Fix PostgreSQL savepoint handling and client_min_messages getter under JDBC

Correct savepoint behaviour in the shared transaction support and fix the
PostgreSQL#client_min_messages getter, which did not work under the JDBC
adapter (it does not inherit the native pg adapter implementation).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: skunkworker

lib/arjdbc/abstract/transaction_support.rb

@@ -66,6 +66,16 @@ def exec_rollback_db_transaction
 
       ########################## Savepoint Interface ############################
 
+      # Save-point operations must NOT be retried on a connection failure. They
+      # only ever run inside an already-open transaction, so a dropped backend
+      # means the transaction's prior writes are gone. Retrying via
+      # `with_raw_connection(allow_retry: true)` would reconnect, replay an
+      # *empty* transaction (the original writes died with the backend), run the
+      # save-point statement against it, and report success - silently losing
+      # data. ActiveRecord's native adapters route these through
+      # `internal_execute` (allow_retry: false, materialize_transactions: true);
+      # we mirror that here. See the COMMIT/ROLLBACK overrides above.
+
       # Creates a (transactional) save-point one can rollback to.
       # Unlike 'plain' `ActiveRecord` it is allowed to pass a save-point name.
       # @param name the save-point name
@@ -74,7 +84,7 @@ def exec_rollback_db_transaction
       # @extension added optional name parameter
       def create_savepoint(name = current_savepoint_name)
         log("SAVEPOINT #{name}", 'TRANSACTION') do
-          with_raw_connection(allow_retry: true, materialize_transactions: false) do |conn|
+          with_raw_connection(allow_retry: false, materialize_transactions: true) do |conn|
             conn.create_savepoint(name)
           end
         end
@@ -87,7 +97,7 @@ def create_savepoint(name = current_savepoint_name)
       # @extension added optional name parameter
       def exec_rollback_to_savepoint(name = current_savepoint_name)
         log("ROLLBACK TO SAVEPOINT #{name}", 'TRANSACTION') do
-          with_raw_connection(allow_retry: true, materialize_transactions: false) do |conn|
+          with_raw_connection(allow_retry: false, materialize_transactions: true) do |conn|
             conn.rollback_savepoint(name)
           end
         end
@@ -100,7 +110,7 @@ def exec_rollback_to_savepoint(name = current_savepoint_name)
       # @extension added optional name parameter
       def release_savepoint(name = current_savepoint_name)
         log("RELEASE SAVEPOINT #{name}", 'TRANSACTION') do
-          with_raw_connection(allow_retry: true, materialize_transactions: false) do |conn|
+          with_raw_connection(allow_retry: false, materialize_transactions: true) do |conn|
             conn.release_savepoint(name)
           end
         end

lib/arjdbc/postgresql/adapter.rb

@@ -624,7 +624,12 @@ def all_schemas
     def client_min_messages
       return nil if redshift? # not supported on Redshift
       # Need to use #execute so we don't try to access the type map before it is initialized
-      execute('SHOW client_min_messages', 'SCHEMA').values.first.first
+      # NOTE: #execute returns an Array of row Hashes here (e.g.
+      # [{"client_min_messages"=>"warning"}]), unlike MRI's pg result object,
+      # so we read the single value out of the first row.
+      result = execute('SHOW client_min_messages', 'SCHEMA')
+      row = result.first
+      row && row.values.first
     end
 
     # Set the client message level.

test/db/postgresql/connection_lost_test.rb

@@ -205,6 +205,44 @@ def test_commit_failure_after_dropped_backend_is_not_reported_as_success
     @adapter.execute('DROP TABLE IF EXISTS commit_retry_loss') rescue nil
   end
 
+  # Regression test for the savepoint-retry data-loss footgun (#1, sibling of
+  # the COMMIT case above).
+  #
+  # create_savepoint / exec_rollback_to_savepoint / release_savepoint must go
+  # through with_raw_connection(allow_retry: false), matching ActiveRecord's
+  # native adapters (which route save-points through internal_execute, whose
+  # default is allow_retry: false). Save-points only ever run inside an open
+  # transaction, so a backend drop means the transaction's prior writes are
+  # gone. If the save-point op were retryable, AR would reconnect, replay an
+  # *empty* transaction, run the SAVEPOINT against it, and report success -
+  # silently losing the transaction's writes. With retry disabled the failure
+  # surfaces to the caller instead.
+  def test_create_savepoint_after_dropped_socket_does_not_silently_retry
+    @adapter.execute('SELECT 1')
+    @adapter.begin_db_transaction
+    # non-empty transaction; also keeps the connection verified/active.
+    @adapter.execute('SELECT 1')
+
+    original = @adapter.instance_variable_get(:@raw_connection).jdbc_connection
+
+    # pgbouncer reaps the backend right before the SAVEPOINT.
+    original.close
+    assert original.isClosed, 'precondition: jdbc connection should be closed'
+
+    # With allow_retry: false the dropped SAVEPOINT must raise rather than
+    # reconnecting and running against a fresh, empty transaction.
+    assert_raise(ActiveRecord::ConnectionFailed) do
+      @adapter.create_savepoint('sp_retry_loss')
+    end
+
+    # And it must NOT have silently swapped onto a fresh connection.
+    current = @adapter.instance_variable_get(:@raw_connection)
+    assert(current.nil? || current.jdbc_connection.equal?(original),
+           'savepoint must not reconnect-and-retry on a fresh connection')
+  ensure
+    @adapter.send(:reconnect!) rescue nil
+  end
+
   private
 
   def translate(jdbc_error)