pgbus 0.13.8 → 0.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 403234bf91b0ae06bd9c1331b6356450c98cc7a062a7ebcfb45f159950d07c2c
-  data.tar.gz: a314687f0071c9588433dcd452c146178cc1afc52a2e46a675e998004bdbef2f
+  metadata.gz: 66fe070813c414410d4b55f2b9c9f1dfcacd70236f97d22f8e037ec7a2d906c4
+  data.tar.gz: 285e8851e43a02384734c0dfda2ae240ea4450554b5c8dca478e351b04a57528
 SHA512:
-  metadata.gz: 80ce61932ee3f9c34562c353219ae5c19a2a1b312c8418e6ed645e32c66ac2e7f590edd7b9cc861e4f13b4bd784a7f2712d4b45b11f0a0c49b30fa117a664501
-  data.tar.gz: 91856c566af986f8de528c40e036a00548adf0d7bb0d6e1fc96abb887120613df0b9f8fb22a04292bf4bb794baf06e6a7668b823b05fed730d52b420ff5cfc9b
+  metadata.gz: 160efab6bf57a74ab7d190b127b7e0f64426fc17877407a87c0f70a3ba328bea8e0dfa6c44e2477263e746b16a23544843a044e1eb88c285147a6e31e129f404
+  data.tar.gz: 7dc944582757565e3d0c8339661e533745f750731da645f2aaf6693673083b31b470f1b92265e880278b7b5720a593cc266eb9d3a11aaf554a527780f7cd481b

