questdb 0.1.0 → 0.1.1

data/vendor/c-questdb-client/questdb-rs/src/ingress/sender.rs

@@ -44,7 +44,7 @@ use crate::ingress::SenderBuilder;
 use crate::ingress::{Buffer, Protocol, ProtocolVersion};
 use std::fmt::{Debug, Formatter};
 #[cfg(feature = "sync-sender-qwp-ws")]
-use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::atomic::Ordering;
 #[cfg(feature = "sync-sender-qwp-ws")]
 use std::time::{Duration, Instant};
 
@@ -134,13 +134,44 @@ mod http;
 #[cfg(feature = "sync-sender-http")]
 pub(crate) use http::*;
 
+/// The binding per-frame cap of a store-and-forward QWP/WebSocket publication:
+/// the configured `max_buf_size`, clamped to the server's advertised
+/// `X-QWP-Max-Batch-Size` (0 = not advertised) and to the queue's segment
+/// payload capacity, which rejects any larger frame. Also reports whether the
+/// server advertised a cap, whether or not it is the binding one.
 #[cfg(feature = "sync-sender-qwp-ws")]
-fn effective_qwp_ws_max_buf_size(configured: usize, server_max: &AtomicUsize) -> usize {
-    let server = server_max.load(Ordering::Relaxed);
-    if server > 0 {
-        configured.min(server)
+pub(crate) fn effective_hard_frame_cap(
+    max_buf_size: usize,
+    server_max_batch_size: usize,
+    sfa_frame_payload_cap: usize,
+) -> (usize, bool) {
+    let configured_cap = if server_max_batch_size == 0 {
+        max_buf_size
+    } else {
+        max_buf_size.min(server_max_batch_size)
+    };
+    (
+        configured_cap.min(sfa_frame_payload_cap),
+        server_max_batch_size != 0,
+    )
+}
+
+/// Name the limit that [`effective_hard_frame_cap`] returns, so a size error
+/// points at the setting that actually binds.
+#[cfg(feature = "sync-sender-qwp-ws")]
+fn effective_hard_frame_cap_source(
+    max_buf_size: usize,
+    server_max_batch_size: usize,
+    sfa_frame_payload_cap: usize,
+) -> &'static str {
+    let (cap, _) =
+        effective_hard_frame_cap(max_buf_size, server_max_batch_size, sfa_frame_payload_cap);
+    if server_max_batch_size != 0 && cap == server_max_batch_size {
+        "the server's advertised X-QWP-Max-Batch-Size"
+    } else if cap == max_buf_size {
+        "max_buf_size"
     } else {
-        configured
+        "the sf_max_segment_bytes segment payload capacity"
     }
 }
 
