legion-data 1.10.17 → 1.10.28

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cc2433eff09e371c9b406ba8790fe20da105a2920fb5490947ae590158eee403
-  data.tar.gz: 6d4ec2038079bbf0f01be66b2093313af264651e69ff7d38bf0a89a1f8656b43
+  metadata.gz: ec41889e66777b7940c00db2ed4f19ec704145ea27b149604ba82a168fed9e0b
+  data.tar.gz: a1d0eec9f3cd9e84d63a4b1eb4e145330b4cdd6354d742ca6f003ea78558ca4c
 SHA512:
-  metadata.gz: fdf39d3c2f11766069af4432713e353e87196478585d1c3fe782f1db0aa298f4c0520b579dadb8a343e2b74afdfba485619c29d23188340b45eab641ea726a73
-  data.tar.gz: 4a92b1cd8ab39a28fb9b144286602a851a99d64f468678cc704da1fdb79001cfd60354778da7ea41e45c6f300241ae025fe537743c507763b3d2c0967dd8522b
+  metadata.gz: b62c13c70c6330f24c17c92c645887f7d506ac83b7978cd33226ca198b0294d49823c0143d778cb3cd03e73e508b87b4b90c1ed229f3fd558e7c5f4b7c9a8710
+  data.tar.gz: 3def1ace7b8172f1b8bd3b9ebd513fae7a65bc10cab304a5f6f7a593f6b44ef3431e93484c12af547b34961107fe02901d0930aefa6a8c8405501c95f7bf3de5

data/CHANGELOG.md

@@ -1,5 +1,64 @@
 # Legion::Data Changelog
 
+## [1.10.28] - 2026-10-30
+
+### Changed
+- Remove the unmerged task-idempotency claim migration and restore the existing task creation API without database claims. The concurrent-creation fix for #77 is withdrawn from this PR (#84).
+- Renumber the unmerged append-claims migration from 139 to 138, leaving a contiguous migration sequence without adding a compensating migration. Migrations already on main are unchanged.
+
+## [1.10.27] - 2026-10-30
+
+### Fixed
+- Remove unmerged migration 140 rather than conditionally taking ownership of a runtime-created archive. Verification handles hot-only history without creating schema and rechecks for an archive created during the first verification pass (#79, #84).
+- Preserve database errors other than a genuinely missing archive, including permission failures. Existing hot/warm verification remains a single ordered statement; migrations already on main are unchanged.
+
+## [1.10.26] - 2026-10-29
+
+### Fixed
+- Exercise concurrent SQLite audit/event appends with the same cooperative busy handler used by production connections, avoiding native busy-wait starvation in Ruby 3.4 CI while retaining lock-timeout behavior (#78).
+- Initialize concurrency-spec cleanup state before resource setup and guard an absent release queue so early setup failures are not masked by cleanup errors (#84).
+
+## [1.10.25] - 2026-10-29
+
+### Fixed
+- Archive generic retention backlogs in primary-key-ordered, bounded transactions. Copy locked rows and delete only their complete identities; verify deletion counts and roll back inconsistent batches. Independent workers cannot copy the same locked rows, and concurrent archive-table creation handles PostgreSQL catalog races (#82).
+- Add an optional positive `batch_size` (default 1000), require a declared source primary key, and support composite keys without exceeding SQLite predicate-depth limits. Completed batches survive later failures or process interruption; reruns move only remaining eligible records and report their aggregate count.
+
+## [1.10.24] - 2026-10-29
+
+### Fixed
+- Use the active adapter for privilege checks, including SQLite fallback. PostgreSQL uses native table privileges; MySQL uses nonmutating SELECT and EXPLAIN INSERT probes rather than PostgreSQL-only SQL. Failed queries return false without poisoning future checks (#81).
+- Cache successful privilege lookups per physical connection, invalidate on connection replacement and credential rotation, and prevent in-flight old sessions from overwriting replacement permissions.
+
+## [1.10.23] - 2026-10-29
+
+### Fixed
+- Claim spool entries with nonblocking cross-process file locks before reading, replaying, quarantining, or clearing them. Recheck descriptor identity after acquisition so an already-open deleted file cannot replay again. Reads and clears skip in-flight entries (#80).
+- Preserve callback exceptions and pending events for retry; operating-system lock release recovers crashed owners without stale claim files. Delivery remains at least once if a process exits after its side effect but before deleting the event.
+
+## [1.10.22] - 2026-10-29
+
+### Fixed
+- Verify the audit log across retained hot and warm rows in one ordered database statement, preserving genesis, predecessor, content-hash, and duplicate detection after repeated retention boundaries. Explicit record collections remain strictly verified as supplied; verification counts consumed rows without building an additional result array (#79).
+
+## [1.10.21] - 2026-10-29
+
+### Fixed
+- Serialize audit-chain and governance-stream appends with database claims, including first-entry races. Migration 138 adds scoped append claims. MySQL uses exclusive duplicate-key locking rather than shared-lock upgrades (#78).
+- Read locked tails on network adapters, retain database lock-timeout errors, and verify/walk audit records by append ID rather than writer-clock order. Unrelated insert failures roll back their claims and remain visible to callers.
+
+## [1.10.19] - 2026-10-29
+
+### Fixed
+- Drain database pools through tracked public checkout lifetimes across threaded and sharded pool implementations. Idle pools close immediately; shutdown returns false at its deadline while accepted work finishes, rejects new work, and closes connections and query logging only after the last checkout returns (#76).
+- Rebind loaded models and association caches to the current database on setup so a restart does not reopen a closed pool.
+
+## [1.10.18] - 2026-10-29
+
+### Fixed
+- Preserve task payloads, arguments, results, identities, links, and timestamps through scheduled/policy archival and restore. Copy and delete exact locked row IDs atomically; keep parents referenced by live tasks hot and roll back restores on missing dependencies or occupied IDs (#75).
+- Add migration 137 for missing task archive columns; existing migrations are unchanged. PostgreSQL generated timestamps are excluded from restore inserts.
+
 ## [1.10.17] - 2026-10-29
 
 ### Fixed

data/README.md

@@ -2,7 +2,7 @@
 
 Persistent database storage for the [LegionIO](https://github.com/LegionIO/LegionIO) async job engine and AI coding assistant platform. Provides database connectivity via the [Sequel ORM](https://sequel.jeremyevans.net/), automatic schema migrations (97 numbered migrations), Sequel models for the full LegionIO control plane, and a parallel local SQLite database for on-node agentic cognitive state.
 
