quonfig 1.7.1 → 1.8.0

data/lib/quonfig/config_loader.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'json'
+require 'uri'
 
 module Quonfig
   # Fetches config envelopes from the Quonfig delivery API and installs them
@@ -18,6 +19,79 @@ module Quonfig
 
     CONFIGS_PATH = '/api/v2/configs'
 
+    # Rule R1 (qfg-goi1.10.26): the auth class. A fetch cycle with no 200/304
+    # on any leg and one of these on the primary leg is rejected; the client's
+    # poller then enters auth-failed (Client#start_polling).
+    AUTH_STATUSES = [401, 403, 404, 410].freeze
+
+    # Result of one fetch cycle across the configured legs. +statuses+ maps a
+    # config_api_urls index to the HTTP status that leg returned (0 = no
+    # response: timeout, connection failure). +primary_host+ is host:port of
+    # the primary leg, for the entry ERROR (never the key).
+    class FetchCycle
+      attr_reader :result, :statuses, :primary_host
+
+      def initialize(result, statuses, primary_host)
+        @result = result
+        @statuses = statuses
+        @primary_host = primary_host
+      end
+
+      def primary_status
+        @statuses[0] || 0
+      end
+
+      # Rule R2: no leg returned 200/304 and the primary returned an
+      # auth-class status. A 200 the guard dropped, or a 304, never qualifies.
+      def auth_rejected?
+        return false unless @result == :failed
+        return false if @statuses.values.any? { |s| [200, 304].include?(s) }
+
+        AUTH_STATUSES.include?(primary_status)
+      end
+    end
+
+    # Collects one cycle's per-leg log lines. +mode+:
+    #   :normal - log at once, as always (init fetch, refresh, legacy callers)
+    #   :poll   - a poller cycle: hold the auth-class lines until the cycle is
+    #             classified, so an entering cycle logs its one ERROR in their
+    #             place (rule R5); otherwise they are logged unchanged
+    #   :probe  - an auth-failed probe: every line at DEBUG (rule R5)
+    class CycleLog
+      def initialize(logger, mode)
+        @logger = logger
+        @mode = mode
+        @held = []
+        @released = false
+        @mutex = Mutex.new
+      end
+
+      def log(level, msg, auth: false)
+        return @logger.debug(msg) if @mode == :probe
+
+        if @mode == :poll && auth
+          hold = @mutex.synchronize do
+            @held << [level, msg] unless @released
+            !@released
+          end
+          return if hold
+        end
+        @logger.public_send(level, msg)
+      end
+
+      # Log (or with +drop+, discard) the held lines. Lines from a leg that
+      # settles later are logged as they come.
+      def release(drop: false)
+        held = @mutex.synchronize do
+          @released = true
+          h = @held
+          @held = []
+          h
+        end
+        held.each { |level, msg| @logger.public_send(level, msg) } unless drop
+      end
+    end
+
     attr_reader :version, :environment_id
 
     # qfg-7h5d.1.9 (canonical ordering). Diagnostic surface read by the failover/
@@ -127,17 +201,32 @@ module Quonfig
     #   :not_modified  -- a leg answered 304 (no change) and nothing installed
     #   :failed        -- every fired leg failed
     def fetch!
+      fetch_cycle!.result
+    end
+
+    # One fetch cycle, as #fetch!, returning a FetchCycle that carries each
+    # leg's status (rule R2, qfg-goi1.10.26). +log_mode+ is one of CycleLog's
+    # modes; the poller passes :poll for an ordinary cycle and :probe while
+    # auth-failed.
+    def fetch_cycle!(log_mode: :normal)
       urls = Array(@options.config_api_urls)
-      return :failed if urls.empty?
+      statuses = Concurrent::Map.new
+      return FetchCycle.new(:failed, statuses, '') if urls.empty?
 
