ros-apartment 4.0.0.alpha10 → 4.0.0.alpha12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d24210e257a6f61365a496b60f54762e4b0e9d5ef6f652d77891455fba01d6a4
-  data.tar.gz: dd1eb795e6ca4c9bc2b22377b2feb7fd8bd9fc66efdd3d1eaaeab891bd4fa7d3
+  metadata.gz: 2bb81b710aa16f388e8861ad84d358eee5ec751ff6cce1ad3121513e9a0ef46e
+  data.tar.gz: 49adf108763c408b893a314f223756697ccaf21b950087656b357aeb93f33dcd
 SHA512:
-  metadata.gz: 2397d625268ff6c241eb7886834f99383e650a9613048d0c8d99594083d7cb450e3b328279f56d7c14b3babf70e9ca03069b5c5c507f3a3f06591a429c8283e8
-  data.tar.gz: 57ef4cf17beff1ee06a8abdaff9303b114be190c962f829de2465e766b1235664718e1bb534c8bee715657dbea45512c116f1467d20a287f7ea7c55e164822aa
+  metadata.gz: 773ee7eff98a2f2287c53aef4b1b8172c97b2251c3d82e3f4b099e60b9602f7093cec92b8bdef9669d71a864bece4f767a2ba7dad9109816a80e8478b6087ed7
+  data.tar.gz: 1cf4884cd5b476e57481e8f928c39575e95cdc75249b86fa24dbfeb6885d28f9af1567795f22d1d71270cd402755711727f6614ecc566998d85a47cae780635c

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2010-2026 Ryan Brunner, Brad Robertson, Rui Baltazar, Mauricio Novelo, and the ros-apartment contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -3,6 +3,7 @@
 [![Gem Version](https://badge.fury.io/rb/ros-apartment.svg)](https://badge.fury.io/rb/ros-apartment)
 [![CI](https://github.com/rails-on-services/apartment/actions/workflows/ci.yml/badge.svg)](https://github.com/rails-on-services/apartment/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/rails-on-services/apartment/graph/badge.svg?token=Q4I5QL78SA)](https://codecov.io/gh/rails-on-services/apartment)
+[![Greptile: The War on Bugs](https://www.greptile.com/badge.svg)](https://www.greptile.com/?utm_source=oss_badge&utm_medium=readme&utm_campaign=greptile_for_open_source)
 
 *Database-level multitenancy for Rails and ActiveRecord*
 
@@ -487,4 +488,4 @@ application code with the standard `Exclude:` keys if needed. See
 
 ## License
 
-[MIT License](http://www.opensource.org/licenses/MIT)
+MIT — see [LICENSE](LICENSE). SPDX identifier: `MIT`.

data/lib/apartment/CLAUDE.md

@@ -21,6 +21,7 @@ lib/apartment/
 ├── elevators/             # Rack middleware for tenant detection (see CLAUDE.md); v4 uses constructor keyword args, no class-level state; Generic, Subdomain, FirstSubdomain, Domain, Host, HostHash, Header
 ├── patches/               # ActiveRecord patches for tenant-aware connections
 │   ├── connection_handling.rb # Prepends on AR::Base — tenant-aware connection_pool
+│   ├── connection_registry.rb # Prepends on AR's PoolManager + ConnectionHandler — serializes the pool registry
 │   └── postgresql_sequence_name.rb # Prepends on the PG adapter — schema-agnostic Model.sequence_name memoization
 ├── tasks/                 # Rake task utilities; v4.rake for apartment:create/drop/migrate/seed/rollback
 ├── config.rb              # Configuration with validate!/freeze!
@@ -62,6 +63,16 @@ lib/apartment/
 
 `Concurrent::Map` storing connection pools by tenant key. Monotonic clock timestamps for idle/LRU tracking. `stats_for` returns `{ seconds_idle: N }`. `clear` disconnects all pools before clearing. When a pool budget is configured (`max_tenant_pools` and/or `max_tenant_connections`, resolved by `Config#effective_pool_budget`; `max_total_connections` is the deprecated alias of `max_tenant_pools`), `Apartment.configure` wires an `admission_controller` (the reaper) so cold creates route through a serialized, capacity-bounded path; otherwise the lock-free `compute_if_absent` fast path is used. See `docs/designs/pool-connection-budget.md` and `docs/designs/pool-admission-control.md`.
 
+### patches/connection_registry.rb — AR Registry Serialization
+
+Rails' `ActiveRecord::ConnectionAdapters::PoolManager` (**not** Apartment's same-named class — always fully qualify inside `Apartment::Patches`) stores every pool in a plain nested Hash, unsynchronized, because upstream only writes it at boot. Pool-per-tenant writes it forever, so a cold tenant switch could add a shard key while another thread was iterating, and MRI's iteration guard (per-Hash, not per-thread) failed the *switch* with `RuntimeError: can't add a new key into hash during iteration`.
+
+The readers are Rails' own, all reaching the registry through `ConnectionHandler#each_connection_pool`: `ActiveRecord::QueryCache.run` (every executor run — the start of every request and job), `ConnectionPool::ExecutorHooks.complete` (every executor completion), `Base.clear_query_caches_for_current_thread` (after writes), `ActiveRecord.all_open_transactions`, and `clear_active_connections!` / `clear_all_connections!` / `flush_idle_connections!`. **Not** AR's `ConnectionPool::Reaper` — verified across 7.2/8.0/8.1, it keeps a private mutex-protected `WeakRef` list per reaping frequency and never touches this registry. Target the readers above when reasoning about synchronization or writing regression tests.
+
+`ConnectionRegistry.apply!` (called by `activate!`) prepends two wrappers sharing one process-wide `Monitor`: `PoolManagerSync` over all eight `PoolManager` accessors — reads included, because the outer Hash's default proc mutates on a miss — and `HandlerSync` over `ConnectionHandler#set_pool_manager` (kept `private`), whose `||=` is a non-atomic upsert. `each_pool_config` snapshots under the lock and yields outside it; never hold this lock across a caller's block, since Rails disconnects pools inside those blocks. `SYNC` is a **leaf lock** — nothing acquired under it, no IO under it — which is the whole deadlock-freedom argument.
+
+`serialize!` **fails closed**: it resolves each guarded method with `method_defined?` / `private_method_defined?` (matching what `super` actually needs, so an upstream method merely *moved* to a superclass or module still counts) and raises `Apartment::ConfigurationError` at `activate!` when one is genuinely gone. It only *warns* when upstream has grown a public accessor we do not guard — a hole beats a boot failure. See `docs/designs/ar-connection-registry-thread-safety.md`.
+
 ### pool_reaper.rb — Pool Eviction + Admission
 
