wurk 1.1.0 → 1.1.2

data/lib/wurk/fetcher/reliable.rb

@@ -3,6 +3,7 @@
 require 'socket'
 require_relative '../component'
 require_relative '../keys'
+require_relative '../lua'
 require_relative '../fetcher'
 
 module Wurk
@@ -79,19 +80,20 @@ module Wurk
       end
 
       # Called on shutdown for jobs the Processor couldn't finish in time.
-      # One pipelined RPUSH per public queue (head insert) so on next boot
-      # they're picked again ahead of fresh enqueues.
+      # Atomically moves each still-private UoW back to its public queue via
+      # the RELIABLE_REQUEUE Lua (LREM-guarded RPUSH): the job leaves the
+      # per-process private list and reappears on the public queue in one hop,
+      # so it's visible immediately after a deploy instead of waiting for the
+      # next boot's reaper. The guard makes the move idempotent against the
+      # cross-thread `job`-read race in Manager#hard_shutdown — a Processor
+      # that ACKed in that window is a no-op (LREM misses, RPUSH skipped), so a
+      # finished job is never resurrected. Sidekiq Pro super_fetch §3 retains
+      # in-flight in the private list until the next boot; we prefer the
+      # immediate move so a rolling deploy recovers work without a restart.
       def bulk_requeue(in_progress)
         return if in_progress.nil? || in_progress.empty?
 
-        grouped = in_progress.group_by(&:queue)
-        config.redis do |conn|
-          conn.pipelined do |pipe|
-            grouped.each do |public_q, uows|
-              pipe.call('RPUSH', public_q, *uows.map(&:job))
-            end
-          end
-        end
+        config.redis { |conn| requeue_pipelined(conn, in_progress) }
       end
 
       # Prefixed queue keys (`queue:<name>`) in fetch order. Strict mode
@@ -107,12 +109,40 @@ module Wurk
         names.map { |q| "#{Keys::QUEUE_PREFIX}#{q}" }
       end
 
+      # Quiet hook (Manager#quiet). Flips the drain flag so retrieve_work
+      # short-circuits: once quieted, no processor can pull a fresh UoW, even
+      # one sitting in the between-jobs window (Processor#run only re-checks its
+      # own @done between iterations). Quiet is one-way — matches Sidekiq TSTP
+      # (spec §21.3), there is no un-terminate.
       def terminate
         @done = true
       end
 
       private
 
+      # One pipelined RELIABLE_REQUEUE EVALSHA per UoW. Mirrors
+      # Client#push_batched_pipelined: a pipelined EVALSHA surfaces NOSCRIPT
+      # only at finalize (never to eval_cached's inline rescue). Every command
+      # here is the same script, so a flushed cache fails all of them and
+      # applies none — recover by reloading once and replaying the whole
+      # pipeline via source-embedded EVAL.
+      def requeue_pipelined(conn, in_progress, eval_method: :eval_cached)
+        conn.pipelined do |pipe|
+          in_progress.each do |uow|
+            Wurk::Lua::Loader.public_send(
+              eval_method, pipe, :reliable_requeue,
+              keys: [self.class.private_queue_name(uow.queue), uow.queue],
+              argv: [uow.job]
+            )
+          end
+        end
+      rescue RedisClient::CommandError => e
+        raise unless e.message.to_s.start_with?('NOSCRIPT')
+
+        Wurk::Lua::Loader.script_load_all(conn)
+        requeue_pipelined(conn, in_progress, eval_method: :eval_with_source)
+      end
+
       # SMEMBERS of the `paused` SET. One round-trip per fetch pass; the
       # set is tiny in practice (one entry per paused queue) so the cost
       # is dominated by the BLMOVE that follows. Returns a Set for O(1)
@@ -130,9 +160,12 @@ module Wurk
       def blmove(public_q)
         priv = self.class.private_queue_name(public_q)
         timeout = poll_interval
-        # Extend the socket read-timeout past BLMOVE's own timeout so the
-        # default 1s pool timeout doesn't fire before BLMOVE returns.
-        job = config.redis do |conn|
+        # Dedicated fetch pool, not the main one: a parked BLMOVE holds its slot
+        # for the whole block window, so routing it here keeps idle fetchers from
+        # starving the main pool's background loops (#101). Extend the socket
+        # read-timeout one second past BLMOVE's own server-side timeout so the
+        # connection's read timeout can't fire while BLMOVE is legitimately blocked.
+        job = config.fetch_redis do |conn|
           conn.blocking_call(timeout + 1, 'BLMOVE', public_q, priv, 'RIGHT', 'LEFT', timeout)
         end
         job ? UnitOfWork.new(queue: public_q, job: job, config: config) : nil

