Merge origin/main into qwip_go

Brings in the mainline QWP work (#66 connect-string key consolidation,
#67 connection recycle) on top of the qwip_go feature branch (delta symbol
dictionary, NACK policy v2, the QuestDB facade, durable-ack).

Conflict resolution notes:
- NACK policy: kept v2 (PolicyRetriable/Terminal + poison-frame detector);
  main's PolicyHalt/DropAndContinue is superseded and undefined post-merge.
- Config keys: adopted main's #66 policy per request — sf_max_segment_bytes
  rename, canonicalConfigKey aliases, duplicate-key rejection, transaction /
  UDP-key handling, and the strict QWP key vocabulary (gorilla,
  in_flight_window, token_x/token_y, protocol_version, egress auth are
  rejected/removed). Kept ours' orthogonal features (facade pool keys,
  durable-ack, connection-listener storage, delta symbol dictionary).
- connect_timeout: combined both branches' edge-case fixes (reject negatives,
  floor sub-millisecond positives to 1ms).
- README: dropped the duplicated legacy QWP section in favour of the
  reorganized facade-first structure.

go build ./..., go vet ./..., and the unit suite all pass.

Author: kafka1991

CLAUDE.md

@@ -17,7 +17,8 @@ Go client library for QuestDB ingestion. Three transports:
 
 Module path: `github.com/questdb/go-questdb-client/v4` — the `/v4` segment is
 load-bearing when importing within this repo. Minimum Go: 1.23 (go.mod pins
-`go 1.23` with a `1.24.4` toolchain).
+`go 1.23` with no `toolchain` directive; CI's `1.23.x`/`1.24.x` matrix runs
+under `GOTOOLCHAIN=local`).
 
 ## Commands
 
@@ -153,23 +154,6 @@ write-ahead persists a frame's new symbols before publishing it; a host-crash
 tear (frame delta start > recovered dict size) is caught pre-send by the
 **torn-dict guard**, a terminal `PROTOCOL_VIOLATION` ("resend required").
 
-`WithInFlightWindow(n)` / `in_flight_window=n` is **retained but a no-op** in
-the cursor architecture — backpressure is governed by the engine's segment-ring
-+ `engineAppendBlocking` deadline.
-
-### Java-parity QWP knobs (not in connect-string.md)
-
-These connect-string keys are recognised by the Java client
-(`Sender.java`) but are not listed in the
-[native-client spec](https://github.com/questdb/questdb-enterprise/blob/main/questdb/docs/qwp/connect-string.md).
-We accept them for Java-parity portability — a connect string that
-works on the Java client must work here. None should ever be
-considered for removal without a matching change in Java:
-
-- `gorilla=on|off` — gates the Gorilla timestamp encoding in
-  `qwp_encoder.go` (FLAG_GORILLA). Default `on`.
-- `in_flight_window=N` — see the "retained but a no-op" note above.
-
 `close_timeout=N` (millisecond integer) was a v4.0–v4.5 Go-only key
 for the memory-mode close path. The cursor architecture unified
 memory and SF onto `close_flush_timeout_millis`, which the spec
@@ -210,7 +194,7 @@ Orphan-slot adoption (SF mode, `drain_orphans=on`) is implemented in
 `qwp_sf_orphan.go` + `qwp_sf_drainer.go` + `qwp_sf_round_walk.go`; drainers run
 in dedicated goroutines and are visible via `QwpSender.BackgroundDrainers()`.
 
-### Error handling (NACK policy v2 — no drop, no lists, no dead senders)
+### Error handling (no drop, no lists, no dead senders)
 
 QWP server rejections surface as `*SenderError` (`sender_error.go` is canonical
 for categories + policy enum). Two paths: async callback registered via
@@ -295,10 +279,6 @@ over the generic `qwpDispatcher[T]` (`qwp_dispatcher.go`).
 QWP unit tests use `httptest.Server` to stand in for the QuestDB WebSocket
 endpoint (`newQwpTestServer` in `qwp_sender_test.go`). ILP unit tests are pure.
 
-`*_integration_test.go` files need Docker — they spin up real QuestDB via
-testcontainers-go; HTTP/TCP suites sometimes launch haproxy via
-`test/haproxy.cfg`.
-
 Cross-language conformance: `interop_test.go` +
 `test/interop/questdb-client-test` (submodule) — ILP vectors shared across
 QuestDB client libraries.

README.md

@@ -396,8 +396,6 @@ terminally against a replica.
 
 Backpressure is governed by the engine's segment ring and the append deadline
 (`sf_append_deadline_millis`), not a fixed in-flight count.
-`in_flight_window` / `qdb.WithInFlightWindow(n)` is retained for compatibility
-but is a **no-op**.
 
 ### Error handling
 
@@ -471,7 +469,7 @@ runs in SF mode it assigns each pooled sender its own slot automatically.
 |---|---|---|
 | `sf_dir` | unset | Group root. Setting it activates SF. |
 | `sender_id` | `default` | Per-sender slot name; ASCII letters / digits / `-_` only (no `.` or path separators). |
-| `sf_max_bytes` | 4 MiB | Per-segment file size. |
+| `sf_max_segment_bytes` | 4 MiB | Per-segment file size. |
 | `sf_max_total_bytes` | 10 GiB | Total cap; producer is backpressured when reached. |
 | `sf_append_deadline_millis` | 30000 | How long `At` / `AtNow` block on backpressure before failing. |
 | `reconnect_max_duration_millis` | 300000 | Bounds only the blocking sync initial connect. A running sender retries transient outages indefinitely; it is also reused as the poison-frame episode budget (`max_frame_rejections`). |
@@ -486,7 +484,7 @@ runs in SF mode it assigns each pooled sender its own slot automatically.
 | `durable_ack_keepalive_interval_millis` | 200 | Idle ping that re-elicits pending durable acks; `<= 0` disables (an idle producer can then stall `AwaitAckedFsn`). |
 
 The same options are available programmatically: `WithSfDir`, `WithSenderId`,
-`WithSfMaxBytes`, `WithSfMaxTotalBytes`, `WithReconnectPolicy`,
+`WithSfMaxSegmentBytes`, `WithSfMaxTotalBytes`, `WithReconnectPolicy`,
 `WithInitialConnectRetry`, `WithInitialConnectMode`, `WithCloseFlushTimeout`,
 `WithMaxFrameRejections`, `WithRequestDurableAck`,
 `WithDurableAckKeepaliveInterval`.