register_worker();
+        server.slots.read()[0].lane_tx.lock().take(); // a crashed worker's lane
+        server.slots.read()[1].retire();
+
+        assert!(matches!(
+            try_dispatch(&server, test_ctx()),
+            Dispatch::Full(_)
+        ));
+    }
+
+    #[test]
+    fn a_reset_lane_receives_dispatches_again() {
+        let server = test_server(true, 4);
+        server.register_worker();
+        server.register_worker();
+        server.slots.read()[0].retire();
+        assert!(matches!(try_dispatch(&server, test_ctx()), Dispatch::Sent));
+        assert_eq!(server.lane_depths(), Some(vec![0, 1]));
+
+        server.slots.read()[0].reset();
+        for _ in 0..2 {
+            assert!(matches!(try_dispatch(&server, test_ctx()), Dispatch::Sent));
+        }
+        // Back in the round-robin.
+        assert_eq!(server.lane_depths(), Some(vec![1, 2]));
+    }
+
+    #[test]
+    fn nothing_lands_in_a_lane_after_its_retirement_and_final_drain() {
+        let server = test_server(true, 4);
+        server.register_worker();
+        server.register_worker();
+        let stop = Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let dispatcher = std::thread::spawn({
+            let server = server.clone();
+            let stop = stop.clone();
+            move || {
+                while !stop.load(Ordering::Relaxed) {
+                    let _ = try_dispatch(&server, test_ctx());
+                    // Lane 1 keeps draining, so dispatch never stalls on Full.
+                    let slots = server.slots.read();
+                    if let Some(rx) = slots[1].lane_rx.as_ref() {
+                        while rx.try_recv().is_ok() {}
+                    }
+                }
+            }
+        });
+        std::thread::sleep(Duration::from_millis(20));
+
+        // The scaler retires slot 0; its worker then drains what it holds.
+        let slot = server.slots.read()[0].clone();
+        slot.retire();
+        if let Some(rx) = slot.lane_rx.as_ref() {
+            while rx.try_recv().is_ok() {}
+        }
+
+        std::thread::sleep(Duration::from_millis(50));
+        stop.store(true, Ordering::Relaxed);
+        dispatcher.join().expect("dispatcher thread");
+        assert_eq!(server.lane_depths(), Some(vec![0, 0]));
+    }
 }

data/ext/kino/src/test_support.rs

@@ -92,3 +92,47 @@ pub fn close(ruby: &magnus::Ruby, id: u64) -> Result<(), magnus::Error> {
     chan.tx.lock().take();
     Ok(())
 }
+
+/// Build the cache-backed slice of a Rack env directly, the way `build_env`
+/// does for a real request: REMOTE_ADDR from `ip`, SERVER_NAME/SERVER_PORT
+/// from `host` (the Host-header path) or, when `authority` is given, from
+/// it (the :authority path, which also sets HTTP_HOST), plus one interned
+/// header value. The rooting stress spec calls this from several ractors
+/// at once with more distinct inputs than the LRU caches hold.
+pub fn env_probe(
+    ruby: &magnus::Ruby,
+    host: String,
+    authority: Option<String>,
+    ip: String,
+    user_agent: String,
+) -> Result<magnus::RHash, magnus::Error> {
+    use crate::env_strings;
+    use crate::request::split_host_port;
+
+    let ip: std::net::IpAddr = ip.parse().map_err(|e| {
+        magnus::Error::new(ruby.exception_arg_error(), format!("bad ip {ip:?}: {e}"))
+    })?;
+    let env = ruby.hash_new();
+    env_strings::set_addr_env(ruby, env, ip)?;
+    match &authority {
+        Some(authority) => {
+            env_strings::set_authority_env(ruby, env, authority, || split_host_port(authority, 80))?
+        }
+        None => {
+            env_strings::set_host_env(ruby, env, host.as_bytes(), || split_host_port(&host, 80))?
+        }
+    }
+    let strings = env_strings::get();
+    let key = strings
+        .header_names
+        .get("user-agent")
+        .expect("user-agent is a common header");
+    env_strings::set_value_env(
+        ruby,
+        env,
+        ruby.get_inner(*key),
+        "user-agent",
+        user_agent.as_bytes(),
+    )?;
+    Ok(env)
+}