data/lib/wurk/fetcher.rb

@@ -7,5 +7,10 @@ module Wurk
   class Fetcher
     def retrieve_work; end
     def bulk_requeue(in_progress); end
+
+    # Quiet hook: Manager#quiet calls this so retrieve_work can short-circuit
+    # and stop pulling new work the instant a process is quieted. No-op in the
+    # abstract base; Reliable flips its drain flag.
+    def terminate; end
   end
 end

data/lib/wurk/health.rb

@@ -28,40 +28,41 @@ module Wurk
     # start/stop; safe to call from Launcher#run / Launcher#stop.
     class Server
       ACCEPT_TIMEOUT = 0.2
+      # How often a non-owner child re-attempts the shared port. Short enough
+      # that probes come back quickly after the owner dies, long enough not to
+      # spin. See #start_retry_loop.
+      RETRY_INTERVAL = 5
 
       attr_reader :port, :bind
 
-      def initialize(launcher, port: DEFAULT_PORT, bind: DEFAULT_BIND, ready_window: DEFAULT_READY_WINDOW)
-        @launcher     = launcher
-        @config       = launcher.instance_variable_get(:@config)
-        @port         = port
-        @bind         = bind
-        @ready_window = ready_window
-        @server       = nil
-        @thread       = nil
-        @done         = false
+      def initialize(launcher, port: DEFAULT_PORT, bind: DEFAULT_BIND,
+                     ready_window: DEFAULT_READY_WINDOW, retry_interval: RETRY_INTERVAL)
+        @launcher       = launcher
+        @config         = launcher.instance_variable_get(:@config)
+        @port           = port
+        @bind           = bind
+        @ready_window   = ready_window
+        @retry_interval = retry_interval
+        @server         = nil
+        @thread         = nil
+        @retry_thread   = nil
+        @done           = false
       end
 
       def start
-        @server = ::TCPServer.new(@bind, @port)
-        # Capture the OS-assigned port when caller passed 0 (test pattern,
-        # also lets the kernel pick a free port at boot).
-        @port = @server.addr[1]
+        # Idempotent (see class doc): a second start on a live instance would
+        # re-bind the same port, hit EADDRINUSE, and null out @server/@thread —
+        # leaking the original listener so stop could never close it.
+        return self if running? || retrying?
+
         @done = false
-        @thread = ::Thread.new { run }
-        @thread.name = 'wurk-health'
-        self
-      rescue ::Errno::EADDRINUSE => e
-        # Swarm children all try to bind the same port — only the first wins.
-        # Don't crash the worker; just log and skip.
-        logger&.warn { "Wurk::Health: port #{@port} in use; health server NOT started (#{e.message})" }
-        @server = nil
-        @thread = nil
+        bind_and_serve || start_retry_loop
         self
       end
 
       def stop
         @done = true
+        stop_retry_loop
         srv = @server
         @server = nil
         srv&.close
@@ -73,8 +74,59 @@ module Wurk
         @thread&.alive? == true
       end
 
+      # True while a non-owner child is still polling to take the shared port
+      # over (see #start_retry_loop). Distinct from #running?, which reports the
+      # accept thread specifically.
+      def retrying?
+        @retry_thread&.alive? == true
+      end
+
       private
 