-**Version**: 1.10.17 | **Ruby**: >= 3.4 | **License**: Apache-2.0
+**Version**: 1.10.18 | **Ruby**: >= 3.4 | **License**: Apache-2.0
 
 ---
 
@@ -73,7 +73,7 @@ Legion::Data (singleton module)
 │   ├── .connection_info  # Adapter, liveness, and fallback diagnostics
 │   ├── .fallback_active? # True when dev fallback moved a network DB to SQLite
 │   ├── .stats          # Pool metrics, tuning snapshot, adapter-specific DB stats
-│   └── .shutdown       # Disconnect and close query file logger
+│   └── .shutdown       # Drain accepted work; return true only after cleanup
 │
 ├── Migration           # Auto-migration system (97 numbered Sequel DSL migrations)
 │
@@ -151,6 +151,14 @@ Legion::Data::Connection.connection_info
 Legion::Data.shutdown
 ```
 
+### Graceful Database Shutdown
+
+`Legion::Data.shutdown` returns `true` when the shared pool has drained and its connections and query logger are closed. An idle pool closes immediately. Once shutdown starts, new checkouts are rejected; work already accepted by the pool may finish, including nested checkouts in the same execution context.
+
+If `shutdown_timeout` expires, shutdown returns `false` rather than claiming active connections were forcibly closed. The last accepted checkout performs deferred cleanup. `Connection.connection_info[:shutdown]` reports `state` (`open`, `draining`, `closing`, `closed`, or `failed`) and `active_requests`, which counts accepted execution contexts, including pool waiters—not physical connections. A cleanup failure is logged and can be retried by calling shutdown again.
+
+Shutdown does not cancel SQL, kill worker threads, or close borrowed connections. Configure database statement timeouts separately to bound query execution. To resume work after completed shutdown, call `Legion::Data.setup`; it creates a new pool and rebinds loaded models.
+
 ### Model Associations
 
 Models use Sequel associations as the public object graph. Prefer association methods and association datasets over hand-written foreign-key lookups when the relationship is part of the schema contract.
@@ -221,16 +229,48 @@ task = Legion::Data::Model::Task.create_idempotent(
 )
 ```
 
+Terminal tasks and expired TTLs allow a replacement. This database helper uses a lookup followed by an insert; concurrent callers are not guaranteed to receive the same task. It does not provide RabbitMQ delivery or execution deduplication.
+
+### Serialized Audit and Governance Appends
+
+After migration 138, `AuditRecord.append` serializes each chain and `EventStore.append` serializes each stream with database-backed claims, including empty chains. Different audit/event namespaces remain independent. Claim rows do not accumulate after transactions finish; failed appends roll back both claim and record.
+
+Audit tails, verification, and walks use append IDs rather than timestamps, preserving chain order across writer clock skew. Governance events retain their sequential stream numbering. PostgreSQL lock/statement timeouts and native adapter lock limits bound contention; timeout and unrelated database errors propagate rather than being retried indefinitely. MySQL claims use exclusive duplicate-key locking to avoid InnoDB shared-lock upgrade deadlocks.
+
+### Bounded Retention
+
+```ruby
+Legion::Data::Retention.archive_old_records(
+  table: :audit_log, archive_after_days: 90, batch_size: 1000
+) # => { archived: total_moved, table: :audit_log }
+```
+
+Source tables need a declared primary key, including composite keys. `batch_size` must be a positive integer and bounds each materialized batch. Rows are selected in primary-key order; PostgreSQL/MySQL lock them and SQLite uses an immediate write transaction. Each batch copies and deletes exactly the same identities atomically, including when other rows become eligible during the copy.
+
+Outside a caller-owned transaction, each batch commits independently. A later failure is raised without undoing earlier batches; rerun to archive the remaining eligible rows. A successful result sums that invocation's moved rows. If the caller wraps retention in its own transaction, that outer transaction still controls commit and lock lifetime.
+
+### Audit Verification After Retention
+
+`Legion::Data::Model::AuditLog.verify_chain` verifies hot `audit_log` rows together with retained `audit_log_archive` rows in one ordered SQL statement when the archive exists. Moving records between these tables does not discard their predecessors or create a mixed-snapshot boundary. Archived content is rehashed; missing predecessors, modified content, and duplicate copies remain verification failures.
+
+Passing an explicit record collection still verifies exactly that collection from genesis. Cold storage and purged history are not silently trusted: missing archived predecessors remain invalid until the complete history is supplied. This does not change LegionIO's separate tier-verification API.
+
+Before the first retention run, verification reads hot-only history without creating archive schema. It checks again afterward for concurrent archive creation and, if the archive appeared, verifies both tables together. Only an actual missing-table error means the archive is absent; permission, connection, and other database failures propagate.
+
 ### Filesystem Spool (Write Buffer)
 
 When the database is unavailable, `Legion::Data::Spool` buffers writes to `~/.legionio/data/spool/` and replays once the connection is restored:
 
 ```ruby
 spool = Legion::Data::Spool.for(Legion::Extensions::MyLex)
-spool.write({ task_id: SecureRandom.uuid, data: payload })
-spool.drain { |entry| process(entry) }
+spool.write(:events, { task_id: SecureRandom.uuid, data: payload })
+spool.flush(:events) { |entry| process(entry) }
 ```
 
+Replay claims each event with a nonblocking advisory file lock held through the callback and successful deletion. Concurrent processes cannot replay the same live claim. `read` and `clear` skip in-flight entries; `count` includes them until deletion. Corrupt files are quarantined under the same ownership protocol.
+
+Callback failure retains the event and releases its lock. Process exit also releases the lock automatically, so the next drainer can recover it without stale claim markers. Delivery is **at least once**: a crash after an external side effect but before deletion can replay that effect. Callbacks must provide their own idempotency. Single-drainer filename order is preserved, but concurrent completion order is not guaranteed. The spool filesystem must support cooperative advisory locking.
+
 ### Row-Level Security (PostgreSQL)
 