 Background `Concurrent::TimerTask` that evicts idle and excess tenant pools, and also serves as the pool manager's synchronous admission controller (`admit!`) when a cap is configured — evicting the LRU idle pool inline before a new one is established, applying `pool_overflow_policy` (`:evict_idle` / `:raise`) when no idle pool can be freed. A single `evict_tenant` primitive backs the timer (idle/LRU) and admission paths. Reap cadence (`interval`/`reaper_interval`) is decoupled from the idle window (`idle_timeout`/`pool_idle_timeout`). Created by `Apartment.configure`, stored as `Apartment.pool_reaper`. Deregisters evicted pools from AR's ConnectionHandler. Default tenant is never evicted.
@@ -86,9 +97,13 @@ All inherit from `AbstractAdapter`. Override `resolve_connection_config`, `creat
 
 **Identity:** `apartment_pinned?` — the class answers whether it is pinned (ivars + superclass walk). `Apartment.pinned_model?(klass)` delegates to `klass.apartment_pinned?` when the concern is included; otherwise it falls back to registry lookup (`pinned_models`) for `excluded_models` shim classes that never included the concern.
 
-**Table naming:** `apartment_explicit_table_name?` — whether `self.table_name` was explicitly set vs convention (compares `@table_name` to `compute_table_name`). Lives here so adapters do not read `@table_name` or call `compute_table_name` from outside; **class instance variable access for pinning is confined to this concern**.
+**Table naming:** `apartment_explicit_table_name?` — whether the cached `@table_name` is one Rails' convention machinery would rebuild (compares `@table_name` to `compute_table_name`). Lives here so adapters do not read `@table_name` or call `compute_table_name` from outside; **class instance variable access for pinning is confined to this concern**. It selects a **restore** strategy only — it is *not* a qualification discriminator, and using it as one shipped three silent no-ops (see `docs/designs/v4-shared-pinned-connections.md`): `compute_table_name` honours `full_table_name_prefix` only on its `base_class?` branch, so prefix-based qualification is discarded outright for subclasses and for models whose module parent defines `table_name_prefix`. Qualification always assigns `table_name` directly.
+
+**Lifecycle:** `apartment_pinned_processed?`, `apartment_mark_processed!`, `apartment_restore!` — qualification state and teardown. Paths are `:computed` (convention rebuilds the name; restore drops the `@table_name` override and recomputes), `:explicit` (restore assigns the saved name back verbatim), `:prefix` (abstract base; restore puts back the app's `table_name_prefix`), and `nil` (separate-pool; nothing to undo). **Abstract bases are the one case still qualified via `table_name_prefix`**, because `pin_tenant` early-returns once a superclass is pinned — so concrete descendants are never registered and only a `class_attribute` broadcast reaches them. Adapters call these; `Apartment.clear_config` uses `apartment_restore!` with `respond_to?` so shim-registered models without the concern still clear safely. `apartment_mark_pinned!` — sets the pinned flag without triggering processing (used by `process_pinned_model` for shim classes to avoid `pin_tenant` recursion).
+
+**Subclasses of a pinned model:** `pin_tenant` is idempotent **per class**, not per hierarchy — it keys on the class's own flag, not `apartment_pinned?` (which walks the superclass chain). A subclass declaring its own table must register and qualify on its own merits, since the parent's qualification cannot reach a different table; keying on the chain made that call silently no-op. A subclass that *shares* the parent's table still needs nothing and is skipped at qualification time by `AbstractAdapter#inherits_pinned_table?`. A subclass that declares its own table and is never registered gets a boot warning (`warn_unregistered_pinned_subclasses`, descendants-based, so complete only under eager loading). See `docs/designs/v4-shared-pinned-connections.md`.
 
-**Lifecycle:** `apartment_pinned_processed?`, `apartment_mark_processed!`, `apartment_restore!` — qualification state and teardown. Adapters call these; `Apartment.clear_config` uses `apartment_restore!` with `respond_to?` so shim-registered models without the concern still clear safely. `apartment_mark_pinned!` — sets the pinned flag without triggering processing (used by `process_pinned_model` for shim classes to avoid `pin_tenant` recursion).
+**Descendant memos:** Rails memoizes `@table_name` per class and never invalidates a descendant's copy when an ancestor changes, so an early read (initializer, gem, route constraint) would freeze the *unqualified* name and the pinned model would read the tenant's table forever. `qualify_pinned_table_name` and `apartment_restore!` bracket their mutation with `apartment_descendants_inheriting_table_name` (collected **before**, while a stale memo is still distinguishable from a declaration) and `apartment_resync_descendant_table_names!` (`reset_table_name` after, which clears `@quoted_table_name`/`@arel_table` via Rails' own setter).
 
 **Guards:** `pin_tenant` raises `ArgumentError` if called on a non-AR class or module. For anonymous classes (`Class.new`), it warns that `TracePoint(:end)` won't fire and skips deferral; call `process_pinned_model` explicitly after assigning the constant.
 

data/lib/apartment/adapters/abstract_adapter.rb

@@ -148,12 +148,96 @@ module Apartment
         !tenant_container_exists?(tenant)
       end
 
