Keep foreground cap-gap retries unbounded

Separate symbol-dictionary catch-up cap-gap policy by loop owner.
Foreground senders now retry until a compatible node returns, while
orphan drainers retain bounded quarantine behavior.

Preserve existing constructor signatures and add unit and integration
coverage for retries beyond the orphan budget and recovery after the
server cap is restored.

Author: glasstiger

core/src/main/java/io/questdb/client/Sender.java

@@ -1760,21 +1760,19 @@ public Sender build() {
 
         /**
          * Minimum wall-clock time (millis) a symbol-dictionary catch-up CAP GAP must
-         * persist before the sender gives up on it and fails.
+         * persist before an orphan store-and-forward drainer quarantines its slot.
          * <p>
          * A cap gap means a symbol already accepted by one node is too large to
          * re-register on the node the sender just failed over to, because that node
          * advertises a smaller maximum batch size. On a homogeneous cluster this cannot
          * happen; it takes a heterogeneous or mid-roll cluster, or an operator lowering
          * the cap below existing data.
          * <p>
-         * The sender retries such a gap across reconnects rather than failing on sight,
-         * because the larger-cap node may simply be away -- a rolling restart is the most
-         * likely reason a failover happened at all. It gives up only once the gap has BOTH
-         * recurred many times AND persisted for this long, so an ordinary cluster
-         * operation cannot bring down a live producer. Raise it for a cluster whose
+         * A foreground sender retries such a gap indefinitely because the larger-cap node
+         * may simply be away. An orphan drainer may quarantine only once the gap has BOTH
+         * recurred many times AND persisted for this long. Raise it for a cluster whose
          * rolling restarts take longer than the 5-minute default; set it to {@code 0} to
-         * fail as soon as the retry count is exhausted.
+         * quarantine an orphan slot as soon as the retry count is exhausted.
          * <p>
          * WebSocket transport only.
          */

core/src/main/java/io/questdb/client/cutlass/qwp/client/QwpWebSocketSender.java

@@ -314,9 +314,9 @@ public class QwpWebSocketSender implements Sender {
     // maxFrameRejections (connect-string key poison_min_escalation_window_millis).
     private long poisonMinEscalationWindowMillis =
             CursorWebSocketSendLoop.DEFAULT_POISON_MIN_ESCALATION_WINDOW_MILLIS;
-    // Minimum wall-clock dwell a symbol-dict catch-up cap gap must persist before the
-    // send loop latches a terminal (connect-string key
-    // catchup_cap_gap_min_escalation_window_millis). See
+    // Minimum wall-clock dwell a symbol-dict catch-up cap gap must persist before an
+    // orphan drainer may quarantine its slot (connect-string key
+    // catchup_cap_gap_min_escalation_window_millis). Foreground senders retry forever. See
     // CursorWebSocketSendLoop.DEFAULT_CATCHUP_CAP_GAP_MIN_ESCALATION_WINDOW_MILLIS.
     private long catchUpCapGapMinEscalationWindowMillis =
             CursorWebSocketSendLoop.DEFAULT_CATCHUP_CAP_GAP_MIN_ESCALATION_WINDOW_MILLIS;
@@ -3358,7 +3358,8 @@ private void ensureConnected() {
                     durableAckKeepaliveIntervalMillis,
                     maxFrameRejections,
                     poisonMinEscalationWindowMillis,
-                    catchUpCapGapMinEscalationWindowMillis);
+                    catchUpCapGapMinEscalationWindowMillis,
+                    CursorWebSocketSendLoop.CatchUpCapGapPolicy.RETRY_FOREVER);
             // Plug the async-delivery sink before start() so the I/O thread
             // never observes a null dispatcher between recordFatal and
             // notification — the test for null in dispatchError handles

core/src/main/java/io/questdb/client/cutlass/qwp/client/sf/cursor/BackgroundDrainer.java

@@ -133,9 +133,9 @@ public final class BackgroundDrainer implements Runnable {
     // drain loop; mirrors the owner sender's poison_min_escalation_window_millis.
     private final long poisonMinEscalationWindowMillis;
     // Minimum wall-clock dwell a symbol-dict catch-up cap gap must persist before this
-    // drainer's send loop latches a terminal. Same knob the foreground sender uses; the
-    // orphan drainer honours it too so a rolling restart cannot quarantine an otherwise
-    // drainable slot on a strike count alone.
+    // orphan drainer's send loop latches a terminal. Foreground senders retry forever;
+    // this bounded policy is permitted only so a persistent orphan slot can be
+    // quarantined for operator intervention.
     private final long catchUpCapGapMinEscalationWindowMillis;
 
     public BackgroundDrainer(
@@ -584,7 +584,8 @@ public void run() {
                         durableAckKeepaliveIntervalMillis,
                         maxHeadFrameRejections,
                         poisonMinEscalationWindowMillis,
-                        catchUpCapGapMinEscalationWindowMillis);
+                        catchUpCapGapMinEscalationWindowMillis,
+                        CursorWebSocketSendLoop.CatchUpCapGapPolicy.TERMINAL_AFTER_SETTLE_BUDGET);
                 loop.start();
 
                 while (!stopRequestedOrInterrupted()) {