[gouhongshen]

What type of PR is this?

• API-change
• BUG
• Improvement
• Documentation
• Feature
• Test and CI
• Code Refactoring

Which issue(s) this PR fixes:

Fixes #29944

What this PR does / why we need it:

quantileExactWeighted has no entry anywhere in the SQL stack: the parser grammar carries no token or aggregate rule (so quantileExactWeighted(...) OVER (...) and DISTINCT forms fail to parse), the function registries carry no quantileexactweighted key (flat calls return (20105, "not supported: function or operator")), and the exact-percentile executors (median / approx_percentile / percentile_cont / percentile_disc) retain only unweighted value rows. Unweighted PERCENTILE_CONT computes a different statistic: on the issue's fixture it interpolates 3 where the weighted lower-CDF threshold selects 2.

This PR adds the native exact weighted percentile quantileExactWeighted(value, weight, level) computing min { v present : F(v) >= k } with k = ceil(level * W) in exact big-integer arithmetic:

• Grammar: a QUANTILE_EXACT_WEIGHTED aggregate rule with DISTINCT and window support, the keyword map entry, and mysql_sql.go regenerated through the repository's in-tree goyacc make target under its zero-conflict gate; a parser UT covers the plain, DISTINCT, window-partition and window-ROWS-frame forms, and the full parser corpus passes.
• Registration/binding: function id 616 in both registries (re-issued from the pre-merge draft 606 when upstream feat: technical-indicator window kernels and rolling risk analytics #31017's indicator kernels allocated 605-615; the design's first-unassigned-id rule, recorded in the document's second post-merge annotation); typed weight admission (int widths, BIT, UINT64, FLOAT32/64, DECIMAL64/128) with DECIMAL256 rejected at bind; flat three-argument layout whose level parameter is constant-or-prepared configuration, re-evaluated per EXECUTE through the shared validated percentile codec; sliding time-window contexts rejected like the ordered-set percentiles.
• Executor (new pkg/sql/colexec/aggexec/quantile_exact_weighted.go): weights validated in their own type before exact uint64 conversion with a total-overflow abort; the paired-NULL rule; DISTINCT deduplicates exact (value, weight) typed pairs; typed saved state with interim wire and spill round trips; finalization restores one group's typed value rows once while converting every retained weight exactly once in the same arena scan (per-group temporary footprint is the restored value rows plus the 8-byte-per-row sort selectors and converted uint64 collapse weights — (valueWidth + 16) × N plus the result/bitmap tail — with no second pair-payload copy), sorts through an interruptible in-package heap order whose comparator reproduces SortByVectors' SQL-order relation exactly, checks context at chunk entry, per-row entry, the restore scan, inside the sort at a bounded swap cadence and the cumulative scan at a bounded row cadence, frees partially built results only on the error path, transfers successful output ownership to the caller, and constructs retained-pair errors only inside failing branches so a valid finalization reports no errors.
• Window: admitted beside the ordered-set percentiles for full-partition frames (ordered-set fast path) and sliding ROWS frames (generic per-frame path); the window binder carries DISTINCT through for this aggregate exactly like the group-aggregate binder records it, while every other DISTINCT window aggregate stays NYI.
• Distributed: destination-verified remote dispatch gated on MORPC protocol 131 at encode time (requiredProtocol floor over pipelines containing the aggregate), send time (per-destination stream confirmation) and compile time (AllCNsSupportProtocol fast-fail plus the coordinator self-gate).

Issue-to-test proof (#29944)

• Red/green on the assigned base e3a6ffe27c: the identical self-contained BVT file test/distributed/cases/function/func_aggr_weighted_quantile.test (76 statements) fails on the clean base - the issue's own probe is rejected 3/3 with (20105, "not supported: function or operator 'quantileexactweighted'") and the compared mo-tester run passes only 47/76 with every quantileExactWeighted statement failing (20105 bind rejections for flat calls, SQL parser errors for window/DISTINCT forms) - and passes 76/76 at a 100% success rate on this branch, where the issue fixture returns 2 beside the 3.0 unweighted control.
• Every generated BVT value was hand-verified against exact k = ceil(level * W) mathematics before adoption: GROUP BY partitions, full-partition and cumulative-ROWS windows, DISTINCT windows (distinct 2.0 vs plain 6.0 with the dedup row flipping inside both a partition and a bounded frame), ties, zero-weight endpoints (trailing zero weight at level 1, massless leading value at level 0, all-zero group), empty and all-skipped groups returning NULL, typed UINT64 weights above 2^53 accepted exactly (W=18014398509481985, k=9007199254740993 = F(1)), DECIMAL(20,0) and literal weights, prepared levels re-evaluated per EXECUTE (0.25 -> -1, 0.75 -> 4), and the documented rejections (level out of range, fractional and negative weights, DECIMAL(65,0) weight rejected at bind).

Validation

Executed locally on the final tree (macOS/arm64, native cgo artifacts built by make cgo), using .agents/skills/mo-dev/scripts/mo-cgo-test as the repository CGo wrapper:

• --count=1 -run 'TestQuantile|TestAccounted...AllocationFailure' ./pkg/sql/colexec/aggexec/ -> ok: the executor matrix (issue fixture, endpoints, 128-bit threshold arithmetic, typed-weight witnesses, overflow with allocated-memory accounting, merge equivalence, wire round trips, DISTINCT + spill, dispatch/config guards, the Flush -> executor-free -> repeated-read output-ownership witness), the rewritten large-group cancellation witness with deterministic flip points mid-restore, at sort entry, deep inside the sort's element work, mid cumulative scan and between groups (leak-free on every abort), the sort-interruption unit witnesses (pre-cancelled context stops the sort with zero element moves; mid-work abort after the bounded swap checkpoint), the ordering-parity witness against SortByVectors for every supported value type (NaN/±Inf/−0/+0/extremes/duplicates), the 8192-row peak-scratch witness (measured within (valueWidth + 16) × N and admitted under an enforced-budget account) and the two allocation-failure sweep cases green.
• --count=1 -run 'TestWindowQuantileExactWeighted' ./pkg/sql/colexec/window/ -> ok: full-partition broadcast, retained-partition-result survival after executor destruction across output chunks, and DISTINCT windows over a full partition and a bounded frame, plus the 40000-row large-partition cancellation regression (a context cancelled after Prepare makes vm.Exec return the standard cancellation error before any partition result is broadcast; the finalize's own mid-work abort points are pinned by the executor-level regression).
• --count=1 -run 'TestQuantileExactWeighted|TestPreflightQuantileExactWeighted' ./pkg/sql/compile/ -> ok: prepared-level preflight and reuse, config extraction keeping original argument types, the protocol-131 floor, the 129/130/131 dispatch matrix (including a worker advertising only upstream's temporal 130), the coordinator self-gate and the stream-confirmation seam.
• --count=1 -run 'TestQuantileExactWeightedDistinctWindowBinding|TestBindWindowFuncExprValidationAndHelpers|TestPreparedQuantileExactWeightedParameters' ./pkg/sql/plan/ -> ok.
• Full normal-mode owning packages: ./pkg/sql/colexec/aggexec/, ./pkg/sql/colexec/window/, ./pkg/sql/compile/, ./pkg/sql/plan/, ./pkg/defines/ all ok; the full parser corpus and ./pkg/sql/plan/function/ also pass.
• BVT via the shared mo-tester against an isolated local service: genrs regenerated the checkpoint, every value inspected, compared run 76/76 with run exit 0 on this branch and 47/76 with run exit 1 on the clean base build.
• gofmt -l empty over all changed Go files; go vet clean on all owning packages.

