fix: do not run the statement when the restart BEGIN fails

With mysqli exception reporting off, begin_transaction() returns false
instead of throwing. The restart flag was then cleared and the statement
ran without a transaction. execute() now returns false and keeps the
restart pending.

The guide now says the rollback happens when the outermost transaction
finishes, and that a nested transCommit() still returns true. Drop the
issue link from the changelog entry to match the changelog style.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: KevinBlakeLopez

system/Database/MySQLi/Connection.php

@@ -297,7 +297,13 @@ protected function execute(string $sql)
             // Errno 1205 is not handled: innodb_rollback_on_timeout decides
             // whether InnoDB rolled that transaction back.
             if ($this->connID instanceof mysqli && $this->serverTransactionRestartPending()) {
-                $this->connID->begin_transaction();
+                // With mysqli exception reporting off, a failed BEGIN returns
+                // false instead of throwing. Do not run the statement without
+                // the transaction.
+                if (! $this->connID->begin_transaction()) {
+                    return false;
+                }
+
                 $this->serverTransactionRestarted();
             }
 

tests/system/Database/Live/MySQLi/DeadlockTransactionTest.php

@@ -18,6 +18,7 @@
 use CodeIgniter\Test\DatabaseTestTrait;
 use Config\Database;
 use mysqli;
+use mysqli_driver;
 use PHPUnit\Framework\Attributes\Group;
 use Throwable;
 
@@ -115,6 +116,32 @@ public function testLostConnectionAfterDeadlockDoesNotEscapeAsDriverException():
         );
     }
 
+    public function testRestartThatCannotBeginDoesNotRunTheStatement(): void
+    {
+        $table            = $this->db->escapeIdentifier($this->db->prefixTable('deadlock_probe'));
+        $this->probeTable = $table;
+        $this->forceDeadlock($table);
+
+        // An active XA transaction makes MySQL refuse START TRANSACTION on a live
+        // connection. With mysqli exception reporting off, begin_transaction()
+        // then returns false instead of throwing.
+        $mysqli   = $this->db->getConnection();
+        $previous = (new mysqli_driver())->report_mode;
+        $mysqli->query("XA START 'deadlock_probe'");
+        mysqli_report(MYSQLI_REPORT_OFF);
+
+        try {
+            $insert   = $this->db->query('INSERT INTO ' . $table . " (id, note) VALUES (102, 'after')");
+            $inserted = (int) $mysqli->query('SELECT COUNT(*) FROM ' . $table . ' WHERE id = 102')->fetch_row()[0];
+        } finally {
+            $mysqli->query("XA END 'deadlock_probe'");
+            $mysqli->query("XA ROLLBACK 'deadlock_probe'");
+            mysqli_report($previous);
+        }
+
+        $this->assertSame(['insert' => false, 'inserted' => 0], ['insert' => $insert, 'inserted' => $inserted]);
+    }
+
     private function killConnection(BaseConnection $db): void
     {
         $threadId = $db->getConnection()->thread_id;

user_guide_src/source/changelogs/v4.7.6.rst

@@ -39,7 +39,7 @@ Bugs Fixed
 - **CLI:** Fixed a bug where a prompt asked again forever when its input was piped or redirected and ran out before a valid answer: ``CLI::prompt()`` and ``CLI::promptByKey()`` whose default fails the validation rules, and ``CLI::promptByMultipleKeys()`` whose options have string keys. They now throw a ``CLIException``. The new ``InputOutput::isAtEnd()`` tells that end of the input from an empty line. Pressing Ctrl+D at a terminal still asks again.
 - **Commands:** Fixed a bug where generator commands did not sort the imports of a template with CRLF line endings.
 - **Database:** Fixed ``reconnect()`` so a replaced socket does not keep the transaction that died with the old connection. ``transDepth`` is cleared and the transaction status is failed before the new connection is opened, so a failed reconnect cannot still report success. OCI8 commit mode returns to autocommit. ``transComplete()`` does not report success. This applies when ``ping()`` reports the connection lost; PostgreSQL's ``pg_ping()`` reconnects a broken connection itself, so it is not covered.
-- **Database:** Fixed MySQLi errno 1213 (``ER_LOCK_DEADLOCK``) so a following write through ``query()``, ``simpleQuery()`` or the Query Builder on the victim connection does not autocommit, and ``transCommit()`` rolls back and returns false after InnoDB has rolled the victim transaction back. Prepared queries and errno 1205 are unchanged. See `#10649 <https://github.com/codeigniter4/CodeIgniter4/issues/10649>`_.
+- **Database:** Fixed MySQLi errno 1213 (``ER_LOCK_DEADLOCK``) so a following write through ``query()``, ``simpleQuery()`` or the Query Builder on the victim connection does not autocommit, and ``transCommit()`` rolls back and returns false after InnoDB has rolled the victim transaction back. Prepared queries and errno 1205 are unchanged.
 - **Format:** Fixed ``XMLFormatter`` so that an array key that becomes empty after sanitization no longer triggers a ``ValueError``; the fallback tag name ``item`` is used instead. Values that cannot be converted to a string, such as objects not implementing ``Stringable``, now throw a ``FormatException`` instead of a fatal ``Error``.
 - **Helpers:** Fixed a regression in v4.7.5 where ``set_value()`` threw a ``TypeError`` when the default value was not a string or an array, such as an integer, a float, ``null``, or a ``Stringable`` object. Such values are now converted to a string.
 - **HTTP:** Fixed a bug in ``ContentSecurityPolicy`` where a numeric source such as ``'0'`` threw a ``TypeError``, and a space-separated directive string in ``Config\\ContentSecurityPolicy`` was emitted as one unquoted source.

user_guide_src/source/database/transactions.rst

@@ -151,9 +151,11 @@ MySQL Deadlocks
 InnoDB error 1213 rolls the victim transaction back. CodeIgniter keeps that
 transaction open. The next statement run through ``query()``, ``simpleQuery()``
 or the Query Builder on the same connection starts a new server transaction,
-so the write does not autocommit. ``transCommit()`` rolls that server
-transaction back and returns false, so the transaction has ended when it
-returns. ``transComplete()`` also rolls it back.
+so the write does not autocommit. The rollback happens when the outermost
+transaction finishes: ``transCommit()`` rolls that server transaction back and
+returns false, so the transaction has ended when it returns, and
+``transComplete()`` also rolls it back. At a nested depth, ``transCommit()``
+still returns true and only decrements the depth.
 
 Prepared queries are not covered. A deadlock raised by a prepared query is not
 detected, and a prepared query run after a deadlock does not start a new server