@rotorsoft/act-pg 1.13.0 → 1.13.2

package/dist/@types/postgres-store.d.ts

@@ -188,6 +188,34 @@ export declare class PostgresStore implements Store {
      * connection would re-fire the stale handler.
      */
     private _listen_handler;
+    /**
+     * Error listener attached to the active LISTEN client. node-postgres
+     * removes its idle-error guard on checkout, so a checked-out client
+     * that emits `error` (backend restart, failover, network drop) with no
+     * listener is an uncaught exception — a process crash (#1189). Tracked
+     * alongside `_listen_handler` so teardown detaches it in lockstep.
+     */
+    private _listen_error_handler;
+    /**
+     * The caller's notification handler for the active subscription, kept
+     * so the self-healing reconnect path (#1189) can re-establish LISTEN
+     * on a fresh client after the dedicated one emits `error`. Cleared by
+     * `_teardown_listen`, which is what makes disposal cancel any pending
+     * reconnect.
+     */
+    private _notify_handler;
+    /**
+     * Pending reconnect timer, if a LISTEN client error scheduled one.
+     * Tracked so `_teardown_listen` (and therefore `dispose()`) can cancel
+     * it — a reconnect must never fire after teardown.
+     */
+    private _reconnect_timer;
+    /**
+     * Consecutive reconnect attempts since the last healthy LISTEN, used to
+     * grow the capped exponential backoff. Reset to 0 once a re-LISTEN
+     * succeeds.
+     */
+    private _reconnect_attempts;
     /**
      * Cross-process commit subscription. **Present only when
      * `config.notify === true`** — the orchestrator's auto-wire path
@@ -228,11 +256,17 @@ export declare class PostgresStore implements Store {
      */
     dispose(): Promise<void>;
     /**
-     * Tear down the active LISTEN subscription if any: detach the
-     * notification listener, run UNLISTEN, and destroy the dedicated
-     * client (do not return it to the pool — its listener is removed but
-     * destroying belt-and-braces guards against any future change in
-     * pg-pool semantics that could re-issue a half-clean client).
+     * Tear down the active LISTEN subscription if any: cancel any pending
+     * reconnect, forget the caller's handler (so no reconnect can fire
+     * after teardown), detach the notification + error listeners, run
+     * UNLISTEN, and destroy the dedicated client (do not return it to the
+     * pool — its listeners are removed but destroying belt-and-braces
+     * guards against any future change in pg-pool semantics that could
+     * re-issue a half-clean client).
+     *
+     * Clearing `_notify_handler` and the reconnect timer here is what makes
+     * `dispose()` safe during a pending reconnect (#1189): a scheduled
+     * `_reconnect` bails the moment it finds no handler.
      */
     private _teardown_listen;
     /**
@@ -437,10 +471,35 @@ export declare class PostgresStore implements Store {
      * client; pool disposal also tears the subscription down as a safety
      * net.
      *
+     * The subscription is **self-healing** (#1189): the dedicated client
+     * has an `error` listener that, on a connection blip (backend restart,
+     * failover, network drop), tears the dead client down and re-LISTENs
+     * on a fresh one with capped exponential backoff — degrading to the
+     * poll path in between. A pending reconnect is cancelled by disposal,
+     * so no reconnect fires after teardown.
+     *
      * @param handler Called for each cross-process commit notification.
      * @returns Disposer that releases the LISTEN client.
      */
     private _subscribe_notifications;
+    /**
+     * Check out a dedicated client, attach the notification + error
+     * listeners, and run `LISTEN`. Shared by the initial subscription and
+     * every reconnect (#1189). On any failure before `LISTEN` succeeds the
+     * client is detached and destroyed so nothing leaks — the caller
+     * decides whether to propagate (initial subscribe) or reschedule
+     * (reconnect).
