pgbus 0.15.0 → 0.15.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c9e24beb40f37672bb2d5b51db5c6ffeb2894e1a2be3711ff6b17cc5c2ed52b7
-  data.tar.gz: 4fe85e1733dd8257b1f13af40778fbc449146015d707e9d2889b287ad83af78b
+  metadata.gz: 13ec61547a6821edab1a7aa96e794d522cc6fdcd38dd354bf601c9c760a2fded
+  data.tar.gz: b79ef51aa82c336ba98e3df071d40e9de5467bec196fb53edaf8a4fa5507327d
 SHA512:
-  metadata.gz: b8e23d2e38e12c2dd882dcdb5de8c23763b469551c869511718cd9d52a85ccdceb344779ae48ab3a3cfec2f1d3e8373d642f8d97f712c30f98893ed0450abc0d
-  data.tar.gz: 142d408f3fa304d82593cf9fdf6167592c3bf2cafb64016702b057e374a98c7476e33922d6b05be00e7a71136861a77d9b8267dbd1fabb1dc6ed48c6fd1e15ae
+  metadata.gz: 8647f5cff936fae72bc95ea49c793fc68e514c29c2955d88b668dd6e5905a95418f7efdb8082e77048a584b9a0c86aa2cea42bbcd1f0777df349606ddbd4db08
+  data.tar.gz: ee10d3f15f0e03a8a46d359c5aaf19f3329ed628dd4ae72d98fe00aec4b9689ee43005b73884b62e997fb3305c0b2c5ec2ce9a747646e558a1ade1cbeca27f0e

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 ## [Unreleased]
 
+### Fixed
+
+- **Worker forks no longer kill the supervisor's shared LISTEN connection (issue #437).** Under `worker_notify_scope = :supervisor` every fork produced one `[Pgbus::NotifyListener] connection error (PG::ConnectionBad: PQconsumeInput() server closed the connection unexpectedly …) — reconnecting` in the supervisor ~2 s after `Worker started`, and a LISTEN gap (polling fallback) until `reconnect!` completed. The child's fork hygiene closed the Ruby `IO` wrapper of the inherited LISTEN socket, but pg builds `socket_io` with `autoclose=false`, so the fd stayed open — and when the child's GC freed the inherited `PG::Connection`, its `PQfinish` sent a libpq Terminate down that fd, i.e. down the **parent's** connection. `NotifyListener#close_inherited_socket!` now repoints the fd at `/dev/null` (`socket_io.reopen(IO::NULL)`, the ActiveRecord `PostgreSQLAdapter#discard!` idiom) so the eventual `PQfinish` is harmless. Regression-covered by a real-fork integration spec that asserts the parent's `pgbus-listen` backend pid is unchanged and no reconnect is logged. Refs #437.
+- **A process whose `pgbus_processes` row is deleted underneath it now re-registers instead of staying invisible forever (issue #438).** `Heartbeat#beat` updated its row by id; when the row was gone — the dispatcher's stale-process reaper after a ≥ 5-minute heartbeat gap, a manual cleanup, another host's clock skew — `update_all` matched 0 rows, raised nothing, and the process (healthy, logging, serving `/readyz`) was absent from `pgbus_processes` until it restarted, so the supervisor's DB loop-tick check silently fell back to the pipe and `ConsumerPriority` could not see it. The beat now treats an affected-row count of 0 as "row is gone": it logs one WARN naming the old id, kind and pid (so whatever deleted the row can be hunted), re-registers through the existing boot path, and lands that beat's `last_heartbeat_at` / metadata on the new row. A mutex plus a stopped flag keep a beat that races `stop` from resurrecting a row `deregister_process` just deleted. Zero extra queries on the happy path. Refs #438.
+- **Supervisor logs a worker recycle as a clean exit, not a crash (issue #438).** A worker or consumer hitting `max_jobs` / `max_memory` / `max_lifetime` exits 0 by design, but the supervisor logged `Child worker pid=N exited unexpectedly (status=0)`, burying real crashes. A clean exit outside shutdown is now INFO `exited cleanly (status=0) — restarting (worker recycle)`; non-zero exits keep the WARN, and a signaled exit reports `signal=N` instead of an empty status so an OOM SIGKILL is distinguishable. Restart policy is unchanged. Refs #438.
+- **`current_attributes` capture skips an unpersisted record instead of raising at enqueue (issue #435).** An attribute holding an Active Record instance with no id — a dev-mode fallback record assigned to `Current`, a form-built model captured before `save`, a destroyed record whose locate is guaranteed to fail — made every `perform_later` in that context raise `Pgbus::CurrentAttributesError`, even though such a record can never round-trip (no id → no GlobalID) and capture is ambient: the enqueuer never opted into persisting that attribute per-call, so its momentary state must not abort the enqueue. `capture` now skips any attribute value that answers `persisted?` falsey (so destroyed-but-id-bearing records are skipped too, not just `new_record?`) with a debug log naming the class, attribute and why; the rest of the class's attributes still persist. The `except:` guidance and the loud `CurrentAttributesError` remain for genuinely unserializable values — objects without the Active Record duck-type (`respond_to?(:persisted?)`) are untouched. Applies to jobs and event-bus publish alike (same capture path). Refs #435.
+
 ### Added
 
