hardening: fault-inject SQL binding, migrations, and transaction recovery #54

Goal

Run a deeper, contract-driven edge-case pass for 0.5.0. The cases below are probes, not claims that defects are currently present.

Probe targets

Exercise placeholder ordering across nested queries, null/empty/binary/large values, identifier rejection, constraint violations, migration failure halfway through, rollback failure, and connection cleanup. Compare PostgreSQL and SQLite behavior for the same supported contract, and prove no partial schema/data state survives failed transactional operations.

Required outcome

• Inspect current implementation and tests before adding cases; extend existing coverage instead of duplicating it.
• Exercise relevant malformed/boundary inputs, ordering and repeated operations, failure/recovery, cancellation/cleanup, and cross-runtime or cross-package parity.
• For each confirmed bug, keep a minimal reproducer and regression test with the fix. If the fix is too large or needs a product decision, file/link a separate bug issue with impact and release disposition.
• Refactor only where the probes expose a fragile boundary, repeated work, or unclear ownership. The 0.5.0 API contraction is not a substitute for behavioral hardening.
• Record the scenarios exercised, outcomes, changed tests/fixes, coverage evidence for the affected branches, and the repository's relevant validation commands. If the probe finds no bug, record the evidence and tested matrix.

A broad checklist without executed tests or source-backed findings does not complete this issue.

Initial invariant and test-gap assessment (2026-10-02)

Baseline: static inventory of test paths, scripts, and named cases on origin/develop. No suites were run and not every assertion body was inspected. Named tests are evidence signals, not proof of coverage; candidate gaps must be checked against assertions before being called missing.

Invariants and evidence

• Batch statements respect PostgreSQL parameter ceilings and transaction failures preserve database state. Existing tests cover ceilings, heterogeneous batches/joins, PostgreSQL rollback, and terminated connections.
• SQLite rollback and migration behavior matches its documented dialect contract. tests/sqlite.test.ts covers rollback failure, nested/four-level savepoints, shared-file serialization, and failed non-transactional migrations; status: broader evidence than the initial inventory suggested.

Candidate gaps to verify

Probe connection loss during rollback and lock-release/recovery after a failed or interrupted SQLite migration; assert persisted state and subsequent connection usability. Do not treat SQLite rollback parity as untested.

Closure evidence: inspect and run the relevant assertions, then mark each invariant covered, partial, not evidenced, or not run. Add a minimal regression reproducer for every confirmed defect; record the exact command and outcome for a no-defect probe.