+     */
+    private _open_listen;
+    /**
+     * Self-heal the LISTEN subscription after the dedicated client emitted
+     * `error` (#1189). Detaches and destroys the dead client, then
+     * reconnects on a fresh one with capped exponential backoff. Bails
+     * immediately if the subscription was disposed while a reconnect was
+     * pending (`_notify_handler` cleared by `_teardown_listen`), so no
+     * reconnect ever fires after teardown.
+     */
+    private _reconnect;
     /**
      * Atomically truncates streams and seeds each with a snapshot or tombstone.
      * Windowed targets (`before` set) prune the prefix below the closest safe

package/dist/@types/postgres-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-store.d.ts","sourceRoot":"","sources":["../../src/postgres-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,SAAS,EACT,KAAK,EAEL,OAAO,EACP,cAAc,EACd,KAAK,EACL,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,MAAM,EACN,OAAO,EACP,KAAK,EACL,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,WAAW,EACZ,MAAM,gBAAgB,CAAC;AAQxB,OAAO,EAEL,KAAK,UAAU,EAGhB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,IAAI,CAAC;AAUpB,KAAK,MAAM,GAAG,QAAQ,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,cAAc,CAAC,EAAE,UAAU,CAAC;CAC7B,CAAC,GACA,EAAE,CAAC,UAAU,CAAC;AA2EhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2GG;AACH,qBAAa,aAAc,YAAW,KAAK;IACzC,OAAO,CAAC,KAAK,CAAC;IACd,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAC5C;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,8DAA8D;IAC9D,OAAO,CAAC,cAAc,CAA4B;IAClD;;;;;OAKG;IACH,OAAO,CAAC,eAAe,CAA+C;IACtE;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,CACP,OAAO,EAAE,CAAC,YAAY,EAAE,iBAAiB,KAAK,IAAI,KAC/C,OAAO,CAAC,cAAc,CAAC,CAAC;IAE7B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsC;IAEvE;;;OAGG;gBACS,MAAM,GAAE,OAAO,CAAC,MAAM,CAAM;IAyBxC;;;;;;;OAOG;YACW,OAAO;IAQrB;;;;OAIG;IACG,OAAO;IAKb;;;;;;OAMG;YACW,gBAAgB;IAe9B;;;;OAIG;IACG,IAAI;IAuIV;;;OAGG;IACG,IAAI;IAoBV;;;;;;;;;OASG;IACG,KAAK,CAAC,CAAC,SAAS,OAAO,EAC3B,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI,EAChD,KAAK,CAAC,EAAE,KAAK;IAgGf;;;;;;;;;OASG;IACG,MAAM,CAAC,CAAC,SAAS,OAAO,EAC5B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,EAC3B,IAAI,EAAE,SAAS,EACf,eAAe,CAAC,EAAE,MAAM;IA0G1B;;;;;;;;;;;;;OAaG;IACG,KAAK,CACT,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,EAAE,CAAC;IAsFnB;;;;;;OAMG;IACG,SAAS,CACb,OAAO,EAAE,KAAK,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC,GACD,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IA8DrD;;;;;OAKG;IACG,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IA6D5C;;;;OAIG;IACG,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IA+C5D;;;;;;;;;OASG;IACG,KAAK,CACT,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,EAC9B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;IAoBlB;;;;;OAKG;IACH;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAqChB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IAmB5D;;;;;;;;;;;;;;OAcG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IA0B9D;;;;;;;;;;;;;OAaG;IACG,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQzE;;;;;;;;;OASG;IACG,aAAa,CACjB,QAAQ,EAAE,CAAC,QAAQ,EAAE,cAAc,KAAK,IAAI,EAC5C,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC,kBAAkB,CAAC;IA+F9B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,WAAW,CAAC,CAAC,SAAS,OAAO,EACjC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,cAAc,CAAC,EAC/D,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IA2EvC;;;;OAIG;YACW,uBAAuB;IA6CrC;;;;OAIG;YACW,sBAAsB;IA2GpC;