monkrb 0.18.0 → 0.20.0

data/lib/monk/templates/base/public/js/app.js

@@ -1,5 +1,5 @@
 // Served as-is and loaded as an ES module -- no build step. Import your
 // own files by relative path with a real extension
 // (import { x } from "./x.js"), and anything third-party through the
-// import map in views/layouts/app.erb.
+// import map in app/views/layouts/app.erb.
 console.log("monk");

data/lib/monk/templates/jobs/{jobs → app/jobs}/send_login_link.rb

@@ -21,7 +21,8 @@ class SendLoginLink < Monk::Job
     token = Monk::Auth.request_login(email, redirect_to: redirect_to)
     # Your callback route; config/settings.rb's public_url is the origin.
     link = "#{Monk::Settings[:public_url]}/auth/callback/#{token}"
-    # Calls config/auth.rb's deliver: -- a synchronous send, here in the job.
+    # Calls config/auth.rb's deliver: (AppMailer::MAGIC_LINK) -- a
+    # synchronous send, here in the job.
     Monk::Auth.deliver_link(email: email, link: link, token: token)
   end
 end

data/lib/monk/templates/jobs/bin/jobs

@@ -1,22 +1,14 @@
 #!/usr/bin/env ruby
 require "bundler/setup"
-require_relative "../config/settings"
-
-# Loaded when this app has them, so jobs can send mail or use Monk::Auth --
-# a missing file is a harmless no-op, the same way bin/websocket_server
-# treats config/auth.rb.
-%w[mail auth].each do |name|
-  require_relative "../config/#{name}"
-rescue LoadError
-  nil
-end
-
-require_relative "../config/jobs"
+# The configs and app/, as the web process loads them, so a job can use
+# the app's models and mailers, send mail, or push a Live update --
+# config/load.rb, never Monk.boot: this process serves no routes.
+require_relative "../config/load"
 require "monk/jobs/runtime"
 
 # The app's templates, so a job can render one (a mail's HTML part, say):
 # there's no App class here to point Monk::Views at them.
-Monk::Views.root = File.expand_path("../views", __dir__)
+Monk::Views.root = File.expand_path("../app/views", __dir__)
 
 workers = Integer(ENV.fetch("JOBS_WORKERS", "5"))
 queues = ENV.fetch("JOBS_QUEUES", "default").split(",").map(&:strip)

data/lib/monk/templates/jobs/config/jobs.rb

@@ -4,8 +4,8 @@ require_relative "persistence"
 
 # Background jobs (Monk::Jobs): enqueue from any route, e.g.
 # HelloJob.enqueue("world"); bin/jobs runs them. Every job is a class under
-# jobs/, loaded below so the web process can enqueue it and bin/jobs can
-# run it.
+# app/jobs/, which config/load.rb loads after this file, so the web process
+# can enqueue it and bin/jobs can run it.
 #
 # The queue lives in the app's own database, so a job can be enqueued
 # inside the app's own transaction: HelloJob.enqueue("world", conn: conn).
@@ -13,5 +13,3 @@ require_relative "persistence"
 # a database of its own -- register it in config/persistence.rb and pass
 # its name here (Monk's docs/guides/jobs.md, "Keeping the queue healthy").
 Monk::Jobs.configure(db_name: :primary)
-
-Dir[File.expand_path("../jobs/*.rb", __dir__)].sort.each { |file| require file }

data/lib/monk/templates/live/{config.ru → app/app.rb}

@@ -1,8 +1,5 @@
-require_relative "config/settings"
-require_relative "config/live"
-
 class App < Monk::Base
-  views "views"
+  views "app/views"
   layout "layouts/app"
   assets "public"
 
@@ -23,5 +20,3 @@ class App < Monk::Base
   get("/hello") { "hello from monk" }
   get("/api/hello") { json(message: "hello from monk") }
 end
-
-run Monk.boot(App)

data/lib/monk/templates/live/{views → app/views}/index.erb

@@ -12,7 +12,7 @@
 
 <p>
   The pieces: <code>live_topic</code> in this view, the partial
-  <code>views/live/_hits.erb</code>, <code>Monk::Live.patch</code> in
-  <code>POST /hit</code> (<code>config.ru</code>), and the rules and Redis
+  <code>app/views/live/_hits.erb</code>, <code>Monk::Live.patch</code> in
+  <code>POST /hit</code> (<code>app/app.rb</code>), and the rules and Redis
   wiring in <code>config/live.rb</code>.
 </p>

data/lib/monk/templates/live/bin/websocket_server

@@ -13,11 +13,29 @@ end
 
 # Monk::Live: the browsers' sockets end here. The handler takes their
 # subscribe/unsubscribe messages, checks each topic against the rules in
-# config/live.rb, and relays whatever config.ru's process publishes over
+# config/live.rb, and relays whatever bin/server's process publishes over
 # Redis.
 require_relative "../config/live"
 