data/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ### Fixed
 
+- **Boot-time BusRecord connections no longer wedge `db:test:purge` — pgbus disconnects its own pools before every database purge/drop (issue #409).** With pgbus on a dedicated database (`config.connects_to`), any boot-time touch of a pgbus model left an idle session on that database for the life of the process. Rails' purge/drop only disconnects the connection it establishes for the target db_config — it knows nothing about gem-owned pools — so the rake process's own idle session blocked its own `DROP DATABASE`: a hang without a `statement_timeout`, a fast `ActiveRecord::QueryCanceled` with one, and either way `db:test:prepare` / `maintain_test_schema!` permanently broken on that machine (every retry re-boots, re-opens the connection, and re-blocks; terminating sessions externally can't help). Three changes: **(1)** `Pgbus::DatabaseTasksGuard` is prepended onto `ActiveRecord::Tasks::DatabaseTasks` at boot, so every route to a purge/drop — `db:test:purge` / `db:purge` / `db:drop` and their per-database variants, `maintain_test_schema!`'s in-process purge, parallel-testing's `TestDatabases` — first runs `Pgbus::BusRecord.disconnect_all_pools!` (all roles; a no-op on primary-database installs, `ActiveRecord::Base`'s pool is never touched). **(2)** The task-aware guard the event-bus registry already used internally is now public as **`Pgbus.database_task?`** — true while the process runs a `db:*` / `assets:*`-family rake task — so apps can skip their own boot-time warm-ups in the contexts where a database may legitimately not exist. **(3)** `pgbus:tune_autovacuum` (enhanced onto `db:schema:load`) no longer holds a permanent connection lease from `BusRecord.connection`: it checks out via `connection_pool.with_connection` and disconnects the pool afterward, leaving no idle session behind inside longer rake chains. Refs #409.
+
+- **Concurrent queue creation no longer kills the loser with `PG::UniqueViolation` on `pg_class` (issue #404).** The sibling of the #403 trigger race, one DDL step earlier: `CREATE TABLE IF NOT EXISTS` is not race-safe — two backends creating a not-yet-existing queue both pass the existence check (READ COMMITTED; neither sees the other's uncommitted catalog rows), both insert into `pg_class`, and the loser raises `unique_violation` on `pg_class_relname_nsp_index` instead of the friendly `duplicate_table`. All the dedup guards (`@queues_created`, `Stream#@ensured`, `synchronized`) are process-local, so with lazily-created per-record durable stream queues two processes first-touching the same brand-new stream hit `pgmq.create` simultaneously — and via `send_message`'s `ensure_queue` the same window applies to plain job queues on cold post-deploy herds (production: AppSignal incident #963, an unrescued `PG::UniqueViolation` out of an unrelated `after_commit`). Three DDL steps now rescue the duplicate as success, mirroring the #397/#403 shape: **(1)** `create_queue_table` — `pgmq.create` is a single statement and therefore atomic, so when the loser unblocks the winner has committed the whole queue; the loser re-checks `pgmq.meta` and returns, retrying `pgmq.create` once when the re-check can't confirm (e.g. a leftover physical table without a meta row) with a second failure propagating (the retry's own error — the original duplicate is preserved deeper in its cause chain via Ruby's implicit `$!` chaining); **(2)** `create_fifo_index_if_needed` under group_mode — the duplicate proves the index exists; **(3)** the stream archive `msg_id` index in `ensure_stream_queue` — a raw `CREATE INDEX IF NOT EXISTS` with the same catalog race, where the loser now proceeds to register and memoize the stream instead of dropping the first broadcast. Duplicate detection reuses `DUPLICATE_INSTALL_ERROR_CLASSES`, matched directly (raw `conn.exec` paths) or as the `cause` of pgmq-ruby's `ConnectionError` wrapper. No locking added, no happy-path cost. Refs #404.
+
+- **Concurrent lazy stream-queue ensures no longer drop the loser's broadcast with `PG::DuplicateObject` on the NOTIFY trigger (issue #403).** `Client#enable_notify_if_needed` is check-then-act — `notify_trigger_current?` is a plain SELECT and the surrounding `synchronized` is a process-local mutex — so after a deploy, when every process's `@queues_created` memo is cold, two processes handling the first broadcast for the same stream both see "trigger not current" and both run PGMQ's `DROP TRIGGER IF EXISTS` + `CREATE CONSTRAINT TRIGGER` cycle. The loser's CREATE blocks on the winner's table lock and fails with `duplicate_object` once the winner commits — surfaced as `PGMQ::Errors::ConnectionError`, killing that broadcast (in production: a deploy-time thundering herd turning unrelated `after_commit` writes into 500s, AppSignal incident #546). The existing mitigations all miss this window: the 0.12.x `notify_trigger_current?` check made repeat ensures cheap but left the TOCTOU race, the #397 advisory lock serializes schema install only, and the supervisor's pre-fork bootstrap covers job-container children but not web processes. The loser now treats the duplicate as success — the trigger provably exists because a concurrent caller just created it (same shape as the #397 duplicate-object rescue on schema install; matched on the trigger identifier, which survives message localization, plus the `PG::DuplicateObject` cause or the "already exists" text). Before returning, it re-checks `notify_trigger_current?`: racing ensures pass the same throttle so the check normally confirms and returns, but a job-queue ensure (250ms) racing the stream override (0ms) can leave the wrong interval installed — that mismatch retries `enable_notify_insert` once to converge; a second loss propagates. No locking added, no happy-path cost. Refs #403.
+
 - **`StreamQueue.record!` no longer depends on Rails' pool schema-cache index resolution — one bad probe stopped poisoning stream registration for the process lifetime (issue #401).** `record!` used `upsert(unique_by: :queue_name)`, which resolves the unique index through the connection pool's schema cache. That cache stores a negative `data_source_exists?` answer permanently, and `SchemaCache#indexes` returns `[]` (uncached) whenever the cached probe says false — while the `table_exists?` guard at the top of `record!` is a live query. So a single wrong first probe on the pool cache (observed under PgBouncer transaction pooling in production, and from a coalescer flush thread racing foreground test DB work in CI) made the guard pass and the upsert raise `ArgumentError: No unique index found for queue_name` — swallowed at DEBUG — on **every** subsequent `record!` in that process until restart, leaving streams unregistered from that process's perspective (maintenance, orphan sweep, and wildcard classification degrade). The registry write is now a raw `INSERT … ON CONFLICT (queue_name) DO NOTHING` on the model's connection: the unique index is owned by the gem's own migration, so there is nothing for Rails to resolve, no schema-cache traffic leaves the hot first-broadcast path, and a poisoned cache can no longer break registration (pinned by an integration regression spec that deliberately poisons the pool cache, plus a `sql.active_record` assertion that no `SCHEMA` query is issued once the `table_exists?` memo is warm). Failure logging is now class-aware: a transient database error (`ActiveRecord::ActiveRecordError`) still logs at DEBUG per attempt, but a non-database failure — the bug-signal class the old `ArgumentError` belonged to — logs at WARN once per process (DEBUG thereafter) instead of drowning a process-lifetime malfunction in per-broadcast DEBUG spam. Return values and `backfill!`/`all_names` cache semantics are unchanged. Refs #401.
 
