wurk 1.7.6 → 1.8.0

data/lib/wurk/configuration.rb

@@ -1,12 +1,12 @@
 # frozen_string_literal: true
 
-require 'etc'
 require 'logger'
 require_relative 'middleware/chain'
 require_relative 'capsule'
 require_relative 'pool_checkout'
 require_relative 'context'
 require_relative 'topology'
+require_relative 'cpu_count'
 require_relative 'redis_options'
 require_relative 'keys'
 
@@ -46,7 +46,7 @@ module Wurk
       reloader: proc { |&b| b.call },
       backtrace_cleaner: ->(bt) { bt },
       logged_job_attributes: %w[bid tags],
-      redis_idle_timeout: nil,
+      redis_idle_timeout: nil, # seconds; RedisPool closes connections idle this long
       redis_error_handlers: [],
       # Wurk extras, appended after the mirrored keys so the Sidekiq prefix
       # above stays byte-for-byte what a gem reading @options expects.
@@ -121,6 +121,7 @@ module Wurk
     # Spec: docs/target/sidekiq-free.md §4.3.
     ERROR_HANDLER = lambda do |ex, ctx, cfg = Wurk.configuration|
       safe_ctx = ctx || {}
+      safe_ctx = cfg.redacted_context(safe_ctx) if cfg.respond_to?(:redacted_context)
       Wurk::Context.with(safe_ctx) do
         dev = $DEBUG || ENV['WURK_DEBUG'] || cfg.logger.debug?
         msg = dev ? ex.full_message : ex.detailed_message
@@ -157,7 +158,7 @@ module Wurk
       # Hash arrives frozen: the fetch path resolves caps once at boot, so a
       # Hash still mutable here is one a caller can add a queue to and have
       # nothing read it. FrozenError is the honest answer to that.
-      @options[:global_concurrency] = normalize_global_concurrency(@options[:global_concurrency])
+      validate_constructor_options!
       @options[:error_handlers] << ERROR_HANDLER if @options[:error_handlers].empty?
       @capsules = {}
       @directory = {}
@@ -177,6 +178,7 @@ module Wurk
 
     def []=(key, val)
       guard_frozen!
+      RedisPool.validate_idle_timeout(val) if key == :redis_idle_timeout
       @options[key] = val
     end
 
@@ -185,6 +187,7 @@ module Wurk
     alias has_key? key?
     def merge!(other)
       guard_frozen!
+      RedisPool.validate_idle_timeout(other[:redis_idle_timeout]) if other.key?(:redis_idle_timeout)
       @options.merge!(other)
     end
 
@@ -250,6 +253,12 @@ module Wurk
       @redis_config = @redis_config.merge(hash.transform_keys(&:to_sym))
     end
 
+    # Sidekiq's setter for `:redis_idle_timeout`; read when a pool is built, so
+    # call it in the initializer.
+    def reap_idle_redis_connections(timeout = 60)
+      self[:redis_idle_timeout] = timeout
+    end
+
     def redis_pool
       default_capsule.redis_pool
     end
@@ -360,6 +369,40 @@ module Wurk
       @options[:fetch_poll_interval]
     end
 
+    # Display-side argument redaction (Wurk::Redact): a callable taking a deep
+    # copy of the job Hash and returning the args to show in logs, the
+    # dashboard and the fallback error log. nil (default) shows args as-is.
+    def redact_args=(hook)
+      raise ArgumentError, 'redact_args must be nil or respond to #call' unless hook.nil? || hook.respond_to?(:call)
+
+      @options[:redact_args] = hook
+    end
+
+    def redact_args
+      @options[:redact_args]
+    end
+
+    # Seconds a swarm child may go without a heartbeat before the parent
+    # replaces it (Swarm::Liveness). false or 0 turns the check off. The floor
+    # sits above the heartbeat's own cadence so a child that is merely busy is
+    # never read as hung.
+    SWARM_HEARTBEAT_TIMEOUT_FLOOR = 20
+
+    def swarm_heartbeat_timeout=(seconds)
+      unless seconds == false || seconds == 0 || # rubocop:disable Style/NumericPredicate
+             ((seconds.is_a?(Integer) || seconds.is_a?(Float)) && seconds >= SWARM_HEARTBEAT_TIMEOUT_FLOOR)
+        raise ArgumentError,
+              "swarm_heartbeat_timeout must be false, 0, or a number >= #{SWARM_HEARTBEAT_TIMEOUT_FLOOR} " \
+              "(got #{seconds.inspect})"
+      end
+
+      @options[:swarm_heartbeat_timeout] = seconds
+    end
+
+    def swarm_heartbeat_timeout
+      @options[:swarm_heartbeat_timeout]
+    end
+
     # --- Reliability (Sidekiq Pro drop-in toggles) -----------------------
 
