Post-merge review of #804 reproduced queue-ownership defects:
- hard-killed workers can leave unfinished rows permanently stamped with a dead process_id
- a database reconnect can drop GET_LOCK() while PHP remains alive, so the lock alone is not a liveness oracle
- unscoped reads and terminal updates can let workers drain or complete another worker claim
Add a database-scoped advisory lease for mutual exclusion. Recover confirmed-dead workers immediately; wait one expired heartbeat when liveness is unknown; and compare a stale live PID process age with the database registration before deciding whether the operating system reused it. Process age supports Linux etimes and portable etime output and fails closed when identity cannot be verified.
Recover orphan claims whose process registration is gone, scope every queue read and terminal write to process_id, prove ownership through affected-row counts, install cleanup before registration, heartbeat within queue loops, normalize diagnostics to valid UTF-8 and the schema length, and make unsupported topics terminal. Keep the legacy --thread option accepted for compatibility, but document that it is deprecated and ignored because ownership is automatic.
Fresh overlap audit: no other open plugin_thold PR implements this ownership and recovery correction. The separate retry policy and display-order work remains only in stacked PR #811.
Post-merge review of #804 reproduced queue-ownership defects:
Add a database-scoped advisory lease for mutual exclusion. Recover confirmed-dead workers immediately; wait one expired heartbeat when liveness is unknown; and compare a stale live PID process age with the database registration before deciding whether the operating system reused it. Process age supports Linux etimes and portable etime output and fails closed when identity cannot be verified.
Recover orphan claims whose process registration is gone, scope every queue read and terminal write to process_id, prove ownership through affected-row counts, install cleanup before registration, heartbeat within queue loops, normalize diagnostics to valid UTF-8 and the schema length, and make unsupported topics terminal. Keep the legacy --thread option accepted for compatibility, but document that it is deprecated and ignored because ownership is automatic.
Fresh overlap audit: no other open plugin_thold PR implements this ownership and recovery correction. The separate retry policy and display-order work remains only in stacked PR #811.