 - **The schema-install transaction framing no longer commits or destroys a caller's open transaction (#398 review follow-up).** The #397 fix wrapped check+install in `BEGIN`…`COMMIT`/`ROLLBACK` unconditionally. On the Proc-supplied shared-connection path (the Rails lambda), the connection can arrive **mid-transaction** — e.g. `perform_later` inside an application `transaction do` block — where `BEGIN` is a warning-level no-op and the matching `COMMIT`/`ROLLBACK` then commits half of, or destroys, the *caller's* transaction. The framing is now `transaction_status`-aware: an idle connection gets the owned `BEGIN`…`COMMIT` as before; a connection already inside a transaction rides it via `SAVEPOINT pgbus_pgmq_install` / `RELEASE` (`ROLLBACK TO SAVEPOINT` on failure), so the caller's transaction is never touched. On the savepoint path the advisory lock joins the caller's transaction and is held until it ends — over-holding only delays a concurrent installer, never corrupts it — and `@schema_ensured` is NOT cached there: the install is only durable once the caller commits, so a cached true after an outer rollback would skip every future check against a missing schema. The same durability rule now governs `@queues_created`: queue DDL on the shared Proc-supplied connection joins the caller's open transaction, so queue creation there runs uncached (idempotent `CREATE IF NOT EXISTS`) and the next ensure re-checks — a cache write outliving a caller rollback would make later message operations fail against a missing queue. All shared-connection access in these paths — including the transaction-status probe and the schema install itself — holds the per-instance connection mutex, restoring the single-owner invariant the #397 fix had narrowed. Refs #398.

data/lib/pgbus/bus_record.rb

@@ -12,5 +12,20 @@ module Pgbus
   # and the engine's app/models path isn't registered yet.
   class BusRecord < ActiveRecord::Base
     self.abstract_class = true
+
+    # Disconnects every pool owned by this class — the pools `connects_to`
+    # creates when pgbus runs on a dedicated database — across all roles.
+    # When pgbus runs in the primary database there is no BusRecord-owned
+    # pool and this is a no-op; ActiveRecord::Base's pool is never touched.
+    #
+    # Called by Pgbus::DatabaseTasksGuard before every database purge/drop so
+    # an idle boot-time session on the pgbus database can never block that
+    # same process's DROP DATABASE (issue #409). Safe to call at any time:
+    # the next checkout after a disconnect reconnects transparently.
+    def self.disconnect_all_pools!
+      connection_handler.connection_pool_list(:all).each do |pool|
+        pool.disconnect! if pool.connection_class == self
+      end
+    end
   end
 end

data/lib/pgbus/client/ensure_stream_queue.rb

@@ -46,10 +46,19 @@ module Pgbus
           ON pgmq.a_#{sanitized} (msg_id)
         SQL
 
-        synchronized do
-          with_raw_connection do |conn|
-            conn.exec(sql)
+        begin
+          synchronized do
+            with_raw_connection do |conn|
+              conn.exec(sql)
+            end
           end
+        rescue StandardError => e
+          # CREATE INDEX IF NOT EXISTS shares pgmq.create's catalog race
+          # (issue #404): two first-broadcasts both pass the existence
+          # check and the loser gets a raw unique_violation on pg_class.
+          # The duplicate proves the index exists — carry on to register
+          # and memoize.
+          raise unless duplicate_relation_error?(e)
         end
 
