1.10.2

CHANGELOG.md

@@ -9,8 +9,20 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ### Fixed
 
+- Instances with heavy write traffic no longer crash-loop on the 1.10.1 upgrade. Dropping the legacy `points.latitude`/`points.longitude` columns needs an exclusive lock that busy instances could not win in one attempt, which aborted the migration and restarted the container in a loop. The drop is now retried, and if it still cannot get the lock it is handed to a background job so startup completes. If that job cannot get the lock either, the columns stay and the log prints the statement to run by hand — they are unused, so nothing breaks in the meantime (#3176)
+- Trial lifecycle email jobs left over from older releases are now discarded instead of retrying forever in the background queue. Mail addressed to a record that has since been deleted is also discarded rather than retried.
+- Reverse geocoding and place-name provider outages no longer flood error reporting with handled timeouts, dropped TLS connections, or invalid provider responses. A misconfigured or rate-limited provider — a bad API key, for example — is still reported.
+- Reverse geocoding retries point updates that time out while waiting on concurrent writes.
 - Google Semantic History and phone Timeline imports now tag points with a per-import tracker id instead of one shared constant, so tracks from different devices are no longer braided together. A one-time backfill rewrites existing points and regenerates affected tracks per user.
 - Points at exactly (0,0) — a common GPS glitch — are no longer accepted from any ingestion path (API, OwnTracks, Overland, Traccar, file imports) and no longer produce suggested visits at "Null Island". Existing (0,0) points are flagged as anomalies by a one-time cleanup that also removes visits placed at (0,0) and recalculates affected stats and tracks.
+- Place names you set yourself are no longer overwritten by nightly reverse geocoding. Renaming a place, creating one by hand, or picking one on the timeline locks its name; renaming it back to "Suggested place" hands it back to auto-naming. Map v2 and the place drawer show when a name is locked (#3086, #3175)
+- Real-time visit detection no longer stops after the first run for users who track continuously — the debounce key is now released when the job runs.
+- The nightly visit suggestion job no longer scans forward to the end of the calendar year; it processes only the day it was asked for.
+- Merged visits now report the correct duration, centre, radius and suggested name instead of keeping the values of the first cluster in the merge.
+- Visit suggestion failures no longer show a raw stack trace in your notifications, and repeated failures within an hour no longer create a notification each time (#3091)
+- Points at exactly (0,0) — a common GPS glitch — are no longer accepted from any ingestion path (API, OwnTracks, Overland, Traccar, file imports) and no longer produce suggested visits at "Null Island". Existing (0,0) points are flagged as anomalies by a one-time cleanup that also removes visits placed at (0,0), tolerates legacy points without timestamps, and recalculates affected stats and tracks.
+- Point uploads from all ingestion paths (REST API, OwnTracks, Overland, Traccar) now retry transient statement and lock-wait timeouts, not just deadlocks, instead of failing the upload.
+- The DNS caching layer no longer crashes with a misleading `NoMethodError` when the SMTP server is not configured in the background worker, so email delivery surfaces the real configuration error instead. (#3038)
 
 ## [1.10.1] - 2026-07-19, Berlin
 
@@ -40,6 +52,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 - Track generation and user data recalculations now retry a bounded number of times when another job is already processing the same user's tracks, instead of dropping the request and reporting an error; a genuinely stuck lock is logged after the retries are exhausted. The per-user lock also renews itself while a job runs and frees within a minute if a worker dies, so a crashed job no longer blocks a user's track processing for up to half an hour.
 - Dawarich added to an iOS Home Screen now opens Map v2 instead of an unrelated previously visited page (#3097)
 - Point uploads (REST API, OwnTracks, Overland, Traccar) now write batches in a consistent order so concurrent uploads no longer deadlock each other, and both uploads and anomaly filtering recover automatically from any remaining transient database deadlocks instead of failing the upload or background job.
+- Reverse geocoding overlapping places no longer exhausts retries because of concurrent database deadlocks.
 - The app and Sidekiq containers no longer crash-loop on startup when `WEB_CONCURRENCY` or `BACKGROUND_PROCESSING_CONCURRENCY` reach the container as an unexpanded `${VAR:-default}` string (seen with some podman-compose versions); the entrypoint now warns and falls back to the default value (#3124)
 - Cache preheating no longer times out for accounts with large location histories.
 - Cloud: Changing plans resets the Lite archival-warning state, so a user downgraded to Lite again is notified about archived data again.

