@volter/world-runtime 3.0.50 → 3.0.52

package/dist/src/pglite-host.mjs

@@ -40,43 +40,20 @@
 //   multiple databases require the native or container backing.
 // - No COPY … FROM STDIN: refused with 0A000 (it aborts PGlite's backend);
 //   COPY … TO STDOUT works.
-// - ONE serialized session. Connections are accepted concurrently but run
-//   one at a time under the lock below; a client holding a transaction open
-//   blocks every other client until it ends — or until it has sat idle in
-//   that transaction (ReadyForQuery 'T' or 'E') for IDLE_IN_TRANSACTION_MS
-//   while another client waits: then it is terminated with the FATAL Postgres
-//   sends a session past idle_in_transaction_session_timeout (25P03), its
-//   transaction rolled back (writes made through it are lost, as on Postgres),
-//   and the next client runs. This DEVIATES from Postgres, whose timeout is off
-//   by default and where an idle open transaction holds only its row locks:
-//   here it would hold the whole database, so a transaction that waits on
-//   something else (an HTTP call inside it) for longer than the limit while
-//   another client queues is cut. A READ-ONLY batch another connection sends
-//   while the holder sits idle in its transaction does not wait: it runs as a
-//   guest in the holder's session, inside a savepoint (see enter()), and sees
-//   the holder's uncommitted rows — Postgres would show it only committed ones.
-//   While a guest's batch runs, the holder waits for it (its idle clock
-//   stopped); a guest batch still open after GUEST_TURN_MS while anyone waits
-//   (a cursor that has not sent its Sync) is cancelled (57014), its savepoint
-//   undone;
-//   a batch that begins with a read and goes on to write is refused (0A000).
-//   A connection that closes while it waits
-//   for the lock gives it up unrun (rallly walk 2: pg-pool evicted an idle
-//   client — its Terminate queued behind another connection's transaction,
-//   ran once that ended, left no ReadyForQuery, and held the lock forever). All connections share the one
-//   backend session, so session state leaks between them and outlives the
-//   connection that set it: SET (search_path, timezone…), temp tables and
-//   SQL PREPAREd statements are visible to every other connection (a
-//   statement prepared over the protocol is the connection's own: a name
-//   another live connection holds is renamed for it, and its own SQL
-//   EXECUTE/DEALLOCATE of that name is renamed with it; scopeNames — except
-//   in CREATE TABLE … AS EXECUTE, a comment between the verb and the name,
-//   a Query holding a backslash, and a DEALLOCATE sent through Parse, which
-//   reach the name as the backend holds it); session
-//   advisory locks do NOT exclude (a second connection's
-//   pg_try_advisory_lock on a held key returns true); a NOTIFY is delivered
-//   to the connection that sent it, not to the one that ran LISTEN.
-//   CREATE ROLE succeeds but connections never run as that role.
+// - ONE backend session, with concurrent wire connections and driver pools.
+//   A complete implicit statement or explicit transaction owns it until the
+//   backend reports idle; other connections' reads and writes wait their turn.
+//   No reader borrows another connection's open transaction. An idle holder
+//   is not terminated to admit a waiter. Cross-connection work awaited inside
+//   a transaction must wait for that transaction to finish.
+//   Session SET, temp tables and session advisory locks remain shared across
+//   transactions and outlive their connection; pg_try_advisory_lock on a key
+//   another connection holds sees the same session and returns true. NOTIFY
+//   answers its sender, not an independent listener, and pg_backend_pid is
+//   shared. Existing prepared-name scoping supports pooled Prisma clients;
+//   SQL spellings outside its handled forms remain shared. Select native or
+//   container PostgreSQL for independent sessions; no gateway emulation of
+//   locks, isolation or session state supplies those semantics.
 //
 // Database timestamps use the World clock: PGlite reads Date.now() for now(),
 // CURRENT_TIMESTAMP, clock_timestamp() and transaction starts. Refresh the file
@@ -187,104 +164,34 @@ dbReady.catch((error) => {
 });
 
 // ---- transaction-affinity lock ---------------------------------------------
-// How long the holder may sit idle inside its transaction while another client
-// waits before it is terminated (see the limits above). Prisma's own default
-// interactive-transaction timeout is 5s; a session idle that long with others
-// queued is one no client is still driving.
-const IDLE_IN_TRANSACTION_MS = 5000;
 let holder = null;
 const waiters = [];
-/** Each connection's socket, whether a message of it is running, and since
- * when it has been idle. */
 const sessions = new Map();
-// A GUEST batch: while the holder sits idle inside its transaction (its last
-// ReadyForQuery 'T', no message of its own running, none half-sent), another
-// connection's READ-ONLY batch runs in the holder's session, inside a savepoint
-// released after it (rolled back to on an error, so the holder's transaction is
-// never aborted by it), and is answered ReadyForQuery 'I' as its own session
-// would be. An application that reads on a second pooled connection while its
-// first holds a transaction open (twenty's sign-up: a TypeORM transaction that
-// awaits a repository read on another connection) otherwise waits for a lock
-// the transaction never gives up. The read sees the holder's uncommitted rows —
-// a deviation from Postgres's isolation, stated in the limits above. Writes,
-// and a guest's own BEGIN, wait for the lock as before.
-let guestBatch = null;
-let guestStartedAt = 0;
-// How long a guest batch may hold its turn while the holder or a writer waits (a cursor that never sends its Sync
-// would otherwise hold every connection up): past it the guest's batch is refused and the waiters run.