@@ -367,17 +398,14 @@ impl Sender {
             ));
         }
 
+        let (server_max, sfa_frame_payload_cap) = self
+            .qwp_ws_frame_cap_inputs()
+            .expect("QWP/WebSocket handler was checked above");
+        let (max, _) =
+            effective_hard_frame_cap(self.max_buf_size, server_max, sfa_frame_payload_cap);
         let result = match &mut self.handler {
-            SyncProtocolHandler::SyncQwpWs(state) => {
-                let max =
-                    effective_qwp_ws_max_buf_size(self.max_buf_size, &state.server_max_batch_size);
-                flush_qwp_ws(state, qwp, max)
-            }
-            SyncProtocolHandler::ManualQwpWs(state) => {
-                let max =
-                    effective_qwp_ws_max_buf_size(self.max_buf_size, &state.server_max_batch_size);
-                flush_qwp_ws_manual(state, qwp, max)
-            }
+            SyncProtocolHandler::SyncQwpWs(state) => flush_qwp_ws(state, qwp, max),
+            SyncProtocolHandler::ManualQwpWs(state) => flush_qwp_ws_manual(state, qwp, max),
             _ => unreachable!("QWP/WebSocket handler was checked above"),
         };
         if result
@@ -386,7 +414,38 @@ impl Sender {
         {
             self.connected = false;
         }
-        result
+        result.map_err(|err| {
+            if err.code() == crate::ErrorCode::BatchTooLarge {
+                let source = effective_hard_frame_cap_source(
+                    self.max_buf_size,
+                    server_max,
+                    sfa_frame_payload_cap,
+                );
+                crate::Error::new(
+                    crate::ErrorCode::BatchTooLarge,
+                    format!("{} The cap is set by {}.", err.msg(), source),
+                )
+            } else {
+                err
+            }
+        })
+    }
+
+    /// The server's advertised cap (0 = not advertised) and the queue's segment
+    /// payload capacity, or `None` for a sender that is not QWP/WebSocket.
+    #[cfg(feature = "sync-sender-qwp-ws")]
+    fn qwp_ws_frame_cap_inputs(&self) -> Option<(usize, usize)> {
+        match &self.handler {
+            SyncProtocolHandler::SyncQwpWs(state) => Some((
+                state.server_max_batch_size.load(Ordering::Acquire),
+                state.sfa_frame_payload_cap,
+            )),
+            SyncProtocolHandler::ManualQwpWs(state) => Some((
+                state.server_max_batch_size.load(Ordering::Acquire),
+                state.sfa_frame_payload_cap,
+            )),
+            _ => None,
+        }
     }
 
     #[allow(unused_variables)]
@@ -633,6 +692,31 @@ impl Sender {
         self.flush_qwp_ws_buffer(buf, false)
     }
 
+    /// Return the binding per-frame cap of this QWP/WebSocket sender and whether
+    /// the current connection advertised `X-QWP-Max-Batch-Size`, whether or not
+    /// that value is the binding limit.
+    ///
+    /// The cap is the smallest of `max_buf_size`, the server's advertised cap
+    /// and the store-and-forward segment payload capacity. A flush whose
+    /// encoded frame exceeds it fails with
+    /// [`ErrorCode::BatchTooLarge`](crate::ErrorCode::BatchTooLarge) and
+    /// publishes nothing. The value can change after a reconnect.
+    #[cfg(feature = "sync-sender-qwp-ws")]
+    pub fn effective_frame_cap(&self) -> Result<(usize, bool)> {
+        let (server_max, sfa_frame_payload_cap) =
+            self.qwp_ws_frame_cap_inputs().ok_or_else(|| {
+                error::fmt!(
+                    InvalidApiCall,
+                    "effective_frame_cap is only supported for QWP/WebSocket senders."
+                )
+            })?;
+        Ok(effective_hard_frame_cap(
+            self.max_buf_size,
+            server_max,
+            sfa_frame_payload_cap,
+        ))
+    }
+
     /// Return the highest frame sequence number published locally by this
     /// QWP/WebSocket sender, or `None` if no frame has been published.
     ///

data/vendor/c-questdb-client/questdb-rs/src/ingress/tests.rs

@@ -363,6 +363,8 @@ const EGRESS_ONLY_CONFIG_KEYS: &[&str] = &[
     "failover_backoff_initial_ms",
     "failover_backoff_max_ms",
     "failover_max_duration_ms",
+    // Egress-only per-query timeout default
+    "query_timeout_ms",
     // Java-egress-only decoded-batch pool size (Rust egress is sync/pull,
     // see comment in `egress/config.rs`); still ignored on ingress
     // because that's an egress-side concern either way.
@@ -429,6 +431,36 @@ fn ingress_accepts_full_egress_connect_string_unchanged() {
     assert_specified_eq(&builder.password, Some("p".to_string()));
 }
 