-      # Qualify a pinned model's table_name so it targets the default
-      # tenant's tables from any tenant connection. Subclasses must
-      # implement when shared_pinned_connection? returns true.
-      def qualify_pinned_table_name(_klass)
+      # The namespace that makes the default tenant's tables reachable from any
+      # tenant connection — a schema (PostgreSQL) or a database (MySQL).
+      # Subclasses must implement when shared_pinned_connection? returns true.
+      def pinned_table_qualifier
         raise(NotImplementedError,
-              "#{self.class}#qualify_pinned_table_name must be implemented when shared_pinned_connection? is true")
+              "#{self.class}#pinned_table_qualifier must be implemented when shared_pinned_connection? is true")
+      end
+
+      # Qualify a pinned model's table_name so it targets the default tenant's
+      # tables from any tenant connection.
+      #
+      # Always assigns table_name directly. The tempting alternative — set
+      # table_name_prefix and let Rails recompose — is unsound, because
+      # compute_table_name only consults full_table_name_prefix on its
+      # base_class? branch:
+      #
+      #   * a class that is not its own base_class gets base_class.table_name
+      #     verbatim, so the prefix is discarded outright;
+      #   * full_table_name_prefix prefers the first module parent that responds
+      #     to table_name_prefix, so an engine-namespaced model ignores the
+      #     prefix set on the class itself;
+      #   * overwriting the prefix drops one the app set, silently retargeting
+      #     the model at a different table.
+      #
+      # Each case left the model resolving to the *tenant's* table with no
+      # error. Reading table_name first lets Rails compute the conventional
+      # name — honouring any prefix, suffix, or nesting the app declared —
+      # before we qualify the result.
+      def qualify_pinned_table_name(klass)
+        # Captured before the mutation below: afterwards there is no way to
+        # tell a descendant's stale memo from a table it declared itself.
+        inheriting = klass.apartment_descendants_inheriting_table_name
+        apply_pinned_qualification(klass)
+        klass.apartment_resync_descendant_table_names!(inheriting)
+      end
+
+      def apply_pinned_qualification(klass)
+        return qualify_pinned_table_name_prefix(klass) if klass.abstract_class?
+        return klass.apartment_mark_processed! if inherits_pinned_table?(klass)
+
+        # Captured before the assignment below, which would otherwise make
+        # every model look explicitly named.
+        path = klass.apartment_explicit_table_name? ? :explicit : :computed
+        original = klass.table_name
+        klass.table_name = "#{pinned_table_qualifier}.#{original.sub(/\A[^.]+\./, '')}"
+        klass.apartment_mark_processed!(path, (original if path == :explicit))
+      end
+
+      # An abstract class has no table of its own — table_name is nil — so
+      # there is nothing to assign. Pinning one is a supported pattern (an
+      # abstract `connects_to` base is pinned so Apartment does not build
+      # tenant pools for it), and its qualifier still has to reach the concrete
+      # descendants that inherit the pin.
+      #
+      # Those descendants are never qualified directly: pin_tenant early-returns
+      # once any superclass is pinned (apartment_pinned? walks the chain), so
+      # they are never registered and process_pinned_models never sees them.
+      # table_name_prefix is a class_attribute, so setting it here broadcasts
+      # down the inheritance chain and each descendant composes it in its own
+      # compute_table_name. Any prefix the app set is preserved rather than
+      # overwritten, so `myapp_` becomes `<qualifier>.myapp_`.
+      #
+      # This is the one place the prefix mechanism is still correct, because
+      # here it is a broadcast to other classes rather than an attempt to
+      # qualify this class's own name.
+      def qualify_pinned_table_name_prefix(klass)
+        original_prefix = klass.table_name_prefix
+        klass.table_name_prefix = "#{pinned_table_qualifier}.#{original_prefix}"
+        klass.apartment_mark_processed!(:prefix, original_prefix)
+      end
+
+      # Whether +klass+ reaches its table through an already-pinned base class
+      # and so needs no qualification of its own. Rails resolves a subclass's
+      # table through base_class.table_name, which the base's qualification
+      # already covers; assigning here would freeze a copy of the base's
+      # qualified name onto the child and desynchronise the two on teardown.
+      #
+      # Scoped narrowly on purpose. A subclass that declares its own table —
+      # the transitional shape when migrating an STI child off a pinned
+      # parent's table — is NOT covered and qualifies normally, because the
+      # parent's qualification cannot reach a different table. And a subclass
+      # whose base class is not pinned (e.g. an app model extending a gem's
+      # model) is not covered either, which is the case that motivated
+      # qualifying by assignment in the first place.
+      def inherits_pinned_table?(klass)
+        return false if klass.base_class?
+        return false if klass.apartment_explicit_table_name?
+
+        base = klass.base_class
+        base.respond_to?(:apartment_pinned?) && base.apartment_pinned?
       end
 
       # Process all pinned models. When shared_pinned_connection? is true, qualifies
@@ -167,6 +251,86 @@ module Apartment
           raise(Apartment::ConfigurationError,
                 "Failed to process pinned model #{klass.name}: #{e.class}: #{e.message}")
         end
+
+        warn_unregistered_pinned_subclasses
+      end
+
+      # Warn about subclasses of a pinned model that declare their own table and
+      # were never registered. Such a class inherits apartment_pinned? through
+      # the superclass walk but gets no qualification, so on a shared-connection
+      # adapter it silently reads the *tenant's* table — and on a separate-pool
+      # adapter a genuinely tenant-scoped one silently reads the default's. The
+      # shape is transitional (migrating an STI child off a pinned parent's
+      # table), which is exactly when a silent read is most costly: the symptom
+      # looks like a botched backfill.
+      #
+      # Detection walks descendants, so it is complete under eager loading
+      # (production boot, CI) and partial under Zeitwerk lazy loading. That is
+      # tolerable for a warning and would not be for a raise — which is why this
+      # warns rather than raising.
+      # descendants is transitive, so every pinned class in one inheritance
+      # chain sees the same unregistered descendant. Deduplicate, and attribute
+      # each warning to the *nearest* pinned ancestor — the one whose pin the
+      # subclass actually inherits — so the message is deterministic rather than
+      # dependent on registry iteration order.
+      def warn_unregistered_pinned_subclasses
+        # Snapshot the registry and walk it outside its own lock. Concurrent::Set
+        # synchronizes every method on CRuby, #each included, so iterating in
+        # place would hold a process-wide monitor across descendant walking and
+        # stderr I/O. Same leaf-lock discipline as Patches::ConnectionRegistry.
+        pinned = Apartment.pinned_models.to_a
+        registered = Set.new(pinned)
+        seen = Set.new
+
+        pinned.each do |klass|
+          next unless klass.respond_to?(:descendants)
+
+          klass.descendants.each do |sub|
+            check_pinned_subclass(klass, sub, registered) if seen.add?(sub)
+          end
+        end
+      end
+
+      # Advisory only: this runs from process_pinned_models, which Tenant.init
+      # calls in after_initialize, so it must never be able to fail a boot.
+      # Rails' naming machinery raises on shapes we do not control — an
+      # anonymous descendant has no model_name, and Class.new(SomeBase) is
+      # everywhere in test suites.
+      def check_pinned_subclass(klass, sub, registered)
+        return unless unregistered_pinned_subclass?(sub, registered)
+
+        warn_unqualified_subclass(nearest_pinned_ancestor(sub, registered) || klass, sub)
+      rescue StandardError => e
+        warn "[Apartment] could not check pinned subclass #{sub.inspect}: #{e.class}: #{e.message}"
+      end
+
+      # The closest registered ancestor above +klass+, i.e. the pin it inherits.
+      def nearest_pinned_ancestor(klass, registered)
+        ancestor = klass.superclass
+        while ancestor.is_a?(Class) && ancestor < ActiveRecord::Base
+          return ancestor if registered.include?(ancestor)
+
+          ancestor = ancestor.superclass
+        end
+        nil
+      end
+
+      def unregistered_pinned_subclass?(sub, registered)
+        return false if registered.include?(sub)
+        # Anonymous classes have no model_name for Rails to compute a table
+        # from, and nothing actionable to name in a warning.
+        return false if sub.name.nil?
+        return false unless sub.respond_to?(:apartment_explicit_table_name?)
+        return false if sub.abstract_class?
+
+        sub.apartment_explicit_table_name?
+      end
+
+      def warn_unqualified_subclass(klass, sub)
+        warn "[Apartment] #{sub.name || sub.inspect} inherits a pin from " \
+             "#{klass.name || klass.inspect} but declares its own table " \
+             "(#{sub.table_name}) and was never registered, so it is not qualified. " \
+             "Call pin_tenant on it if it should read the default tenant's data."
       end
 