-const GUEST_TURN_MS = 2000;
-function wakeAll() {
-  for (const wake of waiters.splice(0)) wake();
-}
-/** How `token` may run its next message: 'own' (it holds the lock, and its turn is claimed here, before any other
- *  waiter wakes to look) or 'guest'. A holder waiting for its turn is `wanting`: no new guest starts ahead of it. */
-async function enter(token, session, data) {
-  for (;;) {
-    if (guestBatch === token) return 'guest';
-    if (guestBatch === null) {
-      if (holder === null || holder === token) {
-        holder = token;
-        session.busy = true;
-        session.wanting = false;
-        return 'own';
-      }
-      const host = sessions.get(holder);
-      if (host && !host.busy && !host.wanting && !host.midBatch && host.status === 'T'
-        && session.status !== 'T' && session.status !== 'E' && guestMessageAllowed(session, data)) {
-        guestBatch = token;
-        guestStartedAt = machineNow();
-        return 'guest';
-      }
-    }
-    if (holder === token) session.wanting = true;
-    await new Promise((resolve) => waiters.push(resolve));
+/** Reserve the next complete protocol cycle/transaction in arrival order. */
+function enter(token, session) {
+  if (session.closed) return Promise.resolve(false);
+  if (holder === token) return Promise.resolve(true);
+  if (holder === null && !waiters.length) {
+    holder = token;
+    return Promise.resolve(true);
   }
+  return new Promise(resolve => waiters.push({ token, session, resolve }));
 }
 function release(token) {
   if (holder !== token) return;
   holder = null;
-  wakeAll();
-}
-
-/** A statement's text with its string literals, quoted identifiers and comments blanked, or null when it cannot be
- *  read safely (a dollar-quoted body, an unterminated literal): the caller then treats it as not read-only. */
-function statementSkeleton(text) {
-  // dollar quoting and backslash-escape strings (E'…', where \' does not close) are not read here: not read-only
-  // (a backslash anywhere, too: with standard_conforming_strings off, which one connection can set for the shared
-  // session, a plain '…' takes backslash escapes)
-  if (/\$[A-Za-z_0-9]*\$/.test(text) || text.includes('\\')) return null;
-  let out = '';
-  for (let i = 0; i < text.length;) {
-    const c = text[i];
-    if (c === "'" || c === '"') {
-      const end = text.indexOf(c, i + 1);
-      if (end < 0) return null;
-      let j = end;
-      while (text[j + 1] === c) { const next = text.indexOf(c, j + 2); if (next < 0) return null; j = next; }
-      out += ' ';
-      i = j + 1;
-    } else if (c === '-' && text[i + 1] === '-') {
-      const end = text.indexOf('\n', i);
-      i = end < 0 ? text.length : end;
-      out += ' ';
-    } else if (c === '/' && text[i + 1] === '*') {
-      const end = text.indexOf('*/', i + 2);
-      if (end < 0) return null;
-      i = end + 2;
-      out += ' ';
-    } else { out += c; i += 1; }
+  while (waiters.length) {
+    const next = waiters.shift();
+    if (next.session.closed) { next.resolve(false); continue; }
+    holder = next.token;
+    next.resolve(true);
+    break;
   }
-  return out.trim();
 }
-
-/** Whether a statement only reads: one SELECT (or WITH/SHOW/VALUES/TABLE/EXPLAIN without ANALYZE) that writes,
- *  locks or advances nothing, judged on its text with literals and comments removed. A false "no" only waits. */
-function readOnlySql(text) {
-  const sql = statementSkeleton(text);
-  if (sql === null) return false;
-  if (sql.replace(/;\s*$/, '').includes(';')) return false; // one statement only
-  if (!/^(select|with|show|values|table|explain)\b/i.test(sql)) return false;
-  return !/\b(insert|update|delete|merge|into|copy|analyze|call|do|set_config|nextval|setval|pg_(try_)?advisory\w*|pg_notify|lo_\w+|for\s+(update|share|no\s+key\s+update|key\s+share))\b/i.test(sql);
+function cancelWait(token) {
+  const index = waiters.findIndex(waiter => waiter.token === token);
+  if (index < 0) return;
+  waiters.splice(index, 1)[0].resolve(false);
 }
 
 const text = (data, from) => data.subarray(from, data.indexOf(0, from)).toString('utf8');
@@ -504,126 +411,6 @@ async function flushClosed(db) {
   }
 }
 
-/** Record, per connection, which named statements it prepared read-only (a Parse of its own or a guest's); a
- *  PREPARE/DEALLOCATE/DISCARD sent as SQL forgets them all. */
-function noteStatement(session, message) {
-  const data = asBuffer(message);
-  if (data[0] === 0x51 /* Q */ && /\b(prepare|deallocate|discard)\b/i.test(text(data, 5))) session.statements.clear();
-  else if (data[0] === 0x50 /* P */) {
-    const name = text(data, 5);
-    session.statements.set(name, readOnlySql(text(data, 5 + Buffer.byteLength(name) + 1)));
-  } else if (data[0] === 0x43 /* C */ && data[5] === 0x53 /* S */) {
-    session.statements.delete(text(data, 6));
-  }
-}
-
-/** Whether a guest may run this message: a Query or Parse of read-only SQL, a Bind of a statement this connection
- *  prepared read-only (the unnamed one included), and the batch's Describe/Execute/Sync/Flush/Close. */
-function guestMessageAllowed(session, message) {
-  const data = asBuffer(message);
-  switch (data[0]) {
-    case 0x51: return readOnlySql(text(data, 5)); // Q
-    case 0x50: { const name = text(data, 5); return readOnlySql(text(data, 5 + Buffer.byteLength(name) + 1)); } // P
-    case 0x42: { // B: portal name, then statement name; the unnamed one only as this batch parsed it
-      const portal = text(data, 5);
-      const statement = text(data, 5 + Buffer.byteLength(portal) + 1);
-      if (statement === '') return session.guestOpen && session.guestUnnamed === true;
-      return session.statements.get(statement) === true;
-    }
-    case 0x44: case 0x45: case 0x53: case 0x48: case 0x43: return session.guestOpen; // D E S H C, inside its batch
-    default: return false;
-  }
-}
-
-/** An ErrorResponse (and nothing else): the guest batch refused mid-way. */
-function errorResponse(code, message) {
-  const fields = ['SERROR', 'VERROR', `C${code}`, `M${message}`];
-  const body = Buffer.concat([...fields.map((f) => Buffer.from(`${f}\0`)), Buffer.from([0])]);
-  const head = Buffer.alloc(5);
-  head[0] = 0x45;
-  head.writeInt32BE(body.length + 4, 1);
-  return Buffer.concat([head, body]);
-}
-const READY_IDLE = Buffer.from([0x5a, 0, 0, 0, 5, 0x49]);
-
-/** A statement of the host's own around a guest; its failure (the holder's transaction already gone) is not fatal. */
-async function quiet(db, sql) {
-  try { await db.query(sql); } catch (error) {
-    if (error?.code !== '3B001' && error?.code !== '25P01') throw error;
-  }
-}
-
-/** `response` with its last ReadyForQuery reporting `status`. */
-function withReadyStatus(response, status) {
-  const out = Buffer.from(response);
-  let offset = 0;
-  let at = -1;
-  while (offset + 5 <= out.length) {
-    const length = out.readInt32BE(offset + 1);
-    if (length < 4) break;
-    if (out[offset] === 0x5a && offset + 5 < out.length) at = offset + 5;
-    offset += 1 + length;
-  }
-  if (at >= 0) out[at] = status.charCodeAt(0);
-  return out;
-}
-
-/** Postgres's FATAL for a session past idle_in_transaction_session_timeout