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,wBAAwB;IAuFtC;;;;;;;;OAQG;IACG,QAAQ,CACZ,OAAO,EAAE,KAAK,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,SAAS,CAAC;QACjB,MAAM,CAAC,EAAE,IAAI,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,GACD,OAAO,CACR,GAAG,CACD,MAAM,EACN;QACE,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,IAAI,CAAC;KACf,CACF,CACF;IA2ED;;;;;;;;;;;OAWG;IACG,OAAO,CACX,MAAM,EAAE,CACN,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KACpE,OAAO,CAAC,IAAI,CAAC,GACjB,OAAO,CAAC,IAAI,CAAC;IA8ChB;;;;;;;;;;;;;;;OAeG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAOlD"}
+{"version":3,"file":"postgres-store.d.ts","sourceRoot":"","sources":["../../src/postgres-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,SAAS,EACT,KAAK,EAEL,OAAO,EACP,cAAc,EACd,KAAK,EACL,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,MAAM,EACN,OAAO,EACP,KAAK,EACL,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,WAAW,EACZ,MAAM,gBAAgB,CAAC;AAQxB,OAAO,EAEL,KAAK,UAAU,EAGhB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,IAAI,CAAC;AAUpB,KAAK,MAAM,GAAG,QAAQ,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,cAAc,CAAC,EAAE,UAAU,CAAC;CAC7B,CAAC,GACA,EAAE,CAAC,UAAU,CAAC;AAmFhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2GG;AACH,qBAAa,aAAc,YAAW,KAAK;IACzC,OAAO,CAAC,KAAK,CAAC;IACd,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAC5C;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,8DAA8D;IAC9D,OAAO,CAAC,cAAc,CAA4B;IAClD;;;;;OAKG;IACH,OAAO,CAAC,eAAe,CAA+C;IACtE;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB,CAAqC;IAClE;;;;;;OAMG;IACH,OAAO,CAAC,eAAe,CAET;IACd;;;;OAIG;IACH,OAAO,CAAC,gBAAgB,CAA4C;IACpE;;;;OAIG;IACH,OAAO,CAAC,mBAAmB,CAAK;IAChC;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,CACP,OAAO,EAAE,CAAC,YAAY,EAAE,iBAAiB,KAAK,IAAI,KAC/C,OAAO,CAAC,cAAc,CAAC,CAAC;IAE7B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsC;IAEvE;;;OAGG;gBACS,MAAM,GAAE,OAAO,CAAC,MAAM,CAAM;IAyBxC;;;;;;;OAOG;YACW,OAAO;IAQrB;;;;OAIG;IACG,OAAO;IAKb;;;;;;;;;;;;OAYG;YACW,gBAAgB;IAwB9B;;;;OAIG;IACG,IAAI;IAgKV;;;OAGG;IACG,IAAI;IAoBV;;;;;;;;;OASG;IACG,KAAK,CAAC,CAAC,SAAS,OAAO,EAC3B,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI,EAChD,KAAK,CAAC,EAAE,KAAK;IAgGf;;;;;;;;;OASG;IACG,MAAM,CAAC,CAAC,SAAS,OAAO,EAC5B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,EAC3B,IAAI,EAAE,SAAS,EACf,eAAe,CAAC,EAAE,MAAM;IA4J1B;;;;;;;;;;;;;OAaG;IACG,KAAK,CACT,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,EAAE,CAAC;IAsFnB;;;;;;OAMG;IACG,SAAS,CACb,OAAO,EAAE,KAAK,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC,GACD,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IA8DrD;;;;;OAKG;IACG,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IA6D5C;;;;OAIG;IACG,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IA+C5D;;;;;;;;;OASG;IACG,KAAK,CACT,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,EAC9B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;IAoBlB;;;;;OAKG;IACH;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAqChB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IAmB5D;;;;;;;;;;;;;;OAcG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IA0B9D;;;;;;;;;;;;;OAaG;IACG,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQzE;;;;;;;;;OASG;IACG,aAAa,CACjB,QAAQ,EAAE,CAAC,QAAQ,EAAE,cAAc,KAAK,IAAI,EAC5C,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC,kBAAkB,CAAC;IA+F9B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,WAAW,CAAC,CAAC,SAAS,OAAO,EACjC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,cAAc,CAAC,EAC/D,