pgbus 0.18.2 → 0.19.0

data/lib/pgbus/metrics/subscriber.rb

@@ -17,15 +17,45 @@ module Pgbus
       METRIC_PREFIX = "pgbus_"
       private_constant :METRIC_PREFIX
 
-      @subscriptions = []
+      # Installed once at boot (the engine's after_initialize) and torn down by
+      # reset! in specs; @install_lock makes the check-then-install atomic so
+      # two callers can never subscribe twice (issue #527). Handlers read
+      # @backend through the private reader: a reference swapped whole.
+      @install_lock = Mutex.new
+      @subscriptions = [].freeze
       @backend = nil
+      @installed = false
 
       class << self
         def install!(backend:)
-          return false if @installed
+          @install_lock.synchronize do
+            next false if @installed
 
-          @backend = backend
-          @subscriptions = [
+            @backend = backend
+            @subscriptions = subscribe_all
+            @installed = true
+          end
+        end
+
+        def installed?
+          @install_lock.synchronize { @installed }
+        end
+
+        def reset!
+          @install_lock.synchronize do
+            @subscriptions.each { |s| ActiveSupport::Notifications.unsubscribe(s) }
+            @subscriptions = [].freeze
+            @backend = nil
+            @installed = false
+          end
+        end
+
+        private
+
+        attr_reader :backend
+
+        def subscribe_all
+          [
             subscribe("pgbus.executor.execute") { |event| on_executor_execute(event) },
             subscribe("pgbus.job_completed") { |event| on_job_completed(event) },
             subscribe("pgbus.job_failed") { |event| on_job_failed(event) },
@@ -43,25 +73,9 @@ module Pgbus
             subscribe("pgbus.worker.recycle") { |event| on_worker_recycle(event) },
             subscribe("pgbus.consumer.recycle") { |event| on_consumer_recycle(event) },
             subscribe("pgbus.client.pool") { |event| on_client_pool(event) }
-          ]
-          @installed = true
-        end
-
-        def installed?
-          @installed == true
-        end
-
-        def reset!
-          @subscriptions&.each { |s| ActiveSupport::Notifications.unsubscribe(s) }
-          @subscriptions = []
-          @backend = nil
-          @installed = false
+          ].freeze
         end
 
-        private
-
-        attr_reader :backend
-
         def subscribe(name, &block)
           ActiveSupport::Notifications.subscribe(name) do |*args|
             event = ActiveSupport::Notifications::Event.new(*args)

data/lib/pgbus/process/consumer.rb

@@ -170,7 +170,7 @@ module Pgbus
       def immediate_shutdown
         @shutting_down = true
         @wake_signal.notify!
-        @pool.kill
+        ExecutionPools.terminate(@pool, grace: config.immediate_shutdown_grace)
       end
 
       private

data/lib/pgbus/process/consumer_priority.rb

@@ -17,8 +17,8 @@ module Pgbus
       # 0.1s polling interval.
       CACHE_TTL = 5
 
-      @cache = {}
       @cache_mutex = Mutex.new
+      @cache = {} # rubocop:disable ThreadSafety/MutableClassInstanceVariable -- only read or written under @cache_mutex
 
       # Check if this worker should yield to a higher-priority worker.
       # Returns true if a higher-priority healthy worker exists for

data/lib/pgbus/process/lifecycle.rb

@@ -22,11 +22,11 @@ module Pgbus
       STATES = %i[starting running paused draining stopped].freeze
 
       TRANSITIONS = {
-        starting: %i[running stopped],
-        running: %i[paused draining stopped],
-        paused: %i[running draining stopped],
-        draining: %i[stopped],
-        stopped: []
+        starting: %i[running stopped].freeze,
+        running: %i[paused draining stopped].freeze,
+        paused: %i[running draining stopped].freeze,
+        draining: %i[stopped].freeze,
+        stopped: [].freeze
       }.freeze
 
       attr_reader :state

data/lib/pgbus/process/notify_listener.rb

@@ -64,6 +64,9 @@ module Pgbus
         @health_check_ms = health_check_ms
         @logger = logger
         @state_mutex = Mutex.new
+        # Serializes #start and #stop whole (see #start). Never taken by the
+        # listener thread, so #stop can join it while holding this.
+        @lifecycle_mutex = Mutex.new
         @listening_to = Set.new
         @commands = Queue.new
         @running = false
@@ -98,33 +101,44 @@ module Pgbus
         @state_mutex.synchronize { @delivering }
       end
 