- * (postgres.c: ERRCODE_IDLE_IN_TRANSACTION_SESSION_TIMEOUT, 25P03). */
-function idleInTransactionFatal() {
-  const fields = ['SFATAL', 'VFATAL', 'C25P03', 'Mterminating connection due to idle-in-transaction timeout'];
-  const body = Buffer.concat([...fields.map((f) => Buffer.from(`${f}\0`)), Buffer.from([0])]);
-  const head = Buffer.alloc(5);
-  head[0] = 0x45; // 'E'
-  head.writeInt32BE(body.length + 4, 1);
-  return Buffer.concat([head, body]);
-}
-
-// the holder idle in its transaction past the limit while others wait: end it
-const idleWatch = setInterval(() => {
-  // a guest holding its turn past GUEST_TURN_MS while others wait: its batch is refused, its savepoint undone
-  if (guestBatch !== null && waiters.length > 0 && machineNow() - guestStartedAt > GUEST_TURN_MS) {
-    const guest = sessions.get(guestBatch);
-    const expired = guestBatch;
-    if (guest && guest.guestRefused && !guest.guestRunning) {
-      // a refused batch that never sends its Sync: its savepoint is already undone; its turn ends
-      guest.guestRefused = false;
-      guest.guestExpired = true;
-      guest.guestErrorSent = true;
-      const host = sessions.get(holder);
-      if (host) host.idleSince += machineNow() - guestStartedAt;
-      guestBatch = null;
-      wakeAll();
-    } else if (guest && guest.guestOpen && !guest.guestRunning) {
-      guest.guestOpen = false;
-      guest.guestUnnamed = false;
-      guest.guestExpired = true;
-      void dbReady.then(async (db) => {
-        await quiet(db, 'ROLLBACK TO SAVEPOINT volter_guest');
-        await quiet(db, 'RELEASE SAVEPOINT volter_guest');
-      }).then(() => {
-        if (guestBatch !== expired) return;
-        const host = sessions.get(holder);
-        if (host) host.idleSince += machineNow() - guestStartedAt;
-        guestBatch = null;
-        wakeAll();
-      });
-    }
-  }
-  if (holder === null || waiters.length === 0) return;
-  const session = sessions.get(holder);
-  // armed at ReadyForQuery inside a transaction, as Postgres arms it — never mid-pipeline
-  // a holder waiting for its turn (behind a guest) is sending, not idle; a guest's turn is not the holder's idleness
-  if (!session || session.busy || session.wanting || guestBatch !== null || session.terminated || (session.status !== 'T' && session.status !== 'E')) return;
-  if (machineNow() - session.idleSince < IDLE_IN_TRANSACTION_MS) return;
-  session.terminated = true;
-  process.stderr.write('pglite-host: terminated a connection idle in its transaction while others waited\n');
-  // the socket's close handler rolls the transaction back and releases the lock
-  session.socket.end(idleInTransactionFatal());
-  setTimeout(() => session.socket.destroy(), 500).unref();
-}, 250);
-idleWatch.unref();
-
 /** The transaction status of the LAST ReadyForQuery ('Z') message in a raw
  * protocol response, or null when the response carries none (mid-pipeline:
  * the sender keeps the lock). 'I' = idle, 'T' = in transaction, 'E' = failed
@@ -766,37 +553,31 @@ function withoutEarlyReady(message, response) {
   return response;
 }
 
-const server = net.createServer(async (socket) => {
+const server = net.createServer((socket) => {
   const token = {};
-  let holding = false;
-  const session = { socket, busy: false, idleSince: machineNow(), terminated: false, closed: false, status: null, midBatch: false,
-    wanting: false, guestOpen: false, guestRefused: false, guestUnnamed: false, guestExpired: false, guestErrorSent: false, guestRunning: false, statements: new Map(),
-    names: new Map() };
+  const session = { closed: false, status: null, midBatch: false, names: new Map(), work: Promise.resolve() };
   sessions.set(token, session);
   socket.on('close', () => {
     session.closed = true;
     sessions.delete(token);
     releaseStatements(session);
-    if (guestBatch === token) {
-      // a guest gone mid-batch: undo what it did in the holder's transaction
-      void dbReady
-        .then(async (db) => { if (session.guestOpen) { await quiet(db, 'ROLLBACK TO SAVEPOINT volter_guest'); await quiet(db, 'RELEASE SAVEPOINT volter_guest'); } })
-        .then(() => { session.guestOpen = false; guestBatch = null; wakeAll(); });
-      return;
-    }
-    if (!holding) return;
-    // the client vanished inside its transaction: roll it back, then let the
-    // next connection in — never leak a half-open transaction into a stranger
-    void dbReady
-      .then((db) => db.query('ROLLBACK'))
-      .catch(error => { process.stderr.write(`pglite-host: connection cleanup failed: ${errorMessage(error)}\n`); })
-      .then(() => {
-        holding = false;
-        release(token);
-      });
+    cancelWait(token);
+    if (holder !== token) return;
+    // Keep ownership while any in-flight message finishes. Sync clears a
+    // disconnected extended-protocol error state, then the real backend rolls
+    // back the holder before another connection can enter its transaction.
+    void session.work.then(async () => {
+      const db = await dbReady;
+      await db.execProtocolRaw(new Uint8Array([0x53, 0, 0, 0, 4]));
+      await db.query('ROLLBACK');
+      release(token);
+    }).catch(error => {
+      process.stderr.write(`pglite-host: connection cleanup failed: ${errorMessage(error)}\n`);
+      process.exit(1);
+    });
   });
   socket.on('error', () => { /* close handler owns cleanup */ });
-  await fromNodeSocket(socket, {
+  void fromNodeSocket(socket, {
     serverVersion: '18.3 (PGlite)',
     auth: { method: 'password', getClearTextPassword: () => databasePassword,
       validateCredentials: ({ username, password }) => username === databaseUser && password === databasePassword },
@@ -806,113 +587,42 @@ const server = net.createServer(async (socket) => {
     },
     async onMessage(data, { isAuthenticated, clientParams }) {
       if (!isAuthenticated) return undefined; // gateway owns startup/auth traffic
-      const client = data;
-      const closes = closing(client);
-      // looked up, not claimed, while the turn is decided: a Parse claims its name on the connection's own turn,
-      // after the closed connections' names are released (a reconnect's `s0` is its own again)
-      data = scopeNames(session, client, false);
-      const db = await dbReady;
-      readWorldClock();
-      // a guest whose turn ran out: told once, the rest of its batch dropped until its Sync
-      if (session.guestExpired) {
-        if (data[0] === 0x53) { session.guestExpired = false; session.guestErrorSent = false; session.status = 'I'; return READY_IDLE; }
-        if (session.guestErrorSent) return new Uint8Array(0);
-        session.guestErrorSent = true;
-        return errorResponse('57014', 'the containerless Postgres (one session) cancelled this read: it ran beside another connection\'s open transaction longer than its turn allows');
-      }
-      const role = await enter(token, session, data);
-      if (role === 'guest') {
+      // Gateway owns Terminate; it must neither wait for a turn nor terminate
+      // the shared PostgreSQL backend. The close handler owns rollback.