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IA2EvC;;;;OAIG;YACW,uBAAuB;IA6CrC;;;;OAIG;YACW,sBAAsB;IA2GpC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;YACW,wBAAwB;IA2BtC;;;;;;;OAOG;YACW,YAAY;IA2F1B;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU;IAoClB;;;;;;;;OAQG;IACG,QAAQ,CACZ,OAAO,EAAE,KAAK,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,SAAS,CAAC;QACjB,MAAM,CAAC,EAAE,IAAI,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC,GACD,OAAO,CACR,GAAG,CACD,MAAM,EACN;QACE,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,IAAI,CAAC;KACf,CACF,CACF;IAiFD;;;;;;;;;;;OAWG;IACG,OAAO,CACX,MAAM,EAAE,CACN,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KACpE,OAAO,CAAC,IAAI,CAAC,GACjB,OAAO,CAAC,IAAI,CAAC;IA8ChB;;;;;;;;;;;;;;;OAeG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAOlD"}

package/dist/index.cjs

@@ -60,6 +60,8 @@ var SAFE_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 var PG_UNIQUE_VIOLATION = "23505";
 var NOTIFY_CHANNEL_PREFIX = "act_commit";
 var NOTIFY_MAX_PAYLOAD_BYTES = 8e3;
+var NOTIFY_RECONNECT_BASE_MS = 250;
+var NOTIFY_RECONNECT_MAX_MS = 3e4;
 function notify_channel(schema, table) {
   return `${NOTIFY_CHANNEL_PREFIX}_${schema}_${table}`;
 }
@@ -132,6 +134,34 @@ var PostgresStore = class {
    * connection would re-fire the stale handler.
    */
   _listen_handler;
+  /**
+   * Error listener attached to the active LISTEN client. node-postgres
+   * removes its idle-error guard on checkout, so a checked-out client
+   * that emits `error` (backend restart, failover, network drop) with no
+   * listener is an uncaught exception — a process crash (#1189). Tracked
+   * alongside `_listen_handler` so teardown detaches it in lockstep.
+   */
+  _listen_error_handler;
+  /**
+   * The caller's notification handler for the active subscription, kept
+   * so the self-healing reconnect path (#1189) can re-establish LISTEN
+   * on a fresh client after the dedicated one emits `error`. Cleared by
+   * `_teardown_listen`, which is what makes disposal cancel any pending
+   * reconnect.
+   */
+  _notify_handler;
+  /**
+   * Pending reconnect timer, if a LISTEN client error scheduled one.
+   * Tracked so `_teardown_listen` (and therefore `dispose()`) can cancel
+   * it — a reconnect must never fire after teardown.
+   */
+  _reconnect_timer;
+  /**
+   * Consecutive reconnect attempts since the last healthy LISTEN, used to
+   * grow the capped exponential backoff. Reset to 0 once a re-LISTEN
+   * succeeds.
+   */
+  _reconnect_attempts = 0;
   /**
    * Cross-process commit subscription. **Present only when
    * `config.notify === true`** — the orchestrator's auto-wire path
@@ -199,16 +229,30 @@ var PostgresStore = class {
     await this._pool.end();
   }
   /**
-   * Tear down the active LISTEN subscription if any: detach the
-   * notification listener, run UNLISTEN, and destroy the dedicated
-   * client (do not return it to the pool — its listener is removed but
-   * destroying belt-and-braces guards against any future change in
-   * pg-pool semantics that could re-issue a half-clean client).
+   * Tear down the active LISTEN subscription if any: cancel any pending
+   * reconnect, forget the caller's handler (so no reconnect can fire
+   * after teardown), detach the notification + error listeners, run
+   * UNLISTEN, and destroy the dedicated client (do not return it to the
+   * pool — its listeners are removed but destroying belt-and-braces
+   * guards against any future change in pg-pool semantics that could
+   * re-issue a half-clean client).