     # Sidekiq Pro's opt-in toggle for reliable fetch. Already the default in
@@ -664,7 +707,11 @@ module Wurk
     #
     # Off by default — call this in a `configure_server` block to enable.
     # Spec: docs/target/sidekiq-ent.md §7.1.2.
-    def health_check(port:, bind: '0.0.0.0', ready_window: 30)
+    #
+    # `metrics:` serves the Prometheus scrape on the same listener (on by
+    # default). `min_ready:` — children with a fresh heartbeat required for
+    # /ready inside a swarm; nil means half the swarm, rounded up.
+    def health_check(port:, bind: '0.0.0.0', ready_window: 30, metrics: true, min_ready: nil)
       guard_frozen!
       p = Integer(port)
       rw = Integer(ready_window)
@@ -674,7 +721,9 @@ module Wurk
       b = bind.to_s
       raise ArgumentError, 'bind must be a non-empty string' if b.empty?
 
-      @options[:health_check_options] = { port: p, bind: b, ready_window: rw }
+      @options[:health_check_options] = { port: p, bind: b, ready_window: rw,
+                                          metrics: health_check_metrics(metrics),
+                                          min_ready: health_check_min_ready(min_ready) }
     end
 
     # --- Lifecycle hooks --------------------------------------------------
@@ -698,7 +747,7 @@ module Wurk
 
     def handle_exception(ex, ctx = {})
       if error_handlers.empty?
-        logger.error("#{ctx} #{ex.class}: #{ex.message}")
+        logger.error("#{redacted_context(ctx)} #{ex.class}: #{ex.message}")
       else
         error_handlers.each do |handler|
           handler.call(ex, ctx, self)
@@ -708,14 +757,31 @@ module Wurk
       end
     end
 
+    # The error context with the job's args passed through the `redact_args`
+    # hook, for the two reporters that print or tag the whole context: the
+    # fallback log line and the default ERROR_HANDLER (whose Wurk::Context a
+    # JSON log formatter emits). Host-registered error handlers still receive
+    # the real ctx — they are the host's own code.
+    def redacted_context(ctx)
+      hook = @options[:redact_args]
+      job = ctx.is_a?(Hash) ? ctx[:job] : nil
+      return ctx unless hook && job.is_a?(Hash) && job.key?('args')
+
+      require_relative 'redact'
+      ctx.merge(job: job.merge('args' => Wurk::Redact.args(job, hook)))
+    end
+
     # --- Configure blocks (Sidekiq.configure_server / _client) -----------
 
     def configure_server(&block)
       yield self if block && server?
     end
 
+    # A web process that also boots the swarm (Wurk::RailsBoot) is flagged
+    # server, yet every enqueue it makes from a request is client work, so
+    # `client_in_server` lets its configure_client blocks run too.
     def configure_client(&block)
-      yield self if block && !server?
+      yield self if block && (!server? || @options[:client_in_server])
     end
 
     def server?
@@ -788,6 +854,7 @@ module Wurk
       prepare_for_fork!
       @capsules.each_value(&:freeze)
       @capsules.freeze
+      warn_on_small_db_pool
       self
     end
 
@@ -801,6 +868,11 @@ module Wurk
 
     private
 
+    def validate_constructor_options!
+      @options[:global_concurrency] = normalize_global_concurrency(@options[:global_concurrency])
+      RedisPool.validate_idle_timeout(@options[:redis_idle_timeout])
+    end
+
     # One flat fork running the default capsule's queues + concurrency. The
     # railtie boots this when a Rails host mounts the engine without declaring
     # a topology. queue_specs (not queues) so weights survive the round-trip.
@@ -810,20 +882,78 @@ module Wurk
     end
 