Residual risks / follow-ups

• Only quantileExactWeighted carries DISTINCT through windows; generalizing DISTINCT windows to other aggregates is out of scope here.
• Sliding ROWS frames recompute per frame through the generic aggregate path; the full-partition fast path covers the common case.
• The MORPC-131 mixed-version gates are proven at seam/UT level and by single-process SQL; a real multi-CN mixed-version cluster remains CI territory.
• The BVT checkpoint embeds current diagnostic wording; unrelated wording drift would need one checkpoint regeneration, as with any BVT result.

Design gate: recorded approval

This feature triggers the mandatory design-first gate (new public SQL API, cross-package aggregate state, mixed-version MORPC dispatch; contract at .agents/skills/mo-dev/references/feature-design-review.md). Review order was honored end to end: a versioned design document was written first and reviewed in five design-only rounds while implementation stayed blocked — four REQUEST_CHANGES decisions (revisions 1-4; each returned blocker and its fix is recorded in the document's own revision log: typed weight admission, exact big.Int threshold domain, destination-verified MORPC protocol gating, typed saved-state schema, finalization resource and output ownership) — and then:

• Reviewed design: docs/design/20261023-exact-weighted-percentiles.md, revision 5. The approved revision-5 content is SHA256 b2705c13ab4d3f9965ab3d83a6f3e4a83d3426e4ffefdcdc8b6713864c69e083, byte-preserved at commit 60d88ff6adb4ae6ea9e1ba0946ee82bc61f26ea7 (the commit that introduced the document), so the reviewed bytes remain verifiable against that hash.
• Reviewer: independent design-review session, separate from the implementing author (issue-fix loop review session 01a16996-b2e8-76a1-aa31-f47fd5a0737d), applying the repository's feature-design-review contract; design-only checkpoint, no repository state modified during the review.
• Decision: PASS, 2026-10-24 — "Numerical semantics, typed saved state, destination protocol gates and corrected output ownership are coherent with the inspected code. No blocking design findings remain." One non-blocking P3 (exercise executor destruction before retained-result reads); the window UT covers it (flush -> executor teardown -> retained-result reads -> caller release).
• Document/PR reconciliation: commit 0afd975232 records this decision inside the design document itself — its Status section now states the approval (decision, date, reviewer, reviewed revision and content hash) and the header links this PR, replacing the pre-review "pending" wording. Documentation-only annotation; no reviewed decision, invariant, or validation plan changed.
• The separate implementation review reused this recorded design approval, verified the implementation against the design, and returned its own PASS.

CI follow-up: race-mode UT failure fixed

The UT Test on Ubuntu/x86 job runs the unit tests with -race, where pkg/container/vector's race build (compile_config_race.go -> checkType) enforces generic access typing. TestQuantileExactWeightedEmptyAndSkippedGroups appended the untyped literals 0/1 through vector.AppendFixed into T_float64 vectors, binding the generic parameter to int: under -race the weight append panicked with type mismatch: casting float64 vector to []int (surfaced by the test's deferred allocation check, 0 expected vs 557056 actual), while a non-race build silently wrote int bit patterns into the float64 weights. The two literals are now the float64 literals 0.0/1.0, so the generic binds to the vector's element type. A sweep of the other generic vector call sites this PR adds found no similar untyped-literal misuse.

• Red/green at the pushed head 3fb5563e with the repository wrapper: .agents/skills/mo-dev/scripts/mo-cgo-test -race -count=1 -run '^TestQuantileExactWeightedEmptyAndSkippedGroups$' ./pkg/sql/colexec/aggexec failed with the exact CI signature (checkType panic reached through AppendFixed at quantile_exact_weighted_test.go:135), and passes after the change.
• Package-level race parity for the failed CI job on the fixed tree: .agents/skills/mo-dev/scripts/mo-cgo-test -race -count=1 ./pkg/sql/colexec/aggexec -> ok (31.8s), zero failing tests.
• Regression and static checks: focused normal-mode -run 'TestQuantileExactWeighted' on the same package passes; gofmt and go vet on the package are clean.

Review-fix round: finalization cancellation and memory conformance (D12)

The requested-changes review (mo-bot-local, commit 0afd975) returned two P2 findings on finalization — cancellation inside the sort/scan of a large group or window partition, and a temporary footprint beyond the approved resource model — and the delivered code has been conformed to the approved design revision 5 (no design decision changed, so no re-review was required).