+      cycle_log = CycleLog.new(@logger, log_mode)
       # Single leg (or no secondary configured): no hedge, just fetch on the
       # calling thread under the SEQUENTIAL per-URL timeout (config_fetch_timeout_ms
       # is unchanged and still governs any non-hedged path). Preserves the
       # synchronous, single-request-per-call shape the legacy/mock callers depend
       # on.
-      return fetch_from(urls[0], 0, timeout_ms: config_fetch_timeout_ms) if urls.length < 2
-
-      fetch_hedged(urls)
+      result = if urls.length < 2
+                 fetch_from(urls[0], 0, timeout_ms: config_fetch_timeout_ms, statuses: statuses, cycle_log: cycle_log)
+               else
+                 fetch_hedged(urls, statuses: statuses, cycle_log: cycle_log)
+               end
+      cycle = FetchCycle.new(result, statuses, host_of(urls[0]))
+      cycle_log.release(drop: cycle.auth_rejected?)
+      cycle
     end
 
     # Apply a ConfigEnvelope (from SSE) to the store. Called by the SSE client
@@ -176,7 +265,7 @@ module Quonfig
     # the hedge abort inside fetch_from, and heals forward through the
     # reject-older guard. We never join the slow leg — a hung primary must not
     # block a successful secondary install.
-    def fetch_hedged(urls)
+    def fetch_hedged(urls, statuses: nil, cycle_log: nil)
       hedge_delay_s = hedge_delay_ms / 1000.0
       abort_ms = hedge_abort_ms
 
@@ -204,7 +293,7 @@ module Quonfig
         Thread.new do
           result = :failed
           begin
-            result = fetch_from(urls[index], index, timeout_ms: abort_ms)
+            result = fetch_from(urls[index], index, timeout_ms: abort_ms, statuses: statuses, cycle_log: cycle_log)
           rescue StandardError => e
             @logger.debug "Hedge leg #{index} failed: #{e.class}: #{e.message}"
           ensure
@@ -306,7 +395,15 @@ module Quonfig
       @options.respond_to?(:config_fetch_timeout_ms) ? @options.config_fetch_timeout_ms : nil
     end
 
-    def fetch_from(source, index = nil, timeout_ms: nil)
+    def host_of(url)
+      uri = URI(url.to_s)
+      uri.host ? "#{uri.host}:#{uri.port}" : url.to_s
+    rescue URI::InvalidURIError
+      ''
+    end
+
+    def fetch_from(source, index = nil, timeout_ms: nil, statuses: nil, cycle_log: nil)
+      cycle_log ||= CycleLog.new(@logger, :normal)
       # qfg-7h5d.1.9 / .1.14: bound this single per-leg attempt so a hung upstream
       # aborts (Faraday::TimeoutError, caught below as :failed). On the hedged
       # path the caller passes config_fetch_hedge_abort_ms; on the sequential /
@@ -318,6 +415,7 @@ module Quonfig
       etag = etag_for(index)
       headers['If-None-Match'] = etag if etag
       response = conn.get(CONFIGS_PATH, headers)
+      statuses[index || 0] = response.status.to_i if statuses
 
       case response.status
       when 200
@@ -337,23 +435,24 @@ module Quonfig
         @logger.debug "Configs not modified (304) from #{source}"
         :not_modified
       when 401, 403
-        @logger.warn "Config fetch rejected (#{response.status}) from #{source}: #{short_body(response)}"
+        cycle_log.log(:warn, "Config fetch rejected (#{response.status}) from #{source}: #{short_body(response)}", auth: true)
         :failed
       else
-        @logger.info "Config fetch failed: status #{response.status} from #{source}"
+        cycle_log.log(:info, "Config fetch failed: status #{response.status} from #{source}",
+                      auth: AUTH_STATUSES.include?(response.status.to_i))
         :failed
       end
     rescue NonEnvelopeError => e
       # qfg-9dxb.3: a non-envelope 200 is a leg error, NOT an install — the
       # hedge/failover proceeds and this leg's ETag is never stored (so a junk
       # 200 cannot pin itself through later 304s).
-      @logger.warn "Config fetch from #{source} returned a non-envelope 200 (#{e.message}); treating as a failed leg"
+      cycle_log.log(:warn, "Config fetch from #{source} returned a non-envelope 200 (#{e.message}); treating as a failed leg")
       :failed
     rescue Faraday::ConnectionFailed => e
       @logger.debug "Connection failure fetching configs from #{source}: #{e.message}"
       :failed
     rescue StandardError => e
-      @logger.warn "Unexpected error fetching configs from #{source}: #{e.message}"
+      cycle_log.log(:warn, "Unexpected error fetching configs from #{source}: #{e.message}")
       :failed
     end
 
