quonfig 1.3.0 → 1.4.1

data/lib/quonfig/config_loader.rb

@@ -31,6 +31,12 @@ module Quonfig
     #                     SSE does not change it).
     attr_reader :held_generation, :install_count
 
+    # Repoint the failover-telemetry sink. The one caller is
+    # Client#after_fork_in_child: a forked child gets fresh aggregators (the
+    # parent still owns and flushes its own), and the loader has to record
+    # into the child's copy rather than the inherited one (qfg-lv4n.1).
+    attr_writer :failover_aggregator
+
     # +store+: the Quonfig::ConfigStore to populate on successful fetch.
     # +options+: a Quonfig::Options instance (supplies sdk_key + config_api_urls).
     # +logger+: optional logger override (defaults to module LOG).
@@ -386,11 +392,29 @@ module Quonfig
         # ordering info, so it is never rejected as "older"; freezing the client
         # on stale config would be worse (mirrors sdk-node).
         unless @held_generation.nil? || incoming_gen <= 0 || incoming_gen > @held_generation
-          @logger.debug "Reject-older guard: dropping incoming generation #{incoming_gen} <= held #{@held_generation} (source=#{source})"
-          # Failover observability (qfg-41nh.18): count the guard rejection. This
-          # single guard covers BOTH the HTTP config-fetch path and the SSE
-          # message path (apply_envelope) — every network install funnels here.
-          @failover_aggregator&.record_guard_rejected
+          if incoming_gen < @held_generation
+            @logger.debug "Reject-older guard: dropping incoming generation #{incoming_gen} < held #{@held_generation} (source=#{source})"
+            # Failover observability (qfg-41nh.18): count the guard rejection.
+            # This single guard covers BOTH the HTTP config-fetch path and the
+            # SSE message path (apply_envelope) — every network install funnels
+            # here. Only a STRICTLY older payload is counted (qfg-rr5b): that is
+            # the one thing `guardRejected` is meant to report, "a leg tried to
+            # move us backwards", which is what the sdk_failover dashboard panel
+            # is for.
+            @failover_aggregator&.record_guard_rejected
+          else
+            # Equal generation: a re-delivery of the envelope we already hold, and
+            # a silent no-op (qfg-rr5b). Two server behaviors produce it in normal
+            # steady state — api-delivery's SSE `sendInitialConfig` re-sends the
+            # current envelope on every connect regardless of the Last-Event-Id
+            # we send, and a config poll on an empty per-leg ETag slot (a
+            # fresh transport, a reconnect, the fallback poller's engage fetch)
+            # returns a full 200 at the same generation. Counting those as
+            # `guardRejected` made a healthy client report failover activity from
+            # init alone. Not installed, not counted — but still :not_modified, so
+            # the caller's liveness stamp is unchanged.
+            @logger.debug "Same-generation re-delivery: ignoring incoming generation #{incoming_gen} (source=#{source})"
+          end
           return :not_modified
         end
 

data/lib/quonfig/sse_config_client.rb

@@ -129,6 +129,15 @@ module Quonfig
       @worker = Thread.new { run_loop(&on_envelope) }
     end
 
+    # True while the worker thread that owns the stream (and its reconnect
+    # loop) is running. Stays true across a reconnect — the worker owns the
+    # retry, so a blip is not "no channel". Used by Client#connection_state
+    # so that diagnostic derives from liveness rather than a stored flag
+    # (qfg-lv4n.1).
+    def alive?
+      @worker&.alive? || false
+    end
+
     # Shut down. Interrupts the in-flight stream by closing the underlying
     # socket from this thread — the worker thread observes the resulting
     # IOError, sees @stopped == true, and exits cleanly.

