fix: behavior/robustness audit cluster (F2-10, F1-03, F1-04, F1-06, F3-02) - #92
Merged
Merged
Conversation
…3-02) - F2-10: validate_schema now probes pg_index.indisunique — a same-named but NON-unique timer_id_uq (correct predicate) breaks the producer's ON CONFLICT arbiter at publish time and is now flagged. Integration test recreates the index non-unique. - F1-03: OutboxBroker.stop sets running=False BEFORE the subscriber-stop gather, so an external cancellation of stop() can't leave running=True over already-stopped subs. - F1-04: a drain that exceeds graceful_timeout now emits a WARNING + drain_timeout metric instead of silently abandoning in-flight rows (they're left to lease-expiry retry). - F1-06: _run_with_reconnect captures `started` only after open_resources succeeds, so a slow pool checkout that then fails no longer counts as healthy and resets the backoff. - F3-02: extract validate_table_identifiers in schema.py and call it from OutboxClient.__init__, so a directly-constructed/reflected over-long Table can't bypass the 63-byte identifier guard. Each test-first. just test -> 514 passed, 100% coverage; just lint clean. Findings doc updated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
lesnik512
added a commit
that referenced
this pull request
Jun 14, 2026
) #92 added the drain_timeout recorder event but only the raw recorder seam saw it — the bundled adapters ignored it (forward-compatible) and the docs didn't mention it, so operators got no out-of-the-box metric. Complete the feature: - Prometheus: faststream_outbox_drain_timeout_total counter (consume labels). - OTel: messaging.outbox.drain_timeout meter counter (operation=process). - Docs: observability.md recorder-event table + event set; CLAUDE.md and architecture/metrics.md emission lists. Added PLR0911 to the two adapters' __call__ noqa (one more event branch in the flat event-dispatch dispatch, same shape as the existing C901/PLR0912 suppressions). Tests: test_{prometheus,otel}_drain_timeout_* assert the counter increments. just test -> 518 passed, 100% coverage; just lint clean; mkdocs --strict builds. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
PR 3 of the tail program — the real code-behavior fixes from the pass-3 audit. Each test-first.
validate_schemanow probespg_index.indisunique. A same-named but non-uniquetimer_id_uq(with the correct partial predicate) passes the existing predicate check yet breaks the producer'sON CONFLICT (queue, timer_id)arbiter at publish time; it's now flagged withnot UNIQUE. Integration test recreates the index non-unique.OutboxBroker.stopsetsrunning=Falsebefore theasyncio.gatherof subscriber stops, so an external cancellation ofstop()mid-gather can't leaverunning=Trueover already-stopped subscribers (ping()would lie). Test spies a subscriber'sstopand asserts it observesrunning is False.graceful_timeoutnow emits aWARNING+ adrain_timeoutrecorder metric instead of silently abandoning in-flight rows (still left to lease-expiry retry). Fake-mode test wedges a handler and asserts both fire._run_with_reconnectcapturesstartedonly afteropen_resourcessucceeds, so a slow pool checkout that then fails no longer counts as "healthy uptime" and resets the backoff (defeating escalation under a connection storm). Test: a failing open keeps the backoff escalating[1,2,3](the pre-fix code reset to[1,1,1]).validate_table_identifiersinschema.pyand call it fromOutboxClient.__init__, so a directly-constructed or reflected over-longTablecan't bypass the 63-byte identifier guard (previously onlymake_outbox_tableenforced it).Verification
just test→ 514 passed, 100% coveragejust lintclean (ruff + ty)Pass-3 findings doc updated. The new
drain_timeoutrecorder event is forward-compatible (the bundled Prometheus/OTel adapters ignore unknown events).🤖 Generated with Claude Code