+   *
+   * Clearing `_notify_handler` and the reconnect timer here is what makes
+   * `dispose()` safe during a pending reconnect (#1189): a scheduled
+   * `_reconnect` bails the moment it finds no handler.
    */
   async _teardown_listen() {
+    if (this._reconnect_timer) {
+      clearTimeout(this._reconnect_timer);
+      this._reconnect_timer = void 0;
+    }
+    this._notify_handler = void 0;
+    this._reconnect_attempts = 0;
     if (!this._listen_client) return;
     this._listen_client.removeListener("notification", this._listen_handler);
+    this._listen_client.removeListener("error", this._listen_error_handler);
     this._listen_handler = void 0;
+    this._listen_error_handler = void 0;
     try {
       await this._listen_client.query(`UNLISTEN ${this._channel}`);
     } catch {
@@ -272,7 +316,7 @@ var PostgresStore = class {
           stream varchar(100) COLLATE pg_catalog."default" PRIMARY KEY,
           source varchar(100) COLLATE pg_catalog."default",
           at int NOT NULL DEFAULT -1,
-          retry smallint NOT NULL DEFAULT -1,
+          retry int NOT NULL DEFAULT -1,
           blocked boolean NOT NULL DEFAULT false,
           error text,
           leased_by text,
@@ -294,6 +338,21 @@ var PostgresStore = class {
         `ALTER TABLE ${this._fqs}
          ADD COLUMN IF NOT EXISTS deferred_at timestamptz;`
       );
+      await client.query(
+        `DO $$
+         BEGIN
+           IF EXISTS (
+             SELECT 1 FROM information_schema.columns
+             WHERE table_schema = '${this.config.schema}'
+               AND table_name = '${this.config.table}_streams'
+               AND column_name = 'retry'
+               AND data_type = 'smallint'
+           ) THEN
+             EXECUTE 'ALTER TABLE ${this._fqs} ALTER COLUMN retry TYPE integer';
+           END IF;
+         END
+         $$;`
+      );
       await client.query(
         `DROP INDEX IF EXISTS "${this.config.schema}"."${this.config.table}_streams_fetch_ix"`
       );
@@ -439,16 +498,13 @@ var PostgresStore = class {
   async commit(stream, msgs, meta, expectedVersion) {
     if (msgs.length === 0) return [];
     const client = await this._client("commit");
-    let version = -1;
     try {
-      await client.query("BEGIN");
       const last = await client.query(
-        `SELECT version
-        FROM ${this._fqt}
-        WHERE stream=$1 ORDER BY version DESC LIMIT 1`,
+        `SELECT version FROM ${this._fqt}
+         WHERE stream=$1 ORDER BY version DESC LIMIT 1`,
         [stream]
       );
-      version = last.rowCount ? last.rows[0].version : -1;
+      let version = last.rows.at(0)?.version ?? -1;
       if (typeof expectedVersion === "number" && version !== expectedVersion)
         throw new import_act.ConcurrencyError(
           stream,
@@ -456,52 +512,69 @@ var PostgresStore = class {
           msgs,
           expectedVersion
         );
-      const committed = [];
+      const base_version = version;
+      const names = [];
+      const datas = [];
+      const piis = [];
+      const versions = [];
       for (const { name, data, pii } of msgs) {
         version++;
-        const sql = `
+        names.push(name);
+        datas.push(JSON.stringify(data));
+        piis.push(
+          this._resolve_pii_key && pii != null ? JSON.stringify(await (0, import_act_crypto.encrypt)(pii, this._resolve_pii_key)) : pii != null ? JSON.stringify(pii) : null
+        );
+        versions.push(version);
+      }
+      const insert_select = msgs.length === 1 ? `SELECT $1, $2::jsonb, $3::jsonb, $5, $4::int, $6 FROM l` : `SELECT u.name, u.data::jsonb, u.pii::jsonb, $5, u.version, $6
+             FROM l, unnest($1::text[], $2::text[], $3::text[], $4::int[])
+               WITH ORDINALITY AS u(name, data, pii, version, ord)
+             ORDER BY u.ord`;
+      const notify_ctes = this.config.notify ? `,
+           payload AS (