+      # One bind attempt. On success spins the accept thread and returns true.
+      # On EADDRINUSE — a sibling swarm child already owns the shared port —
+      # returns false so the caller schedules a retry.
+      def bind_and_serve
+        @server = ::TCPServer.new(@bind, @port)
+        # Capture the OS-assigned port when caller passed 0 (test pattern,
+        # also lets the kernel pick a free port at boot).
+        @port = @server.addr[1]
+        @thread = ::Thread.new { run }
+        @thread.name = 'wurk-health'
+        true
+      rescue ::Errno::EADDRINUSE
+        @server = nil
+        @thread = nil
+        false
+      end
+
+      # Non-owner children poll the shared port instead of giving up. A single
+      # bind-at-boot went dark to k8s the moment the owning child died —
+      # nothing rebound until the pod restarted. Now a survivor takes the port
+      # over within RETRY_INTERVAL of the owner's exit, so liveness/readiness
+      # ride out ordinary child churn (crash-respawn, rolling restart, recycle).
+      def start_retry_loop
+        logger&.warn do
+          "Wurk::Health: port #{@port} in use; polling every #{@retry_interval}s to take it over"
+        end
+        @retry_thread = ::Thread.new do
+          ::Thread.current.name = 'wurk-health-retry'
+          ::Thread.current.report_on_exception = false
+          sleep @retry_interval until @done || bind_and_serve
+        end
+      end
+
+      def stop_retry_loop
+        thread = @retry_thread
+        @retry_thread = nil
+        return unless thread
+
+        thread.wakeup if thread.alive?
+        thread.join(@retry_interval + 1)
+      rescue ThreadError
+        nil
+      end
+
       def run
         until @done
           ready = ::IO.select([@server], nil, nil, ACCEPT_TIMEOUT)

data/lib/wurk/history.rb

@@ -4,6 +4,7 @@ require_relative 'component'
 require_relative 'keys'
 require_relative 'stats'
 require_relative 'metrics/statsd'
+require_relative 'timer_loop'
 
 module Wurk
   # Sidekiq Enterprise §5 Historical Metrics snapshotter. A leader-gated
@@ -63,30 +64,18 @@ module Wurk
 
     def initialize(config)
       @config = config
-      @interval = config.history_interval
       @collector = config.history_collector
       @stream_cap = config[:history_stream_cap] || STREAM_CAP
-      @done = false
-      @mutex = ::Mutex.new
-      @sleeper = ::ConditionVariable.new
+      @timer = TimerLoop.new(config.history_interval)
       @thread = nil
     end
 
     def start
-      @thread ||= safe_thread('history-snapshot') do # rubocop:disable Naming/MemoizedInstanceVariableName
-        wait
-        until @done
-          tick
-          wait
-        end
-      end
+      @thread ||= safe_thread('history-snapshot') { @timer.run { tick } } # rubocop:disable Naming/MemoizedInstanceVariableName
     end
 
     def terminate
-      @mutex.synchronize do
-        @done = true
-        @sleeper.signal
-      end
+      @timer.terminate
     end
 
     # Leader-gated: only the elected leader emits, so N workers don't each
@@ -164,11 +153,5 @@ module Wurk
 
       values.each { |field, value| client.gauge("sidekiq.#{field}", value) }
     end
-
-    def wait
-      @mutex.synchronize do
-        @sleeper.wait(@mutex, @interval) unless @done
-      end
-    end
   end
 end

data/lib/wurk/job_retry.rb

@@ -2,6 +2,7 @@
 
 require 'zlib'
 require_relative 'component'
+require_relative 'dead_set'
 
 module Wurk
   # Owns the retry pipeline. When perform raises, JobRetry decides whether to
@@ -194,7 +195,7 @@ module Wurk
       if item.is_a?(::Float)
         ::Time.at(item)
       else
-        ::Time.at(item / 1000, item % 1000)
+        ::Time.at(item / 1000, item % 1000, :millisecond)
       end
     end
 