+      if (data[0] === 0x58) return undefined;
+      if (!await enter(token, session)) return undefined;
+      const work = (async () => {
         if (session.closed) return undefined;
-        const own = clientParams?.database || clientParams?.user;
-        const sync = data[0] === 0x53;
-        const endGuest = () => {
-          session.guestOpen = false;
-          session.guestRefused = false;
-          session.status = 'I';
-          guestBatch = null;
-          session.guestUnnamed = false;
-          // the holder's idle clock stops while a guest runs, and goes on from where it was
-          const host = sessions.get(holder);
-          if (host) host.idleSince += machineNow() - guestStartedAt;
-          wakeAll();
-        };
-        // a batch refused mid-way: its remaining messages are dropped until its Sync, as Postgres skips after an error
-        if (session.guestRefused) {
-          if (sync) { endGuest(); return READY_IDLE; }
-          return new Uint8Array(0);
-        }
-        if (session.guestOpen && !guestMessageAllowed(session, data)) {
-          session.guestRunning = true; // the expiry waits until this refusal is done
-          await quiet(db, 'ROLLBACK TO SAVEPOINT volter_guest');
-          await quiet(db, 'RELEASE SAVEPOINT volter_guest');
-          session.guestOpen = false;
-          session.guestRefused = true;
-          session.guestRunning = false;
-          return errorResponse('0A000', 'the containerless Postgres (one session) runs only reads beside another connection\'s open transaction; this batch began with a read and went on to write');
-        }
-        if (!session.guestOpen) { await quiet(db, 'SAVEPOINT volter_guest'); session.guestOpen = true; }
-        data = scopeNames(session, client, true);
-        noteStatement(session, data);
-        if (data[0] === 0x50 && text(asBuffer(data), 5) === '') session.guestUnnamed = true;
+        const db = await dbReady;
+        readWorldClock();
+        if (closedStatements.length && !session.midBatch && session.status !== 'T' && session.status !== 'E') await flushClosed(db);
+        if (session.closed) return undefined;
+        const closes = closing(data);
+        data = scopeNames(session, data, true);
         let raw;
-        session.guestRunning = true;
         try {
-          raw = await db.execProtocolRaw(refuseStatements(data, own));
+          raw = await db.execProtocolRaw(refuseStatements(data, clientParams?.database || clientParams?.user));
         } catch (error) {
+          // SQL errors arrive as protocol bytes. A throw is a backend failure.
           process.stderr.write(`pglite-host: backend aborted: ${errorMessage(error)}\n`);
           process.exit(1);
         }
         const response = withoutEarlyReady(data, raw);
         settleClose(session, closes, response);
         const status = lastReadyStatus(response);
-        if (status === null) { session.guestRunning = false; return response; } // mid-batch: the guest keeps its turn until its Sync
-        // the savepoint is gone if the holder's transaction ended meanwhile (its socket closed): quiet, not fatal
-        if (status === 'E') await quiet(db, 'ROLLBACK TO SAVEPOINT volter_guest');
-        await quiet(db, 'RELEASE SAVEPOINT volter_guest');
-        session.guestRunning = false; // the batch has ended: nothing left for the expiry to cancel
-        endGuest();
-        return withReadyStatus(response, 'I');
-      }
-      // closed (or cut) while it waited: give the lock up without running the
-      // message — a Terminate run now would leave no ReadyForQuery to release it
-      if (session.closed || session.terminated) {
-        session.busy = false;
-        if (!holding) release(token);
-        return undefined;
-      }
-      holding = true;
-      session.busy = true;
-      // a turn that begins outside any transaction first closes what closed connections left
-      if (closedStatements.length && !session.midBatch && session.status !== 'T' && session.status !== 'E') await flushClosed(await dbReady);
-      data = scopeNames(session, client, true);
-      noteStatement(session, data);
-      // libpq's default: no database parameter means the user's name
-      const own = clientParams?.database || clientParams?.user;
-      let raw;
-      try {
-        raw = await db.execProtocolRaw(refuseStatements(data, own));
-      } catch (error) {
-        // SQL errors arrive as ErrorResponse bytes; a throw means the WASM
-        // backend itself aborted and every later call would hang. Exit so the
-        // World sees the service down (status fails) instead of a wedged port.
-        process.stderr.write(`pglite-host: backend aborted: ${errorMessage(error)}\n`);
-        process.exit(1);
-      }
-      session.busy = false;
-      session.idleSince = machineNow();
-      const response = withoutEarlyReady(data, raw);
-      settleClose(session, closes, response);
-      const status = lastReadyStatus(response);
-      session.midBatch = status === null;
-      if (status !== null) session.status = status;
-      if (status === 'I') {
-        holding = false;
-        release(token);
-      } else if (status === 'T') {
-        wakeAll(); // idle in its transaction: a waiting reader may now run as a guest
-      }
-      return response;
+        session.midBatch = status === null;
+        if (status !== null) session.status = status;
+        // A closed holder retains admission until its close handler confirms
+        // rollback, even if its in-flight message reported idle.
+        if (status === 'I' && !session.closed) release(token);
+        return response;
+      })();
+      session.work = work;
+      return work;
     },
+  }).catch(error => {
+    process.stderr.write(`pglite-host: wire connection failed: ${errorMessage(error)}\n`);
+    socket.destroy();
   });
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "3.0.50",
+  "version": "3.0.52",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -69,14 +69,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.50",
-    "@volter/world-console": "3.0.45"
+    "@volter/world-core": "3.0.52",
+    "@volter/world-console": "3.0.47"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.50",
+    "@volter/world-core": "3.0.52",
     "mongodb": "~6.20.0",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0",

package/src/pglite-host.mjs

@@ -40,43 +40,20 @@
 //   multiple databases require the native or container backing.
