monkrb 0.19.0 → 0.20.0

data/lib/monk/persistence.rb

@@ -1,4 +1,5 @@
 require_relative "freeze_hooks"
+require_relative "persistence/pool"
 
 module Monk
   # Backend-agnostic persistence. Concrete backends (e.g.
@@ -8,6 +9,16 @@ module Monk
   # can seal every backend actually in use without needing to know their
   # names.
   module Persistence
+    # Closes every connection this Ractor opened, in every backend. A
+    # Ractor that ends leaves its connections to the garbage collector,
+    # which may not run for a long time; one that opened any calls this
+    # as it finishes (Monk::WebSocket::Server.serve, for a socket's).
+    def self.disconnect_all
+      # A copy: each backend's disconnect_all removes its own key.
+      backends = Ractor.current[:monk_persistence]&.keys || []
+      backends.each(&:disconnect_all)
+    end
+
     # Shared by every backend module: per-Ractor connection lifecycle, a
     # registry of named configs, and boot-time shareability sealing. A
     # backend `extend`s this and implements #connect(**opts) /
@@ -27,6 +38,14 @@ module Monk
         configs[name] = opts
       end
 
+      # The options a database was registered with, for something that
+      # opens its own connection to it (PgFanout's LISTEN).
+      def connection_options(name)
+        configs.fetch(name) do
+          raise Monk::UnknownPersistenceError, "no database registered as #{name.inspect}"
+        end
+      end
+
       # Registered connection names (e.g. :primary) -- Monk.boot's log
       # line reads this to report which backends an app actually uses.
       def names
@@ -37,6 +56,76 @@ module Monk
         entry(name).conn
       end
 
+      # With options, declares a named pool (docs/history/plan-pg-pool.md):
+      # `size` worker Ractors, each with its own connection to the
+      # registered database `db`, that run calls sent from any other
+      # Ractor. Nothing connects until #start_pools! runs, in the process
+      # that uses it. Every process loads the declarations
+      # (config/persistence.rb), next to #register.
+      #
+      # Without options, returns the started pool, from any Ractor.
+      # Raises if it was never declared, or declared but not started in
+      # this process.
+      def pool(name, **options)
+        return declare_pool(name, **options) unless options.empty?
+
+        handle = @running && @running[name]
+        return handle if handle
+
+        pool_config(name)
+        raise Monk::PoolNotStartedError,
+          "pool #{name.inspect} is declared but not started in this process -- call " \
+          "#{self}.start_pools!(#{name.inspect}) at boot in the process that uses it"
+      end
+
+      # Starts declared pools in this process: each pool's dispatcher and
+      # `size` workers, each worker with its own connection. Returns once
+      # every worker has connected; raises Monk::PoolStartError if any
+      # can't, and starts nothing for that pool. Main Ractor only, at boot,
+      # after every register and pool declaration: it freezes the
+      # registry, since the workers read it. A pool already started is
+      # left alone.
+      def start_pools!(*names)
+        unless Ractor.current == Ractor.main
+          raise ArgumentError, "#{self}.start_pools! runs in the main Ractor, at boot"
+        end
+
+        freeze_registry!
+        names.each { |name| start_pool(name) unless @running&.key?(name) }
+        self
+      end
+
+      # Hook: makes a copy of an exception fit to leave a pool's worker for
+      # another Ractor, by dropping what can't be copied. A backend whose
+      # errors carry nothing like that keeps this default.
+      def make_portable(_error) = nil
+
+      # This Ractor's own connections to this backend, closed and
+      # forgotten. A pool worker runs it as it stops; the next checkout in
+      # this Ractor reconnects.
+      def disconnect_all
+        Ractor.current[:monk_persistence]&.delete(self)&.each_value do |e|
+          disconnect(e.conn)
+        rescue StandardError
+          nil
+        end
+      end
+
+      # The pools started in this process, name => size (Monk.boot's line).
+      def running_pools
+        (@running || {}).transform_values { |handle| handle.config.size }
+      end
+
+      # A declared pool's options (a frozen Pool::Config).
+      def pool_config(name)
+        pools.fetch(name) do
+          raise Monk::UnknownPoolError,
+            "pool #{name.inspect} was never declared -- declare it once at boot with " \
+            "#{self}.pool(#{name.inspect}, size: #{Pool::DEFAULTS[:size]}); " \
+            "pool(#{name.inspect}) with no options only looks one up"
+        end
+      end
+
       def checkout(name, timeout: DEFAULT_CHECKOUT_TIMEOUT)
         e = entry(name)
         token = e.slot.pop(timeout: timeout)
@@ -46,9 +135,18 @@ module Monk
             "(checkout held longer than #{timeout}s)"
         end
 