+      # Under @lifecycle_mutex, like #stop: a stop that ran between the
+      # @running check and Thread.new found no thread to join, and the thread
+      # started after it was joined by nobody (and a restart could run a
+      # second run_loop beside it).
       def start
-        @state_mutex.synchronize do
-          return self if @running
+        @lifecycle_mutex.synchronize do
+          @state_mutex.synchronize do
+            return self if @running
 
-          @running = true
+            @running = true
+          end
+          @physical_queues.each { |q| @commands << [:listen, q] }
+          # The listener's one thread, owned by this object: started once (the
+          # @running check above, with #start and #stop serialized), the sole
+          # owner of @conn, and joined by #stop after it clears @running.
+          @thread = Thread.new { run_loop } # rubocop:disable ThreadSafety/NewThread
         end
-        @physical_queues.each { |q| @commands << [:listen, q] }
-        @thread = Thread.new { run_loop }
         self
       end
 
       def stop
-        @state_mutex.synchronize do
-          return self unless @running
+        @lifecycle_mutex.synchronize do
+          @state_mutex.synchronize do
+            return self unless @running
 
-          @running = false
+            @running = false
+          end
+          @commands << [:stop]
+          # Deliberately does NOT touch @conn. PG::Connection is not thread-safe
+          # and #close is PQfinish: it frees the PGconn and its OpenSSL objects
+          # out from under whatever libpq call the listener thread is making on
+          # the same connection. That is a use-after-free — a process-killing
+          # SEGV, not a rescuable PG::Error (issue #375). The listener thread is
+          # the sole owner of @conn for its entire life and closes it in
+          # run_loop's ensure; clearing @running above is the whole stop signal.
+          @thread&.join(stop_join_timeout)
+          @thread = nil
         end
-        @commands << [:stop]
-        # Deliberately does NOT touch @conn. PG::Connection is not thread-safe
-        # and #close is PQfinish: it frees the PGconn and its OpenSSL objects
-        # out from under whatever libpq call the listener thread is making on
-        # the same connection. That is a use-after-free — a process-killing
-        # SEGV, not a rescuable PG::Error (issue #375). The listener thread is
-        # the sole owner of @conn for its entire life and closes it in
-        # run_loop's ensure; clearing @running above is the whole stop signal.
-        @thread&.join(stop_join_timeout)
-        @thread = nil
         self
       end
 

data/lib/pgbus/process/wake_pipe.rb

@@ -53,7 +53,10 @@ module Pgbus
 
           @running = true
         end
-        @thread = Thread.new { run_loop }
+        # The pipe watcher's one thread, owned by this object: started once
+        # (the @running check above, under @state_mutex) and stopped by #stop,
+        # which closes the pipe under it and joins it.
+        @thread = Thread.new { run_loop } # rubocop:disable ThreadSafety/NewThread
         self
       end
 

data/lib/pgbus/process/worker.rb

@@ -37,7 +37,9 @@ module Pgbus
                      notify_retry_backoff: NOTIFY_RETRY_BASE_SECONDS,
                      started_at_monotonic: nil, wake_pipe: nil, read_ahead: nil,
                      recycle_limits: {}, capsule: nil, process: nil)
-        @queues = Array(queues)
+        # The worker's own list: eviction deletes from it, and the queues it is
+        # handed come from a configuration frozen by Pgbus.finalize! at boot.
+        @queues = Array(queues).dup
         @initial_queues = @queues.dup.freeze
         @wildcard = @queues.include?("*")
         @threads = threads
@@ -237,7 +239,7 @@ module Pgbus
         Pgbus.stopping = true
         @lifecycle.transition_to!(:stopped)
         @wake_signal.notify!
-        @pool.kill
+        ExecutionPools.terminate(@pool, grace: config.immediate_shutdown_grace)
       end
 
       WILDCARD_REFRESH_INTERVAL = 30 # seconds

data/lib/pgbus/retry_backoff.rb

@@ -20,6 +20,9 @@ module Pgbus
     module JobMixin
       extend ActiveSupport::Concern
 