       # Process a single pinned model. Called by process_pinned_models (batch)
@@ -187,6 +351,14 @@ module Apartment
 
         return if klass.apartment_pinned_processed?
 
+        # A subclass that reaches its table through an already-pinned base needs
+        # nothing on either path. Qualifying would freeze a copy of the base's
+        # name onto it; establishing a connection would hand it a *different*
+        # pool from its parent, splitting two classes that share one physical
+        # table across connections and breaking transactional integrity between
+        # them. Mark processed with a nil path so teardown skips it too.
+        return klass.apartment_mark_processed! if inherits_pinned_table?(klass)
+
         if shared_pinned_connection?
           qualify_pinned_table_name(klass)
         else

data/lib/apartment/adapters/mysql2_adapter.rb

@@ -14,20 +14,10 @@ module Apartment
         !Apartment.config.force_separate_pinned_pool
       end
 
-      def qualify_pinned_table_name(klass)
-        db_name = base_config['database']
-
-        if klass.apartment_explicit_table_name?
-          original = klass.table_name
-          table = original.sub(/\A[^.]+\./, '')
-          klass.table_name = "#{db_name}.#{table}"
-          klass.apartment_mark_processed!(:explicit, original)
-        else
-          original_prefix = klass.table_name_prefix
-          klass.table_name_prefix = "#{db_name}."
-          klass.reset_table_name
-          klass.apartment_mark_processed!(:convention, original_prefix)
-        end
+      # Pinned tables live in the default tenant's database; every tenant
+      # connection can reach them by database-qualifying the name.
+      def pinned_table_qualifier
+        base_config['database']
       end
 
       def resolve_connection_config(tenant, base_config: nil)

data/lib/apartment/adapters/postgresql_schema_adapter.rb

@@ -18,18 +18,10 @@ module Apartment
         !Apartment.config.force_separate_pinned_pool
       end
 
-      def qualify_pinned_table_name(klass)
-        if klass.apartment_explicit_table_name?
-          original = klass.table_name
-          table = original.sub(/\A[^.]+\./, '')
-          klass.table_name = "#{default_tenant}.#{table}"
-          klass.apartment_mark_processed!(:explicit, original)
-        else
-          original_prefix = klass.table_name_prefix
-          klass.table_name_prefix = "#{default_tenant}."
-          klass.reset_table_name
-          klass.apartment_mark_processed!(:convention, original_prefix)
-        end
+      # Pinned tables live in the default tenant's schema; every tenant
+      # connection can reach them by schema-qualifying the name.
+      def pinned_table_qualifier
+        default_tenant
       end
 
       def resolve_connection_config(tenant, base_config: nil)

data/lib/apartment/concerns/model.rb

@@ -16,12 +16,23 @@ module Apartment
       # their connection always targets the default tenant's database/schema.
       #
       # Safe to call before or after Apartment.activate!.
-      # Idempotent: no-op if this class (or a parent) is already pinned.
+      # Idempotent per class: a second call on the same class is a no-op.
+      #
+      # Deliberately keyed on this class's own flag, NOT on apartment_pinned?
+      # (which walks the superclass chain). A subclass of a pinned model that
+      # declares its own table has to be registered and qualified on its own
+      # merits — the parent's qualification cannot reach a different table.
+      # Keying on the chain made that call accept-and-do-nothing, which is the
+      # wrong answer even for a shape apps should avoid: an API call must
+      # either work or be absent, never silently no-op. Subclasses that share
+      # the parent's table still need nothing, and are skipped at
+      # qualification time rather than here (see
+      # AbstractAdapter#inherits_pinned_table?).
       def pin_tenant
         unless is_a?(Class) && self < ActiveRecord::Base
           raise(ArgumentError, "pin_tenant can only be called on ActiveRecord model classes, got #{inspect}")
         end
-        return if apartment_pinned?
+        return if @apartment_pinned
 
         @apartment_pinned = true
         Apartment.register_pinned_model(self)
@@ -54,10 +65,21 @@ module Apartment
         superclass.apartment_pinned?
       end
 
