matrx-orm 3.1.256__tar.gz → 3.1.258__tar.gz

{matrx_orm-3.1.256 → matrx_orm-3.1.258}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: matrx-orm
-Version: 3.1.256
+Version: 3.1.258
 Summary: Async-first PostgreSQL ORM with bidirectional migrations, schema introspection, many-to-many relationships, and built-in state caching
 Project-URL: Homepage, https://github.com/AI-Matrix-Engine/aidream-current
 Project-URL: Repository, https://github.com/AI-Matrix-Engine/aidream-current

matrx_orm-3.1.258/docs/attachment-concurrency.md

@@ -0,0 +1,28 @@
+---
+type: Reference
+title: Credential attachment concurrency verification
+description: Real-router race probe for parent-held attachment mutation and byte materialization.
+---
+
+# Credential attachment concurrency verification
+
+Use the real Vault router and auth provider as `admin@admin.com`, with an
+isolated agent-owned session and a new item stamped with this run's `test_run_id`.
+Never reuse another run's item or touch the owner's credentials.
+
+1. Pause an attachment request after it takes the parent lock but before its
+   child write. Release it first: it must return 201. The following item delete
+   must return 204, and a fresh router list must have no live child.
+2. Reverse the schedule: pause the attachment request before parent-lock
+   acquisition, complete the item delete, then release the request. It must
+   refuse and leave no live child.
+3. Repeat both schedules with download and trusted resolve paused before byte
+   materialization. No child bytes may escape after the winning deletion.
+4. Remove each run-owned disposable item through the canonical cascade, archive
+   retained run-owned fixtures and independently verify no live test records
+   remain. End and verify rejection of the owned session; close only this run's
+   browser/process resources and clear any owned clipboard content.
+
+This probe complements the focused serialization guards; offline source tests do
+not establish live concurrency acceptance. Pending product acceptance belongs in
+the [Vault register](../../../common-docs/projects/credential-sharing-browser-login/REGISTER.md).

matrx_orm-3.1.258/docs/index.md

@@ -0,0 +1,10 @@
+---
+type: Reference
+title: matrx-orm verification and migration guides
+description: Focused package operating guides.
+---
+
+# Package guides
+
+- [Migrations](migrations.md)
+- [Credential attachment concurrency verification](attachment-concurrency.md)

{matrx_orm-3.1.256 → matrx_orm-3.1.258}/matrx_orm/core/FEATURE.md

@@ -32,7 +32,9 @@ generated model therefore remains reachable through
 `get_model_by_table_name(schema, table)` even when its class does not repeat the
 resolved table name as a raw attribute.
 
-Pinned by `tests/level1/test_registry.py`.
+Pinned by `tests/level1/test_registry.py`. Registry, catalog, recovery and diagnostic
+identities use exact `schema.table`; bare names are uncached discovery terms and
+ambiguous lookups refuse rather than choosing a schema.
 
 ## Database execution errors
 
@@ -46,9 +48,7 @@ rejects the statement before execution, so this narrow failure is replay-safe;
 ambiguous write failures remain single-attempt.
 
 **A write may set its own statement ceiling — `Model.create(statement_timeout=…)`
-(seconds, keyword-only).** The read side has had `QueryBuilder.timeout()` for a
-while; the write door had nothing, so the pool's `command_timeout` (10s) was the
-only ceiling any INSERT could have. It threads
+(seconds, keyword-only).** It threads
 `Model.create` → `operations/create` → `query["statement_timeout"]` →
 `QueryExecutor.insert` → `adapter.execute_write(statement_timeout=)` →
 `execute_query(statement_timeout=)` → asyncpg `fetch(..., timeout=)`, so it
@@ -56,8 +56,7 @@ overrides — never widens — anything else: pool-acquire timeout and every oth
 statement are untouched. It raises no retry rights: an ambiguous write is still
 single-attempt HERE, and a caller that re-issues one must own an idempotency key
 (matrx-graph's checkpoint INSERT is keyed by checkpoint id and reads the row back).
-Added 2026-09-12 after a 1.1 MB `workflow.checkpoint` row timed out at 10s under
-load and killed a paid-for workflow run. Guard:
+Guard:
 `tests/level1/test_query_timeout.py::TestInsertStatementTimeout`.
 