• In-sort and in-scan cancellation (was quantile_exact_weighted.go:371): SortByVectors carried no context and the final cumulative scan had no checkpoint, so cancellation waited for the entire sort. Finalization now sorts through an executor-owned interruptible heap order (quantileSortSelectors) that checks the context at sort entry and after every 1024 elementary swaps, mirroring pkg/sort's own heapsort shape; the cumulative scan checks the same 1024-row cadence. The comparator reproduces SortByVectors' SQL-order relation per value type (integer/BIT width compares, Float32/64OrderAscCompare's deterministic NaN/−0 total order, Decimal64/128.Lt), pinned by TestQuantileSortSelectorsMatchesSortByVectors over identity selectors for every supported value type including NaN/±Inf payloads, −0.0/+0.0, width extremes and duplicates.
• Single-scan restore (was :475): the finalize path no longer materializes a typed weight column at all. restorePairs walks the retained arena once per group, restoring only the typed value rows (the sort key and UnionOne output source — the same in-flight restore orderedPercentileDiscreteExec performs) while converting every retained weight exactly once into the converted-weight scratch and accumulating the total W with the overflow abort in the same pass. Per-group temporary footprint is now (valueWidth + 16) × N plus the result/bitmap tail — 24N for INT64/UINT64 (was 32N) and 32N for two DECIMAL128 columns (was 48N) — with no second pair-payload copy.
• Regressions: TestQuantileExactWeightedCancellation was rewritten from three single-pair groups (the reviewer's stale-fixture concern) to a 4096-row group whose deterministic check sequence is learned from a counting-context warmup, pinning flips mid-restore, at the sort's entry, deep inside the sort's element work, mid cumulative scan, and between groups after partial output — each abort surfaces the cause at exactly the first cancelled check and returns the pool to its baseline. TestQuantileSortSelectorsInterruptsInsideElementWork proves a pre-cancelled context stops the sort before its first element move and a bounded-checkpoint abort stops mid-work (selectors neither identity nor fully sorted). TestQuantileExactWeightedFinalizeScratchHonorsDesignBudget arms an allocation-account controller over a real 8192-row group for INT64/UINT64, INT64-with-DECIMAL128-weight and DECIMAL128/DECIMAL128: the measured peak temporary capacity stays within — and above — the (valueWidth + 16) × N budget (the lower bound proves the restore, selectors and converted weights are genuinely simultaneous), and an admission run that denies any byte beyond the budget still finalizes the group correctly. TestWindowQuantileExactWeightedLargePartitionHonorsCancellation drives a 40000-row full-partition window with a context cancelled after Prepare and gets the standard cancellation error back through vm.Exec before any partition result is broadcast; the finalize's own mid-work abort points are pinned deterministically by the executor-level witnesses, and window partitions reuse the same FlushWithContext finalize and therefore the same cadence and budget.
• Overflow semantics are unchanged: the uint64 wrap is detected during the restore scan instead of after the sort (any accumulation order detects the same wrap), with the same invalid-input abort and error-only result cleanup. DISTINCT/merge/wire/spill state is untouched. Local evidence (mo-cgo-test): the focused aggexec executor suite plus both allocation-failure sweeps, the TestQuantileSortSelectors* interruption and ordering-parity witnesses, and the window quantile suite including the large-partition cancellation all exit 0; gofmt is clean and go vet and golangci-lint --new-from-rev report zero findings on the changed packages.

Update: semantic merge of main — MORPC capability slot re-minted 130 -> 131

Upstream main merged #30311 (5a813a324d, incomplete temporal string overloads), which independently minted MORPCVersion130 and moved the MORPCLatestVersion sentinel to 130 — the same slot this branch had drafted for quantileExactWeighted's remote-dispatch gate, leaving the PR DIRTY. Merge commit 2eecad8753 resolves it semantically; per the approved design's D10, no design decision changed, so no design re-review is required.

• pkg/defines/const.go: upstream's temporal MORPCVersion130 is kept, and this aggregate's capability version is re-minted at the next free slot — MORPCVersion131 int64 = 131 // exact weighted percentile aggregate remote dispatch — with MORPCLatestVersion moved to 131. All MORPCLatestVersion consumers use the symbol, so they follow the bump unchanged.
• The aggregate's three verified gate layers (the encodeRemoteScopeWithProtocol requiredProtocol floor, the AllCNsSupportProtocol compile-time fast-fail, the coordinator self-gate message) and the protocol UT now reference MORPCVersion131; every upstream temporal gate keeps 130. The self-gate message now reads quantileExactWeighted remote execution requires MORPC protocol version 131.
• The protocol UT gains the mixed-version counterexample the collision creates: a worker advertising only the temporal MORPCVersion130 is below the aggregate's gate and fails closed both at the inventory fast-fail (coordinator at 131, worker at 130 — supportsQuantileExactWeightedDispatch false, shuffle-group compilation refused, remote group wire unsupported) and at the pre-dispatch stream confirmation (confirming 131 against a 130 worker errors before any pipeline payload).
• The approved design document records this in its revision log as a post-merge annotation: D10's reviewed contract is that dispatch is gated by the capability version minted for THIS aggregate at whichever slot is free when it merges — only the concrete slot number moved (130 drafted pre-collision, 131 delivered), with the approved revision-5 bytes still byte-preserved at introducing commit 60d88ff6ad. No decision, invariant, layering or validation plan changed.

Validation of the merged tree (the tree that became 2eecad8753, local macOS/arm64, mo-cgo-test wrapper):

• mo-cgo-test --count=1 -run 'TestQuantileExactWeighted|TestPreflightQuantileExactWeighted' ./pkg/sql/compile/ -> exit 0: the re-minted gate floor (requiredProtocol = 131 when an encoded pipeline carries the aggregate), the coordinator self-gate message at version 131, the compile-time inventory fast-fail across 129/130/131 — including the new counterexample: coordinator at 131 with a worker advertising only the temporal 130 fails closed (supportsQuantileExactWeightedDispatch false, shuffle-group compilation refused, remote group wire unsupported) — and the pre-dispatch stream confirmation (131 accepted; the temporal-130 worker, 129 and unknown capability rejected before any payload). A -list enumeration confirms all three expected test names matched, and a -v rerun on the same tree records every PASS line, including the worker_at_temporal_gate,_below_aggregate_gate subtest.
• mo-cgo-test --count=1 -run 'TestQuantile|TestAccounted' ./pkg/sql/colexec/aggexec/ -> exit 0: the full quantile executor matrix (issue fixture, endpoints, exact threshold arithmetic, typed weights, overflow, merge, wire, DISTINCT + spill, interruptible finalize) plus every allocation accounted/sweep case on the merged tree — upstream's Decimal128 short-coefficient rework (0abc1d317a) is inside this package's dependency closure.
• mo-cgo-test --count=1 -run 'TestWindowQuantileExactWeighted' ./pkg/sql/colexec/window/ -> exit 0: full-partition broadcast, retained-result survival after executor destruction, DISTINCT windows and the 40000-row large-partition cancellation witness on the merged tree (all four expected test names enumerated via -list).
• mo-cgo-test --count=1 -run 'TestQuantileExactWeightedDistinctWindowBinding|TestBindWindowFuncExprValidationAndHelpers|TestPreparedQuantileExactWeightedParameters' ./pkg/sql/plan/ -> exit 0: binder/prepared-parameter behavior on the merged tree (upstream's base_binder/query_builder/utils changes auto-merged here; all three test names enumerated).
• mo-cgo-test --count=1 -run 'TestAggregateExecutorIDs|TestQuantileExactWeightedRegistration|TestQuantileExactWeightedCheckFnVerifiesTypedAdmission' ./pkg/sql/plan/function/ -> exit 0: the executor/function-id registry test (function id equality across both registries; 606 at that time, 616 after the second merge renumber) and typed-admission/registration checks on the merged tree.
• mo-cgo-test --count=1 ./pkg/sql/parsers/... -> exit 0: the full parser corpus (pkg/sql/parsers, dialect/mysql, dialect/postgresql, tree all ok; pkg/sql/parsers/util changed upstream) — includes this PR's quantile grammar parser test.
• Compile/link closure of the merged tree before the focused runs: defines, aggexec, compile and parsers packages all built and linked; static checks on the cons closure: gofmt -l clean over every changed file and go test -vet=all (full vet) exit 0 on pkg/defines and pkg/sql/compile.

