railwatch 0.9.3 → 1.0.0

data/lib/railwatch/configuration.rb

@@ -60,23 +60,18 @@ module Railwatch
       Rack::QueryParser::ParameterTypeError
     ].freeze
 
-    # What the dashboard controllers inherit from unless the host names its
-    # own. Also how `dashboard_gate` tells "they wired their own auth" from
-    # "they left the default".
+    # What railwatch-server's dashboard proxy inherits from unless the host
+    # names its own.
     DEFAULT_BASE_CONTROLLER = "ActionController::Base"
 
-    attr_accessor :export_enabled, :export_policy, :export_url, :export_token, :export_max_bytes,
-                  :export_max_deliveries, :export_max_age
-    attr_accessor :enabled, :token, :ingest_url, :allow_http, :server, :environment, :transport,
-                  :issue_prefix, :repository_url, :retention_days, :dashboard_user, :writer_socket,
+    attr_accessor :enabled, :token, :ingest_url, :allow_http, :server, :environment,
                   :http_basic_auth_enabled, :http_basic_auth_user, :http_basic_auth_password, :base_controller_class,
-                  :dashboard_open,
                   :sample, :log_level, :capture_request_payload,
                   :capture_exception_source, :capture_exception_locals, :redact_headers, :redact_params,
                   :buffer_size, :buffer_bytes, :execution_buffer_bytes, :batch_bytes,
                   :backpressure,
                   :flush_interval, :flush_threshold,
-                  :connect_timeout, :timeout, :shutdown_timeout, :migration_busy_timeout,
+                  :connect_timeout, :timeout, :shutdown_timeout,
                   :slow_query_threshold_ms, :n_plus_one_threshold,
                   :max_view_renders_per_execution, :ignored_cache_key_prefixes,
                   :beacon_enabled, :beacon_rate_limit, :beacon_global_rate_limit, :beacon_allowed_origins,
@@ -99,49 +94,24 @@ module Railwatch
     def initialize
       @enabled = env_bool("RAILWATCH_ENABLED", true)
       @token = ENV["RAILWATCH_TOKEN"]
-      @transport = ENV.fetch("RAILWATCH_TRANSPORT", "http").to_sym
-      # Embedded dashboard settings; ignored when transport is :http.
-      @issue_prefix = ENV["RAILWATCH_ISSUE_PREFIX"]
-      @repository_url = ENV["RAILWATCH_REPOSITORY_URL"]
-      @retention_days = env_int("RAILWATCH_RETENTION_DAYS", 7)
-      @dashboard_user = nil
-      # Mirroring an embedded install's telemetry to a remote receiver. Off
-      # unless asked for: an embedded install's promise is that nothing leaves
-      # the machine, and a token being present is not consent.
-      @export_enabled = env_bool("RAILWATCH_EXPORT_ENABLED", false)
-      @export_policy = ENV.fetch("RAILWATCH_EXPORT_POLICY", "everything").to_sym
-      @export_url = ENV["RAILWATCH_EXPORT_URL"]
-      @export_token = ENV["RAILWATCH_EXPORT_TOKEN"]
-      @export_max_bytes = env_int("RAILWATCH_EXPORT_MAX_BYTES", 256 * 1024 * 1024)
-      @export_max_deliveries = env_int("RAILWATCH_EXPORT_MAX_DELIVERIES", 100_000)
-      @export_max_age = env_int("RAILWATCH_EXPORT_MAX_AGE_SECONDS", 86_400)
-      # Dashboard access, the way Mission Control Jobs does it: HTTP Basic
+      # The gate in front of the dashboard railwatch-server serves at
+      # /railwatch, the way Mission Control Jobs does it: HTTP Basic
       # authentication is on and CLOSED by default. With no user and password