+      # Class-body macro: it runs while the job class loads (at boot, or under the
+      # autoloader's lock), stores a frozen Hash, and the reader only reads it.
+      # rubocop:disable-next ThreadSafety/ClassInstanceVariable
       class_methods do
         def pgbus_retry_backoff(base: nil, max: nil, jitter: nil)
           raise ArgumentError, "retry_backoff base must be > 0" if !base.nil? && (!base.is_a?(Numeric) || base <= 0)

data/lib/pgbus/shareable.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module Pgbus
+  # Deep-frozen, Ractor-shareable copies of plain data, for the settings
+  # Configuration#finalize! freezes at boot (issue #527).
+  module Shareable
+    # Leaves that are plain data. Modules and classes count too: they are
+    # shareable by nature.
+    LEAVES = [String, Symbol, Numeric, TrueClass, FalseClass, NilClass, Regexp, Module].freeze
+
+    module_function
+
+    # True when +value+ is plain data all the way down: the LEAVES, and Arrays,
+    # Sets, Ranges and default-less Hashes of them. A Proc, a Logger or any
+    # other object anywhere inside makes it false, and so does a collection
+    # that contains itself (+path+ holds the collections being walked), so
+    # finalizing leaves it as it is instead of recursing without end.
+    def data?(value, path = {}.compare_by_identity)
+      case value
+      when Array, Set, Hash, Range
+        return false if path.key?(value)
+
+        path[value] = true
+        begin
+          collection_data?(value, path)
+        ensure
+          path.delete(value)
+        end
+      else LEAVES.any? { |leaf| value.is_a?(leaf) }
+      end
+    end
+
+    def collection_data?(value, path)
+      case value
+      when Array, Set then value.all? { |item| data?(item, path) }
+      when Hash
+        value.default_proc.nil? && data?(value.default, path) && value.all? { |k, v| data?(k, path) && data?(v, path) }
+      else data?(value.begin, path) && data?(value.end, path)
+      end
+    end
+
+    # A deep-frozen copy of plain data (see data?), Ractor-shareable where the
+    # engine has Ractors. The caller's own objects are copied, never frozen in
+    # place.
+    def freeze_copy(value)
+      return ::Ractor.make_shareable(value, copy: true) if defined?(::Ractor) && ::Ractor.respond_to?(:make_shareable)
+
+      deep_freeze(value)
+    end
+
+    # The copy freeze_copy makes where the engine has no Ractor: everything
+    # data? accepts, a Hash's default and a Range's endpoints included.
+    def deep_freeze(value)
+      case value
+      when Array then value.map { |item| deep_freeze(item) }.freeze
+      when Set then value.to_set { |item| deep_freeze(item) }.freeze
+      when Hash then deep_freeze_hash(value)
+      when Range then Range.new(deep_freeze(value.begin), deep_freeze(value.end), value.exclude_end?).freeze
+      when String then value.frozen? ? value : value.dup.freeze
+      else value
+      end
+    end
+
+    def deep_freeze_hash(hash)
+      copy = hash.to_h { |k, v| [deep_freeze(k), deep_freeze(v)] }
+      copy.default = deep_freeze(hash.default)
+      copy.freeze
+    end
+  end
+end

data/lib/pgbus/streams/broadcastable_override.rb

@@ -56,6 +56,9 @@ module Pgbus
         end
       end
 
+      # broadcasts_to / broadcasts_refreshes_to are class-body macros: they write
+      # @pgbus_durable_streams while the model class loads, and it is only read after.
+      # rubocop:disable-next ThreadSafety/ClassInstanceVariable
       module ClassMethods
         def broadcasts_to(stream, durable: nil, inserts_by: :append, target: broadcast_target_default, **rendering)
           if durable.nil?

data/lib/pgbus/streams/presence.rb

@@ -77,11 +77,13 @@ module Pgbus
         # True when pgbus_presence_members has the seat columns (the
         # add_presence_seats migration ran). A true answer is kept for the
         # life of the process; a false one for SCHEMA_RECHECK_SECONDS.
+        #
+        # The answer is read and written under @schema_mutex only (issue
+        # #527). A successful probe is kept as above; a probe that raises is
+        # not, so the next call probes again.
         def seats_supported?
-          return @seats_supported if schema_answer_fresh?
-
           @schema_mutex.synchronize do
-            next @seats_supported if schema_answer_fresh?
+            next @seats_supported if schema_answer_fresh?(@seats_supported, @probed_at)
 
             rows = connection.exec_params(<<~SQL, [])
               SELECT 1 AS present FROM information_schema.columns
@@ -169,10 +171,7 @@ module Pgbus
 
         private
 
-        # Reads each ivar once: a concurrent reset_schema_cache! may nil them.
-        def schema_answer_fresh?
-          supported = @seats_supported
-          probed_at = @probed_at
+        def schema_answer_fresh?(supported, probed_at)
           return false if supported.nil? || probed_at.nil?
 
