diff --git a/lib/database.cc b/lib/database.cc
index dcfad8cf..f39d4485 100644
--- a/lib/database.cc
+++ b/lib/database.cc
@@ -1410,8 +1410,15 @@ notmuch_database_upgrade (notmuch_database_t *notmuch,
 	(NOTMUCH_FEATURE_FILE_TERMS | NOTMUCH_FEATURE_BOOL_FOLDER |
 	 NOTMUCH_FEATURE_LAST_MOD)) {
 	query = notmuch_query_create (notmuch, "");
-	total += notmuch_query_count_messages (query);
+	unsigned msg_count;
+
+	status = notmuch_query_count_messages_st (query, &msg_count);
+	if (status)
+	    goto DONE;
+
+	total += msg_count;
 	notmuch_query_destroy (query);
+	query = NULL;
     }
     if (new_features & NOTMUCH_FEATURE_DIRECTORY_DOCS) {
 	t_end = db->allterms_end ("XTIMESTAMP");
@@ -1492,6 +1499,7 @@ notmuch_database_upgrade (notmuch_database_t *notmuch,
 	}
 
 	notmuch_query_destroy (query);
+	query = NULL;
     }
 
     /* Perform per-directory upgrades. */
@@ -1612,6 +1620,9 @@ notmuch_database_upgrade (notmuch_database_t *notmuch,
 	sigaction (SIGALRM, &action, NULL);
     }
 
+    if (query)
+	notmuch_query_destroy (query);
+
     talloc_free (local);
     return status;
 }
diff --git a/lib/notmuch.h b/lib/notmuch.h
index 87756838..3706fed9 100644
--- a/lib/notmuch.h
+++ b/lib/notmuch.h
@@ -984,10 +984,26 @@ notmuch_threads_destroy (notmuch_threads_t *threads);
  * This function performs a search and returns the number of matching
  * messages.
  *
- * If a Xapian exception occurs, this function may return 0 (after
- * printing a message).
+ * @returns
+ *
+ * NOTMUCH_STATUS_SUCCESS: query completed successfully.
+ *
+ * NOTMUCH_STATUS_XAPIAN_EXCEPTION: a Xapian exception occured. The
+ *      value of *count is not defined.
  */
-unsigned
+notmuch_status_t
+notmuch_query_count_messages_st (notmuch_query_t *query, unsigned int *count);
+
+/**
+ * like notmuch_query_count_messages_st, but without a status return.
+ *
+ * May return 0 in the case of errors.
+ *
+ * @deprecated Deprecated since libnotmuch 4.3 (notmuch 0.21). Please
+ * use notmuch_query_count_messages_st instead.
+ */
+NOTMUCH_DEPRECATED(4,3)
+unsigned int
 notmuch_query_count_messages (notmuch_query_t *query);
 
 /**
@@ -998,11 +1014,31 @@ notmuch_query_count_messages (notmuch_query_t *query);
  * search.
  *
  * Note that this is a significantly heavier operation than
- * notmuch_query_count_messages().
+ * notmuch_query_count_messages{_st}().
  *
- * If an error occurs, this function may return 0.
+ * @returns
+ *
+ * NOTMUCH_STATUS_OUT_OF_MEMORY: Memory allocation failed. The value
+ *      of *count is not defined
+
+ * NOTMUCH_STATUS_SUCCESS: query completed successfully.
+ *
+ * NOTMUCH_STATUS_XAPIAN_EXCEPTION: a Xapian exception occured. The
+ *      value of *count is not defined.
  */
-unsigned
+notmuch_status_t
+notmuch_query_count_threads_st (notmuch_query_t *query, unsigned *count);
+
+/**
+ * like notmuch_query_count_threads, but without a status return.
+ *
+ * May return 0 in case of errors.
+ *
+ * @deprecated Deprecated as of libnotmuch 4.3 (notmuch 0.21). Please
+ * use notmuch_query_count_threads_st instead.
+ */
+NOTMUCH_DEPRECATED(4,3)
+unsigned int
 notmuch_query_count_threads (notmuch_query_t *query);
 
 /**
diff --git a/lib/query.cc b/lib/query.cc
index 8cf0a077..e627bfc2 100644
--- a/lib/query.cc
+++ b/lib/query.cc
@@ -541,8 +541,18 @@ notmuch_threads_destroy (notmuch_threads_t *threads)
     talloc_free (threads);
 }
 
-unsigned
+unsigned int
 notmuch_query_count_messages (notmuch_query_t *query)
+{
+    notmuch_status_t status;
+    unsigned int count;
+
+    status = notmuch_query_count_messages_st (query, &count);
+    return status ? 0 : count;
+}
+
+notmuch_status_t
+notmuch_query_count_messages_st (notmuch_query_t *query, unsigned *count_out)
 {
     notmuch_database_t *notmuch = query->notmuch;
     const char *query_string = query->query_string;
@@ -605,35 +615,44 @@ notmuch_query_count_messages (notmuch_query_t *query)
 			       "Query string was: %s\n",
 			       error.get_msg().c_str(),
 			       query->query_string);
-
+	return NOTMUCH_STATUS_XAPIAN_EXCEPTION;
     }
 
-    return count;
+    *count_out = count;
+    return NOTMUCH_STATUS_SUCCESS;
 }
 
 unsigned
 notmuch_query_count_threads (notmuch_query_t *query)
+{
+    notmuch_status_t status;
+    unsigned int count;
+
+    status = notmuch_query_count_threads_st (query, &count);
+    return status ? 0 : count;
+}
+
+notmuch_status_t
+notmuch_query_count_threads_st (notmuch_query_t *query, unsigned *count)
 {
     notmuch_messages_t *messages;
     GHashTable *hash;
-    unsigned int count;
     notmuch_sort_t sort;
-    notmuch_status_t status;
+    notmuch_status_t ret = NOTMUCH_STATUS_SUCCESS;
 
     sort = query->sort;
     query->sort = NOTMUCH_SORT_UNSORTED;
-    status = notmuch_query_search_messages_st (query, &messages);
-    if (status)
-	return 0;
-
+    ret = notmuch_query_search_messages_st (query, &messages);
+    if (ret)
+	return ret;
     query->sort = sort;
     if (messages == NULL)
-	return 0;
+	return NOTMUCH_STATUS_XAPIAN_EXCEPTION;
 
     hash = g_hash_table_new_full (g_str_hash, g_str_equal, NULL, NULL);
     if (hash == NULL) {
 	talloc_free (messages);
-	return 0;
+	return NOTMUCH_STATUS_OUT_OF_MEMORY;
     }
 
     while (notmuch_messages_valid (messages)) {
@@ -642,7 +661,7 @@ notmuch_query_count_threads (notmuch_query_t *query)
 	char *thread_id_copy = talloc_strdup (messages, thread_id);
 	if (unlikely (thread_id_copy == NULL)) {
 	    notmuch_message_destroy (message);
-	    count = 0;
+	    ret = NOTMUCH_STATUS_OUT_OF_MEMORY;
 	    goto DONE;
 	}
 	g_hash_table_insert (hash, thread_id_copy, NULL);
@@ -650,13 +669,13 @@ notmuch_query_count_threads (notmuch_query_t *query)
 	notmuch_messages_move_to_next (messages);
     }
 
-    count = g_hash_table_size (hash);
+    *count = g_hash_table_size (hash);
 
   DONE:
     g_hash_table_unref (hash);
     talloc_free (messages);
 
-    return count;
+    return ret;
 }
 
 notmuch_database_t *