         # Record the physical queue name so maintenance (stream-archive prune,

data/lib/pgbus/client.rb

@@ -64,6 +64,12 @@ module Pgbus
     # re-running the trigger DDL on every queue.
     NOTIFY_THROTTLE_MS = 250
 
+    # PGMQ's per-queue NOTIFY trigger name, as created by
+    # pgmq.enable_notify_insert — used to recognize the duplicate-trigger
+    # race loser (issue #403).
+    NOTIFY_TRIGGER_NAME = "trigger_notify_queue_insert_listeners"
+    private_constant :NOTIFY_TRIGGER_NAME
+
     # Load the pgmq-ruby gem, defining the PGMQ module before requiring it so
     # Zeitwerk's eager_load (called inside pgmq.rb) can resolve the constant.
     # Without the pre-definition, Ruby 4.0 + Zeitwerk 2.7.5 raises NameError
@@ -1177,7 +1183,29 @@ module Pgbus
     end
 
     # Runs inside synchronized — callers own the connection mutex.
+    #
+    # CREATE TABLE IF NOT EXISTS is not race-safe: two backends creating a
+    # not-yet-existing queue both pass the existence check (READ COMMITTED
+    # — neither sees the other's uncommitted catalog rows), both insert
+    # into pg_class, and the loser raises unique_violation on
+    # pg_class_relname_nsp_index instead of the friendly duplicate_table
+    # (issue #404 — the sibling of the #403 trigger race, one DDL step
+    # earlier; `synchronized` is process-local, so nothing serializes
+    # this across processes). pgmq.create is a single statement and
+    # therefore atomic: by the time the loser unblocks, the winner has
+    # committed the WHOLE queue — tables, indexes, and the pgmq.meta row
+    # — so re-check meta and return (the winner also ran autovacuum
+    # tuning). The retry covers the can't-confirm case (e.g. a leftover
+    # physical table without a meta row); its failure propagates as the
+    # retry's own error, with the original duplicate preserved deeper in
+    # the cause chain (raised while $! held it, so Ruby chains it).
     def create_queue_table(name)
+      @pgmq.create(name)
+      tune_autovacuum(name)
+    rescue StandardError => e
+      raise unless duplicate_relation_error?(e)
+      return if queue_registered?(name)
+
       @pgmq.create(name)
       tune_autovacuum(name)
     end
@@ -1203,17 +1231,77 @@ module Pgbus
       end
     end
 
+    # notify_trigger_current? is a plain SELECT and `synchronized` is a
+    # process-local mutex, so this check-then-act races across processes:
+    # after a deploy every process's @queues_created memo is cold, and two
+    # web processes handling the first broadcast for the same lazy stream
+    # queue both see "trigger not current" and both run PGMQ's
+    # DROP + CREATE CONSTRAINT TRIGGER cycle. The loser's CREATE blocks on
+    # the winner's table lock and fails with PG::DuplicateObject once the
+    # winner commits (issue #403). The duplicate proves the trigger exists,
+    # so treat it as success — same shape as the #397 duplicate-object
+    # rescue on schema install. Re-check the throttle first: racing ensures
+    # pass the same value, but a job-queue ensure (250ms) can race the
+    # stream override (0ms), so a mismatch means the winner installed a
+    # different interval — retry once to converge; a second loss propagates.
     def enable_notify_if_needed(full_name, throttle_ms)
       return unless config.listen_notify
       return if notify_trigger_current?(full_name, throttle_ms)
 
+      @pgmq.enable_notify_insert(full_name, throttle_interval_ms: throttle_ms)
+    rescue PGMQ::Errors::ConnectionError => e
+      raise unless duplicate_notify_trigger_error?(e)
+      return if notify_trigger_current?(full_name, throttle_ms)
+
       @pgmq.enable_notify_insert(full_name, throttle_interval_ms: throttle_ms)
     end
 