@@ -262,10 +263,7 @@ module Wurk
 
     def send_to_morgue(msg)
       logger.info { "Adding dead #{msg['class']} job #{msg['jid']}" }
-      payload = Wurk.dump_json(msg)
-      now = ::Time.now.to_f
-      redis { |conn| conn.call('ZADD', Keys::DEAD, now.to_s, payload) }
-      DeadSet.new.trim
+      DeadSet.new.kill_raw(Wurk.dump_json(msg))
     end
 
     def run_death_handlers(job, exception)

data/lib/wurk/launcher.rb

@@ -65,6 +65,7 @@ module Wurk
       @started_at = nil
       @heartbeat = nil
       @heartbeat_thread = nil
+      @boot_reclaim_thread = nil
       @health_server = build_health_server
     end
 
@@ -94,7 +95,9 @@ module Wurk
       @history&.start
       @managers.each(&:start)
       @reaper.start
-      boot_reclaim
+      # Run on a background thread so /ready probe isn't delayed by a large
+      # orphan sweep (reaper.reclaim! is atomic, but can scan many entries).
+      @boot_reclaim_thread = safe_thread('boot-reclaim', &method(:boot_reclaim))
       @health_server&.start
     end
 
@@ -231,6 +234,9 @@ module Wurk
       @stopped = true
       thread = @heartbeat_thread
       return unless thread
+      # Embedded dashboard-TERM runs `stop` from the beat itself; a self-join
+      # raises ThreadError. @stopped is set, so the loop exits after this beat.
+      return if thread == Thread.current
 
       begin
         thread.wakeup
@@ -253,15 +259,32 @@ module Wurk
       logger.info('Heartbeat stopping...')
     end
 
+    # Dashboard-queued signals must behave exactly like OS signals, so a
+    # standalone process re-delivers to itself and lets the installed trap
+    # run — that wakes the main thread (CLI self-pipe / child dispatcher)
+    # so the process actually exits instead of stopping its managers and
+    # then parking forever. Embedded mode owns no traps (and self-TERM
+    # would kill the host app), so it calls quiet/stop directly — stop on
+    # its own thread because `stop` joins the heartbeat thread we're on.
     def dispatch_signal(sig)
       case sig
-      when 'TSTP' then quiet
-      when 'TERM' then stop
+      when 'TSTP', 'TERM'
+        if @embedded
+          sig == 'TSTP' ? quiet : Thread.new { stop }
+        else
+          redeliver(sig)
+        end
       else
         logger.warn { "Unknown signal in #{identity}-signals: #{sig.inspect}" }
       end
     end
 
+    # Separate method so tests can stub it — really sending TERM/TSTP would
+    # kill or suspend the test process.
+    def redeliver(sig)
+      ::Process.kill(sig, ::Process.pid)
+    end
+
     def build_poller
       Wurk::Scheduled::Poller.new(@config)
     end

data/lib/wurk/limiter/server_middleware.rb

@@ -1,14 +1,28 @@
 # frozen_string_literal: true
 
+require_relative '../job_retry'
+
 module Wurk
   module Limiter
+    # Control signal raised after a job has been rescheduled: the limiter has
+    # already re-enqueued it (via `Client.push` at `Time.now + backoff`), so
+    # the run is *neither* a success nor a failure. Subclassing
+    # `JobRetry::Skip` routes it through the existing "middleware re-pushed the
+    # job — ack cleanly, book no retry" contract: the retrier re-raises it
+    # untouched, the outer Batch middleware skips both acks (its `rescue
+    # Handled` re-raises), and the Processor acks the UnitOfWork. Returning
+    # normally instead would let the outer Batch onion ack success for a job
+    # that never ran. Internal only — not part of the Sidekiq drop-in surface.
+    class Rescheduled < Wurk::JobRetry::Skip; end
+
     # Catches OverLimit (and any class registered in `Limiter.config.errors`),
     # bumps `job['overrated']`, and decides what to do next:
     #
     #   * reschedule disabled (`reschedule: 0`) → re-raise so the normal
     #     retry/dead pipeline handles it (spec §1.2/§1.4 behaviour).
     #   * still under the cap → reschedule onto the same queue at
-    #     `Time.now + backoff` via `Client.push`.
+    #     `Time.now + backoff` via `Client.push`, then raise `Rescheduled` so
+    #     the outcome is neither success nor failure (batch onion skips acks).
     #   * cap reached (`overrated >= reschedule`, default 20) → **poison
     #     brake** (#16): a job that's still rate-limited after N reschedules
     #     is saturating the limiter, so instead of dumping it into another
@@ -58,6 +72,7 @@ module Wurk
         backoff_proc = (limiter && limiter.options[:backoff]) || Wurk::Limiter.config.backoff
         delay = backoff_proc.call(limiter, job, exc).to_f
         Wurk::Client.new.push(job.merge('at' => ::Time.now.to_f + delay))
+        raise Rescheduled
       end
 
