fix(handler): run jobs without open transactions and survive lost connections

[sajfi]

Problem

In production (depoto-server, Sentry TT-SERVER-CQ, 156 events) the messenger:consume job_message worker crashes with There is already an active transaction. It then picks up the same message again every hour (redeliver_timeout), so the same job is re-run in a poison message loop.

Cause in JobMessageHandler (v2.0.9 = v2.1.0):

• while ($process->isRunning()) busy-loops with no sleep. On every iteration it calls $em->refresh($job) and flush(), which rewrites the whole, growing output inside an ORM transaction.
• If the connection fails inside that transaction, DBAL resets its nesting level while PDO still believes a transaction is open.
• The stock doctrine transport then sends the retry over the same default connection, fails in beginTransaction(), and the worker exits before it can reject the message.
• A redelivered message re-runs a job that is already RUNNING.
• output has no size cap, which most likely ends at max_allowed_packet.

Changes

• JobOutputWriter: every write goes through DBAL in autocommit, never inside a transaction.
  • append (with a cap), readStatus, atomic markRunning claim.
  • finalize: a cancelled job stays cancelled.
  • cancel is a conditional UPDATE.
  • resetConnection() rolls back above the caller's nesting level and closes the connection when PDO is in a transaction DBAL doesn't know about.
• JobMessageHandler rewrite:
  • A missing job throws UnrecoverableMessageHandlingException.
  • Loading and claiming the job are retried; if that keeps failing, the handler throws RecoverableMessageHandlingException (nothing has run yet).
  • A redelivered RUNNING job is marked FAILED and not re-run by default (rerun_on_redelivery).
  • The entity is detached after the claim.
  • The loop is throttled: 100 ms sleep, output writes and the cancel check at most once per poll_interval_ms.
  • A DB error inside the loop only counts towards db_failure_tolerance; output stays in memory and the command keeps running.
  • A failing command is recorded as a job status, not thrown as an exception.
  • Finalize is retried with a connection reset. Output the DB rejects is replaced with a note, so it can never block the job result.
  • Deleting the job while it runs stops the command.
• Output handling:
  • Utf8Stream never splits a multi-byte character and replaces invalid bytes.
  • OutputLimiter caps the output (4 MB by default, 0 = unlimited).
  • OutputParamsParser accumulates params across chunks, including a line split between two chunks.
• Config job_queue.processing: poll_interval_ms (1000), output_max_bytes (4194304), db_failure_tolerance (30), rerun_on_redelivery (false).
• JobController::cancel uses a conditional UPDATE, so it cannot overwrite a finished result.
• README / CHANGELOG (Unreleased 2.2.0):
  • recommend retry_strategy.max_retries: 0 and --keepalive,
  • don't use the doctrine_transaction middleware,
  • truncate the output of a stuck legacy job before upgrading.
• composer / CI:
  • psr/log added to require, ext-pdo_sqlite to require-dev.
  • conflict: symfony/dependency-injection >=8: the bundle's XML service config can't be loaded on DI 8. This was already broken before this PR.
  • CI uses tools: flex, so SYMFONY_REQUIRE takes effect, and gains DBAL 3 / ORM 2 legs.

Behaviour changes (minor bump → 2.2.0)

• Output is capped at 4 MB by default.
• outputParams are written at finalize and accumulated.
• A redelivered RUNNING job is not re-run.
• The handler detaches the Job entity after the claim.

Tests

88 tests / 393 assertions:

• unit tests;
• SQLite integration tests with a real Process and a DBAL fault-injection middleware;
• throttling (query count), no transaction during the loop;
• connection loss and a stale PDO transaction (these fail when resetConnection() is a no-op);
• finalize failure, redelivery, lost claim, cancel, job deleted mid-run;
• output cap and UTF-8, output rejected by the DB (SQLite trigger), the caller's transaction.

They pass locally on DBAL 4.5/ORM 3.7, DBAL 3.10/ORM 3.7 and DBAL 3.10/ORM 2.20. The updated CI workflow runs for the first time on this PR.

Not covered: a MySQL 8 CI job (strict sql_mode, small max_allowed_packet, KILL CONNECTION). That is left as a follow-up.

Two independent reviews ran; their blocker/major findings are fixed in 46cbd52.

After merge (depoto-server)

• Release v2.2.0.
• composer update tomatom/jobqueuebundle.
• max_retries: 0 for the job_message transport.
• Before deploying, run the mitigation SQL for the stuck job (truncate its output and mark it failed).

🤖 Generated with Claude Code