+        # Checked here, before the block, and never by re-running it: Monk
+        # can't tell whether a failed block's writes reached the server,
+        # so a drop in the middle of a block fails that block, and the
+        # next checkout finds the connection dead and revives it. A
+        # revive that can't reach the server raises from here.
+        revive(e.conn) unless alive?(e.conn)
         yield e.conn
       ensure
-        e.slot << true if token
+        if token
+          release(e.conn)
+          e.slot << true
+        end
       end
 
       # Called from Base#freeze! (Seam B), via Monk.freeze_hooks.
@@ -61,17 +159,16 @@ module Monk
       # the value (not the module) fixes it, the same way it did there.
       def freeze_registry!
         @configs = Ractor.make_shareable(configs)
+        @pools = Ractor.make_shareable(pools)
       end
 
       # Test-only: drops all registered configs and this Ractor's cached
       # connections. Not part of the app-facing API.
       def reset!
-        Ractor.current[:monk_persistence]&.each_value do |e|
-          disconnect(e.conn)
-        rescue StandardError
-        end
-        Ractor.current[:monk_persistence] = {}
+        stop_pools
+        disconnect_all
         @configs = {}
+        @pools = {}
       end
 
       private
@@ -80,8 +177,87 @@ module Monk
         @configs ||= {}
       end
 
+      def pools
+        @pools ||= {}
+      end
+
+      # The started pools' dispatchers and inboxes, which only this (the
+      # main) Ractor uses: to stop them. Kept apart from @running, the
+      # frozen handles every Ractor reads.
+      def pool_ractors
+        @pool_ractors ||= {}
+      end
+
+      def start_pool(name)
+        ready = Ractor::Port.new
+        dispatcher = Ractor.new(self, pool_config(name), ready, name: "monk-pool-#{name}") do |backend, config, r|
+          Monk::Persistence::Pool::Dispatcher.run(backend, config, r)
+        end
+        status, value = ready.receive
+        unless status == :ok
+          dispatcher.join
+          raise Monk::PoolStartError, "pool #{name.inspect} couldn't connect its workers: #{value}"
+        end
+
+        pool_ractors[name] = { dispatcher: dispatcher, inbox: value }
+        handle = Pool::Handle.new(config: pool_config(name), inbox: value)
+        @running = Ractor.make_shareable((@running || {}).merge(name => handle))
+      ensure
+        ready&.close
+      end
+
+      # Test-only path (reset!). The dispatcher stops its workers, each
+      # finishing the call in hand, and answers every caller still waiting.
+      def stop_pools
+        pool_ractors.each_key { |name| stop_pool(name) }
+        @running = nil
+      end
+
+      def stop_pool(name)
+        stopping = pool_ractors.delete(name)
+        return unless stopping
+
+        send_stop(stopping[:inbox], [:stop])
+        stopping[:dispatcher].join
+      end
+
+      def send_stop(port, message)
+        port.send(message)
+      rescue Ractor::ClosedError
+        nil # already ended
+      end
+
+      def declare_pool(name, **options)
+        unknown = options.keys - Pool::DEFAULTS.keys
+        raise ArgumentError, "unknown pool option(s) #{unknown.join(", ")} for #{name.inspect}" if unknown.any?
+        raise ArgumentError, "pool #{name.inspect} is already declared" if pools.key?(name)
+
+        config = Pool::Config.new(name: name, **Pool::DEFAULTS, **options)
+        validate_pool!(config)
+        pools[name] = Ractor.make_shareable(config)
+      end
+
+      def validate_pool!(config)
+        unless configs.key?(config.db)
+          raise Monk::UnknownPersistenceError,
+            "pool #{config.name.inspect} uses db: #{config.db.inspect}, but no database is registered as " \
+            "#{config.db.inspect} -- call #{self}.register(#{config.db.inspect}, ...) before declaring the pool"
+        end
+
+        { size: Integer, queue: Integer, timeout: Numeric }.each do |option, type|
+          value = config.public_send(option)
+          next if value.is_a?(type) && value.positive?
+
+          raise ArgumentError,
+            "pool #{config.name.inspect}: #{option}: must be a positive #{type}, got #{value.inspect}"
+        end
+      end
+
+      # This Ractor's connections, by backend, then by name: so
+      # Persistence.disconnect_all can find every backend this Ractor
+      # used, from any Ractor.
       def ractor_local
-        Ractor.current[:monk_persistence] ||= {}
+        (Ractor.current[:monk_persistence] ||= {})[self] ||= {}
       end
 