 - **First-class `Current` support: ActiveSupport::CurrentAttributes persist across enqueue → perform (issue #430).** The executor already reset `CurrentAttributes` around every job (so nothing leaked) but nothing restored it — `Current.tenant` was always nil inside a job. New `config.current_attributes` (`nil` = off; `:auto` = every `ActiveSupport::CurrentAttributes` subclass; an Array of classes/names; or a Hash of class => `{ only: [...] }` / `{ except: [...] }`). The new `Pgbus::ActiveJob::CurrentAttributes` mixin (included on `ActiveJob::Base` by the engine next to `BatchId`) captures the assigned attributes of each persisted class in `serialize` — serialized with `ActiveJob::Arguments`, so records become GlobalIDs and fall under the `allowed_global_id_models` allowlist on the way back — under the job-hash key `pgbus_current`, and restores them by wrapping the **whole** `perform_now` in nested `Current.set`, so `before_perform`, `perform`, `rescue_from`, `retry_on` / `discard_on` blocks and jobs enqueued from inside `perform` all see the context, under the pgbus worker and Rails' `:test` / `:inline` adapters alike. A deserialized job re-serializes the context it was enqueued with, so a `retry_on` re-enqueue keeps the original; concurrency-blocked promotion, dead-letter / dashboard retry and `perform_all_later` carry it by construction. An unserializable attribute raises `Pgbus::CurrentAttributesError` at `perform_later` naming the class, attribute and the `except:` fix — nothing is dropped silently; a class that no longer exists or an attribute no longer defined is skipped with a log line (Sidekiq parity). Per job class: `self.pgbus_persist_current_attributes = false` or a spec override. Unconfigured installs have byte-identical payloads. Dashboard: failed-job and dead-letter detail pages gain a **Context** card (`Pgbus::Web::JobContext`, through `PayloadFilter`). Event bus follows in #431. Refs #430.

data/README.md

@@ -674,7 +674,7 @@ end
 
 Events get the same hop: `Pgbus.publish` captures `Current` into the event envelope and the consumer restores it around every `handle` — including across the transactional outbox (captured at `Outbox.publish_event`, inside your transaction). Handlers can also read the raw form via `event.context`.
 
-Captured at enqueue via `ActiveJob::Arguments` (records become GlobalIDs, gated by `allowed_global_id_models`), preserved across retries, concurrency-blocked promotion, dead-letter retry and `perform_all_later`; an unserializable attribute raises at `perform_later` with the `except:` fix. The dashboard shows the context on failed-job and dead-letter pages. Details: [Active Job → Current attributes](https://pgbus.zoolutions.llc/docs/active-job).
+Captured at enqueue via `ActiveJob::Arguments` (records become GlobalIDs, gated by `allowed_global_id_models`), preserved across retries, concurrency-blocked promotion, dead-letter retry and `perform_all_later`; an unserializable attribute raises at `perform_later` with the `except:` fix, while an **unpersisted** record (no id — it could never be restored) is skipped with a debug log instead of aborting the enqueue. The dashboard shows the context on failed-job and dead-letter pages. Details: [Active Job → Current attributes](https://pgbus.zoolutions.llc/docs/active-job).
 
