Bind an AI metadata commit to its outer transaction scope

Ask which boundary owns the metadata outcome

A fictional AI application changes one internal marker M-A for an already admitted artifact revision. Its helper returns from a transaction context without an exception. A caller immediately labels the marker committed, overlooking an ordinary read performed earlier on the same connection.

The missing evidence is context ownership: did the helper control the whole transaction, or a smaller scope inside one already open? This worksheet uses a directly owned synchronous Psycopg connection with the selected non-autocommit profile, fixed trusted database-local operations and no concurrent borrower.

It supplies no SQL, connection setup or executable helper. Pools, asynchronous drivers, pipeline mode, manual transaction statements, two-phase commit and connection context managers are outside the selected profile. The last exclusion matters: an ordinary connection close and a successful connection-context exit are different paths.

Keep an earlier read in the operation inventory

The Psycopg guide identifies 3.3.7.dev1 development documentation. Ordinary operations, including SELECT, implicitly start a transaction. Plain close does not commit pending changes; its example discards them.

Therefore the review begins before the helper’s opening line. Record every relevant operation on the exclusively owned connection and the established transaction state at context entry. A harmless-looking earlier read cannot be omitted merely because it changed no business row.

Actual connection state and driver behavior are unknown here. A caller saying “we have not written anything yet” is not independent evidence that no transaction exists. If a wrapper, middleware path or another job can have used the connection, hold the scope claim instead of reconstructing a convenient history.

Distinguish the outer context from its nested counterpart

The transaction-context section distinguishes idle entry, which owns a transaction, from entry during an implicit transaction, which manages only a savepoint. Normal inner exit leaves the main transaction pending.

These documented alternatives are not interchangeable success labels. Our application record names the connection, main transaction owner and context scope separately. It must preserve which scope completed, rather than promote every normal helper return into an outer-commit result.

Connection-context behavior is different and excluded; do not silently substitute it for this plain-close plan.

Compare two symbolic timelines on paper

These are declared schedules and associations, not constructed statements, schema or database observations. P-B does not become P-A because the helper has the same function name or runs the same intended write. The earlier read changes what that context owns.

The conditional positive is deliberately P-A: every receipt field holds, the fixed change belongs to the established outer scope, and supported actual outer completion is recorded. Only that database-local change may then be described as committed. No model request, message, file publication or external effect is included.

Retain the main owner and completion evidence together

Actual adapter wiring, transaction state, operation inventory, supported completion evidence and current rights are unimplemented or unknown. Any missing field blocks a real positive. A local “helper finished” log cannot fill the main owner’s outcome row.

If outer completion is missing or ambiguous, preserve that uncertainty. This guide supplies no automatic replay, exception-suppression loop or manual repair sequence. A second attempt can be a different business operation; the worksheet authorizes none.

Assign the responsible owner before handing work to the helper. A dashboard should retain that owner reference and phase, without merging several components’ completion labels into an unexplained green status.

Walk eight inert scope decisions

Preserve existing database contracts and evidence limits

The read-view guide still owns visibility, while the advisory-lock guide owns a different coordination profile. This worksheet proves neither crash persistence nor atomicity with external actions.

No Psycopg import, connection, SQL, statement, marker, schema, transaction, savepoint, database, runtime fixture, API or model operation was constructed or executed. Ordinary editorial file handling is separate. Boundary is prelaunch with planned request-path checks; its existing synthetic policy evidence does not implement this transaction coordinator.