 // - No COPY … FROM STDIN: refused with 0A000 (it aborts PGlite's backend);
 //   COPY … TO STDOUT works.
-// - ONE serialized session. Connections are accepted concurrently but run
-//   one at a time under the lock below; a client holding a transaction open
-//   blocks every other client until it ends — or until it has sat idle in
-//   that transaction (ReadyForQuery 'T' or 'E') for IDLE_IN_TRANSACTION_MS
-//   while another client waits: then it is terminated with the FATAL Postgres
-//   sends a session past idle_in_transaction_session_timeout (25P03), its
-//   transaction rolled back (writes made through it are lost, as on Postgres),
-//   and the next client runs. This DEVIATES from Postgres, whose timeout is off
-//   by default and where an idle open transaction holds only its row locks:
-//   here it would hold the whole database, so a transaction that waits on
-//   something else (an HTTP call inside it) for longer than the limit while
-//   another client queues is cut. A READ-ONLY batch another connection sends
-//   while the holder sits idle in its transaction does not wait: it runs as a
-//   guest in the holder's session, inside a savepoint (see enter()), and sees
-//   the holder's uncommitted rows — Postgres would show it only committed ones.
-//   While a guest's batch runs, the holder waits for it (its idle clock
-//   stopped); a guest batch still open after GUEST_TURN_MS while anyone waits
-//   (a cursor that has not sent its Sync) is cancelled (57014), its savepoint
-//   undone;
-//   a batch that begins with a read and goes on to write is refused (0A000).
-//   A connection that closes while it waits
-//   for the lock gives it up unrun (rallly walk 2: pg-pool evicted an idle
-//   client — its Terminate queued behind another connection's transaction,
-//   ran once that ended, left no ReadyForQuery, and held the lock forever). All connections share the one
-//   backend session, so session state leaks between them and outlives the
-//   connection that set it: SET (search_path, timezone…), temp tables and
-//   SQL PREPAREd statements are visible to every other connection (a
-//   statement prepared over the protocol is the connection's own: a name
-//   another live connection holds is renamed for it, and its own SQL
-//   EXECUTE/DEALLOCATE of that name is renamed with it; scopeNames — except
-//   in CREATE TABLE … AS EXECUTE, a comment between the verb and the name,
-//   a Query holding a backslash, and a DEALLOCATE sent through Parse, which
-//   reach the name as the backend holds it); session
-//   advisory locks do NOT exclude (a second connection's
-//   pg_try_advisory_lock on a held key returns true); a NOTIFY is delivered
-//   to the connection that sent it, not to the one that ran LISTEN.
-//   CREATE ROLE succeeds but connections never run as that role.
+// - ONE backend session, with concurrent wire connections and driver pools.
+//   A complete implicit statement or explicit transaction owns it until the
+//   backend reports idle; other connections' reads and writes wait their turn.
+//   No reader borrows another connection's open transaction. An idle holder
+//   is not terminated to admit a waiter. Cross-connection work awaited inside
+//   a transaction must wait for that transaction to finish.
+//   Session SET, temp tables and session advisory locks remain shared across
+//   transactions and outlive their connection; pg_try_advisory_lock on a key
+//   another connection holds sees the same session and returns true. NOTIFY
+//   answers its sender, not an independent listener, and pg_backend_pid is
+//   shared. Existing prepared-name scoping supports pooled Prisma clients;
+//   SQL spellings outside its handled forms remain shared. Select native or
+//   container PostgreSQL for independent sessions; no gateway emulation of
+//   locks, isolation or session state supplies those semantics.
 //
 // Database timestamps use the World clock: PGlite reads Date.now() for now(),
 // CURRENT_TIMESTAMP, clock_timestamp() and transaction starts. Refresh the file
@@ -187,104 +164,34 @@ dbReady.catch((error) => {
 });
 
 // ---- transaction-affinity lock ---------------------------------------------
-// How long the holder may sit idle inside its transaction while another client
-// waits before it is terminated (see the limits above). Prisma's own default
-// interactive-transaction timeout is 5s; a session idle that long with others
-// queued is one no client is still driving.
-const IDLE_IN_TRANSACTION_MS = 5000;
 let holder = null;
 const waiters = [];
-/** Each connection's socket, whether a message of it is running, and since
- * when it has been idle. */
 const sessions = new Map();
-// A GUEST batch: while the holder sits idle inside its transaction (its last
-// ReadyForQuery 'T', no message of its own running, none half-sent), another
-// connection's READ-ONLY batch runs in the holder's session, inside a savepoint
-// released after it (rolled back to on an error, so the holder's transaction is
-// never aborted by it), and is answered ReadyForQuery 'I' as its own session
-// would be. An application that reads on a second pooled connection while its
-// first holds a transaction open (twenty's sign-up: a TypeORM transaction that
-// awaits a repository read on another connection) otherwise waits for a lock
-// the transaction never gives up. The read sees the holder's uncommitted rows —
-// a deviation from Postgres's isolation, stated in the limits above. Writes,
-// and a guest's own BEGIN, wait for the lock as before.
-let guestBatch = null;
-let guestStartedAt = 0;
-// How long a guest batch may hold its turn while the holder or a writer waits (a cursor that never sends its Sync
-// would otherwise hold every connection up): past it the guest's batch is refused and the waiters run.