-      # Whether this model has an explicit self.table_name = assignment
-      # (as opposed to Rails' lazy convention computation). Returns false
-      # if the explicit value matches what convention would produce, since
-      # the convention path handles that case correctly.
+      # Whether this model's current table_name would survive a recomputation
+      # — i.e. whether Rails' convention machinery reproduces the value now
+      # cached in @table_name. False means convention rebuilds it exactly, so
+      # qualification can be undone by discarding the override; true means the
+      # name must be saved verbatim and restored verbatim.
+      #
+      # This answers a *restore* question. It is deliberately NOT a
+      # qualification discriminator: a table_name that matches convention is no
+      # evidence that setting table_name_prefix would qualify the model. Rails
+      # ignores the prefix outright for any class that is not its own
+      # base_class (compute_table_name returns base_class.table_name verbatim),
+      # and full_table_name_prefix prefers a module parent's prefix over the
+      # class's own. Qualification therefore always assigns table_name
+      # directly — see AbstractAdapter#qualify_pinned_table_name.
+      #
       # NOTE: compute_table_name is a private Rails API; tested against
       # Rails main as a canary in CI.
       def apartment_explicit_table_name?
@@ -66,40 +88,110 @@ module Apartment
         instance_variable_get(:@table_name) != send(:compute_table_name)
       end
 
+      # Descendants that reach their table name through this class rather than
+      # declaring one of their own, and have already memoized it.
+      #
+      # Rails memoizes @table_name per class on first read and never
+      # invalidates a descendant's copy when an ancestor's name or prefix
+      # changes. Anything touching a descendant's table_name before
+      # qualification runs — an initializer, a gem, a route constraint, a
+      # descendants sweep — freezes the pre-qualification name, and the model
+      # then resolves to the wrong tenant's table for the life of the process.
+      #
+      # MUST be called BEFORE the ancestor is mutated: afterwards
+      # apartment_explicit_table_name? can no longer distinguish a stale memo
+      # from a genuine declaration, since the ancestor's change has moved what
+      # convention computes. Descendants without a memo are omitted — they
+      # compute lazily and will pick the new value up on their own.
+      def apartment_descendants_inheriting_table_name
+        return [] unless respond_to?(:descendants)
+
+        stale = descendants.select do |sub|
+          sub.instance_variable_defined?(:@table_name) &&
+            sub.respond_to?(:apartment_inherited_table_name) &&
+            sub.instance_variable_get(:@table_name) == sub.apartment_inherited_table_name
+        rescue StandardError
+          # Rails' naming machinery raises on shapes we do not control (an
+          # anonymous class has no model_name). Skip rather than guess.
+          false
+        end
+
+        # Reset an intermediate before anything beneath it: reset_table_name on
+        # a class under an abstract parent reads superclass.table_name — the
+        # memo, not base_class — so a grandchild reset first would re-freeze its
+        # parent's stale value. ActiveSupport's descendants happens to be
+        # ancestor-first today, but that ordering is undocumented.
+        stale.sort_by { |sub| sub.ancestors.size }
+      end
+
+      # What Rails' own reset_table_name would recompute for this class right
+      # now. Mirrors ActiveRecord::ModelSchema#reset_table_name deliberately.
+      #
+      # NOT compute_table_name: the two disagree for a class whose superclass
+      # is abstract. reset_table_name prefers `superclass.table_name`, while
+      # compute_table_name treats such a class as its own base_class and builds
+      # from its own model_name. So a concrete class under an abstract
+      # intermediate that carries a table (an abstract class sandwiched under a
+      # concrete pinned parent) inherits `foos` but computes `gkids` — and
+      # keying on compute_table_name misreads that inherited name as an
+      # explicit declaration, skipping the resync and leaving the model on the
+      # tenant's table.
+      def apartment_inherited_table_name
+        if abstract_class?
+          superclass.table_name
+        elsif superclass.abstract_class?
+          superclass.table_name || send(:compute_table_name)
+        else
+          send(:compute_table_name)
+        end
+      end
+
+      # Recompute the table name of each descendant captured above, now that
+      # this class has changed. reset_table_name goes through Rails' own
+      # table_name= setter, so the derived @quoted_table_name and @arel_table
+      # caches are cleared with it.
+      def apartment_resync_descendant_table_names!(subclasses)
+        subclasses.each do |sub|
+          sub.reset_table_name
+        rescue StandardError => e
+          warn "[Apartment] could not reset table name for #{sub.name || sub.inspect}: " \
+               "#{e.class}: #{e.message}"
+        end
+      end
+
       # Whether process_pinned_model has already run for this class.
       def apartment_pinned_processed?
         @apartment_pinned_processed == true
       end
 
-      # Record that qualification has been applied, and what path was used.
+      # Record that qualification has been applied, and how it must be undone.
       # Called by qualify_pinned_table_name (adapters) after mutations succeed,
       # or by process_pinned_model after establish_connection on separate-pool path.
+      #
+      # :computed — the pre-qualification name was reproducible by convention;
+      #   restore by discarding the override and recomputing.
+      # :explicit — the name was assigned in a way convention cannot rebuild;
+      #   +original_value+ is that name, restored verbatim.
+      # :prefix — an abstract base, qualified by broadcasting through
+      #   table_name_prefix to the descendants that inherit its pin;
+      #   +original_value+ is the prefix the app had set.
+      # nil — separate-pool models; nothing to undo.
       def apartment_mark_processed!(path = nil, original_value = nil)
         @apartment_pinned_processed = true
         @apartment_qualification_path = path
         case path
         when :explicit then @apartment_original_table_name = original_value
-        when :convention then @apartment_original_table_name_prefix = original_value
+        when :prefix then @apartment_original_table_name_prefix = original_value
         end
       end
 
       # Undo table name qualification and clear tracking state.
-      # Convention path: restore original prefix so reset_table_name recomputes.
-      # Explicit path: restore the original table_name that was overwritten.
-      # nil path: separate-pool models — no table name changes to undo.
       def apartment_restore!
         return unless @apartment_pinned_processed
 
-        case @apartment_qualification_path
-        when :convention
-          self.table_name_prefix = @apartment_original_table_name_prefix || ''
-          reset_table_name
-        when :explicit
-          self.table_name = @apartment_original_table_name if @apartment_original_table_name
-        when nil then nil
-        else
-          warn "[Apartment] #{name}: unexpected qualification_path #{@apartment_qualification_path.inspect}"
-        end
+        inheriting = apartment_descendants_inheriting_table_name
+        apartment_undo_qualification!
+        apartment_resync_descendant_table_names!(inheriting)
 