 ### Consumer priority
 

data/lib/pgbus/client.rb

@@ -1753,11 +1753,10 @@ module Pgbus
       timeout = config.read_timeout
       return mapping_statement_timeout(&block) unless timeout&.positive?
 
-      # rubocop:disable Pgbus/NoRubyTimeout -- deliberate last-resort bound; see above
+      # rubocop:disable-next Pgbus/NoRubyTimeout -- deliberate last-resort bound; see above
       Timeout.timeout(timeout + READ_TIMEOUT_SLACK, WedgedReadTimeout) do
         mapping_statement_timeout(&block)
       end
-      # rubocop:enable Pgbus/NoRubyTimeout
     rescue WedgedReadTimeout
       reload_pool_after_wedged_timeout
       raise

data/lib/pgbus/current_attributes.rb

@@ -8,8 +8,11 @@ module Pgbus
   # (config.current_attributes: :auto, an explicit list, or per-class
   # only:/except: filters) serialized through ActiveJob::Arguments — so
   # GlobalID models, Symbols, Times round-trip like job arguments and fall
-  # under the allowed_global_id_models allowlist on the way back. `restore`
-  # nests `klass.set(attrs)` for the duration of a block.
+  # under the allowed_global_id_models allowlist on the way back. An
+  # attribute holding an unpersisted record is skipped with a debug log
+  # (no id → no GlobalID → it could never be restored; see
+  # #reject_unpersisted). `restore` nests `klass.set(attrs)` for the
+  # duration of a block.
   #
   # The ActiveJob side (Pgbus::ActiveJob::CurrentAttributes) calls capture
   # from `serialize` and restore around `perform_now`, so the hop works under
@@ -34,7 +37,7 @@ module Pgbus
         captured = {}
         persisted_specs(config, override: override).each do |spec|
           klass = resolve_class(spec[:name]) or next
-          attrs = filter_attrs(klass.attributes, spec)
+          attrs = reject_unpersisted(klass, filter_attrs(klass.attributes, spec))
           next if attrs.empty?
 
           captured[klass.name] = serialize_attrs(klass, attrs)
@@ -126,6 +129,27 @@ module Pgbus
         attrs
       end
 
+      # An unpersisted record cannot round-trip by definition — no id, no
+      # GlobalID — and capture is ambient: the enqueuer never opted into
+      # persisting this attribute per-call, so its momentary state (a dev-mode
+      # fallback record, a form-built model assigned to Current before save,
+      # a destroyed record whose locate is guaranteed to fail) must not abort
+      # the enqueue. Skip it like an unassigned attribute. persisted? (not
+      # new_record?) so destroyed-but-id-bearing records are skipped too;
+      # objects without the Active Record duck-type pass through untouched
+      # and still hit serialize_attrs' loud CurrentAttributesError if bad.
+      def reject_unpersisted(klass, attrs)
+        attrs.reject do |name, value|
+          next false unless value.respond_to?(:persisted?) && !value.persisted?
+
+          Pgbus.logger.debug do
+            "[Pgbus] current_attributes: #{klass.name}##{name} holds an unpersisted #{value.class} — " \
+              "skipped (no id to serialize; it could never be restored)"
+          end
+          true
+        end
+      end
+
       def serialize_attrs(klass, attrs)
         ::ActiveJob::Arguments.serialize([attrs]).first
       rescue ::ActiveJob::SerializationError, URI::Error

data/lib/pgbus/execution_pools/async_pool.rb

@@ -95,7 +95,7 @@ module Pgbus
               "Add `gem \"async\"` to your Gemfile. Original error: #{e.message}"
       end
 