Local logs are preserved under issue-29944/merge-conflict-resolution/ in the loop's state artifacts directory.

Update: semantic merge of main (second) — ID-space collision 606 -> 616 and window-binder coexistence

Upstream main advanced past the first merge's base (ac13078b98) with #31017 (6fb6531432, technical-indicator window kernels, whose registry allocated SQL function ids 605-615 beside MO_VIEW's internal 603/604 helpers), #31021 (a1888d62f8) and #31035 (f4343be0ae), leaving the PR DIRTY (content conflicts in pkg/sql/plan/function/function_id.go, function_id_test.go, pkg/sql/plan/window_binder.go and the generated parser). The resolution keeps every upstream change and re-issues this aggregate's colliding bits:

• QUANTILE_EXACT_WEIGHTED = 616, the sentinel FUNCTION_END_NUMBER = 617: upstream's indicator registry owns 605-615, so this aggregate takes the first unassigned catalog id past the current sentinel — the approved design's own allocation rule, with only the concrete number moved (606 drafted, 616 delivered; recorded in the design document's second post-merge annotation, a documentation change, not a design revision). AggIdOfQuantileExactWeighted tracks it as 616 << 32; Test_funids's predefined-Funids mapping, the composite-id assertion and the stale "cluster protocol 130" comment on the constant (now 131) follow.
• window_binder.go keeps both independent hooks: this feature's DISTINCT window-aggregate recording and upstream's indicator-window validateIndicatorWindowSpec gate — disjoint paths, both exercised by their respective suites on the merged tree. mysql_sql.go is regenerated through the repository's in-tree goyacc make target under its zero-shift/reduce-conflict gate from the cleanly merged grammar (both this feature's QUANTILE_EXACT_WEIGHTED rules and upstream's grammar changes retained).
• The dispatch gate stays on MORPCVersion131; pkg/defines/const.go auto-merged cleanly.

Validation of the merged tree (local macOS/arm64, mo-cgo-test wrapper, ladder v3):

• mo-cgo-test --count=1 -run '^$' ./pkg/defines/ ./pkg/sql/colexec/aggexec/ ./pkg/sql/colexec/window/ ./pkg/sql/compile/ ./pkg/sql/plan/ ./pkg/sql/parsers/... -> exit 0: compile/link of the whole owning closure on the merged tree (the working tree that became the merge commit).
• mo-cgo-test --count=1 -run 'TestQuantile|TestAccounted' ./pkg/sql/colexec/aggexec/ -> exit 0: the full quantile executor matrix — 67 matched tests (-list), including the 8192-row peak-scratch budget, cancellation/witness and SortByVectors-parity suites — green with AggIdOfQuantileExactWeighted = 616 << 32.
• mo-cgo-test --count=1 -run 'Test_funids' ./pkg/sql/plan/function/ and -run 'TestAggregateExecutorIDs' -> exit 0 both: the predefined-Funids consistency audit (616/617 entries, upstream's 605-615 kept) and the cross-registry id-equality circuit.
• mo-cgo-test --count=1 -run 'Quantile|FunctionID|Funids' ./pkg/sql/plan/function/ -> exit 0: registration and typed-admission checks on the merged registry (TestQuantileExactWeightedRegistration, TestQuantileExactWeightedCheckFnVerifiesTypedAdmission enumerated via -list).
• mo-cgo-test --count=1 -run 'TestQuantileExactWeightedDistinctWindowBinding|TestBindWindowFuncExprValidationAndHelpers|TestPreparedQuantileExactWeightedParameters|TestIndicatorBinderSurface|TestIndicatorRegistryBits|TestIndicatorDeduceNotNullablePins' ./pkg/sql/plan/ -> exit 0: the manually resolved window-binder seam holds both sides — this feature's DISTINCT binding and upstream's indicator binder surface (all six names enumerated via -list).
• mo-cgo-test --count=1 -run 'TestWindowQuantileExactWeighted|TestIndicatorOperator|TestIndicatorChunkedEmit|TestIndicatorScanCancellationLatency' ./pkg/sql/colexec/window/ -> exit 0: this feature's four window-quantile witnesses and upstream's indicator operator emit/reset/cancel/lifecycle seams coexist on the auto-merged window.go (eleven names enumerated via -list).
• mo-cgo-test --count=1 -run 'TestQuantileExactWeighted|TestPreflightQuantileExactWeighted' ./pkg/sql/compile/ -> exit 0: the 129/130/131 dispatch matrix (including the temporal-130-only counterexample) and prepared-level preflight re-proven on the merged tree.
• mo-cgo-test --count=1 ./pkg/sql/parsers/... -> exit 0: full parser corpus (pkg/sql/parsers, dialect/mysql, dialect/postgresql, tree) against the regenerated mysql_sql.go, which is goyacc-verified (zero shift/reduce conflicts) to carry both this feature's QUANTILE_EXACT_WEIGHTED grammar and upstream's changes.
• gofmt -l clean over every changed file; git diff --check clean. Ladder v3 preserved per-step exit-status files: every step 0.

Local logs are preserved under issue-29944/merge2-conflict-resolution/ in the loop's state artifacts directory.

Update: third merge of main — tracked CI blocker #31044 resolved (closed NOT_PLANNED); fresh-head re-evaluation

With the second merge's head f79bbb0dbe terminally red only on the coverage lanes that tracked issue #31044 (run 40105576983 attempt 4: UT Coverage producer flake with Coverage/CI Required as its projections) and that run's failed-jobs rerun budget consumed (attempts 3–4 were re-queued externally), the open→closed transition of #31044 was verified and the resolved-blocker contract was followed: current main was incorporated so the required checks get a fresh evaluation on a new head, and the stale run is not rerun.