       # Poison brake: stamp a clear reason, drop the job in the dead set, and

data/lib/wurk/limiter.rb

@@ -77,7 +77,7 @@ module Wurk
         @backoff = DEFAULT_BACKOFF
         @errors = [OverLimit]
         @redis = nil
-        @redis_pool = nil
+        @pool = nil
       end
 
       # Accept either a Hash (the documented Sidekiq Ent shape — `{ size:,
@@ -86,7 +86,9 @@ module Wurk
       # responsibility (same contract as Wurk.redis_pool).
       def redis=(value)
         @redis = value
-        @redis_pool = nil
+        # Reset the memo `pool` actually reads — resetting a different ivar
+        # left the old pool pinned after `config.redis = {...}`.
+        @pool = nil
       end
 
       def pool
@@ -97,9 +99,8 @@ module Wurk
                   when Hash
                     Wurk::RedisPool.new(
                       size: @redis[:size] || 10,
-                      url: @redis[:url] || Wurk::RedisPool::DEFAULT_URL,
-                      timeout: @redis[:timeout] || Wurk::RedisPool::DEFAULT_TIMEOUT,
-                      name: 'limiter'
+                      name: 'limiter',
+                      **@redis.except(:size, :name)
                     )
                   else
                     raise ArgumentError, "Limiter.config.redis must be Hash or RedisPool, got #{@redis.class}"

data/lib/wurk/lua/loader.rb

@@ -14,12 +14,18 @@ module Wurk
       NOSCRIPT_PREFIX = 'NOSCRIPT'
 
       class << self
-        # Eagerly upload every registered script to the given connection.
-        # Idempotent on the Redis side: `SCRIPT LOAD` of the same source
-        # returns the same SHA regardless of how often it's called.
-        # Manager calls this once per child after the post-fork reconnect.
+        # Eagerly upload every registered script to the given connection in a
+        # single pipelined round-trip (all SCRIPT LOADs, one RTT — not one per
+        # script). Idempotent on the Redis side: `SCRIPT LOAD` of the same source
+        # returns the same SHA no matter how often it runs. ChildBoot calls this
+        # once per child right after the post-fork reconnect so the first real
+        # EVALSHA hits a warm cache instead of paying a NOSCRIPT reload. Transient
+        # connection errors are the pool wrapper's job (Wurk::RedisPool#with);
+        # this only ships the loads.
         def script_load_all(redis)
-          SCRIPTS.each_value { |src| redis.call('SCRIPT', 'LOAD', src) }
+          redis.pipelined do |pipe|
+            SCRIPTS.each_value { |src| pipe.call('SCRIPT', 'LOAD', src) }
+          end
         end
 