+    # Matched on the trigger name (an identifier — survives server-side
+    # message localization) plus either the PG::DuplicateObject cause set by
+    # pgmq-ruby's `raise … ConnectionError` inside `rescue PG::Error` (the
+    # defined? guard mirrors the other PG::… checks in this file: a cause
+    # can only be a PG::DuplicateObject when the class is loaded) or the
+    # English "already exists" text when a wrapper dropped the cause.
+    def duplicate_notify_trigger_error?(error)
+      message = error.message.to_s
+      return false unless message.include?(NOTIFY_TRIGGER_NAME)
+
+      (defined?(PG::DuplicateObject) && error.cause.is_a?(PG::DuplicateObject)) ||
+        message.include?("already exists")
+    end
+
     def create_fifo_index_if_needed(full_name)
       return unless config.group_mode
 
       @pgmq.create_fifo_index(full_name)
+    rescue StandardError => e
+      # CREATE INDEX IF NOT EXISTS has the same catalog race as
+      # pgmq.create (issue #404): the loser's duplicate proves a
+      # concurrent ensure created the index.
+      raise unless duplicate_relation_error?(e)
+    end
+
+    # A relation-creation race loser's error: one of the duplicate DDL
+    # classes directly (raw conn.exec paths), or wrapped — pgmq-ruby
+    # raises ConnectionError inside `rescue PG::Error`, so Ruby sets the
+    # duplicate as its cause automatically.
+    def duplicate_relation_error?(error)
+      duplicate_install_error?(error) || duplicate_install_error?(error.cause)
+    end
+
+    # Whether pgmq.meta records the queue — the authoritative "create
+    # committed" signal (pgmq.create writes it atomically with the
+    # tables). The pooled checkout is a sequential sibling of the failed
+    # create's (already returned when the exception unwound), so there is
+    # no nested checkout — same reasoning as notify_trigger_current?.
+    def queue_registered?(full_name)
+      @pgmq.with_connection do |conn|
+        conn.exec_params("SELECT 1 FROM pgmq.meta WHERE queue_name = $1 LIMIT 1", [full_name]).ntuples.positive?
+      end
+    rescue StandardError
+      # Can't confirm (aborted caller transaction, schema not ready) —
+      # fall through to the retry, which surfaces the state honestly.
+      false
     end
 
     # Check whether the NOTIFY trigger already exists on this queue with the
@@ -1238,7 +1326,7 @@ module Pgbus
           JOIN pg_namespace n ON c.relnamespace = n.oid
           WHERE n.nspname = 'pgmq'
             AND c.relname = pgmq.format_table_name($1, 'q')
-            AND t.tgname = 'trigger_notify_queue_insert_listeners'
+            AND t.tgname = '#{NOTIFY_TRIGGER_NAME}'
             AND EXISTS (
               SELECT 1 FROM pgmq.notify_insert_throttle
               WHERE queue_name = $1

data/lib/pgbus/database_tasks_guard.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module Pgbus
+  # Prepended onto ActiveRecord::Tasks::DatabaseTasks' singleton class by the
+  # engine (initializer "pgbus.db") so every database purge/drop first
+  # disconnects the gem's own BusRecord pools.
+  #
+  # Why: with pgbus on a dedicated database (config.connects_to), any
+  # boot-time touch of a Pgbus model leaves an idle session on that database
+  # for the life of the process. Rails' purge/drop only disconnects the
+  # connection it establishes for the target db_config — it knows nothing
+  # about gem-owned pools — so the process's own idle session blocks its own
+  # DROP DATABASE (or kills it via statement_timeout), permanently wedging
+  # db:test:prepare (issue #409).
+  #
+  # Intercepting DatabaseTasks (rather than enhancing the rake tasks) covers
+  # every route to a purge/drop: db:test:purge / db:purge / db:drop and their
+  # per-database variants, maintain_test_schema!'s in-process purge, and
+  # parallel-testing's TestDatabases — they all funnel through these methods.
+  #
+  # Installed only in processes that booted the app; a bare `db:drop` process
+  # that never ran initializers has no BusRecord pool to block on anyway.
+  module DatabaseTasksGuard
+    def purge(...)
+      Pgbus::BusRecord.disconnect_all_pools!
+      super
+    end
+
+    def drop(...)
+      Pgbus::BusRecord.disconnect_all_pools!
+      super
+    end
+  end
+end