       # configured every dashboard request is 401, so an install that forgot
       # to set anything up is never a public page. Credentials come from
       # Rails credentials (railwatch.http_basic_auth_user/_password, written
       # by `bin/rails railwatch:authentication:configure`), from these env
       # vars, or by assignment here. A host with its own admin auth turns
-      # Basic off and names a base controller, or wraps the mount in a
-      # routes constraint.
+      # Basic off and names a base controller. Nothing here reads them unless
+      # railwatch-server is installed.
       @http_basic_auth_enabled = env_bool("RAILWATCH_HTTP_BASIC_AUTH_ENABLED", true)
       @http_basic_auth_user = ENV["RAILWATCH_HTTP_BASIC_AUTH_USER"]
       @http_basic_auth_password = ENV["RAILWATCH_HTTP_BASIC_AUTH_PASSWORD"]
-      # Only consulted when HTTP Basic is off: the host saying, in as many
-      # words, "I accept that anyone who can reach this URL can read it".
-      # A private network or a VPN is a real answer; this is how you say so,
-      # and it is what silences the boot warning and opens the live channel.
-      @dashboard_open = env_bool("RAILWATCH_DASHBOARD_OPEN", false)
-      # The dashboard controllers inherit from this class, so a host's own
-      # before_actions (require an admin, redirect to sign-in) run in front of
-      # every page. Default is the engine's own base, which authenticates
-      # nothing itself beyond HTTP Basic above.
+      # railwatch-server's dashboard proxy inherits from this class, so a
+      # host's own before_actions (require an admin, redirect to sign-in) run
+      # in front of every page. The default authenticates nothing itself
+      # beyond HTTP Basic above.
       @base_controller_class = ENV.fetch("RAILWATCH_BASE_CONTROLLER_CLASS", DEFAULT_BASE_CONTROLLER)
-      # Embedded mode's writer process (lib/railwatch/writer.rb): the Unix
-      # socket the Puma workers hand their batches to. Relative paths are
-      # under Rails.root. nil disables the writer and every process writes
-      # its own batches, as before.
-      @writer_socket = ENV.fetch("RAILWATCH_WRITER_SOCKET", "tmp/sockets/railwatch-writer.sock")
       @ingest_url = ENV.fetch("RAILWATCH_INGEST_URL", "https://railwatch.rebulk.com")
       @allow_http = env_bool("RAILWATCH_ALLOW_HTTP", false)
       @project_root = defined?(Rails) ? Rails.root : Dir.pwd
@@ -187,13 +157,6 @@ module Railwatch
       @connect_timeout = env_float("RAILWATCH_CONNECT_TIMEOUT", 1.0)
       @timeout = env_float("RAILWATCH_TIMEOUT", 3.0)
       @shutdown_timeout = env_float("RAILWATCH_SHUTDOWN_TIMEOUT", 2.0)
-      # Seconds a migration of the railwatch databases waits for SQLite's
-      # write lock (Patches::MigrationBusyTimeout). A deploy migrates while
-      # the old release's writer is still committing to the same file; the
-      # database's own `timeout` (5 s) is too short to get between its
-      # transactions when the disk is busy. Kept under a typical health-check
-      # window (Kamal's deploy_timeout defaults to 30 s and is often 90 s).
-      @migration_busy_timeout = env_float("RAILWATCH_MIGRATION_BUSY_TIMEOUT", 60.0)
       @slow_query_threshold_ms = env_float("RAILWATCH_SLOW_QUERY_MS", 5.0)
       @n_plus_one_threshold = env_int("RAILWATCH_N_PLUS_ONE_THRESHOLD", 5)
       @max_view_renders_per_execution = 20
@@ -318,67 +281,13 @@ module Railwatch
     end
 