-const GUEST_TURN_MS = 2000;
-function wakeAll() {
-  for (const wake of waiters.splice(0)) wake();
-}
-/** How `token` may run its next message: 'own' (it holds the lock, and its turn is claimed here, before any other
- *  waiter wakes to look) or 'guest'. A holder waiting for its turn is `wanting`: no new guest starts ahead of it. */
-async function enter(token, session, data) {
-  for (;;) {
-    if (guestBatch === token) return 'guest';
-    if (guestBatch === null) {
-      if (holder === null || holder === token) {
-        holder = token;
-        session.busy = true;
-        session.wanting = false;
-        return 'own';
-      }
-      const host = sessions.get(holder);
-      if (host && !host.busy && !host.wanting && !host.midBatch && host.status === 'T'
-        && session.status !== 'T' && session.status !== 'E' && guestMessageAllowed(session, data)) {
-        guestBatch = token;
-        guestStartedAt = machineNow();
-        return 'guest';
-      }
-    }
-    if (holder === token) session.wanting = true;
-    await new Promise((resolve) => waiters.push(resolve));
+/** Reserve the next complete protocol cycle/transaction in arrival order. */
+function enter(token, session) {
+  if (session.closed) return Promise.resolve(false);
+  if (holder === token) return Promise.resolve(true);
+  if (holder === null && !waiters.length) {
+    holder = token;
+    return Promise.resolve(true);
   }
+  return new Promise(resolve => waiters.push({ token, session, resolve }));
 }
 function release(token) {
   if (holder !== token) return;
   holder = null;
-  wakeAll();
-}
-
-/** A statement's text with its string literals, quoted identifiers and comments blanked, or null when it cannot be
- *  read safely (a dollar-quoted body, an unterminated literal): the caller then treats it as not read-only. */
-function statementSkeleton(text) {
-  // dollar quoting and backslash-escape strings (E'…', where \' does not close) are not read here: not read-only
-  // (a backslash anywhere, too: with standard_conforming_strings off, which one connection can set for the shared
-  // session, a plain '…' takes backslash escapes)
-  if (/\$[A-Za-z_0-9]*\$/.test(text) || text.includes('\\')) return null;
-  let out = '';
-  for (let i = 0; i < text.length;) {
-    const c = text[i];
-    if (c === "'" || c === '"') {
-      const end = text.indexOf(c, i + 1);
-      if (end < 0) return null;
-      let j = end;
-      while (text[j + 1] === c) { const next = text.indexOf(c, j + 2); if (next < 0) return null; j = next; }
-      out += ' ';
-      i = j + 1;
-    } else if (c === '-' && text[i + 1] === '-') {
-      const end = text.indexOf('\n', i);
-      i = end < 0 ? text.length : end;
-      out += ' ';
-    } else if (c === '/' && text[i + 1] === '*') {
-      const end = text.indexOf('*/', i + 2);
-      if (end < 0) return null;
-      i = end + 2;
-      out += ' ';
-    } else { out += c; i += 1; }
+  while (waiters.length) {
+    const next = waiters.shift();
+    if (next.session.closed) { next.resolve(false); continue; }
+    holder = next.token;
+    next.resolve(true);
+    break;
   }
-  return out.trim();
 }
-
-/** Whether a statement only reads: one SELECT (or WITH/SHOW/VALUES/TABLE/EXPLAIN without ANALYZE) that writes,
- *  locks or advances nothing, judged on its text with literals and comments removed. A false "no" only waits. */
-function readOnlySql(text) {
-  const sql = statementSkeleton(text);
-  if (sql === null) return false;
-  if (sql.replace(/;\s*$/, '').includes(';')) return false; // one statement only
-  if (!/^(select|with|show|values|table|explain)\b/i.test(sql)) return false;
-  return !/\b(insert|update|delete|merge|into|copy|analyze|call|do|set_config|nextval|setval|pg_(try_)?advisory\w*|pg_notify|lo_\w+|for\s+(update|share|no\s+key\s+update|key\s+share))\b/i.test(sql);
+function cancelWait(token) {
+  const index = waiters.findIndex(waiter => waiter.token === token);
+  if (index < 0) return;
+  waiters.splice(index, 1)[0].resolve(false);
 }
 
 const text = (data, from) => data.subarray(from, data.indexOf(0, from)).toString('utf8');
@@ -504,126 +411,6 @@ async function flushClosed(db) {
   }
 }
 
-/** Record, per connection, which named statements it prepared read-only (a Parse of its own or a guest's); a
- *  PREPARE/DEALLOCATE/DISCARD sent as SQL forgets them all. */
-function noteStatement(session, message) {
-  const data = asBuffer(message);
-  if (data[0] === 0x51 /* Q */ && /\b(prepare|deallocate|discard)\b/i.test(text(data, 5))) session.statements.clear();
-  else if (data[0] === 0x50 /* P */) {
-    const name = text(data, 5);
-    session.statements.set(name, readOnlySql(text(data, 5 + Buffer.byteLength(name) + 1)));
-  } else if (data[0] === 0x43 /* C */ && data[5] === 0x53 /* S */) {
-    session.statements.delete(text(data, 6));
-  }
-}
-
-/** Whether a guest may run this message: a Query or Parse of read-only SQL, a Bind of a statement this connection
- *  prepared read-only (the unnamed one included), and the batch's Describe/Execute/Sync/Flush/Close. */
-function guestMessageAllowed(session, message) {
-  const data = asBuffer(message);
-  switch (data[0]) {
-    case 0x51: return readOnlySql(text(data, 5)); // Q
-    case 0x50: { const name = text(data, 5); return readOnlySql(text(data, 5 + Buffer.byteLength(name) + 1)); } // P
-    case 0x42: { // B: portal name, then statement name; the unnamed one only as this batch parsed it
-      const portal = text(data, 5);
-      const statement = text(data, 5 + Buffer.byteLength(portal) + 1);
-      if (statement === '') return session.guestOpen && session.guestUnnamed === true;
-      return session.statements.get(statement) === true;
-    }
-    case 0x44: case 0x45: case 0x53: case 0x48: case 0x43: return session.guestOpen; // D E S H C, inside its batch
-    default: return false;
-  }
-}
-
-/** An ErrorResponse (and nothing else): the guest batch refused mid-way. */
-function errorResponse(code, message) {
-  const fields = ['SERROR', 'VERROR', `C${code}`, `M${message}`];