       def entry(name)
@@ -108,6 +284,19 @@ module Monk
       def disconnect(conn)
         raise NotImplementedError, "#{self} must implement #disconnect(conn)"
       end
+
+      # Optional hooks around #checkout's block. A backend that can't tell
+      # a dead connection from a live one keeps these defaults.
+
+      # Whether conn can take a query. Cheap: runs before every checkout.
+      def alive?(_conn) = true
+
+      # Reconnects a connection #alive? said was dead; raises if it can't.
+      def revive(_conn) = nil
+
+      # Runs after every checkout's block, however it ended. Must not
+      # raise: it runs in an ensure, and would hide the block's exception.
+      def release(_conn) = nil
     end
   end
 end

data/lib/monk/scaffold.rb

@@ -39,6 +39,9 @@ module Monk
       "bin/console" => "postgres/bin/console",
       "bin/setup_db" => "postgres/bin/setup_db",
       "bin/migrate" => "postgres/bin/migrate",
+      # Kept by git when empty, like app/'s role directories: a fresh clone
+      # still shows where migrations go. The migrator reads only *.sql.
+      "db/migrate/.keep" => "postgres/db/migrate/.keep",
     }.freeze
 
     # The pg gem's native extension needs libpq -- the base Dockerfile has
@@ -229,7 +232,6 @@ module Monk
 
       if @postgres
         POSTGRES_FILES.each { |relative, template| write_file(relative, template, executable: EXECUTABLE_FILES.include?(relative)) }
-        FileUtils.mkdir_p(File.join(@dir, "db/migrate"))
         append_gemfile_extra("postgres/Gemfile.extra")
       end
 

data/lib/monk/templates/auth/config/auth.rb

@@ -23,3 +23,9 @@ Monk::Auth.configure(
   secure: !Monk.env.development?, # Secure cookie flag; off in dev so plain-http testing works (Safari drops it)
   deliver: AppMailer::MAGIC_LINK,
 )
+
+# bin/websocket_server checks each socket's session through this pool, so
+# it holds 4 connections however many pages are open, instead of one per
+# open page. Declaring it opens nothing: only bin/websocket_server starts
+# it. See docs/guides/persistence.md, "Pools", in the monk repo.
+Monk::Persistence::Pg.pool(:auth, size: 4)

data/lib/monk/templates/base/bin/websocket_server

@@ -54,7 +54,14 @@ end
 # has nothing to listen to, and listen! does nothing.
 ChatServer::REGISTRY.listen!
 
