fix: claim a redrive the way every other role claims work

`Redrive.lock` takes a plain `FOR UPDATE`, so with a redrive thread in
every supervisor the second one waits on the first rather than taking
the next task. It uses `lock_candidates` now, which is
`FOR UPDATE SKIP LOCKED` where the database has it, as the actor,
effect, broadcast, and reminder claims already do.

`RedriveTask#cancel` moves out of the `Data.define` block, because
rbs-inline does not read that block and the shipped signature therefore
omitted a documented method.

The migrations inline their one-use JSON helper, and four comments that
restated the code they sat above are gone. The reasoning they carried is
in the commit that introduced each one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: cardmagic

db/migrate/20260922000000_add_solid_objects_administration_events.rb

@@ -7,7 +7,7 @@ def change
       definition.string :action, null: false, limit: 64
       definition.string :kind, null: false, limit: 32
       definition.string :subject_id, limit: 191
-      json_column definition, :filters
+      definition.public_send(json_type, :filters)
       definition.string :actor, limit: 255
       definition.datetime :occurred_at, null: false, precision: 6
       definition.timestamps precision: 6, null: false
@@ -20,12 +20,7 @@ def change
   private
 
   # @rbs () -> Symbol
-  def json_column_type
+  def json_type
     connection.adapter_name.match?(/postgres/i) ? :jsonb : :json
   end
-
-  # @rbs (untyped, Symbol, ?null: bool) -> void
-  def json_column(definition, name, null: true)
-    definition.public_send(json_column_type, name, null:)
-  end
 end

db/migrate/20260922000001_add_solid_objects_redrives.rb

@@ -5,7 +5,7 @@ class AddSolidObjectsRedrives < ActiveRecord::Migration[7.1]
   def change
     create_table SolidObjects.table_name(:redrives), id: :string, limit: 64 do |definition|
       definition.string :kind, null: false, limit: 32
-      json_column definition, :filters, null: false
+      definition.public_send(json_type, :filters, null: false)
       definition.string :status, null: false, default: "running", limit: 32
       definition.string :active_scope, limit: 191
       definition.integer :moved, null: false, default: 0
@@ -26,12 +26,7 @@ def change
   private
 
   # @rbs () -> Symbol
-  def json_column_type
+  def json_type
     connection.adapter_name.match?(/postgres/i) ? :jsonb : :json
   end
-
-  # @rbs (untyped, Symbol, ?null: bool) -> void
-  def json_column(definition, name, null: true)
-    definition.public_send(json_column_type, name, null:)
-  end
 end

lib/solid_objects/dead_letter_scope.rb

@@ -67,9 +67,6 @@ def dead
       model.where(status: DEAD)
     end
 
-    # A redrive moves what was already dead when it started. Without that bound
-    # a row that fails again lands back in the same scope, and a task whose
-    # handler is still broken would move it forever.
     # @rbs (Hash[String, untyped], ?dead_before: untyped) -> ActiveRecord::Relation[untyped]
     def matching(filters, dead_before: nil)
       relation = dead

lib/solid_objects/redrive_manager.rb

@@ -98,8 +98,6 @@ def open_task(scope:, filters:, active_scope:, authorization_context:)
       record
     end
 
-    # A running task reports what is left to move rather than a stored
-    # estimate, because rows die and are retried while it runs.
     # @rbs (Redrive) -> Integer
     def remaining_for(record)
       return 0 unless record.status == RUNNING

lib/solid_objects/redrive_runner.rb

@@ -1,13 +1,10 @@
 # rbs_inline: enabled
 
 module SolidObjects
-  # Moves dead rows back to pending for one redrive task at a time, in bounded
-  # batches. Each batch is its own short transaction, so a redrive of thousands
-  # of rows never holds a lock long enough to starve delivery.
   class RedriveRunner
     # @rbs () -> bool
     def run_once
-      database_adapter.transaction do
+      SolidObjects.database_adapter.transaction do
         record = claim
         next false unless record
 
@@ -19,7 +16,8 @@ def run_once
 
     # @rbs () -> Redrive?
     def claim
-      Redrive.lock.where(status: RedriveManager::RUNNING).order(:started_at, :id).first
+      relation = Redrive.where(status: RedriveManager::RUNNING).order(:started_at, :id)
+      SolidObjects.database_adapter.lock_candidates(relation).first
     end
 
     # @rbs (Redrive) -> bool
@@ -64,10 +62,5 @@ def finish(record)
       manager.close(record, status: RedriveManager::COMPLETED)
       manager.audit(record, action: "redrive.finish")
     end
-
-    # @rbs () -> DatabaseAdapter
-    def database_adapter
-      SolidObjects.database_adapter
-    end
   end
 end

lib/solid_objects/redrive_task.rb

@@ -3,7 +3,9 @@
 module SolidObjects
   RedriveTask = Data.define(
     :id, :kind, :filters, :status, :moved, :remaining, :started_at, :finished_at
-  ) do
+  )
+
+  class RedriveTask
     # @rbs (?authorization_context: untyped) -> RedriveTask
     def cancel(authorization_context: nil)
       SolidObjects.redrives.cancel(id, authorization_context:)

lib/solid_objects/supervisor.rb

@@ -207,10 +207,6 @@ def retention_pause(failures)
       [ backoff, interval ].min
     end
 
-    # An operator starts a redrive and expects it to move, so the supervisor
-    # advances it rather than ask the application to schedule a job. Each pass
-    # takes one bounded batch, and the loop pauses between batches so a large
-    # redrive shares the database with delivery.
     # @rbs () -> void
     def redrive_loop
       while @started

sig/generated/lib/solid_objects/dead_letter_scope.rbs

@@ -34,9 +34,6 @@ module SolidObjects
     # @rbs () -> ActiveRecord::Relation[untyped]
     def dead: () -> ActiveRecord::Relation[untyped]
 
-    # A redrive moves what was already dead when it started. Without that bound
-    # a row that fails again lands back in the same scope, and a task whose
-    # handler is still broken would move it forever.
     # @rbs (Hash[String, untyped], ?dead_before: untyped) -> ActiveRecord::Relation[untyped]
     def matching: (Hash[String, untyped], ?dead_before: untyped) -> ActiveRecord::Relation[untyped]
 

sig/generated/lib/solid_objects/redrive_manager.rbs

@@ -34,8 +34,6 @@ module SolidObjects
     # @rbs (scope: DeadLetterScope, filters: Hash[String, untyped], active_scope: String, authorization_context: untyped) -> Redrive
     def open_task: (scope: DeadLetterScope, filters: Hash[String, untyped], active_scope: String, authorization_context: untyped) -> Redrive
 
-    # A running task reports what is left to move rather than a stored
-    # estimate, because rows die and are retried while it runs.
     # @rbs (Redrive) -> Integer
     def remaining_for: (Redrive) -> Integer
 

sig/generated/lib/solid_objects/redrive_runner.rbs

@@ -1,9 +1,6 @@
 # Generated from lib/solid_objects/redrive_runner.rb with RBS::Inline
 
 module SolidObjects
-  # Moves dead rows back to pending for one redrive task at a time, in bounded
-  # batches. Each batch is its own short transaction, so a redrive of thousands
-  # of rows never holds a lock long enough to starve delivery.
   class RedriveRunner
     # @rbs () -> bool
     def run_once: () -> bool
@@ -24,8 +21,5 @@ module SolidObjects
 
     # @rbs (Redrive) -> void
     def finish: (Redrive) -> void
-
-    # @rbs () -> DatabaseAdapter
-    def database_adapter: () -> DatabaseAdapter
   end
 end