tina4ruby 3.13.94 → 3.13.97

data/lib/tina4/drivers/mongodb_driver.rb

@@ -3,6 +3,7 @@
 module Tina4
   module Drivers
     class MongodbDriver
+      include Tina4::DatabaseAdapter
       attr_reader :connection, :db
 
       def connect(connection_string, username: nil, password: nil)
@@ -17,7 +18,17 @@ module Tina4
 
         uri = build_uri(connection_string, username, password)
         @db_name = extract_db_name(connection_string)
-        @client = Mongo::Client.new(uri)
+        # The mongo driver's OWN connect_timeout, in seconds. It already bounds
+        # itself - MEASURED: Mongo::Client.new against a TCPServer that accepts
+        # and never replies returns after 10.02s, the gem's hard-coded default -
+        # so this makes it honour the Tina4 variable instead. A URI that spells
+        # connectTimeoutMS itself keeps that value. No bounding_connect wrapper:
+        # Client.new does NOT raise on an unreachable server (server selection
+        # happens later, on the first operation), so there is no expiry to name.
+        seconds = Tina4::DatabaseAdapter.connect_timeout_seconds
+        options = {}
+        options[:connect_timeout] = seconds if seconds && !uri.include?("connectTimeoutMS")
+        @client = Mongo::Client.new(uri, options)
         @db = @client.use(@db_name)
         @connection = @db
         @last_insert_id = nil
@@ -89,11 +100,15 @@ module Tina4
       end
 
       # MongoDB has no LIMIT clause — ignore; already handled in execute_query
+      # Uses the SAME detector as Database#fetch (scrubbed + anchored to the end)
+      # instead of its own naive `sql.upcase.include?("LIMIT")`, which mistook a
+      # column named rate_limit or a `'LIMIT'` literal for a real clause and
+      # returned the statement uncapped. Appends on a NEW LINE so a trailing
+      # `-- comment` cannot swallow the clause.
       def apply_limit(sql, limit, offset = 0)
-        sql_up = sql.upcase
-        return sql if sql_up.include?("LIMIT")
+        return sql if Tina4::Database.has_trailing_limit?(sql)
         modified = sql.dup
-        modified += " LIMIT #{limit}" if limit && limit > 0
+        modified += "\nLIMIT #{limit}" if limit && limit > 0
         modified += " OFFSET #{offset}" if offset && offset > 0
         modified
       end

data/lib/tina4/drivers/mssql_driver.rb

@@ -5,6 +5,15 @@ require_relative "schema_split"
 module Tina4
   module Drivers
     class MssqlDriver
+      # Postgres, MySQL, MSSQL and ODBC all REQUIRE a name for a derived
+      # table, so the COUNT probe in Database#count_probe wraps as
+      # `FROM (sql) AS _count_query`. SQLite and Firebird do not define
+      # this and get no alias - Firebird rejects `AS` in that position.
+      def count_subquery_alias
+        "_count_query"
+      end
+
+      include Tina4::DatabaseAdapter
       include SchemaSplit
       attr_reader :connection
 
@@ -18,13 +27,23 @@ module Tina4
                 "    gem install tiny_tds    # bare driver"
         end
         uri = parse_connection(connection_string)
-        @connection = TinyTds::Client.new(
+        options = {
           host: uri[:host],
           port: uri[:port] || 1433,
           username: username || uri[:username],
           password: password || uri[:password],
           database: uri[:database]
-        )
+        }
+        # FreeTDS's OWN login_timeout, in whole seconds - the bound on reaching
+        # and logging in to the server. MEASURED: 3.01s ("TDS server connection
+        # timed out") against a TCPServer that accepts and never replies, where
+        # the same connect with no bound sat past 20s and needed SIGKILL. The
+        # separate :timeout (per-query, tiny_tds default 5s) is untouched.
+        seconds = Tina4::DatabaseAdapter.connect_timeout_whole_seconds
+        options[:login_timeout] = seconds if seconds
+        Tina4::DatabaseAdapter.bounding_connect(options[:host], options[:port]) do
+          @connection = TinyTds::Client.new(**options)
+        end
       end
 
