[isdaniel]

Summary

This PR fixes them, adds regression tests for each, and documents the behaviour changes for the next release.

What changed

Area	Problem (measured on main)	Fix
Reconnect (stream.rs)	timeout(d, es.next_event()) with d shorter than a reconnect never recovers: the dropped future takes the half-built connection with it, and the next call dials again from scratch. With d = 2 ms and one walsender kill: 9,459 connections in 50 s (rustls), 5,454 (libpq), and no events after the fault (d = 50–500 ms: 0–3 events).	A private recovering flag is raised by recover_connection and lowered only on success. EventStream::next_event / next_event_before then park the stream in the poll future poll_next already uses, so the reconnect survives the caller's timeout.
Reconnect cancel (stream.rs)	token.cancel() during a stuck reconnect waited out the connect attempt (2.8–3.8 s).	The retry loop selects on the cancellation token during a reconnect: 0.13 ms.
libpq runtime (libpq.rs)	new() now runs IDENTIFY_SYSTEM, which registered the AsyncFd on the runtime current at new() for the life of the connection. start() under another runtime failed (...is being shutdown) or hung (8 s).	exec_async registers the socket for its own command and releases it, unless a COPY holds a registration. START_REPLICATION / COPY OUT still make the long-lived registration under the runtime that starts them.
connection_timeout = ZERO (retry.rs)	Returned Timeout("0ns") after the first failed attempt, ignoring max_attempts.	Zero means no budget; retries as for any other value.
Cancelled startup command (stream.rs)	After a dropped start() / slot_confirmed_flush_lsn() / timeline_history(), every later command failed with a non-permanent Protocol error, so a retry loop never rebuilt the stream.	Mapped to PermanentConnection at the stream layer; next_event_with_retry still reconnects.
Aligned snapshot (aligned.rs)	TRUNCATE, table-rewriting ALTER TABLE and DROP + CREATE are not MVCC-safe: committed after the consistent point, they make COPY return an empty table while finish() says Ok. Under a truncating writer, 60/60 captures were silently empty.	capture takes ACCESS SHARE ... NOWAIT on the requested tables, then fails if one changed since the snapshot (relfilenode / name). Lock alone is not enough (58/60 still empty): there is a window between the consistent point and the lock.
Aligned snapshot identity (capture_aligned)	With a multi-host libpq conninfo the side connection could land on another cluster and return its rows.	Refuses a side connection whose server_identity differs (PermanentConnection).
Tests	Two integration tests and the startup heartbeat tests assumed 500 ms / 50 ms.	Wait for the server (or leave margin) instead. One strict-sink control now fails when the commit_lsn filter is broken.
Docs / CI	README and rustdoc omitted the acknowledge-before-copy step (50 transactions re-applied after a reconnect), the DDL lock, cancel-safety of next_row, and the xid semantics.	Added. README gets an "Unreleased: changes since 0.9.0" section for the eventual upgrade note. New MSRV 1.87 job (library check only, because proptest 1.12 needs 1.88). Examples job uses --locked. Example, fuzz and load-test lockfiles refreshed. pq-sys 0.7.6 → 0.7.8 (bindgen regeneration only).

Behaviour changes to review

• While a parked reconnect is in flight, EventStream::inner(), inner_mut() and current_lsn() panic until the next next_event() returns (documented; same class as an abandoned poll_next). Feedback methods are unaffected.
• AlignedSnapshot::capture can now return an error (a requested table changed since the snapshot, or a conflicting lock is held at that instant). ALTER TABLE, TRUNCATE, VACUUM FULL and CLUSTER on the requested tables wait until finish(), and writes queued behind them wait too (up to their lock_timeout). Callers should retry a refused capture.
• A cancelled startup command now returns PermanentConnection instead of Protocol.
• connection_timeout = ZERO retries instead of failing on the first attempt.

Type of change

• Bug fix
• New feature
• Performance improvement
• Refactor / internal cleanup
• Documentation
• CI / build

Checklist

• make before-git-push passes locally (check, build, format, audit, test, doc-check)
• Tests added/updated for the change (coverage stays ≥ 90%)
• Both backends build (--features rustls-tls if connection/streaming code changed)
• Docs / README updated if public API changed

[codspeed]

Merging this PR will not alter performance

✅ 50 untouched benchmarks

---

_{Comparing fix/startup-reconnect-liveness (960b3d1) with main (2b35e0e)}

[codecov]

Codecov Report

❌ Patch coverage is 99.09774% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.48%. Comparing base (2b35e0e) to head (960b3d1).