 `Legion::Data::Rls` provides tenant isolation via PostgreSQL session variables (migration 043):
@@ -251,6 +291,10 @@ Legion::Data.can_read?(:tasks)   # => true
 Legion::Data.reset_privileges!   # clear cached privilege checks
 ```
 
+Checks use the active database adapter, including SQLite fallback, and return false while disconnected. PostgreSQL checks table-level SELECT/INSERT grants. MySQL checks base tables with a zero-row SELECT and a nonexecuting `EXPLAIN INSERT`; checking a MySQL view also requires the privileges needed to explain that view, including SHOW VIEW for writes. Neither probe inserts data.
+
+Successful lookups are cached per physical connection. Connection replacement and credential rotation invalidate caches; query or connection failures return false without caching a denial. Call `reset_privileges!` after changing grants or roles on existing sessions.
+
 ---
 
 ## Configuration
@@ -415,6 +459,12 @@ Enable `data.query_log` (or `data.local.query_log`) to write SQL to a dedicated
 
 Replica URLs initialize a sharded pool at startup. URL-specific options override primary connection options; omitted credentials and session timeouts are inherited. Duplicate URLs are registered once as `read_0`, `read_1`, and so on. Reads remain on the primary unless explicitly routed, for example `dataset.server(Legion::Data::Connection.read_server)`. With no replicas configured, `read_server` returns `:default`.
 
+### Task Database Archival
+
+`Archival.archive_completed_tasks` and task-policy archival retain every task field after migration 137. Copy/delete and restore are atomic; only copied task IDs are deleted. A task referenced as a parent or master by another live task remains hot, so linked task trees archive from leaves upward across batches.
+
+Restore preserves original IDs and restores parent/master links after inserting the requested rows. Include archived ancestors in the same restore request or restore them first. Occupied IDs or missing referenced functions/relationships cause rollback and leave the archive intact. Fields already discarded by older archival versions cannot be reconstructed by this migration.
+
 ### Archive Objects
 
 Each archive batch receives a UUID before upload. S3, Azure, and local object paths use `legion-archive/<table>/<year>/<month>/batch_<uuid>.jsonl.gz`; the same UUID is stored in `archive_manifest.batch_id`. Repeated runs do not reuse numbered object names. Existing manifest paths remain valid; no stored objects are renamed. Direct `Archiver.upload_batch` callers must supply `batch_id:` instead of `batch_n:`.

data/lib/legion/data/archival.rb

@@ -10,6 +10,11 @@ module Legion
         tasks:            :tasks_archive,
         metering_records: :metering_records_archive
       }.freeze
+      COLUMN_MAP = { id: :original_id, created_at: :original_created_at, updated_at: :original_updated_at }.freeze
+      TASK_COLUMN_MAP = {
+        id: :original_id, created: :original_created_at, updated: :original_updated_at,
+        function_args: :args, results: :result
+      }.freeze
 
       class << self
         include Legion::Logging::Helper
@@ -42,17 +47,17 @@ module Legion
           return 0 unless archive_table && db_ready?(archive_table)
 
           conn = Legion::Data.connection
-          restored = 0
-          conn.transaction do
-            conn[archive_table].where(original_id: ids).each do |row|
-              restore_row = row.except(:id, :archived_at, :original_id, :original_created_at, :original_updated_at)
-              restore_row[:id] = row[:original_id]
-              restore_row[:created_at] = row[:original_created_at]
-              restore_row[:updated_at] = row[:original_updated_at]
-              conn[source_table].insert(restore_row)
-              restored += 1
+          restored = conn.transaction(savepoint: true, **(conn.database_type == :sqlite ? { mode: :immediate } : {})) do
+            dataset = conn[archive_table].where(original_id: ids).order(:original_id)
+            dataset = dataset.for_update unless conn.database_type == :sqlite
+            archived = dataset.all
+            rows = restore_row_values(conn: conn, source: source_table, archived: archived)
+            rows.each do |row|
+              conn[source_table].insert(source_table == :tasks ? row.merge(parent_id: nil, master_id: nil) : row)
             end
-            conn[archive_table].where(original_id: ids).delete
+            rows.each { |row| conn[:tasks].where(id: row[:id]).update(row.slice(:parent_id, :master_id)) } if source_table == :tasks
+            conn[archive_table].where(id: archived.map { |row| row[:id] }).delete
+            rows.size
           end
           log.info "Restored #{restored} row(s) from #{archive_table} -> #{source_table}"
           restored
@@ -82,30 +87,8 @@ module Legion
 
           return { archived: 0, cutoff: cutoff.iso8601 } unless conn&.table_exists?(:tasks) && conn.table_exists?(:tasks_archive)
 
-          candidates = conn[:tasks]
-                       .where(status: %w[completed failed])
-                       .where(Sequel.lit('created < ?', cutoff))
-                       .limit(batch_size)
-
-          count = candidates.count
-          if count.positive?
-            archive_cols = conn.schema(:tasks_archive).to_set(&:first)
-            conn.transaction do
-              candidates.each do |row|
-                archive_row = {
-                  original_id:         row[:id],
-                  status:              row[:status],
-                  relationship_id:     row[:relationship_id],
-                  original_created_at: row[:created],
-                  original_updated_at: row[:updated],
-                  archived_at:         Time.now
-                }
-                archive_row[:archive_reason] = 'completed_task_archival' if archive_cols.include?(:archive_reason)
-                conn[:tasks_archive].insert(archive_row)
-              end
-              conn[:tasks].where(id: candidates.select(:id)).delete
-            end
-          end
+          count = archive_table!(source: :tasks, destination: :tasks_archive, cutoff: cutoff,
+                                 batch_size: batch_size, dry_run: false, statuses: %w[completed failed])
 
           log.info "archive_completed_tasks: archived #{count} tasks (cutoff: #{cutoff.iso8601})"
           { archived: count, cutoff: cutoff.iso8601 }
@@ -135,24 +118,40 @@ module Legion
 
         private
 
-        def archive_table!(source:, destination:, cutoff:, batch_size:, dry_run:)
+        def archive_table!(source:, destination:, cutoff:, batch_size:, dry_run:, statuses: nil)
           conn = Legion::Data.connection
-          candidates = conn[source].where { created_at < cutoff }.limit(batch_size)
-          count = candidates.count
-          return count if dry_run || count.zero?
-
-          conn.transaction do
-            candidates.each do |row|
-              archive_row = row.dup
-              archive_row[:original_id] = archive_row.delete(:id)
-              archive_row[:original_created_at] = archive_row.delete(:created_at)