           supported || monotonic_now - probed_at < SCHEMA_RECHECK_SECONDS

data/lib/pgbus/streams.rb

@@ -33,38 +33,49 @@ module Pgbus
     # `message`. Broadcasts may override it with a typed name (issue #170).
     DEFAULT_SSE_EVENT = "turbo-stream"
 
-    # Process-wide registry of server-side audience filter predicates.
-    # Register filters at boot time via:
-    #   Pgbus::Streams.filters.register(:admin_only) { |user| user.admin? }
-    # See lib/pgbus/streams/filters.rb for the full API.
-    def self.filters
-      @filters ||= Filters.new
-    end
+    class << self
+      # Process-wide registry of server-side audience filter predicates.
+      # Register filters at boot time via:
+      #   Pgbus::Streams.filters.register(:admin_only) { |user| user.admin? }
+      # See lib/pgbus/streams/filters.rb for the full API.
+      #
+      # Process-wide publish-side coalescer for high-frequency broadcasts
+      # (issue #171); the flush re-enters the normal broadcast path so a
+      # coalesced frame is just a deferred ordinary broadcast.
+      #
+      # Both are built when this file loads, not by `||=` on first use: two
+      # first callers could each build a registry, and a filter registered on
+      # the one that lost was gone (issue #527). Replaced only by the resets.
+      attr_reader :filters, :coalescer
+
+      # Fresh filters registry. Used by tests; not intended for runtime.
+      def reset_filters!
+        @reset_lock.synchronize { @filters = Filters.new }
+      end
 
-    # Clears the filters registry. Used by tests; not intended for runtime.
-    def self.reset_filters!
-      @filters = nil
-    end
+      # Fresh coalescer. Used by tests; not intended for runtime.
+      def reset_coalescer!
+        @reset_lock.synchronize { @coalescer = build_coalescer }
+      end
 
-    # Process-wide publish-side coalescer for high-frequency broadcasts
-    # (issue #171). Lazily built; the flush re-enters the normal broadcast
-    # path so a coalesced frame is just a deferred ordinary broadcast.
-    def self.coalescer
-      # `target:` is part of the flush signature but unused here — it's only
-      # a coalescing key; the target is already encoded in the payload's
-      # turbo-stream tag. Absorbed via ** so it isn't a broadcast argument.
-      @coalescer ||= Coalescer.new(
-        flush: lambda do |stream_name:, payload:, opts:, **|
-          Pgbus.stream(stream_name).broadcast(payload, **opts)
-        end
-      )
-    end
+      private
 
-    # Clears the coalescer. Used by tests; not intended for runtime.
-    def self.reset_coalescer!
-      @coalescer = nil
+      def build_coalescer
+        # `target:` is part of the flush signature but unused here — it's only
+        # a coalescing key; the target is already encoded in the payload's
+        # turbo-stream tag. Absorbed via ** so it isn't a broadcast argument.
+        Coalescer.new(
+          flush: lambda do |stream_name:, payload:, opts:, **|
+            Pgbus.stream(stream_name).broadcast(payload, **opts)
+          end
+        )
+      end
     end
 
+    @reset_lock = Mutex.new
+    @filters = Filters.new
+    @coalescer = build_coalescer
+
     # A handle on a single logical stream. The name can be any string, an
     # object responding to `to_gid_param`, or an array of streamables (which
     # are joined with colons — turbo-rails-compatible).

data/lib/pgbus/testing.rb

@@ -71,6 +71,15 @@ module Pgbus
     # Eagerly initialize the store so concurrent access never races on creation.
     @store = EventStore.new
 
