monkrb 0.19.0 → 0.21.0

data/lib/monk/websocket/pg_fanout.rb

@@ -1,5 +1,6 @@
 require "pg"
 require "securerandom"
+require_relative "../persistence/pg"
 require_relative "errors"
 require_relative "listeners"
 
@@ -54,7 +55,110 @@ module Monk
         [origin, key, payload]
       end
 
-      def initialize(registry, pg_opts:)
+      # The body of #listen!'s subscriber Ractor. A class method, like
+      # .decode_envelope, because the Ractor has no PgFanout instance to
+      # call into. Reports :ok, or why it couldn't LISTEN, on `ready`, then
+      # relays notifies for the rest of the process's life.
+      #
+      # A dropped LISTEN connection (a Postgres restart, a failover) is
+      # reconnected with backoff (plan-pg-reconnect.md). Notifies sent
+      # while it was down are lost, so once listening again every open
+      # socket is closed (Listeners::MISSED_CODE), and each client
+      # reconnects and resyncs; their jittered reconnect spreads the
+      # refetches.
+      def self.subscribe(registry, pg_opts, own_origin, ready)
+        begin
+          conn = listen_connection(pg_opts)
+        rescue StandardError => e
+          ready.send("#{e.class}: #{e.message}")
+          return
+        end
+        ready.send(:ok)
+
+        loop do
+          conn.wait_for_notify { |_channel, _pid, raw| relay(registry, own_origin, raw) }
+        rescue PG::ConnectionBad => e
+          log(:error, "lost the LISTEN connection (#{e.message.lines.first&.strip}); reconnecting")
+          conn = reconnect(pg_opts)
+          closed = registry.close_all(Listeners::MISSED_CODE, Listeners::MISSED_REASON)
+          log(:info, "listening again; closed #{closed} socket(s) so their pages resync")
+        end
+      end
+
+      # One notify into this process's registry. Anything that goes wrong
+      # here (a payload that isn't an envelope, a failing broadcast) drops
+      # this notify only: escaping, it would end the subscriber Ractor, and
+      # with it every later broadcast, silently.
+      def self.relay(registry, own_origin, raw)
+        sender, key, payload = decode_envelope(raw)
+        return if sender == own_origin
+
+        registry.broadcast(key.to_sym, payload)
+      rescue StandardError => e
+        log(:error, "dropped a notify: #{e.class}: #{e.message}")
+      end
+
+      def self.listen_connection(pg_opts)
+        conn = PG.connect(connect_timeout: Monk::Persistence::Pg::DEFAULT_CONNECT_TIMEOUT, **pg_opts)
+        conn.exec("LISTEN #{CHANNEL}")
+        conn
+      rescue StandardError
+        conn&.close
+        raise
+      end
+
+      def self.reconnect(pg_opts)
+        delay = Listeners::RETRY_INITIAL
+        begin
+          listen_connection(pg_opts)
+        rescue PG::Error => e
+          log(:warn, "can't LISTEN yet (#{e.class}: #{e.message.lines.first&.strip}); retrying in #{delay}s")
+          sleep delay
+          delay = Listeners.next_delay(delay)
+          retry
+        end
+      end
+
+      def self.log(level, message) = Listeners.log(name, level, message)
+      private_class_method :relay, :listen_connection, :reconnect, :log
+
+      # The body of a pooled publish (#broadcast with db_pool:), run in the
+      # pool's worker on its connection. That connection serves nothing
+      # but pool calls, each of which ends its transaction, so a NOTIFY
+      # here is never held back by an app's open transaction.
+      def self.notify(db, envelope)
+        Monk::Persistence::Pg.checkout(db) { |conn| conn.exec_params("SELECT pg_notify($1, $2)", [CHANNEL, envelope]) }
