From 5c6b286be6cefb87a08b52f72bfbff6fe1846836 Mon Sep 17 00:00:00 2001
From: Prateek Singh <42719720+singhpratech@users.noreply.github.com>
Date: Sun, 2 Aug 2026 12:02:14 -0400
Subject: [PATCH 1/2] deps: clear all 14 Dependabot PRs, and correct a wrong
 deny.toml rationale
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three of the fourteen were red, all on cargo-deny, all for a
duplicate-version ban rather than an advisory:

  #20 serde 1.0.229    serde_derive moved to syn 3.0
  #22 thiserror 2.0.19 thiserror-impl moved to syn 3.0
  #21 twox-hash 2.1.2  pulled rand 0.9 beside DataFusion's rand 0.8

syn gets a documented skip: both roots on the 3.0 line and all eighteen
on the 2.0 line are proc-macro or build-script crates, so neither version
links into a shipped artifact and the cost is compile time. The
derive ecosystem is mid-migration; the retire condition is the 2.0 list
emptying out.

twox-hash needed no skip at all. The `random` feature exists to build a
RandomState we never construct, and it was the only thing pulling rand
0.9 — `default-features = false` drops it. XXH64 is fixed by the spec, so
2.x is digest-identical to the 1.6 line every published Puffin sidecar
was built with; verified over both the oneshot and chunked-write paths
before taking the bump, because a silent digest change would have broken
cross-version sketch merges without failing a test.

That bump also exposed a wrong comment. The existing twox-hash skip
claimed samkhya-core pinned 1.6 while DataFusion pulled 2.x. In fact
DataFusion 46 roots both — parquet 54 takes 1.6.3, lz4_flex takes 2.1.2 —
and samkhya-core's own pin was the 1.6 that made the duplicate look like
ours. The skip stays, upstream-only, with the paths corrected.

The Actions bumps go to the current major (checkout/setup-node/
upload-artifact v7, setup-python v7, one past the v6 Dependabot proposed)
rather than one step at a time; the runner had already started warning
that checkout@v4 targets the deprecated Node 20. #16 is declined instead:
it proposed replacing floating `@v2` with an exact patch of
taiki-e/install-action, which publishes several releases a week. Every
action here is referenced by major tag on purpose, so dependabot.yml now
ignores patch and minor for the Actions ecosystem and lets majors through.

Verified locally against every CI job, not just the changed surface:
fmt, clippy, 415 workspace tests, MSRV check on a real 1.85 toolchain,
all five optional-feature matrix entries including the bundled DuckDB
C++ build, all four cargo-deny checks, and both wire-contract transports
against the bumped FastAPI 0.140.13 / uvicorn 0.51.0.

One thing to know rather than act on: duckdb 1.10505.0 declares
rust-version 1.85.1 while the workspace declares 1.85. It only matters to
someone on exactly 1.85.0 enabling the off-by-default `bundled` feature,
and CI's "1.85" resolves to 1.85.1, so the floor is not being raised for
an optional dependency.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/dependabot.yml                     |  12 +
 .github/workflows/ci.yml                   |  16 +-
 .github/workflows/release-candidate.yml    |   6 +-
 Cargo.lock                                 | 378 ++++++++-------------
 Cargo.toml                                 |   9 +-
 deny.toml                                  |  25 +-
 samkhya-gpudb/scripts/package-lock.json    |  12 +-
 samkhya-gpudb/scripts/requirements-llm.txt |   4 +-
 8 files changed, 191 insertions(+), 271 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8a0c142..6a85d7d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -11,6 +11,18 @@ updates:
     schedule:
       interval: monthly
     open-pull-requests-limit: 5
+    # Every action in these workflows is referenced by its floating major
+    # tag (`@v7`), so patch and minor releases already arrive without a PR
+    # and a PR for one is pure noise. It is not free noise either: left on,
+    # Dependabot proposes replacing a floating `@v2` with an exact patch —
+    # taiki-e/install-action#16 did exactly that — and then opens a fresh PR
+    # for every subsequent patch, of which that action publishes several a
+    # week. Major bumps are the ones that need a human, and still get one.
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-patch
+          - version-update:semver-minor
 
   - package-ecosystem: pip
     directory: /samkhya-py
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 27cfd75..5b1cf9a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -70,7 +70,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -114,7 +114,7 @@ jobs:
             feature_args: --features puffin-cross-engine --test puffin_cross_engine
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -141,7 +141,7 @@ jobs:
         python-version: ["3.9", "3.12", "3.13"]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -149,7 +149,7 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
 
