feat(rust/ffi): report ECANCELED through exported streams for cancelled operations

[fornwall]

Fork-internal PR — intentionally targets fornwall/arrow-adbc:main, not upstream. Do not retarget to apache/arrow-adbc yet.

Problem

The driver exporter exports result readers via arrow-rs's FFI_ArrowArrayStream::new, whose error→errno mapping is hardcoded to the ArrowError variant: NotYetImplemented→ENOSYS, MemoryError→ENOMEM, IoError→EIO, everything else→EINVAL. Rust ADBC drivers surface their rich adbc_core::error::Error through ArrowError::ExternalError, which lands in the EINVAL catch-all — so a driver whose in-flight query was cancelled has no way to report ECANCELED through the C stream, even though the ADBC spec (and the C++ validation suite's SqlQueryCancel) expect exactly that errno after AdbcStatementCancel.

Concretely: adbc-spanner's now-working cancellation fails SpannerStatementTest.SqlQueryCancel with errno 22 (EINVAL), message "Cancelled: operation cancelled" — the status is right there in the message but unreachable in the code.

Why owning the stream callbacks (and not something smaller)

This was checked against the C/C++ side of the repo, and the "invasive" part — implementing the ArrowArrayStream callbacks instead of delegating to arrow-rs — is exactly what the in-tree C/C++ drivers do. E.g. the PostgreSQL driver's TupleReader (c/driver/postgresql/statement.cc) implements GetSchema/GetNext by hand and returns InternalAdbcStatusCodeToErrno(status_); the shared status→errno table lives in c/driver/common/utils.c. arrow-rs's generic exporter is the outlier: it stringifies the error into its private data, so the ADBC status is unreachable once the stream is built.

Smaller alternatives considered and rejected:

• Wrap the reader so errors map to a different ArrowError variant — no variant reaches ECANCELED; dead end.
• Wrap the exported stream and remap EINVAL post-hoc — only the stringified message survives inside arrow-rs's private data, so this degenerates to sniffing "Cancelled:" prefixes; same amount of unsafe callback code, but fragile.
• Upstream arrow-rs hook (e.g. FFI_ArrowArrayStream::new_with_error_code(reader, f)) — the genuinely smaller end-state, but needs an arrow-rs API addition and release; worth proposing separately.

Fix

New rust/ffi/src/exported_stream.rs: the same export machinery (adapted from arrow-rs's ffi_stream.rs, Apache-2.0), differing only in the error-code function:

• the error source chain is searched for an adbc_core::error::Error;
• a found ADBC status maps through errno_for_status, a direct port of the canonical InternalAdbcStatusCodeToErrno (c/driver/common/utils.c): Cancelled→ECANCELED, NotFound→ENOENT, NotImplemented→ENOTSUP, Timeout→ETIMEDOUT, Unauthenticated/Unauthorized→EACCES, etc. — so Rust drivers report the same errnos through the C stream as the C/C++ drivers do;
• errors without an ADBC status keep the arrow-rs variant mapping.

Errno constants come from libc (new workspace dependency, default-features = false) rather than a hand-maintained per-OS cfg table — platform-correct everywhere including Windows, mirroring how the C code gets them from <errno.h>.

All seven FFI_ArrowArrayStream::new(reader) export sites in driver_exporter.rs now go through export_reader.

Testing

Unit tests drive the exported stream through the raw C callbacks, exactly as a C consumer would:

• end-of-stream returns 0 with a released array
• a Cancelled ADBC error returns ECANCELED, message preserved via get_last_error
• a Cancelled error nested deeper in a source chain is still found
• the canonical table spot-checked across eight statuses
• errors without an ADBC status keep the arrow-rs mapping (EINVAL/ENOSYS/EIO)
• schema round-trips

cargo test -p adbc_ffi, cargo clippy -p adbc_ffi --all-targets -- -D warnings, cargo fmt --check all pass.

Follow-up (separate changes)

• Bump the adbc_core/adbc_ffi git pin in adbc-spanner to include this, and re-gate SpannerStatementTest.SqlQueryCancel in its validation suite.
• Propose an error-code hook upstream in arrow-rs, which would let this module shrink to a closure.
• Potentially propose this upstream (apache/arrow-adbc) after it has proven out in the fork.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FXTDX6SvmGeXvttQux5zbS