data/lib/pgbus/engine.rb

@@ -61,6 +61,12 @@ module Pgbus
     initializer "pgbus.db" do
       ActiveSupport.on_load(:active_record) do
         Pgbus::BusRecord.connects_to(**Pgbus.configuration.connects_to) if Pgbus.configuration.connects_to
+
+        # Disconnect the gem's own pools before any database purge/drop, so an
+        # idle boot-time BusRecord session on a dedicated pgbus database can
+        # never block that same process's DROP DATABASE (issue #409). No-op
+        # when pgbus runs in the primary database (no BusRecord-owned pool).
+        ActiveRecord::Tasks::DatabaseTasks.singleton_class.prepend(Pgbus::DatabaseTasksGuard)
       end
     end
 

data/lib/pgbus/event_bus/registry.rb

@@ -104,23 +104,11 @@ module Pgbus
 
       private
 
-      # Rake task-name prefixes during which pgbus must NOT open a PGMQ
-      # connection: creating/dropping/migrating/loading the schema (a live
-      # connection blocks DROP DATABASE) and asset precompile (no DB expected).
-      SCHEMA_TASK_PREFIXES = %w[db: db_test: assets: webpacker: yarn:].freeze
-      private_constant :SCHEMA_TASK_PREFIXES
-
       # True when running inside a rake schema/asset task, where setup_all!(safe:)
-      # should skip rather than open a connection. Detected from the invoked rake
-      # task names; false outside a Rake run.
+      # should skip rather than open a connection. Delegates to the shared,
+      # public detector (issue #409) so there is a single implementation.
       def schema_task_context?
-        return false unless defined?(::Rake) && ::Rake.respond_to?(:application)
-
-        tasks = ::Rake.application.top_level_tasks
-        tasks.any? { |t| SCHEMA_TASK_PREFIXES.any? { |prefix| t.to_s.start_with?(prefix) } }
-      rescue StandardError => e
-        Pgbus.logger.debug { "[Pgbus] schema_task_context? detection failed, assuming non-schema: #{e.class}: #{e.message}" }
-        false
+        Pgbus.database_task?
       end
 
       def matches?(pattern, routing_key)

data/lib/pgbus/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Pgbus
-  VERSION = "0.13.8"
+  VERSION = "0.14.0"
 end

data/lib/pgbus.rb

@@ -10,6 +10,13 @@ module Pgbus
   # this to be configurable.
   DEAD_LETTER_SUFFIX = "_dlq"
 
+  # Rake task-name prefixes during which pgbus must NOT open a database
+  # connection: schema management (an idle session on a dedicated pgbus
+  # database blocks that same process's DROP DATABASE during db:test:purge —
+  # issue #409) and asset precompile (where a database may legitimately not
+  # exist). Consulted by Pgbus.database_task?.
+  DATABASE_TASK_PREFIXES = %w[db: db_test: assets: webpacker: yarn:].freeze
+
   # Error-hierarchy policy (the 1.0 contract, issue #282):
   #
   #   * OPERATIONAL errors — a pgbus subsystem failed to do its job at runtime
@@ -149,6 +156,30 @@ module Pgbus
       @configuration ||= Configuration.new
     end
 