         # @param redis [RedisClient] a single connection (not a pool)

data/lib/wurk/lua.rb

@@ -37,28 +37,91 @@ module Wurk
     # Pro reliable scheduler: atomically promote all due jobs in a sorted
     # set to their target queues. Pure-Ruby promotion does ZRANGE → ZREM →
     # LPUSH non-atomically and can lose jobs on a mid-step crash.
+    #
+    # Each promoted payload is restamped with a fresh `enqueued_at` (ARGV[3],
+    # epoch ms): that field marks arrival on an *immediate* queue, so a job
+    # leaving `schedule`/`retry` must get a new one at promotion rather than
+    # keep its stale scheduled-origin value (or none). This matches the default
+    # Ruby scheduler, whose push path restamps `enqueued_at` too
+    # (Client#push_plain / #push_batched) — so both schedulers emit
+    # wire-identical promoted payloads (spec §7.1).
+    #
+    # The restamp is a surgical string patch, NOT a cjson.decode -> cjson.encode
+    # round-trip: cjson maps every JSON number to a Lua double, so re-encoding
+    # would silently corrupt integer args past 2^53 (snowflake IDs, 64-bit
+    # counters) and reformat 15+ digit numbers into scientific notation --
+    # breaking wire-compat AND diverging from the loss-free Ruby scheduler,
+    # whose Ruby-side JSON keeps big integers exact. So the stored member is
+    # preserved byte-for-byte and only its top-level `enqueued_at` is rewritten:
+    # replaced in place when present (retry members keep theirs), inserted after
+    # the opening brace when absent (schedule members are stored stripped of it,
+    # via Client#push_scheduled). cjson.decode is still called -- but only to
+    # read the `queue` string and test for a top-level `enqueued_at`, never to
+    # re-serialize, so a lossy decode never reaches the payload. (Residual: a
+    # retry member whose user args embed a numeric key literally named
+    # `enqueued_at` ahead of the top-level one patches the arg instead --
+    # vanishingly rare, and still strictly safer than round-tripping every arg.)
     # KEYS = [sorted_set, queues_set]
-    # ARGV = [now, queue_prefix]
+    # ARGV = [now, queue_prefix, now_ms]
     # Returns the number of jobs promoted.
     # Order matters: decode + push BEFORE zrem. Redis Lua has no rollback,
     # so a failed cjson.decode after a zrem would lose the job. Decode first;
-    # push first; only then remove from the sorted set. Worst case is a
-    # crash between lpush and zrem → at-least-once redelivery, never loss.
+    # push first; only then remove from the sorted set — and zrem the ORIGINAL
+    # member, not the restamped copy. Worst case is a crash between lpush and
+    # zrem → at-least-once redelivery, never loss.
+    # ARGV[4] caps members per call: Lua is atomic and single-threaded in
+    # Redis, so an unbatched promote of a post-outage backlog (100k+ due
+    # members) would block every client for the whole sweep. The Ruby caller
+    # loops until a short batch comes back.
     RELIABLE_SCHEDULE_PROMOTE = <<~LUA
-      local jobs = redis.call("zrangebyscore", KEYS[1], "-inf", ARGV[1])
+      local jobs = redis.call("zrangebyscore", KEYS[1], "-inf", ARGV[1], "LIMIT", 0, tonumber(ARGV[4]))
       for i = 1, #jobs do
         local job = jobs[i]
-        local q = cjson.decode(job)["queue"]
+        local decoded = cjson.decode(job)
+        local q = decoded["queue"]
+        local stamped
+        if decoded["enqueued_at"] == nil then
+          stamped = string.gsub(job, "^{", '{"enqueued_at":' .. ARGV[3] .. ",", 1)
+        else
+          stamped = string.gsub(job, '"enqueued_at":%-?%d[%d.eE+-]*', '"enqueued_at":' .. ARGV[3], 1)
+        end
         redis.call("sadd", KEYS[2], q)
-        redis.call("lpush", ARGV[2] .. q, job)
+        redis.call("lpush", ARGV[2] .. q, stamped)
         redis.call("zrem", KEYS[1], job)
       end
       return #jobs
     LUA
 