     # Number of swarm children when the host hasn't declared a topology
-    # (Sidekiq Ent §7.2). Defaults to the CPU count. A whole number is an
-    # absolute count; a fractional value is a CPU multiplier (e.g. `0.5` → half
-    # the cores, rounded), supported since Sidekiq 8.0.2. WURK_COUNT is the
-    # native name, SIDEKIQ_COUNT the drop-in alias. Unparseable input falls back
-    # to the CPU count; the result is floored at 1 so the swarm always forks.
+    # (Sidekiq Ent §7.2). Defaults to the usable CPU count — the cgroup quota
+    # when one is tighter than the host's cores (Wurk::CpuCount). A whole number
+    # is an absolute count; a fractional value is a CPU multiplier (e.g. `0.5`
+    # → half the usable CPUs, rounded), supported since Sidekiq 8.0.2.
+    # WURK_COUNT is the native name, SIDEKIQ_COUNT the drop-in alias.
+    # Unparseable input falls back to the CPU count; the result is floored at 1
+    # so the swarm always forks. Logged once, with where the number came from:
+    # a pod that forks the wrong number of children is otherwise only visible
+    # as throttling or memory pressure.
     def default_child_count
-      raw = ENV['WURK_COUNT'] || ENV.fetch('SIDEKIQ_COUNT', nil)
-      return Etc.nprocessors if raw.nil? || raw.strip.empty?
+      count, source = child_count_and_source
+      logger.info { "Wurk swarm: forking #{count} #{count == 1 ? 'child' : 'children'} (#{source})" }
+      count
+    end
+
+    def child_count_and_source
+      name = ENV['WURK_COUNT'] ? 'WURK_COUNT' : 'SIDEKIQ_COUNT'
+      raw = ENV.fetch(name, nil)
+      cpus = Wurk::CpuCount.detect
+      return [cpus.count, cpus.source] if raw.nil? || raw.strip.empty?
+
+      env_child_count(name, raw, cpus)
+    end
 
+    def env_child_count(name, raw, cpus)
       value = Float(raw)
-      count = (value % 1).zero? ? value.to_i : (value * Etc.nprocessors).round
-      [count, 1].max
+      return [[value.to_i, 1].max, "#{name}=#{raw}"] if (value % 1).zero?
+
+      [[(value * cpus.count).round, 1].max, "#{name}=#{raw} x #{cpus.count} CPUs from #{cpus.source}"]
     rescue ArgumentError, TypeError
-      Etc.nprocessors
+      [cpus.count, "#{cpus.source}; #{name}=#{raw.inspect} is not a number"]
+    end
+
+    def health_check_metrics(value)
+      raise ArgumentError, "metrics must be true or false (got #{value.inspect})" unless [true, false].include?(value)
+
+      value
+    end
+
+    def health_check_min_ready(value)
+      return nil if value.nil?
+      unless value.is_a?(Integer) && value.positive?
+        raise ArgumentError, "min_ready must be nil or an Integer >= 1 (got #{value.inspect})"
+      end
+
+      value
+    end
+
+    # Runs where every worker process settles its capsules — a swarm child
+    # after its slot is applied, `wurk`, embedded — so the concurrency compared
+    # is the one that process will actually run. Every job thread that touches
+    # the database checks out its own connection; a pool smaller than the
+    # thread count turns into ActiveRecord::ConnectionTimeoutError under load,
+    # long after boot. A warning rather than a raise: a job set that never
+    # touches the database is a legitimate reason to run a small pool.
+    def warn_on_small_db_pool(record_class = (::ActiveRecord::Base if defined?(::ActiveRecord::Base)))
+      return unless record_class
+
+      size = record_class.connection_pool.size
+      threads = total_concurrency
+      return if size >= threads
+
+      logger.warn do
+        "ActiveRecord connection pool size (#{size}) is smaller than this process's job concurrency " \
+          "(#{threads}); jobs that use the database will wait for connections and may raise " \
+          'ActiveRecord::ConnectionTimeoutError. Raise `pool:` in config/database.yml to at least ' \
+          "#{threads} (plus any other threads that use the database)."
+      end
+    rescue StandardError
+      # No database configured, or an adapter that cannot report its pool:
+      # nothing to compare.
+      nil
     end
 