       def close
@@ -51,22 +70,41 @@ module Tina4
         # the INSERT and SELECT SCOPE_IDENTITY() in ONE batch (a single
         # @connection.execute), read the id from the SAME batch, and cache it.
         if sql.to_s.lstrip[0, 6].casecmp?("INSERT")
-          result = @connection.execute("#{effective_sql}; SELECT SCOPE_IDENTITY() AS id")
+          # @@ROWCOUNT rides along in the SAME batch for the same reason
+          # SCOPE_IDENTITY() does: it reports the row count of the immediately
+          # preceding statement (the INSERT), and read in a later batch it would
+          # describe something else entirely.
+          result = @connection.execute(
+            "#{effective_sql}; SELECT SCOPE_IDENTITY() AS id, @@ROWCOUNT AS affected"
+          )
           rows = result.each(symbolize_keys: true).to_a
           result.cancel if result.respond_to?(:cancel)
           row = rows.last
           @last_insert_id = row && row[:id] ? row[:id].to_i : nil
+          @affected_rows = row && row[:affected] ? row[:affected].to_i : 1
           return true
         end
 
         result = @connection.execute(effective_sql)
-        result.do
+        # TinyTds::Result#do runs the statement and RETURNS the number of rows
+        # it affected. That count was computed and thrown away: the driver
+        # exposed no #affected_rows, so Database#write_affected fell through to
+        # its default of 0 and an UPDATE that really changed a row reported
+        # affected_rows = 0 — indistinguishable from "matched nothing".
+        @affected_rows = result.do
       end
 
       def last_insert_id
         @last_insert_id
       end
 
+      # Rows changed by the most recent INSERT/UPDATE/DELETE on this connection.
+      # Parity with SQLite (connection.changes), MySQL (stmt.affected_rows),
+      # PostgreSQL (cmd_tuples) and the Python master (cursor.rowcount).
+      def affected_rows
+        @affected_rows.to_i
+      end
+
       def placeholder
         "?"
       end
@@ -81,8 +119,15 @@ module Tina4
         # or any unordered SELECT given a limit) otherwise raises "Incorrect
         # syntax near '0'" at the OFFSET. Append a no-op ORDER BY (SELECT NULL)
         # when the SQL has no ORDER BY, mirroring the Python master (mssql.py).
-        ordered = sql =~ /\bORDER\s+BY\b/i ? sql : "#{sql} ORDER BY (SELECT NULL)"
-        "#{ordered} OFFSET #{offset} ROWS FETCH NEXT #{limit} ROWS ONLY"
+        #
+        # Both appends go on a NEW LINE: inline they land inside a trailing
+        # `-- comment` and are silently swallowed (see the note on
+        # Drivers::SqliteDriver#apply_limit). The ORDER BY probe reads the
+        # SCRUBBED SQL for the same reason — an ORDER BY that only appears
+        # inside a comment or a string literal is not an ORDER BY.
+        has_order = Tina4::Database.scrub_sql_text(sql) =~ /\bORDER\s+BY\b/i
+        ordered = has_order ? sql : "#{sql}\nORDER BY (SELECT NULL)"
+        "#{ordered}\nOFFSET #{offset} ROWS FETCH NEXT #{limit} ROWS ONLY"
       end
 