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
@@ -194,12 +194,12 @@ jobs:
         working-directory: samkhya-gpudb/scripts
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: npm
@@ -233,7 +233,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/release-candidate.yml b/.github/workflows/release-candidate.yml
index abb2788..5087e52 100644
--- a/.github/workflows/release-candidate.yml
+++ b/.github/workflows/release-candidate.yml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -26,7 +26,7 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
 
       - name: Install Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
@@ -83,7 +83,7 @@ jobs:
         run: sha256sum *.crate *.whl cargo-metadata.json sbom.cdx.json > SHA256SUMS
 
       - name: Upload candidate bundle
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: samkhya-1.1.0-local-candidate
           path: target/release-candidate/
diff --git a/Cargo.lock b/Cargo.lock
index 808cdd9..7de0c67 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8,17 +8,6 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
-[[package]]
-name = "ahash"
-version = "0.7.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "891477e0c6a8957309ee5c45a6368af3ae14bb510732d2684ffa19af310920f9"
-dependencies = [
- "getrandom 0.2.17",
- "once_cell",
- "version_check",
-]
-
 [[package]]
 name = "ahash"
 version = "0.8.12"
@@ -173,7 +162,7 @@ dependencies = [
  "serde_json",
  "strum",
  "strum_macros",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "uuid",
  "zstd",
 ]
@@ -317,7 +306,7 @@ version = "54.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a12fcdb3f1d03f69d3ec26ac67645a8fe3f878d77b5ebb0b15d64a116c212985"
 dependencies = [
- "ahash 0.8.12",
+ "ahash",
  "arrow-buffer 54.3.1",
  "arrow-data 54.3.1",
  "arrow-schema 54.3.1",
@@ -334,7 +323,7 @@ version = "57.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8a4ab47b3f3eac60f7fd31b81e9028fda018607bcc63451aca4f2b755269862"
 dependencies = [
- "ahash 0.8.12",
+ "ahash",
  "arrow-buffer 57.3.1",
  "arrow-data 57.3.1",
  "arrow-schema 57.3.1",
@@ -352,7 +341,7 @@ version = "58.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfd33d3e92f207444098c75b42de99d329562be0cf686b307b097cc52b4e999e"
 dependencies = [
- "ahash 0.8.12",
+ "ahash",
  "arrow-buffer 58.3.0",
  "arrow-data 58.3.0",
  "arrow-schema 58.3.0",
@@ -659,7 +648,7 @@ version = "54.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69efcd706420e52cd44f5c4358d279801993846d1c2a8e52111853d61d55a619"
 dependencies = [
- "ahash 0.8.12",
+ "ahash",
  "arrow-array 54.3.1",
  "arrow-buffer 54.3.1",
  "arrow-data 54.3.1",
@@ -673,7 +662,7 @@ version = "57.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b320d86a9806923663bb0fd9baa65ecaba81cb0cd77ff8c1768b9716b4ef891"
 dependencies = [
- "ahash 0.8.12",
+ "ahash",
  "arrow-array 57.3.1",
  "arrow-buffer 57.3.1",
  "arrow-data 57.3.1",
@@ -687,7 +676,7 @@ version = "58.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8cd065c54172ac787cf3f2f8d4107e0d3fdc26edba76fdf4f4cc170258942222"
 dependencies = [
- "ahash 0.8.12",
+ "ahash",
  "arrow-array 58.3.0",
  "arrow-buffer 58.3.0",
  "arrow-data 58.3.0",
@@ -1059,30 +1048,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "borsh"
-version = "1.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfd1e3f8955a5d7de9fab72fc8373fade9fb8a703968cb200ae3dc6cf08e185a"
-dependencies = [
- "borsh-derive",
- "bytes",
- "cfg_aliases",
-]
-
-[[package]]
-name = "borsh-derive"
-version = "1.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfcfdc083699101d5a7965e49925975f2f55060f94f9a05e7187be95d530ca59"
-dependencies = [
- "once_cell",
- "proc-macro-crate",
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "boxcar"
 version = "0.2.14"
@@ -1146,28 +1111,6 @@ version = "3.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
 