+#[cfg(all(feature = "sync-sender-http", feature = "sync-sender-qwp-ws"))]
+#[test]
+fn qwpws_config_knows_every_egress_only_key() {
+    // `ingress_silently_accepts_every_egress_only_key` only covers
+    // `http::`, where the parser's catch-all ignores anything it does not
+    // recognise. On `ws::` the parser REJECTS unknown keys, so an
+    // egress-only key missing from `QWP_WS_PORTABLE_CONFIG_KEYS` breaks
+    // every connect string shared between a sender and a reader — which is
+    // the normal shape for `questdb.connect()`, where one string configures
+    // both pools.
+    //
+    // The assertion is on the failure MODE, not on success: a key may still
+    // be rejected for its value (`compression=1` is not a valid codec), and
+    // that is fine. What must never happen is "Unknown config key".
+    for key in EGRESS_ONLY_CONFIG_KEYS {
+        for val in ["1", "primary", "halt", ""] {
+            let conf = format!("ws::addr=localhost:9000;{key}={val};");
+            if let Err(e) = SenderBuilder::from_conf(&conf) {
+                assert!(
+                    !e.msg().contains("Unknown config key"),
+                    "egress-only key {key:?} is missing from \
+                     QWP_WS_PORTABLE_CONFIG_KEYS, so a shared ws:: connect \
+                     string carrying it fails to parse: {}",
+                    e.msg()
+                );
+            }
+        }
+    }
+}
+
 #[cfg(feature = "sync-sender-qwp-ws")]
 #[test]
 fn qwpws_config_silently_accepts_reserved_on_error_policy_keys() {

data/vendor/c-questdb-client/questdb-rs/src/ingress.rs

@@ -602,8 +602,8 @@ impl QwpWsConnector {
         )?;
         // The per-frame cap is the negotiated one: the configured
         // max_buf_size clamped to the server's advertised
-        // X-QWP-Max-Batch-Size (0 = not advertised), matching the row
-        // sender's effective_qwp_ws_max_buf_size.
+        // X-QWP-Max-Batch-Size (0 = not advertised). A direct connection
+        // has no store-and-forward queue, so no segment cap applies.
         let max_buf_size = if connected.server_max_batch_size > 0 {
             self.max_buf_size.min(connected.server_max_batch_size)
         } else {
@@ -1128,6 +1128,7 @@ impl SenderBuilder {
             "pool_reap",
             "query_pool_max",
             "query_pool_min",
+            "query_timeout_ms",
             "sender_pool_max",
             "sender_pool_min",
             "target",

data/vendor/c-questdb-client/questdb-rs/src/tests/qwp_ws.rs

@@ -2078,14 +2078,14 @@ fn qwp_ws_max_buf_size_rejects_oversized_replay_frame_in_all_progress_modes() {
         let err = sender.flush(&mut buf).unwrap_err();
         assert_eq!(
             err.code(),
-            crate::ErrorCode::InvalidApiCall,
+            crate::ErrorCode::BatchTooLarge,
             "mode={}",
             progress.name()
         );
         assert_eq!(
             err.msg(),
             format!(
-                "Could not flush buffer: QWP/WebSocket encoded message size of {encoded_len} exceeds maximum configured allowed size of {max} bytes."
+                "Could not flush buffer: QWP/WebSocket encoded message size of {encoded_len} bytes exceeds the per-frame cap of {max} bytes. The cap is set by max_buf_size."
             ),
             "mode={}",
             progress.name()
@@ -5144,10 +5144,9 @@ fn qwp_ws_rewind_after_a_failed_publication_republishes_only_surviving_rows() {
     let bookmark = buf.bookmark().unwrap();
     write_doomed_rows(&mut buf);
     let err = sender.flush_and_keep(&buf).unwrap_err();
-    assert_eq!(err.code(), ErrorCode::InvalidApiCall, "{err}");
+    assert_eq!(err.code(), ErrorCode::BatchTooLarge, "{err}");
     assert!(
-        err.msg()
-            .contains("exceeds maximum configured allowed size"),
+        err.msg().contains("exceeds the per-frame cap"),
         "the doomed flush must fail on the size cap, not another guard: {err}"
     );
 