@@ -461,6 +560,25 @@ module Quonfig
         @version = meta['version'] || meta[:version] || @version
         @environment_id = meta['environment'] || meta[:environment] || @environment_id
 
+        # Replace the live store first, then advance the generation
+        # (qfg-goi1.10.2). An interrupt part-way through the store write
+        # (Thread#raise, Timeout) then leaves the held generation where it
+        # was, so the same-generation redelivery that follows installs again
+        # and repairs the store instead of being ignored as a duplicate.
+        unless @store.nil?
+          new_keys = next_map.keys.to_set
+          old_keys = @store.keys.to_set
+          # Drop keys that disappeared server-side.
+          (old_keys - new_keys).each { |k| @store.delete(k) } if @store.respond_to?(:delete)
+
+          envelope.configs.each do |cfg|
+            key = config_key(cfg)
+            next if key.nil?
+
+            @store.set(key, cfg)
+          end
+        end
+
         # qfg-9dxb.3 Fix A: an unversioned install (generation <= 0) carries no
         # ordering info and must never LOWER a positive held generation. Under
         # the qfg-9dxb.9 rule it only installs when held is nil/0 anyway, so
@@ -473,21 +591,6 @@ module Quonfig
         # SSE / datadir installs pass source_index nil and are ignored by the
         # aggregator, so they are never counted.
         @failover_aggregator&.record_resolved_from(source_index)
-
-        # Replace the live store atomically.
-        return if @store.nil?
-
-        new_keys = next_map.keys.to_set
-        old_keys = @store.keys.to_set
-        # Drop keys that disappeared server-side.
-        (old_keys - new_keys).each { |k| @store.delete(k) } if @store.respond_to?(:delete)
-
-        envelope.configs.each do |cfg|
-          key = config_key(cfg)
-          next if key.nil?
-
-          @store.set(key, cfg)
-        end
       end
     end
 

data/lib/quonfig/datadir.rb

@@ -39,7 +39,10 @@ module Quonfig
            .sort
            .each do |filename|
           path = File.join(dir, filename)
-          raw = JSON.parse(File.read(path))
+          # Always read as UTF-8: under LANG unset / LANG=C the process
+          # default is US-ASCII and JSON.parse would raise on any non-ASCII
+          # byte (qfg-goi1.2.11 / qfg-xy92).
+          raw = JSON.parse(File.read(path, encoding: 'UTF-8'))
           raise ArgumentError, "[quonfig] config has empty key — file is not a Quonfig Config: #{path}" if raw['key'].nil? || raw['key'].to_s.empty?
 
           coerce_numeric_values(raw)
@@ -68,7 +71,7 @@ module Quonfig
 
       raise ArgumentError, "[quonfig] Datadir is missing quonfig.json: #{quonfig_path}" unless File.exist?(quonfig_path)
 
-      environments = JSON.parse(File.read(quonfig_path)).fetch('environments', [])
+      environments = JSON.parse(File.read(quonfig_path, encoding: 'UTF-8')).fetch('environments', [])
 
       raise Quonfig::Errors::InvalidEnvironmentError.new(environment, environments) if !environments.empty? && !environments.include?(environment)
 

data/lib/quonfig/dev_context.rb

@@ -21,7 +21,8 @@ module Quonfig
       return nil unless File.exist?(path)
 
       raw = begin
-        File.read(path)
+        # UTF-8 regardless of the process locale (qfg-goi1.2.11 / qfg-xy92).
+        File.read(path, encoding: 'UTF-8')
       rescue StandardError => e
         LOG.warn "dev-context: could not read #{path} (#{e.class}: #{e.message}); skipping injection"
         return nil