-              archive_row[:original_updated_at] = archive_row.delete(:updated_at)
-              archive_row[:archived_at] = Time.now
-              conn[destination].insert(archive_row)
+          date_column = Policy::DATE_COLUMN_OVERRIDES.fetch(source.to_s, :created_at)
+          candidates = conn[source].where(Sequel[date_column] < cutoff).order(:id).limit(batch_size)
+          candidates = candidates.where(status: statuses) if statuses
+          if source == :tasks
+            references = conn.from(Sequel.as(:tasks, :dependent_tasks))
+                             .where(Sequel.|({ parent_id: Sequel[:tasks][:id] }, { master_id: Sequel[:tasks][:id] }))
+                             .exclude(id: Sequel[:tasks][:id]).exists
+            candidates = candidates.exclude(references)
+          end
+          return candidates.count if dry_run
+
+          mapping = source == :tasks ? TASK_COLUMN_MAP : COLUMN_MAP
+          conn.transaction(savepoint: true, **(conn.database_type == :sqlite ? { mode: :immediate } : {})) do
+            locked = conn.database_type == :sqlite ? candidates : candidates.for_update
+            selected_ids = locked.select_map(:id)
+            selected = conn[source].where(id: selected_ids).order(:id)
+            selected = selected.exclude(references) if source == :tasks
+            selected = selected.for_update unless conn.database_type == :sqlite
+            rows = selected.all
+            rows.each do |row|
+              archive_row = row.to_h { |column, value| [mapping.fetch(column, column), value] }
+              conn[destination].insert(archive_row.merge(archived_at: Time.now))
             end
-            conn[source].where(id: candidates.select(:id)).delete
+            conn[source].where(id: rows.map { |row| row[:id] }).delete
+            rows.size
           end
-          count
+        end
+
+        def restore_row_values(conn:, source:, archived:)
+          mapping = source == :tasks ? TASK_COLUMN_MAP : COLUMN_MAP
+          columns = conn.schema(source).reject { |_, info| info[:generated] }.map(&:first)
+          archived.map { |row| columns.to_h { |column| [column, row[mapping.fetch(column, column)]] } }
         end
 
         def db_ready?(table)

data/lib/legion/data/audit_log_hash_chain.rb

@@ -19,6 +19,7 @@ module Legion
 
         def verify(records)
           previous_hash = GENESIS_HASH
+          length = 0
           records.each do |record|
             return invalid(record, :parent_mismatch) unless value_for(record, :previous_hash).to_s == previous_hash
 
@@ -26,9 +27,10 @@ module Legion
             return invalid(record, :hash_mismatch) unless value_for(record, :record_hash).to_s == expected
 
             previous_hash = expected
+            length += 1
           end
 
-          { valid: true, length: records.size }
+          { valid: true, length: length }
         end
 
         def canonical_payload(record)

data/lib/legion/data/audit_record.rb

@@ -2,6 +2,7 @@
 
 require 'legion/logging/helper'
 require 'digest'
+require 'legion/data/database_lock'
 
 module Legion
   module Data
@@ -23,7 +24,8 @@ module Legion
           return { error: 'db unavailable' } unless db_ready?
 
           conn = Legion::Data.connection
-          conn.transaction do
+          Legion::Data::DatabaseLock.with_claim(database: conn, table: :append_claims,
+                                                key: { kind: 'audit', stream_id: chain_id }) do
             parent_hash = latest_chain_hash(conn, chain_id)
             ts          = truncate_to_us(Time.now)
             ch          = compute_chain_hash(parent_hash, content_hash, ts, content_type)
@@ -46,7 +48,7 @@ module Legion
           end
         end
 
-        # Walk all records in the chain ordered by creation time and verify that
+        # Walk all records in append order and verify that
         # each record's stored chain_hash matches a freshly computed one.
         #
         # @param chain_id [String]
@@ -56,7 +58,7 @@ module Legion
 
           records = Legion::Data.connection[:audit_records]
                                 .where(chain_id: chain_id)
-                                .order(:created_at, :id)
+                                .order(:id)
                                 .all
 
           prev_hash = GENESIS_HASH
@@ -88,7 +90,7 @@ module Legion
 
           ds = Legion::Data.connection[:audit_records].where(chain_id: chain_id)
           ds = ds.where { created_at >= since } if since
-          ds.order(:created_at, :id).limit(limit).all.map { |r| deserialize(r) }
+          ds.order(:id).limit(limit).all.map { |r| deserialize(r) }
         end
 
         # Return records filtered by content_type across all chains.
@@ -136,11 +138,12 @@ module Legion
         end
 
         def latest_chain_hash(conn, chain_id)
-          last = conn[:audit_records]
-                 .select(:chain_hash)
-                 .where(chain_id: chain_id)
-                 .order(Sequel.desc(:created_at), Sequel.desc(:id))
-                 .first
+          records = conn[:audit_records]
+                    .select(:chain_hash)
+                    .where(chain_id: chain_id)
+                    .order(Sequel.desc(:id))
+          records = records.for_update unless conn.database_type == :sqlite
+          last = records.first
           last ? last[:chain_hash] : GENESIS_HASH
         end
 

data/lib/legion/data/connection.rb

@@ -2,6 +2,7 @@
 
 require 'legion/logging/helper'
 require 'legion/data/auth_failure_handler'
+require 'legion/data/connection_pool'
 
 require 'fileutils'
 require 'sequel'
@@ -165,7 +166,16 @@ module Legion
       class << self
         include Legion::Logging::Helper
 
-        attr_accessor :sequel
+        attr_reader :sequel
+
+        def sequel=(database)
+          if database
+            pool = database.pool
+            pool.extend(Legion::Data::ConnectionPool) unless pool.is_a?(Legion::Data::ConnectionPool)
+          end
+          Legion::Data.reset_privileges!
+          @sequel = database
+        end
 
         def adapter
           @adapter ||= Legion::Settings[:data][:adapter]&.to_sym || :sqlite
@@ -180,28 +190,28 @@ module Legion
           log.info("Legion::Data::Connection setup adapter=#{adapter}")
           @fallback_active = false
           @replica_servers = []
-          @sequel = if adapter == :sqlite
-                      ::Sequel.connect(opts.merge(adapter: :sqlite, database: sqlite_path))
-                    else
-                      attempted_adapter = adapter
-                      begin
-                        ::Sequel.connect(connection_opts_for(adapter: attempted_adapter, opts: opts))
-                      rescue UnresolvedCredentialError => e
-                        handle_exception(e, level: :fatal, handled: false, operation: :data_connect)
-                        raise
-                      rescue ::Sequel::DatabaseConnectionError => e
-                        raise unless dev_fallback?
-