• Verified blocker resolution: [Bug]: [flaky] UT pkg/embed TestCrossTargetUpgradeRecovery/manual-ready-steps-4.0.13 hangs until 20m go test timeout #31044 was closed at 2026-10-24T21:37:23Z as NOT_PLANNED by XuPeng-SH — the closing review of the complete retained coverage artifact confirmed the complete CHECK namespace and all four cross-target recovery scenarios pass on current main dae02bbaaa (linux/amd64 race + matrixone_test, package 120.959s, manual-ready 16.71s), explicitly reviewed this PR's attempt-4 reproduction record, and re-classified it as package-budget boundary behavior rather than a recovery defect. No pkg/embed change was merged upstream (the six upstream commits touch no path under pkg/embed), so current main is the upstream state under which the blocker was declared resolved.
• Base update: merge of main dae02bbaaa (upstream perf(sql): prune total derived grouping keys #31040 derived-group-by pruning, fix(plan): preserve composite predicates through secondary index selection #31048 composite secondary-index filters, fix(logservice): preserve CN mutation budgets; test grouped SUM #30886 logservice mutation budgets, fix(plan): reject FK ON DELETE/UPDATE SET NULL over NOT NULL child columns (#30282) #30925 FK ON DELETE/UPDATE SET NULL guard, perf(partition): reduce consecutive Top-1 candidates before copying #31001 partition Top-1, fix(frontend): close the client connection after COM_QUIT #31041 COM_QUIT connection close) into f79bbb0dbe → bbd761648c. A clean auto-merge with zero content conflicts (git merge-tree --write-tree dry run: none): the only shared file pkg/sql/plan/query_builder.go merged at disjoint hunks (this feature's NameQuantileExactWeighted constant vs upstream's createQuery/bindSelect aggregate-consumer regions). QUANTILE_EXACT_WEIGHTED keeps catalog id 616 and FUNCTION_END_NUMBER 617 (upstream allocated no SQL function ids), the D10 wire gate MORPCVersion131 is untouched, and the goyacc-verified generated parser stands byte-unchanged (no upstream grammar change); the upstream range contains no .github content. No reviewed design decision changed, so no design re-review was required. The update is a merge, not a rebase: every cited evidence hash stays reachable from the new head (the approved revision-5 bytes byte-preserved at 60d88ff6adb, the remediation commits 0afd975232/5b60194404db, prior merge f79bbb0dbe, and the recorded run identities).

Validation of the merged tree (local macOS/arm64, mo-cgo-test wrapper, ladder v4 — the second merge's proven ladder set, plus the upstream test families that landed in packages this feature owns or at its binding seam: sum_local_table_test.go in aggexec and derived_group_by_test.go's aggregate-consumer pruning tests in plan):

• mo-cgo-test --count=1 -run '^$' ./pkg/defines/ ./pkg/frontend/ ./pkg/logservice/ ./pkg/util/executor/ ./pkg/sql/colexec/aggexec/ ./pkg/sql/colexec/window/ ./pkg/sql/colexec/partition/ ./pkg/sql/compile/ ./pkg/sql/plan/ ./pkg/sql/plan/function/ ./pkg/sql/parsers/... -> exit 0: compile/link proof of the whole owning closure extended with the upstream-touched runtime packages (frontend, logservice, util/executor, colexec/partition) — every test binary builds against the merged tree.
• mo-cgo-test --count=1 -run 'TestQuantile|TestAccounted|TestSumFullLocalTable' ./pkg/sql/colexec/aggexec/ -> exit 0 (ok ... 4.391s): 67 matched tests via -list (45 TestQuantile* + 20 TestAccounted* + upstream's 2 new TestSumFullLocalTable*) — the full quantile executor matrix including the 8192-row peak-scratch budget, cancellation/witness and SortByVectors-parity suites green with AggIdOfQuantileExactWeighted = 616 << 32, plus upstream's grouped-SUM local-table regressions coexisting in the same package.
• mo-cgo-test --count=1 -run 'Quantile|FunctionID|Funids' ./pkg/sql/plan/function/ -> exit 0 (ok ... 2.015s): registration, typed-admission and Funids registry-consistency checks (616/617 kept; upstream's 605-615 intact).
• mo-cgo-test --count=1 -run 'TestQuantileExactWeightedDistinctWindowBinding|TestBindWindowFuncExprValidationAndHelpers|TestPreparedQuantileExactWeightedParameters|TestIndicatorBinderSurface|TestIndicatorRegistryBits|TestIndicatorDeduceNotNullablePins|TestPruneDerivedGroupBy|TestBuildPlanPrunesDerivedGroupKeys' ./pkg/sql/plan/ -> exit 0 (ok ... 2.533s): 10 matched tests via -list — this feature's DISTINCT window binding, helper-validation and prepared-parameter cases, upstream's indicator binder surface, and upstream's new derived-group-by pruning tests at the aggregate-consumer seam, all exercising the merged query_builder.go.
• mo-cgo-test --count=1 -run 'TestWindowQuantileExactWeighted|TestIndicatorOperator|TestIndicatorChunkedEmit|TestIndicatorScanCancellationLatency' ./pkg/sql/colexec/window/ -> exit 0 (ok ... 2.674s): 11 matched tests via -list — the window-quantile witnesses (including the 40000-row full-partition cancellation) and upstream's indicator operator emit/reset/lifecycle seams.
• mo-cgo-test --count=1 -run 'TestQuantileExactWeighted|TestPreflightQuantileExactWeighted' ./pkg/sql/compile/ -> exit 0 (ok ... 4.440s): the 129/130/131 dispatch matrix (including the temporal-130-only counterexample) and prepared-level preflight re-proven on the merged tree.
• mo-cgo-test --count=1 ./pkg/sql/parsers/... -> exit 0: full parser corpus — pkg/sql/parsers, dialect/mysql, dialect/postgresql and tree all ok against the byte-unchanged goyacc-verified mysql_sql.go.
• Static: gofmt -l over the feature-owned files and the auto-merged query_builder.go -> clean; git diff --check -> clean; git status --porcelain -> empty. Every step wrote an individual exit-status file; the ladder's overall status is 0.

Local logs and per-step exit-status files are preserved under issue-29944/merge3-conflict-resolution/ in the loop's state artifacts directory.

Update: fourth merge of main — function-id re-issue 616 -> 619 (#31020 claimed the catalog tail)

GitHub reported this PR DIRTY/CONFLICTING against head bbd761648c because upstream main advanced to ac4ec31587 (#31020, local sliding-window ranks mrank/cumrank/tmrank — a feature that itself had been renumbered around #31017's 605-615 indicator block when it merged, and allocated SQL function ids MRANK = 616, CUMRANK = 617, TMRANK = 618 with FUNCTION_END_NUMBER = 619). That is exactly the tail this aggregate occupied after its own second merge (QUANTILE_EXACT_WEIGHTED = 616, sentinel 617), so three content conflicts followed: pkg/sql/plan/function/function_id.go, function_id_test.go, and the generated parser pkg/sql/parsers/dialect/mysql/mysql_sql.go; the grammar (mysql_sql.y), keywords, window operator and window-binder seams auto-merged with disjoint paths. The upstream range contains no .github content.