@@ -7775,13 +7774,15 @@ fn server_max_batch_size_clamps_flush_below_configured_max_in_all_progress_modes
         let err = sender.flush(&mut buf).unwrap_err();
         assert_eq!(
             err.code(),
-            crate::ErrorCode::InvalidApiCall,
+            crate::ErrorCode::BatchTooLarge,
             "mode={}",
             progress.name()
         );
         assert!(
-            err.msg()
-                .contains("exceeds maximum configured allowed size"),
+            err.msg().contains(
+                "exceeds the per-frame cap of 512 bytes. \
+                 The cap is set by the server's advertised X-QWP-Max-Batch-Size."
+            ),
             "mode={}: got: {}",
             progress.name(),
             err.msg()
@@ -7795,6 +7796,76 @@ fn server_max_batch_size_clamps_flush_below_configured_max_in_all_progress_modes
     }
 }
 
+#[test]
+fn segment_payload_capacity_clamps_flush_below_server_cap_in_all_progress_modes() {
+    for progress in [ProgressCase::Background, ProgressCase::Manual] {
+        let server_cap: usize = 100 * 1024;
+        let port = spawn_max_batch_size_upgrade_only_server(Some(server_cap));
+        let conf = format!(
+            "ws::addr=127.0.0.1:{port};qwp_ws_progress={};sf_max_segment_bytes=4096;",
+            progress.name()
+        );
+        let mut sender = SenderBuilder::from_conf(conf).unwrap().build().unwrap();
+
+        let (cap, server_cap_known) = sender.effective_frame_cap().unwrap();
+        assert!(server_cap_known, "mode={}", progress.name());
+        assert!(
+            cap < 4096,
+            "mode={}: the segment payload capacity must bind, got {cap}",
+            progress.name()
+        );
+
+        let mut buf = build_buffer_with_payload_bytes(cap + 200);
+        let err = sender.flush(&mut buf).unwrap_err();
+        assert_eq!(
+            err.code(),
+            crate::ErrorCode::BatchTooLarge,
+            "mode={}",
+            progress.name()
+        );
+        assert!(
+            err.msg().contains(&format!(
+                "exceeds the per-frame cap of {cap} bytes. \
+                 The cap is set by the sf_max_segment_bytes segment payload capacity."
+            )),
+            "mode={}: got: {}",
+            progress.name(),
+            err.msg()
+        );
+        assert!(!buf.is_empty(), "mode={}", progress.name());
+    }
+}
+
+#[test]
+fn effective_frame_cap_reports_the_binding_limit_in_all_progress_modes() {
+    for progress in [ProgressCase::Background, ProgressCase::Manual] {
+        let server_cap: usize = 512;
+        let port = spawn_max_batch_size_upgrade_only_server(Some(server_cap));
+        let builder = SenderBuilder::new(Protocol::Ws, "127.0.0.1", port)
+            .max_buf_size(100 * 1024 * 1024)
+            .unwrap();
+        let sender = build_qwp_ws_sender_from_builder(progress, builder);
+        assert_eq!(
+            sender.effective_frame_cap().unwrap(),
+            (server_cap, true),
+            "mode={}",
+            progress.name()
+        );
+
+        let port = spawn_max_batch_size_upgrade_only_server(None);
+        let builder = SenderBuilder::new(Protocol::Ws, "127.0.0.1", port)
+            .max_buf_size(2048)
+            .unwrap();
+        let sender = build_qwp_ws_sender_from_builder(progress, builder);
+        assert_eq!(
+            sender.effective_frame_cap().unwrap(),
+            (2048, false),
+            "mode={}",
+            progress.name()
+        );
+    }
+}
+
 #[test]
 fn server_max_batch_size_allows_flush_when_encoded_fits_in_all_progress_modes() {
     for progress in [ProgressCase::Background, ProgressCase::Manual] {
@@ -7849,12 +7920,15 @@ fn absent_server_max_batch_size_falls_back_to_configured_max_in_all_progress_mod
         let err = sender.flush(&mut buf).unwrap_err();
         assert_eq!(
             err.code(),
-            crate::ErrorCode::InvalidApiCall,
+            crate::ErrorCode::BatchTooLarge,
             "mode={}",
             progress.name()
         );
         assert!(
-            err.msg().contains(&configured_max.to_string()),
+            err.msg().contains(&format!(
+                "exceeds the per-frame cap of {configured_max} bytes. \
+                 The cap is set by max_buf_size."
+            )),
             "mode={}: error should reference configured max {configured_max}, got: {}",
             progress.name(),
             err.msg()
@@ -7889,12 +7963,15 @@ fn configured_max_wins_when_smaller_than_server_cap_in_all_progress_modes() {
         let err = sender.flush(&mut buf).unwrap_err();
         assert_eq!(
             err.code(),
-            crate::ErrorCode::InvalidApiCall,
+            crate::ErrorCode::BatchTooLarge,
             "mode={}",
             progress.name()
         );
         assert!(
-            err.msg().contains(&configured_max.to_string()),
+            err.msg().contains(&format!(
+                "exceeds the per-frame cap of {configured_max} bytes. \
+                 The cap is set by max_buf_size."
+            )),
             "mode={}: error should reference configured max {configured_max}, got: {}",
             progress.name(),
             err.msg()
@@ -7936,8 +8013,8 @@ fn server_cap_prevents_message_too_big_by_rejecting_locally_in_all_progress_mode
         let err = sender.flush(&mut big_buf).unwrap_err();
         assert_eq!(
             err.code(),
-            crate::ErrorCode::InvalidApiCall,
-            "mode={}: must get local InvalidApiCall, not a server error",
+            crate::ErrorCode::BatchTooLarge,
+            "mode={}: must get local BatchTooLarge, not a server error",
             progress.name()
         );
     }
@@ -7999,12 +8076,15 @@ fn server_cap_one_byte_below_encoded_len_rejects_flush_in_all_progress_modes() {
         let err = sender.flush(&mut buf).unwrap_err();
         assert_eq!(
             err.code(),
-            crate::ErrorCode::InvalidApiCall,
+            crate::ErrorCode::BatchTooLarge,
             "mode={}",
             progress.name()
         );
         assert!(
-            err.msg().contains(&server_cap.to_string()),
+            err.msg().contains(&format!(
+                "exceeds the per-frame cap of {server_cap} bytes. \
+                 The cap is set by the server's advertised X-QWP-Max-Batch-Size."
+            )),
             "mode={}: error should reference server cap {server_cap}, got: {}",
             progress.name(),
             err.msg()

