Mirror in-lock messages clear in sync commit/rollback async bodies

The async commit() / rollback() pair clears Connection.messages
twice: once pre-lock to honour PEP 249 §6.1.1 on the closed-raise
and never-connected fast paths, and once inside the op_lock so a
sibling task that appends to messages between the pre-lock clear
and the COMMIT round-trip is wiped before the wire call. The sync
counterparts only had the pre-lock clear; the same sibling-thread
window was undefended.

Add a second del self.messages[:] inside _commit_async and
_rollback_async (which run under _op_lock via _run_sync) and pin
both branches with direct asyncio.run tests of the inner
coroutines, including the exception-from-execute path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: antoineleclair

src/dqlitedbapi/connection.py

@@ -814,6 +814,14 @@ async def _commit_async(self) -> None:
         """Async implementation of commit."""
         if self._async_conn is None:
             raise InterfaceError("Connection is closed")
+        # Clear ``messages`` under the lock so the PEP 249 contract
+        # "messages cleared by every method call" is atomic with the
+        # operation. ``_run_sync`` holds ``_op_lock`` across this
+        # coroutine; the pre-lock clear in ``commit()`` leaves a
+        # window where a sibling thread could write directly to
+        # ``messages`` between that clear and the lock acquire.
+        # Mirror the async sibling's defense-in-depth shape.
+        del self.messages[:]
         try:
             # Route through ``_call_client`` so client-layer errors
             # (including ``DqliteConnectionError`` for an externally
@@ -849,6 +857,9 @@ async def _rollback_async(self) -> None:
         """Async implementation of rollback."""
         if self._async_conn is None:
             raise InterfaceError("Connection is closed")
+        # In-lock messages clear; see ``_commit_async`` for the
+        # rationale.
+        del self.messages[:]
         try:
             # See ``_commit_async``: route through ``_call_client`` so
             # client-layer failures surface as PEP 249 ``Error``

tests/test_sync_commit_rollback_messages_under_lock.py

@@ -0,0 +1,78 @@
+"""Pin: sync ``Connection.commit`` / ``rollback`` clear ``messages``
+both pre-lock AND inside ``_op_lock`` (mirroring the async sibling).
+
+PEP 249 §6.1.1 says ``Connection.messages`` is cleared by every
+method call on the connection. Clearing only pre-lock leaves a
+window where a sibling thread can append directly to
+``conn.messages`` between the pre-lock clear and the COMMIT round-
+trip; the in-lock clear in ``_commit_async`` / ``_rollback_async``
+(which run on the loop thread inside ``_run_sync``'s ``_op_lock``
+critical section) defends that window and matches the
+already-hardened async surface.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import contextlib
+from unittest.mock import AsyncMock, MagicMock
+
+from dqlitedbapi.connection import Connection
+
+
+def _build_conn_with_mocked_async() -> Connection:
+    """Build a Connection with no real socket: bypass ``__init__`` and
+    wire only the fields ``_commit_async`` / ``_rollback_async`` touch.
+    """
+    conn = Connection.__new__(Connection)
+    conn.messages = []
+    fake = MagicMock()
+    fake.execute = AsyncMock(return_value=(0, 0))
+    fake.in_transaction = True
+    conn._async_conn = fake
+    return conn
+
+
+class TestCommitAsyncClearsMessagesInLock:
+    def test_commit_async_clears_messages(self) -> None:
+        conn = _build_conn_with_mocked_async()
+        conn.messages.append((RuntimeError, "synthetic"))
+        asyncio.run(conn._commit_async())
+        assert conn.messages == []
+
+    def test_commit_async_clears_messages_before_execute(self) -> None:
+        """The clear runs before ``execute("COMMIT")`` so even an
+        exception from the wire round-trip leaves ``messages`` empty
+        — consistent with PEP 249 "cleared prior to executing the
+        call"."""
+        conn = _build_conn_with_mocked_async()
+        conn.messages.append((RuntimeError, "stale"))
+        # Make the COMMIT raise; messages should still be cleared.
+        from dqlitedbapi import OperationalError
+
+        conn._async_conn.execute = AsyncMock(  # type: ignore[union-attr]
+            side_effect=OperationalError("boom")
+        )
+        with contextlib.suppress(OperationalError):
+            asyncio.run(conn._commit_async())
+        assert conn.messages == []
+
+
+class TestRollbackAsyncClearsMessagesInLock:
+    def test_rollback_async_clears_messages(self) -> None:
+        conn = _build_conn_with_mocked_async()
+        conn.messages.append((RuntimeError, "synthetic"))
+        asyncio.run(conn._rollback_async())
+        assert conn.messages == []
+
+    def test_rollback_async_clears_messages_before_execute(self) -> None:
+        conn = _build_conn_with_mocked_async()
+        conn.messages.append((RuntimeError, "stale"))
+        from dqlitedbapi import OperationalError
+
+        conn._async_conn.execute = AsyncMock(  # type: ignore[union-attr]
+            side_effect=OperationalError("boom")
+        )
+        with contextlib.suppress(OperationalError):
+            asyncio.run(conn._rollback_async())
+        assert conn.messages == []