-                        log.error("Legion::Data FALLING BACK TO SQLITE — #{attempted_adapter} network DB connection failed: #{e.message}")
-                        log.error("Legion::Data WARNING: Data written to SQLite will NOT be visible when #{attempted_adapter} reconnects. " \
-                                  'Apollo knowledge, audit logs, and other DB-backed services will use a local-only store.')
-                        handle_exception(e, level: :error, handled: true, operation: :shared_connect, fallback: :sqlite)
-                        @adapter = :sqlite
-                        @fallback_active = true
-                        sqlite_opts = sequel_opts
-                        ::Sequel.connect(sqlite_opts.merge(adapter: :sqlite, database: sqlite_path))
-                      end
-                    end
+          self.sequel = if adapter == :sqlite
+                          ::Sequel.connect(opts.merge(adapter: :sqlite, database: sqlite_path))
+                        else
+                          attempted_adapter = adapter
+                          begin
+                            ::Sequel.connect(connection_opts_for(adapter: attempted_adapter, opts: opts))
+                          rescue UnresolvedCredentialError => e
+                            handle_exception(e, level: :fatal, handled: false, operation: :data_connect)
+                            raise
+                          rescue ::Sequel::DatabaseConnectionError => e
+                            raise unless dev_fallback?
+
+                            log.error("Legion::Data FALLING BACK TO SQLITE — #{attempted_adapter} network DB connection failed: #{e.message}")
+                            log.error("Legion::Data WARNING: Data written to SQLite will NOT be visible when #{attempted_adapter} reconnects. " \
+                                      'Apollo knowledge, audit logs, and other DB-backed services will use a local-only store.')
+                            handle_exception(e, level: :error, handled: true, operation: :shared_connect, fallback: :sqlite)
+                            @adapter = :sqlite
+                            @fallback_active = true
+                            sqlite_opts = sequel_opts
+                            ::Sequel.connect(sqlite_opts.merge(adapter: :sqlite, database: sqlite_path))
+                          end
+                        end
           @replica_servers = @sequel.opts.fetch(:servers, {}).keys
           log_connection_info
           configure_extensions
@@ -221,6 +231,7 @@ module Legion
             connected:          Legion::Settings[:data][:connected],
             fallback_active:    @fallback_active || false,
             configured_adapter: Legion::Settings[:data][:adapter]&.to_sym || :sqlite,
+            shutdown:           @sequel&.pool&.shutdown_status,
             sequel_alive:       (begin
               !@sequel&.test_connection.nil?
             rescue StandardError => e
@@ -287,16 +298,26 @@ module Legion
         end
 
         def shutdown
-          if @sequel
-            timeout = Legion::Settings[:data][:shutdown_timeout]
-            force_disconnect_pool(timeout: timeout)
+          database = @sequel
+          logger = @query_file_logger
+          on_closed = proc do
+            logger&.close
+            if @sequel.equal?(database)
+              @query_file_logger = nil
+              @fallback_active = false
+              @replica_servers = []
+              Legion::Settings[:data][:connected] = false
+            end
+            log.info 'Legion::Data connection closed'
           end
-          @query_file_logger&.close
-          @query_file_logger = nil
-          @fallback_active = false
-          @replica_servers = []
-          Legion::Settings[:data][:connected] = false
-          log.info 'Legion::Data connection closed'
+          unless database
+            on_closed.call
+            return true
+          end
+
+          closed = database.pool.shutdown(timeout: Legion::Settings[:data][:shutdown_timeout], &on_closed)
+          log.warn("Legion::Data shutdown incomplete: #{database.pool.shutdown_status}") unless closed
+          closed
         end
 
         def reconnect_with_fresh_creds
@@ -317,6 +338,7 @@ module Legion
           old_user = @sequel.opts[:user]
           @sequel.opts[:user] = new_user
           @sequel.opts[:password] = new_pass
+          Legion::Data.reset_privileges!
 
           @sequel.disconnect
           expire_all_pooled_connections
@@ -441,28 +463,6 @@ module Legion
           data_settings[:dev_mode] == true && data_settings[:dev_fallback] != false
         end
 
-        def force_disconnect_pool(timeout:)
-          pool = @sequel.pool
-          in_use = pool.size - (pool.respond_to?(:available_connections) ? pool.available_connections.size : 0)
-
-          if in_use.positive?
-            log.warn("Legion::Data shutdown: #{in_use} connection(s) still checked out, waiting up to #{timeout}s")
-            deadline = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + timeout
-            while ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) < deadline
-              break if pool.size <= (pool.respond_to?(:available_connections) ? pool.available_connections.size : 0)
-
-              sleep 0.1
-            end
-            remaining = pool.size - (pool.respond_to?(:available_connections) ? pool.available_connections.size : 0)
-            log.warn("Legion::Data shutdown: force-disconnecting #{remaining} wedged connection(s)") if remaining.positive?
-          end
-
-          @sequel.disconnect
-        rescue StandardError => e
-          handle_exception(e, level: :warn, handled: true, operation: :force_disconnect_pool)
-          @sequel&.disconnect rescue nil # rubocop:disable Style/RescueModifier
-        end
-
         def sqlite_path
           path = Legion::Settings[:data][:creds][:database] || 'legionio.db'
           return path if File.absolute_path?(path)

data/lib/legion/data/connection_pool.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require 'legion/logging/helper'
+
+module Legion
+  module Data
+    module ConnectionPool
+      include Legion::Logging::Helper
+
+      def self.extended(pool)
+        pool.instance_variable_set(:@shutdown_mutex, Mutex.new)
+        pool.instance_variable_set(:@shutdown_condition, ConditionVariable.new)
+        pool.instance_variable_set(:@shutdown_owners, {}.compare_by_identity)
+        pool.instance_variable_set(:@shutdown_state, :open)
+      end
+
+      def hold(server = :default)
+        owner = Sequel.current
+        @shutdown_mutex.synchronize do
+          raise Sequel::Error, 'Database pool is shutting down or closed' unless @shutdown_state == :open || @shutdown_owners.key?(owner)
+
+          @shutdown_owners[owner] = @shutdown_owners.fetch(owner, 0) + 1
+        end
+        begin
+          super
+        ensure
+          finish = @shutdown_mutex.synchronize do
+            @shutdown_owners[owner] -= 1
+            @shutdown_owners.delete(owner) if @shutdown_owners[owner].zero?