-      # rubocop:disable Lint/RescueException
+      # rubocop:disable-next Lint/RescueException
       def start_reactor
         Thread.new do
           Thread.current.name = "pgbus-async-reactor-#{object_id}"
@@ -122,7 +122,6 @@ module Pgbus
           raise
         end
       end
-      # rubocop:enable Lint/RescueException
 
       def wait_for_executions(semaphore)
         loop do

data/lib/pgbus/process/heartbeat.rb

@@ -18,6 +18,12 @@ module Pgbus
         @loop_tick_supplier = loop_tick_supplier
         @metadata_supplier = metadata_supplier
         @timer = nil
+        @stopped = false
+        # Guards @process_id between the timer thread (beat) and the main
+        # thread (stop): TimerTask#shutdown does not wait for an in-flight
+        # beat, and a beat that re-registers after deregister_process ran
+        # would leave a zombie row (issue #438).
+        @mutex = Mutex.new
       end
 
       def start
@@ -27,18 +33,19 @@ module Pgbus
       end
 
       def stop
+        @stopped = true
         @timer&.shutdown
-        deregister_process
+        @mutex.synchronize { deregister_process }
       end
 
       def beat
-        return unless @process_id
+        return unless @process_id && !@stopped
 
         @on_beat&.call
         updates = { last_heartbeat_at: Time.current }
         metadata = beat_metadata
         updates[:metadata] = metadata unless metadata.nil?
-        ProcessEntry.where(id: @process_id).update_all(updates)
+        @mutex.synchronize { write_beat(updates) }
       rescue StandardError => e
         Pgbus.logger.warn { "[Pgbus] Heartbeat failed: #{e.message}" }
       end
@@ -59,6 +66,25 @@ module Pgbus
         metadata
       end
 
+      # update_all by id matches 0 rows when the row was deleted underneath a
+      # live process (stale-process reaper after a heartbeat gap, manual
+      # cleanup, another host's clock skew). Nothing raises, so treat the
+      # count as the signal: re-register and log once so the cause of the
+      # deletion is discoverable, then land this beat's updates on the new
+      # row (issue #438). Skipped after stop so a beat racing deregistration
+      # cannot resurrect the row.
+      def write_beat(updates)
+        return if ProcessEntry.where(id: @process_id).update_all(updates).positive? || @stopped
+
+        old_id = @process_id
+        Pgbus.logger.warn do
+          "[Pgbus] Process row id=#{old_id} kind=#{@kind} pid=#{::Process.pid} is gone " \
+            "(stale-process reaper, manual cleanup, or clock skew?) — re-registering"
+        end
+        register_process
+        ProcessEntry.where(id: @process_id).update_all(updates) if @process_id != old_id
+      end
+
       def register_process
         record = ProcessEntry.create!(
           kind: @kind,

data/lib/pgbus/process/notify_listener.rb

@@ -143,13 +143,21 @@ module Pgbus
         @state_mutex.synchronize { @running }
       end
 