+        nil
+      end
+
+      # Closes the calling Ractor's publisher connection (#publisher), if
+      # it opened one; the next broadcast in this Ractor reconnects.
+      # Server.serve runs it as each socket ends: a Ractor that ends
+      # leaves its connection to the garbage collector, which may not run
+      # for a long time.
+      def self.disconnect_publisher
+        conn = Ractor.current[:monk_pg_fanout_publisher]
+        return unless conn
+
+        Ractor.current[:monk_pg_fanout_publisher] = nil
+        conn.finish
+      rescue PG::Error
+        nil # already closed
+      end
+
+      # pg_opts: connects the publisher (one connection per Ractor that
+      # publishes) and #listen!'s LISTEN connection. db_pool: (a
+      # Monk::Persistence::Pg pool of size 1, docs/history/plan-pg-pool.md)
+      # publishes through that pool instead, so a process holds one
+      # publishing connection however many Ractors publish, and LISTENs on
+      # the pool's database. Exactly one of the two.
+      #
+      # Through the pool a publish doesn't wait for Postgres (call_async):
+      # a failed pg_notify is logged, not raised, and the page catches up
+      # at its next resync, as it would after any missed patch. Size 1
+      # because only a single worker runs one sender's publishes in the
+      # order they were made, and patches to a page must arrive in order.
+      def initialize(registry, pg_opts: nil, db_pool: nil)
         # Checked upfront, on the argument -- RedisFanout has no equivalent
         # check (freezing self never raises on its own, even when an ivar
         # isn't itself shareable), so a bad registry there only surfaces
@@ -74,7 +178,12 @@ module Monk
         # fails on this Hash's contents, not on the registry argument it's
         # meant to guard, the same trap Server#initialize's
         # allowed_origins already avoids the same way.
-        @pg_opts = Ractor.make_shareable(pg_opts.dup)
+        raise ArgumentError, "Monk::WebSocket::PgFanout.new needs pg_opts: or db_pool:, not both" if pg_opts && db_pool
+        raise ArgumentError, "Monk::WebSocket::PgFanout.new needs pg_opts: or db_pool:" unless pg_opts || db_pool
+
+        @pg_opts = Ractor.make_shareable((pg_opts || pooled_pg_opts(db_pool)).dup)
+        @db_pool = db_pool
+        @db = db_pool && Monk::Persistence::Pg.pool_config(db_pool).db
         # Frozen explicitly, not just a String literal: read from every
         # calling Ractor's own #broadcast and from the subscriber Ractor
         # #listen! starts, both of which raise Ractor::IsolationError on an
@@ -105,23 +214,7 @@ module Monk
         # subscriber and Monk::Persistence::Pg's per-Ractor connection
         # pattern.
         Ractor.new(@registry, @pg_opts, @origin, ready) do |registry, pg_opts, own_origin, ready|
-          begin
-            conn = PG.connect(**pg_opts)
-            conn.exec("LISTEN #{Monk::WebSocket::PgFanout::CHANNEL}")
-          rescue StandardError => e
-            ready.send("#{e.class}: #{e.message}")
-            next
-          end
-          ready.send(:ok)
-
-          loop do
-            conn.wait_for_notify do |_channel, _pid, raw|
-              sender, key, payload = Monk::WebSocket::PgFanout.decode_envelope(raw)
-              next if sender == own_origin
-
-              registry.broadcast(key.to_sym, payload)
-            end
-          end
+          Monk::WebSocket::PgFanout.subscribe(registry, pg_opts, own_origin, ready)
         end
 
