unwind owned rows on pool release failure

Author: oswalpalash

docs/FEATURE_MATRIX.md

@@ -20,7 +20,7 @@ coverage; PostgreSQL rows marked live also run against PostgreSQL 16 in CI.
 | Safe parameter binding | Complete | positional/named APIs; single-allocation PostgreSQL Bind packets; full unsigned 16-bit parameter count; strict protocol C-strings | byte-parity/allocation/NUL tests; driver tests; `tests/postgres_live.zig` |
 | Typed row decoding | Complete | `Row.as`, `Row.asName`, `Row.to`, `zsql.decode`; owned PostgreSQL bytea hex/escape decode; single-schema query contract | malformed/OOM unit tests; multi-result recovery and core/live driver tests |
 | Explicit owned rows | Complete | `OwnedRow`, `Row.getOwned`, `zsql.freeOwnedRows`; documented invalidation boundary for borrowed values | allocator-backed core/driver tests plus external SQLite survival after rows, connection, and database teardown |
-| Connection pooling | Complete | `Pool(D)`, `Lease(D)`, health-aware consuming release, OOM-safe idle return, shutdown draining/wakeup, stats and timeouts | SQLite recovery/lifecycle tests; PostgreSQL live release-OOM/shutdown/recovery tests |
+| Connection pooling | Complete | `Pool(D)`, `Lease(D)`, health-aware consuming release, OOM-safe idle return and owned-result unwind, shutdown draining/wakeup, stats and timeouts | SQLite release-OOM/result-unwind/recovery tests; PostgreSQL live release-OOM/result-unwind/shutdown tests |
 | Transactions and savepoints | Complete | explicit nested/idle/aborted states; PostgreSQL `25P02` mapping; prepared-statement transition safety; failed-state savepoint recovery; `Tx(D)`, `Savepoint(D)`, `withTx` | SQLite state tests and PostgreSQL direct/prepared/pool live tests |
 | Migrations | Complete | transactional apply, durable dirty failures, checksum-guarded API/CLI repair; `Migrator(D).up`, `.status` | SQLite repair workflow, PostgreSQL live repair tests, CLI parser tests, migration example |
 | Schema inspection | Complete | driver `inspectSchema`; dialect-tagged CLI `inspect`; structured PostgreSQL schema/table identity; self-contained nullable struct generation with exact fields and schema-aware collision-free table types | inspector/codegen syntax tests and PostgreSQL live tests |

src/drivers/postgres/pool.zig

@@ -260,10 +260,11 @@ pub const Pool = struct {
     pub fn queryOneParams(self: *Pool, sql: []const u8, binds: []const core.Value) !core.OwnedRow {
         var lease = try self.acquire();
         errdefer if (lease.open) lease.discard() catch {};
-        const owned = (try lease.conn()).queryOneParams(sql, binds) catch |err| {
+        var owned = (try lease.conn()).queryOneParams(sql, binds) catch |err| {
             lease.finishAfterError(err);
             return err;
         };
+        errdefer owned.deinit();
         try lease.release();
         return owned;
     }
@@ -277,6 +278,7 @@ pub const Pool = struct {
             lease.finishAfterError(err);
             return err;
         };
+        errdefer core.OwnedRow.freeSlice(self.allocator, owned);
         try lease.release();
         return owned;
     }

src/drivers/sqlite/sqlite.zig

@@ -323,10 +323,11 @@ pub const Pool = struct {
     pub fn queryOne(self: *Pool, sql: []const u8, binds: []const core.Value) !core.OwnedRow {
         var lease = try self.acquire();
         errdefer if (lease.open) lease.discard() catch {};
-        const owned = (try lease.conn()).queryOne(sql, binds) catch |err| {
+        var owned = (try lease.conn()).queryOne(sql, binds) catch |err| {
             lease.finishAfterError(err);
             return err;
         };
+        errdefer owned.deinit();
         try lease.release();
         return owned;
     }
@@ -340,6 +341,7 @@ pub const Pool = struct {
             lease.finishAfterError(err);
             return err;
         };
+        errdefer core.OwnedRow.freeSlice(self.allocator, owned);
         try lease.release();
         return owned;
     }
@@ -431,7 +433,14 @@ pub const Lease = struct {
         }
 
         if (self.pool.idle.items.len < self.pool.effectiveMaxIdle()) {
-            try self.pool.idle.append(self.pool.allocator, self.db);
+            self.pool.idle.append(self.pool.allocator, self.db) catch |err| {
+                self.conn_value.close();
+                self.db.deinit();
+                self.pool.open_count -|= 1;
+                self.open = false;
+                self.pool.notifyAvailable();
+                return err;
+            };
             self.conn_value.close();
         } else {
             self.conn_value.close();
@@ -3000,6 +3009,72 @@ test "SQLite pool timed acquire unblocks after concurrent release" {
     try std.testing.expectEqual(@as(usize, 0), ctx.err_len);
 }
 