-authenticate = defined?(Monk::Auth) && !!Monk::Auth.config
+# false, not nil, without --auth: Server.new refuses nil.
+authenticate = !!(defined?(Monk::Auth) && Monk::Auth.config)
+# Sessions are checked through config/auth.rb's :auth pool rather than in
+# each socket's own Ractor, which would hold a Postgres connection per
+# open page. This is the only process that uses the pool, so it starts it.
+db_pool = (:auth if authenticate)
+Monk::Persistence::Pg.start_pools!(db_pool) if db_pool
+
 port = ENV.fetch("WS_PORT", "9293").to_i
 # Defaults to public_url (config/settings.rb) so one PUBLIC_URL env var
 # keeps this in sync with the app's actual origin instead of two vars
@@ -62,7 +69,9 @@ port = ENV.fetch("WS_PORT", "9293").to_i
 # more than one origin (comma-separated).
 allowed_origins = ENV.fetch("WS_ALLOWED_ORIGINS", Monk::Settings[:public_url]).split(",")
 
-server = Monk::WebSocket::Server.new(port: port, authenticate: authenticate, allowed_origins: allowed_origins)
+server = Monk::WebSocket::Server.new(
+  port: port, authenticate: authenticate, allowed_origins: allowed_origins, db_pool: db_pool,
+)
 puts "Monk::WebSocket::Server listening on ws://0.0.0.0:#{port} " \
   "(authenticate: #{authenticate}, redis fan-out: #{ENV["REDIS_URL"] ? "on" : "off"})"
 server.run(&ChatServer::HANDLER)

data/lib/monk/templates/live/bin/websocket_server

@@ -30,6 +30,12 @@ Monk::Live.listen!
 # `anonymous: true`, like the demo's "hits". Without Monk::Auth every
 # socket is anonymous.
 authenticate = defined?(Monk::Auth) && Monk::Auth.config ? :optional : false
+# Sessions are checked through config/auth.rb's :auth pool rather than in
+# each socket's own Ractor, which would hold a Postgres connection per
+# open page. This is the only process that uses the pool, so it starts it.
+db_pool = (:auth if authenticate)
+Monk::Persistence::Pg.start_pools!(db_pool) if db_pool
+
 port = ENV.fetch("WS_PORT", "9293").to_i
 # Defaults to public_url (config/settings.rb) so one PUBLIC_URL env var
 # keeps this in sync with the app's actual origin instead of two vars
@@ -37,6 +43,8 @@ port = ENV.fetch("WS_PORT", "9293").to_i
 # more than one origin (comma-separated).
 allowed_origins = ENV.fetch("WS_ALLOWED_ORIGINS", Monk::Settings[:public_url]).split(",")
 
-server = Monk::WebSocket::Server.new(port: port, authenticate: authenticate, allowed_origins: allowed_origins)
+server = Monk::WebSocket::Server.new(
+  port: port, authenticate: authenticate, allowed_origins: allowed_origins, db_pool: db_pool,
+)
 puts "Monk::Live WebSocket server listening on ws://0.0.0.0:#{port} (authenticate: #{authenticate})"
 server.run(&Monk::Live::HANDLER)

data/lib/monk/version.rb

@@ -5,5 +5,5 @@ module Monk
   # class of bug .freeze! guards against for routes/error handlers/models,
   # just on a top-level constant that every worker Ractor reads on boot
   # (found live under kino: GET /hello 500'd until this was frozen).
-  VERSION = "0.19.0".freeze
+  VERSION = "0.20.0".freeze
 end

data/lib/monk/websocket/connection.rb

@@ -85,11 +85,22 @@ module Monk
 
       # The server-initiated close path (step 14): send a close frame
       # carrying the 2-byte status code + reason RFC 6455 expects, then
-      # close the socket outright -- no wait for the client's own close
-      # frame in reply.
+      # end the connection -- no wait for the client's own close frame in
+      # reply.
+      #
+      # Shut down, not closed: this runs from other threads too (a relay
+      # on Registry#close_all, the reverify thread) while the handler's
+      # thread is blocked reading. IO#close would wait for that reader,
+      # and the reader's cleanup kills the closing thread mid-close,
+      # leaving the descriptor open: the client never sees the close.
+      # shutdown tells the client at once and ends the blocked read (it
+      # returns nil, as on any disconnect); Server.serve's ensure closes
+      # the socket.
       def close(code: 1000, reason: "")
         write_frame([code].pack("n") + reason.to_s, 0x8)
-        @socket.close
+        @socket.shutdown(:RDWR)
+      rescue Errno::ENOTCONN
+        # The client went away first: nothing left to shut down.
       end
 