The resolution applies the approved design's recorded first-unassigned-id allocation rule unchanged — the same rule as the second merge, applied to new inputs; no design decision, invariant, admission set or validation plan changed, and the D10 wire gate MORPCVersion131 is untouched:

• Upstream's MRANK = 616, CUMRANK = 617, TMRANK = 618 are kept; QUANTILE_EXACT_WEIGHTED is re-issued to the first unassigned catalog id 619, with FUNCTION_END_NUMBER = 620 (one past the highest allocated id). Every reference to this aggregate's id is by name, so renumbering is safe.
• AggIdOfQuantileExactWeighted tracks the catalog id as 619 << 32 (in pkg/sql/colexec/aggexec/function_id.go); the executor-id tracking assertion in pkg/sql/plan/function/quantile_exact_weighted_test.go and the Test_funids predefined-pin map follow (the merged map pins MRANK 616, CUMRANK 617, TMRANK 618, QUANTILE_EXACT_WEIGHTED 619, FUNCTION_END_NUMBER 620).
• The generated parser was regenerated through the repository's in-tree goyacc make target under its zero shift/reduce-conflict gate (0 conflicts, exit 0) from the cleanly merged grammar, which carries both this feature's QUANTILE_EXACT_WEIGHTED productions and upstream's MRANK/CUMRANK/TMRANK grammar (confirmed in the merged mysql_sql.y and keywords.go: "quantileexactweighted" beside "mrank"/"cumrank"/"tmrank").
• The auto-merged seams keep both sides' coexisting paths: upstream's rank-width binder/operator additions beside this aggregate's DISTINCT window hook, percentile-config normalization and executor wiring (base_binder.go, window_binder.go, pkg/sql/colexec/window/window.go).
• docs/design/20261023-exact-weighted-percentiles.md records the re-issue as its third post-merge annotation — documentation change only, not a design revision; the approved revision-5 bytes remain byte-preserved at introducing commit 60d88ff6adb.

Merge (not rebase), preserving every cited evidence hash — revision-5 design bytes at 60d88ff6adb, remediation commits 0afd975232/5b60194404db, prior merges 2eecad8753/f79bbb0dbe/bbd761648c, and the recorded workflow-run identities.

Validation of the merged tree (local macOS/arm64, mo-cgo-test wrapper, ladder v5, ddc46c416b; every step exit 0, per-step status files preserved under issue-29944/merge4-conflict-resolution/ in the loop's state artifacts):

• mo-cgo-test --count=1 -run '^$' ./pkg/defines/ ./pkg/frontend/ ./pkg/logservice/ ./pkg/util/executor/ ./pkg/sql/colexec/aggexec/ ./pkg/sql/colexec/window/ ./pkg/sql/colexec/partition/ ./pkg/sql/compile/ ./pkg/sql/plan/ ./pkg/sql/plan/function/ ./pkg/sql/parsers/... -> exit 0: compile/link of the owning closure on the merged tree (including upstream-touched window/plan/parser/special-types files and upstream's bindFuncExprImplByPlanExpr signature change, whose merged call sites all use the new signature).
• mo-cgo-test --count=1 -run 'TestQuantile|TestAccounted|TestSumFullLocalTable' ./pkg/sql/colexec/aggexec/ -> exit 0 (ok 1.999s): the full quantile executor matrix — the same 67-test set as ladder v4 (the merge's only aggexec delta vs bbd761648c is the tracking constant 619 << 32) — green.
• mo-cgo-test --count=1 -run 'Quantile|FunctionID|Funids' ./pkg/sql/plan/function/ -> exit 0 (ok 1.522s): Test_funids with the merged pin map and TestAggregateExecutorIDs cross-registry equality (catalog 619 == 619 << 32 executor id), registration and typed-admission checks.
• mo-cgo-test --count=1 -run '...8-name set...|TestLocalRank' ./pkg/sql/plan/ (full pattern: TestQuantileExactWeightedDistinctWindowBinding|TestBindWindowFuncExprValidationAndHelpers|TestPreparedQuantileExactWeightedParameters|TestIndicatorBinderSurface|TestIndicatorRegistryBits|TestIndicatorDeduceNotNullablePins|TestPruneDerivedGroupBy|TestBuildPlanPrunesDerivedGroupKeys|TestLocalRank) -> exit 0 (ok 2.098s): 22 matched tests (-list) — this feature's binder/prepared-parameter/indicator surfaces beside upstream's 12 TestLocalRank binder and prepared-width families on the auto-merged window_binder.go/base_binder.go.
• mo-cgo-test --count=1 -run 'TestWindowQuantileExactWeighted|TestIndicatorOperator|TestIndicatorChunkedEmit|TestIndicatorScanCancellationLatency|TestLocalRank' ./pkg/sql/colexec/window/ -> exit 0 (ok 12.374s): 37 matched tests (-list) — the 4 window-quantile witnesses (including large-partition cancellation and executor-destruction retention) and upstream's 7 indicator seams and 26 TestLocalRank operator suites on the auto-merged window.go/interval.go/local_rank.go.
• mo-cgo-test --count=1 -run 'TestQuantileExactWeighted|TestPreflightQuantileExactWeighted' ./pkg/sql/compile/ -> exit 0 (ok 1.690s): the 129/130/131 dispatch matrix and prepared-level preflight re-proven on the merged tree.
• mo-cgo-test --count=1 ./pkg/sql/parsers/... -> exit 0: full parser corpus (pkg/sql/parsers, dialect/mysql incl. upstream's window_local_rank_parser_test.go and this feature's mysql_sql_test.go, dialect/postgresql, tree) against the regenerated goyacc-verified parser.
• Static: gofmt -l over the resolved and feature-owned files -> clean; git diff --check and git diff --cached --check -> clean.

Update: review remediation — equal-key sort-work cancellation cadence (P2 · quantile_exact_weighted.go:584)

The mo-bot-local review of head ddc46c416b requested changes for one P2: the interruptible heap sort charged its cancellation-checkpoint counter on sift-down element swaps only, and not even root-extraction swaps received a charge. With an equal-valued group every sift-down returns at the comparison without a swap, so the counter never advanced again: cancelling immediately after the sort's entry check let the whole sort run to completion (the review's 65,536-equal-values probe recorded checks=1, selector_moves=65536, err=nil), with the cancelled cause surfacing only at the later cumulative-scan checkpoints — a departure from approved D12's "bounded per-row cadence inside each group's finalization".

Fix (commit a4a7ef92bd, pkg/sql/colexec/aggexec/quantile_exact_weighted.go): the checkpoint cadence now charges every elementary heap step — each sift-down iteration, including the comparing iterations that return without swapping, plus each root-extraction swap (the review's requested "count comparisons or iterations, including no-swap work"). context.Cause is re-checked at the sort's entry (unchanged) and after every quantileSortCheckSteps = 1024 charged steps, before the next element move, so the work between checks stays bounded for every value distribution. The comparator, heap shape and selection order are untouched (the SortByVectors parity suite re-proves it); no design decision, invariant, admission set or validation plan changed, and DISTINCT/merge/wire/spill state is untouched.