         result = ready.receive
@@ -166,11 +259,25 @@ module Monk
         # parameter sidesteps any quoting/injection concern for its bytes
         # entirely, unlike Redis's PUBLISH, which never had that concern
         # in the first place.
+        return Monk::Persistence::Pg.pool(@db_pool).call_async(PgFanout, :notify, @db, envelope) if @db_pool
+
         publisher.exec_params("SELECT pg_notify($1, $2)", [CHANNEL, envelope])
       end
 
       private
 
+      # The pool's database's connection options, for #listen!.
+      def pooled_pg_opts(db_pool)
+        config = Monk::Persistence::Pg.pool_config(db_pool)
+        unless config.size == 1
+          raise ArgumentError,
+            "Monk::WebSocket::PgFanout's db_pool #{db_pool.inspect} has size #{config.size}; it must have size 1: " \
+            "patches to a page must arrive in the order they were published, and only one worker keeps " \
+            "a sender's publishes in order"
+        end
+        Monk::Persistence::Pg.connection_options(config.db)
+      end
+
       # Length-prefixes the origin and key (Netstring-style: "<bytesize>:"
       # then that many bytes) instead of RedisFanout's NUL-separated
       # "origin\0payload" -- discovered while building this that a NUL
@@ -201,8 +308,24 @@ module Monk
       # out for app queries: NOTIFY issued on a connection mid-transaction
       # wouldn't fire until that transaction commits, so this stays a
       # connection of its own, used for nothing but one-off notifies.
+      #
+      # Probed before each notify and reset if Postgres dropped it
+      # (Monk::Persistence::Pg.alive?, plan-pg-reconnect.md), the way
+      # checkout treats an app's connection. A failed pg_notify is never
+      # retried: it may have reached the server, and a patch delivered
+      # twice shows twice, while a missed one is recovered by the client's
+      # resync.
       def publisher
-        Ractor.current[:monk_pg_fanout_publisher] ||= PG.connect(**@pg_opts)
+        conn = Ractor.current[:monk_pg_fanout_publisher] ||= connect
+        Monk::Persistence::Pg.revive(conn) unless Monk::Persistence::Pg.alive?(conn)
+        conn
+      end
+
+      # Same connect_timeout default as Monk::Persistence::Pg's own
+      # connections: a reset runs inside a request's Live.patch, and
+      # mustn't wait indefinitely for a host that doesn't answer.
+      def connect
+        PG.connect(connect_timeout: Monk::Persistence::Pg::DEFAULT_CONNECT_TIMEOUT, **@pg_opts)
       end
     end
   end

data/lib/monk/websocket/redis_fanout.rb

@@ -38,6 +38,83 @@ module Monk
       # already shareable.
       CHANNEL_PREFIX = "monk:ws:".freeze
 