app/controllers/api/v1/places_controller.rb

@@ -69,6 +69,7 @@ def show
 
       def create
         @place = current_api_user.places.build(place_params.except(:tag_ids))
+        @place.user_named = true
 
         if @place.save
           add_tags if tag_ids.present?
@@ -180,6 +181,7 @@ def serialize_place(place)
           icon: place.tags.first&.icon,
           color: place.tags.first&.color,
           visits_count: place.visits.size,
+          name_locked: place.name_locked?,
           created_at: place.created_at,
           tags: place.tags.map do |tag|
             {

app/controllers/places_controller.rb

@@ -19,6 +19,7 @@ def show
 
   def create
     @place = current_user.places.build(place_params.except(:tag_ids))
+    @place.user_named = true
 
     if @place.save
       add_tags if tag_ids.present?

app/javascript/controllers/maps/maplibre/data_loader.js

@@ -505,6 +505,7 @@ export class DataLoader {
           latitude: place.latitude,
           longitude: place.longitude,
           note: place.note,
+          nameLocked: Boolean(place.name_locked),
           // Stringify tags for MapLibre GL JS compatibility
           tags: JSON.stringify(place.tags || []),
           // Use first tag's color if available

app/javascript/controllers/maps/maplibre/event_handlers.js

@@ -191,6 +191,11 @@ export class EventHandlers {
       <div class="space-y-2">
         ${properties.tag ? `<div class="badge badge-sm badge-primary">${escapeHtml(properties.tag)}</div>` : ""}
         ${properties.description ? `<div>${escapeHtml(properties.description)}</div>` : ""}
+        ${
+          properties.nameLocked
+            ? `<div class="text-xs opacity-70" data-testid="place-name-lock">🔒 You named this place, so automatic naming won't change it. Rename it to "Suggested place" to hand it back.</div>`
+            : ""
+        }
       </div>
     `
 

app/jobs/data_migrations/cleanup_null_island_job.rb

@@ -10,7 +10,9 @@ def perform(user_id = nil)
 
     rows = user.points.null_island.pluck(:id, :timestamp, :track_id)
     track_ids = rows.filter_map(&:last).uniq
-    affected_months = rows.map do |_, timestamp, _|
+    affected_months = rows.filter_map do |_, timestamp, _|
+      next if timestamp.nil?
+
       time = Time.zone.at(timestamp)
       [time.year, time.month]
     end.uniq

app/jobs/data_migrations/drop_legacy_lat_lon_job.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+class DataMigrations::DropLegacyLatLonJob < ApplicationJob
+  queue_as :data_migrations
+
+  # Long enough to catch the gap between two batched writes. The same release
+  # backfills tracker ids and clears raw_data in 5k/10k-row batches that each
+  # hold RowExclusive on points for seconds at a time, so a one-second wait
+  # would expire inside a batch and lose every attempt. Each try does stall
+  # points behind an ACCESS EXCLUSIVE request, but at one try per five minutes
+  # that is a fraction of a percent of the time.
+  LOCK_TIMEOUT = '5s'
+
+  MAX_ATTEMPTS = 288
+
+  # Losing the lock race is the expected case on a busy instance, so back off and
+  # try again over the next day rather than reporting a failure. Attempts are
+  # capped: each one stalls points writes for LOCK_TIMEOUT, so a drop that can
+  # never win must stop and say so instead of retrying invisibly forever.
+  # QueryAborted covers both LockWaitTimeout's sibling StatementTimeout and the
+  # QueryCanceled that PostgreSQL raises when statement_timeout fires.
+  retry_on ActiveRecord::LockWaitTimeout, wait: 5.minutes, attempts: MAX_ATTEMPTS do |_job, error|
+    log_exhaustion(error)
+  end
+
+  retry_on ActiveRecord::QueryAborted, wait: 5.minutes, attempts: MAX_ATTEMPTS do |_job, error|
+    log_exhaustion(error)
+  end
+
+  def self.log_exhaustion(error)
+    Rails.logger.error(
+      "[DataMigrations::DropLegacyLatLon] gave up after #{MAX_ATTEMPTS} attempts (#{error.class}: #{error.message}); " \
+      'points.latitude / points.longitude are still present. Drop them once traffic is quiet with: ' \
+      "BEGIN; SET LOCAL lock_timeout = '#{LOCK_TIMEOUT}'; " \
+      'ALTER TABLE points DROP COLUMN IF EXISTS latitude, DROP COLUMN IF EXISTS longitude; COMMIT;'
+    )
+  end
+
+  def perform
+    connection = ActiveRecord::Base.connection
+    return unless legacy_columns?(connection)
+
+    # SET LOCAL binds both timeouts to this transaction's backend so they survive
+    # PgBouncer transaction pooling — a bare SET + ALTER can otherwise land on
+    # different servers, leaving the drop with no timeout at all and an unbounded
+    # ACCESS EXCLUSIVE request queued ahead of every points read and write.
+    # statement_timeout is pinned off so only lock_timeout bounds the wait; the
+    # drop itself is metadata-only once the lock is held.
+    connection.transaction do
+      connection.execute('SET LOCAL statement_timeout = 0')
+      connection.execute("SET LOCAL lock_timeout = '#{LOCK_TIMEOUT}'")
+      connection.execute('ALTER TABLE points DROP COLUMN IF EXISTS latitude, DROP COLUMN IF EXISTS longitude')
+    end
+
+    Rails.logger.info('[DataMigrations::DropLegacyLatLon] dropped legacy points.latitude / points.longitude')
+  end
+
+  private
+
+  def legacy_columns?(connection)
+    connection.column_exists?(:points, :latitude) || connection.column_exists?(:points, :longitude)
+  end
+end

