fix(api): bound audit writes and lock waits during PostgreSQL stalls #873

Production readiness audit of Gameplane v0.4.0, commit 07bee47b. Tracking issue and PR merge order: #867.

Finding

Audit inserts serialize behind a process-local lock while executing a transaction. Detached request contexts can outlive HTTP deadlines and leave later mutations waiting behind the same blocked operation.

Work

Give insert and prune bounded, cancellable admission and transaction budgets. Bound in-flight/queued work and the connection pool. Define the caller-visible policy for required audit writes and instrument timeout, rejection and persistence failure without logging secrets.

Acceptance criteria

Blackhole the DB and issue concurrent mutations past their HTTP deadlines. Verify goroutines, waiters and connections stay bounded, failures are observable, and restoration drains the backlog according to policy. Check hash-chain and prune invariants before and after recovery.

PR ownership and prior work

Own the audit-store acquisition/transaction path and failure fixtures. H07 adds cross-process serialization on that path and reuses its fault injection. Audit-drop logging from #16 is distinct from bounding stalled DB work.

Audit lock · Middleware · PostgreSQL pool

Qualification evidence

PR #888 passed on f9a130db. The real PostgreSQL lane exercised stalled database sockets and audit recovery, alongside passing API checks on amd64 and arm64. PostgreSQL integration · API amd64 · API arm64