-authenticate = defined?(Monk::Auth) && !!Monk::Auth.config
+# This process holds the browsers' sockets, so it's the only one that
+# listens for updates published elsewhere (bin/server, bin/jobs): the
+# fanout's subscriber connection is opened here, at boot, and an
+# unreachable Redis/Postgres fails right here.
+Monk::Live.listen!
+
+# With Monk::Auth (--auth), a socket with a valid session gets its user,
+# and one without -- a visitor, or a session since revoked -- comes in
+# anonymous instead of refused. The rules in config/live.rb decide what
+# each may subscribe to: a topic is open to visitors only if its rule says
+# `anonymous: true`, like the demo's "hits". Without Monk::Auth every
+# socket is anonymous.
+authenticate = defined?(Monk::Auth) && Monk::Auth.config ? :optional : false
+# Sessions are checked through config/auth.rb's :auth pool rather than in
+# each socket's own Ractor, which would hold a Postgres connection per
+# open page. This is the only process that uses the pool, so it starts it.
+db_pool = (:auth if authenticate)
+Monk::Persistence::Pg.start_pools!(db_pool) if db_pool
+
 port = ENV.fetch("WS_PORT", "9293").to_i
 # Defaults to public_url (config/settings.rb) so one PUBLIC_URL env var
 # keeps this in sync with the app's actual origin instead of two vars
@@ -25,6 +43,8 @@ port = ENV.fetch("WS_PORT", "9293").to_i
 # more than one origin (comma-separated).
 allowed_origins = ENV.fetch("WS_ALLOWED_ORIGINS", Monk::Settings[:public_url]).split(",")
 
-server = Monk::WebSocket::Server.new(port: port, authenticate: authenticate, allowed_origins: allowed_origins)
+server = Monk::WebSocket::Server.new(
+  port: port, authenticate: authenticate, allowed_origins: allowed_origins, db_pool: db_pool,
+)
 puts "Monk::Live WebSocket server listening on ws://0.0.0.0:#{port} (authenticate: #{authenticate})"
 server.run(&Monk::Live::HANDLER)

data/lib/monk/templates/live/config/live.rb

@@ -1,4 +1,4 @@
-# Monk::Live wiring, required by both processes: config.ru (this app
+# Monk::Live wiring, required by both processes: config/load.rb (this app
 # publishes updates, e.g. from a route) and bin/websocket_server (the browsers'
 # sockets terminate there and are handed the updates).
 #

data/lib/monk/templates/live/config/live_pg.rb

@@ -1,4 +1,4 @@
-# Monk::Live wiring, required by both processes: config.ru (this app
+# Monk::Live wiring, required by both processes: config/load.rb (this app
 # publishes updates, e.g. from a route) and bin/websocket_server (the browsers'
 # sockets terminate there and are handed the updates).
 #

data/lib/monk/templates/mail/config/mail.rb

@@ -2,8 +2,8 @@ require "monk"
 require "monk/mail"
 
 # Sends email with Monk::Mail.deliver(to:, subject:, text:, html:) from
-# any route -- and, with --auth, the magic links config/auth.rb's AppMailer
-# delivers. See docs/guides/mail.md. Required from config.ru (not from
+# any route -- and, with --auth, the magic links AppMailer::MAGIC_LINK
+# (app/mailers/app_mailer.rb) delivers. See docs/guides/mail.md. Required from config/load.rb (not from
 # config/auth.rb: bin/websocket_server loads that too, and never sends mail).
 Monk::Settings.configure do
   # Where mail goes. Unset in development means log:// (printed to the

data/lib/monk/templates/postgres/bin/console

@@ -1,7 +1,9 @@
 #!/usr/bin/env ruby
 require "bundler/setup"
-require_relative "../config/settings"
-require_relative "../config/persistence"
+# The configs and app/ (models, jobs, mailers...), as the app sees them --
+# config/load.rb, never Monk.boot, so nothing is frozen and you can poke at
+# anything.
+require_relative "../config/load"
 require "irb"
 