 **A statement the SERVER canceled to break a lock collision is re-issued — the
@@ -71,19 +70,15 @@ unretryable. Class-40 siblings stay out by name — `40003`
 this completed", and `40002` is a constraint failure wearing a class-40 code.
 The victim is often innocent of any write: a multi-table READ is canceled
 whenever a concurrent DDL session wants AccessExclusiveLock on a table it already
-holds a lock on, which reached a person as "listConversations: deadlock detected"
-on /chat.
+holds a lock on.
 
 🚨 **THERE IS ONE LOOP AND ONE BUDGET.** `matrx_orm/core/write_retry.py` owns the
 classification (`is_confidently_aborted_lock_contention`), the knob policy, and
 the loop (`run_with_lock_retry`); both doors into the database run through it —
 `execute_query` for every statement and `call_function` for RPCs (an RPC reaches
-Postgres on a raw connection, bypassing `execute_query` entirely, so before this a
-deadlock inside any `SECURITY DEFINER` write RPC failed its caller outright).
+Postgres on a raw connection, bypassing `execute_query` entirely).
 `_execute_with_retry` retries only the nothing-was-sent classes above it and must
-never grow a lock budget of its own: on 2026-09-12 two independent lock-retry
-mechanisms landed within hours and nested, making the real ceiling the product of
-two budgets nobody had chosen. Statement-level replay is sound only because both
+never grow a lock budget of its own. Statement-level replay is sound only because both
 doors return early when a `transaction()` is active: every attempt the loop
 retries WAS its own transaction. Inside a caller's transaction the rollback took
 the whole block and only that transaction's owner can redo the unit, so the
@@ -113,7 +108,9 @@ labels (`unique`, `foreign_key`, `not_null`, `check`, `exclusion`, and
 
 `UnknownDatabaseError` is reserved for genuinely unrecognized driver failures.
 It is diagnostic and intentionally verbose, so a known PostgreSQL error must
-never reach that fallback.
+never reach that fallback. `AppError.db_sqlstate` preserves the deepest
+PostgreSQL SQLSTATE without retaining traceback frames, so replay-safe transaction
+owners can classify failures without parsing rendered prose.
 
 `QueryTimeoutError` diagnoses by SQL verb. A fresh `INSERT` points first to a
 relation/DDL lock convoy, FK parent lock, or trigger work—not same-row fan-out.
@@ -140,7 +137,17 @@ Static twin: aidream `scripts/check_driver_timeout_vs_statement_ceiling.py`.
 `retry_on_transient(..., jitter_ratio=...)` retains deterministic exponential
 backoff by default; a caller recovering a replay-safe lock conflict can add at
 most `jitter_ratio * base_delay` to each retry without changing its retry count
-or exception classification.
+or exception classification. `policy_db=...` instead uses the existing write-retry
+knobs (`1 + max_retries` attempts and their full-jitter backoff), requires explicit
+narrow `retry_on` types, and rejects legacy timing overrides. Resolve policy
+before opening the whole-unit transaction. If a transaction is already active,
+the factory runs once without resolving policy; its outer owner must restart.
+A narrow `RuntimeError` subtype is the caller's assertion of a fixed safe
+structural signal; it does not classify provider failures. Cancellation always
+propagates. Legacy calls retain their original defaults. Transaction/savepoint
+scopes never suppress the body exception; `TransactionContext.__aexit__` returns
+`Literal[False]` or raises, so callers and type checking preserve that fact.
+Guard: `tests/level1/test_resilience_policy.py`.
 
 **Read-side connection loss retries once on a fresh checkout.** A read-only SQL
 statement is safe to repeat after `ConnectionDoesNotExistError`. The same retry
@@ -187,9 +194,7 @@ no timeout, after the one cancellation an outer timeout could deliver was
 already spent, and against a hung database that close never ends; (2)
 `asyncpg.create_pool` runs under `pool_create_timeout` (default 30 s) with
 `connect_timeout` (default 10 s), and the half-built pool is terminated on
-failure. Incident 2026-09-25: the zero-connection replacement ran while the
-database machine was hung and held `_locks['matrx_files']` for 4.5 h (the same
-close wedged matrx-seo's keepalive). Pinned by
+failure. Pinned by
 `tests/level1/test_pool_create_never_wedges.py` (a fake PostgreSQL that
 handshakes, then goes silent).
 
@@ -248,9 +253,7 @@ bounds execution, not the WAIT for a lock: a `CREATE TABLE` queued behind a dump
 sweep is not executing, so `statement_timeout` never fires and an unbounded waiter
 blocks everyone behind it. `lock_timeout_ms` (default `None` = leave the server
 default) is `SET LOCAL` like the role and the claims, so it cannot outlive the
-transaction. First consumer: aidream's table-provisioning lane B
-(`aidream/services/provisioning/`), whose new tables carry FKs into two of the busiest
-relations on the platform database.
+transaction.
 