     # SIDEKIQ_MAXMEM_MB is the drop-in name; WURK_MAXMEM_MB the native alias.
@@ -897,15 +1027,16 @@ module Wurk
       logger
     end
 
-    # `size`/`name` are pool-structural (the caller owns them); every other
-    # key the host set via `config.redis = {...}` — url, the split timeouts,
-    # reconnect_attempts, driver, … — flows through to RedisPool verbatim.
-    # `overrides` win over the host config (the web pool pins its own
-    # pool_timeout this way). Every pool built here is wired to the redis-error
-    # telemetry dispatcher.
+    # `size` and the pool label are structural (the caller owns them); every
+    # other key the host set via `config.redis = {...}` — url, the split
+    # timeouts, reconnect_attempts, driver, a Sentinel `name:` … — flows through
+    # to RedisPool (see RedisOptions.pool_kwargs). `overrides` win over the
+    # host config (the web pool pins its own pool_timeout this way). Every pool
+    # built here is wired to the redis-error telemetry dispatcher.
     def build_redis_pool(size:, name:, **overrides)
       RedisPool.new(size: size, name: name, on_error: method(:dispatch_redis_error),
-                    **@redis_config.except(:size, :name), **overrides)
+                    redis_idle_timeout: @options[:redis_idle_timeout],
+                    **RedisOptions.pool_kwargs(@redis_config), **overrides)
     end
 
     # Fan a RedisPool retry/give-up event out to the registered handlers. A

data/lib/wurk/cpu_count.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+require 'etc'
+
+module Wurk
+  # How many CPUs this process may actually use — the default swarm size.
+  #
+  # `Etc.nprocessors` reports the host's cores (or the affinity mask), not the
+  # container's share of them: a pod limited to 2 CPUs on a 64-core node reads
+  # 64, and a swarm that forks one child per core then runs 64 processes on 2
+  # CPUs' worth of CFS quota — throttled, with 32x the memory. The quota lives
+  # in the cgroup, so it is read from there and the smaller of the two wins.
+  #
+  # cgroup v2: `cpu.max` is `<quota> <period>` or `max <period>`, read in this
+  # process's own cgroup and every ancestor up to the mount root (a limit set on
+  # a parent slice binds the child too), smallest wins. cgroup v1:
+  # `cpu.cfs_quota_us` (-1 = unlimited) over `cpu.cfs_period_us`, in the cpu
+  # controller's mount. Either way `ceil(quota / period)`, floored at 1: a
+  # 1.5-CPU quota can keep two processes busy part of the time, and rounding a
+  # 0.5-CPU quota down to zero would fork nothing.
+  module CpuCount
+    Result = Data.define(:count, :source)
+
+    ROOT = '/sys/fs/cgroup'
+    PROC_SELF_CGROUP = '/proc/self/cgroup'
+    V1_CONTROLLER_DIRS = %w[cpu cpu,cpuacct cpuacct,cpu].freeze
+
+    module_function
+
+    def detect(root: ROOT, proc_cgroup: PROC_SELF_CGROUP, nprocessors: Etc.nprocessors)
+      quota = cgroup_v2_quota(root, proc_cgroup)
+      source = 'cgroup v2 cpu.max'
+      unless quota
+        quota = cgroup_v1_quota(root)
+        source = 'cgroup v1 cpu.cfs_quota_us'
+      end
+      return Result.new(nprocessors, 'Etc.nprocessors') if quota.nil? || quota >= nprocessors
+
+      Result.new(quota, source)
+    end
+
+    def cgroup_v2_quota(root, proc_cgroup)
+      v2_dirs(root, proc_cgroup).filter_map { |dir| v2_limit(File.join(dir, 'cpu.max')) }.min
+    end
+
+    # `0::<path>` is the v2 entry. Inside a container with its own cgroup
+    # namespace the path is `/` and the limit sits at the mount root; on a host
+    # (or without the namespace) it sits under the full path.
+    def v2_dirs(root, proc_cgroup)
+      line = read(proc_cgroup)&.lines&.find { |l| l.start_with?('0::') }
+      path = line ? line.strip.delete_prefix('0::') : '/'
+      dirs = []
+      loop do
+        dirs << File.join(root, path)
+        break if path == '/' || path.empty?
+
+        path = File.dirname(path)
+      end
+      dirs.uniq
+    end
+
+    def v2_limit(file)
+      quota, period = read(file)&.split
+      return nil if quota.nil? || quota == 'max'
+
+      ceil_ratio(quota, period)
+    end
+
+    def cgroup_v1_quota(root)
+      V1_CONTROLLER_DIRS.each do |dir|
+        quota = read(File.join(root, dir, 'cpu.cfs_quota_us'))
+        next unless quota
+
+        return nil if quota.strip.start_with?('-')
+
+        return ceil_ratio(quota, read(File.join(root, dir, 'cpu.cfs_period_us')))
+      end
+      nil
+    end
+
+    def ceil_ratio(quota, period)
+      quota = Integer(quota.to_s.strip, 10)
+      period = Integer(period.to_s.strip, 10)
+      return nil unless quota.positive? && period.positive?
+
+      (quota + period - 1) / period
+    rescue ArgumentError
+      nil
+    end
+
+    def read(path)
+      File.read(path)
+    rescue SystemCallError, IOError
+      nil
+    end
+  end
+end