 IRB.start(__FILE__)

data/lib/monk/version.rb

@@ -5,5 +5,5 @@ module Monk
   # class of bug .freeze! guards against for routes/error handlers/models,
   # just on a top-level constant that every worker Ractor reads on boot
   # (found live under kino: GET /hello 500'd until this was frozen).
-  VERSION = "0.18.0".freeze
+  VERSION = "0.20.0".freeze
 end

data/lib/monk/websocket/connection.rb

@@ -85,11 +85,22 @@ module Monk
 
       # The server-initiated close path (step 14): send a close frame
       # carrying the 2-byte status code + reason RFC 6455 expects, then
-      # close the socket outright -- no wait for the client's own close
-      # frame in reply.
+      # end the connection -- no wait for the client's own close frame in
+      # reply.
+      #
+      # Shut down, not closed: this runs from other threads too (a relay
+      # on Registry#close_all, the reverify thread) while the handler's
+      # thread is blocked reading. IO#close would wait for that reader,
+      # and the reader's cleanup kills the closing thread mid-close,
+      # leaving the descriptor open: the client never sees the close.
+      # shutdown tells the client at once and ends the blocked read (it
+      # returns nil, as on any disconnect); Server.serve's ensure closes
+      # the socket.
       def close(code: 1000, reason: "")
         write_frame([code].pack("n") + reason.to_s, 0x8)
-        @socket.close
+        @socket.shutdown(:RDWR)
+      rescue Errno::ENOTCONN
+        # The client went away first: nothing left to shut down.
       end
 
       # Registers this connection's own Ractor::Port -- the "connection
@@ -154,9 +165,17 @@ module Monk
       private
 
       def relay_broadcasts
-        loop { write(@port.receive) }
-      rescue Ractor::ClosedError
-        # #unsubscribe! closed the port out from under a pending #receive.
+        loop do
+          message = @port.receive
+          next write(message) unless message.is_a?(CloseRequest)
+
+          # Registry#close_all: the read loop then sees the socket closed
+          # and Server.serve's cleanup runs as on any other close.
+          return close(code: message.code, reason: message.reason)
+        end
+      rescue Ractor::ClosedError, IOError, SystemCallError
+        # #unsubscribe! closed the port out from under a pending #receive,
+        # or the socket went away first.
       end
 
       def write_frame(payload, opcode)

data/lib/monk/websocket/errors.rb

@@ -12,5 +12,16 @@ module Monk
     # tradeoff.
     class PayloadTooLargeError < StandardError
     end
+
+    # A fanout's #register before its #listen!: a socket registered there
+    # would never get another process's broadcasts, so this says so at the
+    # first subscription instead of losing them silently.
+    class NotListeningError < StandardError
+    end
+
+    # #listen! couldn't open its subscriber connection (Redis or Postgres
+    # unreachable, bad credentials) -- raised in the WS process's boot.
+    class ListenError < StandardError
+    end
   end
 end

data/lib/monk/websocket/listeners.rb

@@ -0,0 +1,47 @@
+module Monk
+  module WebSocket
+    # Which fanouts in this process have called #listen!, by origin id.
+    # A fanout freezes itself (every connection Ractor reads it through a
+    # module constant), so it can't record this on itself; a frozen list
+    # in a module ivar is written from the main Ractor, where #listen! runs
+    # at boot, and read from any Ractor, where #register runs.
+    #
+    # Also what both fanouts' subscribers share for surviving a dropped
+    # connection: the reconnect backoff and a log that can't end them.
+    module Listeners
+      # 500 ms doubling to 30 s, the same curve as monk_live.js's reconnect.
+      RETRY_INITIAL = 0.5
+      RETRY_MAX = 30
+
+      # What a subscriber closes every open socket with after reconnecting:
+      # what was published while it was down is lost, and no client can
+      # tell (its seq counts what this process sent it), so each must
+      # reconnect and resync (ADR 0011).
+      MISSED_CODE = 1011
+      MISSED_REASON = "missed broadcasts".freeze
+
+      @origins = [].freeze
+
+      class << self
+        def listening?(origin) = @origins.include?(origin)
+
+        def next_delay(delay) = [delay * 2, RETRY_MAX].min
+
+        # Monk::Log writes to log/<env>.log once Monk has booted. Logging
+        # must never end a subscriber, whatever state Monk::Log is in.
+        def log(source, level, message)
+          Monk::Log.public_send(level, "#{source}: #{message}")
+        rescue StandardError
+          nil
+        end
+
+        # Main Ractor only -- a module ivar write from another Ractor raises
+        # Ractor::IsolationError, which is the right answer for a boot-time
+        # call made from the wrong place.
+        def add(origin)
+          @origins = Ractor.make_shareable([*@origins, origin])
+        end
+      end
+    end
+  end
+end