       # Registers this connection's own Ractor::Port -- the "connection
@@ -154,9 +165,17 @@ module Monk
       private
 
       def relay_broadcasts
-        loop { write(@port.receive) }
-      rescue Ractor::ClosedError
-        # #unsubscribe! closed the port out from under a pending #receive.
+        loop do
+          message = @port.receive
+          next write(message) unless message.is_a?(CloseRequest)
+
+          # Registry#close_all: the read loop then sees the socket closed
+          # and Server.serve's cleanup runs as on any other close.
+          return close(code: message.code, reason: message.reason)
+        end
+      rescue Ractor::ClosedError, IOError, SystemCallError
+        # #unsubscribe! closed the port out from under a pending #receive,
+        # or the socket went away first.
       end
 
       def write_frame(payload, opcode)

data/lib/monk/websocket/listeners.rb

@@ -5,12 +5,36 @@ module Monk
     # module constant), so it can't record this on itself; a frozen list
     # in a module ivar is written from the main Ractor, where #listen! runs
     # at boot, and read from any Ractor, where #register runs.
+    #
+    # Also what both fanouts' subscribers share for surviving a dropped
+    # connection: the reconnect backoff and a log that can't end them.
     module Listeners
+      # 500 ms doubling to 30 s, the same curve as monk_live.js's reconnect.
+      RETRY_INITIAL = 0.5
+      RETRY_MAX = 30
+
+      # What a subscriber closes every open socket with after reconnecting:
+      # what was published while it was down is lost, and no client can
+      # tell (its seq counts what this process sent it), so each must
+      # reconnect and resync (ADR 0011).
+      MISSED_CODE = 1011
+      MISSED_REASON = "missed broadcasts".freeze
+
       @origins = [].freeze
 
       class << self
         def listening?(origin) = @origins.include?(origin)
 
+        def next_delay(delay) = [delay * 2, RETRY_MAX].min
+
+        # Monk::Log writes to log/<env>.log once Monk has booted. Logging
+        # must never end a subscriber, whatever state Monk::Log is in.
+        def log(source, level, message)
+          Monk::Log.public_send(level, "#{source}: #{message}")
+        rescue StandardError
+          nil
+        end
+
         # Main Ractor only -- a module ivar write from another Ractor raises
         # Ractor::IsolationError, which is the right answer for a boot-time
         # call made from the wrong place.

data/lib/monk/websocket/pg_fanout.rb

@@ -1,5 +1,6 @@
 require "pg"
 require "securerandom"
+require_relative "../persistence/pg"
 require_relative "errors"
 require_relative "listeners"
 