+    # True when the current process is running a rake task (db:*, assets:*, …
+    # — see DATABASE_TASK_PREFIXES) during which pgbus must not touch the
+    # database: the database may not exist yet, and an idle connection on a
+    # dedicated pgbus database blocks that same process's DROP DATABASE
+    # during db:test:purge (issue #409). Use it to guard boot-time database
+    # touches in an initializer:
+    #
+    #   Rails.application.config.after_initialize do
+    #     Pgbus::StreamQueue.table_exists? unless Pgbus.database_task?
+    #   end
+    #
+    # False outside a Rake run, and false (never raise into boot) when
+    # detection itself fails.
+    def database_task?
+      return false unless defined?(::Rake) && ::Rake.respond_to?(:application)
+
+      ::Rake.application.top_level_tasks.any? do |task|
+        DATABASE_TASK_PREFIXES.any? { |prefix| task.to_s.start_with?(prefix) }
+      end
+    rescue StandardError => e
+      logger.debug { "[Pgbus] database_task? detection failed, assuming non-schema: #{e.class}: #{e.message}" }
+      false
+    end
+
     def configure
       yield configuration
       # Fail loud at boot on an invalid value rather than leaving it dormant

data/lib/tasks/pgbus_autovacuum.rake

@@ -5,26 +5,42 @@ namespace :pgbus do
   task tune_autovacuum: :environment do
     require "pgbus/autovacuum_tuning"
 
-    conn = Pgbus.configuration.connects_to ? Pgbus::BusRecord.connection : ActiveRecord::Base.connection
+    apply_tuning = lambda do |conn|
+      # Only run if pgmq schema exists (tables may not be created yet during
+      # initial setup — the install migration handles tuning itself).
+      pgmq_exists = conn.select_value(
+        "SELECT 1 FROM information_schema.schemata WHERE schema_name = 'pgmq'"
+      )
 
-    # Only run if pgmq schema exists (tables may not be created yet during
-    # initial setup — the install migration handles tuning itself).
-    pgmq_exists = conn.select_value(
-      "SELECT 1 FROM information_schema.schemata WHERE schema_name = 'pgmq'"
-    )
+      unless pgmq_exists
+        puts "[pgbus] PGMQ schema not found — skipping autovacuum tuning."
+        next
+      end
 
-    unless pgmq_exists
-      puts "[pgbus] PGMQ schema not found — skipping autovacuum tuning."
-      next
-    end
+      puts "[pgbus] Applying autovacuum tuning to PGMQ queue/archive tables..."
+      conn.execute(Pgbus::AutovacuumTuning.sql_for_all_queues)
 
-    puts "[pgbus] Applying autovacuum tuning to PGMQ queue/archive tables..."
-    conn.execute(Pgbus::AutovacuumTuning.sql_for_all_queues)
+      puts "[pgbus] Applying autovacuum tuning to high-churn pgbus tables..."
+      conn.execute(Pgbus::AutovacuumTuning.sql_for_high_churn_tables)
 
-    puts "[pgbus] Applying autovacuum tuning to high-churn pgbus tables..."
-    conn.execute(Pgbus::AutovacuumTuning.sql_for_high_churn_tables)
+      puts "[pgbus] Autovacuum tuning complete."
+    end
 
-    puts "[pgbus] Autovacuum tuning complete."
+    if Pgbus.configuration.connects_to
+      # Scoped checkout + disconnect: this task is enhanced onto
+      # db:schema:load, so a permanent `.connection` lease on the dedicated
+      # pgbus database would leave an idle session that blocks a later
+      # DROP DATABASE in the same rake process (issue #409).
+      begin
+        Pgbus::BusRecord.connection_pool.with_connection { |conn| apply_tuning.call(conn) }
+      ensure
+        # Disconnect even when tuning raises — the session must not outlive
+        # the task either way.
+        Pgbus::BusRecord.connection_pool.disconnect!
+      end
+    else
+      apply_tuning.call(ActiveRecord::Base.connection)
+    end
   end
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pgbus
 version: !ruby/object:Gem::Version
-  version: 0.13.8
+  version: 0.14.0
 platform: ruby
 authors:
 - Mikael Henriksson
@@ -270,6 +270,7 @@ files:
 - lib/pgbus/concurrency/semaphore.rb
 - lib/pgbus/configuration.rb
 - lib/pgbus/configuration/capsule_dsl.rb
+- lib/pgbus/database_tasks_guard.rb
 - lib/pgbus/dedicated_connection.rb
 - lib/pgbus/dedup_cache.rb
 - lib/pgbus/doctor.rb