app/jobs/users/mailer_sending_job.rb

@@ -13,9 +13,23 @@ class UnknownEmailType < StandardError; end
     'account_destroy_confirmation' => ['UsersMailer', :account_destroy_confirmation]
   }.freeze
 
+  LEGACY_MANAGER_EMAIL_TYPES = %w[
+    trial_expired
+    trial_expires_soon
+    post_trial_reminder_early
+    post_trial_reminder_late
+  ].freeze
+
   def perform(user_id, email_type, **options)
     user = find_user_or_skip(user_id) || return
 
+    if LEGACY_MANAGER_EMAIL_TYPES.include?(email_type.to_s)
+      Rails.logger.info(
+        "[Users::MailerSendingJob] skipping legacy Manager-owned email_type=#{email_type} user_id=#{user.id}"
+      )
+      return
+    end
+
     mailer_class_name, action = MAILER_REGISTRY.fetch(email_type.to_s) do
       raise UnknownEmailType, "Unknown email_type=#{email_type.inspect} user_id=#{user.id}"
     end

app/jobs/visit_suggesting_job.rb

@@ -8,6 +8,8 @@ class VisitSuggestingJob < ApplicationJob
 
   # Passing timespan of more than 3 years somehow results in duplicated Places
   def perform(user_id:, start_at:, end_at:)
+    release_debounce_key(user_id)
+
     user = find_user_or_skip(user_id) || return
 
     return unless user.safe_settings.visits_suggestions_enabled?
@@ -28,6 +30,13 @@ def perform(user_id:, start_at:, end_at:)
 
   private
 
+  # retry: false means a transient Redis blip here would otherwise drop the whole run.
+  def release_debounce_key(user_id)
+    Visits::RealtimeDebouncer.new(user_id).clear
+  rescue StandardError => e
+    Rails.logger.warn("[VisitSuggestingJob] debounce key release failed user_id=#{user_id}: #{e.class}: #{e.message}")
+  end
+
   def parse_date(date)
     date.is_a?(String) ? Time.zone.parse(date) : date.to_datetime
   end

app/mailers/application_mailer.rb

@@ -3,4 +3,8 @@
 class ApplicationMailer < ActionMailer::Base
   default from: ENV['SMTP_FROM']
   layout 'mailer'
+
+  rescue_from ActiveJob::DeserializationError do |exception|
+    Rails.logger.info("[ApplicationMailer] discarding delivery for a missing record: #{exception.message}")
+  end
 end

app/mailers/users_mailer.rb

@@ -47,4 +47,12 @@ def otp_account_locked
 
     mail(to: @user.email, subject: 'Dawarich account temporarily locked')
   end
+
+  def trial_expired; end
+
+  def trial_expires_soon; end
+
+  def post_trial_reminder_early; end
+
+  def post_trial_reminder_late; end
 end

app/models/concerns/archivable.rb

@@ -21,6 +21,11 @@ module Archivable
   UPSERT_MAX_RETRIES = 3
   UPSERT_BACKOFF_BASE = 0.1
   UPSERT_BACKOFF_JITTER = 0.05
+  UPSERT_CONTENTION_ERRORS = [
+    ActiveRecord::Deadlocked,
+    ActiveRecord::LockWaitTimeout,
+    ActiveRecord::QueryCanceled
+  ].freeze
 
   class_methods do
     # Bulk-ingest counterpart of the reset_archival_on_raw_data_change
@@ -40,7 +45,7 @@ def archival_safe_upsert_all(rows, returning:)
       set_clauses << '"updated_at" = CURRENT_TIMESTAMP' unless update_columns.include?(:updated_at)
       set_clauses.concat(archival_reset_clauses) if update_columns.include?(:raw_data)
 