         @apartment_pinned_processed = nil
         @apartment_qualification_path = nil
@@ -109,6 +201,31 @@ module Apartment
 
       private
 
+      # Reverse whichever mutation qualify_pinned_table_name applied.
+      def apartment_undo_qualification!
+        case @apartment_qualification_path
+        when :computed then apartment_recompute_table_name!
+        when :explicit then apartment_restore_table_name!
+        when :prefix then self.table_name_prefix = @apartment_original_table_name_prefix || ''
+        when nil then nil
+        else
+          warn "[Apartment] #{name}: unexpected qualification_path #{@apartment_qualification_path.inspect}"
+        end
+      end
+
+      # Drop the qualified override and recompute from convention. The ivar is
+      # removed first so nothing can keep the qualified value; the recompute
+      # then runs through Rails' table_name= setter, which also clears the
+      # derived @quoted_table_name and @arel_table caches.
+      def apartment_recompute_table_name!
+        remove_instance_variable(:@table_name) if instance_variable_defined?(:@table_name)
+        reset_table_name
+      end
+
+      def apartment_restore_table_name!
+        self.table_name = @apartment_original_table_name if @apartment_original_table_name
+      end
+
       # Register a one-shot TracePoint(:end) that fires after the class body
       # closes. Only :end is used — :b_return fires for ALL block returns in
       # class context (each, tap, include hooks) and would trigger prematurely.

