fix(client): schema install must not commit or destroy a caller's transaction

[mhenrixon]

Summary

Follow-up addressing the cubic review on #398 (both findings valid, merged before I read them):

• P1: the ensure_pgmq_schema: concurrent install race across clients/processes can desync a shared libpq connection #397 framing issued BEGIN…COMMIT/ROLLBACK unconditionally. On the Proc-supplied shared-AR path the connection can arrive mid-transaction (perform_later inside an application transaction do), where BEGIN is a warning no-op and the matching COMMIT/ROLLBACK commits half of — or destroys — the caller's transaction. Framing is now transaction_status-aware: idle → owned BEGIN…COMMIT; in-transaction → SAVEPOINT pgbus_pgmq_install/RELEASE, ROLLBACK TO SAVEPOINT on failure. On the savepoint path the advisory lock joins the caller's transaction until it ends — over-holding delays a concurrent installer but never corrupts it.
• P3: the serialization spec's fixed sleep 0.05 could false-pass on a saturated scheduler (an unserialized B might simply not be scheduled inside the window). It now waits deterministically until thread B blocks or terminates before asserting zero connection traffic — an unserialized B terminates with traffic recorded and fails every time.

Refs #398

Test plan

• New specs: savepoint framing order + no BEGIN/COMMIT when transaction_status is INTRANS; ROLLBACK TO SAVEPOINT (never bare ROLLBACK) on duplicate-install; owned BEGIN/COMMIT when status is idle
• bundle exec rspec spec/pgbus/ spec/generators/ — 3857 examples, 0 failures
• bundle exec rubocop clean on changed files

---

Summary by cubic

Prevents PGMQ schema install from committing or destroying a caller’s open transaction and restores single‑owner access to the shared connection. Also stops caching non‑durable results so callers don’t skip checks after a rollback.

• Idle connection: run BEGIN…COMMIT with pg_advisory_xact_lock; install if missing; ROLLBACK on failure with a duplicate‑install recheck.
• Inside a caller transaction: frame in SAVEPOINT pgbus_pgmq_install; acquire the same lock; RELEASE on success; ROLLBACK TO SAVEPOINT on failure; never issue bare BEGIN/COMMIT/ROLLBACK; do not set @schema_ensured here. Side effect: the advisory lock is held until the outer transaction ends.
• Queue and DLQ DDL on a shared Proc connection: create the tables but do not set @queues_created; the next ensure re‑checks. Dedicated connections still cache.
• Connection safety: hold the per‑instance connection mutex during the transaction‑status probe, schema install, and queue/DLQ DDL (nested under the class‑level install mutex).
• Tests: add savepoint and idle‑ownership specs; deterministic serialization spec now waits for thread B to block or terminate and fails explicitly if it never settles.

^{Written for commit dfac1d3. Summary will update on new commits.}

[cubic-dev-ai]

Running ultrareview automatically — Schema-install transaction framing is now transaction-status-aware, switching between owned BEGIN/COMMIT and savepoint-based handling; a subtle bug here could commit or truncate a caller's open transaction, and the advisory-lock/savepoint interplay is concurrency-sensitive, so this warrants a.... I'll post findings when complete.

[cubic-dev-ai]

Ultrareview completed in 9m 27s

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 3 files (changes from recent commits).

Confidence score: 2/5

• In lib/pgbus/client.rb, ensure_single_queue can cache queue existence before the surrounding transaction commits, so a rollback can leave in-memory state saying the queue exists when its DDL was undone; subsequent calls may skip creation and fail at runtime when publishing/consuming. Move the cache update to post-commit (or clear it on rollback) so cache state cannot outlive rolled-back DDL.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="lib/pgbus/client.rb">

<violation number="1" location="lib/pgbus/client.rb:989">
P1: When the first queue creation runs inside a caller transaction, this savepoint path leaves the queue DDL in that transaction, but `ensure_single_queue` caches it before commit. If the caller rolls back, later `ensure_queue` calls skip recreation and message operations fail; defer or avoid the queue cache update until the caller transaction commits.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 3 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 3 files (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}