 **Empty-to-nonempty is not contamination proof.** A READ COMMITTED row can be
 created between the original empty query and its reproof (`guest_executions`
@@ -271,10 +274,12 @@ column names preserved). A clean answer, empty or not, is proven by that one
 statement; a borrowed role RAISES (22P02 naming the role), and only then does
 `repair_guarded_read` emit the contamination alarm and re-read on a pinned, reset
 session. `<login>` is learned once per pool by `learn_login_role` (pinned transaction,
-both resets, `session_user`). Before this, every zero-row read was re-run as an
-`EXISTS` proof: 3.5M extra statements in 5.7 h on the live database. A query that
+both resets, `session_user`). A query that
 cannot be wrapped (multi-statement, SHOW, VALUES) keeps the old path
-(`prove_empty_in_one_statement`, then the pinned re-proof). Pinned by
+(`prove_empty_in_one_statement`, then the pinned re-proof). Replay-safe polling
+reads may explicitly use `verify_empty=False` when their unchanged cursor makes
+an empty-to-nonempty race recover on the next poll. Ordinary reads retain the
+role guard. Pinned by
 `tests/level1/test_guarded_read_never_reruns_empty.py` and `tests/test_pooler_role_guard.py`.
 
 **Round trips are the launch cost on a remote pooler.** Every top-level BEGIN sets
@@ -283,8 +288,7 @@ its ceilings, the host's declared session context and the opener's own settings
 role LAST) in ONE `set_config` statement; `set_local_gucs` does the same inside a
 transaction. A transaction-mode pool releases connections with no reset statement
 (`_transaction_pool_release`); a session-mode pool keeps asyncpg's full reset.
-Measured on one agent launch against the clone through the pooler (170 ms per round
-trip from a laptop): 435 → ~200 round trips. Pinned by
+Pinned by
 `tests/level1/test_transaction_gucs_one_round_trip.py`,
 `tests/level1/test_transaction_pool_release_sends_nothing.py` and
 `tests/level1/test_rls_session_scope.py`.
@@ -316,8 +320,7 @@ pooler shares server connections with every client of the same login and never r
 one between clients, so a session-level `SET default_transaction_read_only = on` (or
 `SET SESSION CHARACTERISTICS AS TRANSACTION READ ONLY`) sent outside a transaction — the
 shape of an ad-hoc "read-only production" helper — leaves that backend read-only for
-everyone (2026-10-01 incident: dispatchers, workflow claims, request audit, chat writes;
-recurring since 2026-09-12). A transaction-mode pool's connections are
+everyone. A transaction-mode pool's connections are
 `ReadWriteConnection` (`read_write.py`): every top-level BEGIN naming no access mode is
 sent as `... READ WRITE` (zero extra round trips), and an autocommit statement refused as
 read-only re-runs once inside `BEGIN READ WRITE` with a WARNING naming the cause. An
@@ -326,18 +329,15 @@ pooler belongs in `BEGIN READ ONLY`, never a session SET. Pinned by
 `tests/test_a_read_only_backend_never_refuses_our_writes.py` (loopback `ISOLATED_PG17_DSN`)
 and `tests/level1/test_read_write_declared.py`.
 
-**A backend handed over inside another client's transaction never takes our writes.** The
-second shape of the same incident: a probe sent `begin read only; …; rollback;` through the
-pooler, an error or timeout skipped the `rollback`, and the pooler handed the open READ ONLY
-transaction to the server. The pooler answers our handshake "idle", so asyncpg learns of it
-only from the reply. A statement that comes back inside a transaction this connection never
-opened is the stranger's: rolled back, logged at ERROR with the remedy, re-run once in our own
+**A backend handed over inside another client's transaction never takes our writes.**
+A pooler may hand over an open transaction despite an idle handshake. A statement
+that comes back inside a transaction this connection never opened is the stranger's: rolled back, logged at ERROR with the remedy, re-run once in our own
 `BEGIN READ WRITE … COMMIT` (the rollback undid it, so exactly once). A top-level BEGIN answered
 with 25001 is the same: rolled back and begun again; a second stranger raises
 `InheritedTransactionError` by name. Pinned by
 `tests/test_a_backend_handed_over_mid_transaction_never_takes_our_writes.py`, which runs an
 in-process transaction pooler that never resets its one server connection (loopback
-`ISOLATED_PG17_DSN`; 4 of 5 fail on the code before it).
+`ISOLATED_PG17_DSN`).
 
