Run durable PostgreSQL jobs with atomic effects #16

New issue

Open

opened 2026-11-01 20:11:35 +00:00 by viacheslavshuka · 0 comments

viacheslavshuka commented

2026-11-01 20:11:35 +00:00

Owner

Scheduled work must survive worker restarts without duplicating domain changes. Provide the selected PgQueuer runtime and a concrete transaction contract for its consumers.

Scope

Use PgQueuer with asyncpg and PostgreSQL. Run a separate worker container from the same image and release version as the web service. Select bounded internal retries and recovery behavior as engineering details.

Acceptance criteria

Domain writes and required job enqueues use the same transaction and acquired connection. A rollback removes both effects. A committed write cannot lose its required enqueue.
Jobs survive a worker restart. Recovery can execute abandoned work again without repeating an already committed domain effect.
Deferred jobs use canonical UTC deadlines and recheck current state before applying a transition. Replacing or canceling scheduled work makes stale execution harmless.
Internal retries have explicit finite limits and delays. Exhausted or malformed jobs retain an inspectable failed result. A tool failure cannot appear as successful completion.
The worker stops cleanly and releases its database resources. Interrupted work remains recoverable according to the pinned PgQueuer version's verified behavior.
The implementation provides durable deduplication for domain effects where required. Temporary active-job deduplication alone cannot establish this guarantee.
Recovery executes overdue domain work according to current state. Consumer handlers expire offers, complete ended sessions, and suppress obsolete notifications under their own contracts.
A representative transaction and idempotent handler demonstrate the runtime contract. It does not require every reminder or lifecycle consumer to exist first.
Documentation distinguishes internal retries from Telegram delivery retries. It does not promise exactly-once Telegram delivery.

Validation

Use actual PostgreSQL and the pinned PgQueuer release. Exercise rollback, crash before commit, crash after commit, duplicate delivery, cancellation races, and overdue execution. Check persisted effects after recovery, including the absence of repeated changes.

Dependencies

#8: Apply PostgreSQL migrations with release compatibility checks. Durable queue state and transactions need migrated PostgreSQL.

Scheduled work must survive worker restarts without duplicating domain changes. Provide the selected PgQueuer runtime and a concrete transaction contract for its consumers. ## Scope Use PgQueuer with asyncpg and PostgreSQL. Run a separate worker container from the same image and release version as the web service. Select bounded internal retries and recovery behavior as engineering details. ## Acceptance criteria - Domain writes and required job enqueues use the same transaction and acquired connection. A rollback removes both effects. A committed write cannot lose its required enqueue. - Jobs survive a worker restart. Recovery can execute abandoned work again without repeating an already committed domain effect. - Deferred jobs use canonical UTC deadlines and recheck current state before applying a transition. Replacing or canceling scheduled work makes stale execution harmless. - Internal retries have explicit finite limits and delays. Exhausted or malformed jobs retain an inspectable failed result. A tool failure cannot appear as successful completion. - The worker stops cleanly and releases its database resources. Interrupted work remains recoverable according to the pinned PgQueuer version's verified behavior. - The implementation provides durable deduplication for domain effects where required. Temporary active-job deduplication alone cannot establish this guarantee. - Recovery executes overdue domain work according to current state. Consumer handlers expire offers, complete ended sessions, and suppress obsolete notifications under their own contracts. - A representative transaction and idempotent handler demonstrate the runtime contract. It does not require every reminder or lifecycle consumer to exist first. - Documentation distinguishes internal retries from Telegram delivery retries. It does not promise exactly-once Telegram delivery. ## Validation Use actual PostgreSQL and the pinned PgQueuer release. Exercise rollback, crash before commit, crash after commit, duplicate delivery, cancellation races, and overdue execution. Check persisted effects after recovery, including the absence of repeated changes. ## Dependencies - [#8: Apply PostgreSQL migrations with release compatibility checks](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/8). Durable queue state and transactions need migrated PostgreSQL. ## Related work - [#26: Package and serve the website and API from one image](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/26) - [#34: Deploy validated main images to development](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/34)

viacheslavshuka referenced this issue

2026-11-01 20:11:40 +00:00

Keep a durable notification inbox with current action status #22

viacheslavshuka referenced this issue

2026-11-01 20:11:43 +00:00

Package and serve the website and API from one image #26

viacheslavshuka referenced this issue

2026-11-01 20:11:44 +00:00

Complete registration through verified rating-profile control #27

viacheslavshuka referenced this issue

2026-11-01 20:11:46 +00:00

Deliver Telegram notifications with bounded retries and current permissions #29