-  const body = Buffer.concat([...fields.map((f) => Buffer.from(`${f}\0`)), Buffer.from([0])]);
-  const head = Buffer.alloc(5);
-  head[0] = 0x45;
-  head.writeInt32BE(body.length + 4, 1);
-  return Buffer.concat([head, body]);
-}
-const READY_IDLE = Buffer.from([0x5a, 0, 0, 0, 5, 0x49]);
-
-/** A statement of the host's own around a guest; its failure (the holder's transaction already gone) is not fatal. */
-async function quiet(db, sql) {
-  try { await db.query(sql); } catch (error) {
-    if (error?.code !== '3B001' && error?.code !== '25P01') throw error;
-  }
-}
-
-/** `response` with its last ReadyForQuery reporting `status`. */
-function withReadyStatus(response, status) {
-  const out = Buffer.from(response);
-  let offset = 0;
-  let at = -1;
-  while (offset + 5 <= out.length) {
-    const length = out.readInt32BE(offset + 1);
-    if (length < 4) break;
-    if (out[offset] === 0x5a && offset + 5 < out.length) at = offset + 5;
-    offset += 1 + length;
-  }
-  if (at >= 0) out[at] = status.charCodeAt(0);
-  return out;
-}
-
-/** Postgres's FATAL for a session past idle_in_transaction_session_timeout
- * (postgres.c: ERRCODE_IDLE_IN_TRANSACTION_SESSION_TIMEOUT, 25P03). */
-function idleInTransactionFatal() {
-  const fields = ['SFATAL', 'VFATAL', 'C25P03', 'Mterminating connection due to idle-in-transaction timeout'];
-  const body = Buffer.concat([...fields.map((f) => Buffer.from(`${f}\0`)), Buffer.from([0])]);
-  const head = Buffer.alloc(5);
-  head[0] = 0x45; // 'E'
-  head.writeInt32BE(body.length + 4, 1);
-  return Buffer.concat([head, body]);
-}
-
-// the holder idle in its transaction past the limit while others wait: end it
-const idleWatch = setInterval(() => {
-  // a guest holding its turn past GUEST_TURN_MS while others wait: its batch is refused, its savepoint undone
-  if (guestBatch !== null && waiters.length > 0 && machineNow() - guestStartedAt > GUEST_TURN_MS) {
-    const guest = sessions.get(guestBatch);
-    const expired = guestBatch;
-    if (guest && guest.guestRefused && !guest.guestRunning) {
-      // a refused batch that never sends its Sync: its savepoint is already undone; its turn ends
-      guest.guestRefused = false;
-      guest.guestExpired = true;
-      guest.guestErrorSent = true;
-      const host = sessions.get(holder);
-      if (host) host.idleSince += machineNow() - guestStartedAt;
-      guestBatch = null;
-      wakeAll();
-    } else if (guest && guest.guestOpen && !guest.guestRunning) {
-      guest.guestOpen = false;
-      guest.guestUnnamed = false;
-      guest.guestExpired = true;
-      void dbReady.then(async (db) => {
-        await quiet(db, 'ROLLBACK TO SAVEPOINT volter_guest');
-        await quiet(db, 'RELEASE SAVEPOINT volter_guest');
-      }).then(() => {
-        if (guestBatch !== expired) return;
-        const host = sessions.get(holder);
-        if (host) host.idleSince += machineNow() - guestStartedAt;
-        guestBatch = null;
-        wakeAll();
-      });
-    }
-  }
-  if (holder === null || waiters.length === 0) return;
-  const session = sessions.get(holder);
-  // armed at ReadyForQuery inside a transaction, as Postgres arms it — never mid-pipeline
-  // a holder waiting for its turn (behind a guest) is sending, not idle; a guest's turn is not the holder's idleness
-  if (!session || session.busy || session.wanting || guestBatch !== null || session.terminated || (session.status !== 'T' && session.status !== 'E')) return;
-  if (machineNow() - session.idleSince < IDLE_IN_TRANSACTION_MS) return;
-  session.terminated = true;
-  process.stderr.write('pglite-host: terminated a connection idle in its transaction while others waited\n');
-  // the socket's close handler rolls the transaction back and releases the lock
-  session.socket.end(idleInTransactionFatal());
-  setTimeout(() => session.socket.destroy(), 500).unref();
-}, 250);
-idleWatch.unref();
-
 /** The transaction status of the LAST ReadyForQuery ('Z') message in a raw
  * protocol response, or null when the response carries none (mid-pipeline:
  * the sender keeps the lock). 'I' = idle, 'T' = in transaction, 'E' = failed
@@ -766,37 +553,31 @@ function withoutEarlyReady(message, response) {
   return response;
 }
 
-const server = net.createServer(async (socket) => {
+const server = net.createServer((socket) => {
   const token = {};
-  let holding = false;
-  const session = { socket, busy: false, idleSince: machineNow(), terminated: false, closed: false, status: null, midBatch: false,
-    wanting: false, guestOpen: false, guestRefused: false, guestUnnamed: false, guestExpired: false, guestErrorSent: false, guestRunning: false, statements: new Map(),
-    names: new Map() };
+  const session = { closed: false, status: null, midBatch: false, names: new Map(), work: Promise.resolve() };
   sessions.set(token, session);
   socket.on('close', () => {
     session.closed = true;
     sessions.delete(token);
     releaseStatements(session);
-    if (guestBatch === token) {
-      // a guest gone mid-batch: undo what it did in the holder's transaction
-      void dbReady
-        .then(async (db) => { if (session.guestOpen) { await quiet(db, 'ROLLBACK TO SAVEPOINT volter_guest'); await quiet(db, 'RELEASE SAVEPOINT volter_guest'); } })
-        .then(() => { session.guestOpen = false; guestBatch = null; wakeAll(); });
-      return;
-    }
-    if (!holding) return;
-    // the client vanished inside its transaction: roll it back, then let the
-    // next connection in — never leak a half-open transaction into a stranger
-    void dbReady
-      .then((db) => db.query('ROLLBACK'))
-      .catch(error => { process.stderr.write(`pglite-host: connection cleanup failed: ${errorMessage(error)}\n`); })
-      .then(() => {
-        holding = false;
-        release(token);
-      });
+    cancelWait(token);
+    if (holder !== token) return;
+    // Keep ownership while any in-flight message finishes. Sync clears a
+    // disconnected extended-protocol error state, then the real backend rolls
+    // back the holder before another connection can enter its transaction.