data/lib/wurk/cron.rb

@@ -271,7 +271,11 @@ module Wurk
     class Loop
       attr_reader :lid, :schedule, :klass, :options, :tz
 
-      def initialize(schedule:, klass:, options: {}, tz: nil, lid: nil)
+      # `paused:` is the loop HASH's `paused` field when read back from Redis —
+      # the runtime owns it (Web UI pause/unpause, ent §2.4). A code-declared
+      # `paused:` option only seeds that field at first registration, so it
+      # must not keep the loop paused once the field says otherwise.
+      def initialize(schedule:, klass:, options: {}, tz: nil, lid: nil, paused: nil)
         raise ArgumentError, 'klass must be a String' unless klass.is_a?(String) && !klass.empty?
 
         @schedule = schedule
@@ -280,6 +284,7 @@ module Wurk
         @tz = tz
         @parser = Parser.new(schedule)
         @lid = lid || Cron.lid(schedule, klass, @options)
+        @paused = paused.nil? ? [true, '1', 1].include?(@options['paused']) : paused
       end
 
       def parser
@@ -287,19 +292,51 @@ module Wurk
       end
 
       def paused?
-        @options['paused'].to_s == '1' || @options['paused'] == true
+        @paused
       end
 
+      # The queue a tick lands in: the loop's own `queue:`, else the worker's
+      # `sidekiq_options` queue, as `perform_async` would pick (ent §2.2).
       def queue
-        @options['queue'] || 'default'
+        @options['queue'] || worker_option('queue') || 'default'
       end
 
+      # `args:` is the static argument list splatted into perform. A bare value
+      # (a Hash most often) is one argument — `Array({ 'a' => 1 })` would turn
+      # it into `[['a', 1]]`.
       def args
-        Array(@options['args'])
+        value = @options['args']
+        return [] if value.nil?
+
+        value.is_a?(::Array) ? value : [value]
       end
 
+      # The loop's `retry:`, else the worker's, else Sidekiq's default `true`.
       def retry_value
-        @options.fetch('retry', true)
+        return @options['retry'] if @options.key?('retry')
+
+        worker_retry = worker_option('retry')
+        worker_retry.nil? || worker_retry
+      end
+
+      # The payload one tick pushes. Ent §2.2: a tick is `klass.perform_async(*args)`
+      # with the loop's `retry` / `queue` laid over the worker's own options, so
+      # the resolved class goes to the client — JobUtil#normalize_item merges its
+      # `get_sidekiq_options` (unique_for, encrypt, expires_in, …) only for a
+      # Class. Only the overrides the loop actually declares are set.
+      def job_item
+        worker = worker_class
+        item = { 'class' => worker.respond_to?(:get_sidekiq_options) ? worker : @klass, 'args' => args }
+        item['queue'] = @options['queue'] if @options.key?('queue')
+        item['retry'] = @options['retry'] if @options.key?('retry')
+        item
+      end
+
+      # The worker constant, or nil when it is not loadable in this process.
+      def worker_class
+        @klass.split('::').inject(::Object) { |mod, name| mod.const_get(name) }
+      rescue ::NameError
+        nil
       end
 