+test "SQLite lease release consumes connection when idle growth is OOM" {
+    var failing = std.testing.FailingAllocator.init(std.testing.allocator, .{});
+    var pool = try Pool.init(failing.allocator(), std.testing.io, .{
+        .max_open = 1,
+        .max_idle = 1,
+    });
+    defer pool.deinit();
+
+    var lease = try pool.acquire();
+    try (try lease.conn()).ping();
+    failing.fail_index = failing.alloc_index;
+    try std.testing.expectError(error.OutOfMemory, lease.release());
+    try std.testing.expect(failing.has_induced_failure);
+    try std.testing.expect(!lease.open);
+    try std.testing.expectEqual(@as(usize, 0), pool.stats().open);
+    try std.testing.expectEqual(@as(usize, 0), pool.stats().leased);
+
+    failing.fail_index = std.math.maxInt(usize);
+    try pool.ping();
+    try std.testing.expectEqual(@as(usize, 1), pool.stats().idle);
+}
+
+test "SQLite owned pool results unwind when release observes shutdown" {
+    const CloseOnQuery = struct {
+        pool: *Pool,
+        closed: bool = false,
+
+        fn after(raw: ?*anyopaque, _: core.QueryEnd) void {
+            const self: *@This() = @ptrCast(@alignCast(raw.?));
+            if (self.closed) return;
+            self.closed = true;
+            self.pool.deinit();
+        }
+
+        fn hooks(self: *@This()) core.Hooks {
+            return .{ .ctx = self, .after_query = after };
+        }
+    };
+
+    {
+        var pool = try Pool.init(std.testing.allocator, std.testing.io, .{ .max_open = 1 });
+        defer pool.deinit();
+        _ = try pool.exec("create table release_one (id integer primary key)", &.{});
+        _ = try pool.exec("insert into release_one (id) values (1)", &.{});
+        var state = CloseOnQuery{ .pool = &pool };
+        pool.config.hooks = state.hooks();
+        try std.testing.expectError(
+            error.PoolClosed,
+            pool.queryOne("select id from release_one", &.{}),
+        );
+    }
+
+    {
+        var pool = try Pool.init(std.testing.allocator, std.testing.io, .{ .max_open = 1 });
+        defer pool.deinit();
+        _ = try pool.exec("create table release_all (id integer primary key)", &.{});
+        _ = try pool.exec("insert into release_all (id) values (1), (2)", &.{});
+        var state = CloseOnQuery{ .pool = &pool };
+        pool.config.hooks = state.hooks();
+        try std.testing.expectError(
+            error.PoolClosed,
+            pool.queryAll("select id from release_all order by id", &.{}),
+        );
+    }
+}
+
 test "SQLite pool queryOne returns single owned row" {
     var pool = try Pool.init(std.testing.allocator, std.testing.io, .{ .max_open = 2 });
     defer pool.deinit();

tests/postgres_live.zig

@@ -419,6 +419,65 @@ test "postgres live: pool queryAllParams collects owned rows" {
     try pool.ping();
 }
 
+test "postgres live: owned pool results unwind when release observes shutdown" {
+    var gpa_state: std.heap.DebugAllocator(.{}) = .init;
+    defer std.debug.assert(gpa_state.deinit() == .ok);
+    const allocator = gpa_state.allocator();
+    const url_str = try requireUrl(allocator);
+    defer allocator.free(url_str);
+    var config = try pg.parseUrl(allocator, url_str);
+    defer config.deinit();
+
+    const CloseOnQuery = struct {
+        pool: *pg.Pool,
+        closed: bool = false,
+
+        fn after(raw: ?*anyopaque, _: zsql.QueryEnd) void {
+            const self: *@This() = @ptrCast(@alignCast(raw.?));
+            if (self.closed) return;
+            self.closed = true;
+            self.pool.deinit();
+        }
+
+        fn hooks(self: *@This()) zsql.Hooks {
+            return .{ .ctx = self, .after_query = after };
+        }
+    };
+
+    {
+        var pool = try pg.Pool.init(allocator, std.testing.io, .{
+            .database = config,
+            .max_open = 1,
+            .max_idle = 1,
+        });
+        defer pool.deinit();
+        var state = CloseOnQuery{ .pool = &pool };
+        pool.config.hooks = state.hooks();
+        try std.testing.expectError(
+            error.PoolClosed,
+            pool.queryOneParams("select 1::int as id", &.{}),
+        );
+    }
+
+    {
+        var pool = try pg.Pool.init(allocator, std.testing.io, .{
+            .database = config,
+            .max_open = 1,
+            .max_idle = 1,
+        });
+        defer pool.deinit();
+        var state = CloseOnQuery{ .pool = &pool };
+        pool.config.hooks = state.hooks();
+        try std.testing.expectError(
+            error.PoolClosed,
+            pool.queryAllParams(
+                "select id from (values (1), (2)) as rows(id) order by id",
+                &.{},
+            ),
+        );
+    }
+}
+
 test "postgres live: pool withTx commits and rolls back" {
     var gpa_state: std.heap.DebugAllocator(.{}) = .init;
     defer _ = gpa_state.deinit();