     def enabled?
-      @enabled && (local? || token.present?)
+      @enabled && token.present?
     end
 
-    # :local writes telemetry into the engine's own database in-process;
-    # anything else ships it to ingest_url over HTTPS.
-    def local? = transport.to_s == "local"
-
-    # The receiver admits an unseen delivery for seven days; queueing one for
-    # longer cannot help.
-    MAX_EXPORT_AGE = 7 * 24 * 60 * 60
-
-    # Mirroring is a thing an embedded install opts into; it is meaningless
-    # for an install that is already sending everything over HTTP.
-    def export? = export_enabled && local? && export_problem.nil?
-
-    # Why export is configured but unusable, or nil when it is fine. The
-    # doctor reports this; nothing silently half-enables.
-    def export_problem
-      return nil unless export_enabled
-      return "export needs transport :local; an :http install already sends everything" unless local?
-      return "RAILWATCH_EXPORT_POLICY #{export_policy} is not implemented" unless export_policy.to_s == "everything"
-      return "no export token: set RAILWATCH_EXPORT_TOKEN or RAILWATCH_TOKEN" if resolved_export_token.to_s.empty?
-      return "no export url: set RAILWATCH_EXPORT_URL or RAILWATCH_INGEST_URL" if resolved_export_url.to_s.empty?
-      return "export url must be HTTPS (or set RAILWATCH_ALLOW_HTTP=true)" unless url_allowed?(resolved_export_url)
-      # Past this a receiver stops recognising a delivery's id, so holding one
-      # any longer just means discovering later that it can never be sent.
-      if export_max_age > MAX_EXPORT_AGE
-        return "RAILWATCH_EXPORT_MAX_AGE_SECONDS cannot exceed #{MAX_EXPORT_AGE} (the receiver stops recognising a delivery past that)"
-      end
-
-      nil
-    end
-
-    # The receiver, and the credential we are bound to it with. Both fall back
-    # to the ordinary ingest settings so switching an install from embedded to
-    # cloud needs no second set of values.
-    def resolved_export_url
-      url = export_url.presence || (ingest_url.presence && URI.join(ingest_url, "/ingest").to_s)
-      url&.sub(%r{/\z}, "")
-    rescue URI::Error
-      # BadURIError (a relative ingest_url) is not an InvalidURIError, and
-      # letting it out of here takes the doctor down with it.
-      nil
-    end
-
-    def resolved_export_token = export_token.presence || token
-
-    # Absolute path of the writer socket, or nil when the writer is off.
-    def writer_socket_path
-      path = writer_socket.to_s
-      return nil if path.empty?
-
-      root = defined?(Rails) && Rails.respond_to?(:root) && Rails.root ? Rails.root.to_s : Dir.pwd
-      File.expand_path(path, root)
-    end
+    # Always false: there is no embedded transport any more. Only
+    # railwatch-server 0.1.0 calls it.
+    def local? = false
 
-    # Who the embedded dashboard shows as the signed-in operator. A host
-    # passes a lambda taking the request (cookies, warden, whatever it uses)
-    # and returning a User, {id:, name:, email:} or nil. Authentication and
-    # authorisation stay the host's job: put the mount behind its own
-    # constraint. This only names the person for comments and saved views.
     # Both halves present. Read late (not at boot) so credentials set from an
     # initializer, an env var or the configure task all count.
     def http_basic_auth_configured?
@@ -386,17 +295,17 @@ module Railwatch
     end
 
     # Development with Basic on and nothing configured is open, so a first
-    # run is `rails g railwatch:install` and a page, not a password step
-    # first. Rails already shows full error pages there. Every other
-    # environment stays closed until credentials exist.
+    # run is a page, not a password step first. Rails already shows full
+    # error pages there. Every other environment stays closed until
+    # credentials exist.
     def http_basic_auth_waived?
       http_basic_auth_enabled && !http_basic_auth_configured? && defined?(Rails) && Rails.env.development?
     end
 
     # Whether the request carries the configured HTTP Basic credentials.
     # False when Basic is on and nothing is configured (closed), true when
-    # Basic is off (the host's base controller or routes constraint is the
-    # gate then). Shared by the dashboard controller and the live channel.
+    # Basic is off (the host's base controller is the gate then).
+    # railwatch-server's dashboard proxy calls it.
     def http_basic_auth_ok?(request)
       return true unless http_basic_auth_enabled
       return true if http_basic_auth_waived?
@@ -408,45 +317,6 @@ module Railwatch
       end == true
     end
 
-    # Which gate is in force, for the doctor, the boot warning and the live
-    # channel. :basic when HTTP Basic is on (closed until credentials exist),
-    # :controller when the host named its own base controller, :resolver when
-    # it gave a dashboard_user that can refuse, :open when it said the
-    # dashboard is deliberately public, and :undeclared when Basic is off and
-    # none of those is true -- which usually means a routes constraint the
-    # gem cannot see, and might mean nothing at all.
-    def dashboard_gate
-      return :basic if http_basic_auth_enabled
-      return :controller unless base_controller_class == DEFAULT_BASE_CONTROLLER
-      return :resolver if dashboard_user
-      return :open if dashboard_open
-
-      :undeclared
-    end
-
-    # Whether a live-update subscription is allowed. Action Cable runs on the
-    # host's own /cable endpoint, which a routes constraint around the
-    # engine's mount does not cover and a base controller cannot reach, so an
-    # undeclared gate refuses rather than assuming.
-    def dashboard_channel_allowed?(request)
-      return http_basic_auth_ok?(request) if http_basic_auth_enabled
-      if dashboard_user
-        return !!(dashboard_user.respond_to?(:call) ? dashboard_user.call(request) : dashboard_user)
-      end
-
-      # A controller name is not evidence of authorization on /cable.
-      !!dashboard_open
-    end
-
-    def resolve_dashboard_user(request)
-      resolved = dashboard_user.respond_to?(:call) ? dashboard_user.call(request) : dashboard_user
-      case resolved
-      when User then resolved
-      when Hash then User.new(id: resolved[:id] || User::ID, name: resolved[:name].to_s.presence || "Operator", email: resolved[:email])
-      else User.default
-      end
-    end
-
     def ingest_url_allowed?
       url_allowed?(ingest_url)
     end