 **The destructive live proof is loopback-only.**
 `tests/live_pooler_role.py::assert_isolated_pooler_target` runs before DSN
@@ -365,9 +365,7 @@ key through its own `server_settings`.
 Why it is not optional: an open transaction holds its locks (DDL queues behind
 it for the WHOLE database) and pins the cluster xmin horizon, which stops
 autovacuum from reclaiming dead tuples everywhere, not just on the tables that
-session touched. On 2026-08-21 one session sat idle in a transaction for 18+
-minutes; every `CREATE POLICY` on the live database blocked to `lock_timeout`
-while the migration applier told each agent to fix SQL that was correct.
+session touched.
 
 **Startup parameters do not survive a pooler.** Supavisor drops non-allowlisted
 startup parameters in both transaction and session mode (measured 2026-08-21:
@@ -399,12 +397,7 @@ A block that needs more says `SET LOCAL` later and wins.
 
 Empty in production — these are deployment settings there. The one caller is
 `matrx_orm.pytest_lock_guard`, the pytest11 guard that bounds what a test run may
-do to a SHARED database after a test transaction held ACCESS EXCLUSIVE on
-`platform.reachability` for 77s and stopped production chat on 2026-09-15
-(root-`conftest.py`, the sixth cross-suite hazard). Verified against the live
-database 2026-09-16: `lock_timeout`, `idle_in_transaction_session_timeout` and a
-tagged `application_name` all land through the pooler this way, and the same
-connection asked for them as startup options gets `0` and `"Supavisor"`.
+do to a shared database.
 
 **`long_transactions()` names the blocker.** `matrx_orm.long_transactions`
 (async) and `matrx_orm.long_transactions_sql` (a parameter-free SQL string, so
@@ -416,7 +409,7 @@ can never disagree about who the blocker was.
 
 Verified against the live database: 2026-08-21.
 
