odoshi 0.4.1 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8640e5e7840c3cac37ffedf58f4cad896ff602e72a61e98d2ee4b75f9b36fead
-  data.tar.gz: 2a49762d91363eb4867e6b7e61dce1784309e381f03b266b0fe9d713f12fc7d7
+  metadata.gz: 210218ceb1b9b969a90c2c7240a2d3265c7ce0850f06b50e5d7766bbc162483d
+  data.tar.gz: bc952939508e837da4999c95438cc05da4ef1dfa48f7141614571b89833e0cc0
 SHA512:
-  metadata.gz: 0d83801180e7dbd89233e37c877d78a9ee057b16093a0203063a08e0be57b2cbcd3de6f5c98dce4ad0898db0e7cbc92a94edfad2dc7f5c53ba71d7bdd3b7cbd6
-  data.tar.gz: f6f51e4b02af83310287321aee2668a6ca8d735876827806c9149fe595538174500811f9d53b12a7ea184421a382be6f2a614efe277211caa532f88c4211ae2c
+  metadata.gz: 72db2214ebcab14f74e0499e8246e38cc9f552278920a715309123153bd602f6006e57995f53ed2b335754c12335d8a2d05eb42e22156a4b68a9b0c625ec8720
+  data.tar.gz: 0b25f4206c6063a36482f626c787a92d88a44bc8ab03936eeb8b59f3e3bb2cde65f7b4104d79317655a2430c529c1f4858bdaca483930d5e6c26c469e08c5111

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## v0.4.2 — 2026-09-17
+
+- **A dead child's last heartbeat can no longer vouch for its replacement** (#18). The
+  predecessor's final line could still be sitting in its socket buffer when the successor
+  spawned; processed after the record was cleared, it stamped the new child as
+  active-and-healthy on the corpse's word — masking a replacement that was failing to boot
+  until freshness aging caught up (~3 health intervals). Connections now carry a monotonic
+  id and each child records the high-water mark at spawn, so beats from connections that
+  predate the current occupant are ignored. Every restart is a new process and therefore a
+  new connection, so a live child's own beats always pass. No wire change: §5 is untouched
+  and the fix is entirely supervisor-side.
+
 ## v0.4.1 — 2026-09-17
 
 - **Typo'd lifecycle options now fail loudly.** Adapter options pass through by design, so

data/lib/odoshi/socket_server.rb

@@ -19,10 +19,20 @@ module Odoshi
 
     attr_reader :path, :token
 
+    # Highest connection id issued so far: connections at or below a child's
+    # recorded floor predate it (issue #18).
+    def conn_seq = @seq_mutex.synchronize { @conn_seq }
+
     def initialize(path:, on_heartbeat:, on_control:)
       @path, @on_heartbeat, @on_control = path, on_heartbeat, on_control
       @token = SecureRandom.hex(16)
       @conns = []
+      # Monotonic per-connection id. A restarted child is a NEW process and
+      # must open a NEW connection, so the supervisor can tell a successor's
+      # beats from its dead predecessor's buffered ones (issue #18) without
+      # touching the frozen §5 wire format.
+      @conn_seq = 0
+      @seq_mutex = Mutex.new
     end
 
     # Binds, chmods, and exports ODOSHI_SOCK / ODOSHI_TOKEN so children
@@ -48,7 +58,8 @@ module Odoshi
             close_quietly(conn)
             next
           end
-          @conns << { conn: conn, thread: Thread.new { serve(conn) } }
+          seq = @seq_mutex.synchronize { @conn_seq += 1 }
+          @conns << { conn: conn, seq: seq, thread: Thread.new { serve(conn, seq) } }
         rescue IOError, SystemCallError
           break # server closed during shutdown
         end
@@ -70,7 +81,7 @@ module Odoshi
 
     private
 
-    def serve(conn)
+    def serve(conn, seq)
       loop do
         line = conn.gets("\n", MAX_LINE)
         break if line.nil?
@@ -81,7 +92,7 @@ module Odoshi
           break if line.nil?
           next
         end
-        handle_line(line)
+        handle_line(line, seq)
       end
     rescue IOError, SystemCallError
       nil
@@ -92,7 +103,7 @@ module Odoshi
     # §5: token, cmd, id, and state are JSON strings; anything else in those
     # fields is malformed and silently dropped — same as a bad token. A bad
     # line must never take the connection (or the supervisor) down.
-    def handle_line(line)
+    def handle_line(line, seq)
       msg = begin
         JSON.parse(line)
       rescue StandardError
@@ -102,7 +113,7 @@ module Odoshi
       if msg.key?("cmd")
         @on_control.call(msg) if msg["cmd"].is_a?(String)
       elsif msg["id"].is_a?(String) && msg["state"].is_a?(String)
-        @on_heartbeat.call(msg)
+        @on_heartbeat.call(msg, seq)
       end
     end
 

data/lib/odoshi/supervisor.rb

@@ -16,6 +16,7 @@ module Odoshi
       @stopping = false
       @stop_requested = false
       @heartbeats = {} # id => { at: monotonic ts of last heartbeat, state: reported state }
+      @hb_floor = {}   # id => connection seq at spawn; older connections are the corpse's (#18)
       return unless socket_path
       @socket = SocketServer.new(
         path: socket_path,
@@ -23,9 +24,18 @@ module Odoshi
         # dropped at intake: ghost ids must not grow the table unboundedly
         # (issue #16/#27). Subtree-grandchild routing is the open flat-id
         # question — until it's decided, their beats are dropped, not hoarded.
-        on_heartbeat: lambda { |msg|
+        # A beat counts only if it comes from a connection opened AFTER the
+        # child currently holding that id was spawned. The predecessor's
+        # last line can still be sitting in its socket buffer when the
+        # replacement starts; accepting it would vouch for a successor that
+        # may be failing to boot (#18). Every restart is a new process and
+        # therefore a new connection, so a live child's own beats always
+        # pass. Ghost ids are still dropped at intake (#16).
+        on_heartbeat: lambda { |msg, seq|
           id = msg["id"].to_sym
-          @heartbeats[id] = { at: mono_now, state: msg["state"] } if @children.any? { |c| c.id == id }
+          next unless @children.any? { |c| c.id == id }
+          next if seq <= @hb_floor[id].to_i
+          @heartbeats[id] = { at: mono_now, state: msg["state"] }
         },
         on_control: ->(msg) { @queue << { type: :control, cmd: msg["cmd"], id: msg["id"].to_s.to_sym } }
       )
@@ -109,7 +119,12 @@ module Odoshi
     end
 
     def spawn_and_link(spec)
-      @heartbeats.delete(spec.id) # a replaced child's heartbeats must not vouch for its successor
+      # A replaced child's heartbeats must not vouch for its successor:
+      # clear the record AND raise the connection floor, so beats still
+      # buffered on the corpse's connection are ignored rather than racing
+      # the delete (#18).
+      @heartbeats.delete(spec.id)
+      @hb_floor[spec.id] = @socket&.conn_seq || 0
       adapter = Adapter.lookup(spec.adapter).new
       handle = adapter.spawn(spec)
       prev = @live[spec.id] || {}

data/lib/odoshi/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module Odoshi
-  VERSION = "0.4.1"
+  VERSION = "0.4.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: odoshi
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.4.2
 platform: ruby
 authors:
 - timimsms