data/vendor/c-questdb-client/questdb-rs/tests/egress_failover.rs

@@ -80,6 +80,15 @@ fn encode_varint_u64(mut v: u64, out: &mut Vec<u8>) {
 }
 
 fn server_info_frame(role: ServerRole, node_id: &str, cluster_id: &str) -> Vec<u8> {
+    server_info_frame_with_caps(role, node_id, cluster_id, 0)
+}
+
+fn server_info_frame_with_caps(
+    role: ServerRole,
+    node_id: &str,
+    cluster_id: &str,
+    capabilities: u32,
+) -> Vec<u8> {
     let role_byte = match role {
         ServerRole::Standalone => 0x00,
         ServerRole::Primary => 0x01,
@@ -90,7 +99,7 @@ fn server_info_frame(role: ServerRole, node_id: &str, cluster_id: &str) -> Vec<u
     };
     let mut payload = vec![MSG_SERVER_INFO, role_byte];
     payload.extend_from_slice(&0u64.to_le_bytes()); // epoch
-    payload.extend_from_slice(&0u32.to_le_bytes()); // capabilities
+    payload.extend_from_slice(&capabilities.to_le_bytes());
     payload.extend_from_slice(&0i64.to_le_bytes()); // server_wall_ns
     payload.extend_from_slice(&(cluster_id.len() as u16).to_le_bytes());
     payload.extend_from_slice(cluster_id.as_bytes());
@@ -121,6 +130,9 @@ enum BatchColumn {
     /// its dict from scratch); `codes` are the per-row ids that index it.
     #[cfg_attr(not(feature = "arrow"), allow(dead_code))]
     Symbol { dict: Vec<String>, codes: Vec<u32> },
+    /// DOUBLE_ARRAY column named `a`, one zero-filled array per shape.
+    #[cfg_attr(not(feature = "arrow-egress"), allow(dead_code))]
+    DoubleArray(Vec<Vec<u32>>),
 }
 