-[[package]]
-name = "bytecheck"
-version = "0.6.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23cdc57ce23ac53c931e88a43d06d070a6fd142f2617be5855eb75efc9beb1c2"
-dependencies = [
- "bytecheck_derive",
- "ptr_meta",
- "simdutf8",
-]
-
-[[package]]
-name = "bytecheck_derive"
-version = "0.6.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3db406d29fbcd95542e92559bed4d8ad92636d1ca8b3b72ede10b4bcc010e659"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "bytemuck"
 version = "1.25.0"
@@ -1426,6 +1369,7 @@ version = "7.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4a65ebfec4fb190b6f90e944a817d60499ee0744e582530e2c9900a22e591d9a"
 dependencies = [
+ "crossterm",
  "unicode-segmentation",
  "unicode-width 0.2.2",
 ]
@@ -1610,6 +1554,28 @@ version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
+[[package]]
+name = "crossterm"
+version = "0.28.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "829d955a0bb380ef178a640b91779e3987da38c9aea133b20614cfed8cdea9c6"
+dependencies = [
+ "bitflags 2.11.1",
+ "crossterm_winapi",
+ "parking_lot",
+ "rustix 0.38.44",
+ "winapi",
+]
+
+[[package]]
+name = "crossterm_winapi"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acdd7c62a3665c7f6830a51635d9ac9b23ed385797f70a83bb8bafe9c572ab2b"
+dependencies = [
+ "winapi",
+]
+
 [[package]]
 name = "crunchy"
 version = "0.2.4"
@@ -1891,7 +1857,7 @@ version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1f53d7ec508e1b3f68bd301cee3f649834fad51eff9240d898a4b2614cfd0a7a"
 dependencies = [
- "ahash 0.8.12",
+ "ahash",
  "arrow 54.3.1",
  "arrow-ipc 54.3.1",
  "base64",
@@ -2047,7 +2013,7 @@ version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "adfc2d074d5ee4d9354fdcc9283d5b2b9037849237ddecb8942a29144b77ca05"
 dependencies = [
- "ahash 0.8.12",
+ "ahash",
  "arrow 54.3.1",
  "datafusion-common",
  "datafusion-doc",
@@ -2068,7 +2034,7 @@ version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1cbceba0f98d921309a9121b702bcd49289d383684cccabf9a92cda1602f3bbb"
 dependencies = [
- "ahash 0.8.12",
+ "ahash",
  "arrow 54.3.1",
  "datafusion-common",
  "datafusion-expr-common",
@@ -2175,7 +2141,7 @@ version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1447c2c6bc8674a16be4786b4abf528c302803fafa186aa6275692570e64d85"
 dependencies = [
- "ahash 0.8.12",
+ "ahash",
  "arrow 54.3.1",
  "datafusion-common",
  "datafusion-expr",
@@ -2197,7 +2163,7 @@ version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69f8c25dcd069073a75b3d2840a79d0f81e64bdd2c05f2d3d18939afb36a7dcb"
 dependencies = [
- "ahash 0.8.12",
+ "ahash",
  "arrow 54.3.1",
  "datafusion-common",
  "datafusion-expr-common",
@@ -2230,7 +2196,7 @@ version = "46.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "88cc160df00e413e370b3b259c8ea7bfbebc134d32de16325950e9e923846b7f"
 dependencies = [
- "ahash 0.8.12",
+ "ahash",
  "arrow 54.3.1",
  "arrow-ord 54.3.1",
  "arrow-schema 54.3.1",
@@ -2359,18 +2325,18 @@ checksum = "aeda16ab4059c5fd2a83f2b9c9e9c981327b18aa8e3b313f7e6563799d4f093e"
 
 [[package]]
 name = "duckdb"
-version = "1.10501.0"
+version = "1.10505.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f13bc6d6487032fc2825a62ef8b4924b2378a2eb3166e132e5f3141ae9dd633f"
+checksum = "970e05eedd3f55c435194d9104f90a9b4a79a80d6e73251bc9ff43e178130c4e"
 dependencies = [
  "arrow 58.3.0",
  "cast",
+ "comfy-table",
  "fallible-iterator",
  "fallible-streaming-iterator",
  "hashlink 0.10.0",
  "libduckdb-sys",
  "num-integer",
- "rust_decimal",
  "strum",
 ]
 