data/lib/railwatch/engine.rb

@@ -1,88 +1,25 @@
 # frozen_string_literal: true
 
-# The dashboard controllers are Inertia controllers; a host that does not use
-# Inertia itself never requires the gem, so the engine does.
-require "inertia_rails"
-# The engine's jobs (grouping, rollups, scans) are Active Job classes even
-# though embedded mode calls their perform directly, so a host built with
-# `rails new --minimal` (no Active Job) still needs the framework loaded.
-# Part of the rails gem this one depends on, so nothing new is pulled in.
-require "active_job/railtie"
-
 module Railwatch
-  # isolate_namespace would give every model a railwatch_ prefix. Only the
-  # engine's own records (issues, comments, deploys: Railwatch::ApplicationRecord)
-  # carry it; the telemetry tables are the hosted platform's schema and stay
-  # unprefixed. Defined before isolate_namespace runs, which only adds a
-  # prefix when none is set.
-  def self.table_name_prefix = ""
-
+  # Mounted for the browser beacon (POST <mount>/beacon), its only route.
   class Engine < ::Rails::Engine
     isolate_namespace Railwatch
 
-    config.railwatch = ActiveSupport::OrderedOptions.new
-
-    # The dashboard bundle is built into the gem at release time; serve it
-    # from here so a host app needs no asset pipeline integration at all.
-    # Where it goes in the stack is DashboardAssets.install!'s decision.
-    initializer "railwatch.dashboard_assets" do |app|
-      Railwatch::DashboardAssets.install!(app, root: root.join("public/railwatch").to_s)
-    end
-
-    # Action Cable is optional: live dashboard updates need it, nothing else
-    # does. A host without it (`rails new --minimal`, --skip-action-cable)
-    # must not eager-load the engine's channel, which inherits from a class
-    # that does not exist there.
-    initializer "railwatch.channels", before: :setup_main_autoloader do
-      Rails.autoloaders.main.ignore(root.join("app/channels")) unless defined?(::ActionCable)
-    end
-
-    # The dashboard bundle subscribes to "EnvironmentChannel" by name; Action
-    # Cable constantizes that, so the engine's channel needs the bare name.
-    # Only defined when the host has not got one of its own.
-    initializer "railwatch.live_channel" do
-      next unless defined?(::ActionCable)
-
-      # Action Cable constantizes the subscription's channel name at
-      # subscribe time; the alias only has to exist by then, and it must
-      # not clobber a host channel of the same name.
-      config.to_prepare do
-        Object.const_set(:EnvironmentChannel, Railwatch::EnvironmentChannel) unless Object.const_defined?(:EnvironmentChannel)
-      end
-    end
-
     # The request middleware goes first so wall time includes every other
     # middleware, exactly like Nightwatch's GlobalMiddleware.
     initializer "railwatch.middleware", before: :load_config_initializers do |app|
       app.middleware.insert_before 0, Railwatch::Middleware::Request
     end
 