Regressions added per the finding (all in quantile_exact_weighted_test.go):

• TestQuantileSortSelectorsInterruptsEqualValuedWork — the sort-level probe over 65,536 identical values: the counting warmup gates on real in-sort checkpoints; flipping at the first in-sort checkpoint surfaces the cancelled cause with zero element moves; a learned mid-extraction flip aborts with selectors neither identity nor the completed permutation.
• TestQuantileExactWeightedEqualValuedCancellation — the executor-level regression ("cancel the finalization of a large equal-valued aggregate or window partition"; window partitions finalize through the same FlushWithContext path): a 4096-row equal-valued group's finalization cancelled at the sort's first in-work checkpoint and deep inside its element work surfaces the cause at exactly the first flipped check, frees every scratch and partial result, and a fresh executor over the same group still finalizes the correct value.
• TestQuantileSortSelectorsInterruptsInsideElementWork retuned to the iteration-charged cadence (its old n=2 flip pinned "after exactly 1024 swaps", which under descending input now fires during the no-swap heap build): the flip point is learned from a counting warmup, deep inside the extraction phase, keeping the same three assertions; it is an invariance witness on both cadences, green before and after this change.

Validation of the remediation (local macOS/arm64, mo-cgo-test wrapper; per-step logs and exit-status files preserved under issue-29944/review-equal-key-cancellation/logs/ in the loop state artifacts):

• Pre-fix failure of the same new tests, implementation hunk stashed (base-prefixed-code-fails.log, exit 1): the sort-level equal-key warmup records exactly 1 checkpoint over 65,536 equal values and the executor-level equal-key group learns 11 total checks — zero in-sort checkpoints — both the review probe's signature.
• Post-fix new regressions plus retuned descending witness exit 0 (postfix-new-regressions-pass.log, ok 2.367s).
• Full aggexec matrix TestQuantile|TestAccounted|TestSumFullLocalTable exit 0 (aggexec-full-quantile-matrix.log, ok 4.847s; 69 matched tests via -list: 22 TestQuantile* + 45 TestAccounted* + 2 TestSumFullLocalTable* — the ladder-v5 67-test set plus the two new regressions), including the descending large-group cancellation matrix, the SortByVectors ordering-parity suite, the 8192-row peak-scratch budget admission and the allocation-failure sweeps.
• TestWindowQuantileExactWeighted exit 0 (window-quantile-witnesses.log, ok 1.419s), including the 40000-row full-partition window cancellation through the shared finalization route.
• Static: gofmt -l clean; go vet and golangci-lint --new-from-rev ac4ec31587 report zero findings on the changed closure under the repository CGo native environment; git diff --check clean.

The fresh MatrixOne ALL CI run on the new head a4a7ef92bd re-evaluates every lane; the previous head ddc46c416b holds the recorded green verdicts (shared build, Ubuntu/x86 UT, arm64 SCA, UT Coverage, Coverage, CI Required, both multi-CN BVT compose legs, preflight, Iceberg Connector E2E).

Update: fifth merge of main — conflict resolved against #30973's widened RANGE frame bounds

GitHub reported this PR DIRTY/CONFLICTING against head a4a7ef92bd because upstream main advanced to 80ea60aaeb, three commits past the merge-#4 base ac4ec31587: fix(window) #30973 (widen narrow integer RANGE frame bounds), fix(plan) #31015 (overlapping ON DELETE CASCADE/SET NULL order-independence) and fix(frontend) #31052 (preserve microseconds in session timestamp overrides). merge-tree pinned exactly one content conflict: pkg/sql/plan/window_binder_test.go, where #30973 appends TestRangeFrameBoundTypeWidening (plus its T_int32→T_int64 prepared-marker assertion updates) at the same file tail this feature's TestQuantileExactWeightedDistinctWindowBinding occupies.

Resolution (semantic union; no design change): the conflicted test file now carries both appended functions with upstream's widened marker assertions. pkg/sql/plan/window_binder.go and pkg/sql/colexec/window/window.go auto-merged because the seams are disjoint — this feature's DISTINCT window hook lives in bindWindowFuncExpr while #30973's rangeFrameBoundType call site lives in bindWindowSpec, and this feature's orderedSetWindowAggregate entry is a different function from #30973's signedNarrowRangeBound/signedRangeOffsetValue additions. This feature's tests use only ROWS frames, so the bound-widening change cannot alter any of this PR's expected outputs. Upstream allocated no SQL function IDs in this range: QUANTILE_EXACT_WEIGHTED = 619, FUNCTION_END_NUMBER = 620 and every recorded id evidence stand, so no design-document annotation is required (no design decision, invariant, admission set or validation plan changed). The upstream range touches no .github and no mo-tester content. Merge (not rebase), preserving every cited evidence hash — revision-5 design bytes at 60d88ff6adb, remediation commits 0afd975232/5b60194404db/a4a7ef92bd, prior merges 2eecad8753/f79bbb0dbe/bbd761648c/ddc46c416b — plus the recorded workflow-run identities.

Validation of the merged tree (local macOS/arm64, mo-cgo-test wrapper, ladder v6, a56f0b0313910268d8500260ec5572dfad514df7; every step exit 0; console log, per-step status files and -list proofs preserved under issue-29944/merge5-conflict-resolution/logs/ in the loop's state artifacts):

