fix(streaming): bound socket writes, seed historical deadlines, arm self-join guard, and own the wait-strategy surface

[userFRM]

Five reliability and public-surface fixes across the real-time streaming and historical paths.

Socket write timeout (FPSS)

The connection set a read timeout but never a write timeout. The credentials write drives the lazy TLS handshake, and steady-state ping/subscribe writes can block indefinitely against a peer whose receive window has stalled (alive enough to ACK at the kernel but not draining the socket); the connect timeout only bounds the SYN/ACK. A write deadline is now set alongside the read deadline, sourced from the same connect-window budget. It persists for the life of the socket, so a write TimedOut surfaces as a fatal I/O error and the existing reconnect path takes over, mirroring the read-timeout liveness contract.

Historical per-request deadline (MDDS)

Historical requests had no default deadline: a server holding the HTTP/2 stream open while sending no chunks would hang the collect/stream drain, since gRPC keepalive only detects a fully dead peer, not a live-but-silent one. A new HistoricalConfig::request_timeout_secs (default 300s) seeds the per-request deadline when the caller set none. An explicit with_deadline(...) still overrides it, and with_deadline(Duration::ZERO) opts a single request out; a configured default of 0 disables the fallback.

Production self-join guard

The Drop self-join guard read a consumer thread id that only the test harness ever recorded, so the documented protection against an inline join deadlock — when a user callback drops the last client handle while running on the consumer thread — was inert in shipped builds. The draining thread id is now captured at the single drain entry point every path routes through (next_event / for_each* / poll_batch), so the guard fires in production.

Wait-strategy surface no longer leaks the ring crate

The bring-your-own wait-strategy drain exposed the underlying ring crate's trait in its public generic bound, and the migration doc instructed users to name that crate directly in a use. The wait-strategy trait and presets are now re-exported under thetadatadx::streaming::wait, and both the generic bound and the migration doc point at the crate-owned path. A real Rust caller never adds the ring crate to their own manifest. A clean re-export was chosen over collapsing to the FFI-safe preset enum because the trait and presets re-export trivially, preserving the existing zero-cost generic escape hatch with no API break.

Heartbeat send consistency

The ping heartbeat used a blocking send while the rest of the control plane uses non-blocking try_send. The heartbeat is an idempotent liveness signal: a momentarily full channel means the I/O thread is already draining a large outbound backlog (hence demonstrably alive), so skipping one beat and firing the next an interval later stays well inside any server-side ping deadline. It now uses try_send, so a backpressured channel cannot pin the Drop path for up to one interval.

Verification

cargo fmt --all -- --check clean. cargo test -p thetadatadx --lib — 814 passed. cargo build -p thetadatadx clean. cargo clippy -p thetadatadx --lib -- -D warnings clean. The pre-existing --all-targets clippy failures (thetadatadx::wire unresolved, decode private, in tests/ and examples/) reproduce identically on the base branch and are unrelated. Both doc gates pass: the docs-site generator --check reports generated pages match the registries, and check_docs_consistency.py reports ok.

🤖 Generated with Claude Code