-**`probe_server_vitals()` sees the server without the pool.** One FRESH connection
+**`probe_server_vitals(config_name, timeout_s=…)` sees the server without the pool.** One FRESH connection
 with the registered config's own host/user/password/TLS, `select 1` (timed) plus
 one read-only catalog query — client-backend connections vs `max_connections`, lock
 waiters, the oldest running client statement (maintenance roles in
@@ -424,68 +417,3 @@ waiters, the oldest running client statement (maintenance roles in
 deadline, then terminated. It RAISES (`TimeoutError` on a hung server) because
 its caller, a watchdog, counts failures. Never touches the shared pool, which is
 what is exhausted or hung when a watchdog needs to speak.
-
-## Change log
-- 2026-10-03: `probe_server_vitals(config_name, timeout_s=)` — fresh-connection server health probe for the aidream database watchdog; verified live (latency 163 ms, 70/240 connections, postmaster start 22:34:55 UTC).
-- 2026-10-01: `ReadWriteConnection` rolls back a stranger's open transaction it was handed (statement reply or 25001 on BEGIN), re-runs our statement in its own transaction, and names a repeat `InheritedTransactionError`.
-- 2026-10-01: `ReadWriteConnection` for transaction-mode pools — every BEGIN declares READ WRITE and a read-only-refused autocommit statement re-runs once in one; a pooled backend another client left read-only at session level no longer fails the platform's writes.
-- 2026-09-30: Fewer round trips per request (agent-launch latency, lane deep): one-statement proof of a clean empty read; ceilings + declared context + `rls_session` settings in ONE BEGIN-time `set_config` statement (`transaction(opening_gucs=)`, `set_local_gucs`, `emit_local_gucs`); transaction-mode pools release with no reset statement. 435 → ~200 round trips on a flashcard launch.
-- 2026-09-30: `statement_ceiling.py` — a driver timeout above the server's statement ceiling is logged once per call site; `SERVER_CEILING` sentinel. ~19 callers passed 60-600 s under the 30 s `postgres` ceiling (the nightly keyword classifier was canceled at 30 s for eight days).
-- 2026-09-12 (later): ONE retry mechanism. Two independent lock-retry
-  implementations for the same class landed hours apart — a `LockContentionError`
-  + constant-budget loop inside `execute_query`, and a `TransientTransactionError`
-  + knob-budget loop wrapped around `_execute_with_retry` — and merged into
-  nesting. Reconciled to: `LockContentionError` survives (it covers reads and
-  55P03 too), the loop lives once in `write_retry.run_with_lock_retry` and is used
-  by `execute_query` AND `call_function`, its budget is the `orm.write_retry`
-  knob rows (never a constant), and `TransientTransactionError` is deleted.
-- 2026-09-12: A statement Postgres canceled to break a lock collision
-  (40P01/40001/55P03) is re-issued on a fresh connection instead of failing the
-  caller. Before this it fell to the catch-all as `UnknownDatabaseError` and
-  killed the request: four parallel `ai.agent.start` invocations deadlocked on
-  `users.user_secrets` and errored a whole workflow run, and a pure `/chat`
-  conversation-list READ showed "deadlock detected" to a person.
-- 2026-08-30: Classified server restart/failover rejection during pool checkout
-  as retryable connection failure before any caller SQL is sent.
-- 2026-08-24: Recovered read-only disconnects masked by empty-read reproof's
-  transaction teardown, while preserving diagnostic handling for unrelated
-  interface errors.
-- 2026-08-22: Retried read-only mid-query connection loss once on a fresh
-  checkout while preserving no-retry write semantics.
-- 2026-09-11: Replay-safe polling reads may explicitly skip empty-result
-  reproof; their unchanged cursor makes an empty-to-nonempty race recover on
-  the next poll, avoiding the transaction-pool reproof convoy without relaxing
-  the default integrity guard for ordinary reads.
-- 2026-08-22: Preserved the deepest Postgres SQLSTATE on `AppError` as a
-  lightweight classification (without retaining traceback frames), so an
-  idempotent transactional owner can recover from a database role transition
-  without parsing rendered error prose.
-- 2026-08-21: Added the idle-in-transaction ceiling on every pool and the
-  `long_transactions` blocker-naming primitive (feedback c72a32ac).
-
-- 2026-08-18: Indexed ModelMeta-derived table names so generated models remain
-  discoverable by exact schema/table identity.
-- 2026-08-18: Preserved successful query results when asyncpg times out while
-  resetting and discarding the released connection.
-- 2026-08-18: Let waiters reuse healthy connections released behind a slow
-  serialized-growth handshake.
-- 2026-08-17: Corrected INSERT timeout guidance to identify relation/DDL lock
-  convoys before application row contention.
-- 2026-08-17: Required direct before/after role evidence before recording
-  contamination; concurrent empty-to-nonempty reads reconcile without a false
-  repair-queue row, and session-authorization contamination is reset too.
-- 2026-08-17: Refused destructive pooler-role verification against shared or
-  remote databases before any connection is opened.
-- 2026-08-16: Kept the destructive transaction-pool contamination proof out of
-  the installable runtime package and isolated it under package tests; the
-  operator wrapper is SQL-free and runtime prose no longer resembles an
-  executable non-local role mutation.
-- 2026-08-15: Pinned transaction-local RLS role cleanup across success,
-  exception, and early-return paths.
-- 2026-08-15: Added first-timeout pool holder census, host alarm seam, tracked raw-pool helper, and bounded cancellation-safe release.
-- 2026-08-14: Public models now render `public.table` SQL targets; bare public
-  relation names can no longer disable application logs or write-failure capture.
-- 2026-08-13: Registry, admin, recovery, catalog, and diagnostic identities are now exact `schema.table`; bare names are accepted only as uncached discovery terms and ambiguity fails loudly.
-- 2026-09-25: Pool creation is bounded and a failed connection init aborts instead of awaiting an untimed close.
-- 2026-08-13: Added atomic recovery from a pool left at zero connections after an upstream database restart.
-- 2026-08-09: Pinned positional-mapping hydration for parameter-shaped column names.

{matrx_orm-3.1.256 → matrx_orm-3.1.258}/matrx_orm/core/resilience.py

@@ -31,14 +31,12 @@ import asyncio
 import logging
 import random
 import re
-from typing import Awaitable, Callable, TypeVar
+from collections.abc import Awaitable, Callable
 
 from matrx_orm.exceptions import PoolAcquireTimeoutError, QueryTimeoutError
 
 logger = logging.getLogger("matrx_orm.resilience")
 
-T = TypeVar("T")
-
 # The transient failures that a rolled-back / idempotent unit of work may retry.
 # Both mean "no committed side effect survived": a command-timeout aborts its
 # transaction, a pool-acquire timeout never sent SQL at all.
@@ -48,14 +46,15 @@ DEFAULT_TRANSIENT: tuple[type[BaseException], ...] = (
 )
 
 
-async def retry_on_transient(
+async def retry_on_transient[T](
     factory: Callable[[], Awaitable[T]],
     *,
     attempts: int = 3,
     base_backoff: float = 0.25,
     jitter_ratio: float = 0.0,
-    retry_on: tuple[type[BaseException], ...] = DEFAULT_TRANSIENT,
+    retry_on: tuple[type[BaseException], ...] | None = None,
     label: str = "db-unit",
+    policy_db: str | None = None,
 ) -> T:
     """Run ``factory()`` and retry it on a transient DB failure.
 