data/lib/quonfig/errors/env_var_parse_error.rb

@@ -3,7 +3,9 @@
 module Quonfig
   module Errors
     class EnvVarParseError < Quonfig::Error
-      def initialize(env_var, config, env_var_name)
+      # +stored: true+ marks a malformed stored value (no env var involved);
+      # the message then names the stored value rather than a variable.
+      def initialize(_env_var, config, env_var_name, stored: false)
         key, value_type =
           if config.is_a?(Hash)
             [config[:key] || config['key'],
@@ -11,7 +13,14 @@ module Quonfig
           else
             [config.key, config.value_type]
           end
-        super("Evaluating #{key} couldn't coerce #{env_var_name} of #{env_var} to #{value_type}")
+        # +_env_var+ (the raw value) is deliberately left out of the message:
+        # an env var or stored value can be a secret (qfg-goi1.2.11). The
+        # wording is the cross-SDK template pinned by integration-test-data
+        # (v2026.10.12): it names the variable, the lowercase type and the
+        # config key, never the value or a parser message quoting it.
+        type_name = value_type.to_s.downcase
+        source = stored ? 'stored value' : %(environment variable "#{env_var_name}")
+        super(%(#{source} cannot be converted to #{type_name} for config "#{key}"))
       end
     end
   end

data/lib/quonfig/errors/type_mismatch_error.rb

@@ -3,8 +3,12 @@
 module Quonfig
   module Errors
     class TypeMismatchError < Quonfig::Error
+      # The message names the key, the expected type and the actual value's
+      # class only. The value itself is never interpolated: it can be a
+      # decrypted secret, and exception messages end up in logs and error
+      # trackers (qfg-goi1.2.11).
       def initialize(key, expected, actual_value)
-        super("Quonfig value for key '#{key}' expected #{expected}, got #{actual_value.class}: #{actual_value.inspect}")
+        super("Quonfig value for key '#{key}' expected #{expected}, got #{actual_value.class}")
       end
     end
   end

data/lib/quonfig/evaluator.rb

@@ -54,8 +54,26 @@ module Quonfig
     OP_IS_PRESENT                      = 'IS_PRESENT'
     OP_IS_NOT_PRESENT                  = 'IS_NOT_PRESENT'
 
+    MAX_SAFE_INTEGER = (2**53) - 1
+
+    # Timestamp grammar for PROP_BEFORE / PROP_AFTER; see #date_to_millis.
+    INTEGER_STRING = /\A-?[0-9]+\z/
+    RFC3339_TIMESTAMP = /
+      \A(?<y>[0-9]{4})-(?<mo>[0-9]{2})-(?<d>[0-9]{2})
+      T(?<h>[0-9]{2}):(?<mi>[0-9]{2}):(?<s>[0-9]{2})(?:\.(?<frac>[0-9]+))?
+      (?:Z|(?<sign>[+-])(?<oh>[0-9]{2}):(?<om>[0-9]{2}))\z
+    /x
+
     MAGIC_CURRENT_TIME_PROPS = %w[quonfig.current-time prefab.current-time reforge.current-time].freeze
 
+    # PROP_MATCHES / PROP_DOES_NOT_MATCH match timeout (qfg-goi1.2.11). Ruby
+    # 3.2+ supports Regexp.new(src, timeout:); Regexp::TimeoutError is a
+    # RegexpError, so a pattern that runs away (backreferences and lookarounds
+    # defeat Onigmo's memoization) does not match instead of pinning a
+    # thread. Ruby 3.0/3.1 have no timeout and are unchanged.
+    REGEX_MATCH_TIMEOUT_SECONDS = 0.1
+    REGEX_TIMEOUT_SUPPORTED = Regexp.respond_to?(:timeout)
+
     attr_reader :store
     attr_accessor :project_env_id, :env_id
 