@@ -54,7 +55,110 @@ module Monk
         [origin, key, payload]
       end
 
-      def initialize(registry, pg_opts:)
+      # The body of #listen!'s subscriber Ractor. A class method, like
+      # .decode_envelope, because the Ractor has no PgFanout instance to
+      # call into. Reports :ok, or why it couldn't LISTEN, on `ready`, then
+      # relays notifies for the rest of the process's life.
+      #
+      # A dropped LISTEN connection (a Postgres restart, a failover) is
+      # reconnected with backoff (plan-pg-reconnect.md). Notifies sent
+      # while it was down are lost, so once listening again every open
+      # socket is closed (Listeners::MISSED_CODE), and each client
+      # reconnects and resyncs; their jittered reconnect spreads the
+      # refetches.
+      def self.subscribe(registry, pg_opts, own_origin, ready)
+        begin
+          conn = listen_connection(pg_opts)
+        rescue StandardError => e
+          ready.send("#{e.class}: #{e.message}")
+          return
+        end
+        ready.send(:ok)
+
+        loop do
+          conn.wait_for_notify { |_channel, _pid, raw| relay(registry, own_origin, raw) }
+        rescue PG::ConnectionBad => e
+          log(:error, "lost the LISTEN connection (#{e.message.lines.first&.strip}); reconnecting")
+          conn = reconnect(pg_opts)
+          closed = registry.close_all(Listeners::MISSED_CODE, Listeners::MISSED_REASON)
+          log(:info, "listening again; closed #{closed} socket(s) so their pages resync")
+        end
+      end
+
+      # One notify into this process's registry. Anything that goes wrong
+      # here (a payload that isn't an envelope, a failing broadcast) drops
+      # this notify only: escaping, it would end the subscriber Ractor, and
+      # with it every later broadcast, silently.
+      def self.relay(registry, own_origin, raw)
+        sender, key, payload = decode_envelope(raw)
+        return if sender == own_origin
+
+        registry.broadcast(key.to_sym, payload)
+      rescue StandardError => e
+        log(:error, "dropped a notify: #{e.class}: #{e.message}")
+      end
+
+      def self.listen_connection(pg_opts)
+        conn = PG.connect(connect_timeout: Monk::Persistence::Pg::DEFAULT_CONNECT_TIMEOUT, **pg_opts)
+        conn.exec("LISTEN #{CHANNEL}")
+        conn
+      rescue StandardError
+        conn&.close
+        raise
+      end
+
+      def self.reconnect(pg_opts)
+        delay = Listeners::RETRY_INITIAL
+        begin
+          listen_connection(pg_opts)
+        rescue PG::Error => e
+          log(:warn, "can't LISTEN yet (#{e.class}: #{e.message.lines.first&.strip}); retrying in #{delay}s")
+          sleep delay
+          delay = Listeners.next_delay(delay)
+          retry
+        end
+      end
+
+      def self.log(level, message) = Listeners.log(name, level, message)
+      private_class_method :relay, :listen_connection, :reconnect, :log
+
+      # The body of a pooled publish (#broadcast with db_pool:), run in the
+      # pool's worker on its connection. That connection serves nothing
+      # but pool calls, each of which ends its transaction, so a NOTIFY
+      # here is never held back by an app's open transaction.
+      def self.notify(db, envelope)
+        Monk::Persistence::Pg.checkout(db) { |conn| conn.exec_params("SELECT pg_notify($1, $2)", [CHANNEL, envelope]) }
+        nil
+      end
+
+      # Closes the calling Ractor's publisher connection (#publisher), if
+      # it opened one; the next broadcast in this Ractor reconnects.
+      # Server.serve runs it as each socket ends: a Ractor that ends
+      # leaves its connection to the garbage collector, which may not run
+      # for a long time.
+      def self.disconnect_publisher
+        conn = Ractor.current[:monk_pg_fanout_publisher]
+        return unless conn
+
+        Ractor.current[:monk_pg_fanout_publisher] = nil
+        conn.finish
+      rescue PG::Error
+        nil # already closed
+      end
+
+      # pg_opts: connects the publisher (one connection per Ractor that
+      # publishes) and #listen!'s LISTEN connection. db_pool: (a
+      # Monk::Persistence::Pg pool of size 1, docs/history/plan-pg-pool.md)
+      # publishes through that pool instead, so a process holds one
+      # publishing connection however many Ractors publish, and LISTENs on
+      # the pool's database. Exactly one of the two.
+      #
+      # Through the pool a publish doesn't wait for Postgres (call_async):
+      # a failed pg_notify is logged, not raised, and the page catches up
+      # at its next resync, as it would after any missed patch. Size 1
+      # because only a single worker runs one sender's publishes in the
+      # order they were made, and patches to a page must arrive in order.
+      def initialize(registry, pg_opts: nil, db_pool: nil)
         # Checked upfront, on the argument -- RedisFanout has no equivalent
         # check (freezing self never raises on its own, even when an ivar
         # isn't itself shareable), so a bad registry there only surfaces
@@ -74,7 +178,12 @@ module Monk
         # fails on this Hash's contents, not on the registry argument it's
         # meant to guard, the same trap Server#initialize's
         # allowed_origins already avoids the same way.
-        @pg_opts = Ractor.make_shareable(pg_opts.dup)
+        raise ArgumentError, "Monk::WebSocket::PgFanout.new needs pg_opts: or db_pool:, not both" if pg_opts && db_pool
+        raise ArgumentError, "Monk::WebSocket::PgFanout.new needs pg_opts: or db_pool:" unless pg_opts || db_pool
+
+        @pg_opts = Ractor.make_shareable((pg_opts || pooled_pg_opts(db_pool)).dup)
+        @db_pool = db_pool
+        @db = db_pool && Monk::Persistence::Pg.pool_config(db_pool).db
         # Frozen explicitly, not just a String literal: read from every
         # calling Ractor's own #broadcast and from the subscriber Ractor
         # #listen! starts, both of which raise Ractor::IsolationError on an
@@ -105,23 +214,7 @@ module Monk
         # subscriber and Monk::Persistence::Pg's per-Ractor connection
         # pattern.
         Ractor.new(@registry, @pg_opts, @origin, ready) do |registry, pg_opts, own_origin, ready|
-          begin
-            conn = PG.connect(**pg_opts)
-            conn.exec("LISTEN #{Monk::WebSocket::PgFanout::CHANNEL}")
-          rescue StandardError => e
-            ready.send("#{e.class}: #{e.message}")
-            next
-          end
-          ready.send(:ok)
-
-          loop do
-            conn.wait_for_notify do |_channel, _pid, raw|
-              sender, key, payload = Monk::WebSocket::PgFanout.decode_envelope(raw)
-              next if sender == own_origin
-
-              registry.broadcast(key.to_sym, payload)
-            end
-          end
+          Monk::WebSocket::PgFanout.subscribe(registry, pg_opts, own_origin, ready)
         end
 