@@ -66,12 +65,47 @@ async def retry_on_transient(
     delay, so callers recovering lock contention need not retry in lockstep.
     On the final attempt the original exception propagates unchanged.
 
+    ``policy_db`` opts into existing write-retry knobs instead of legacy timing.
+    It requires explicit narrow lock/structural restart types in ``retry_on``.
+    A narrow RuntimeError subtype is the caller's assertion of a fixed safe
+    structural signal, not a general classifier of provider failures.
+    Inside an active transaction the factory runs once without a policy read;
+    its outer owner handles restarts.
+
     Loud on every retry AND on heal, so a masked slow-query/contention problem
     is never silent — it shows up as a WARNING you can grep, not a swallowed
     hiccup.
     """
     if jitter_ratio < 0:
         raise ValueError("jitter_ratio must be non-negative")
+    policy = None
+    if policy_db is not None:
+        if (attempts, base_backoff, jitter_ratio) != (3, 0.25, 0.0):
+            raise ValueError("policy_db cannot be combined with legacy retry timing options")
+        from matrx_orm.core.transaction import get_active_connection
+        from matrx_orm.core.write_retry import resolve_policy
+        from matrx_orm.exceptions import DatabaseError, LockContentionError
+
+        if retry_on is None:
+            raise ValueError("policy_db requires explicit retry_on exception types")
+        if any(
+            kind is RuntimeError
+            or not issubclass(kind, (LockContentionError, RuntimeError))
+            or issubclass(kind, (asyncio.CancelledError, OSError, PermissionError))
+            or (
+                issubclass(kind, DatabaseError)
+                and not issubclass(kind, LockContentionError)
+            )
+            for kind in retry_on
+        ):
+            raise ValueError("policy_db requires narrow lock or structural restart types")
+        # A savepoint retry retains outer locks/snapshot: only its owner may retry.
+        if get_active_connection() is not None:
+            return await factory()
+        policy = await resolve_policy(policy_db)
+        attempts = 1 + policy.max_retries
+    if retry_on is None:
+        retry_on = DEFAULT_TRANSIENT
     last_exc: BaseException | None = None
     for attempt in range(1, attempts + 1):
         try:
@@ -85,6 +119,8 @@ async def retry_on_transient(
                     type(last_exc).__name__ if last_exc else "?",
                 )
             return result
+        except asyncio.CancelledError:
+            raise
         except retry_on as exc:
             last_exc = exc
             if attempt >= attempts:
@@ -96,7 +132,11 @@ async def retry_on_transient(
                     type(exc).__name__,
                 )
                 raise
-            backoff = base_backoff * (2 ** (attempt - 1))
+            backoff = (
+                policy.backoff_seconds(attempt - 1)
+                if policy is not None
+                else base_backoff * (2 ** (attempt - 1))
+            )
             if jitter_ratio:
                 backoff += random.uniform(0.0, backoff * jitter_ratio)  # noqa: S311 -- retry desynchronization
             logger.warning(

{matrx_orm-3.1.256 → matrx_orm-3.1.258}/matrx_orm/core/transaction.py

@@ -449,7 +449,7 @@ class TransactionContext:
         exc_type: type[BaseException] | None,
         exc_val: BaseException | None,
         exc_tb: Any,
-    ) -> bool:
+    ) -> Literal[False]:
         conn = _active_connection.get()
         if self._is_savepoint:
             if self._depth_token is not None:

{matrx_orm-3.1.256 → matrx_orm-3.1.258}/matrx_orm/core/write_retry.py

@@ -190,7 +190,7 @@ async def resolve_policy(config_name: str) -> WriteRetryPolicy:
         )
         values = {str(row["key"]): row["value"] for row in rows or []}
     except Exception as exc:  # noqa: BLE001 — a knob read must never fail a write
-        _announce_degradation(config_name, f"{type(exc).__name__}: {exc}")
+        _announce_degradation(config_name, type(exc).__name__)
         policy = STARTING_POLICY
     else:
         missing = [