+      # The body of #listen!'s subscriber Ractor. A class method because
+      # the Ractor has no RedisFanout instance to call into. Reports :ok,
+      # or why it couldn't subscribe, on `ready`, then relays messages for
+      # the rest of the process's life.
+      #
+      # A dropped connection (a Redis restart, a failover) is resubscribed
+      # with backoff. Messages published while it was down are lost, so
+      # once subscribed again every open socket is closed
+      # (Listeners::MISSED_CODE), and each client reconnects and resyncs.
+      def self.subscribe(registry, url, own_origin, ready)
+        listening = false
+        delay = Listeners::RETRY_INITIAL
+        loop do
+          Redis.new(url: url).psubscribe("#{CHANNEL_PREFIX}*") do |on|
+            on.psubscribe do
+              delay = Listeners::RETRY_INITIAL
+              if listening
+                closed = registry.close_all(Listeners::MISSED_CODE, Listeners::MISSED_REASON)
+                log(:info, "subscribed again; closed #{closed} socket(s) so their pages resync")
+              else
+                listening = true
+                ready.send(:ok)
+              end
+            end
+            on.pmessage { |_pattern, channel, envelope| relay(registry, own_origin, channel, envelope) }
+          end
+        rescue StandardError => e
+          # Not narrower: redis-rb lets redis-client's own
+          # RedisClient::ConnectionError out of psubscribe, not a
+          # Redis::BaseConnectionError. #relay rescues its own errors, so
+          # what gets here is the connection.
+          return ready.send("#{e.class}: #{e.message}") unless listening
+
+          log(:error, "subscriber connection failed (#{e.class}: #{e.message}); retrying in #{delay}s")
+          sleep delay
+          delay = Listeners.next_delay(delay)
+        end
+      end
+
+      # One message into this process's registry. Anything that goes wrong
+      # here drops this message only: escaping, it would end the
+      # subscriber Ractor, and with it every later broadcast, silently.
+      #
+      # Redis channel names are always Strings, but Registry's own keys
+      # are ordinary Hash keys the app chooses -- every existing caller
+      # (Registry's own tests, the websocket_server scaffold's :chat
+      # channel) uses a Symbol. #to_sym here is what makes
+      # registry.broadcast(:chat, ...) land on the same Hash key
+      # #register(:chat, port) used -- without it this silently
+      # broadcasts to an unrelated "chat" String key that nothing is ever
+      # registered under, and #broadcast still returns true either way
+      # (Registry#broadcast succeeds whether or not any port is registered
+      # for a key).
+      def self.relay(registry, own_origin, channel, envelope)
+        sender, payload = envelope.split("\0", 2)
+        raise ArgumentError, "no origin separator in the message" unless payload
+        return if sender == own_origin
+
+        registry.broadcast(channel.delete_prefix(CHANNEL_PREFIX).to_sym, payload)
+      rescue StandardError => e
+        log(:error, "dropped a message on #{channel}: #{e.class}: #{e.message}")
+      end
+
+      def self.log(level, message) = Listeners.log(name, level, message)
+      private_class_method :relay, :log
+
+      # Closes the calling Ractor's publisher client (#publisher), if it
+      # opened one; the next broadcast in this Ractor reconnects.
+      # Server.serve runs it as each socket ends, as PgFanout's.
+      def self.disconnect_publisher
+        client = Ractor.current[:monk_redis_fanout_publisher]
+        return unless client
+
+        Ractor.current[:monk_redis_fanout_publisher] = nil
+        client.close
+      end
+
       def initialize(registry, redis_url:)
         @registry = registry
         @redis_url = redis_url.dup.freeze
@@ -73,35 +150,7 @@ module Monk
         # Redis client itself is built inside the block, never passed in --
         # mirrors PG::Connection's per-Ractor pattern (persistence/pg.rb).
         Ractor.new(@registry, @redis_url, @origin, ready) do |registry, url, origin, ready|
-          subscribed = false
-          Redis.new(url: url).psubscribe("#{Monk::WebSocket::RedisFanout::CHANNEL_PREFIX}*") do |on|
-            on.psubscribe do
-              subscribed = true
-              ready.send(:ok)
-            end
-
-            on.pmessage do |_pattern, channel, envelope|
-              sender, payload = envelope.split("\0", 2)
-              next if sender == origin
-
-              # Redis channel names are always Strings, but Registry's own
-              # keys are ordinary Hash keys the app chooses -- every
-              # existing caller (Registry's own tests, the websocket_server
-              # scaffold's :chat channel) uses a Symbol. #to_sym here is
-              # what makes registry.broadcast(:chat, ...) land on the same
-              # Hash key #register(:chat, port) used -- without it this
-              # silently broadcasts to an unrelated "chat" String key that
-              # nothing is ever registered under, and #broadcast still
-              # returns true either way (Registry#broadcast succeeds
-              # whether or not any port is registered for a key).
-              key = channel.delete_prefix(Monk::WebSocket::RedisFanout::CHANNEL_PREFIX).to_sym
-              registry.broadcast(key, payload)
-            end
-          end
-        rescue StandardError => e
-          raise if subscribed
-
-          ready.send("#{e.class}: #{e.message}")
+          Monk::WebSocket::RedisFanout.subscribe(registry, url, origin, ready)
         end
 
