Review findings on the cancellation-shield fix:
- Bound _run_to_completion with _CLEANUP_TIMEOUT_SECONDS. Shielded cleanup is
uninterruptible by design, so a wedged connection (dead socket, no libpq
timeout) would otherwise pin the task forever; past the bound we abandon
cleanup rather than hang. Switched the wait to asyncio.wait (shields fut,
supports a timeout) and guarded fut.exception()/fut.cancelled() so loop
shutdown can't raise from the tail.
- tracked_db: reset request_context in its own finally so a cancelled cleanup
path can't leak the task-scoped contextvar into a reused long-lived task
(deriver).
- Tests: reset-context-on-cancellation, abandon-wedged-cleanup, and a real-DB
wire cancellation test asserting no `idle in transaction` backend lingers
after a cancelled in-flight write transaction (pg_stat_activity).
Full suite: 21 passed live (incl. 4 pre-existing + 4 new real-DB tests).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
76dc6c3c79