-    # HTTP installs have no embedded databases or job backend. Loading their
-    # models still registers them with Active Record, whose schema-cache boot
-    # hook asks every descendant for its connection_pool (e.g. with
-    # activerecord-tenanted). Decide after the host's initializer selects the
-    # transport. Keep autoloading available for the local installer and tools;
-    # only local installs should eagerly load the embedded models and jobs.
-    # Dashboard controllers also reference model constants in their class
-    # bodies. The beacon is the only controller a cloud install needs.
-    initializer "railwatch.embedded_eager_loading", after: :load_config_initializers, before: :setup_main_autoloader do
-      next if Railwatch.config.local?
-
-      Rails.autoloaders.main.do_not_eager_load(root.join("app/models"))
-      Rails.autoloaders.main.do_not_eager_load(root.join("app/jobs"))
-      root.glob("app/controllers/railwatch/*.rb").each do |path|
-        Rails.autoloaders.main.do_not_eager_load(path) unless path.basename.to_s == "beacon_controller.rb"
-      end
-    end
-
     # Before anything subscribes or starts a thread, and after the app's own
     # initializer has had its say about config: a console captures nothing.
     initializer "railwatch.console", after: :load_config_initializers, before: "railwatch.subscribe" do
       Railwatch::Console.silence!
     end
 
-    # Same source Mission Control Jobs reads: railwatch.http_basic_auth_user
-    # and _password in Rails credentials, which `bin/rails
+    # The dashboard gate railwatch-server's proxy applies. Same source
+    # Mission Control Jobs reads: railwatch.http_basic_auth_user and
+    # _password in Rails credentials, which `bin/rails
     # railwatch:authentication:configure` writes. An initializer or env var
     # that already set them wins.
     initializer "railwatch.http_basic_auth", after: :load_config_initializers do |app|
@@ -91,49 +28,26 @@ module Railwatch
       config.http_basic_auth_password ||= app.credentials.dig(:railwatch, :http_basic_auth_password)
     end
 
-    # Three things worth one line in the log at boot, because all are
-    # invisible until something is already wrong: a Rails/json pair that
-    # cannot decode, an embedded dashboard with nothing declared in front of
-    # it, and one that is closed to everyone because Basic has no
-    # credentials outside development.
+    # Worth one line in the log at boot, because it is invisible until
+    # something is already wrong: a Rails/json pair that cannot decode.
     initializer "railwatch.warnings", after: :load_config_initializers do
       config.after_initialize do
         next unless Railwatch.enabled?
 
         Rails.logger.warn("[railwatch] #{Railwatch::JsonCompat.advice}") if Railwatch::JsonCompat.broken?
-
-        if Railwatch.config.local? && Railwatch.config.dashboard_gate == :basic &&
-           !Railwatch.config.http_basic_auth_configured? && !Rails.env.local?
-          Rails.logger.warn(
-            "[railwatch] the dashboard is closed: HTTP Basic is on and no credentials are configured for " \
-            "#{Rails.env}, so every request to it is 401. Run `RAILS_ENV=#{Rails.env} bin/rails " \
-            "railwatch:authentication:configure`, or gate it with your own auth and set " \
-            "`c.http_basic_auth_enabled = false` (docs/embedded.md)."
-          )
-        end
-
-        if Railwatch.config.local? && Railwatch.config.dashboard_gate == :undeclared && !Rails.env.local?
-          Rails.logger.warn(
-            "[railwatch] the dashboard at the engine's mount has no gate this gem can see: HTTP Basic is off and " \
-            "no base_controller_class, dashboard_user or dashboard_open is set. If a routes constraint or your " \
-            "network already gates it, authorize /cable separately with `c.dashboard_user`, or set `c.dashboard_open = true` " \
-            "only when the network protects both endpoints. Otherwise anyone who can reach the dashboard can read every query, log line and exception this app records."
-          )
-        end
       end
     end
 
     # A rake process starts its command execution before this point -- the
     # top-level task is invoked before its `:environment` prerequisite boots
-    # Rails -- so a reporter can already exist, built from a config that had
-    # not yet been told the app is embedded. This is the first moment the
-    # app's own configuration is final.
+    # Rails -- so a reporter can already exist, built from a config that was
+    # not final. This is the first moment the app's own configuration is.
     initializer "railwatch.adopt_final_config", after: :load_config_initializers do
       Railwatch.adopt_final_config!
     end
 
     initializer "railwatch.transport_security", after: :load_config_initializers do
-      next if Railwatch.config.local? || Railwatch.config.ingest_url_allowed?
+      next if Railwatch.config.ingest_url_allowed?
 
