1.0 hardening: fix @transaction early-return composition

[quinnj]

Continuation of the 1.0 readiness work from #5, on a fresh branch against merged main: independent adversarial review rounds against a live PostgreSQL, fixing what they surface, until a round comes back clean.

The problem: @transaction early-return was unsound under composition

Round 13 (the first review of #5's merged tail) found that the early-return support rewrote return x into an untagged thrown marker, so the dynamically nearest @transaction expansion always intercepted it. Verified live: nested @transaction + return silently rolled back all levels and left the connection stuck in a transaction; a user try/catch swallowed the marker and returned its own fallback value; return inside task macros threw the marker instead of producing the task's value; break/continue left the transaction open.

The evolution of the fix (rounds 14–16 + external review)

Commits 1–4 fixed this incrementally: per-expansion tokens, guards injected into user catches, and a growing skip list of closure/task-forming constructs (short-form defs, @spawnat, @fetch/@fetchfrom, comprehensions). Each round's reviewer found the next hole in the allowlist.

External review (codex) then proved the endpoint of that trajectory: no finite allowlist can cover third-party task macros (reproduced with a minimal @local_task), and — the key insight — the expansion's finally already gives plain return the intended semantics with no rewriting at all.

Final design (commit 5, net −140 lines)

The marker struct, AST walker, try-guard injection, and both skip lists are deleted. The macro is now just try/catch/finally:

• Every non-exceptional exit commits — normal completion, return, break, continue. A return unwinds through every enclosing expansion's finally, each committing its level exactly once, innermost first. Only a thrown exception rolls back.
• Plain Julia semantics everywhere: user catches cannot intercept a plain return; closures, do-blocks, comprehensions, and any task-forming macro (standard or third-party) keep their ordinary meaning untouched.
• The finally handles its own commit failure (the second P1 from external review): it rolls back the current level before propagating — commit at savepoint depth leaves the depth unchanged on failure, so each enclosing level unwinds its own. Previously a RELEASE SAVEPOINT failure during a break out of an aborted nested level escaped cleanup and left the outer transaction open with its work pending.

Verification

• Behavioral regressions for every failure mode found along the way: nested return (incl. cross-connection and 3-level), both user-catch shapes, Threads.@spawn, a third-party @local_task macro, Distributed.@spawnat/@fetch/@fetchfrom (run locally on worker 1), short-form helpers escaping the block, break/continue, recursion re-entering the same expansion, plain-vs-wrapped flattened-iterator equivalence, and the nested-break-with-aborted-savepoint commit-failure case (asserts the server error surfaces and nothing stays open client- or server-side).
• Mutation-verified: restoring the original marker behavior fails 6+ tests; removing the finally rollback fails 5.
• Suite: 1433/1433 locally (Docker integration + TLS fixture); full 18-check CI matrix green on every commit.
• All three external review threads answered on their respective conversations.

🤖 Generated with Claude Code

[quinnj]

READY/CLEAN on exact head 467596923c86b4f483d107174b8a28d4edd7f476.

Independent PostgreSQL 16 retests passed: standard and third-party task macros preserve plain return semantics and commit; a failed finally savepoint commit now unwinds every client/server transaction level and rolls back pending rows; the flattened-iterator case matches plain Julia and commits. All 15 exact-head CI jobs and both Codecov checks are green. The PR is MERGEABLE/CLEAN with no unresolved review threads.