quonfig 1.2.0 → 1.4.0

data/lib/quonfig/config_loader.rb

@@ -31,6 +31,12 @@ module Quonfig
     #                     SSE does not change it).
     attr_reader :held_generation, :install_count
 
+    # Repoint the failover-telemetry sink. The one caller is
+    # Client#after_fork_in_child: a forked child gets fresh aggregators (the
+    # parent still owns and flushes its own), and the loader has to record
+    # into the child's copy rather than the inherited one (qfg-lv4n.1).
+    attr_writer :failover_aggregator
+
     # +store+: the Quonfig::ConfigStore to populate on successful fetch.
     # +options+: a Quonfig::Options instance (supplies sdk_key + config_api_urls).
     # +logger+: optional logger override (defaults to module LOG).

data/lib/quonfig/options.rb

@@ -140,10 +140,21 @@ module Quonfig
 
     # In datadir mode the SDK evaluates config from a local workspace and does
     # not connect to the delivery service.
+    #
+    # NOTE: this says nothing about telemetry. Datadir mode is a config-DELIVERY
+    # mode; usage telemetry still flows whenever an SDK key is configured. See
+    # #telemetry_allowed?.
     def local_only?
       !@datadir.nil?
     end
 
+    # True when an SDK key is configured. The SDK key is what identifies the
+    # workspace telemetry is attributed to, so it is the single gate on whether
+    # any collection happens at all (qfg-j001 / qfg-5x9x).
+    def sdk_key?
+      !(@sdk_key.nil? || @sdk_key.to_s.empty?)
+    end
+
     def datadir?
       !@datadir.nil?
     end
@@ -202,6 +213,13 @@ module Quonfig
     #     Debounce window in milliseconds. Filesystem events arriving
     #     inside the window are coalesced into a single re-read. Ignored
     #     when +:data_dir_auto_reload+ is +false+.
+    #   @option options [Boolean] :allow_telemetry_in_local_mode (false)
+    #     @deprecated No-op since 1.3.0 (qfg-5x9x). Telemetry is gated on SDK-key
+    #       presence alone, so datadir mode no longer suppresses it and this flag
+    #       has nothing left to unlock. Still accepted so existing callers keep
+    #       working; slated for removal in 2.0.0. To turn telemetry off, use the
+    #       standard opt-outs (+:collect_evaluation_summaries+ +false+,
+    #       +:context_upload_mode+ +:none+).
     def init(
       api_urls: nil,
       telemetry_url: nil,
@@ -226,6 +244,7 @@ module Quonfig
       context_max_size: DEFAULT_MAX_EVAL_SUMMARIES,
       collect_evaluation_summaries: true,
       collect_max_evaluation_summaries: DEFAULT_MAX_EVAL_SUMMARIES,
+      # Deprecated no-op since 1.3.0 (qfg-5x9x) — see the @option doc above.
       allow_telemetry_in_local_mode: false,
       global_context: {},
       logger_key: nil,
@@ -287,6 +306,7 @@ module Quonfig
       @collect_sync_interval = collect_sync_interval
       @collect_evaluation_summaries = collect_evaluation_summaries
       @collect_max_evaluation_summaries = collect_max_evaluation_summaries
+      # Retained for back-compat only; nothing reads it (qfg-5x9x).
       @allow_telemetry_in_local_mode = allow_telemetry_in_local_mode
       @is_fork = false
       @global_context = global_context
@@ -342,8 +362,21 @@ module Quonfig
       end
     end
 
+    # The telemetry gate: an explicit per-collector opt-out (+option+) AND the
+    # presence of an SDK key. Mode is deliberately NOT part of this decision.
+    #
+    # qfg-5x9x: this used to read
+    #   `option && (!local_only? || @allow_telemetry_in_local_mode)`
+    # which zeroed every collect_max_* the moment a datadir was set, so a
+    # datadir client holding a perfectly valid SDK key built no aggregators and
+    # therefore never constructed a reporter — it emitted nothing at all.
+    # Datadir + SDK key is a supported combination and telemetry has to flow
+    # there like it does in delivery mode. Conversely a keyless client (the
+    # open-source / no-account path) has no workspace to attribute data to, so
+    # nothing is collected and the reporter never starts. Mirrors sdk-node's
+    # `isTelemetryEnabled` and sdk-go's `Options.TelemetryEnabled()`.
     def telemetry_allowed?(option)
-      option && (!local_only? || @allow_telemetry_in_local_mode)
+      option && sdk_key?
     end
 
     def remove_trailing_slash(url)

data/lib/quonfig/sse_config_client.rb

@@ -129,6 +129,15 @@ module Quonfig
       @worker = Thread.new { run_loop(&on_envelope) }
     end
 