@@ -218,7 +236,7 @@ module Quonfig
         mv = hget(match_value, :value)
         if context_exists && context_value.is_a?(String) && mv.is_a?(String)
           begin
-            re = Regexp.new(mv)
+            re = REGEX_TIMEOUT_SUPPORTED ? Regexp.new(mv, timeout: REGEX_MATCH_TIMEOUT_SECONDS) : Regexp.new(mv)
             matched = re.match?(context_value)
             return matched == (operator == OP_PROP_MATCHES)
           rescue RegexpError
@@ -274,8 +292,8 @@ module Quonfig
       when OP_PROP_SEMVER_LESS_THAN, OP_PROP_SEMVER_EQUAL, OP_PROP_SEMVER_GREATER_THAN
         mv = hget(match_value, :value)
         if context_exists && context_value.is_a?(String) && mv.is_a?(String)
-          sv_ctx = SemanticVersion.parse_quietly(context_value)
-          sv_mv  = SemanticVersion.parse_quietly(mv)
+          sv_ctx = SemanticVersion.parse_quietly(context_value, allow_abbreviated: true)
+          sv_mv  = SemanticVersion.parse_quietly(mv, allow_abbreviated: true)
           if sv_ctx && sv_mv
             cmp = (sv_ctx <=> sv_mv)
             case operator
@@ -348,12 +366,27 @@ module Quonfig
 
     # --- Type coercion helpers ----------------------------------------
 
+    # Canonical string form (qfg-goi1.5 R1) for *_ONE_OF, the string
+    # operators and HIERARCHICAL_MATCH: strings as-is, booleans as
+    # "true"/"false", and an integral number below 2^53 as plain digits
+    # whatever its runtime type, so 1.0 is "1" and 5e9 is "5000000000"
+    # (Float#to_s would give "1.0" and "5.0e9").
     def to_s_nil(v)
       return '' if v.nil?
+      return v if v.is_a?(String)
+      return canonical_number(v) if v.is_a?(Numeric) && !v.is_a?(Integer)
 
       v.to_s
     end
 
+    def canonical_number(v)
+      return v.to_s unless v.real?
+      return v.to_s if v.respond_to?(:finite?) && !v.finite?
+      return v.to_s unless v == v.truncate && v.abs <= MAX_SAFE_INTEGER
+
+      v.to_i.to_s
+    end
+
     def to_string_slice(v)
       return [] if v.nil?
       return v.map { |i| to_s_nil(i) } if v.is_a?(Array)
@@ -406,22 +439,44 @@ module Quonfig
       [start_v || min, end_v || max]
     end
 
+    # The ONE timestamp grammar for PROP_BEFORE / PROP_AFTER (qfg-goi1.5 R5),
+    # applied to both the context value and the criterion: a number (epoch
+    # ms, truncated), an all-digit string (epoch ms), or RFC3339 with an
+    # uppercase T and a Z or numeric offset (fractional seconds allowed,
+    # truncated to ms). Date-only, offset-less and free-form strings are not
+    # timestamps and never match. This replaces DateTime.parse, which read
+    # any of those (offset-less as UTC).
     def date_to_millis(val)
       case val
-      when Integer, Float
-        val.to_i
+      when Integer
+        val
+      when Float
+        val.finite? ? val.to_i : nil
       when String
-        # Try ISO-8601 / RFC3339 first, fall back to integer-string.
-        begin
-          t = DateTime.parse(val)
-          return (t.to_time.to_f * 1000).to_i
-        rescue ArgumentError, TypeError
-          # not a date; try integer
-        end
-        Integer(val, exception: false)
+        return Integer(val, 10) if INTEGER_STRING.match?(val)
 
+        rfc3339_to_millis(val)
       end
     end
+
+    def rfc3339_to_millis(str)
+      m = RFC3339_TIMESTAMP.match(str)
+      return nil if m.nil?
+
+      y, mo, d, h, mi, s = %i[y mo d h mi s].map { |k| m[k].to_i }
+      return nil unless Date.valid_date?(y, mo, d) && h <= 23 && mi <= 59 && s <= 59
+
+      offset_seconds = 0
+      if m[:sign]
+        oh = m[:oh].to_i
+        om = m[:om].to_i
+        return nil if oh > 23 || om > 59
+
+        offset_seconds = ((oh * 3600) + (om * 60)) * (m[:sign] == '-' ? -1 : 1)
+      end
+      epoch_seconds = Time.utc(y, mo, d, h, mi, s).to_i - offset_seconds
+      (epoch_seconds * 1000) + (m[:frac] || '').ljust(3, '0')[0, 3].to_i
+    end
   end
 