data/lib/apartment/patches/connection_registry.rb

@@ -0,0 +1,284 @@
+# frozen_string_literal: true
+
+require 'monitor'
+require_relative '../errors'
+
+module Apartment
+  module Patches
+    # Serializes access to ActiveRecord's connection registry so pool-per-tenant
+    # can register and discard shards from many threads at once.
+    #
+    # THE REGISTRY. ActiveRecord::ConnectionAdapters::PoolManager (the Rails
+    # class, not Apartment's same-named one) indexes every pool AR knows about as
+    # a plain nested Hash, +{ role => { shard => pool_config } }+, with no
+    # synchronization of any kind. Rails can afford that because upstream writes
+    # it only at boot: +establish_connection+ runs from initializers and from
+    # +connects_to+, single-threaded, and after boot the structure is read-only.
+    #
+    # WHY v4 CANNOT. A tenant pool is established lazily, on the thread that
+    # first routes to that tenant, for the life of the process — so every cold
+    # tenant switch adds a shard key to that Hash while other threads are reading
+    # it. MRI's per-Hash iteration guard turns the collision into a hard failure
+    # in the WRITER: `RuntimeError: can't add a new key into hash during
+    # iteration`, surfaced by Apartment as a failed tenant switch. The readers are
+    # routine and unavoidable, all via ConnectionHandler#each_connection_pool:
+    # ActiveRecord::QueryCache.run on every executor run (the start of every
+    # request and job), ConnectionPool::ExecutorHooks.complete on every executor
+    # completion, Base.clear_query_caches_for_current_thread after writes,
+    # ActiveRecord.all_open_transactions for transaction-callback bookkeeping, and
+    # clear_active_connections! / clear_all_connections! /
+    # flush_idle_connections!. (AR's own ConnectionPool::Reaper is NOT one of
+    # them — it keeps a private WeakRef list and never reads this registry.)
+    # Parallel migration is simply the densest producer of cold creates (one
+    # thread per tenant, all establishing at once) and therefore the easiest place
+    # to see it.
+    #
+    # A read can write, too: +get_pool_config+ / +pool_configs+ /
+    # +each_pool_config+ reach the outer Hash through +[]+, whose default proc
+    # (+Hash.new { |h, k| h[k] = {} }+) INSERTS an empty shard map on a miss. So a
+    # lookup for a not-yet-seen role is itself a write, and the guarded set below
+    # is every public accessor rather than only the obvious mutators.
+    #
+    # WHY NOT JUST LOCK APARTMENT'S OWN CALL SITES. Apartment's cold creates are
+    # already serialized against each other — Concurrent::Map's MRI backend holds
+    # a write lock across +compute_if_absent+, and the capacity-bounded path holds
+    # PoolManager's own create mutex. Neither excludes AR's readers, which is the
+    # side of the race that matters, and neither covers the discard half
+    # (+remove_connection_pool+ from Apartment::PoolReaper's timer thread — ours,
+    # not AR's — from AbstractAdapter#drop, from Migrator eviction). The registry
+    # itself is the only place that sees all of it.
+    #
+    # SCOPE. Applied from +Apartment.activate!+, not at gem load: an app that
+    # merely has the gem in its Gemfile should not pay for a lock it does not
+    # need. Prepending affects instances already created (the primary pool's
+    # manager is built during Rails' database initializer, before activate!),
+    # which is why the lock is module-level rather than per-instance state.
+    #
+    # NO DEADLOCK, BY CONSTRUCTION. SYNC is a LEAF lock: every guarded body is an
+    # in-memory Hash operation that acquires nothing else, performs no IO, and
+    # yields to no caller. Keep it that way — it is the entire deadlock-freedom
+    # argument, and Apartment's cold-create path already establishes the one lock
+    # ordering that exists (Concurrent::Map's write lock, or the capped path's
+    # create mutex, is taken FIRST and SYNC underneath it via
+    # establish_connection). Nothing acquires SYNC and then reaches for either.
+    # Upstream cooperates: +remove_pool_config+ returns the pool_config and
+    # +disconnect_pool_from_pool_manager+ calls +disconnect!+ on it only after the
+    # guarded call has returned, and +establish_connection+ builds the pool
+    # (PoolConfig#pool, under PoolConfig's own monitor) after +set_pool_config+
+    # returns — so no pool IO and no other monitor is ever nested under SYNC.
+    #
+    # COST. One uncontended monitor acquire, measured at ~90ns, on registry
+    # operations only. +get_pool_config+ is the hot one (AR resolves it per query
+    # for default-tenant and pinned traffic), where it is noise against even a
+    # cached query. Iteration copies its pool_config list under the lock and
+    # yields outside it, so per-request hooks hold the lock for the length of a
+    # Hash walk and never for the length of a caller's block.
+    module ConnectionRegistry
+      # One monitor for every registry in the process. Instances are few (one per
+      # connection name, so typically one or two) and every guarded operation is
+      # an in-memory Hash op with no IO and no yielding, so per-instance locks
+      # would buy negligible parallelism in exchange for lazy-init state on
+      # objects that already exist by the time the patch is applied.
+      #
+      # Monitor, not Mutex, purely defensively: no guarded method re-enters
+      # another today (each accessor's +super+ reads the Hash directly, and
+      # #each_pool_config yields outside the lock), and establish_connection's
+      # several acquisitions are sequential rather than nested — a Mutex would
+      # work. Reentrance costs nothing measurable here (~90ns either way) and
+      # buys tolerance for an upstream implementation in which one accessor
+      # dispatches through another.
+      SYNC = Monitor.new
+
+      # Every public accessor AR::ConnectionAdapters::PoolManager defines. Both
+      # halves of this claim are enforced at activate! time: a method that has
+      # gone missing raises, and an accessor upstream has ADDED that we therefore
+      # do not guard warns (the patch still works, but there is a hole in it).
+      POOL_MANAGER_METHODS = %i[
+        shard_names
+        role_names
+        pool_configs
+        each_pool_config
+        remove_role
+        remove_pool_config
+        get_pool_config
+        set_pool_config
+      ].freeze
+
+      HANDLER_METHODS = %i[set_pool_manager].freeze
+
+      class << self
+        # Idempotent — prepend on an already-prepended module is a no-op.
+        def apply!
+          serialize!(ActiveRecord::ConnectionAdapters::PoolManager, POOL_MANAGER_METHODS, PoolManagerSync,
+                     exhaustive: true)
+          serialize!(ActiveRecord::ConnectionAdapters::ConnectionHandler, HANDLER_METHODS, HandlerSync)
+          nil
+        end
+
+        private
+
+        # FAILS CLOSED on a shape we cannot serialize. Both wrapper modules work by
+        # +super+, so a guarded method that no longer exists anywhere in the MRO
+        # would be a NoMethodError at first call. Raising here instead is louder and
+        # earlier: activate! runs at boot, from an explicit call, so the operator
+        # learns on deploy that this gem version does not support this ActiveRecord
+        # version. The alternative — warn and continue unpatched — reinstates a race
+        # that fails a fraction of cold tenant switches under load, which is far
+        # harder to attribute. It would also be effectively silent: the Rails-main
+        # CI canary is continue-on-error, so a warning blocks nothing.
+        #
+        # Resolution deliberately uses +method_defined?+, not +instance_methods(false)+:
+        # +super+ dispatches through the whole ancestor chain, so a method upstream
+        # merely MOVED to a superclass or an included module still works through the
+        # wrapper. Testing for a direct definition would refuse a refactor that is
+        # entirely benign, and refusing is now fatal.
+        #
+        # +exhaustive+ additionally warns (never raises) when upstream has grown a
+        # public accessor we do not guard: the patch still does its job, but that
+        # method touches the registry unsynchronized. A warning, not a raise,
+        # because a hole is strictly better than a boot failure — and the unit spec
+        # pins the exact set so it fails in CI first.
+        def serialize!(klass, method_names, wrapper, exhaustive: false)
+          missing = method_names.reject do |name|
+            klass.method_defined?(name) || klass.private_method_defined?(name)
+          end
+
+          unless missing.empty?
+            raise(Apartment::ConfigurationError,
+                  "Apartment cannot serialize #{klass} on ActiveRecord " \
+                  "#{ActiveRecord::VERSION::STRING}: expected method(s) #{missing.join(', ')} " \
+                  'are gone. Pool-per-tenant registers connection pools concurrently and ' \
+                  'this registry is not thread-safe without them. Upgrade ros-apartment to a ' \
+                  'version that supports this ActiveRecord release.')
+          end
+
+          warn_unguarded(klass, method_names, wrapper) if exhaustive
+
+          klass.prepend(wrapper)
+        end
+
+        def warn_unguarded(klass, method_names, wrapper)
+          # instance_methods(false) is the right question HERE (unlike above): it asks
+          # what this class itself declares, and stays correct after prepending
+          # because a prepended module's methods are not the class's own.
+          unguarded = klass.instance_methods(false) - method_names
+          return if unguarded.empty?
+
+          warn "[Apartment] #{klass} on ActiveRecord #{ActiveRecord::VERSION::STRING} declares " \
+               "method(s) #{unguarded.join(', ')} that #{wrapper.name} does not serialize. " \
+               'Concurrent tenant pool creation is protected, but those methods reach the ' \
+               'registry unsynchronized.'
+        end
+      end
+
+      # Guards AR::ConnectionAdapters::PoolManager. Fully qualified everywhere
+      # because the bare constant would resolve to Apartment::PoolManager.
+      module PoolManagerSync
+        def shard_names
+          SYNC.synchronize { super }
+        end
+
+        def role_names
+          SYNC.synchronize { super }
+        end
+
+        def pool_configs(role = nil)
+          SYNC.synchronize { super }
+        end
+
+        def remove_role(role)
+          SYNC.synchronize { super }
+        end
+
+        def remove_pool_config(role, shard)
+          SYNC.synchronize { super }
+        end
+
+        def get_pool_config(role, shard)
+          SYNC.synchronize { super }
+        end
+
+        def set_pool_config(role, shard, pool_config)
+          SYNC.synchronize { super }
+        end
+
+        # Snapshot under the lock, yield outside it. Holding the registry lock
+        # across the caller's block is what makes this dangerous rather than
+        # merely slow: AR's own iterating callers disconnect pools and release
+        # connections inside the block, so the lock would be held across pool
+        # IO while cold creates queue behind it.
+        #
+        # Collected by delegating to +super+ rather than by reading the Hash, so
+        # the snapshot is exactly what upstream would have yielded on this Rails
+        # version. One visible consequence, deliberate: a shard registered
+        # mid-iteration is not yielded (a snapshot, like Concurrent::Map's
+        # iterators elsewhere in Apartment).
+        #
+        # THE RETURN VALUE IS UPSTREAM'S, NOT THE SNAPSHOT. Measured identical on
+        # 7.2 / 8.0 / 8.1: with a block, upstream returns the very Hash it walked
+        # — the inner shard map when a role is given, the outer role map when not
+        # — and the block-less form returns an Enumerator for a role but the outer
+        # Hash (having enumerated nothing) without one. A lock is no reason to
+        # narrow the contract of the method it wraps, and this is a `:nodoc:`
+        # internal that other gems wrap too, so returning our Array would be a
+        # gratuitous difference for anything that ever reads it. AR's own single
+        # caller (ConnectionHandler#each_connection_pool) discards it.
+        #
+        # The two block-less forms need opposite treatment, which is why they are
+        # not one branch:
+        #
+        # WITH a role, upstream's Enumerator is a live view of the inner Hash, and
+        # iterating it later bypasses this wrapper completely — a concurrent
+        # +set_pool_config+ takes SYNC and still mutates the Hash being walked, so
+        # MRI raises in the writer. Probed: the failure is IDENTICAL patched and
+        # unpatched, i.e. delegating here left the original race fully intact on
+        # this path. So we substitute an Enumerator over this method; its deferred
+        # traversal re-enters with a block and goes through the snapshot path
+        # above. Contract preserved — upstream's is an Enumerator too, and +size+
+        # is supplied because upstream's reports the shard count rather than nil.
+        # (Repeated iteration re-snapshots, so it stays a live view like
+        # upstream's, not a frozen one.)
+        #
+        # WITHOUT a role, upstream returns the outer role map and enumerates
+        # nothing whatsoever. There is no traversal to protect and no Enumerator to
+        # match, so substituting one would invent behavior; delegate untouched.
+        def each_pool_config(role = nil, &block)
+          unless block
+            return enum_for(__method__, role) { pool_configs(role).size } if role
+
+            return super
+          end
+
+          snapshot = []
+          upstream_result = SYNC.synchronize { super(role) { |pool_config| snapshot << pool_config } }
+          snapshot.each(&block)
+
+          upstream_result
+        end
+      end
+
+      # Guards the handler's manager cache. +set_pool_manager+ upserts with
+      # +||=+ on a Concurrent::Map: atomic per operation, but a read-then-write
+      # across two, so two threads establishing the first connection for the same
+      # connection name can each build a PoolManager and one is discarded —
+      # silently taking any shard already registered in it with it. Serializing
+      # the whole method makes the upsert atomic.
+      #
+      # Wrapped with argument forwarding rather than a reimplementation because
+      # the signature is version-dependent (AR >= 8.0 passes a ConnectionDescriptor
+      # where 7.2 passed the connection-name String) and the key derivation is
+      # upstream's business, not ours.
+      #
+      # Declared private to match upstream. A prepended method is public by
+      # default, and leaving it so would widen a Rails internal into public API
+      # from a patch whose only job is a lock.
+      module HandlerSync
+        def set_pool_manager(...)
+          SYNC.synchronize { super }
+        end
+
+        private :set_pool_manager
+      end
+    end
+  end
+end