+    # Reliable fetch (Pro super_fetch §3) shutdown requeue: atomically move
+    # one in-flight job from a per-process private list back to its public
+    # queue. The LREM guard is the whole point — RPUSH runs only when the job
+    # was still in the private list (LREM removed exactly 1). A job the
+    # Processor ACKed in the window between hard_shutdown's cross-thread `job`
+    # read and this move (LREM removes 0) is NOT re-pushed, so the job lands in
+    # exactly one place and can't double-execute. RPUSH (public tail) not LPUSH
+    # so the reclaimed job is fetched next — LMOVE pops the tail — ahead of
+    # fresh LPUSH'd enqueues.
+    # KEYS = [private_list, public_queue]
+    # ARGV = [job_json]
+    # Returns 1 when the job was moved, 0 when it was already acked.
+    RELIABLE_REQUEUE = <<~LUA
+      if redis.call("lrem", KEYS[1], 1, ARGV[1]) == 1 then
+        redis.call("rpush", KEYS[2], ARGV[1])
+        return 1
+      end
+      return 0
+    LUA
+
     # Pro Batch: register a job into a batch and push it to its queue
     # atomically. Keeps total/pending in sync with the jids set.
     #
+    # SADD into the live jids set is the registration guard: total/pending
+    # increment only when the jid is genuinely new (SADD == 1). A jid already
+    # live is a re-push — a retry or scheduled promotion re-enqueueing a job
+    # that never left the batch — so it re-LPUSHes the payload but must NOT
+    # recount, or pending inflates past the acks and `:success` never fires
+    # (spec §2.3/§2.5: total = distinct jobs added, pending = not-yet-succeeded).
+    #
     # A jid found in `b-<bid>-died` is a manual retry of a dead job (morgue
     # "retry" / "add to queue") — it rejoins the live set without recounting:
     # total and pending already include it, because a death never decrements
@@ -79,15 +142,41 @@ module Wurk
           redis.call("zrem", KEYS[6], ARGV[4])
         end
       else
-        redis.call("hincrby", KEYS[1], "total", 1)
-        redis.call("hincrby", KEYS[1], "pending", 1)
-        redis.call("sadd", KEYS[2], ARGV[2])
+        if redis.call("sadd", KEYS[2], ARGV[2]) == 1 then
+          redis.call("hincrby", KEYS[1], "total", 1)
+          redis.call("hincrby", KEYS[1], "pending", 1)
+        end
       end
       redis.call("sadd", KEYS[4], ARGV[1])
       redis.call("lpush", KEYS[3], ARGV[3])
       return 1
     LUA
 
+    # Pro Batch: register a scheduled (`at`) job into a batch AND ZADD it onto
+    # the `schedule` set, atomically. This is the deferred sibling of BATCH_PUSH:
+    # same SADD-guarded total/pending counting, but the enqueue action is a ZADD
+    # (schedule for later) instead of an LPUSH (queue now). A `perform_in` inside
+    # `batch.jobs` must move `total`/`pending` at *creation* — otherwise the
+    # empty-marker check (batch.rb) sees no counter movement and fires
+    # `:complete`/`:success` while real jobs still sit in `schedule`.
+    #
+    # No died / dead-batches handling (unlike BATCH_PUSH): a job scheduled at
+    # creation time is always new to the batch. When the scheduler later promotes
+    # it, the re-push routes through BATCH_PUSH, whose guard finds the jid already
+    # live (SADD == 0) → pure LPUSH, no recount. So registration happens exactly
+    # once, here, at enqueue.
+    # KEYS = [schedule, b-<bid>, b-<bid>-jids]
+    # ARGV = [at_score, job_json, jid]
+    # Returns 1.
+    BATCH_SCHEDULE = <<~LUA
+      if redis.call("sadd", KEYS[3], ARGV[3]) == 1 then
+        redis.call("hincrby", KEYS[2], "total", 1)
+        redis.call("hincrby", KEYS[2], "pending", 1)
+      end
+      redis.call("zadd", KEYS[1], ARGV[1], ARGV[2])
+      return 1
+    LUA
+
     # Pro Batch: ACK a job that completed successfully. SREM from the live
     # jids set and decrement pending iff the jid was a member (idempotent
     # against double-success on a flaky retry). A success also clears any
@@ -259,7 +348,9 @@ module Wurk
       zpopbyscore: ZPOPBYSCORE,
       bulk_push: BULK_PUSH,
       reliable_schedule_promote: RELIABLE_SCHEDULE_PROMOTE,
+      reliable_requeue: RELIABLE_REQUEUE,
       batch_push: BATCH_PUSH,
+      batch_schedule: BATCH_SCHEDULE,
       batch_ack_success: BATCH_ACK_SUCCESS,
       batch_ack_failed: BATCH_ACK_FAILED,
       batch_ack_complete: BATCH_ACK_COMPLETE,