   # Result of a matched config evaluation. Provides the caller with both the
@@ -532,8 +587,11 @@ module Quonfig
       when 'log_level'   then raw.is_a?(Numeric) ? raw : raw.to_s
       when 'duration'    then duration_to_millis(raw)
       when 'json'
-        # JSON values must be native JS/Ruby types on the wire.
-        raw
+        # JSON values must be native JS/Ruby types on the wire. Hashes and
+        # Arrays are copied so a caller mutating the result cannot rewrite
+        # the cached config for every later read (qfg-goi1.10.3, sdk-go
+        # qfg-9dxb.6). Leaf values (strings included) are not copied.
+        copy_json_containers(raw)
       else
         raw
       end
@@ -547,6 +605,14 @@ module Quonfig
 
     private
 
+    def copy_json_containers(value)
+      case value
+      when Hash then value.to_h { |k, v| [k, copy_json_containers(v)] }
+      when Array then value.map { |v| copy_json_containers(v) }
+      else value
+      end
+    end
+
     # Coerce an ISO 8601 duration value (e.g. "PT0.2S", "P1DT6H2M1.5S")
     # to integer milliseconds. The wire format may either be a bare ISO
     # string in `value` or the structured `{ seconds, nanos }` proto-style

data/lib/quonfig/quonfig.rb

@@ -11,6 +11,14 @@ module Quonfig
     end
 
     @@lock.with_write_lock do
+      # Re-check under the lock: two threads can both pass the check above,
+      # and the loser must not build (and orphan) a second Client with its
+      # own SSE stream and telemetry thread (qfg-goi1.2.11).
+      unless @singleton.nil?
+        LOG.warn 'Quonfig already initialized.'
+        next @singleton
+      end
+
       @singleton = Quonfig::Client.new(options)
     end
   end

data/lib/quonfig/resolver.rb

@@ -56,15 +56,21 @@ module Quonfig
 
       weighted_index = nil
       hash_missing = []
-      resolved_value = resolve_value_on_path(eval_result.value, config, context, [], hash_missing) do |idx|
+      selected_variants = []
+      resolved_value = resolve_value_on_path(eval_result.value, config, context, [], hash_missing,
+                                             selected_variants) do |idx|
         weighted_index = idx
       end
+      # Redact from the selected rollout variant, not only the outer
+      # weighted_values wrapper (which is never flagged), so a confidential or
+      # decryptWith variant never reaches telemetry in plaintext (qfg-goi1.2.39).
+      reportable = redacted_reportable_value(eval_result.value) || redacted_reportable_value(selected_variants.last)
       EvalResult.new(
         value: resolved_value,
         rule_index: eval_result.rule_index,
         config: config,
         weighted_value_index: weighted_index,
-        reportable_value: redacted_reportable_value(eval_result.value),
+        reportable_value: reportable,
         hash_property_missing: !hash_missing.empty?
       )
     end
@@ -91,15 +97,21 @@ module Quonfig
     # DecryptionError instead of recursing until SystemStackError
     # (qfg-9dxb.7, matching sdk-go qfg-9dxb.4). +hash_missing+, when given,
     # gets an entry for each weighted rollout whose hash property was missing
-    # from the context (qfg-9dxb.8).
-    def resolve_value_on_path(value, config, context, key_path, hash_missing = nil, &on_weighted_index)
+    # from the context (qfg-9dxb.8). +selected_variants+, when given, gets the
+    # stored (pre-resolution) Value of each weighted variant picked, so get()
+    # can redact a confidential/decryptWith variant (qfg-goi1.2.39).
+    def resolve_value_on_path(value, config, context, key_path, hash_missing = nil, selected_variants = nil,
+                              &on_weighted_index)
       return nil if value.nil?
 