       Rails.logger.warn(
         "Railwatch will not send telemetry to #{Railwatch.config.ingest_url}: plain HTTP is allowed only for loopback " \
@@ -243,28 +157,6 @@ module Railwatch
       at_exit { Railwatch::Sessions.stop! }
     end
 
-    # The embedded install's maintenance clock (release health, scans,
-    # pruning). Same shape and ordering rationale as "railwatch.health":
-    # stopped before the reporter's final flush. Maintenance.start! is a
-    # no-op unless the transport is local.
-    initializer "railwatch.maintenance" do
-      next unless Railwatch.enabled?
-
-      Railwatch::Maintenance.start!
-      at_exit { Railwatch::Maintenance.stop! }
-    end
-
-    # Draining the export queue. Same shape and ordering as the others:
-    # stopped before the reporter's final flush, so its last claim is
-    # released rather than left to expire. Sender.start! is a no-op unless
-    # export is configured and usable.
-    initializer "railwatch.export" do
-      next unless Railwatch.enabled?
-
-      Railwatch::Export::Sender.start!
-      at_exit { Railwatch::Export::Sender.stop! }
-    end
-
     # lib/tasks/railwatch_tasks.rake is picked up by Rails::Engine's default
     # lib/tasks convention; the rake_tasks block above only installs the
     # Rake::Task patch.
@@ -274,7 +166,6 @@ end
 require "railwatch/console"
 require "railwatch/health"
 require "railwatch/sessions"
-require "railwatch/maintenance"
 require "railwatch/middleware/request"
 require "railwatch/job_tracing"
 require "railwatch/controller_helpers"

data/lib/railwatch/patches.rb

@@ -4,7 +4,6 @@ require "railwatch/patches/net_http"
 require "railwatch/patches/rake_task"
 require "railwatch/patches/runner_command"
 require "railwatch/patches/inertia"
-require "railwatch/patches/migration_busy_timeout"
 
 module Railwatch
   module Patches
@@ -23,16 +22,6 @@ module Railwatch
     # From Rails::Engine#load_tasks, which has already required rake.
     def install_rake_task!
       ::Rake::Task.prepend(RakeTask) unless ::Rake::Task.ancestors.include?(RakeTask)
-      install_migration_busy_timeout!
-    end
-
-    # db:prepare and db:migrate run as rake tasks, so this goes in with the
-    # rake patch. Unlike it, this one is not gated on Railwatch.enabled?: a
-    # container entrypoint migrates with Railwatch switched off, and that is
-    # exactly the migration that has to wait out the old release's writer.
-    def install_migration_busy_timeout!
-      tasks = ::ActiveRecord::Tasks::DatabaseTasks.singleton_class
-      tasks.prepend(MigrationBusyTimeout) unless tasks.ancestors.include?(MigrationBusyTimeout)
     end
 
     # From Rails::Application#load_runner, which RunnerCommand#perform calls

data/lib/railwatch/reporter.rb

@@ -13,7 +13,8 @@ module Railwatch
     # counted) so the buffer's newest records win again. Without the cap a
     # batch that keeps failing would be pinned forever while everything
     # newer was discarded around it. Eight attempts on the backoff ladder is
-    # roughly four minutes of outage.
+    # roughly four minutes of outage; one to two when every attempt is
+    # refused with a Retry-After (MAX_REFUSED_RETRY_DELAY).
     MAX_RETRY_ATTEMPTS = 8
     # An unhandled exception asks for an immediate flush so it reaches the
     # platform without waiting out flush_interval. "Immediate" is this many
@@ -26,7 +27,23 @@ module Railwatch
     # is enough to turn a saturated stream into breathing room without the
     # long recovery and sparse telemetry a 16x cap would impose.
     MAX_BACKPRESSURE_FACTOR = 8.0
+    # A receiver that answers with a Retry-After (503 "disk almost full" or
+    # "database busy", 429 "rate limit exceeded") is refusing, not failing.
+    # The next attempt waits for its Retry-After instead of the ladder, up
+    # to this long. Railwatch's receivers send 15 s for a busy database,
+    # honoured as given, and 60 s for the disk floor and the rate-limit
+    # window, which are not forecasts: the floor is re-checked every 10 s
+    # and lifts the moment space is back, and a window can end at any time.
+    # The ladder alone was worse than either: a minute into a refusal its
+    # rungs were 16-60 s apart, and a recovered app stayed sampled down
+    # until the next one. A longer wait is cut to between half and all of
+    # this, jittered so processes refused together do not return together:
+    # one POST per process every 7.5-15 s.
+    MAX_REFUSED_RETRY_DELAY = 15.0
     DeliveryBatch = Data.define(:id, :records, :bytes, :dropped, :dropped_bytes, :prepared)
+    # From the first refusal to the next accepted delivery: when it began,
+    # what the receiver said, and the loss counters as they stood then.
+    Refusal = Struct.new(:started_at, :reason, :overflowed, :sampled_out, :gave_up)
 