       def begin_transaction
@@ -116,16 +161,34 @@ module Tina4
       def columns(table_name)
         # v3.13.14 (#48): honour a schema-qualified name; bare names match any schema.
         schema, tbl = split_schema(table_name)
-        sql = "SELECT COLUMN_NAME, DATA_TYPE, IS_NULLABLE, COLUMN_DEFAULT FROM INFORMATION_SCHEMA.COLUMNS " \
-              "WHERE TABLE_NAME = ? AND (? IS NULL OR TABLE_SCHEMA = ?)"
-        rows = execute_query(sql, [tbl, schema, schema])
+        # Same hole PostgreSQL had: :primary_key hardcoded false meant
+        # Database#primary_key introspected NOTHING on SQL Server, so the
+        # feature-4 filterless-write guard rejected every PK-keyed update.
+        # Ported from the Python master; the subquery yields every column of the
+        # PK, so a COMPOSITE key reports true on each of its columns.
+        sql = <<~SQL
+          SELECT c.COLUMN_NAME, c.DATA_TYPE, c.IS_NULLABLE, c.COLUMN_DEFAULT,
+                 CASE WHEN pk.COLUMN_NAME IS NOT NULL THEN 1 ELSE 0 END AS is_primary
+          FROM INFORMATION_SCHEMA.COLUMNS c
+          LEFT JOIN (
+            SELECT ku.COLUMN_NAME
+            FROM INFORMATION_SCHEMA.TABLE_CONSTRAINTS tc
+            JOIN INFORMATION_SCHEMA.KEY_COLUMN_USAGE ku
+              ON tc.CONSTRAINT_NAME = ku.CONSTRAINT_NAME
+            WHERE tc.TABLE_NAME = ? AND (? IS NULL OR tc.TABLE_SCHEMA = ?)
+              AND tc.CONSTRAINT_TYPE = 'PRIMARY KEY'
+          ) pk ON c.COLUMN_NAME = pk.COLUMN_NAME
+          WHERE c.TABLE_NAME = ? AND (? IS NULL OR c.TABLE_SCHEMA = ?)
+          ORDER BY c.ORDINAL_POSITION
+        SQL
+        rows = execute_query(sql, [tbl, schema, schema, tbl, schema, schema])
         rows.map do |r|
           {
             name: r[:COLUMN_NAME] || r[:column_name],
             type: r[:DATA_TYPE] || r[:data_type],
             nullable: (r[:IS_NULLABLE] || r[:is_nullable]) == "YES",
             default: r[:COLUMN_DEFAULT] || r[:column_default],
-            primary_key: false
+            primary_key: (r[:is_primary] || r[:IS_PRIMARY]).to_i == 1
           }
         end
       end

data/lib/tina4/drivers/mysql_driver.rb

@@ -5,6 +5,19 @@ require_relative "schema_split"
 module Tina4
   module Drivers
     class MysqlDriver
+      # Postgres, MySQL, MSSQL and ODBC all REQUIRE a name for a derived
+      # table, so the COUNT probe in Database#count_probe wraps as
+      # `FROM (sql) AS _count_query`. SQLite and Firebird do not define
+      # this and get no alias - Firebird rejects `AS` in that position.
+      def count_subquery_alias
+        "_count_query"
+      end
+
+      # First SIX characters of the statements whose row count #affected_rows
+      # reports. "REPLAC" is REPLACE truncated to the same width.
+      WRITE_VERBS = %w[INSERT UPDATE DELETE REPLAC].freeze
+
+      include Tina4::DatabaseAdapter
       include SchemaSplit
       attr_reader :connection
 
@@ -28,13 +41,23 @@ module Tina4
         # identical socket trap).
         host = uri.host || "127.0.0.1"
         host = "127.0.0.1" if host == "localhost" && uri.port
-        @connection = Mysql2::Client.new(
+        options = {
           host: host,
           port: uri.port || 3306,
           username: username || uri.user,
           password: password || uri.password,
           database: uri.path&.sub("/", "")
-        )
+        }
+        # mysql2's OWN connect_timeout, in whole seconds. MEASURED: it bounds the
+        # handshake read too, not just the TCP connect - 3.01s with "Lost
+        # connection ... waiting for initial communication packet" against a
+        # TCPServer that accepts and never replies, where the same connect with
+        # no bound sat past 20s and needed SIGKILL.
+        seconds = Tina4::DatabaseAdapter.connect_timeout_whole_seconds
+        options[:connect_timeout] = seconds if seconds
+        Tina4::DatabaseAdapter.bounding_connect(options[:host], options[:port]) do
+          @connection = Mysql2::Client.new(**options)
+        end
       end
 