         result = ready.receive
@@ -166,11 +259,25 @@ module Monk
         # parameter sidesteps any quoting/injection concern for its bytes
         # entirely, unlike Redis's PUBLISH, which never had that concern
         # in the first place.
+        return Monk::Persistence::Pg.pool(@db_pool).call_async(PgFanout, :notify, @db, envelope) if @db_pool
+
         publisher.exec_params("SELECT pg_notify($1, $2)", [CHANNEL, envelope])
       end
 
       private
 
+      # The pool's database's connection options, for #listen!.
+      def pooled_pg_opts(db_pool)
+        config = Monk::Persistence::Pg.pool_config(db_pool)
+        unless config.size == 1
+          raise ArgumentError,
+            "Monk::WebSocket::PgFanout's db_pool #{db_pool.inspect} has size #{config.size}; it must have size 1: " \
+            "patches to a page must arrive in the order they were published, and only one worker keeps " \
+            "a sender's publishes in order"
+        end
+        Monk::Persistence::Pg.connection_options(config.db)
+      end
+
       # Length-prefixes the origin and key (Netstring-style: "<bytesize>:"
       # then that many bytes) instead of RedisFanout's NUL-separated
       # "origin\0payload" -- discovered while building this that a NUL
@@ -201,8 +308,24 @@ module Monk
       # out for app queries: NOTIFY issued on a connection mid-transaction
       # wouldn't fire until that transaction commits, so this stays a
       # connection of its own, used for nothing but one-off notifies.
+      #
+      # Probed before each notify and reset if Postgres dropped it
+      # (Monk::Persistence::Pg.alive?, plan-pg-reconnect.md), the way
+      # checkout treats an app's connection. A failed pg_notify is never
+      # retried: it may have reached the server, and a patch delivered
+      # twice shows twice, while a missed one is recovered by the client's
+      # resync.
       def publisher
-        Ractor.current[:monk_pg_fanout_publisher] ||= PG.connect(**@pg_opts)
+        conn = Ractor.current[:monk_pg_fanout_publisher] ||= connect
+        Monk::Persistence::Pg.revive(conn) unless Monk::Persistence::Pg.alive?(conn)
+        conn
+      end
+
+      # Same connect_timeout default as Monk::Persistence::Pg's own
+      # connections: a reset runs inside a request's Live.patch, and
+      # mustn't wait indefinitely for a host that doesn't answer.
+      def connect
+        PG.connect(connect_timeout: Monk::Persistence::Pg::DEFAULT_CONNECT_TIMEOUT, **@pg_opts)
       end
     end
   end