+            if @shutdown_state == :draining && @shutdown_owners.empty?
+              @shutdown_state = :closing
+              true
+            end
+          end
+          finish_shutdown if finish
+        end
+      end
+
+      def shutdown(timeout:, &on_closed)
+        deadline = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + timeout
+        finish = @shutdown_mutex.synchronize do
+          @shutdown_callback ||= on_closed
+          @shutdown_state = :draining if %i[open failed].include?(@shutdown_state)
+          if @shutdown_state == :draining && @shutdown_owners.empty?
+            @shutdown_state = :closing
+            true
+          end
+        end
+        finish_shutdown if finish
+        @shutdown_mutex.synchronize do
+          until @shutdown_state == :closed
+            remaining = deadline - ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+            return false if remaining <= 0 || @shutdown_state == :failed || @shutdown_owners.key?(Sequel.current)
+
+            @shutdown_condition.wait(@shutdown_mutex, remaining)
+          end
+        end
+        true
+      end
+
+      def shutdown_status
+        @shutdown_mutex.synchronize { { state: @shutdown_state, active_requests: @shutdown_owners.size } }
+      end
+
+      private
+
+      def finish_shutdown
+        disconnect
+        @shutdown_callback.call
+        @shutdown_mutex.synchronize do
+          @shutdown_state = :closed
+          @shutdown_condition.broadcast
+        end
+      rescue StandardError => e
+        @shutdown_mutex.synchronize do
+          @shutdown_state = :failed
+          @shutdown_condition.broadcast
+        end
+        handle_exception(e, level: :error, handled: true, operation: :pool_shutdown)
+      end
+    end
+  end
+end

data/lib/legion/data/database_lock.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Legion
+  module Data
+    module DatabaseLock
+      def self.with_claim(database:, table:, key:)
+        options = { savepoint: true }
+        options[:mode] = :immediate if database.database_type == :sqlite
+        database.transaction(**options) do
+          claim = database[table].where(key)
+          # InnoDB needs exclusive duplicate-key locks to avoid shared-lock upgrade deadlocks.
+          claim = claim.on_duplicate_key_update(*key.keys) if database.database_type == :mysql
+          claim.insert(key)
+          result = yield
+          # The unique-key lock lasts until commit; historical keys need no retained rows.
+          claim.delete
+          result
+        end
+      end
+    end
+  end
+end

data/lib/legion/data/event_store.rb

@@ -2,6 +2,7 @@
 
 require 'legion/logging/helper'
 require 'digest'
+require 'legion/data/database_lock'
 
 module Legion
   module Data
@@ -21,11 +22,11 @@ module Legion
           return { error: 'db unavailable' } unless db_ready?
 
           conn = Legion::Data.connection
-          conn.transaction do
-            last = conn[:governance_events]
-                   .where(stream_id: stream)
-                   .order(Sequel.desc(:sequence_number))
-                   .first
+          Legion::Data::DatabaseLock.with_claim(database: conn, table: :append_claims,
+                                                key: { kind: 'event', stream_id: stream }) do
+            records = conn[:governance_events].where(stream_id: stream).order(Sequel.desc(:sequence_number))
+            records = records.for_update unless conn.database_type == :sqlite
+            last = records.first
 
             seq = (last&.[](:sequence_number) || 0) + 1
             prev_hash = last&.[](:event_hash) || ('0' * 64)

data/lib/legion/data/migrations/137_preserve_task_archive_fields.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+Sequel.migration do
+  up do
+    alter_table(:tasks_archive) do
+      add_column :function_id, Integer
+      add_column :parent_id, Integer
+      add_column :master_id, Integer
+      add_column :payload, String, text: true
+      add_column :worker_id, String, size: 36
+      add_column :tenant_id, String, size: 64
+      add_column :depth, Integer
+      add_column :cancelled_at, DateTime
+      add_column :task_delay, Integer
+      add_column :created_at, DateTime
+      add_column :idempotency_key, String, size: 64
+      add_column :idempotency_expires_at, DateTime
+    end
+  end
+
+  down do
+    alter_table(:tasks_archive) do
+      drop_column :function_id
+      drop_column :parent_id
+      drop_column :master_id
+      drop_column :payload
+      drop_column :worker_id
+      drop_column :tenant_id
+      drop_column :depth
+      drop_column :cancelled_at
+      drop_column :task_delay
+      drop_column :created_at
+      drop_column :idempotency_key
+      drop_column :idempotency_expires_at
+    end
+  end
+end

data/lib/legion/data/migrations/138_add_append_claims.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+Sequel.migration do
+  change do
+    create_table(:append_claims) do
+      String :kind, size: 16, null: false
+      String :stream_id, size: 255, null: false
+      primary_key %i[kind stream_id]
+    end
+  end
+end

data/lib/legion/data/model.rb

@@ -30,7 +30,10 @@ module Legion
         def load
           log.info 'Loading Legion::Data::Models'
           @loaded_models ||= []
+          database = Legion::Data::Connection.sequel
+          Sequel::Model.db = database
           require_sequel_models(models)
+          bind_database(namespace: Legion::Data::Model, database: database)
           Legion::Settings[:data][:models][:loaded] = true
         end
 
@@ -49,6 +52,22 @@ module Legion
           handle_exception(e, level: :fatal, operation: :load_sequel_model, model: model)
           raise e unless Legion::Settings[:data][:models][:continue_on_load_fail]
         end
+
+        private
+
+        def bind_database(namespace:, database:)
+          namespace.constants(false).each do |name|
+            value = namespace.const_get(name, false)
+            if value.is_a?(Class) && value < Sequel::Model
+              next if value.db.equal?(database)
+
+              value.set_dataset(database[value.table_name])
+              value.association_reflections.each_value { |reflection| reflection[:cache]&.clear }
+            elsif value.is_a?(Module)
+              bind_database(namespace: value, database: database)
+            end
+          end
+        end
       end
     end
   end

data/lib/legion/data/models/audit_log.rb

@@ -8,9 +8,11 @@ module Legion
     module Model
       class AuditLog < Sequel::Model(:audit_log)
         include Legion::Logging::Helper
+        extend Legion::Logging::Helper
 
         VALID_EVENT_TYPES = %w[runner_execution lifecycle_transition].freeze
         VALID_STATUSES    = %w[success failure denied].freeze
+        HASH_CHAIN_COLUMNS = [:id, :record_hash, *Legion::Data::AuditLogHashChain::CANONICAL_FIELDS].freeze
 
         def validate
           super
@@ -39,9 +41,39 @@ module Legion
           Legion::Data::AuditLogHashChain.compute_hash(record)
         end
 
-        def self.verify_chain(records = order(:created_at, :id).all)