 /// Single-table `RESULT_BATCH` frame carrying one non-null column. The
@@ -132,6 +144,7 @@ fn result_batch_frame(request_id: i64, batch_seq: u64, column: &BatchColumn) ->
     const KIND_LONG: u8 = 0x05;
     const KIND_DOUBLE: u8 = 0x07;
     const KIND_SYMBOL: u8 = 0x09;
+    const KIND_DOUBLE_ARRAY: u8 = 0x11;
     const NULL_FLAG_NONE: u8 = 0x00;
     // Frame header flag: SYMBOL columns ride the connection-scoped dict,
     // so the batch carries the delta-dict section (`flags::DELTA_SYMBOL_DICT`).
@@ -140,6 +153,7 @@ fn result_batch_frame(request_id: i64, batch_seq: u64, column: &BatchColumn) ->
         BatchColumn::Long(v) => ("v", KIND_LONG, v.len()),
         BatchColumn::Double(v) => ("d", KIND_DOUBLE, v.len()),
         BatchColumn::Symbol { codes, .. } => ("s", KIND_SYMBOL, codes.len()),
+        BatchColumn::DoubleArray(shapes) => ("a", KIND_DOUBLE_ARRAY, shapes.len()),
     };
     let flags = match column {
         BatchColumn::Symbol { .. } => FLAG_DELTA_SYMBOL_DICT,
@@ -185,6 +199,16 @@ fn result_batch_frame(request_id: i64, batch_seq: u64, column: &BatchColumn) ->
                 encode_varint_u64(*code as u64, &mut payload);
             }
         }
+        BatchColumn::DoubleArray(shapes) => {
+            for shape in shapes {
+                payload.push(shape.len() as u8);
+                for dim in shape {
+                    payload.extend_from_slice(&dim.to_le_bytes());
+                }
+                let elements: u32 = shape.iter().product();
+                payload.extend(std::iter::repeat_n(0u8, elements as usize * 8));
+            }
+        }
     }
     framed(1, flags, 1, &payload)
 }
@@ -1034,6 +1058,50 @@ fn non_stale_internal_error_still_surfaces_to_caller() {
     assert_eq!(srv.accepts(), 1, "no retry, so no second connection");
 }
 