data/lib/quonfig/telemetry/failover_aggregator.rb

@@ -45,8 +45,10 @@ module Quonfig
         end
       end
 
-      # Count one install dropped by the reject-older ordering guard (an
-      # equal-or-older snapshot on any install path — HTTP config-fetch or SSE).
+      # Count one install dropped by the reject-older ordering guard because it
+      # was STRICTLY older than the held generation, on any install path (HTTP
+      # config-fetch or SSE). An equal-generation re-delivery is dropped too but
+      # is not counted (qfg-rr5b).
       def record_guard_rejected
         @mutex.synchronize do
           @start_at_ms ||= Quonfig::TimeHelpers.now_in_ms

data/lib/quonfig/telemetry/telemetry_reporter.rb

@@ -51,6 +51,9 @@ module Quonfig
         @stopped = Concurrent::AtomicBoolean.new(false)
         @thread = nil
         @at_exit_registered = false
+        # Set on #start. Everything that can EMIT is gated on it so a forked
+        # child never speaks for the process that created this reporter.
+        @owner_pid = nil
       end
 
       def enabled?
@@ -80,6 +83,11 @@ module Quonfig
         return if @thread&.alive?
         return unless enabled?
 
+        # Claim ownership for THIS process. fork(2) copies the reporter, its
+        # aggregators, and the process-wide at_exit closure registered below;
+        # the pid recorded here is what lets the copy know it is not the
+        # owner and must stay silent (qfg-lv4n.1, dd-trace-rb's pattern).
+        @owner_pid = Process.pid
         @stopped.make_false
         register_at_exit_handler
         @thread = Thread.new do
@@ -106,6 +114,8 @@ module Quonfig
       end
 
       def stop
+        return if foreign_process?('stop')
+
         @stopped.make_true
         thread = @thread
         @thread = nil
@@ -121,7 +131,13 @@ module Quonfig
 
       # Drain all aggregators and POST the batch. Public so tests can
       # trigger a sync without waiting for the background loop.
+      #
+      # Silent in any process other than the one that started the reporter:
+      # after a fork the child holds a full copy of the PARENT's un-flushed
+      # window, and the parent is still going to flush it itself.
       def sync
+        return if foreign_process?('sync')
+
         events = []
         if (summaries_event = @evaluation_summaries_aggregator&.drain_event)
           events << summaries_event
@@ -151,8 +167,41 @@ module Quonfig
         @at_exit_registered
       end
 
+      # Pid of the process that started this reporter, or nil if it was never
+      # started. Visible for tests / diagnostics.
+      attr_reader :owner_pid
+
+      # Called on the INHERITED reporter in a forked child, from
+      # +Quonfig::Client#after_fork_in_child+, once the child has dropped its
+      # reference to it. Makes the copied window unreachable so nothing can
+      # ever emit it — belt to the +@owner_pid+ braces.
+      #
+      # Deliberately does NOT stop, close, or join anything: the thread does
+      # not exist in the child, and the HTTP connection's fd is shared with
+      # the parent.
+      def discard_inherited!
+        @stopped.make_true
+        @thread = nil
+        @context_shape_aggregator = nil
+        @example_contexts_aggregator = nil
+        @evaluation_summaries_aggregator = nil
+        @failover_aggregator = nil
+      end
+
       private
 
+      # True when this reporter belongs to a different process — i.e. we are
+      # a fork(2) copy. Never true before #start (nothing has been claimed,
+      # and nothing was registered at_exit either).
+      def foreign_process?(operation)
+        return false if @owner_pid.nil?
+        return false if @owner_pid == Process.pid
+
+        LOG.debug "[quonfig] Telemetry #{operation} skipped in forked child " \
+                  "pid=#{Process.pid} owner_pid=#{@owner_pid}"
+        true
+      end
+
       # Rails / Passenger / Puma workers often terminate via SIGTERM without
       # a chance to call Client#stop. Register a Kernel.at_exit hook on
       # first start so the in-flight batch still gets flushed.
@@ -174,6 +223,8 @@ module Quonfig
       # no-op. Bounded so a stuck reporter thread or dead telemetry
       # endpoint can't hang process exit.
       def final_drain_on_exit
+        return if foreign_process?('at_exit drain')
+
         @stopped.make_true
         thread = @thread
         @thread = nil

data/lib/quonfig/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Quonfig
-  VERSION = '1.3.0'
+  VERSION = '1.4.1'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: quonfig
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.4.1
 platform: ruby
 authors:
 - Jeff Dwyer
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-18 00:00:00.000000000 Z
+date: 2026-09-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport