Remove the PostgreSQL savepoint resource-owner depth limit

CHANGELOG.md

@@ -9,6 +9,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 ### Fixed
 
 - **SQLite: a payload whose commit fails no longer leaves its transaction open.** When `cloudsync_payload_apply` started the transaction itself and the commit then failed — a deferred foreign key violated at commit, or `SQLITE_BUSY` because a reader held the database — the transaction stayed open: the uncommitted rows remained visible on the connection and the next `BEGIN` failed. The failed transaction is now rolled back and the original error is returned. Changes from earlier source versions that were already committed are kept, the receive checkpoint does not move, and the rolled-back rows are no longer counted as applied, so delivering the payload again applies it. A transaction or savepoint opened by the caller is still left to the caller.
+- **PostgreSQL: applying a payload read from a table works at any savepoint depth.** Inside 126 or more savepoints, `SELECT cloudsync_payload_apply(payload) FROM some_table` still failed with `buffer pin ... is not owned by resource owner SubTransaction` (and a caught error at that depth could abort an assertion-enabled server): cloudsync recorded the caller's resource owner and memory context for at most 128 nesting levels, counting its own internal savepoints, and silently stopped restoring them beyond that. The fixed limit is gone; only PostgreSQL's own resource limits apply.
 
 ## [1.1.4] - 2026-09-21
 

docs/internal/deep-savepoints.md

@@ -0,0 +1,13 @@
+# PostgreSQL savepoint depth
+
+A heap scan feeding `cloudsync_payload_apply(payload)` failed with `buffer pin ... is not owned by resource owner SubTransaction` at 126 user savepoints. The caller's resource owner and memory context were stored in a 128-entry array; Cloudsync's internal savepoints consumed additional levels and silently exceeded the array.
+
+The backend now keeps one dynamically allocated frame per Cloudsync subtransaction. Each frame records the caller's owner, memory context and subtransaction ID. Commit and rollback restore a local copy after PostgreSQL ends the subtransaction. Subtransaction callbacks discard frames on both normal completion and external abort; transaction callbacks clear the stack before its owning memory context disappears. Snapshot replacement remains restricted to the outermost Cloudsync savepoint.
+
+This removes Cloudsync's fixed depth cap; PostgreSQL's own resource limits still apply. Allocations happen before opening a new subtransaction.
+
+## Validation
+
+`test/postgresql/63_deep_savepoints.sql` is included in `full_test.sql`. It exercises depths 1, 125, 126, 127, 128, 256, 1024 and 2048, reads payloads from a heap table, checks rollback, reapplies in the same transaction and commits. It also catches 100 trigger failures at depth 256 and verifies a subsequent successful apply in the same backend.
+
+The full suite passes all 546 checks on PostgreSQL 15.19, 17.11 and 18.6. Restoring the old implementation reproduces the buffer-owner error at depth 126. These are local database tests, not tests of a deployed cloud server.

src/postgresql/database_postgresql.c

@@ -3062,32 +3062,48 @@ static int database_refresh_snapshot (void) {
 // pin of the scan feeding cloudsync_payload_apply, say) is then charged to the wrong
 // owner: "buffer pin ... is not owned by resource owner TopTransaction". So, as the
 // procedural languages do, remember both at the start of each subtransaction and
-// restore them when it ends. Indexed by nesting level so an owner never leaks across
-// a subtransaction that was aborted elsewhere.
-#define CLOUDSYNC_SAVEPOINT_MAX_DEPTH 128
-static ResourceOwner savepoint_owner[CLOUDSYNC_SAVEPOINT_MAX_DEPTH];
-static MemoryContext savepoint_context[CLOUDSYNC_SAVEPOINT_MAX_DEPTH];
-
-// Only the outermost savepoint opened here may swap the active snapshot when it ends: a
-// snapshot pushed while an enclosing savepoint is still open belongs to that
-// subtransaction, and rolling the enclosing one back pops it — in place of the caller's
-// snapshot the swap popped, leaving the caller's portal without one (an assertion
-// failure in EnsurePortalSnapshotExists). Nested, advancing the command counter is
-// enough to make the changes visible: every SPI statement takes a fresh snapshot.
-// True when the subtransaction at level is nested inside another savepoint opened here.
-static bool savepoint_is_nested (int level) {
-    for (int k = 2; k < level && k < CLOUDSYNC_SAVEPOINT_MAX_DEPTH; k++) {
-        if (savepoint_owner[k]) return true;
-    }
-    return false;
-}
-
-static void savepoint_restore_caller (int level) {
-    if (level <= 0 || level >= CLOUDSYNC_SAVEPOINT_MAX_DEPTH || !savepoint_owner[level]) return;
-    MemoryContextSwitchTo(savepoint_context[level]);
-    CurrentResourceOwner = savepoint_owner[level];
-    savepoint_owner[level] = NULL;
-    savepoint_context[level] = NULL;
+// restore them when it ends. Frames live in TopTransactionContext and are removed
+// by transaction callbacks even when a caller aborts outside these wrappers.
+typedef struct cloudsync_savepoint_frame {
+    ResourceOwner owner;
+    MemoryContext context;
+    SubTransactionId subid;
+    struct cloudsync_savepoint_frame *previous;
+} cloudsync_savepoint_frame;
+
+static cloudsync_savepoint_frame *savepoint_stack;
+static bool savepoint_callbacks_registered;
+
+static void savepoint_xact_callback (XactEvent event, void *arg) {
+    if (event == XACT_EVENT_COMMIT || event == XACT_EVENT_ABORT ||
+        event == XACT_EVENT_PARALLEL_COMMIT || event == XACT_EVENT_PARALLEL_ABORT ||
+        event == XACT_EVENT_PREPARE)
+        savepoint_stack = NULL; // TopTransactionContext owns the allocations.
+}
+
+static void savepoint_subxact_callback (SubXactEvent event, SubTransactionId subid,
+                                       SubTransactionId parent, void *arg) {
+    if (event != SUBXACT_EVENT_COMMIT_SUB && event != SUBXACT_EVENT_ABORT_SUB) return;
+    if (savepoint_stack && savepoint_stack->subid == subid) {
+        cloudsync_savepoint_frame *frame = savepoint_stack;
+        savepoint_stack = frame->previous;
+        pfree(frame);
+    }
+}
+
+// Only the outermost cloudsync savepoint may replace the caller's snapshot.
+// Copy the frame before ending the subtransaction: its callback frees the frame.
+static cloudsync_savepoint_frame savepoint_caller (void) {
+    cloudsync_savepoint_frame caller = {0};
+    if (savepoint_stack && savepoint_stack->subid == GetCurrentSubTransactionId())
+        caller = *savepoint_stack;
+    return caller;
+}
+
+static void savepoint_restore_caller (cloudsync_savepoint_frame caller) {
+    if (!caller.owner) return;
+    MemoryContextSwitchTo(caller.context);
+    CurrentResourceOwner = caller.owner;
 }
 