@@ -2608,7 +2574,7 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8640e34b88f7652208ce9e88b1a37a2ae95227d84abec377ccd3c5cfeb141ed4"
 dependencies = [
- "rustix",
+ "rustix 1.1.4",
  "windows-sys 0.59.0",
 ]
 
@@ -2852,9 +2818,6 @@ name = "hashbrown"
 version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
-dependencies = [
- "ahash 0.7.8",
-]
 
 [[package]]
 name = "hashbrown"
@@ -2862,7 +2825,7 @@ version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 dependencies = [
- "ahash 0.8.12",
+ "ahash",
  "allocator-api2",
 ]
 
@@ -3032,7 +2995,6 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots 1.0.7",
 ]
 
 [[package]]
@@ -3446,17 +3408,17 @@ checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
 [[package]]
 name = "libduckdb-sys"
-version = "1.10501.0"
+version = "1.10505.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12096c1694924782b3fe21e790630b77bacb4fcb7ad9d7ee0fec626f985bf248"
+checksum = "6cb514dab5e271e849235c1cb98bd65a2ae107fbd619a6740219319c54a71d95"
 dependencies = [
  "cc",
  "flate2",
  "pkg-config",
- "reqwest",
  "serde",
  "serde_json",
  "tar",
+ "ureq 3.3.0",
  "vcpkg",
  "zip",
 ]
@@ -3497,6 +3459,12 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
@@ -3908,7 +3876,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tracing",
  "url",
@@ -4014,7 +3982,7 @@ version = "54.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bfb15796ac6f56b429fd99e33ba133783ad75b27c36b4b5ce06f1f82cc97754e"
 dependencies = [
- "ahash 0.8.12",
+ "ahash",
  "arrow-array 54.3.1",
  "arrow-buffer 54.3.1",
  "arrow-cast 54.3.1",
@@ -4050,7 +4018,7 @@ version = "57.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2e832c6aa20310fc6de7ea5a3f4e20d34fd83e3b43229d32b81ffe5c14d74692"
 dependencies = [
- "ahash 0.8.12",
+ "ahash",
  "arrow-array 57.3.1",
  "arrow-buffer 57.3.1",
  "arrow-cast 57.3.1",
@@ -4924,15 +4892,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "proc-macro-crate"
-version = "3.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
-dependencies = [
- "toml_edit 0.25.11+spec-1.1.0",
-]
-
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -4971,26 +4930,6 @@ dependencies = [
  "cc",
 ]
 
-[[package]]
-name = "ptr_meta"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0738ccf7ea06b608c10564b31debd4f5bc5e197fc8bfe088f68ae5ce81e7a4f1"
-dependencies = [
- "ptr_meta_derive",
-]
-
-[[package]]
-name = "ptr_meta_derive"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16b845dbfca988fa33db069c0e230574d15a3088f147a87b64c7589eb662c9ac"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "pyo3"
 version = "0.29.0"
@@ -5084,7 +5023,7 @@ dependencies = [
  "rustc-hash 2.1.2",
  "rustls",
  "socket2",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tracing",
  "web-time",
@@ -5105,7 +5044,7 @@ dependencies = [
  "rustls",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tinyvec",
  "tracing",
  "web-time",
@@ -5366,15 +5305,6 @@ version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
-[[package]]
-name = "rend"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71fe3824f5629716b1589be05dacd749f6aa084c87e00e016714a8cdfccc997c"
-dependencies = [
- "bytecheck",
-]
-
 [[package]]
 name = "reqwest"
 version = "0.12.28"
@@ -5383,7 +5313,6 @@ checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
  "base64",
  "bytes",
- "futures-channel",
  "futures-core",
  "futures-util",
  "h2",
@@ -5416,7 +5345,6 @@ dependencies = [
  "wasm-bindgen-futures",
  "wasm-streams",
  "web-sys",
- "webpki-roots 1.0.7",
 ]
 
 [[package]]
@@ -5433,35 +5361,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "rkyv"
-version = "0.7.46"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2297bf9c81a3f0dc96bc9521370b88f054168c29826a75e89c55ff196e7ed6a1"
-dependencies = [
- "bitvec",
- "bytecheck",
- "bytes",
- "hashbrown 0.12.3",
- "ptr_meta",
- "rend",
- "rkyv_derive",
- "seahash",
- "tinyvec",
- "uuid",
-]
-
-[[package]]
-name = "rkyv_derive"
-version = "0.7.46"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84d7b42d4b8d06048d3ac8db0eb31bcb942cbeb709f0b5f2b2ebde398d3038f5"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "rmp"
 version = "0.8.15"
@@ -5498,7 +5397,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c51c9ae4df8a7fba42103df5c621fa3c37eccf3a3c650879e90fc48b11cc192c"
 dependencies = [
  "hashbrown 0.16.1",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -5516,23 +5415,6 @@ dependencies = [
  "sqlite-wasm-rs",
 ]
 
-[[package]]
-name = "rust_decimal"
-version = "1.42.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c5108e3d4d903e21aac27f12ba5377b6b34f9f44b325e4894c7924169d06995"
-dependencies = [
- "arrayvec",
- "borsh",
- "bytes",
- "num-traits",
- "rand 0.8.6",
- "rkyv",
- "serde",
- "serde_json",
- "wasm-bindgen",
-]
-
 [[package]]
 name = "rustc-hash"
 version = "1.1.0"
@@ -5563,6 +5445,19 @@ dependencies = [
  "semver 1.0.28",
 ]
 
+[[package]]
+name = "rustix"
+version = "0.38.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
+dependencies = [
+ "bitflags 2.11.1",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.4.15",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "rustix"
 version = "1.1.4"
@@ -5572,7 +5467,7 @@ dependencies = [
  "bitflags 2.11.1",
  "errno",
  "libc",
- "linux-raw-sys",
+ "linux-raw-sys 0.12.1",
  "windows-sys 0.61.2",
 ]
 
@@ -5680,7 +5575,7 @@ dependencies = [
  "serde_json",
  "tempfile",
  "tokio",
- "ureq",
+ "ureq 2.12.1",
 ]
 
 [[package]]
@@ -5710,9 +5605,9 @@ dependencies = [
  "serde",
  "serde_json",
  "tempfile",
- "thiserror 2.0.18",
- "twox-hash 1.6.3",
- "ureq",
+ "thiserror 2.0.19",
+ "twox-hash 2.1.2",
+ "ureq 2.12.1",
  "zstd",
 ]
 
@@ -5923,9 +5818,9 @@ checksum = "1bc711410fbe7399f390ca1c3b60ad0f53f80e95c5eb935e52268a0e2cd49acc"
 
 [[package]]
 name = "serde"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
  "serde_core",
  "serde_derive",
@@ -5962,29 +5857,29 @@ dependencies = [
 
 [[package]]
 name = "serde_core"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 3.0.3",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
  "itoa",
  "memchr",
@@ -6333,9 +6228,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "1.0.109"
+version = "2.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6344,9 +6239,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.117"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6425,7 +6320,7 @@ dependencies = [
  "fastrand",
  "getrandom 0.4.2",
  "once_cell",
- "rustix",
+ "rustix 1.1.4",
  "windows-sys 0.61.2",
 ]
 
@@ -6449,11 +6344,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.18"
+version = "2.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
 dependencies = [
- "thiserror-impl 2.0.18",
+ "thiserror-impl 2.0.19",
 ]
 
 [[package]]
@@ -6469,13 +6364,13 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.18"
+version = "2.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.117",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -6630,8 +6525,8 @@ checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
 dependencies = [
  "serde",
  "serde_spanned",
- "toml_datetime 0.6.11",
- "toml_edit 0.22.27",
+ "toml_datetime",
+ "toml_edit",
 ]
 
 [[package]]
@@ -6643,15 +6538,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "toml_datetime"
-version = "1.1.1+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
-dependencies = [
- "serde_core",
-]
-
 [[package]]
 name = "toml_edit"
 version = "0.22.27"
@@ -6661,30 +6547,9 @@ dependencies = [
  "indexmap 2.14.0",
  "serde",
  "serde_spanned",
- "toml_datetime 0.6.11",
+ "toml_datetime",
  "toml_write",
- "winnow 0.7.15",
-]
-
-[[package]]
-name = "toml_edit"
-version = "0.25.11+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b59c4d22ed448339746c59b905d24568fcbb3ab65a500494f7b8c3e97739f2b"
-dependencies = [
- "indexmap 2.14.0",
- "toml_datetime 1.1.1+spec-1.1.0",
- "toml_parser",
- "winnow 1.0.3",
-]
-
-[[package]]
-name = "toml_parser"
-version = "1.1.2+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
-dependencies = [
- "winnow 1.0.3",
+ "winnow",
 ]
 
 [[package]]
@@ -6782,7 +6647,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97fee6b57c6a41524a810daee9286c02d7752c4253064d0b05472833a438f675"
 dependencies = [
  "cfg-if",
- "rand 0.8.6",
  "static_assertions",
 ]
 
@@ -6925,6 +6789,34 @@ dependencies = [
  "webpki-roots 0.26.11",
 ]
 
+[[package]]
+name = "ureq"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0"
+dependencies = [
+ "base64",
+ "log",
+ "percent-encoding",
+ "rustls",
+ "rustls-pki-types",
+ "ureq-proto",
+ "utf8-zero",
+ "webpki-roots 1.0.7",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e994ba84b0bd1b1b0cf92878b7ef898a5c1760108fe7b6010327e274917a808c"
+dependencies = [
+ "base64",
+ "http",
+ "httparse",
+ "log",
+]
+
 [[package]]
 name = "url"
 version = "2.5.8"
@@ -6937,6 +6829,12 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "utf8-zero"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -7040,7 +6938,6 @@ dependencies = [
  "cfg-if",
  "once_cell",
  "rustversion",
- "serde",
  "wasm-bindgen-macro",
  "wasm-bindgen-shared",
 ]
@@ -7490,15 +7387,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "winnow"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "wit-bindgen"
 version = "0.51.0"
@@ -7615,7 +7503,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
 dependencies = [
  "libc",
- "rustix",
+ "rustix 1.1.4",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 613b47b..c1fcbaa 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -39,8 +39,13 @@ serde_json = "1"
 bincode = "1.3"
 thiserror = "2"
 byteorder = "1.5"
-# Hashing for sketches
-twox-hash = "1.6"
+# Hashing for sketches. `default-features = false` drops the `random`
+# feature, whose only job is a RandomState we never construct; leaving it on
+# pulls rand 0.9 alongside the rand 0.8 DataFusion 46 already roots, for no
+# benefit. XXH64 output is fixed by the spec, so the 2.x line is
+# digest-identical to the 1.6 line every published sidecar was built with —
+# verified over the oneshot and chunked-write paths before this bump.
+twox-hash = { version = "2.1", default-features = false, features = ["std", "xxhash64"] }
 # Persistence (feedback recorder)
 rusqlite = { version = "0.39", features = ["bundled"] }
 # Logging / errors
diff --git a/deny.toml b/deny.toml
index 1e886cd..1730901 100644
--- a/deny.toml
+++ b/deny.toml
@@ -228,11 +228,26 @@ skip = [
     # Retires with the getrandom consolidation above.
     { name = "r-efi", version = "5.3.0" },
 
-    # --- twox-hash (Bloom hash path + DataFusion) ---
-    # samkhya-core pins twox-hash 1.6 for the Bloom hash path
-    # (deterministic across releases). DataFusion 46 pulls twox-hash
-    # 2.x. Both coexist; size cost negligible. Retires when DataFusion
-    # exposes a hash-builder API that lets samkhya share its 2.x.
+    # --- syn (proc-macro expansion — serde/thiserror moved first) ---
+    # syn 3.0 shipped 2026-07; the derive ecosystem is mid-migration.
+    # Paths verified with `cargo tree -i syn@<v> --workspace` on 2026-08-01:
+    #   3.0 → serde_derive 1.0.229, thiserror-impl 2.0.19  (2 roots)
+    #   2.0 → the other 18 derive crates (arrow, datafusion-macros, pyo3,
+    #         tokio, clap, wasm-bindgen, cxx, …)             (the majority)
+    # Every root on both lines is a proc-macro or build-script crate, so
+    # neither version links into a shipped artifact; the cost is compile
+    # time. Retires when the 2.0 side of that list empties out — check by
+    # dropping this entry, not by waiting for a notification.
+    { name = "syn", version = "2.0" },
+
+    # --- twox-hash (both versions arrive through DataFusion 46) ---
+    # Corrected 2026-08-01: this entry used to claim samkhya-core pinned
+    # 1.6 and DataFusion pulled 2.x. Both versions are in fact rooted in
+    # DataFusion 46 — parquet 54.3.1 → 1.6.3, lz4_flex 0.11 → 2.1.2 — and
+    # samkhya-core's own pin was the 1.6 that made it look like ours.
+    # samkhya-core now takes 2.1 (digest-identical; XXH64 is spec-fixed),
+    # so this skip covers upstream only. Retires when parquet drops its
+    # 1.6 dependency, which the DataFusion 54 bump may already do.
     { name = "twox-hash", version = "1.6" },
 ]
 skip-tree = []
diff --git a/samkhya-gpudb/scripts/package-lock.json b/samkhya-gpudb/scripts/package-lock.json
index cb5c9e5..6c086a1 100644
--- a/samkhya-gpudb/scripts/package-lock.json
+++ b/samkhya-gpudb/scripts/package-lock.json
@@ -472,9 +472,9 @@
       }
     },
     "node_modules/@types/node": {
-      "version": "26.1.1",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.1.tgz",
-      "integrity": "sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==",
+      "version": "26.1.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.2.tgz",
+      "integrity": "sha512-Vu4a5UFA9rIIFJ7rB/Vaafh9lrCQszopTCx6KjFboXTGQbPNasehVR5TEiithSDGyd1DEiUByggTZsg8jukeIg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -879,9 +879,9 @@
       }
     },
     "node_modules/tsx": {
-      "version": "4.22.1",
-      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.22.1.tgz",
-      "integrity": "sha512-TvncJykhxAzFCk0VQZKBTClall4Pm7qXDSodb6uxi8QFa8X8mT6ABjxxsQ2opDRYxG7AzcRWXaFtruz5HJKuWg==",
+      "version": "4.23.4",
+      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.4.tgz",
+      "integrity": "sha512-ZiUQ8oT/KzN51mJUWPqARYqwFLFJZtGZipRkw1ynHMr9vy3eU77m5yfF3Gzm6meEg/beW+lUu3fHYgskTN2oVQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/samkhya-gpudb/scripts/requirements-llm.txt b/samkhya-gpudb/scripts/requirements-llm.txt
index 1bbb378..6cfef3a 100644
--- a/samkhya-gpudb/scripts/requirements-llm.txt
+++ b/samkhya-gpudb/scripts/requirements-llm.txt
@@ -1,3 +1,3 @@
 # Primary Python LLM transport; current releases require Python 3.10+.
-fastapi==0.136.1; python_version >= "3.10"
-uvicorn==0.47.0; python_version >= "3.10"
+fastapi==0.140.13; python_version >= "3.10"
+uvicorn==0.51.0; python_version >= "3.10"

From a4940265073ad438d7933d61e9682e64a93b523b Mon Sep 17 00:00:00 2001
From: Prateek Singh <42719720+singhpratech@users.noreply.github.com>
Date: Sun, 2 Aug 2026 12:09:07 -0400
Subject: [PATCH 2/2] test(residual): drain the mock's request before answering
 it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`core-all` went red on the dependency batch with

    residual::llm_http_tests::mock_clamps_to_ceiling
    left: None  right: Some(500)

which is not a dependency regression. `mock_success_returns_clamped_estimate`
exercises the identical mock, transport and JSON path and passed in the
same run, and samkhya-core's HTTP client (ureq 2.12.1) is byte-identical
to main — the duckdb bump's ureq 3.3.0 is a separate, unrelated node.

The mock served one `read()` per connection and called that the whole
request. It isn't, however small the payload: a read returns one
segment's worth, and the header block and JSON body can arrive
separately. When they do, the server replies and drops the socket with
body bytes still in its receive queue, the kernel answers those
leftovers with an RST rather than a FIN, and the RST discards the
response out of the client's receive buffer. ureq reports ECONNRESET,
the corrector's failure contract converts that to `Ok(None)`, and a
green-path assertion fails as though the endpoint were down.

Confirmed rather than assumed — a standalone repro drives the split
directly. With the old single-read server the client gets `Connection
reset by peer` at 3/3 timing configurations; with the request drained it
gets the response at 3/3.

So the fix is to read the request in full: to the `\r\n\r\n`
terminator, then exactly `Content-Length` more bytes. Still not a
general HTTP parser — it handles what the corrector sends and nothing
else.