+#[test]
+#[cfg_attr(
+    windows,
+    ignore = "WinSock send() to a peer that has RST'd can block for the full WRITE_TIMEOUT"
+)]
+fn stale_cached_plan_replay_onto_dead_peer_closes_the_connection() {
+    let srv = MockServer::start(vec![vec![
+        Action::SendServerInfo {
+            role: ServerRole::Standalone,
+            node_id: "n1".into(),
+        },
+        Action::AwaitQueryRequest,
+        Action::SendQueryError {
+            status: STATUS_INTERNAL_ERROR,
+            message: stale_plan_message(),
+        },
+        Action::AbortiveRst,
+    ]]);
+    let conf = format!("ws::addr={};failover=off", srv.url());
+    let mut reader = Reader::from_conf(&conf).expect("connect");
+    let mut cursor = reader.prepare("select 1").execute().expect("execute");
+
+    let err = cursor
+        .next_batch()
+        .err()
+        .expect("a dead peer must surface as an error, not as rows");
+    assert_ne!(
+        err.code(),
+        ErrorCode::ServerInternalError,
+        "the stale-plan fault itself must never reach the caller: {}",
+        err.msg()
+    );
+    assert!(
+        !cursor.connection_reusable(),
+        "a connection whose replay hit a dead peer must not be recycled"
+    );
+    drop(cursor);
+    assert!(
+        reader.transport_torn_down(),
+        "the transport must be closed, not left half-written for the next query"
+    );
+    assert_eq!(srv.accepts(), 1, "failover is off, so no reconnect");
+}
+
 #[test]
 fn stale_cached_plan_after_rows_delivered_surfaces() {
     // The load-bearing `!data_delivered` guard: once a batch has been handed
@@ -1269,6 +1337,127 @@ fn pre_batch_failover_without_callback_still_replays() {
     );
 }
 
+const CAP_QUERY_FLAGS: u32 = 0x02;
+const CAP_QUERY_TIMEOUT: u32 = 0x08;
+
+fn server_info_with_caps(node_id: &str, capabilities: u32) -> Action {
+    Action::SendRaw(server_info_frame_with_caps(
+        ServerRole::Standalone,
+        node_id,
+        "test-cluster",
+        capabilities,
+    ))
+}
+
+#[test]
+fn sub_millisecond_timeout_rounds_up_on_the_wire() {
+    let srv = MockServer::start(vec![vec![
+        server_info_with_caps("n1", CAP_QUERY_FLAGS | CAP_QUERY_TIMEOUT),
+        Action::AwaitQueryRequest,
+        Action::SendResultEnd,
+    ]]);
+    let mut reader = Reader::from_conf(format!("ws::addr={}", srv.url())).expect("connect");
+    let mut cursor = reader
+        .prepare("select 1")
+        .timeout(Duration::from_micros(500))
+        .execute()
+        .expect("execute");
+    assert!(matches!(cursor.next_batch(), Ok(None)));
+    drop(cursor);
+
+    let requests = srv.captured_requests();
+    assert_eq!(requests.len(), 1);
+    // bind_count = 0, query_flags = QUERY_FLAG_TIMEOUT, timeout_ms = 1.
+    assert!(
+        requests[0].ends_with(&[0x00, 0x02, 0x01]),
+        "500 us must round up to timeout_ms = 1, got {:02X?}",
+        requests[0]
+    );
+}
+
+#[test]
+fn timeout_failover_onto_server_without_timeout_cap_refuses_replay() {
+    let srv_a = MockServer::start(vec![vec![
+        server_info_with_caps("a", CAP_QUERY_FLAGS | CAP_QUERY_TIMEOUT),
+        Action::AwaitQueryRequest,
+        Action::HardDrop,
+    ]]);
+    let srv_b = MockServer::start(vec![vec![
+        server_info_with_caps("b", CAP_QUERY_FLAGS),
+        Action::AwaitQueryRequest,
+        Action::SendResultEnd,
+    ]]);
+    let conf = format!(
+        "ws::addr={};failover_backoff_initial_ms=1;failover_backoff_max_ms=10",
+        build_addr_list(&[&srv_a, &srv_b])
+    );
+    let mut reader = Reader::from_conf(&conf).expect("connect to A");
+    let mut cursor = reader
+        .prepare("select 1")
+        .timeout(Duration::from_millis(10))
+        .execute()
+        .expect("execute");
+