+    # The process-wide mode (`fake!` with no block). A module ivar under a lock
+    # built at load, not `Thread.main[]`: that reads the main thread's CURRENT
+    # fiber only, so a mode set inside a fiber (an Async task) or read while the
+    # main thread runs one was lost (issue #527). The block form stays
+    # `Thread.current[MODE_KEY]`, which is fiber-local on every Ruby: a `fake!`
+    # block inside one Async task must not leak to its siblings.
+    @mode_lock = Mutex.new
+    @default_mode = nil
+
     class << self
       def mode!(mode, &block)
         raise ArgumentError, "Unknown mode: #{mode}. Valid modes: #{MODES.join(", ")}" unless MODES.include?(mode)
@@ -78,7 +87,7 @@ module Pgbus
         # Record the mode BEFORE syncing streams: a StreamerLeakError raised
         # by the teardown must still leave the process in the requested mode.
         unless block
-          Thread.main[MODE_KEY] = mode
+          @mode_lock.synchronize { @default_mode = mode }
           sync_streams_test_mode!(mode)
           return
         end
@@ -90,12 +99,15 @@ module Pgbus
       ensure
         if block
           Thread.current[MODE_KEY] = old
-          sync_streams_test_mode!(old || :disabled)
+          # The mode in effect again: the outer block's, else the
+          # process-wide one (not :disabled, which would let the streamer
+          # into a fake-mode test's later SSE requests).
+          sync_streams_test_mode!(old || default_mode)
         end
       end
 
       def mode
-        Thread.current[MODE_KEY] || Thread.main[MODE_KEY] || :disabled
+        Thread.current[MODE_KEY] || default_mode
       end
 
       def fake!(&) = mode!(:fake, &)
@@ -110,6 +122,10 @@ module Pgbus
 
       private
 
+      def default_mode
+        @mode_lock.synchronize { @default_mode } || :disabled
+      end
+
       # When entering fake/inline mode, enable streams_test_mode to prevent
       # rack.hijack from spawning background threads that acquire DB
       # connections outside the test transaction (see issue #133). When

data/lib/pgbus/uniqueness.rb

@@ -52,6 +52,9 @@ module Pgbus
     VALID_STRATEGIES = %i[until_executed while_executing].freeze
     VALID_CONFLICTS = %i[reject discard log].freeze
 
+    # Class-body macro: it runs while the job class loads (at boot, or under the
+    # autoloader's lock), stores a frozen Hash, and the reader only reads it.
+    # rubocop:disable-next ThreadSafety/ClassInstanceVariable
     class_methods do
       def ensures_uniqueness(strategy: :until_executed, key: nil, on_conflict: :reject, **opts)
         # lock_ttl was validated and stored in message metadata but never read

data/lib/pgbus/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Pgbus
-  VERSION = "0.18.2"
+  VERSION = "0.19.0"
 end

data/lib/pgbus/visibility_heartbeat.rb

@@ -45,7 +45,9 @@ module Pgbus
       extend ActiveSupport::Concern
 
       included do
-        class_attribute :pgbus_visibility_heartbeat_enabled, instance_writer: false, default: nil
+        # A per-class setting the job's own class body writes at load
+        # (`pgbus_visibility_heartbeat false`); jobs only read it while they run.
+        class_attribute :pgbus_visibility_heartbeat_enabled, instance_writer: false, default: nil # rubocop:disable ThreadSafety/ClassAndModuleAttributes
       end
 
       class_methods do
@@ -55,6 +57,14 @@ module Pgbus
       end
     end
 
+    # Built at load, never lazily: a `@mutex ||= Mutex.new` is itself a race in
+    # which two first callers each lock a Mutex of their own (issue #527). It
+    # guards @entries, @running, @thread and @pid, which are only touched inside
+    # #synchronize. A forked child can take it even when a parent thread held it
+    # at the fork: Ruby abandons a Mutex whose owner did not survive the fork.
+    @mutex = Mutex.new
+    @entries = {} # rubocop:disable ThreadSafety/MutableClassInstanceVariable -- only read or written inside #synchronize
+
     class << self
       # Track the message for the duration of the block.
       #
@@ -106,13 +116,13 @@ module Pgbus
       # can drive it.
       def tick!(now: monotonic_now, config: Pgbus.configuration)
         interval = config.effective_visibility_heartbeat_interval
-        due = synchronize { entries.values.select { |entry| now - entry.extended_at >= interval } }
+        due = synchronize { @entries.values.select { |entry| now - entry.extended_at >= interval } }
         due.each { |entry| extend!(entry, now: now, config: config) }
         due.size
       end
 
       def tracked_count
-        synchronize { entries.size }
+        synchronize { @entries.size }
       end
 