       def close
@@ -52,6 +75,7 @@ module Tina4
       end
 
       def execute(sql, params = [])
+        stmt = nil
         result =
           if params.empty?
             @connection.query(sql)
@@ -67,7 +91,40 @@ module Tina4
         # returned 0 after an insert (issue #262). Snapshot it for every INSERT so
         # last_insert_id keeps the id of the last insert regardless of any
         # subsequent COMMIT / SELECT on the connection.
-        @last_insert_id = @connection.last_id if sql.to_s.lstrip[0, 6].casecmp?("INSERT")
+        # MySQL reports the FIRST generated id of a MULTI-ROW INSERT, not the
+        # last (verified live: a 3-row insert into a fresh table reports 1 while
+        # MAX(id) is 3). Every other engine reports the last, and callers -
+        # get_last_id, ORM#save, the batch DatabaseResult - all expect the last.
+        # The ids in one statement are consecutive, so normalise here, where both
+        # the first id and the row count are known; doing it further up would
+        # leave get_last_id disagreeing with the returned result.
+        # The row count MUST come from the STATEMENT, not the connection.
+        # mysql2's client.affected_rows is unreliable after a prepared
+        # execute - measured live, it reported 3 (stale, from the previous
+        # query) for a 1-row prepared insert, and 0 for a 3-row one. Using it
+        # would shift last_id by a wrong offset. stmt.affected_rows is exact.
+        #
+        # Hoisted out of the INSERT branch: the count was computed for an INSERT
+        # only, so the driver exposed no #affected_rows at all and
+        # Database#write_affected fell through to its default of 0 - an UPDATE
+        # that really changed a row reported affected_rows = 0, indistinguishable
+        # from "matched nothing". Gated on the WRITE verbs because a SELECT's
+        # count is its returned-row count, which would clobber the write before
+        # it (SQLite's connection.changes has the same last-write-wins rule).
+        if WRITE_VERBS.include?(sql.to_s.lstrip[0, 6].upcase)
+          @affected_rows = stmt ? stmt.affected_rows.to_i : @connection.affected_rows.to_i
+        end
+
+        if sql.to_s.lstrip[0, 6].casecmp?("INSERT")
+          first_id = @connection.last_id
+          rows = @affected_rows.to_i
+          @last_insert_id =
+            if first_id.to_i.positive?
+              first_id.to_i + [rows, 1].max - 1
+            else
+              first_id
+            end
+        end
         result
       end
 
@@ -75,6 +132,13 @@ module Tina4
         @last_insert_id
       end
 
+      # Rows changed by the most recent INSERT/UPDATE/DELETE on this connection.
+      # Parity with SQLite (connection.changes), PostgreSQL (cmd_tuples), MSSQL
+      # (TinyTds::Result#do) and the Python master (cursor.rowcount).
+      def affected_rows
+        @affected_rows.to_i
+      end
+
       def placeholder
         "?"
       end
@@ -83,8 +147,11 @@ module Tina4
         (["?"] * count).join(", ")
       end
 
+      # NEW LINE, not a space — appended inline the clause lands inside a
+      # trailing `-- comment` and the engine ignores it (see the note on
+      # Drivers::SqliteDriver#apply_limit).
       def apply_limit(sql, limit, offset = 0)
-        "#{sql} LIMIT #{limit} OFFSET #{offset}"
+        "#{sql}\nLIMIT #{limit} OFFSET #{offset}"
       end
 
       def begin_transaction

data/lib/tina4/drivers/odbc_driver.rb

@@ -3,6 +3,15 @@
 module Tina4
   module Drivers
     class OdbcDriver
+      # Postgres, MySQL, MSSQL and ODBC all REQUIRE a name for a derived
+      # table, so the COUNT probe in Database#count_probe wraps as
+      # `FROM (sql) AS _count_query`. SQLite and Firebird do not define
+      # this and get no alias - Firebird rejects `AS` in that position.
+      def count_subquery_alias
+        "_count_query"
+      end
+
+      include Tina4::DatabaseAdapter
       attr_reader :connection
 