data/lib/monk/websocket/pg_fanout.rb

@@ -1,5 +1,8 @@
 require "pg"
 require "securerandom"
+require_relative "../persistence/pg"
+require_relative "errors"
+require_relative "listeners"
 
 module Monk
   module WebSocket
@@ -7,7 +10,7 @@ module Monk
     # "monk/websocket/pg_fanout" explicitly -- "monk/websocket" alone does
     # not load this. A second implementation of the exact interface
     # RedisFanout wraps a Registry behind (#register, #unregister, #count,
-    # #broadcast, docs/design/live-pg-fanout.md,
+    # #broadcast, #listen!, docs/design/live-pg-fanout.md,
     # docs/history/plan-live-pg-fanout.md), so an app swaps which object it
     # holds and nothing else changes. Uses Postgres LISTEN/NOTIFY instead
     # of Redis pub/sub -- for an app that already runs Postgres
@@ -52,16 +55,115 @@ module Monk
         [origin, key, payload]
       end
 
-      def initialize(registry, pg_opts:)
-        # Checked upfront, on the argument, before anything below opens a
-        # real Postgres connection -- RedisFanout has no equivalent check
-        # (freezing self never raises on its own, even when an ivar isn't
-        # itself shareable), so a bad registry there only surfaces later
-        # as an opaque Ractor::IsolationError. Checking here first, rather
-        # than after spawning the subscriber below, means a bad registry
-        # never leaves a live LISTEN connection running past a failed
-        # construction. Mirrors Monk::Live.configure's own check of its
-        # registry argument.
+      # The body of #listen!'s subscriber Ractor. A class method, like
+      # .decode_envelope, because the Ractor has no PgFanout instance to
+      # call into. Reports :ok, or why it couldn't LISTEN, on `ready`, then
+      # relays notifies for the rest of the process's life.
+      #
+      # A dropped LISTEN connection (a Postgres restart, a failover) is
+      # reconnected with backoff (plan-pg-reconnect.md). Notifies sent
+      # while it was down are lost, so once listening again every open
+      # socket is closed (Listeners::MISSED_CODE), and each client
+      # reconnects and resyncs; their jittered reconnect spreads the
+      # refetches.
+      def self.subscribe(registry, pg_opts, own_origin, ready)
+        begin
+          conn = listen_connection(pg_opts)
+        rescue StandardError => e
+          ready.send("#{e.class}: #{e.message}")
+          return
+        end
+        ready.send(:ok)
+
+        loop do
+          conn.wait_for_notify { |_channel, _pid, raw| relay(registry, own_origin, raw) }
+        rescue PG::ConnectionBad => e
+          log(:error, "lost the LISTEN connection (#{e.message.lines.first&.strip}); reconnecting")
+          conn = reconnect(pg_opts)
+          closed = registry.close_all(Listeners::MISSED_CODE, Listeners::MISSED_REASON)
+          log(:info, "listening again; closed #{closed} socket(s) so their pages resync")
+        end
+      end
+
+      # One notify into this process's registry. Anything that goes wrong
+      # here (a payload that isn't an envelope, a failing broadcast) drops
+      # this notify only: escaping, it would end the subscriber Ractor, and
+      # with it every later broadcast, silently.
+      def self.relay(registry, own_origin, raw)
+        sender, key, payload = decode_envelope(raw)
+        return if sender == own_origin
+
+        registry.broadcast(key.to_sym, payload)
+      rescue StandardError => e
+        log(:error, "dropped a notify: #{e.class}: #{e.message}")
+      end
+
+      def self.listen_connection(pg_opts)
+        conn = PG.connect(connect_timeout: Monk::Persistence::Pg::DEFAULT_CONNECT_TIMEOUT, **pg_opts)
+        conn.exec("LISTEN #{CHANNEL}")
+        conn
+      rescue StandardError
+        conn&.close
+        raise
+      end
+
+      def self.reconnect(pg_opts)
+        delay = Listeners::RETRY_INITIAL
+        begin
+          listen_connection(pg_opts)