+    let err = cursor.next_batch().err().expect("replay must be refused");
+    assert_eq!(err.code(), ErrorCode::UnsupportedServer, "{}", err.msg());
+    assert_eq!(cursor.failover_resets(), 0);
+    drop(cursor);
+    assert!(
+        srv_b.captured_requests().is_empty(),
+        "the timed query must never reach a server that would ignore the timeout"
+    );
+
+    let mut cursor = reader.prepare("select 1").execute().expect("reuse B");
+    assert!(matches!(cursor.next_batch(), Ok(None)));
+    drop(cursor);
+    assert_eq!(reader.current_addr().port, srv_b.addr.port());
+    assert_eq!(srv_b.captured_requests().len(), 1);
+}
+
+#[test]
+#[cfg_attr(
+    windows,
+    ignore = "WinSock send() to a peer that has RST'd can block for the full WRITE_TIMEOUT"
+)]
+fn add_credit_refused_timeout_replay_stays_terminal() {
+    let srv_a = MockServer::start(vec![vec![
+        server_info_with_caps("a", CAP_QUERY_FLAGS | CAP_QUERY_TIMEOUT),
+        Action::AwaitQueryRequest,
+        Action::AbortiveRst,
+    ]]);
+    let srv_b = MockServer::start(vec![vec![
+        server_info_with_caps("b", CAP_QUERY_FLAGS),
+        Action::AwaitQueryRequest,
+        Action::SendResultEnd,
+    ]]);
+    let conf = format!(
+        "ws::addr={};failover_backoff_initial_ms=1;failover_backoff_max_ms=10",
+        build_addr_list(&[&srv_a, &srv_b])
+    );
+    let mut reader = Reader::from_conf(&conf).expect("connect to A");
+    let mut cursor = reader
+        .prepare("select 1")
+        .timeout(Duration::from_millis(10))
+        .execute()
+        .expect("execute");
+
+    std::thread::sleep(Duration::from_millis(100));
+    // A write can land in the send buffer before the RST is observed;
+    // keep granting until one fails and drives the failover.
+    let err = (0..50)
+        .find_map(|_| cursor.add_credit(64).err())
+        .expect("add_credit must eventually hit A's RST");
+    assert_eq!(err.code(), ErrorCode::UnsupportedServer, "{}", err.msg());
+
+    let next = cursor
+        .next_batch()
+        .err()
+        .expect("must not read as clean EOF");
+    assert_eq!(next.code(), ErrorCode::UnsupportedServer);
+    let again = cursor.add_credit(64).expect_err("cursor stays terminal");
+    assert_eq!(again.code(), ErrorCode::UnsupportedServer);
+}
+
 /// Mid-query failover *after* a batch was already delivered: with a
 /// reset callback installed (the replay opt-in), the replayed query
 /// must re-read its schema from the new node's `batch_seq == 0` frame
@@ -1508,6 +1697,35 @@ fn failover_arrow_reader_schema_drift_poisons() {
     assert_eq!(cursor.failover_resets(), 1);
 }
 
+#[cfg(feature = "arrow-egress")]
+#[test]
+fn arrow_conversion_error_mid_stream_is_not_reusable() {
+    let srv = MockServer::start(vec![vec![
+        Action::SendServerInfo {
+            role: ServerRole::Standalone,
+            node_id: "n1".into(),
+        },
+        Action::AwaitQueryRequest,
+        Action::SendBatch {
+            batch_seq: 0,
+            column: BatchColumn::DoubleArray(vec![vec![1], vec![1, 1]]),
+        },
+        Action::SendResultEnd,
+    ]]);
+    let mut reader = Reader::from_conf(format!("ws::addr={}", srv.url())).expect("connect");
+    let mut cursor = reader
+        .prepare("select a from t")
+        .execute()
+        .expect("execute");
+
+    cursor
+        .next_arrow_batch()
+        .expect_err("mixed-rank rows cannot become one Arrow list column");
+    assert!(!cursor.connection_reusable());
+    drop(cursor);
+    assert!(reader.transport_torn_down());
+}
+
 /// Regression pin for the reconnect-path schema clear
 /// (`query_schema = None` in `Reader::reconnect_with_failover`): when
 /// the replayed query's *first* frame from the new node is a