       type = vget(value, :type, 'type')
 
       return resolve_provided(value, config) if type == 'provided'
 
-      return resolve_weighted(value, config, context, key_path, hash_missing, &on_weighted_index) if type == 'weighted_values'
+      if type == 'weighted_values'
+        return resolve_weighted(value, config, context, key_path, hash_missing, selected_variants,
+                                &on_weighted_index)
+      end
 
       confidential = vget(value, :confidential, 'confidential')
       decrypt_with = vget(value, :decryptWith, 'decryptWith', :decrypt_with, 'decrypt_with')
@@ -184,7 +196,8 @@ module Quonfig
     # nil) hashes an empty value, the same bucket as a present "", and warns
     # once per config key (qfg-9dxb.8). With no hash property configured the
     # pick stays random per call.
-    def resolve_weighted(value, config, context, key_path, hash_missing = nil, &on_weighted_index)
+    def resolve_weighted(value, config, context, key_path, hash_missing = nil, selected_variants = nil,
+                         &on_weighted_index)
       payload = vget(value, :value, 'value') || {}
       weighted = vget(payload, :weightedValues, 'weightedValues', :weighted_values, 'weighted_values')
       return value unless weighted.is_a?(Array) && !weighted.empty?
@@ -213,7 +226,9 @@ module Quonfig
       variant, index = picker.resolve
       on_weighted_index&.call(index)
       variant_value = vget(variant, :value, 'value')
-      resolve_value_on_path(variant_value, config, context, key_path, hash_missing, &on_weighted_index)
+      selected_variants&.push(variant_value)
+      resolve_value_on_path(variant_value, config, context, key_path, hash_missing, selected_variants,
+                            &on_weighted_index)
     end
 
     def warn_hash_property_missing(cfg_key, hash_property)

data/lib/quonfig/semantic_logger_filter.rb

@@ -52,6 +52,10 @@ module Quonfig
 
     # SemanticLogger filter contract: return true to emit, false to suppress.
     # Missing config key → return true so SemanticLogger's static level decides.
+    # A resolution error (unset ENV_VAR, decryption failure, ...) is treated
+    # the same way: the filter runs inside the host app's log calls and must
+    # never raise out of them (qfg-goi1.2.11). Nothing is logged here, since
+    # logging from inside a log filter can recurse.
     def call(log)
       configured = @client.get(@config_key, nil, context_for(log))
       return true if configured.nil?
@@ -59,6 +63,8 @@ module Quonfig
       log_severity = LEVELS[log.level] || LEVELS[:debug]
       min_severity = LEVELS[normalize_level(configured)] || LEVELS[:debug]
       log_severity >= min_severity
+    rescue StandardError
+      true
     end
 
     private

data/lib/quonfig/semver.rb

@@ -18,6 +18,11 @@ class SemanticVersion
     $
   /x
 
+  # Abbreviated "x" and "x.y" (qfg-goi1.5 Q5), read as x.0.0 and x.y.0 by
+  # the PROP_SEMVER_* operators, matching LaunchDarkly. A prerelease or build
+  # suffix needs the full x.y.z.
+  ABBREVIATED_PATTERN = /\A(?<major>0|[1-9]\d*)(?:\.(?<minor>0|[1-9]\d*))?\z/
+
   attr_reader :major, :minor, :patch, :prerelease, :build_metadata
 
   def self.parse(version_string)
@@ -36,7 +41,12 @@ class SemanticVersion
     )
   end
 
-  def self.parse_quietly(version_string)
+  def self.parse_quietly(version_string, allow_abbreviated: false)
+    if allow_abbreviated && version_string.is_a?(String)
+      match = ABBREVIATED_PATTERN.match(version_string)
+      return new(major: match[:major].to_i, minor: match[:minor].to_i, patch: 0) if match
+    end
+
     parse(version_string)
   rescue ArgumentError
     nil