+        rescue PG::Error => e
+          log(:warn, "can't LISTEN yet (#{e.class}: #{e.message.lines.first&.strip}); retrying in #{delay}s")
+          sleep delay
+          delay = Listeners.next_delay(delay)
+          retry
+        end
+      end
+
+      def self.log(level, message) = Listeners.log(name, level, message)
+      private_class_method :relay, :listen_connection, :reconnect, :log
+
+      # The body of a pooled publish (#broadcast with db_pool:), run in the
+      # pool's worker on its connection. That connection serves nothing
+      # but pool calls, each of which ends its transaction, so a NOTIFY
+      # here is never held back by an app's open transaction.
+      def self.notify(db, envelope)
+        Monk::Persistence::Pg.checkout(db) { |conn| conn.exec_params("SELECT pg_notify($1, $2)", [CHANNEL, envelope]) }
+        nil
+      end
+
+      # Closes the calling Ractor's publisher connection (#publisher), if
+      # it opened one; the next broadcast in this Ractor reconnects.
+      # Server.serve runs it as each socket ends: a Ractor that ends
+      # leaves its connection to the garbage collector, which may not run
+      # for a long time.
+      def self.disconnect_publisher
+        conn = Ractor.current[:monk_pg_fanout_publisher]
+        return unless conn
+
+        Ractor.current[:monk_pg_fanout_publisher] = nil
+        conn.finish
+      rescue PG::Error
+        nil # already closed
+      end
+
+      # pg_opts: connects the publisher (one connection per Ractor that
+      # publishes) and #listen!'s LISTEN connection. db_pool: (a
+      # Monk::Persistence::Pg pool of size 1, docs/history/plan-pg-pool.md)
+      # publishes through that pool instead, so a process holds one
+      # publishing connection however many Ractors publish, and LISTENs on
+      # the pool's database. Exactly one of the two.
+      #
+      # Through the pool a publish doesn't wait for Postgres (call_async):
+      # a failed pg_notify is logged, not raised, and the page catches up
+      # at its next resync, as it would after any missed patch. Size 1
+      # because only a single worker runs one sender's publishes in the
+      # order they were made, and patches to a page must arrive in order.
+      def initialize(registry, pg_opts: nil, db_pool: nil)
+        # Checked upfront, on the argument -- RedisFanout has no equivalent
+        # check (freezing self never raises on its own, even when an ivar
+        # isn't itself shareable), so a bad registry there only surfaces
+        # later as an opaque Ractor::IsolationError. Mirrors
+        # Monk::Live.configure's own check of its registry argument.
         unless Ractor.shareable?(registry)
           raise ArgumentError,
             "Monk::WebSocket::PgFanout.new needs a Ractor-shareable registry, got #{registry.class}"
@@ -76,37 +178,63 @@ module Monk
         # fails on this Hash's contents, not on the registry argument it's
         # meant to guard, the same trap Server#initialize's
         # allowed_origins already avoids the same way.
-        @pg_opts = Ractor.make_shareable(pg_opts.dup)
+        raise ArgumentError, "Monk::WebSocket::PgFanout.new needs pg_opts: or db_pool:, not both" if pg_opts && db_pool
+        raise ArgumentError, "Monk::WebSocket::PgFanout.new needs pg_opts: or db_pool:" unless pg_opts || db_pool
+
+        @pg_opts = Ractor.make_shareable((pg_opts || pooled_pg_opts(db_pool)).dup)
+        @db_pool = db_pool
+        @db = db_pool && Monk::Persistence::Pg.pool_config(db_pool).db
         # Frozen explicitly, not just a String literal: read from every
         # calling Ractor's own #broadcast and from the subscriber Ractor
-        # below, both of which raise Ractor::IsolationError on an
+        # #listen! starts, both of which raise Ractor::IsolationError on an
         # unfrozen value -- same reason RedisFanout freezes its own
         # @origin.
         @origin = SecureRandom.uuid.freeze
 