+    void session.work.then(async () => {
+      const db = await dbReady;
+      await db.execProtocolRaw(new Uint8Array([0x53, 0, 0, 0, 4]));
+      await db.query('ROLLBACK');
+      release(token);
+    }).catch(error => {
+      process.stderr.write(`pglite-host: connection cleanup failed: ${errorMessage(error)}\n`);
+      process.exit(1);
+    });
   });
   socket.on('error', () => { /* close handler owns cleanup */ });
-  await fromNodeSocket(socket, {
+  void fromNodeSocket(socket, {
     serverVersion: '18.3 (PGlite)',
     auth: { method: 'password', getClearTextPassword: () => databasePassword,
       validateCredentials: ({ username, password }) => username === databaseUser && password === databasePassword },
@@ -806,113 +587,42 @@ const server = net.createServer(async (socket) => {
     },
     async onMessage(data, { isAuthenticated, clientParams }) {
       if (!isAuthenticated) return undefined; // gateway owns startup/auth traffic
-      const client = data;
-      const closes = closing(client);
-      // looked up, not claimed, while the turn is decided: a Parse claims its name on the connection's own turn,
-      // after the closed connections' names are released (a reconnect's `s0` is its own again)
-      data = scopeNames(session, client, false);
-      const db = await dbReady;
-      readWorldClock();
-      // a guest whose turn ran out: told once, the rest of its batch dropped until its Sync
-      if (session.guestExpired) {
-        if (data[0] === 0x53) { session.guestExpired = false; session.guestErrorSent = false; session.status = 'I'; return READY_IDLE; }
-        if (session.guestErrorSent) return new Uint8Array(0);
-        session.guestErrorSent = true;
-        return errorResponse('57014', 'the containerless Postgres (one session) cancelled this read: it ran beside another connection\'s open transaction longer than its turn allows');
-      }
-      const role = await enter(token, session, data);
-      if (role === 'guest') {
+      // Gateway owns Terminate; it must neither wait for a turn nor terminate
+      // the shared PostgreSQL backend. The close handler owns rollback.
+      if (data[0] === 0x58) return undefined;
+      if (!await enter(token, session)) return undefined;
+      const work = (async () => {
         if (session.closed) return undefined;
-        const own = clientParams?.database || clientParams?.user;
-        const sync = data[0] === 0x53;
-        const endGuest = () => {
-          session.guestOpen = false;
-          session.guestRefused = false;
-          session.status = 'I';
-          guestBatch = null;
-          session.guestUnnamed = false;
-          // the holder's idle clock stops while a guest runs, and goes on from where it was
-          const host = sessions.get(holder);
-          if (host) host.idleSince += machineNow() - guestStartedAt;
-          wakeAll();
-        };
-        // a batch refused mid-way: its remaining messages are dropped until its Sync, as Postgres skips after an error
-        if (session.guestRefused) {
-          if (sync) { endGuest(); return READY_IDLE; }
-          return new Uint8Array(0);
-        }
-        if (session.guestOpen && !guestMessageAllowed(session, data)) {
-          session.guestRunning = true; // the expiry waits until this refusal is done
-          await quiet(db, 'ROLLBACK TO SAVEPOINT volter_guest');
-          await quiet(db, 'RELEASE SAVEPOINT volter_guest');
-          session.guestOpen = false;
-          session.guestRefused = true;
-          session.guestRunning = false;
-          return errorResponse('0A000', 'the containerless Postgres (one session) runs only reads beside another connection\'s open transaction; this batch began with a read and went on to write');
-        }
-        if (!session.guestOpen) { await quiet(db, 'SAVEPOINT volter_guest'); session.guestOpen = true; }
-        data = scopeNames(session, client, true);
-        noteStatement(session, data);
-        if (data[0] === 0x50 && text(asBuffer(data), 5) === '') session.guestUnnamed = true;
+        const db = await dbReady;
+        readWorldClock();
+        if (closedStatements.length && !session.midBatch && session.status !== 'T' && session.status !== 'E') await flushClosed(db);
+        if (session.closed) return undefined;
+        const closes = closing(data);
+        data = scopeNames(session, data, true);
         let raw;
-        session.guestRunning = true;
         try {
-          raw = await db.execProtocolRaw(refuseStatements(data, own));
+          raw = await db.execProtocolRaw(refuseStatements(data, clientParams?.database || clientParams?.user));
         } catch (error) {
+          // SQL errors arrive as protocol bytes. A throw is a backend failure.
           process.stderr.write(`pglite-host: backend aborted: ${errorMessage(error)}\n`);
           process.exit(1);
         }
         const response = withoutEarlyReady(data, raw);
         settleClose(session, closes, response);
         const status = lastReadyStatus(response);
-        if (status === null) { session.guestRunning = false; return response; } // mid-batch: the guest keeps its turn until its Sync
-        // the savepoint is gone if the holder's transaction ended meanwhile (its socket closed): quiet, not fatal
-        if (status === 'E') await quiet(db, 'ROLLBACK TO SAVEPOINT volter_guest');
-        await quiet(db, 'RELEASE SAVEPOINT volter_guest');
-        session.guestRunning = false; // the batch has ended: nothing left for the expiry to cancel
-        endGuest();
-        return withReadyStatus(response, 'I');
-      }
-      // closed (or cut) while it waited: give the lock up without running the
-      // message — a Terminate run now would leave no ReadyForQuery to release it
-      if (session.closed || session.terminated) {
-        session.busy = false;
-        if (!holding) release(token);
-        return undefined;
-      }
-      holding = true;
-      session.busy = true;
-      // a turn that begins outside any transaction first closes what closed connections left
-      if (closedStatements.length && !session.midBatch && session.status !== 'T' && session.status !== 'E') await flushClosed(await dbReady);
-      data = scopeNames(session, client, true);
-      noteStatement(session, data);
-      // libpq's default: no database parameter means the user's name
-      const own = clientParams?.database || clientParams?.user;
-      let raw;
-      try {
-        raw = await db.execProtocolRaw(refuseStatements(data, own));
-      } catch (error) {
-        // SQL errors arrive as ErrorResponse bytes; a throw means the WASM
-        // backend itself aborted and every later call would hang. Exit so the
-        // World sees the service down (status fails) instead of a wedged port.
-        process.stderr.write(`pglite-host: backend aborted: ${errorMessage(error)}\n`);
-        process.exit(1);
-      }
-      session.busy = false;
-      session.idleSince = machineNow();
-      const response = withoutEarlyReady(data, raw);
-      settleClose(session, closes, response);
-      const status = lastReadyStatus(response);
-      session.midBatch = status === null;
-      if (status !== null) session.status = status;
-      if (status === 'I') {
-        holding = false;
-        release(token);
-      } else if (status === 'T') {
-        wakeAll(); // idle in its transaction: a waiting reader may now run as a guest
-      }
-      return response;
+        session.midBatch = status === null;
+        if (status !== null) session.status = status;
+        // A closed holder retains admission until its close handler confirms
+        // rollback, even if its in-flight message reported idle.
+        if (status === 'I' && !session.closed) release(token);
+        return response;
+      })();
+      session.work = work;
+      return work;
     },
+  }).catch(error => {
+    process.stderr.write(`pglite-host: wire connection failed: ${errorMessage(error)}\n`);
+    socket.destroy();
   });
 });