-      with_deadlock_retry do
+      with_write_contention_retry do
         upsert_all(
           rows,
           unique_by: UPSERT_CONFLICT_KEYS,
@@ -52,12 +57,12 @@ def archival_safe_upsert_all(rows, returning:)
 
     private
 
-    def with_deadlock_retry
+    def with_write_contention_retry
       retries = 0
 
       begin
         yield
-      rescue ActiveRecord::Deadlocked => e
+      rescue *UPSERT_CONTENTION_ERRORS => e
         retries += 1
         raise e if retries > UPSERT_MAX_RETRIES
 

app/models/place.rb

@@ -14,7 +14,10 @@ class Place < ApplicationRecord
   has_many :place_visits, dependent: :destroy
   has_many :suggested_visits, -> { distinct }, through: :place_visits, source: :visit
 
+  attr_accessor :machine_named, :user_named
+
   before_validation :build_lonlat, if: -> { latitude.present? && longitude.present? }
+  before_save :lock_name_on_user_edit
 
   validates :name, presence: true, length: { maximum: 255 }
   validates :lonlat, presence: true
@@ -39,6 +42,10 @@ def lat
     lonlat.y
   end
 
+  def name_locked?
+    name_locked_at.present?
+  end
+
   def osm_id
     geodata.dig('properties', 'osm_id')
   end
@@ -60,4 +67,14 @@ def osm_type
   def build_lonlat
     self.lonlat = "POINT(#{longitude} #{latitude})"
   end
+
+  def lock_name_on_user_edit
+    return if machine_named
+    return unless will_save_change_to_name?
+
+    return self.name_locked_at = nil if name == DEFAULT_NAME
+    return if new_record? && !user_named
+
+    self.name_locked_at = Time.current
+  end
 end

app/serializers/api/place_serializer.rb

@@ -17,7 +17,8 @@ def call
       geodata:    place.geodata,
       created_at: place.created_at,
       updated_at: place.updated_at,
-      reverse_geocoded_at: place.reverse_geocoded_at
+      reverse_geocoded_at: place.reverse_geocoded_at,
+      name_locked: place.name_locked?
     }
   end
 

app/services/places/name_fetcher.rb

@@ -33,17 +33,28 @@ def call
       name = ::Visits::Names::Builder.build_from_properties(properties)
 
       ActiveRecord::Base.transaction do
-        place.name = name if name.present?
+        place.machine_named = true
+        place.name = name if name.present? && !place.name_locked?
         place.city = properties['city'] if properties['city'].present?
         place.country = properties['country'] if properties['country'].present?
         place.geodata = result.data if DawarichSettings.store_geodata?
         place.save!
-        place.visits.where(name: Place::DEFAULT_NAME).update_all(name: name) if name.present?
+
+        propagated_name = place.name
+        place.visits.where(name: Place::DEFAULT_NAME).update_all(name: propagated_name) if propagated_name.present?
+
         place
       end
+    rescue *ReverseGeocoding::ProviderErrors::TRANSIENT => e
+      Rails.logger.warn("Geocoding provider error in NameFetcher for place #{place.id}: #{e.message}")
+      nil
     rescue StandardError => e
-      Rails.logger.error("Geocoding error in NameFetcher for place #{place.id}: #{e.message}")
-      ExceptionReporter.call(e)
+      if ReverseGeocoding::ProviderErrors.transient_tls?(e)
+        Rails.logger.warn("Geocoding provider error in NameFetcher for place #{place.id}: #{e.message}")
+      else
+        Rails.logger.error("Geocoding error in NameFetcher for place #{place.id}: #{e.message}")
+        ExceptionReporter.call(e)
+      end
       nil
     end
 

app/services/reverse_geocoding/places/fetch_data.rb

@@ -36,15 +36,18 @@
 
     data = normalize_geocoder_data(reverse_geocoded_place.data)
 
-    place.update!(
-      name:       place_name(data),
+    attributes = {
       lonlat:     build_point_coordinates(data['geometry']['coordinates']),
       city:       data['properties']['city'],
       country:    data['properties']['country'],
       geodata:    data,
       source:     Place.sources[:photon],
       reverse_geocoded_at: Time.current
-    )
+    }
+    attributes[:name] = place_name(data) unless place.name_locked?
+
+    place.machine_named = true
+    place.update!(attributes)
   end
 
   def find_place(place_data, existing_places)
@@ -107,7 +110,7 @@
   end
 
   def populate_place_attributes(place, data)
-    place.name = place_name(data)
+    place.name = place_name(data) unless place.name_locked?
     place.city = data['properties']['city']
     place.country = data['properties']['country']
     place.geodata = data
@@ -142,7 +145,7 @@
 
     return unless places_to_update.any?
 
-    update_attributes = places_to_update.uniq(&:id).map do |place|
+    update_attributes = places_to_update.uniq(&:id).sort_by(&:id).map do |place|
       {
         id: place.id,
         name: place.name,