+             SELECT json_build_object(
+               'stream', $5::text,
+               'events', json_agg(json_build_object('id', ins.id, 'name', ins.name) ORDER BY ins.version),
+               'by', $9::text
+             )::text AS p
+             FROM ins
+           ),
+           n AS (
+             SELECT pg_notify($8, payload.p) FROM payload
+             WHERE octet_length(payload.p) < $10
+           )` : "";
+      const final_select = this.config.notify ? "SELECT ins.* FROM ins LEFT JOIN n ON true ORDER BY ins.version" : "SELECT * FROM ins ORDER BY version";
+      const sql = `WITH l AS (SELECT pg_advisory_xact_lock(hashtext($7))),
+        ins AS (
           INSERT INTO ${this._fqt}(name, data, pii, stream, version, meta)
-          VALUES($1, $2, $3, $4, $5, $6) RETURNING *`;
-        const pii_for_write = this._resolve_pii_key && pii != null ? JSON.stringify(await (0, import_act_crypto.encrypt)(pii, this._resolve_pii_key)) : pii ?? null;
-        const vals = [name, data, pii_for_write, stream, version, meta];
-        try {
-          const { rows } = await client.query(sql, vals);
-          const row = rows.at(0);
-          if (this._resolve_pii_key && typeof row.pii === "string") {
-            const decrypted = await (0, import_act_crypto.decrypt)(row.pii, this._resolve_pii_key);
-            row.pii = decrypted;
-          }
-          committed.push(row);
-        } catch (error) {
-          if (error?.code === PG_UNIQUE_VIOLATION) {
-            throw new import_act.ConcurrencyError(
-              stream,
-              version - 1,
-              msgs,
-              expectedVersion ?? -1
-            );
+          ${insert_select}
+          RETURNING *
+        )${notify_ctes}
+        ${final_select}`;
+      const base_params = msgs.length === 1 ? [names[0], datas[0], piis[0], versions[0], stream, meta, this._fqt] : [names, datas, piis, versions, stream, meta, this._fqt];
+      const params = this.config.notify ? [...base_params, this._channel, this._by, NOTIFY_MAX_PAYLOAD_BYTES] : base_params;
+      try {
+        const { rows } = await client.query(sql, params);
+        if (this._resolve_pii_key) {
+          for (const row of rows) {
+            if (typeof row.pii === "string") {
+              const decrypted = await (0, import_act_crypto.decrypt)(row.pii, this._resolve_pii_key);
+              row.pii = decrypted;
+            }
           }
-          throw error;
         }
+        return rows;
+      } catch (error) {
+        if (error?.code === PG_UNIQUE_VIOLATION) {
+          throw new import_act.ConcurrencyError(
+            stream,
+            base_version,
+            msgs,
+            expectedVersion ?? -1
+          );
+        }
+        throw error;
       }
-      if (this.config.notify) {
-        const payload = JSON.stringify({
-          stream,
-          events: committed.map((c) => ({ id: c.id, name: c.name })),
-          by: this._by
-        });
-        if (Buffer.byteLength(payload, "utf8") < NOTIFY_MAX_PAYLOAD_BYTES)
-          await client.query(`SELECT pg_notify($1, $2)`, [
-            this._channel,
-            payload
-          ]);
-      }
-      await client.query("COMMIT");
-      return committed;
-    } catch (error) {
-      await client.query("ROLLBACK").catch(() => {
-      });
-      throw error;
     } finally {
       client.release();
     }
@@ -1166,11 +1239,39 @@ var PostgresStore = class {
    * client; pool disposal also tears the subscription down as a safety
    * net.
    *
+   * The subscription is **self-healing** (#1189): the dedicated client
+   * has an `error` listener that, on a connection blip (backend restart,
+   * failover, network drop), tears the dead client down and re-LISTENs
+   * on a fresh one with capped exponential backoff — degrading to the
+   * poll path in between. A pending reconnect is cancelled by disposal,
+   * so no reconnect fires after teardown.
