Retry transient catalog-concurrency errors in PostgreSQL migration DDL (closes #293)

[jeremydmiller]

Closes #293. Follow-up to #282.

Problem

#282 (6b6d296) made only CREATE SCHEMA concurrent-safe — a plpgsql sub-block catching 42P06/23505. The rest of the migration DDL emitted by migration.WriteAllUpdates(...) (CREATE OR REPLACE FUNCTION mt_immutable_*, CREATE TABLE IF NOT EXISTS, …) stayed unguarded. When two sessions lazily EnsureStorageExists against the same database, the shared catalog DDL races and one backend gets:

Npgsql.PostgresException : XX000: tuple concurrently updated

That SQLSTATE isn't caught by #282, so it propagates. Surfaced as a Marten conjoined multi-tenant CI flake (query_before_saving, downstream JasperFx/marten#4552).

Why retry is the right fix

Two properties of PostgresqlMigrator.executeDelta make a bounded retry both safe and minimal:

1. The DDL is idempotent — IF NOT EXISTS / CREATE OR REPLACE throughout.
2. Each statement auto-commits independently — executeDelta never sets cmd.Transaction, so a failed statement rolls back fully and a retry re-runs from a clean slate. (CREATE INDEX CONCURRENTLY is already split into its own chunk, so the main body is a transaction-safe block.)

A wider DO-block guard doesn't generalize — the post-schema DDL isn't in one catchable block, and CONCURRENTLY can't be. Retry is the issue's recommended option and the general fix.

Change

Wrap each cmd.ExecuteNonQueryAsync in a bounded retry (3 attempts, jittered sub-100ms backoff), inside the existing try/catch so the established logger.OnFailure / rethrow path is untouched after exhaustion. Retry only on the transient, retry-safe SQLSTATEs:

SQLSTATE	Meaning	Match
40001	serialization_failure	by code
40P01	deadlock_detected	by code
XX000	internal_error	only when message is tuple concurrently updated (XX000 is a catch-all)

Kept PG-specific (these codes are PostgreSQL's; executeDelta is a per-provider override). The classification is a pure internal predicate IsTransientCatalogConcurrency(sqlState, messageText).

Test plan

• PostgresqlMigratorConcurrencyRetryTests — 12 assertions on the predicate: 40001/40P01 by code; XX000 matches on message (case-insensitive, substring), rejects unrelated XX000 messages + null; unrelated SQLSTATEs (incl. the Make CREATE SCHEMA migration DDL concurrent-safe against pg_namespace race #282-handled 42P06/23505) not retried. The catalog race itself isn't deterministically testable, so the classification is what's covered.
• Happy-path integration unchanged: migration-scenario / schema-creation / DatabaseWithTables / Bug983 suites 21/22 (1 pre-existing skip) against PostgreSQL.

Downstream JasperFx/marten#4552 stabilizes once Marten consumes a Weasel build with this (an rc.2 candidate).

🤖 Generated with Claude Code