data/lib/apartment/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Apartment
-  VERSION = '4.0.0.alpha10'
+  VERSION = '4.0.0.alpha12'
 end

data/lib/apartment.rb

@@ -191,11 +191,24 @@ module Apartment # rubocop:disable Metrics/ModuleLength
       @activated = false
     end
 
-    # Activate the ConnectionHandling patch on ActiveRecord::Base.
+    # Activate the ActiveRecord patches pool-per-tenant depends on.
     # Idempotent — prepend on an already-prepended module is a no-op.
+    #
+    # ConnectionHandling routes AR::Base.connection_pool to the current tenant's
+    # pool; ConnectionRegistry makes AR's own pool registry safe for the
+    # concurrent shard registration that routing produces. The second is not
+    # optional given the first: without it, a cold tenant switch can fail whenever
+    # any thread happens to be iterating AR's pools — which Rails does through
+    # ConnectionHandler#each_connection_pool at the start of every request or job
+    # (ActiveRecord::QueryCache.run), at the end of every one
+    # (ConnectionPool::ExecutorHooks.complete), and after writes
+    # (clear_query_caches_for_current_thread). NOT from AR's ConnectionPool::Reaper,
+    # which reads a private WeakRef list rather than the registry.
     def activate!
       require_relative('apartment/patches/connection_handling')
+      require_relative('apartment/patches/connection_registry')
       ActiveRecord::Base.singleton_class.prepend(Patches::ConnectionHandling)
+      Patches::ConnectionRegistry.apply!
       @activated = true
     end
 

data/ros-apartment.gemspec

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# SPDX-License-Identifier: MIT
+
 $LOAD_PATH << File.expand_path('lib', __dir__)
 require 'apartment/version'
 
@@ -13,7 +15,9 @@ Gem::Specification.new do |s|
                     'through schema-based or database-based isolation strategies.'
   s.email         = ['ryan@influitive.com', 'brad@influitive.com', 'rui.p.baltazar@gmail.com', 'mauricio@campusesp.com']
 
-  s.files = %w[ros-apartment.gemspec README.md] + `git ls-files -- lib config`.split("\n")
+  # LICENSE ships in the gem deliberately: MIT requires the notice to travel with
+  # every distribution, and RubyGems has no other copy of it.
+  s.files = %w[ros-apartment.gemspec README.md LICENSE] + `git ls-files -- lib config`.split("\n")
   s.require_paths = ['lib']
 
   s.homepage = 'https://github.com/rails-on-services/apartment'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ros-apartment
 version: !ruby/object:Gem::Version
-  version: 4.0.0.alpha10
+  version: 4.0.0.alpha12
 platform: ruby
 authors:
 - Ryan Brunner
@@ -159,6 +159,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- LICENSE
 - README.md
 - config/default.yml
 - lib/apartment.rb
@@ -194,6 +195,7 @@ files:
 - lib/apartment/lifecycle.rb
 - lib/apartment/migrator.rb
 - lib/apartment/patches/connection_handling.rb
+- lib/apartment/patches/connection_registry.rb
 - lib/apartment/patches/live_tenant_propagation.rb
 - lib/apartment/patches/postgresql_sequence_name.rb
 - lib/apartment/pool_manager.rb