Convert null-consistency and time-array count checks in
TimeSeriesChecker from f-string SQL to ibis filter/group_by/join
expressions, and replace duckdb.sql() in csv_io with rel.project().

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ibis-sqlite's create_table calls con.commit() internally, which silently
terminated any outer BEGIN — DDL inside transaction() blocks survived
rollback. Wrap the underlying sqlite3.Connection in a no-commit proxy for
the duration of the transaction so DDL is now genuinely covered by
rollback.

Drop the unused `created` cleanup list from transaction(); no caller
populated it. transaction() is now a thin DB BEGIN/COMMIT/ROLLBACK
wrapper, with semantics documented per backend.

Wrap apply_mapping and _intermediate_mapping_ymdp_to_ymdh in
transaction() so DuckDB and SQLite get atomic rollback of the multi-step
DDL for free. Spark falls back to manual cleanup. The output_file
parquet (not transactional) is unlinked on failure.

Drop the redundant DuckDB and Spark write_parquet overrides — the base
class already delegates to ibis's to_parquet, which uses server-side
COPY/native partitioning.

Switch the quick_start doc example from pandas-style ibis indexing to
filter()/select(), matching the codebase idiom.

Add backend-parametric regression tests for transactional DDL on both
DuckDB and SQLite.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Reviewer-flagged: ``apply_mapping`` was deleting the existing
``output_path`` before renaming the staged output into place, which
opened a window where a failure or process crash left the user with
neither the old output nor the new one — contradicting the docstring's
"prior on-disk state is restored" claim.

Replace the delete-then-rename sequence with a backup-rename-replace
pattern: rename the existing target aside to a sibling
``.<name>.backup.<uid>`` path, rename staging into the target, then
delete the backup. If the second rename fails, restore the backup so
the original is preserved. Each ``Path.replace`` call is atomic, and
the user's data is never simultaneously absent from both target and
backup.

Add ``test_map_table_preserves_existing_parquet_on_promotion_failure``,
which monkey-patches ``Path.replace`` to fail on the staging→target
call and asserts the pre-existing parquet is preserved with no debris
left over.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Reviewer-flagged: ``delete_if_exists(backup_path)`` ran inside the same
try block as the mapping work, so any failure cleaning up the backup
caused ``apply_mapping`` to re-raise. ``Store.map_table_time_config``
then skipped its ``add_schema`` call and the user was left with the new
parquet on disk but no schema registration — the store believed the
mapping had failed.

Wrap the backup cleanup in try/except + warning. The promotion already
succeeded by this point and the new output is observable; a leftover
backup is cosmetic debris that the user can remove manually.

Add ``test_map_table_succeeds_when_backup_cleanup_fails`` which
monkey-patches ``delete_if_exists`` to fail for backup paths only and
asserts the mapping completes, the new content is in place, and the
schema is registered — matching the reviewer's exact reproducer.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Three correctness improvements to transaction handling, motivated by a
review of the branch:

- Cleanup paths (Store.ingest_*, apply_mapping,
  _intermediate_mapping_ymdp_to_ymdh) no longer mask the original error.
  A connectivity failure on Spark inside drop_table during rollback
  previously replaced the user-visible InvalidTable, leaving callers
  debugging the wrong thing. Each cleanup step is now individually
  guarded; failures are logged via logger.exception and swallowed so the
  bare raise propagates the cause. Adds
  test_ingest_cleanup_failure_does_not_mask_original_error as a
  regression test.

- DuckDBBackend and SparkBackend now initialize self._in_transaction in
  __init__ to match SQLiteBackend. The class-level default on
  IbisBackend is dropped in favor of a docstring contract that
  subclasses must initialize the instance attribute, eliminating the
  attribute-shadowing trick.

- Docstrings on ingest_tables, ingest_from_csvs, and
  ingest_pivoted_tables now spell out that Spark cannot roll back
  partial appends to a pre-existing table; only the new-table case is
  fully cleaned up on failure.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Removing the class-level default in 6af444c left mypy unable to infer
the type of ``self._in_transaction`` when read from the base class's
``transaction()`` method. Add a bare ``_in_transaction: bool`` annotation
on ``IbisBackend`` to declare the attribute's type without giving it a
value (subclasses still must initialize it in ``__init__``), and drop
the now-stale ``# type: ignore[assignment]`` on the SQLite proxy swap.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ibis-pyspark's ``to_parquet`` forwards ``partition_by`` as a kwarg to
``df.write.format('parquet').save(path, **kwargs)``. PySpark's writer
expects camel-cased ``partitionBy``; the snake_case kwarg is silently
dropped as an unknown option, so partitioned writes fell out as a
single unpartitioned directory. (DuckDB's native ``to_parquet`` accepts
``partition_by`` directly, so this only broke on Spark.)

Override ``write_parquet`` on ``SparkBackend`` to call
``df.write.partitionBy(*cols).parquet(path)`` directly when partition
columns are given, falling back to the ibis path otherwise.

Fixes ``test_spark_write_parquet_partitioned``.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- TimeZoneLocalizerByColumn._get_time_zones() previously rejected only
  the *mixed* case of the literal 'None' string (the get_tzname(None)
  sentinel) plus real time zones. The all-'None' case slipped through
  and crashed with ZoneInfoNotFoundError on ZoneInfo('None'). Tighten
  the check to reject 'None' whenever it appears, with a message
  pointing the user to localize_time_zone(None) for tz-naive rows. Add
  test_localize_time_zone_by_column_rejects_none_sentinel as a
  regression test.

- SQLiteBackend.insert() now wraps con.cursor() in
  contextlib.closing so the cursor is deterministically closed even on
  executemany failure or non-CPython runtimes. (Cursor close is
  independent of transaction state — commit still happens on the
  connection afterwards via _commit_if_needed.)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

The previous run failed in CI because codecov-action v4.2.0 crashed
during its uploader binary fetch (`Could not pull latest version
information: SyntaxError: Unexpected token '<'` followed by a
`write EPIPE` from the gpg verification subprocess). That failure
mode is not caught by `fail_ci_if_error: false` on v4, and was
fixed in the v5 series (which uses the Codecov CLI directly).

Also pin `files: coverage.xml` to skip the auto-discovery walk —
we already produce that exact path with
`pytest --cov-report=xml:coverage.xml`.

Sticking on v5 (not v6) so the action keeps running on Node.js 20;
the runners don't default to Node 24 until 2026-06-02.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>