-          Legion::Data::AuditLogHashChain.verify(records)
+        def self.verify_chain(records = nil)
+          return Legion::Data::AuditLogHashChain.verify(records) unless records.nil?
+
+          hot = dataset.naked.select(*HASH_CHAIN_COLUMNS)
+          unless audit_archive_exists?
+            result = Legion::Data::AuditLogHashChain.verify(hot.order(:created_at, :id))
+            # Retention may create the archive and move rows after the first presence check.
+            return result unless audit_archive_exists?
+          end
+
+          warm = db[:audit_log_archive].select(*HASH_CHAIN_COLUMNS)
+          Legion::Data::AuditLogHashChain.verify(hot.union(warm, all: true).order(:created_at, :id))
+        end
+
+        def self.audit_archive_exists?
+          db.transaction(savepoint: :only) { db[:audit_log_archive].get(Sequel::NULL) }
+          true
+        rescue Sequel::DatabaseError => e
+          cause = e.wrapped_exception
+          missing = case db.database_type
+                    when :postgres
+                      cause.is_a?(::PG::UndefinedTable)
+                    when :mysql
+                      cause.respond_to?(:error_number) && cause.error_number == 1146
+                    when :sqlite
+                      cause.is_a?(::SQLite3::SQLException) && cause.message.start_with?('no such table: audit_log_archive')
+                    end
+          raise unless missing
+
+          handle_exception(e, level: :debug, handled: true, operation: :audit_archive_presence)
+          false
         end
+        private_class_method :audit_archive_exists?
       end
     end
   end

data/lib/legion/data/retention.rb

@@ -12,24 +12,36 @@ module Legion
       class << self
         include Legion::Logging::Helper
 
-        def archive_old_records(table:, date_column: nil, archive_after_days: DEFAULT_ARCHIVE_AFTER_DAYS)
+        def archive_old_records(table:, date_column: nil, archive_after_days: DEFAULT_ARCHIVE_AFTER_DAYS, batch_size: 1000)
           db = Legion::Data.connection
           return { archived: 0, table: table } unless db
+          raise ArgumentError, 'batch_size must be a positive Integer' unless batch_size.is_a?(Integer) && batch_size.positive?
 
           date_column = resolve_date_column(table, date_column)
           cutoff = Time.now - (archive_after_days * 86_400)
           archive_table = archive_table_name(table)
+          primary_keys = db.schema(table).filter_map { |name, info| name if info[:primary_key] }
+          raise Sequel::Error, "#{table} needs a primary key for bounded retention" if primary_keys.empty?
 
           ensure_archive_table!(db, table, archive_table)
 
           count = 0
-          db.transaction do
-            records = db[table].where(Sequel.identifier(date_column) < cutoff)
-            count = records.count
-            if count.positive?
-              db[archive_table].multi_insert(records.all)
-              records.delete
+          loop do
+            archived = db.transaction(savepoint: true, **(db.database_type == :sqlite ? { mode: :immediate } : {})) do
+              records = db[table].where(Sequel.identifier(date_column) < cutoff).order(*primary_keys).limit(batch_size)
+              records = records.for_update unless db.database_type == :sqlite
+              rows = records.all
+              next 0 if rows.empty?
+
+              db[archive_table].multi_insert(rows)
+              deleted = delete_archived_rows(db: db, table: table, rows: rows, primary_keys: primary_keys)
+              raise Sequel::Error, "Retention copied #{rows.length} rows but deleted #{deleted} from #{table}" unless deleted == rows.length
+
+              deleted
             end
+            break if archived.zero?
+
+            count += archived
           end
 
           log.info "Archived #{count} row(s) from #{table}" if count.positive?
@@ -113,18 +125,37 @@ module Legion
           end
         end
 
+        def delete_archived_rows(db:, table:, rows:, primary_keys:)
+          if primary_keys.one?
+            key = primary_keys.first
+            return db[table].where(key => rows.map { |row| row.fetch(key) }).delete
+          end
+
+          # SQLite expands composite-key predicates into OR expressions with a depth limit.
+          identity_batch_size = db.database_type == :sqlite ? 100 : rows.length
+          rows.each_slice(identity_batch_size).sum do |batch|
+            db[table].where(primary_keys => batch.map { |row| row.values_at(*primary_keys) }).delete
+          end
+        end
+
         def ensure_archive_table!(db, source_table, archive_table)
           return if db.table_exists?(archive_table)
 
           source_schema = db.schema(source_table).to_h
 
           log.info "Creating archive table #{archive_table} from #{source_table}"
-          db.create_table(archive_table) do
-            source_schema.each do |col_name, col_info|
-              column col_name, col_info[:db_type]
+          db.transaction(savepoint: true) do
+            db.create_table?(archive_table) do
+              source_schema.each do |col_name, col_info|
+                column col_name, col_info[:db_type]
+              end
+              DateTime :archived_at, default: Sequel::CURRENT_TIMESTAMP
             end
-            DateTime :archived_at, default: Sequel::CURRENT_TIMESTAMP
           end
+        rescue Sequel::UniqueConstraintViolation => e
+          raise unless db.table_exists?(archive_table)
+
+          handle_exception(e, level: :debug, handled: true, operation: :concurrent_archive_creation, table: archive_table)
         end
       end
     end

data/lib/legion/data/spool.rb

@@ -61,8 +61,10 @@ module Legion
 
         def read(sub_namespace)
           sorted_files(sub_namespace).each_with_object([]) do |path, events|
-            event = load_event_file(path, sub_namespace)
-            events << event if event
+            with_locked_event(path) do |file|
+              event = load_event_file(file, path, sub_namespace)
+              events << event if event
+            end
           end
         rescue StandardError => e
           handle_exception(e, level: :error, handled: false, operation: :spool_read, sub_namespace: sub_namespace)
@@ -72,13 +74,16 @@ module Legion
         def flush(sub_namespace)
           count = 0
           path = nil
-          sorted_files(sub_namespace).each do |path|
-            event = load_event_file(path, sub_namespace)
-            next unless event
-
-            yield event
-            File.delete(path)
-            count += 1
+          sorted_files(sub_namespace).each do |entry_path|
+            path = entry_path
+            with_locked_event(path) do |file|
+              event = load_event_file(file, path, sub_namespace)
+              next unless event
+
+              yield event
+              File.delete(path)
+              count += 1
+            end
           end
           log.info "Spool drained #{count} item(s) from #{sub_namespace}" if count.positive?
           count