       # Connect to an ODBC data source.
@@ -16,6 +25,28 @@ module Tina4
       # passed verbatim to ODBC::Database.new as a connection string.
       # username: and password: are appended as UID/PWD if not already present
       # in the connection string.
+      #
+      # NOT bounded by TINA4_DATABASE_CONNECT_TIMEOUT, and this is a deliberate
+      # exclusion rather than an oversight. Three reasons, in order of weight:
+      #
+      # 1. ruby-odbc is not a Tina4 dependency (it is in neither the gemspec nor
+      #    the Gemfile) and its C extension will not build without unixodbc-dev,
+      #    so it is installed in neither CI nor the lab. A change here could not
+      #    be tested, and an untestable change to a connect path is exactly the
+      #    kind of "protection" that turns out not to fire.
+      # 2. An ODBC target is a DSN name, a file DSN or a local driver. In the
+      #    general case there is no host and no port, so the contract's error
+      #    message has nothing to name.
+      # 3. The ODBC-standard bound is SQL_LOGIN_TIMEOUT, which the operator
+      #    already controls: the DSN string below is passed through verbatim, so
+      #    a driver-specific `Login Timeout=` / `Connection Timeout=` in it takes
+      #    effect today with no framework code at all.
+      #
+      # If ruby-odbc ever becomes testable here, the hook exists:
+      # ODBC::Database#login_timeout= maps to SQL_LOGIN_TIMEOUT (odbc.c:5475,
+      # bound at odbc.c:9366), reachable by constructing an unconnected
+      # ODBC::Database, setting it, then calling #drvconnect (odbc.c:9330)
+      # instead of connecting inside ::new.
       def connect(connection_string, username: nil, password: nil)
         begin
           require "odbc"
@@ -105,18 +136,23 @@ module Tina4
       # Tries OFFSET/FETCH NEXT (SQL Server, newer ODBC sources) first.
       # Falls back to LIMIT/OFFSET for sources that support it (MySQL, PostgreSQL via ODBC).
       # The caller (Database#fetch) already gates on whether LIMIT is already present.
+      # Every append goes on a NEW LINE: inline it lands inside a trailing
+      # `-- comment` and the source silently ignores it (see the note on
+      # Drivers::SqliteDriver#apply_limit). The ORDER BY probe reads the SCRUBBED
+      # SQL, so an ORDER BY that only appears in a comment or a string literal
+      # no longer counts as one.
       def apply_limit(sql, limit, offset = 0)
         offset ||= 0
         if offset > 0
           # SQL Server / ANSI syntax — requires ORDER BY; add a no-op if absent
-          if sql.upcase.include?("ORDER BY")
-            "#{sql} OFFSET #{offset} ROWS FETCH NEXT #{limit} ROWS ONLY"
+          if Tina4::Database.scrub_sql_text(sql).upcase.include?("ORDER BY")
+            "#{sql}\nOFFSET #{offset} ROWS FETCH NEXT #{limit} ROWS ONLY"
           else
             # LIMIT/OFFSET fallback (MySQL, PostgreSQL via ODBC, SQLite via ODBC)
-            "#{sql} LIMIT #{limit} OFFSET #{offset}"
+            "#{sql}\nLIMIT #{limit} OFFSET #{offset}"
           end
         else
-          "#{sql} LIMIT #{limit}"
+          "#{sql}\nLIMIT #{limit}"
         end
       end
 

data/lib/tina4/drivers/postgres_driver.rb

@@ -5,6 +5,15 @@ require_relative "schema_split"
 module Tina4
   module Drivers
     class PostgresDriver
+      # Postgres, MySQL, MSSQL and ODBC all REQUIRE a name for a derived
+      # table, so the COUNT probe in Database#count_probe wraps as
+      # `FROM (sql) AS _count_query`. SQLite and Firebird do not define
+      # this and get no alias - Firebird rejects `AS` in that position.
+      def count_subquery_alias
+        "_count_query"
+      end
+
+      include Tina4::DatabaseAdapter
       include SchemaSplit
       attr_reader :connection
 
@@ -24,7 +33,23 @@ module Tina4
           uri.password = password if password
           url = uri.to_s
         end
-        @connection = PG.connect(url)
+        # libpq's OWN connect_timeout, in whole seconds. MEASURED: it bounds the
+        # entire connect INCLUDING the startup handshake - 3.01s against a
+        # TCPServer that accepts and never replies, where the same connect with
+        # no bound sat past 20s and needed SIGKILL. An operator who spelled
+        # connect_timeout in the URL themselves keeps their value.
+        seconds = Tina4::DatabaseAdapter.connect_timeout_whole_seconds
+        seconds = nil if url.include?("connect_timeout=")
+        # Host/port for the timeout message only. A libpq keyword/value conninfo
+        # string is not a URL and simply yields nil here, which is fine.
+        target = begin
+          URI.parse(url)
+        rescue URI::Error
+          nil
+        end
+        Tina4::DatabaseAdapter.bounding_connect(target&.host, target&.port || 5432) do
+          @connection = seconds ? PG.connect(url, connect_timeout: seconds) : PG.connect(url)
+        end
         apply_result_type_map(@connection)
         @connection
       end
@@ -40,6 +65,7 @@ module Tina4
                  else
                    @connection.exec_params(converted_sql, params)
                  end
+        track_affected(result)
         symbolize_result(result)
       end
 
