[tae898]

Backlog row N-05 (bindings study 2026-10-25). NativeDatabase.run_in_transaction made 4 library crossings on the happy path (_transaction_stack_mark, begin, _transaction_commit_mark, commit), each one a ctypes call, a malloc'd JSON reply, string_at, a decode and a json.loads, although the begin reply already carries {"active","depth","commits"} (ArcadeNative.tx returns txState(db) for every op) and begin() discarded it.

What changed (Python only, _native/database.py; no Java change, no image rebuild): run_in_transaction takes commits_at_start from the begin reply (new internal _begin_state(), public begin() still returns None). The unwind after a failed block used to ask is_transaction_active() before every rollback and once more at the end, and the retry check asked for the commit count again; every rollback reply carries the same state, so the new _unwind_opened_since(mark) returns the state of its last crossing and the retry check reads the commit count from it. A crossing that failed leaves the state unknown and the next step reads it again, as before. _end_transactions_opened_since(mark) keeps its signature and behaviour (it is what TransactionContext calls, shared with the JVM wheel).

What was measured, counts only (lib.call invocations, warmed database, new test file test_native_tx_crossings.py): run_in_transaction happy path 4 -> 3 (mark, begin, commit); a block that raises 6 -> 4 (mark, begin, state read, rollback); a refused attempt that is retried and then commits 11 -> 7; with db.transaction() stays at 3 (mark, begin, commit; it never read the commit count) and its failing form is 3 (mark, begin, rollback). Two crossings is not reachable from Python alone: the mark has to be taken before begin (a mark taken after it counts the level begin pushed as the caller's, ArcadeData#9970/ArcadeData#9321, and the interrupt-between-push-and-return window needs the pre-begin state), so it is a crossing of its own. A Java-side record of the pre-begin state in the begin op would make it 2; that needs an image rebuild and is not part of this PR.

No speed claim is made. Whether 1 of 4 crossings is visible in a small-transaction rate would be a timed A/B through tools/ab.py, not run here.

Semantics: unchanged by design, pinned by tests that pass before and after (a nested block that fails leaves the caller's transaction open, one that succeeds commits with the caller, a refused attempt is rolled back before the retry, a duplicated key is retried once, an error without a retry kind is raised after one attempt). The tests that count crossings fail on native-preview (3 failures) and pass here. Ran with the 26.10.2.dev1 library and this checkout's Python (test_native_tx_crossings.py, test_transaction_context_interrupt.py, test_core.py, test_concurrency.py, test_run_in_transaction_retry.py: 62 passed, the JPype-only cases of the last file are skipped as before).

The P-03 guard bug found while reading is fixed in #527, which is based on native-preview and goes first. This branch is rebased onto #527's branch, so its first commit is that fix and the retry check here keeps it (the witness is read from the unwind state, the comparison and the raise sit outside the try). Merge #527 first and this PR shows only its own commit.

Repaired in this PR: tests/test_interrupt_hygiene.py patched Database.begin and Database.rollback, and run_in_transaction no longer calls either on the native Database, so the patches never applied. Two tests failed (test_a_begin_that_refuses_leaves_the_callers_transaction_alone, test_a_failing_rollback_does_not_skip_the_levels_below_it) and three interrupt tests failed with DID NOT RAISE KeyboardInterrupt, which conftest.py turns into a silent NA-JVM skip. rollback() now wraps a new _rollback_state(), as begin() wraps _begin_state(), and the tests patch the seam the active backend's run_in_transaction really calls (begin/rollback on the JPype Database, _begin_state/_rollback_state on the native one). They check what they checked before; with the unwind changed to stop at its first failing rollback, the rollback test fails. The one test with no native equivalent (an interrupt between begin and a separate commit-mark read, which the begin reply made one crossing) skips with a stated reason instead of by marker.

Local checks on this head: native (nnext library) test_interrupt_hygiene.py, test_run_in_transaction_partial_commit.py, test_native_tx_crossings.py, test_core.py, test_run_in_transaction_retry.py and test_concurrency.py: 77 passed, 10 skipped (nine JPype-only cases of the retry file, as before, and the one test above); JVM wheel wheel-main-78e97b1cff (main), the hygiene and partial-commit files: 20 passed. black, isort and the other pre-commit hooks on the touched files: clean; bandit on _native/database.py: no findings.

🤖 Generated with Claude Code

[tae898]

Closing here: the bindings moved to ArcadeData/arcadedb-python. This change has no counterpart there yet and no queued A/B. If it is wanted, it goes there as its own PR: it is now a line in the tracking issue ArcadeData/arcadedb-python#19. The branch stays.