* perf(push): wake delivery worker after notifications are queued
* perf(push): wake one drain per send so bursts cost O(sends + drains) claims
A wake started all twelve drains, so each send arriving at an idle worker cost
~13 claim transactions. A wake now starts one drain; the poll tops up to the
full drain set.
* fix(push): size the claim-attempt budget from the drain count
With twelve drains, up to eleven peers can hold device heads, so a
four-attempt claim budget can run out while claimable rows remain and the
drain exits idle for a tick. Move the drain count into one module and derive
the attempt budget from it.
Claude-Session: ced32ebb-7155-4413-adad-1eccd14c2010
* style(push): keep the worker and store in repo formatting
Claude-Session: ced32ebb-7155-4413-adad-1eccd14c2010
* style(push): drop the stray semicolon in the concurrency constant
Claude-Session: ced32ebb-7155-4413-adad-1eccd14c2010
Four drains, each holding one provider round trip of ~100 ms plus its
database statements, capped delivery near 30/s. Production inflow reached
35/s on 2026-09-30, so the backlog aged past the five-minute TTL and
notifications expired. Twelve drains lift the ceiling to roughly 90/s; the
pool is now six per instance, so the extra drains queue on connections
instead of starving the request path.
Claude-Session: ced32ebb-7155-4413-adad-1eccd14c2010
* fix(push): bound the delivery claim and stop keeping finished batches
* fix(push): bound claim scans to the notification TTL and document the queue
* test(push): boot waits out a table writer for the queue indexes; queue stays correct without them
* fix(push): share the claim lock so a previous-revision claim cannot re-lease a delivery
During a deploy overlap the previous revision's claim scans under an exclusive
push-worker-claim lock and re-reads the row without checking lease_until, so it
could overwrite a lease this revision had just committed and send twice. The
new claim now takes the same key shared: new claimers never block each other,
and the previous claim waits until their leases commit before it scans.
Droppable one release after every worker runs this revision.
* fix(push): install one queue index at boot, not three
push_batches_leased_device indexed lease_until, so every lease, renew and finish
UPDATE lost heap-only eligibility and rewrote every index. push_batches_pending_due
was unused: on a synthetic 902k-row table the candidate scan plans onto the
existing (state, due_at) and expiry indexes with or without it. The per-device
pending index stays; the head check and the busy anti-join use it. Fewer
boot-time builds also shorten the SHARE lock the first boot takes on the table.
* test(push): pin the claim's TTL scan bound and the server's worker connection cap
Removing either guard left the suite green. The claim test captures every row
the candidate scan returns and plants one row that only the TTL term excludes;
the server test drives the real worker through createPushServer and fails when
the request-connection reservation is unwired (peak 4 instead of 2).
* fix(push): renew delivery leases outside the background connection cap
Renew shared the single background slot with claim retries and prune batches,
so a heartbeat could wait long enough for a lease to lapse and the delivery to
be re-leased mid-send. It is a keyed one-row UPDATE, so request traffic cannot
starve it on the ungated pool.
* docs(push): describe the shared claim lock for mixed-revision deploys
Neil
Jinwoo Hong