+    # True while the worker thread that owns the stream (and its reconnect
+    # loop) is running. Stays true across a reconnect — the worker owns the
+    # retry, so a blip is not "no channel". Used by Client#connection_state
+    # so that diagnostic derives from liveness rather than a stored flag
+    # (qfg-lv4n.1).
+    def alive?
+      @worker&.alive? || false
+    end
+
     # Shut down. Interrupts the in-flight stream by closing the underlying
     # socket from this thread — the worker thread observes the resulting
     # IOError, sees @stopped == true, and exits cleanly.

data/lib/quonfig/telemetry/telemetry_reporter.rb

@@ -51,6 +51,9 @@ module Quonfig
         @stopped = Concurrent::AtomicBoolean.new(false)
         @thread = nil
         @at_exit_registered = false
+        # Set on #start. Everything that can EMIT is gated on it so a forked
+        # child never speaks for the process that created this reporter.
+        @owner_pid = nil
       end
 
       def enabled?
@@ -80,6 +83,11 @@ module Quonfig
         return if @thread&.alive?
         return unless enabled?
 
+        # Claim ownership for THIS process. fork(2) copies the reporter, its
+        # aggregators, and the process-wide at_exit closure registered below;
+        # the pid recorded here is what lets the copy know it is not the
+        # owner and must stay silent (qfg-lv4n.1, dd-trace-rb's pattern).
+        @owner_pid = Process.pid
         @stopped.make_false
         register_at_exit_handler
         @thread = Thread.new do
@@ -106,6 +114,8 @@ module Quonfig
       end
 
       def stop
+        return if foreign_process?('stop')
+
         @stopped.make_true
         thread = @thread
         @thread = nil
@@ -121,7 +131,13 @@ module Quonfig
 
       # Drain all aggregators and POST the batch. Public so tests can
       # trigger a sync without waiting for the background loop.
+      #
+      # Silent in any process other than the one that started the reporter:
+      # after a fork the child holds a full copy of the PARENT's un-flushed
+      # window, and the parent is still going to flush it itself.
       def sync
+        return if foreign_process?('sync')
+
         events = []
         if (summaries_event = @evaluation_summaries_aggregator&.drain_event)
           events << summaries_event
@@ -151,8 +167,41 @@ module Quonfig
         @at_exit_registered
       end
 
+      # Pid of the process that started this reporter, or nil if it was never
+      # started. Visible for tests / diagnostics.
+      attr_reader :owner_pid
+
+      # Called on the INHERITED reporter in a forked child, from
+      # +Quonfig::Client#after_fork_in_child+, once the child has dropped its
+      # reference to it. Makes the copied window unreachable so nothing can
+      # ever emit it — belt to the +@owner_pid+ braces.
+      #
+      # Deliberately does NOT stop, close, or join anything: the thread does
+      # not exist in the child, and the HTTP connection's fd is shared with
+      # the parent.
+      def discard_inherited!
+        @stopped.make_true
+        @thread = nil
+        @context_shape_aggregator = nil
+        @example_contexts_aggregator = nil
+        @evaluation_summaries_aggregator = nil
+        @failover_aggregator = nil
+      end
+
       private
 
+      # True when this reporter belongs to a different process — i.e. we are
+      # a fork(2) copy. Never true before #start (nothing has been claimed,
+      # and nothing was registered at_exit either).
+      def foreign_process?(operation)
+        return false if @owner_pid.nil?
+        return false if @owner_pid == Process.pid
+
+        LOG.debug "[quonfig] Telemetry #{operation} skipped in forked child " \
+                  "pid=#{Process.pid} owner_pid=#{@owner_pid}"
+        true
+      end
+
       # Rails / Passenger / Puma workers often terminate via SIGTERM without
       # a chance to call Client#stop. Register a Kernel.at_exit hook on
       # first start so the in-flight batch still gets flushed.
@@ -174,6 +223,8 @@ module Quonfig
       # no-op. Bounded so a stuck reporter thread or dead telemetry
       # endpoint can't hang process exit.
       def final_drain_on_exit
+        return if foreign_process?('at_exit drain')
+
         @stopped.make_true
         thread = @thread
         @thread = nil

data/lib/quonfig/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Quonfig
-  VERSION = '1.2.0'
+  VERSION = '1.4.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: quonfig
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.4.0
 platform: ruby
 authors:
 - Jeff Dwyer
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-08 00:00:00.000000000 Z
+date: 2026-09-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport