[#3918 sub-issue][SQL Server][2/3] Tiberius adapter and shared-runtime integration #4360

Pre-filing checklist

• I searched existing issues and didn't find a duplicate

Component(s)

Rust OTAP dataflow (rust/otap-dataflow/), SQL Server driver adapter, row normalization, and shared scraper delivery integration.

Objective

Land the SQL Server DriverAdapter on top of Part 1, using Tiberius and the existing shared polling controller.

Result of this layer: tested driver execution and shared delivery integration through an injected connection interface. The public receiver is not registered until Part 3.

Rationale

Review metadata, type fidelity, asynchronous lifecycle, and delivery behavior separately from TLS transport construction and public node activation. Keep scheduling, admission, ACK/NACK handling, checkpoints, ownership, and telemetry in the shared scraper.

Scope

• Introduce an optional, crates.io-published Tiberius dependency using default-features = false and the tds73,native-tls features. Use Tiberius 0.13.0 as the initial migration target and commit the reviewed Cargo lockfile. Keep the SQL Server database-system identity and driver dependency out of the shared scraper. The SQL Server TLS path uses platform-native libraries rather than the application's Rustls crypto-* selection.
• Acquire current SQL credentials from BasicAuthProvider for connection/reconnection; reject unusable credentials and never construct credential-bearing SQL or connection strings.
• Describe and validate live result metadata, including cursor nullability, native range/precision, supported types, and schema compatibility.
• Bind cursor and page-limit values using driver APIs; stream and normalize supported rows into shared values and cursors, preserving exact decimals and temporal meaning.
• Apply normalized-page row/byte limits, complete-snapshot-or-error behavior, and safe incremental-prefix handling.
• Preserve absolute operation deadlines, generation-scoped cancellation, response-completion tracking, and redacted error/driver-trace handling. Attempt ATTENTION under the existing one-second cleanup cap. If cleanup cannot be confirmed, discard the connection, return no partial page from the failed operation, leave its checkpoint unchanged, and report cleanup/shutdown failure while preserving the shared ownership safeguard. Do not automatically reconnect or reuse a session after unconfirmed cleanup.
• Exercise the adapter through the shared controller, including ACK/checkpoint behavior, using deterministic driver/protocol fixtures.

Primary files: adapter.rs, data.rs, session.rs, error.rs, and adapter_tests.rs, plus DatabaseSystem::SqlServer, dependency wiring, and adapter documentation.

Excluded: the production TCP/TLS connector, receiver factory/URN registration, and real-server fixture automation; those belong to Part 3.

Acceptance Criteria

• This layer builds on Part 1 and passes adapter/conversion/protocol tests without Part 3's connector or factory.
• Tests cover native binding and conversion fidelity, metadata mismatch, page limits, snapshot overflow, deadlines, cancellation generations, cleanup failures, and redacted diagnostics.
• Shared-controller tests demonstrate that acknowledged progress is persisted without creating a SQL Server-specific checkpoint or polling runtime.
• Tiberius remains independently opt-in and resolves from crates.io with the selected native-TLS feature set. The lockfile contains no Git-sourced Tiberius or Tiberius proc-macro dependency. The scoped platform-native TLS choice is explicitly reconciled with maintainers and documented without changing other components' crypto-provider behavior.
• Deterministic tests cover split-message cancellation acknowledgements, missing/late acknowledgements, cleanup interrupted by an outer timeout, and transport reset during streaming. Unconfirmed cleanup returns no page, does not advance the failed operation's checkpoint, prevents another operation/reconnect, and leaves shutdown unsuccessful with ownership retained. Successful acknowledgement remains distinguishable from containment.
• Driver-internal allocations are explicitly distinguished from normalized/encoded page budgets; no RSS or exactly-once guarantee is claimed.
• Existing Oracle behavior remains unchanged; the focused PR is reviewed and merged after Part 1.

Dependencies or Blockers

Parent: #3918. Depends on Part 1: Configuration and T-SQL query preparation (#4359) and precedes Part 3: Verified TLS connector and receiver activation (#4361).

The selected direction is published Tiberius with native-tls; it does not require the provider-neutral Rustls feature from tiberius-rs/tiberius#456. Remove the temporary Git pin in PR #4389, update the lockfile and documentation, and validate the exact selected registry dependency graph. A Git pin or producer-local patch is not the release solution.

The split-message cancellation defect described in tiberius-rs/tiberius#459, with proposed fix tiberius-rs/tiberius#460, remains unresolved in the evaluated release. Fail-closed containment is accepted for this implementation direction, so publication of that fix is follow-up work rather than a prerequisite to selecting the driver. Containment still requires regression coverage here and native-TLS qualification in Part 3.

Additional Context