         result = ready.receive

data/lib/monk/websocket/registry.rb

@@ -1,5 +1,10 @@
 module Monk
   module WebSocket
+    # Sent through a registered port instead of a payload: the socket
+    # behind it closes with this code and reason. Registry#close_all sends
+    # it; Connection's and Live::Session's relays act on it.
+    CloseRequest = Data.define(:code, :reason)
+
     # A dedicated Ractor holding the live set of connection handles keyed by
     # an app-assigned channel/subject -- mirrors StateRactor's shape
     # (docs/design/ractor.md): the mutable Hash stays hidden inside this one
@@ -41,6 +46,17 @@ module Monk
                 true
               when :count
                 keys[key].size
+              when :close_all
+                # Once per port: a Live page holds one port for all its
+                # topics. Entries stay until each connection's own cleanup
+                # unregisters them, as on any other close.
+                ports = keys.values.flatten.uniq
+                ports.each do |port|
+                  port.send(arg)
+                rescue Ractor::ClosedError
+                  nil
+                end
+                ports.size
               end
             reply_port.send(result)
           end
@@ -67,6 +83,14 @@ module Monk
         ask(:count, key, nil)
       end
 
+      # Closes every registered connection's socket with code and reason,
+      # so each client reconnects -- a fanout's subscriber does this after
+      # missing broadcasts, to make every page resync. Returns how many
+      # connections were asked to close.
+      def close_all(code, reason)
+        ask(:close_all, nil, Ractor.make_shareable(CloseRequest.new(code: code, reason: reason.to_s)))
+      end
+
       # Nothing to listen to: every broadcast reaching this registry comes
       # from this process. Here so a WS process calls #listen! the same
       # way whether it holds a Registry or a RedisFanout/PgFanout around

data/lib/monk/websocket/server.rb

@@ -40,6 +40,15 @@ module Monk
       # under true, and to an anonymous connection that sends an Origin,
       # since only a browser does.
       #
+      # db_pool: (a pool name, docs/history/plan-pg-pool.md) runs those
+      # Monk::Auth.verify calls -- the handshake's and reverify_interval's
+      # -- in that Monk::Persistence::Pg pool instead of in the socket's
+      # own Ractor. Without it, each socket's Ractor opens a connection of
+      # its own on the first verify and holds it while the socket is open:
+      # one Postgres connection per open page. With it, the server holds
+      # the pool's. Requires authenticate:, and the pool started
+      # (start_pools!) before the server.
+      #
       # max_payload_size: (bytes) -- see Connection::DEFAULT_MAX_PAYLOAD_SIZE
       # for what it guards against (gap 5). Unlike ping_interval:/
       # reverify_interval:, always on: this is insurance against a
@@ -53,7 +62,7 @@ module Monk
 
       def initialize(
         port:, bind: "0.0.0.0", allowed_origins: nil, authenticate: false, ping_interval: nil,
-        reverify_interval: nil, max_payload_size: Connection::DEFAULT_MAX_PAYLOAD_SIZE
+        reverify_interval: nil, max_payload_size: Connection::DEFAULT_MAX_PAYLOAD_SIZE, db_pool: nil
       )
         if ping_interval && !ping_interval.positive?
           raise ArgumentError, "ping_interval must be positive, got #{ping_interval.inspect}"
@@ -70,6 +79,8 @@ module Monk
           raise ArgumentError, "reverify_interval requires authenticate: true or :optional" unless authenticate
         end
 
+        raise ArgumentError, "db_pool requires authenticate: true or :optional" if db_pool && !authenticate
+
         unless max_payload_size.positive?
           raise ArgumentError, "max_payload_size must be positive, got #{max_payload_size.inspect}"
         end
@@ -91,12 +102,17 @@ module Monk
           Monk.freeze!
         end
 