+        freeze
+      end
+
+      # Starts relaying other processes' broadcasts into this process's
+      # registry: a subscriber Ractor with its own LISTEN connection. Only
+      # the process that holds sockets calls this (bin/websocket_server, at
+      # boot, from the main Ractor) -- a publish-only process (bin/server,
+      # bin/jobs) never does, so it holds no LISTEN connection at all.
+      # Returns once the LISTEN is in effect, so nothing notified after it
+      # can be missed; raises ListenError if Postgres can't be reached.
+      # Calling it again is a no-op.
+      def listen!
+        return self if Listeners.listening?(@origin)
+
+        ready = Ractor::Port.new
         # Ractor.new's block args must be shareable: registry is
         # (Registry freezes itself around a Ractor, which is inherently
-        # shareable), @pg_opts and @origin are already made so above. The
-        # PG::Connection itself is never passed in -- opened fresh inside
-        # the block, mirroring RedisFanout's subscriber and
-        # Monk::Persistence::Pg's per-Ractor connection pattern.
-        @subscriber = Ractor.new(registry, @pg_opts, @origin) do |registry, pg_opts, own_origin|
-          conn = PG.connect(**pg_opts)
-          conn.exec("LISTEN #{Monk::WebSocket::PgFanout::CHANNEL}")
-          loop do
-            conn.wait_for_notify do |_channel, _pid, raw|
-              sender, key, payload = Monk::WebSocket::PgFanout.decode_envelope(raw)
-              next if sender == own_origin
-
-              registry.broadcast(key.to_sym, payload)
-            end
-          end
+        # shareable), @pg_opts and @origin are already made so, a Port
+        # always is. The PG::Connection itself is never passed in --
+        # opened fresh inside the block, mirroring RedisFanout's
+        # subscriber and Monk::Persistence::Pg's per-Ractor connection
+        # pattern.
+        Ractor.new(@registry, @pg_opts, @origin, ready) do |registry, pg_opts, own_origin, ready|
+          Monk::WebSocket::PgFanout.subscribe(registry, pg_opts, own_origin, ready)
         end
 
-        freeze
+        result = ready.receive
+        raise ListenError, "Monk::WebSocket::PgFanout#listen! couldn't LISTEN: #{result}" unless result == :ok
+
+        Listeners.add(@origin)
+        self
+      end
+
+      def register(key, port)
+        unless Listeners.listening?(@origin)
+          raise NotListeningError,
+            "Monk::WebSocket::PgFanout#register before #listen!: this socket would never get " \
+            "other processes' broadcasts -- call listen! once at boot in the process that holds " \
+            "sockets (bin/websocket_server: Monk::Live.listen!)"
+        end
+
+        @registry.register(key, port)
       end
 
-      def register(key, port) = @registry.register(key, port)
       def unregister(key, port) = @registry.unregister(key, port)
       def count(key) = @registry.count(key)
 
@@ -131,11 +259,25 @@ module Monk
         # parameter sidesteps any quoting/injection concern for its bytes
         # entirely, unlike Redis's PUBLISH, which never had that concern
         # in the first place.
+        return Monk::Persistence::Pg.pool(@db_pool).call_async(PgFanout, :notify, @db, envelope) if @db_pool
+
         publisher.exec_params("SELECT pg_notify($1, $2)", [CHANNEL, envelope])
       end
 
       private
 
+      # The pool's database's connection options, for #listen!.
+      def pooled_pg_opts(db_pool)
+        config = Monk::Persistence::Pg.pool_config(db_pool)
+        unless config.size == 1
+          raise ArgumentError,
+            "Monk::WebSocket::PgFanout's db_pool #{db_pool.inspect} has size #{config.size}; it must have size 1: " \
+            "patches to a page must arrive in the order they were published, and only one worker keeps " \
+            "a sender's publishes in order"
+        end
+        Monk::Persistence::Pg.connection_options(config.db)
+      end
+
       # Length-prefixes the origin and key (Netstring-style: "<bytesize>:"
       # then that many bytes) instead of RedisFanout's NUL-separated
       # "origin\0payload" -- discovered while building this that a NUL
@@ -166,8 +308,24 @@ module Monk
       # out for app queries: NOTIFY issued on a connection mid-transaction
       # wouldn't fire until that transaction commits, so this stays a
       # connection of its own, used for nothing but one-off notifies.
+      #
+      # Probed before each notify and reset if Postgres dropped it
+      # (Monk::Persistence::Pg.alive?, plan-pg-reconnect.md), the way
+      # checkout treats an app's connection. A failed pg_notify is never
+      # retried: it may have reached the server, and a patch delivered
+      # twice shows twice, while a missed one is recovered by the client's
+      # resync.
       def publisher
-        Ractor.current[:monk_pg_fanout_publisher] ||= PG.connect(**@pg_opts)
+        conn = Ractor.current[:monk_pg_fanout_publisher] ||= connect
+        Monk::Persistence::Pg.revive(conn) unless Monk::Persistence::Pg.alive?(conn)
+        conn
+      end
+
+      # Same connect_timeout default as Monk::Persistence::Pg's own
+      # connections: a reset runs inside a request's Live.patch, and
+      # mustn't wait indefinitely for a host that doesn't answer.
+      def connect
+        PG.connect(connect_timeout: Monk::Persistence::Pg::DEFAULT_CONNECT_TIMEOUT, **@pg_opts)
       end
     end
   end