       # Stop the background thread. Tracked entries are kept: a job still
@@ -141,9 +151,20 @@ module Pgbus
 
       def register(entry, config)
         synchronize do
-          forget_parent_entries!
-          entries[key_for(entry)] = entry
-          ensure_thread(config)
+          # Entries registered before a fork belong to the parent's jobs; the
+          # thread did not survive the fork either.
+          unless @pid == ::Process.pid
+            @pid = ::Process.pid
+            @entries = {}
+            @running = false
+            @thread = nil
+          end
+          @entries[key_for(entry)] = entry
+          # Start the ticker once per process.
+          unless @running && @thread&.alive?
+            @running = true
+            @thread = start_ticker(config)
+          end
         end
       end
 
@@ -153,7 +174,7 @@ module Pgbus
       def unregister(entry)
         synchronize do
           key = key_for(entry)
-          entries.delete(key) if entries[key].equal?(entry)
+          @entries.delete(key) if @entries[key].equal?(entry)
         end
       end
 
@@ -186,31 +207,38 @@ module Pgbus
         end
       end
 
-      # Caller holds the mutex. Start the ticker once per process.
-      def ensure_thread(config)
-        return if @running && @thread&.alive?
+      # One ticker per process, owned by this module: #register starts it under
+      # the lock (at most one live thread, see @running/@thread) and #stop
+      # clears @running, wakes it and joins it; Worker#shutdown calls #stop.
+      def start_ticker(config)
+        thread = Thread.new { run_loop(config) } # rubocop:disable ThreadSafety/NewThread
+        thread.name = "pgbus-visibility-heartbeat"
+        thread
+      end
 
-        @running = true
-        @thread = Thread.new { run_loop(config) }
-        @thread.name = "pgbus-visibility-heartbeat"
+      # True while the calling thread is the ticker #register started last
+      # and #stop has not stopped it. A stopped ticker can wake after a
+      # #register has already started its successor; @running alone would be
+      # true again for it, and it would tick beside the new one.
+      def current_ticker?
+        synchronize { @running && @thread.equal?(Thread.current) }
       end
 
       def run_loop(config)
-        while @running
+        while current_ticker?
           # Half the interval keeps every extension inside [interval, 1.5 * interval]
           # of the previous one — at most half the visibility timeout.
           sleep([config.effective_visibility_heartbeat_interval / 2.0, 0.05].max)
-          break unless @running
+          break unless current_ticker?
 
           tick!(config: config)
         end
       rescue StandardError => e
         Pgbus.logger.error { "[Pgbus::VisibilityHeartbeat] ticker died: #{e.class}: #{e.message}" }
-        synchronize { @running = false }
+        # Only its own state: a stopped ticker must not stop its successor.
+        synchronize { @running = false if @thread.equal?(Thread.current) }
       end
 
-      # Entries registered before a fork belong to the parent's jobs; the
-      # thread did not survive the fork either.
       # A live holder keeps its semaphore from being swept, so `duration`
       # bounds heartbeat silence rather than run time. Its own rescue: a
       # failed touch must not cost the message its visibility extension.
@@ -236,29 +264,18 @@ module Pgbus
         end
       end
 
-      def forget_parent_entries!
-        return if @pid == ::Process.pid
-
-        @pid = ::Process.pid
-        @entries = {}
-        @running = false
-        @thread = nil
-      end
-
-      def entries
-        @entries ||= {}
-      end
-
       def registered?(entry)
-        synchronize { entries[key_for(entry)].equal?(entry) }
+        synchronize { @entries[key_for(entry)].equal?(entry) }
       end
 
       def key_for(entry)
         [entry.queue_name, entry.msg_id]
       end
 
-      def synchronize(&)
-        (@mutex ||= Mutex.new).synchronize(&)
+      # A literal block, not `(&)`: ThreadSafety/ClassInstanceVariable accepts
+      # @mutex as the receiver of a synchronize block only.
+      def synchronize
+        @mutex.synchronize { yield } # rubocop:disable Style/ExplicitBlockArgument
       end
 
       def monotonic_now