@@ -95,8 +100,10 @@ module Legion
           dir = sub_dir(sub_namespace)
           return unless Dir.exist?(dir)
 
-          Dir[File.join(dir, '*.json')].each { |f| File.delete(f) }
-          log.info "Spool cleared #{sub_namespace}"
+          sorted_files(sub_namespace).each do |path|
+            with_locked_event(path) { |_file| File.delete(path) }
+          end
+          log.info "Spool cleared unclaimed events from #{sub_namespace}"
         rescue StandardError => e
           handle_exception(e, level: :error, handled: false, operation: :spool_clear, sub_namespace: sub_namespace)
           raise
@@ -115,11 +122,24 @@ module Legion
           Dir.glob(File.join(dir, '*.json'), sort: true)
         end
 
-        def load_event_file(path, sub_namespace)
-          ::JSON.parse(File.binread(path), symbolize_names: true)
-        rescue Errno::ENOENT => e
-          log.debug("spool event file not found: #{path}: #{e.message}")
-          nil
+        def with_locked_event(path)
+          file = begin
+            File.open(path, 'rb')
+          rescue Errno::ENOENT => e
+            log.debug("spool event file not found: #{path}: #{e.message}")
+            nil
+          end
+          return unless file
+          return unless file.flock(File::LOCK_EX | File::LOCK_NB)
+          return unless File.identical?(file, path)
+
+          yield file
+        ensure
+          file&.close
+        end
+
+        def load_event_file(file, path, sub_namespace)
+          ::JSON.parse(file.read, symbolize_names: true)
         rescue ::JSON::ParserError, EOFError, ArgumentError => e
           quarantine_corrupt_file(path, sub_namespace, e)
           nil

data/lib/legion/data/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Data
-    VERSION = '1.10.17'
+    VERSION = '1.10.28'
   end
 end

data/lib/legion/data.rb

@@ -133,36 +133,56 @@ module Legion
       def can_write?(table_name)
         return false unless connected?
 
-        adapter = Legion::Settings[:data][:adapter]&.to_s
-        return true if adapter == 'sqlite'
-
-        @write_privileges ||= {}
-        return @write_privileges[table_name] unless @write_privileges[table_name].nil?
-
-        @write_privileges[table_name] = connection
-                                        .fetch("SELECT has_table_privilege(current_user, ?, 'INSERT') AS can", table_name.to_s)
-                                        .first[:can] == true
+        database = connection
+        return false unless database
+        return true if database.database_type == :sqlite
+
+        cache = @write_privileges ||= ObjectSpace::WeakKeyMap.new
+        database.synchronize do |session|
+          privileges = cache[session] ||= {}
+          return privileges[table_name] if privileges.key?(table_name)
+
+          privileges[table_name] = case database.database_type
+                                   when :postgres
+                                     database.fetch("SELECT has_table_privilege(current_user, ?, 'INSERT') AS can", table_name.to_s)
+                                             .server(:default).first[:can] == true
+                                   when :mysql
+                                     database.fetch('EXPLAIN INSERT INTO ? () VALUES ()', Sequel.identifier(table_name)).server(:default).all
+                                     true
+                                   else
+                                     raise Sequel::Error, "Unsupported privilege adapter: #{database.database_type}"
+                                   end
+        end
       rescue StandardError => e
         handle_exception(e, level: :warn, handled: true, operation: :can_write?, table: table_name)
-        @write_privileges[table_name] = false if @write_privileges
         false
       end
 
       def can_read?(table_name)
         return false unless connected?
 
-        adapter = Legion::Settings[:data][:adapter]&.to_s
-        return true if adapter == 'sqlite'
-
-        @read_privileges ||= {}
-        return @read_privileges[table_name] unless @read_privileges[table_name].nil?
-
-        @read_privileges[table_name] = connection
-                                       .fetch("SELECT has_table_privilege(current_user, ?, 'SELECT') AS can", table_name.to_s)
-                                       .first[:can] == true
+        database = connection
+        return false unless database
+        return true if database.database_type == :sqlite
+
+        cache = @read_privileges ||= ObjectSpace::WeakKeyMap.new
+        database.synchronize do |session|
+          privileges = cache[session] ||= {}
+          return privileges[table_name] if privileges.key?(table_name)
+
+          privileges[table_name] = case database.database_type
+                                   when :postgres
+                                     database.fetch("SELECT has_table_privilege(current_user, ?, 'SELECT') AS can", table_name.to_s)
+                                             .server(:default).first[:can] == true
+                                   when :mysql
+                                     database.fetch('SELECT * FROM ? LIMIT 0', Sequel.identifier(table_name)).server(:default).all
+                                     true
+                                   else
+                                     raise Sequel::Error, "Unsupported privilege adapter: #{database.database_type}"
+                                   end
+        end
       rescue StandardError => e
         handle_exception(e, level: :warn, handled: true, operation: :can_read?, table: table_name)
-        @read_privileges[table_name] = false if @read_privileges
         false
       end
 
@@ -205,8 +225,9 @@ module Legion
 
       def shutdown
         Legion::Data::Local.shutdown if defined?(Legion::Data::Local) && Legion::Data::Local.connected?
-        Legion::Data::Connection.shutdown
-        log.info 'Legion::Data shutdown complete'
+        closed = Legion::Data::Connection.shutdown
+        log.info 'Legion::Data shutdown complete' if closed
+        closed
       end
 
       private

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-data
 version: !ruby/object:Gem::Version
-  version: 1.10.17
+  version: 1.10.28
 platform: ruby
 authors:
 - Esity
@@ -126,6 +126,8 @@ files:
 - lib/legion/data/audit_record.rb
 - lib/legion/data/auth_failure_handler.rb
 - lib/legion/data/connection.rb
+- lib/legion/data/connection_pool.rb
+- lib/legion/data/database_lock.rb
 - lib/legion/data/encryption/cipher.rb
 - lib/legion/data/encryption/key_provider.rb
 - lib/legion/data/encryption/sequel_plugin.rb
@@ -284,6 +286,8 @@ files:
 - lib/legion/data/migrations/134_add_route_attempt_columns.rb
 - lib/legion/data/migrations/135_add_llm_context_token_accounting.rb
 - lib/legion/data/migrations/136_drop_llm_messages_seq_unique.rb
+- lib/legion/data/migrations/137_preserve_task_archive_fields.rb
+- lib/legion/data/migrations/138_add_append_claims.rb
 - lib/legion/data/model.rb
 - lib/legion/data/models/apollo/access_log.rb
 - lib/legion/data/models/apollo/entries.rb