Dead connection mid-transaction crashes the entire process instead of rejecting cleanly

[smiggleworth]

Summary

A pg pool client loses the pool's idle error listener while checked out. The ORM does not attach a replacement during transaction, session, stream, or tooling lifetimes, so a socket error while the client is idle in a transaction is emitted as an unhandled error event and terminates the Node process.

Triage

Confirmed, High. A real PostgreSQL backend terminated with pg_terminate_backend() causes the reproducer child process to exit from an unhandled 57P01 event instead of rejecting the transaction.

Required implementation details

• Wrap every checked-out PoolClient immediately for its complete owned lifetime.
• Attach an error listener that stores the first failure normalized through normalizeDatabaseError.
• Check the stored failure before and after queries and before a session can report success.
• Remove the listener on release and tell the pool to discard a failed client.
• Rollback/savepoint cleanup after connection failure must be best-effort and must not replace the original normalized failure.
• Apply the wrapper consistently to transaction, session, owned stream, and tooling-description checkouts.

Acceptance criteria

• Verify the issue author is smiggleworth.
• Every checked-out PostgreSQL client has an error listener for the complete transaction/session/stream/tooling lifetime.
• A checked-out socket error is surfaced as a catchable DatabaseError using the existing normalization and connection classification.
• Failed clients are not returned as healthy pool clients; listeners are removed on release.
• Rollback and savepoint cleanup cannot replace the original connection failure.
• A fast unit regression proves listener attachment, 57P01 normalization, listener removal, and release.
• A real PostgreSQL child-process regression terminates the active backend while idle in a transaction, then proves the process survives and the transaction rejects with category: "connection" and code 57P01.
• Guardrail (prevent this class of bug): Keep real backend-termination coverage in every supported PostgreSQL-version CI job; mocked query rejection alone is not sufficient for pooled-connection correctness.
• Full ORM release gate, real PostgreSQL 16/17/18 hosted matrix, and exact-head CI pass before merge.

Definition of done

• All acceptance criteria above are checked with evidence and the release-prepared exact-head PR is ready for squash merge as @askrjs/orm@0.0.2.

Severity

High — ordinary database failover, network loss, timeout termination, or administrative cancellation can otherwise terminate the host process.

---

Found via a real-PostgreSQL infrastructure-failure pass.

[smiggleworth]

Acceptance evidence for 1f0c648a13a824ae6fddeb147f573c4796419eeb:

• Authorship verified: this issue was opened by smiggleworth.
• Red commit 26f5b31 runs the failure in a child process; PostgreSQL termination emits unhandled 57P01 and crashes Node on the old implementation.
• Green commit 488412d observes every checked-out client used by transactions, sessions, owned streams, and tooling descriptions. It stores the first normalized failure, checks it around queries and session success, removes the listener at release, and discards failed clients.
• Rollback/savepoint cleanup is best-effort and preserves the original failure.
• The fast unit guardrail proves listener attachment, normalization to DatabaseError { category: "connection", code: "57P01" }, removal, and release.
• The local PostgreSQL 18 child process survives pg_terminate_backend() while idle in a transaction and catches the normalized error.
• Full local release gate and all 6 real PostgreSQL tests pass; runtime audit reports zero vulnerabilities.
• Exact-head hosted run 31903030248 passes package CI plus the real PostgreSQL 16, 17, and 18 matrices: https://github.com/askrjs/askr-orm/actions/runs/31903030248

[smiggleworth]

Release closure:

• PR fix: harden PostgreSQL failure boundaries #17 squash-merged as bf6d7fd057855cbcc8e726136b0dd88bf686dd56.
• Publish run 31903111492 passed the full package and PostgreSQL 16/17/18 gates before publishing: https://github.com/askrjs/askr-orm/actions/runs/31903111492
• Annotated tag v0.0.2 resolves to the exact squash commit.
• npm serves @askrjs/orm@0.0.2 with integrity sha512-B+JJ7B8zFVZo2yPoQyEv0xcnfb/rtpuvDC1Et8LBu3c879v1gvCvedsl6nfLnnUTj9RPiwLcuPlTaUH0dMnjPQ==.
• A clean registry-only consumer connected the published package to PostgreSQL 18, terminated a checked-out transaction backend, caught DatabaseError { category: "connection", code: "57P01" }, then inserted and upserted all 1,000 rows of a 70-column table.
• The clean consumer reported zero runtime audit vulnerabilities. Its temporary PostgreSQL container was stopped and removed after verification.