@@ -52,11 +78,25 @@ module Tina4
         # which is the correct source for a sequence-backed bare INSERT.
         @last_returning_id = nil if sql.lstrip[0, 6].upcase == "INSERT"
         converted_sql = convert_placeholders(sql)
-        if params.empty?
-          @connection.exec(converted_sql)
-        else
-          @connection.exec_params(converted_sql, params)
-        end
+        result = if params.empty?
+                   @connection.exec(converted_sql)
+                 else
+                   @connection.exec_params(converted_sql, params)
+                 end
+        track_affected(result)
+        result
+      end
+
+      # Rows changed by the most recent INSERT/UPDATE/DELETE on this connection.
+      #
+      # Feeds Database#update/delete's DatabaseResult.affected_rows. The driver
+      # exposed NO such method, so write_affected fell through to its default of
+      # 0 and an UPDATE that really changed a row reported affected_rows = 0 —
+      # indistinguishable from "matched nothing". Parity with SQLite
+      # (connection.changes), MySQL (stmt.affected_rows) and the Python master
+      # (cursor.rowcount).
+      def affected_rows
+        @affected_rows.to_i
       end
 
       # Issue #256: surface the ACTUAL primary key value an INSERT wrote —
@@ -152,8 +192,11 @@ module Tina4
         (1..count).map { |i| "$#{i}" }.join(", ")
       end
 
+      # NEW LINE, not a space — appended inline the clause lands inside a
+      # trailing `-- comment` and the engine ignores it (see the note on
+      # Drivers::SqliteDriver#apply_limit).
       def apply_limit(sql, limit, offset = 0)
-        "#{sql} LIMIT #{limit} OFFSET #{offset}"
+        "#{sql}\nLIMIT #{limit} OFFSET #{offset}"
       end
 
       def begin_transaction
@@ -189,21 +232,65 @@ module Tina4
         # v3.13.14 (#48): honour a schema-qualified name; default to public.
         schema, tbl = split_schema(table_name)
         schema ||= "public"
-        sql = "SELECT column_name, data_type, is_nullable, column_default FROM information_schema.columns WHERE table_name = $1 AND table_schema = $2"
-        rows = execute_query(sql, [tbl, schema])
+        # :primary_key was hardcoded false, so Database#primary_key introspected
+        # NOTHING on PostgreSQL. The filterless-write guard (feature 4) reads it,
+        # so `update(table, data)` keyed on the primary key in `data` raised
+        # "update requires a filter or the complete primary key in the data"
+        # against every PostgreSQL table. Port the Python master's LEFT JOIN so
+        # the cross-engine columns() contract (#48) actually holds here — the
+        # subquery yields every column of the PK, so a COMPOSITE key reports
+        # true on each of its columns, not just the first.
+        sql = <<~SQL
+          SELECT c.column_name, c.data_type, c.is_nullable, c.column_default,
+                 CASE WHEN pk.column_name IS NOT NULL THEN true ELSE false END AS is_primary
+          FROM information_schema.columns c
+          LEFT JOIN (
+            SELECT ku.column_name
+            FROM information_schema.table_constraints tc
+            JOIN information_schema.key_column_usage ku
+              ON tc.constraint_name = ku.constraint_name
+             AND tc.table_schema = ku.table_schema
+            WHERE tc.table_name = $1 AND tc.table_schema = $2
+              AND tc.constraint_type = 'PRIMARY KEY'
+          ) pk ON c.column_name = pk.column_name
+          WHERE c.table_name = $3 AND c.table_schema = $4
+          ORDER BY c.ordinal_position
+        SQL
+        rows = execute_query(sql, [tbl, schema, tbl, schema])
         rows.map do |r|
           {
             name: r[:column_name],
             type: r[:data_type],
             nullable: r[:is_nullable] == "YES",
             default: r[:column_default],
-            primary_key: false
+            # The result type map decodes bool to true/false, but stay tolerant
+            # of the raw "t"/"f" text form if the map could not be built.
+            primary_key: r[:is_primary] == true || r[:is_primary] == "t"
           }
         end
       end
 
