[bpamiri]

Summary

Third follow-up for PRs merged into 4.2. All changes are in v4-2-0/upgrading/4x-1-to-4x-2.mdx and two fragments.

• withAdvisoryLock(transaction = true) inside an open transaction (feat(model): opt-in transaction-scoped advisory locks for withAdvisoryLock #4222). The guide's advisory-lock entry, the only page that documents withAdvisoryLock, now says what happens:

  • MySQL and SQL Server: it throws Wheels.AdvisoryLockNotSupported, because their session lock would release before the outer transaction commits. The guide says to take the lock outside the transaction.
  • PostgreSQL: it joins the open transaction and holds the lock until that transaction ends.

  Verified on develop 6dbb62a: locking.cfm $runWithAdvisoryLockTransactional() throws when $transactionIsOpen() and $transactionalAdvisoryLockIsSessionScoped() are both true. Only the MySQL and SQL Server adapters return true for the latter. PostgreSQL inherits false from Base.cfc and takes the join path. CockroachDB and others don't support transaction = true at all, which the entry already says.

• isSafeRedirectUrl entry (from the review of docs(web/guides): isSafeRedirectUrl reserved-name line; retype the migration-lock fragment #4320). It now has the clause the renderNotFound entry has: a controller's own isSafeRedirectUrl helper overrides the framework one. Integration never overwrites a name the controller already has (Controller.cfc: StructAppend(…, adds, false)).

• Final periods on the 4189-singularize-databases (fix: singularize databases to database instead of databasis #4191) and tx-advisory-locks (feat(model): opt-in transaction-scoped advisory locks for withAdvisoryLock #4222) fragments.

Fragment types for the merges since #4320 are correct, and none needs a further guide line:

PR	type	why no line
#4192	performance	output byte-identical
#4280	fixed	docs and log wording only
#4191	changed	guide line added by the PR
#4222	added	opt-in; the guide entry was updated by the PR

tools/changelog-promote.sh --preview renders.

🤖 Generated with Claude Code

[bpamiri]

Review @ d5a7c95: APPROVE (docs and changelog only)

1. withAdvisoryLock addition. It matches $runWithAdvisoryLockTransactional() on develop.
   • When a transaction is already open and $transactionalAdvisoryLockIsSessionScoped() is true (MySQL and SQL Server), it throws Wheels.AdvisoryLockNotSupported. The extendedInfo gives the same reason the guide does: the session lock would be released before the outer transaction commits.
   • PostgreSQL goes to $runAdvisoryLockInOpenTransaction() and holds pg_advisory_xact_lock until the outer transaction ends.
   • The matrix confirms both on every engine: "throws for a session-scoped adapter inside an existing transaction" passes on MySQL and SQL Server, and "holds a PostgreSQL transaction-scoped lock until the outer transaction ends" passes on PostgreSQL.
2. isSafeRedirectUrl override clause. It's correct.
   • Framework mixins are added without overwriting an existing method, on both the loop path and the cached-integration path, so a controller's own isSafeRedirectUrl wins.
   • redirectTo() calls the internal $isSafeRedirectUrl(), so an override doesn't change redirect checking.
   • This mirrors the renderNotFound entry, as I suggested.
3. Fragments. The final periods are fine.
   • INFO, cosmetic: tx-advisory-locks now ends …(the existing behaviour). ([#4198](…))., so the link sits after a finished sentence. The other fragments end … (#NNNN).. Writing … behaviour) ([#4198](…)). or plain (#4198). would match.

Noted that draft #4322 is for the cut and shouldn't be merged.

No findings.