fix(errors): keep the SQLSTATE when wrapping database errors (#2027)

isTransientFailure() checks the driver's error code first, and 57014
(statement timeout) is already in its transient set. But the wrapping idiom
across the codebase was `throw new Error(\`Database error: ${err.message}\`)`,
which keeps the prose and drops the code. A retryable timeout therefore
arrived anonymous and resolved to UNKNOWN_ERROR: "Något gick fel. Försök
igen." An agent cannot dispatch on that, so it retried.

On production over 60 days, with the two bot integrations excluded: 1024 real
agent failures, 645 of them UNKNOWN_ERROR across 60 actors and 57 companies.
82 retry streaks of three or more identical failures, 462 wasted repeat calls,
53.1% of all agent error calls sitting inside a streak.

The worst offender traces to one line in core. gnubok_query_journal failed 164
times at a p50 of 8110ms while every other failing tool sat between 1 and
315ms, and its path is fetchEntryLines -> fetchAllRows, where
lib/supabase/fetch-all.ts threw `new Error(error.message)`. That is the
highest-traffic strip point in the repo: 31 callers, every paginated read.
query_journal already had a correct TRANSIENT_ERROR branch offering "retry, or
narrow with date_from/date_to" which could never fire, because by the time it
looked, the code was gone.

fetch-all keeps the driver message verbatim: callers match on the existing
text, and this adds the code rather than rewording anything.

Attaching the code is safe. extractCode() only accepts /^[A-Z_]+$/ and every
SQLSTATE contains digits, so it cannot be mistaken for one of our own stable
codes. There is a test for that, and one asserting the old bare-Error shape
still resolves to UNKNOWN_ERROR so the fix cannot silently regress.

Also stops rendering the literal "undefined" when a driver-level failure
carries no message, which is the string that made these unsearchable.

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

lib/supabase/__tests__/fetch-all.test.ts

@@ -41,6 +41,31 @@ describe('fetchAllRows', () => {
     ).rejects.toThrow('boom')
   })
 
+  it('propagates the driver SQLSTATE so a timeout stays dispatchable', async () => {
+    // This is the highest-traffic error strip point in the codebase: every
+    // paginated read goes through it. It used to throw `new Error(msg)`, which
+    // dropped `code`, so a statement timeout (57014) reached the structured
+    // error layer anonymous and resolved to UNKNOWN_ERROR instead of the
+    // retryable TRANSIENT_ERROR. gnubok_query_journal failed this way 164
+    // times in 60 days at a p50 of 8 110 ms.
+    const failure = fetchAllRows<Row>(() =>
+      Promise.resolve({
+        data: null,
+        error: { message: 'canceling statement due to statement timeout', code: '57014' },
+      }),
+    )
+    await expect(failure).rejects.toMatchObject({ code: '57014' })
+    // And the message stays verbatim: query_journal's sanitizeDbError matches
+    // on the existing text.
+    await expect(failure).rejects.toThrow('canceling statement due to statement timeout')
+  })
+
+  it('does not render "undefined" when the driver sends no message', async () => {
+    await expect(
+      fetchAllRows<Row>(() => Promise.resolve({ data: null, error: { code: '08006' } as never })),
+    ).rejects.toThrow(/^(?!.*undefined).*$/)
+  })
+
   it('returns [] when the first page is empty', async () => {
     const out = await fetchAllRows<Row>(pagedQuery({ 0: [] }))
     expect(out).toEqual([])

lib/supabase/fetch-all.ts

@@ -1,4 +1,5 @@
 import { createLogger } from '@/lib/logger'
+import { dbError } from '@/lib/errors/db-error'
 
 const log = createLogger('fetch-all')
 
@@ -71,7 +72,19 @@ export async function fetchAllRows<T>(
 
   while (true) {
     const { data, error } = await queryFn({ from, to: from + PAGE_SIZE - 1 })
-    if (error) throw new Error(error.message)
+    // dbError, not `new Error(error.message)`: the bare form discarded the
+    // driver's SQLSTATE, and `isTransientFailure()` checks that code FIRST.
+    // A statement timeout (57014) therefore arrived as an anonymous Error and
+    // resolved to UNKNOWN_ERROR ("Något gick fel. Försök igen.") instead of
+    // the retryable TRANSIENT_ERROR. This is the single highest-traffic strip
+    // point in the codebase: every paginated read goes through it, including
+    // gnubok_query_journal, which failed 164 times in 60 days at a p50 of
+    // 8 110 ms while every other failing tool sat between 1 and 315 ms.
+    //
+    // The message is kept VERBATIM (context: null). Callers such as
+    // query_journal's sanitizeDbError already match on it, and this change is
+    // meant to add the code, not to reword anything.
+    if (error) throw dbError(error, null)
     if (!data || data.length === 0) break
     allRows.push(...data)
     pages += 1