       private
 
+      # Record the row count of a WRITE so #affected_rows can report it.
+      #
+      # Gated on the command tag rather than recorded for every statement: a
+      # SELECT's cmd_tuples is its ROW COUNT, so tracking it unconditionally
+      # would let an ordinary read overwrite the count of the write before it.
+      # SQLite's connection.changes has exactly this "last write wins, reads
+      # don't touch it" semantic, and Database#write_affected reads the count
+      # immediately after the write, so the two agree.
+      def track_affected(result)
+        tag = result.cmd_status.to_s
+        return unless tag.start_with?("INSERT", "UPDATE", "DELETE", "MERGE")
+
+        @affected_rows = result.cmd_tuples.to_i
+      rescue PG::Error, NoMethodError
+        # A result that cannot report its status leaves the previous count
+        # alone rather than zeroing a real one.
+        nil
+      end
+
       # Issue #256: normalise the ``id`` of an ``INSERT ... RETURNING *`` row.
       #
       # The result-type map already decodes a SERIAL/int8 ``id`` to an Integer

data/lib/tina4/drivers/sqlite_driver.rb

@@ -5,6 +5,7 @@ require_relative "schema_split"
 module Tina4
   module Drivers
     class SqliteDriver
+      include Tina4::DatabaseAdapter
       include SchemaSplit
       attr_reader :connection
 
@@ -20,6 +21,11 @@ module Tina4
         attr_reader :write_lock
       end
 
+      # NOT bounded by TINA4_DATABASE_CONNECT_TIMEOUT, deliberately: this connect
+      # opens a LOCAL FILE. There is no network peer, so there is no host and no
+      # port for the contract's error message to name, and no handshake that can
+      # hang. Every other driver's bound lives in its own connect; this is the
+      # one that has nothing to bind.
       def connect(connection_string, username: nil, password: nil)
         require "sqlite3"
         db_path = self.class.resolve_path(connection_string)
@@ -47,7 +53,15 @@ module Tina4
 
         # Strip the scheme + up to three slashes, preserving a potential fourth
         # slash (absolute) or drive letter.
-        raw = connection_string.sub(/^sqlite:\/\/\//, "").sub(/^sqlite:\/\//, "").sub(/^sqlite:/, "")
+        # `sqlite3:` is a documented alias for `sqlite:`. Normalise it FIRST or
+        # none of the strips below match and `raw` keeps the whole connection
+        # string, so the database file is literally named "sqlite3:app.db".
+        # Not merely ugly: a colon is an illegal filename character on Windows,
+        # so the documented alias is unusable there. DatabaseUrl already
+        # normalises it; this method duplicates the strip instead of calling
+        # it, which is how the two drifted.
+        normalised = connection_string.sub(/^sqlite3:/, "sqlite:")
+        raw = normalised.sub(/^sqlite:\/\/\//, "").sub(/^sqlite:\/\//, "").sub(/^sqlite:/, "")
         return ":memory:" if raw == ":memory:"
 
         is_windows_abs = raw.match?(/^[A-Za-z]:[\/\\]/)
@@ -116,8 +130,13 @@ module Tina4
         (["?"] * count).join(", ")
       end
 
+      # The clause goes on a NEW LINE. Appended inline it lands INSIDE a trailing
+      # `-- comment` and is silently swallowed by the engine — MEASURED:
+      # "SELECT * FROM t ORDER BY id -- LIMIT 5" returned all 150 rows with the
+      # 100-row cap in force. That is a bug at the APPEND SITE, independent of
+      # the detector (Database.has_trailing_limit?), and it needs its own test.
       def apply_limit(sql, limit, offset = 0)
-        "#{sql} LIMIT #{limit} OFFSET #{offset}"
+        "#{sql}\nLIMIT #{limit} OFFSET #{offset}"
       end
 
       def begin_transaction