     class DeliveryError < StandardError
       attr_reader :status, :records, :bytes, :dropped, :dropped_bytes
@@ -66,6 +83,8 @@ module Railwatch
       @in_flight_bytes = 0
       @in_flight_dropped_bytes = 0
       @shutdown_notified = false
+      @refusal = nil
+      @sampled_out = 0
     end
 
     def buffer
@@ -75,6 +94,13 @@ module Railwatch
 
     attr_reader :backpressure_factor
 
+    # The sampler calls this for an execution the configured rate kept and
+    # backpressure did not. Only reached while the factor is above one.
+    def note_sampled_out
+      ensure_process!
+      @mutex.synchronize { @sampled_out += 1 }
+    end
+
     def write(record, bytes = nil)
       ensure_process!
       size = @buffer.push(record, bytes)
@@ -146,6 +172,8 @@ module Railwatch
       @in_flight_bytes = 0
       @in_flight_dropped_bytes = 0
       @shutdown_notified = false
+      @refusal = nil
+      @sampled_out = 0
       remove_instance_variable(:@shutdown_deadline) if defined?(@shutdown_deadline)
       self
     end
@@ -155,20 +183,11 @@ module Railwatch
     # where the command patch starts the execution, and sampling that
     # execution builds the reporter -- before the task's `:environment`
     # prerequisite boots Rails and runs config/initializers. A token in the
-    # environment is enough for Railwatch to be enabled that early, so an
-    # embedded app gets a reporter aimed at HTTP, chosen from a config that
-    # had not yet been told the app is embedded. Left alone it stays aimed
-    # there: the memo outlives the configuration that produced it, and every
-    # record from that process goes to the receiver instead of the app's own
-    # database, skipping the export queue and the replay receipts it earns.
+    # environment is enough for Railwatch to be enabled that early.
     #
     # Nothing has been recorded at that point -- starting an execution
     # decides sampling and pushes nothing -- so deciding again here is free.
     def adopt_final_config!
-      # The swap forked_transport already makes, for the same reason: the
-      # situation this transport was chosen for is not the situation now.
-      reselected = Railwatch.local_transport if @config.local?
-      @transport = reselected if reselected && reselected.class != @transport.class
       # Sized from the config as it stood, which was the default one. Safe
       # only while the buffer is still empty: resizing means a new buffer,
       # and anything already in the old one would go with it.
@@ -220,12 +239,6 @@ module Railwatch
     end
 
     def forked_transport
-      # A child may be a different kind of process from its parent: the
-      # writer forked from a Puma master must write SQLite itself, not hand
-      # batches back to the socket it is about to serve.
-      reselected = Railwatch.local_transport if @config.local?
-      return reselected if reselected && reselected.class != @transport.class
-
       transport = @transport.dup
       transport.reset_after_fork! if transport.respond_to?(:reset_after_fork!)
       transport
@@ -348,6 +361,7 @@ module Railwatch
         # raise here and be retained as if it had failed.
         Railwatch.debug { "ingest rejected #{result.rejected} of #{batch.records.size} records" } if result.rejected.to_i.positive?
         delivery_succeeded
+        refusal_ended if @refusal
       elsif retryable?(result)
         retain(batch, result)
       else
@@ -370,22 +384,33 @@ module Railwatch
     end
 