Worth noting the failure mode this class of bug hides behind. The
corrector is *designed* to swallow transport errors so a downed LLM
endpoint can never fail a query, which means a broken transport and a
working one that returns nothing are indistinguishable at the
assertion. A flake here reads as a bad estimate, not a dropped
connection.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 samkhya-core/src/residual.rs | 72 ++++++++++++++++++++++++++++++++----
 1 file changed, 64 insertions(+), 8 deletions(-)

diff --git a/samkhya-core/src/residual.rs b/samkhya-core/src/residual.rs
index 1e1ae84..3305412 100644
--- a/samkhya-core/src/residual.rs
+++ b/samkhya-core/src/residual.rs
@@ -1480,12 +1480,61 @@ mod llm_http_tests {
     };
     use super::{CorrectionFeatures, Corrector};
     use std::io::{Read, Write};
-    use std::net::TcpListener;
+    use std::net::{TcpListener, TcpStream};
     use std::sync::atomic::{AtomicUsize, Ordering};
     use std::sync::{Arc, Mutex};
     use std::thread;
     use std::time::Duration;
 
+    /// Read one HTTP request off `stream` in full: everything up to the
+    /// `\r\n\r\n` header terminator, then exactly `Content-Length` more
+    /// bytes. Returns the raw request, or `None` if the peer hung up or
+    /// the read timeout fired before a complete one arrived.
+    ///
+    /// Deliberately not a general HTTP parser — it handles what the
+    /// corrector sends (one POST, explicit `Content-Length`, no chunked
+    /// encoding, no `Expect: 100-continue`) and nothing more.
+    fn drain_request(stream: &mut TcpStream) -> Option<Vec<u8>> {
+        let mut req: Vec<u8> = Vec::with_capacity(512);
+        let mut buf = [0u8; 4096];
+
+        // Phase 1 — read until the header terminator is in hand.
+        let body_start = loop {
+            match stream.read(&mut buf) {
+                Ok(0) | Err(_) => return None,
+                Ok(n) => {
+                    req.extend_from_slice(&buf[..n]);
+                    if let Some(p) = req.windows(4).position(|w| w == b"\r\n\r\n") {
+                        break p + 4;
+                    }
+                }
+            }
+        };
+
+        // Phase 2 — read the declared body. A request without a
+        // Content-Length has no body to wait for, so the headers alone
+        // are the whole request.
+        let content_length = std::str::from_utf8(&req[..body_start])
+            .ok()
+            .and_then(|head| {
+                head.lines()
+                    .find_map(|line| {
+                        line.split_once(':')
+                            .filter(|(name, _)| name.trim().eq_ignore_ascii_case("content-length"))
+                    })
+                    .and_then(|(_, value)| value.trim().parse::<usize>().ok())
+            })
+            .unwrap_or(0);
+
+        while req.len() - body_start < content_length {
+            match stream.read(&mut buf) {
+                Ok(0) | Err(_) => break,
+                Ok(n) => req.extend_from_slice(&buf[..n]),
+            }
+        }
+        Some(req)
+    }
+
     /// Tiny hand-rolled mock HTTP server, one-shot per accept. We avoid
     /// pulling `mockito` (not currently a dep) and keep the test binary
     /// lean. The server reads the full request, then writes a fixed
@@ -1509,13 +1558,20 @@ mod llm_http_tests {
                 let Ok(mut stream) = stream else { continue };
                 let _ = stream.set_read_timeout(Some(Duration::from_secs(2)));
                 let _ = stream.set_write_timeout(Some(Duration::from_secs(2)));
-                // Drain HTTP request: read headers + body. We pull a
-                // bounded chunk; the bench client sends tiny payloads
-                // (sub-200 bytes) so this is sufficient for the tests
-                // and avoids the parsing complexity of a full HTTP
-                // server.
-                let mut buf = [0u8; 4096];
-                let _ = stream.read(&mut buf);
+                // Drain the *whole* request — headers and body — before
+                // answering. One `read` is not enough, however small the
+                // payload: it returns one segment's worth, and ureq can
+                // put the header block and the JSON body in separate
+                // segments. If we reply and drop the socket with body
+                // bytes still unread, the kernel answers the leftovers
+                // with an RST instead of a FIN, and that RST discards the
+                // response we just wrote out of the client's receive
+                // buffer. ureq then reports a transport error, the
+                // corrector's failure contract turns it into `Ok(None)`,
+                // and a green-path assertion fails as if the endpoint
+                // were down — which is exactly how this surfaced on a
+                // loaded CI runner while passing every local run.
+                let _ = drain_request(&mut stream);
                 let idx = counter_thread.fetch_add(1, Ordering::SeqCst);
                 let body = responder.lock().unwrap()(idx);
                 let header = format!(