fix requests hanging forever when a streamed read stops delivering rows

[cportele]

A database error raised while rows are being streamed is not delivered by the underlying library, so the stream stalls instead of failing: nothing is logged, no response is sent, and the connections the sub-query holds stay held until the client gives up. A connection lost mid-stream — a failover in a replicated cluster, for instance — looks the same from here.

The row source now ends in a timeout that turns such a stall into an error that does propagate, which also releases the connection budget deterministically instead of waiting for the client to disconnect. It is a per-element timeout, so a slow but progressing read is unaffected however long it runs in total; only a gap longer than the window ends the stream. The window is deliberately generous: this detects a stalled read, it is not a query budget, so it has to sit well above the slowest legitimate gap between two rows.

A database-side statement_timeout is no substitute, because its error would be swallowed the same way.

[cportele]

A database error raised while rows are being streamed is not delivered by the underlying library, so the stream stalls instead of failing: nothing is logged, no response is sent, and the connections the sub-query holds stay held until the client gives up. A connection lost mid-stream — a failover in a replicated cluster, for instance — looks the same from here.

The row source now ends in a timeout that turns such a stall into an error that does propagate, which also releases the connection budget deterministically instead of waiting for the client to disconnect. It is a per-element timeout, so a slow but progressing read is unaffected however long it runs in total; only a gap longer than the window ends the stream. The window is deliberately generous: this detects a stalled read, it is not a query budget, so it has to sit well above the slowest legitimate gap between two rows.

A database-side statement_timeout is no substitute, because its error would be swallowed the same way.

[cportele]

A database error raised while rows are being streamed is not delivered by the underlying library, so the stream stalls instead of failing: nothing is logged, no response is sent, and the connections the sub-query holds stay held until the client gives up. A connection lost mid-stream — a failover in a replicated cluster, for instance — looks the same from here.

The row source now ends in a timeout that turns such a stall into an error that does propagate, which also releases the connection budget deterministically instead of waiting for the client to disconnect. It is a per-element timeout, so a slow but progressing read is unaffected however long it runs in total; only a gap longer than the window ends the stream. The window is deliberately generous: this detects a stalled read, it is not a query budget, so it has to sit well above the slowest legitimate gap between two rows.

A database-side statement_timeout is no substitute, because its error would be swallowed the same way.

[cportele]

A database error raised while rows are being streamed is not delivered by the underlying library, so the stream stalls instead of failing: nothing is logged, no response is sent, and the connections the sub-query holds stay held until the client gives up. A connection lost mid-stream — a failover in a replicated cluster, for instance — looks the same from here.

The row source now ends in a timeout that turns such a stall into an error that does propagate, which also releases the connection budget deterministically instead of waiting for the client to disconnect. It is a per-element timeout, so a slow but progressing read is unaffected however long it runs in total; only a gap longer than the window ends the stream. The window is deliberately generous: this detects a stalled read, it is not a query budget, so it has to sit well above the slowest legitimate gap between two rows.

A database-side statement_timeout is no substitute, because its error would be swallowed the same way.

[cportele]

A database error raised while rows are being streamed is not delivered by the underlying library, so the stream stalls instead of failing: nothing is logged, no response is sent, and the connections the sub-query holds stay held until the client gives up. A connection lost mid-stream — a failover in a replicated cluster, for instance — looks the same from here.

The row source now ends in a timeout that turns such a stall into an error that does propagate, which also releases the connection budget deterministically instead of waiting for the client to disconnect. It is a per-element timeout, so a slow but progressing read is unaffected however long it runs in total; only a gap longer than the window ends the stream. The window is deliberately generous: this detects a stalled read, it is not a query budget, so it has to sit well above the slowest legitimate gap between two rows.

A database-side statement_timeout is no substitute, because its error would be swallowed the same way.

[cportele]

A database error raised while rows are being streamed is not delivered by the underlying library, so the stream stalls instead of failing: nothing is logged, no response is sent, and the connections the sub-query holds stay held until the client gives up. A connection lost mid-stream — a failover in a replicated cluster, for instance — looks the same from here.

The row source now ends in a timeout that turns such a stall into an error that does propagate, which also releases the connection budget deterministically instead of waiting for the client to disconnect. It is a per-element timeout, so a slow but progressing read is unaffected however long it runs in total; only a gap longer than the window ends the stream. The window is deliberately generous: this detects a stalled read, it is not a query budget, so it has to sit well above the slowest legitimate gap between two rows.

A database-side statement_timeout is no substitute, because its error would be swallowed the same way.

[cportele]

A database error raised while rows are being streamed is not delivered by the underlying library, so the stream stalls instead of failing: nothing is logged, no response is sent, and the connections the sub-query holds stay held until the client gives up. A connection lost mid-stream — a failover in a replicated cluster, for instance — looks the same from here.

The row source now ends in a timeout that turns such a stall into an error that does propagate, which also releases the connection budget deterministically instead of waiting for the client to disconnect. It is a per-element timeout, so a slow but progressing read is unaffected however long it runs in total; only a gap longer than the window ends the stream. The window is deliberately generous: this detects a stalled read, it is not a query budget, so it has to sit well above the slowest legitimate gap between two rows.

A database-side statement_timeout is no substitute, because its error would be swallowed the same way.

[cportele]

A database error raised while rows are being streamed is not delivered by the underlying library, so the stream stalls instead of failing: nothing is logged, no response is sent, and the connections the sub-query holds stay held until the client gives up. A connection lost mid-stream — a failover in a replicated cluster, for instance — looks the same from here.

The row source now ends in a timeout that turns such a stall into an error that does propagate, which also releases the connection budget deterministically instead of waiting for the client to disconnect. It is a per-element timeout, so a slow but progressing read is unaffected however long it runs in total; only a gap longer than the window ends the stream. The window is deliberately generous: this detects a stalled read, it is not a query budget, so it has to sit well above the slowest legitimate gap between two rows.

A database-side statement_timeout is no substitute, because its error would be swallowed the same way.