       def history
@@ -379,13 +416,18 @@ module Wurk
       def self.from_redis(lid, hash)
         h = hash.is_a?(Array) ? hash.each_slice(2).to_h : hash
         opts = h['options'] ? JSON.parse(h['options']) : {}
-        opts['paused'] = '1' if h['paused'] == '1'
         tz = h['tz'].to_s.empty? ? nil : h['tz']
-        new(lid: lid, schedule: h['schedule'], klass: h['klass'], options: opts, tz: tz)
+        new(lid: lid, schedule: h['schedule'], klass: h['klass'], options: opts, tz: tz,
+            paused: h['paused'] == '1')
       end
 
       private
 
+      def worker_option(key)
+        worker = worker_class
+        worker.get_sidekiq_options[key] if worker.respond_to?(:get_sidekiq_options)
+      end
+
       def stringify_options(opts)
         opts.transform_keys(&:to_s)
       end
@@ -448,18 +490,23 @@ module Wurk
         @config = config
       end
 
+      # Loops are read up front and yielded with no connection held, so the
+      # caller's own Redis work (the poller's claim + push) never nests a second
+      # checkout. A loop whose stored hash no longer parses is skipped with a
+      # warning: one corrupt record must not hide every loop after it.
       def each
         return enum_for(:each) unless block_given?
 
-        redis do |c|
-          lids = c.call('SMEMBERS', PERIODIC_KEY)
-          lids.each do |lid|
+        rows = redis do |c|
+          c.call('SMEMBERS', PERIODIC_KEY).filter_map do |lid|
             h = c.call('HGETALL', "#{LOOP_PREFIX}#{lid}")
-            next if h.nil? || h.empty?
-
-            yield Loop.from_redis(lid, h)
+            [lid, h] unless h.nil? || h.empty?
           end
         end
+        rows.each do |lid, h|
+          loop_obj = parse(lid, h)
+          yield loop_obj if loop_obj
+        end
       end
 
       def size
@@ -478,6 +525,13 @@ module Wurk
 
       private
 
+      def parse(lid, hash)
+        Loop.from_redis(lid, hash)
+      rescue JSON::ParserError, ArgumentError => e
+        Wurk.logger&.warn("[cron] skipping unreadable loop lid=#{lid}: #{e.class}: #{e.message}")
+        nil
+      end
+
       def redis(idempotent: false, &)
         @config ? @config.redis(idempotent:, &) : Wurk.redis(idempotent:, &)
       end
@@ -513,9 +567,9 @@ module Wurk
     end
 
     # Once-per-minute tick driver. Only the cluster leader iterates the LoopSet
-    # and enqueues; non-leaders return early. Missed-tick warning when
-    # wall-clock has drifted more than `MISSED_TICK_THRESHOLD` seconds past the
-    # expected fire.
+    # and enqueues; non-leaders return early. A slot that wall-clock has passed
+    # by more than `MISSED_TICK_THRESHOLD` seconds is skipped with a warning,
+    # never backfilled.
     class Poller
       include Component
 
@@ -556,10 +610,18 @@ module Wurk
       # `dear-leader`): non-leaders return early and never iterate the LoopSet.
       # The Launcher owns the lock's renewal — the poller no longer runs (or
       # expires) its own.
+      #
+      # Rescued per loop: the LoopSet order is stable, so one loop that raises
+      # on every tick (a push its middleware refuses, a class that no longer
+      # loads) would otherwise starve every loop after it, forever.
       def tick
         return unless leader?
 