     def retain(batch, result)
+      refused_until = result.retry_after_at if result.respond_to?(:retry_after_at)
+      refusal = nil
       gave_up = @mutex.synchronize do
         @in_flight_records = 0
         @in_flight_dropped = 0
         @in_flight_bytes = 0
         @in_flight_dropped_bytes = 0
+        if refused_until && !@refusal
+          refusal = @refusal = Refusal.new(started_at: Clock.monotonic, reason: failure_detail(result),
+                                           overflowed: @buffer.overflowed, sampled_out: @sampled_out, gave_up: 0)
+          # Nothing leaves this buffer until the receiver accepts again, and
+          # with retries now seconds apart, so are the flush ticks that would
+          # otherwise double the factor up to here. They hold it there.
+          @backpressure_factor = MAX_BACKPRESSURE_FACTOR if @config.backpressure
+        end
         @retry_attempt += 1
         if @retry_attempt > MAX_RETRY_ATTEMPTS
           @buffer.account_dropped(batch.records.size + batch.dropped,
                                   bytes: batch.bytes + batch.dropped_bytes)
+          @refusal.gave_up += batch.records.size if @refusal
           @retry_attempt = 0
           @retry_at = nil
           Railwatch.debug { "gave up on a batch of #{batch.records.size} records after #{MAX_RETRY_ATTEMPTS} retries (#{result.error || result.status}); dropped and counted" }
           next true
         end
         @retry_batch = batch
-        delay = retry_delay(@retry_attempt)
+        delay = refused_until ? refused_delay(refused_until) : retry_delay(@retry_attempt)
         @retry_at = Clock.monotonic + delay
         @wakeup.signal
         Railwatch.debug do
@@ -394,11 +419,21 @@ module Railwatch
         end
         false
       end
+      # From here backpressure samples out executions the app asked to keep,
+      # and the receiver refusing them has no way to count them. Said once
+      # per refusal, and refusal_ended says what it cost.
+      if refusal
+        defer_notification(
+          DeliveryError.new("Railwatch ingest is refusing deliveries (#{refusal.reason}); holding " \
+                            "#{batch.records.size} #{batch.records.size == 1 ? "record" : "records"}" \
+                            "#{" and sampling down" if @config.backpressure} until it accepts again",
+                            status: result.status)
+        )
+      end
       return unless gave_up
 
-      # Losing a batch is not a debug-level event: with an ingest (or an
-      # embedded writer) that never comes back this is the only place the
-      # loss is ever reported, and the dropped counter it leaves behind
+      # Losing a batch is not a debug-level event: with an ingest that never
+      # comes back this is the only place the loss is ever reported, and the dropped counter it leaves behind
       # rides on the NEXT successful delivery, which may never happen.
       #
       # Reported here, after the lock is released, never inside it. The
@@ -420,6 +455,42 @@ module Railwatch
       )
     end
 
+    # The first delivery ingest accepted after refusing. The refusal was the
+    # pressure, so the divisor goes straight back to one, as it went up,
+    # rather than halving over three more flush ticks. A buffer still over
+    # its high-water mark raises it again on the next tick, as it would have
+    # anyway.
+    def refusal_ended
+      refusal, sampled_out, overflowed = @mutex.synchronize do
+        ended = @refusal
+        @refusal = nil
+        [ ended, @sampled_out - ended.sampled_out, @buffer.overflowed - ended.overflowed ]
+      end
+      @backpressure_factor = 1.0
+      dropped = overflowed + refusal.gave_up
+      seconds = (Clock.monotonic - refusal.started_at).round
+      defer_notification(
+        DeliveryError.new("Railwatch ingest is accepting deliveries again after refusing for #{seconds}s; " \
+                          "meanwhile backpressure sampled out #{sampled_out} " \
+                          "#{sampled_out == 1 ? "execution" : "executions"} and #{dropped} " \
+                          "#{dropped == 1 ? "record was" : "records were"} dropped",
+                          records: dropped)
+      )
+    end
+
+    # Never sooner than the ladder's rung either, so a receiver answering
+    # "Retry-After: 0" gets backoff, not a loop.
+    def refused_delay(retry_after_at)
+      wanted = retry_after_at - Time.now
+      return MAX_REFUSED_RETRY_DELAY * (0.5 + @random.rand * 0.5) if wanted > MAX_REFUSED_RETRY_DELAY
+
+      [ wanted, retry_delay(@retry_attempt) ].max.clamp(0.0, MAX_REFUSED_RETRY_DELAY)
+    end
+
+    def failure_detail(result)
+      [ result.status && "HTTP #{result.status}", result.error ].compact.reject { |part| part.to_s.empty? }.join(": ")
+    end
+
     def discard_unauthorized
       batch = drain_into_flight
       delivery_succeeded