+        # Raises now, not on the first connection, if the pool was never
+        # declared or isn't started in this process.
+        Monk::Persistence::Pg.pool(db_pool) if db_pool
+
         @tcp_server = TCPServer.new(bind, port)
         @allowed_origins = allowed_origins ? Ractor.make_shareable(allowed_origins.dup) : nil
         @authenticate = authenticate
         @ping_interval = ping_interval
         @reverify_interval = reverify_interval
         @max_payload_size = max_payload_size
+        @db_pool = db_pool
       end
 
       def port
@@ -117,12 +133,13 @@ module Monk
         loop do
           socket = @tcp_server.accept
           ractor = Ractor.new(
-            shareable_block, @authenticate, @allowed_origins, @ping_interval, @reverify_interval, @max_payload_size
-          ) do |blk, authenticate, origins, ping_interval, reverify_interval, max_payload_size|
+            shareable_block, @authenticate, @allowed_origins, @ping_interval, @reverify_interval, @max_payload_size,
+            @db_pool
+          ) do |blk, authenticate, origins, ping_interval, reverify_interval, max_payload_size, db_pool|
             Monk::WebSocket::Server.serve(
               Ractor.receive, blk,
-              authenticate: authenticate, allowed_origins: origins,
-              ping_interval: ping_interval, reverify_interval: reverify_interval, max_payload_size: max_payload_size
+              authenticate: authenticate, allowed_origins: origins, ping_interval: ping_interval,
+              reverify_interval: reverify_interval, max_payload_size: max_payload_size, db_pool: db_pool
             )
           end
           ractor.send(socket, move: true)
@@ -152,7 +169,7 @@ module Monk
       # TCPServer) is never Ractor-shareable and can't cross into here.
       def self.serve(
         socket, block, authenticate: false, allowed_origins: nil, ping_interval: nil, reverify_interval: nil,
-        max_payload_size: Connection::DEFAULT_MAX_PAYLOAD_SIZE
+        max_payload_size: Connection::DEFAULT_MAX_PAYLOAD_SIZE, db_pool: nil
       )
         request = read_handshake_request(socket)
         return socket.close unless request
@@ -167,12 +184,12 @@ module Monk
         subject = nil
         case authenticate
         when true
-          subject = authenticate!(socket, headers, allowed_origins)
+          subject = authenticate!(socket, headers, allowed_origins, db_pool)
           return unless subject
         when :optional
           return unless origin_allowed_for_optional?(socket, headers, allowed_origins)
 
-          subject = identify(headers)
+          subject = identify(headers, db_pool)
         end
 
         socket.write(Handshake.response_for(request))
@@ -181,7 +198,7 @@ module Monk
         connection.start_heartbeat(ping_interval) if ping_interval
         reverify_thread =
           if reverify_interval && subject
-            start_reverify(connection, Handshake.credential_from(headers)[:token], reverify_interval)
+            start_reverify(connection, Handshake.credential_from(headers)[:token], reverify_interval, db_pool)
           end
         begin
           block.call(connection)
@@ -201,7 +218,21 @@ module Monk
         connection&.unsubscribe!
         connection&.stop_heartbeat!
         socket.close
+        disconnect_all
+      end
+
+      # Closes the connections this socket's Ractor opened: its database
+      # connection (verifying the session without db_pool:, or a block
+      # that queries) and a fan-out's publisher (a block that broadcasts).
+      # Left alone, each would stay open until the garbage collector
+      # happened to run, which a mostly idle server may not do for a long
+      # time. The fan-outs are opt-in, so each is closed only if loaded.
+      def self.disconnect_all
+        Monk::Persistence.disconnect_all
+        PgFanout.disconnect_publisher if defined?(PgFanout)
+        RedisFanout.disconnect_publisher if defined?(RedisFanout)
       end
+      private_class_method :disconnect_all
 
       # docs/history/plan-websocket.md steps 22-23: the Origin allowlist check runs
       # before Monk::Auth.verify, and only for a cookie-derived
@@ -209,7 +240,7 @@ module Monk
       # by construction (mirrors require_csrf!'s own Bearer exemption in
       # docs/history/plan-auth.md). Returns the verified subject, or nil after writing
       # the appropriate 403/401 response itself.
-      def self.authenticate!(socket, headers, allowed_origins)
+      def self.authenticate!(socket, headers, allowed_origins, db_pool)
         credential = Handshake.credential_from(headers)
 
         if credential&.fetch(:via) == :cookie && allowed_origins
@@ -220,7 +251,7 @@ module Monk
           end
         end
 