-        LoopSet.new(@config).each { |lp| enqueue_if_due(lp) }
+        LoopSet.new(@config).each do |lp|
+          enqueue_if_due(lp)
+        rescue StandardError => e
+          handle_exception(e, { context: 'cron-poller', lid: lp.lid, klass: lp.klass })
+        end
       rescue StandardError => e
         handle_exception(e, { context: 'cron-poller' })
       end
@@ -568,6 +630,10 @@ module Wurk
       # cached read, so a second poller can reach the same due loop for a few
       # seconds after a handover. Losing the CAS means another tick owns this
       # slot — enqueue nothing.
+      #
+      # A slot older than the missed-tick threshold is not backfilled (ent §2.6:
+      # no backfill on restart, missed ticks across a leader gap are dropped):
+      # the marks still advance past it, but nothing is pushed.
       def enqueue_if_due(loop_obj)
         return if loop_obj.paused?
 
@@ -577,8 +643,8 @@ module Wurk
 
         future = loop_obj.next_fire_after(slot, now)
         return unless claim_fire?(loop_obj, mark, now, future)
+        return skip_missed(loop_obj, slot, now) if now - slot > missed_threshold
 
-        warn_missed_tick(loop_obj, slot, now)
         jid = enqueue_claimed!(loop_obj)
         record_history(loop_obj, jid, now)
         jid
@@ -609,13 +675,18 @@ module Wurk
         [next_fire, mark || next_fire.to_s]
       end
 
-      def warn_missed_tick(loop_obj, expected, now)
-        return if now - expected <= MISSED_TICK_THRESHOLD
+      # Never tighter than a tick and a half: a raised tick interval must not
+      # turn every on-time fire into a "missed" one.
+      def missed_threshold
+        [MISSED_TICK_THRESHOLD, @tick_interval * 1.5].max
+      end
 
+      def skip_missed(loop_obj, expected, now)
         logger.warn(
           "[cron] missed tick lid=#{loop_obj.lid} klass=#{loop_obj.klass} " \
-          "expected_at=#{expected} fired_at=#{now} drift=#{now - expected}s"
+          "expected_at=#{expected} now=#{now} drift=#{now - expected}s — skipped, not backfilled"
         )
+        nil
       end
 
       # Compare-and-swap the fire marks: only the tick still looking at the
@@ -647,30 +718,22 @@ module Wurk
       end
 
       def enqueue!(loop_obj)
-        aj = active_job_class(loop_obj.klass)
+        aj = active_job_class(loop_obj.worker_class)
         return enqueue_active_job(aj, loop_obj) if aj
 
-        @client.push(
-          'class' => loop_obj.klass,
-          'args' => loop_obj.args,
-          'queue' => loop_obj.queue,
-          'retry' => loop_obj.retry_value
-        )
+        @client.push(loop_obj.job_item)
       end
 
-      # Resolve a loop's class name to an ActiveJob::Base subclass, or nil when
+      # The loop's class when it is an ActiveJob::Base subclass, or nil when
       # ActiveJob isn't loaded (standalone wurk) or the class isn't one.
       # sidekiq-cron parity: a cron loop targeting an ActiveJob must enqueue
       # through the AJ adapter so the job runs via Sidekiq::ActiveJob::Wrapper
       # with full callbacks/serialization — a bare `client.push('class' => …)`
       # would make the processor call `Klass.new.perform`, skipping all of AJ.
-      def active_job_class(name)
+      def active_job_class(const)
         return nil unless defined?(::ActiveJob::Base)
 
-        const = name.split('::').inject(::Object) { |mod, c| mod.const_get(c) }
         const if const.is_a?(::Class) && const < ::ActiveJob::Base
-      rescue ::NameError
-        nil
       end
 
       # Enqueue via the AJ adapter (→ wurk). Only override the queue when the
@@ -679,7 +742,7 @@ module Wurk
       # doesn't apply here. Returns the wurk jid (provider_job_id) so the fire
       # history records it; nil if a before_enqueue callback halted the push.
       def enqueue_active_job(klass, loop_obj)
-        target = loop_obj.queue == 'default' ? klass : klass.set(queue: loop_obj.queue)
+        target = loop_obj.options.key?('queue') ? klass.set(queue: loop_obj.options['queue']) : klass
         job = target.perform_later(*loop_obj.args)
         job.provider_job_id if job.respond_to?(:provider_job_id)
       end