+   *
    * @param handler Called for each cross-process commit notification.
    * @returns Disposer that releases the LISTEN client.
    */
   async _subscribe_notifications(handler) {
     await this._teardown_listen();
+    this._notify_handler = handler;
+    try {
+      await this._open_listen(handler);
+    } catch (err) {
+      this._notify_handler = void 0;
+      throw err;
+    }
+    return async () => {
+      if (this._notify_handler !== handler) return;
+      await this._teardown_listen();
+    };
+  }
+  /**
+   * Check out a dedicated client, attach the notification + error
+   * listeners, and run `LISTEN`. Shared by the initial subscription and
+   * every reconnect (#1189). On any failure before `LISTEN` succeeds the
+   * client is detached and destroyed so nothing leaks — the caller
+   * decides whether to propagate (initial subscribe) or reschedule
+   * (reconnect).
+   */
+  async _open_listen(handler) {
     const client = await this._client("notify");
     const on_notification = (msg) => {
       if (msg.channel !== this._channel) return;
@@ -1209,20 +1310,59 @@ var PostgresStore = class {
         logger.error(err, "act_commit: handler threw, listener preserved");
       }
     };
+    const on_error = (err) => {
+      logger.error(err, "act_commit: LISTEN client errored, reconnecting");
+      this._reconnect();
+    };
     client.on("notification", on_notification);
+    client.on("error", on_error);
     try {
       await client.query(`LISTEN ${this._channel}`);
     } catch (err) {
       client.removeListener("notification", on_notification);
+      client.removeListener("error", on_error);
       client.release(true);
       throw err;
     }
     this._listen_client = client;
     this._listen_handler = on_notification;
-    return async () => {
-      if (this._listen_client !== client) return;
-      await this._teardown_listen();
-    };
+    this._listen_error_handler = on_error;
+    this._reconnect_attempts = 0;
+  }
+  /**
+   * Self-heal the LISTEN subscription after the dedicated client emitted
+   * `error` (#1189). Detaches and destroys the dead client, then
+   * reconnects on a fresh one with capped exponential backoff. Bails
+   * immediately if the subscription was disposed while a reconnect was
+   * pending (`_notify_handler` cleared by `_teardown_listen`), so no
+   * reconnect ever fires after teardown.
+   */
+  _reconnect() {
+    const handler = this._notify_handler;
+    if (!handler) return;
+    if (this._listen_client) {
+      this._listen_client.removeListener("notification", this._listen_handler);
+      this._listen_client.removeListener("error", this._listen_error_handler);
+      this._listen_handler = void 0;
+      this._listen_error_handler = void 0;
+      this._listen_client.release(true);
+      this._listen_client = void 0;
+    }
+    const delay = Math.min(
+      NOTIFY_RECONNECT_MAX_MS,
+      NOTIFY_RECONNECT_BASE_MS * 2 ** this._reconnect_attempts
+    );
+    this._reconnect_attempts++;
+    this._reconnect_timer = setTimeout(() => {
+      this._reconnect_timer = void 0;
+      const current = this._notify_handler;
+      if (!current) return;
+      this._open_listen(current).catch((err) => {
+        logger.error(err, "act_commit: LISTEN reconnect failed, retrying");
+        this._reconnect();
+      });
+    }, delay);
+    this._reconnect_timer.unref?.();
   }
   /**
    * Atomically truncates streams and seeds each with a snapshot or tombstone.
@@ -1240,6 +1380,9 @@ var PostgresStore = class {
     const client = await this._client("truncate");
     try {
       await client.query("BEGIN");
+      await client.query("SELECT pg_advisory_xact_lock(hashtext($1))", [
+        this._fqt
+      ]);
       const result = /* @__PURE__ */ new Map();
       if (full.length) {
         await client.query(`DELETE FROM ${this._fqs} WHERE stream = ANY($1)`, [