-        subject = credential && Monk::Auth.verify(credential[:token])
+        subject = credential && verify(credential[:token], db_pool)
         socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n") unless subject
         subject
       end
@@ -240,7 +271,9 @@ module Monk
         return true if credential&.fetch(:via) == :bearer
 
         origin = headers["origin"]
-        allowed = credential ? origin && allowed_origins.include?(origin) : origin.nil? || allowed_origins.include?(origin)
+        # A cookie needs an allowed Origin; without one, only a non-browser
+        # client (no Origin at all) is let in.
+        allowed = origin.nil? ? !credential : allowed_origins.include?(origin)
         socket.write("HTTP/1.1 403 Forbidden\r\n\r\n") unless allowed
         allowed
       end
@@ -248,9 +281,9 @@ module Monk
 
       # The subject of a valid session, or nil -- no credential, or one
       # Monk::Auth no longer accepts, both mean anonymous under :optional.
-      def self.identify(headers)
+      def self.identify(headers, db_pool)
         credential = Handshake.credential_from(headers)
-        credential && Monk::Auth.verify(credential[:token])
+        credential && verify(credential[:token], db_pool)
       end
       private_class_method :identify
 
@@ -263,11 +296,11 @@ module Monk
       # own Thread rather than blocking the handler's own read loop,
       # mirroring Connection#start_heartbeat's shape; killed from #serve's
       # ensure the same way.
-      def self.start_reverify(connection, raw_token, interval)
+      def self.start_reverify(connection, raw_token, interval, db_pool)
         Thread.new do
           loop do
             sleep interval
-            break unless Monk::Auth.verify(raw_token)
+            break unless verify(raw_token, db_pool)
           end
           connection.close(code: 1008, reason: "session no longer valid")
         rescue IOError, Errno::EPIPE, Errno::ECONNRESET
@@ -278,6 +311,14 @@ module Monk
       end
       private_class_method :start_reverify
 
+      # Monk::Auth.verify, here or in the db_pool: pool (Server.new).
+      def self.verify(raw_token, db_pool)
+        return Monk::Auth.verify(raw_token) unless db_pool
+
+        Monk::Persistence::Pg.pool(db_pool).call(Monk::Auth, :verify, raw_token)
+      end
+      private_class_method :verify
+
       def self.read_handshake_request(socket)
         request = +""
         until request.end_with?("\r\n\r\n")

data/lib/monk/websocket.rb

@@ -3,6 +3,8 @@ require_relative "errors"
 # true) always raises this precise error, per ADR 0003, rather than a bare
 # NameError when an app calls it without ever requiring "monk/auth" at all.
 require_relative "auth/errors"
+# Dependency-free too: Server.serve closes a socket Ractor's connections.
+require_relative "persistence"
 require_relative "websocket/errors"
 require_relative "websocket/handshake"
 require_relative "websocket/frame"

data/lib/monk.rb

@@ -24,6 +24,8 @@ module Monk
     parts << " - auth=on" if defined?(Auth) && Auth.config
     backends = persistence_backends
     parts << " - persistence=#{backends.join(",")}" unless backends.empty?
+    pools = running_pools
+    parts << " - pools=#{pools.join(",")}" unless pools.empty?
     parts << "\n"
 
     $stdout.puts parts.join("\n")
@@ -42,4 +44,12 @@ module Monk
       .filter_map { |hook| "#{hook.name.split("::").last.downcase}:#{hook.names.join(",")}" if hook.names.any? }
   end
   private_class_method :persistence_backends
+
+  # "name(size)" for every pool started in this process, by any backend.
+  def self.running_pools
+    freeze_hooks
+      .select { |hook| hook.is_a?(Module) && hook.singleton_class.include?(Persistence::Registry) }
+      .flat_map { |hook| hook.running_pools.map { |name, size| "#{name}(#{size})" } }
+  end
+  private_class_method :running_pools
 end