 int database_begin_savepoint (cloudsync_context *data, const char *savepoint_name) {
@@ -3098,12 +3114,20 @@ int database_begin_savepoint (cloudsync_context *data, const char *savepoint_nam
     ResourceOwner oldowner = CurrentResourceOwner;
     PG_TRY();
     {
-        BeginInternalSubTransaction(NULL);
-        int level = GetCurrentTransactionNestLevel();
-        if (level > 0 && level < CLOUDSYNC_SAVEPOINT_MAX_DEPTH) {
-            savepoint_owner[level] = oldowner;
-            savepoint_context[level] = oldcontext;
+        if (!savepoint_callbacks_registered) {
+            RegisterXactCallback(savepoint_xact_callback, NULL);
+            RegisterSubXactCallback(savepoint_subxact_callback, NULL);
+            savepoint_callbacks_registered = true;
         }
+        // Allocate before opening a subtransaction so an allocation error cannot
+        // leave an untracked rollback boundary behind.
+        cloudsync_savepoint_frame *frame = MemoryContextAlloc(TopTransactionContext, sizeof(*frame));
+        frame->owner = oldowner;
+        frame->context = oldcontext;
+        frame->previous = savepoint_stack;
+        BeginInternalSubTransaction(NULL);
+        frame->subid = GetCurrentSubTransactionId();
+        savepoint_stack = frame;
         // Keep allocating in the caller's context; the subtransaction's resource owner
         // stays current so what the savepoint acquires is released with it.
         MemoryContextSwitchTo(oldcontext);
@@ -3128,13 +3152,12 @@ int database_commit_savepoint (cloudsync_context *data, const char *savepoint_na
     int rc = DBRES_OK;
 
     MemoryContext oldcontext = CurrentMemoryContext;
-    int level = GetCurrentTransactionNestLevel();
+    cloudsync_savepoint_frame caller = savepoint_caller();
     PG_TRY();
     {
         ReleaseCurrentSubTransaction();
-        bool nested = savepoint_is_nested(level);
-        savepoint_restore_caller(level);
-        if (nested) CommandCounterIncrement();
+        savepoint_restore_caller(caller);
+        if (caller.previous) CommandCounterIncrement();
         else database_refresh_snapshot();
     }
     PG_CATCH();
@@ -3157,13 +3180,12 @@ int database_rollback_savepoint (cloudsync_context *data, const char *savepoint_
     int rc = DBRES_OK;
 
     MemoryContext oldcontext = CurrentMemoryContext;
-    int level = GetCurrentTransactionNestLevel();
+    cloudsync_savepoint_frame caller = savepoint_caller();
     PG_TRY();
     {
         RollbackAndReleaseCurrentSubTransaction();
-        bool nested = savepoint_is_nested(level);
-        savepoint_restore_caller(level);
-        if (nested) CommandCounterIncrement();
+        savepoint_restore_caller(caller);
+        if (caller.previous) CommandCounterIncrement();
         else database_refresh_snapshot();
     }
     PG_CATCH();