-      # Called ONLY inside a just-forked child (issue #381 hub hygiene): drop
-      # this process's copy of the LISTEN socket fd WITHOUT PQfinish — #close
+      # Called ONLY inside a just-forked child (issues #381 / #437): release
+      # this process's copy of the LISTEN socket WITHOUT PQfinish — #close
       # would send a libpq Terminate over the socket shared with the parent,
-      # killing the parent's LISTEN session. Closing the IO wrapper just
-      # closes the child's fd. The listener thread does not exist in the
-      # child (fork copies only the calling thread), so there is no
-      # concurrent owner and the single-owner rule (#375) does not apply.
+      # killing the parent's LISTEN session.
+      #
+      # Closing the IO wrapper is not enough: pg builds socket_io with
+      # autoclose=false, so IO#close leaves the fd open, and when GC frees the
+      # inherited PG::Connection its PQfinish still writes Terminate on that
+      # fd — i.e. on the PARENT's connection (issue #437, one reconnect per
+      # fork). Repointing the fd at /dev/null (IO#reopen, the ActiveRecord
+      # PostgreSQLAdapter#discard! idiom) makes the eventual PQfinish harmless.
+      #
+      # The listener thread does not exist in the child (fork copies only the
+      # calling thread), so there is no concurrent owner and the single-owner
+      # rule (#375) does not apply.
       def close_inherited_socket!
         conn = @state_mutex.synchronize do
           c = @conn
@@ -157,10 +165,11 @@ module Pgbus
           @running = false
           c
         end
-        conn&.socket_io&.close
+        conn&.socket_io&.reopen(IO::NULL)
       rescue StandardError => e
-        # Best-effort (a lingering fd copy is benign until the parent dies),
-        # but never silent: the child keeps booting either way.
+        # Best-effort but never silent: the child keeps booting either way.
+        # If this fails the child's GC-time PQfinish will hit the parent's
+        # session, which the parent's reconnect! survives.
         @logger.warn do
           "[Pgbus::NotifyListener] inherited socket cleanup failed: #{e.class}: #{e.message}"
         end

data/lib/pgbus/process/supervisor.rb

@@ -613,9 +613,7 @@ module Pgbus
           if @shutting_down
             Pgbus.logger.info { "[Pgbus] Child #{info[:type]} pid=#{pid} exited (status=#{status.exitstatus})" }
           else
-            Pgbus.logger.warn do
-              "[Pgbus] Child #{info[:type]} pid=#{pid} exited unexpectedly (status=#{status&.exitstatus})"
-            end
+            log_child_exit(info, pid, status)
             schedule_restart(info, status)
           end
         rescue Errno::ECHILD
@@ -623,6 +621,27 @@ module Pgbus
         end
       end
 
+      # A clean exit outside shutdown is a worker/consumer recycle (max_jobs,
+      # max_memory, max_lifetime) — expected, so INFO. Anything else is a
+      # crash: WARN, naming the signal when there is one so an OOM SIGKILL
+      # reads differently from an exit code (issue #438).
+      def log_child_exit(info, pid, status)
+        if status&.success?
+          Pgbus.logger.info do
+            "[Pgbus] Child #{info[:type]} pid=#{pid} exited cleanly (status=0) — restarting (worker recycle)"
+          end
+        else
+          Pgbus.logger.warn do
+            detail = if status && status.exitstatus.nil? && status.signaled?
+                       "signal=#{status.termsig}"
+                     else
+                       "status=#{status&.exitstatus}"
+                     end
+            "[Pgbus] Child #{info[:type]} pid=#{pid} exited unexpectedly (#{detail})"
+          end
+        end
+      end
+
       # Restart policy: a clean exit (worker recycling) or a crash after a
       # stable run restarts immediately with a fresh crash streak. A crash
       # within RESTART_STABLE_UPTIME of forking is a crash loop — the child

data/lib/pgbus/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Pgbus
-  VERSION = "0.15.0"
+  VERSION = "0.15.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pgbus
 version: !ruby/object:Gem::Version
-  version: 0.15.0
+  version: 0.15.2
 platform: ruby
 authors:
 - Mikael Henriksson
@@ -424,13 +424,13 @@ files:
 - lib/tasks/pgbus_pgmq.rake
 - lib/tasks/pgbus_queues.rake
 - lib/tasks/pgbus_streams.rake
-homepage: https://github.com/mhenrixon/pgbus
+homepage: https://github.com/zoolutions/pgbus
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/mhenrixon/pgbus
-  source_code_uri: https://github.com/mhenrixon/pgbus/tree/main
-  changelog_uri: https://github.com/mhenrixon/pgbus/blob/main/CHANGELOG.md
+  homepage_uri: https://github.com/zoolutions/pgbus
+  source_code_uri: https://github.com/zoolutions/pgbus/tree/main
+  changelog_uri: https://github.com/zoolutions/pgbus/blob/main/CHANGELOG.md
   documentation_uri: https://pgbus.zoolutions.llc
   rubygems_mfa_required: 'true'
 rdoc_options: []