Files with missing lines	Patch %	Lines
src/stream.rs	98.84%	3 Missing ⚠️
src/retry.rs	93.33%	2 Missing ⚠️
src/connection/libpq.rs	99.52%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #153      +/-   ##
==========================================
+ Coverage   96.38%   96.48%   +0.09%     
==========================================
  Files          36       36              
  Lines       28657    29290     +633     
==========================================
+ Hits        27621    28259     +638     
+ Misses       1036     1031       -5     

Flag	Coverage Δ
integration	64.35% <82.31%> (+0.69%)	⬆️
unit	93.42% <95.48%> (+0.44%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟡 Changes recommended

Unresolved critical issues can silently omit snapshot rows after leaf-partition rewrites and leave aligned-snapshot handoffs waiting indefinitely while retaining table locks after a keepalive-only reconnect.

4 open issues

• Validate filenodes for all partitions read by COPY · New
• Preserve bounded event reads when parking after reconnect · New
• Route implicit-port slow-link tests through the proxy · New
• Make health-check reconnect cancellation-aware · New

What changed in this PR

This PR improves connection recovery and aligned-snapshot reliability in pg-walstream, with regression tests and documentation for the changed behavior.

Changes:

• Preserve reconnect progress across repeated read timeouts, improve cancellation handling, and release libpq command socket registrations between commands.
• Add aligned-snapshot table locks, change detection, and side-connection identity checks.
• Expand regression coverage, document transaction and upgrade semantics, add Rust 1.87 compatibility checks, and refresh dependencies.

File	Description
src/​types.rs	Clarifies message xid semantics and tests JSON compatibility.
src/​stream.rs	Updates recovery, cancellation, startup errors, and identity checks.
src/​snapshot/​mod.rs	Corrects the catalog/COPY behavior comment.
src/​snapshot/​aligned.rs	Adds table protection, identity validation, and usage guidance.
src/​retry.rs	Treats a zero connection budget as unlimited.
src/​protocol.rs	Documents and tests per-change streamed xids.
src/​connection/​libpq.rs	Releases command registrations and adds connection regression tests.
README.md	Documents upgrade changes and safer snapshot merging.
load-tests/​Cargo.lock	Refreshes load-test dependencies.
integration-tests/​reconnect_recovery.rs	Tests slow reconnects and cancelled startup recovery.
integration-tests/​initial_snapshot.rs	Waits for server state before cancelling snapshot creation.
integration-tests/​aligned_snapshot.rs	Strengthens overlap checks and tests concurrent table changes.
fuzz/​Cargo.lock	Updates the fuzzing smallvec dependency.
examples/​typed-deserialization/​Cargo.lock	Refreshes example dependencies.
examples/​tokio-spawn-streaming/​Cargo.lock	Refreshes example dependencies.
examples/​safe-transaction-consumer/​Cargo.lock	Refreshes example dependencies.
examples/​raw-xlogdata/​Cargo.lock	Refreshes example dependencies.
examples/​rate-limited-streaming/​Cargo.lock	Refreshes example dependencies.
examples/​polling/​Cargo.lock	Refreshes example dependencies.
examples/​pg-basebackup/​Cargo.lock	Refreshes example dependencies.
examples/​initial-snapshot/​Cargo.lock	Refreshes example dependencies.
examples/​derive-router/​Cargo.lock	Refreshes example dependencies.
examples/​binary-column-access/​Cargo.lock	Refreshes example dependencies.
examples/​basic-streaming/​Cargo.lock	Refreshes example dependencies.
examples/​arbitrary-fuzzing/​Cargo.lock	Updates the example’s smallvec dependency.
Cargo.toml	Raises pq-sys to 0.7.8.
Cargo.lock	Updates pq-sys and equivalent.
.github/​workflows/​ci-checks.yml	Adds Rust 1.87 checks and enforces example lockfiles.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Critical defects allow post-snapshot partition attachments to affect copied data and resumed bounded reads to report completion while leaving intervening transactions unread.

2 open issues

• Validate partition membership against both new and missing attachments · New
• Recheck the current boundary after a parked read completes · New

4 resolved since last review

• Preserve bounded event reads when parking after reconnect
• Validate filenodes for all partitions read by COPY
• Make health-check reconnect cancellation-aware
• Route implicit-port slow-link tests through the proxy

_{Review effort: Balanced}