• mo-cgo-test --count=1 -run '^$' ./pkg/defines/ ./pkg/frontend/ ./pkg/logservice/ ./pkg/tests/issues/ ./pkg/util/executor/ ./pkg/sql/colexec/aggexec/ ./pkg/sql/colexec/window/ ./pkg/sql/compile/ ./pkg/sql/plan/ ./pkg/sql/plan/function/ ./pkg/sql/parsers/... -> exit 0: compile/link of the owning closure on the merged tree (upstream's frontend, window, plan-DML and tests-issues files beside this feature's packages).
• mo-cgo-test --count=1 -run 'TestQuantile|TestAccounted|TestSumFullLocalTable' ./pkg/sql/colexec/aggexec/ -> exit 0 (ok 1.512s): the full quantile executor matrix — including the equal-key cancellation regressions, SortByVectors parity and budget/sweep witnesses — unchanged and green through the merge.
• mo-cgo-test --count=1 -run 'Quantile|FunctionID|Funids' ./pkg/sql/plan/function/ -> exit 0 (ok 1.074s): Test_funids with the unchanged pin map (MRANK 616, CUMRANK 617, TMRANK 618, QUANTILE_EXACT_WEIGHTED 619, FUNCTION_END_NUMBER 620) and TestAggregateExecutorIDs cross-registry equality (catalog 619 == 619 << 32).
• mo-cgo-test --count=1 -run 'TestQuantileExactWeightedDistinctWindowBinding|TestBindWindowFuncExprValidationAndHelpers|TestPreparedQuantileExactWeightedParameters|TestIndicatorBinderSurface|TestIndicatorRegistryBits|TestIndicatorDeduceNotNullablePins|TestPruneDerivedGroupBy|TestBuildPlanPrunesDerivedGroupKeys|TestLocalRank|TestRangeFrameBoundTypeWidening|TestPreparedWindowRangeFrameMarkers' ./pkg/sql/plan/ -> exit 0 (ok 1.623s): 25 matched tests (-list) — this feature's binder/prepared-parameter surfaces and upstream's 12 TestLocalRank binder families (the merge-More documents are needed in Github REPO #4 set) beside the three new fix(window): widen narrow integer RANGE frame bounds #30973 binder regressions (TestRangeFrameBoundTypeWidening, TestPreparedWindowRangeFrameMarkers, TestPreparedWindowRangeFrameMarkersInBothBounds), all on the auto-merged window_binder.go.
• mo-cgo-test --count=1 -run 'TestWindowQuantileExactWeighted|TestIndicatorOperator|TestIndicatorChunkedEmit|TestIndicatorScanCancellationLatency|TestLocalRank|TestBuildRangeIntervalWideSignedBounds' ./pkg/sql/colexec/window/ -> exit 0 (ok 3.888s): 38 matched tests (-list) — the four window-quantile witnesses, upstream's 7 indicator seams and 26 TestLocalRank operator suites (the merge-More documents are needed in Github REPO #4 37-test set) beside TestBuildRangeIntervalWideSignedBounds, on the auto-merged window.go.
• mo-cgo-test --count=1 -run 'TestQuantileExactWeighted|TestPreflightQuantileExactWeighted' ./pkg/sql/compile/ -> exit 0 (ok 1.405s): the compile dispatch and preflight sets re-proven on the merged tree.
• mo-cgo-test --count=1 ./pkg/sql/parsers/... -> exit 0 (pkg/sql/parsers, dialect/mysql, dialect/postgresql, tree all ok): full parser corpus against the byte-unchanged goyacc-verified parser (this upstream range made no parser change; no regeneration was needed).
• Static: gofmt -l over the resolved and auto-merged files -> clean; git diff --check and git diff --cached --check -> clean.

The fresh MatrixOne ALL CI run on the new head re-evaluates every lane; the previous head a4a7ef92bd holds the fully green exact-head CI record (shared build, Ubuntu/x86 UT, arm64 SCA, UT Coverage, Coverage, CI Required, both multi-CN BVT compose legs, preflight, pr-size-label, coverage eligibility, Iceberg Connector E2E), and the standing review state — CHANGES_REQUESTED from the mo-bot review of the superseded ddc46c416b, with the equal-key remediation answered on a4a7ef92bd and every affected thread resolved — carries to the new head as CI and review proceed.

[XuPeng-SH]

mo-bot review · mo-bot-local · done

Commit: ddc46c416babaa0085b0a287ad27163a1ed59982

Review completed. Read the assessment.

[XuPeng-SH]

mo-bot review · mo-bot-local · review

Commit: ddc46c416babaa0085b0a287ad27163a1ed59982

Assessment: request_changes

Reviewed the complete 33-file delta and surrounding owners. The design reasonably reuses typed saved arguments, percentile configuration, window ownership and protocol negotiation. The approved design revision and scratch-memory budget are verified. One confirmed cancellation defect remains in the new sort.

Model: gpt-6-astra / xhigh

Session: 01a13dcf-1517-7f90-b3f9-c5f9f9e7031b · slot 0 · generation 1

• P2 pkg/sql/colexec/aggexec/quantile_exact_weighted.go:584: Cancel finalization of a large equal-valued aggregate or window partition immediately after the sort's initial context check.
  Impact: Every siftDown returns before incrementing swapSteps, and root-extraction swaps do not increment it either. The entire sort therefore completes without another cancellation check, retaining CPU and scratch memory until the subsequent cumulative scan observes cancellation. Count comparisons or iterations, including no-swap work, and add an equal-key cancellation regression to satisfy design D12.
  Evidence: The retained overlay probe with 65,536 equal values recorded checks=1, selector_moves=65536 and err=nil while the context was canceled. The descending-input control stopped with context.Canceled after two checks. See attempt-1/executor-tests.log and checks/1792889035618102690-2.json under this job; source tracing confirms the later scan eventually reports cancellation.

Validation:

• Verified frozen HEAD, clean source, supplied patch equivalence, approved design SHA-256 and exact parser regeneration.

• Isolation preflight passed; repository-owned native provenance and 192 compatible input files were verified before linked tests.

• All 17 new executor test roots, three changed allocation-failure sweep cases and 14 focused function/planner/compiler/window test roots passed. The executor command exited 1 solely because the additional equal-key cancellation probe failed.

• The supplied exact-head CI snapshot records successful UT, coverage, arm64 SCA and both multi-CN BVT lanes.

• Sort-only benchmarks at 65,536 rows measured candidate/control times of 448/120 microseconds for equal values, 5181/141 for descending values and 7847/4668 for random values. The candidate added one 32-byte allocation; this cost is confined to the new aggregate.

• Commands, source fingerprints, terminal receipts and logs are reconciled in /home/xupeng/.local/state/mo-bot/jobs/d8a93ed76b10bc648c6d6211/attempt-1/validation-audit.json; complete review coverage is recorded in review-map.json.

Limitations:

• Local validation used linked component tests; no live SQL cluster or mixed-version deployment was rerun. Individual CI case logs were not supplied.

• The benchmark compares sorting strategies, not end-to-end query throughput or a weighted aggregate existing at the merge-base.

[iamlinjunhong]

Reviewed head ddc46c416babaa0085b0a287ad27163a1ed59982 against base ac4ec315877cfc95fc5464bd81b081489f75f747, covering the complete 33-file change, aggregate state/configuration, planner and window call paths, remote protocol gates, and the added unit/BVT cases.

One non-blocking finding remains: P0=0, P1=0, P2=1, P3=0. Event: COMMENT.

[P2] Count no-swap work in the sort cancellation cadence — pkg/sql/colexec/aggexec/quantile_exact_weighted.go:584.

Trigger: cancel finalization of a large non-DISTINCT group or full-partition window containing equal values after the sort's initial context check. Every siftDown returns at lines 579–580 before incrementing swapSteps; the extraction swaps at line 600 also do not increment it. Consequently the entire sort runs without checking cancellation again. The following cumulative scan eventually returns the cancellation error, but CPU work and finalization scratch remain occupied until sorting finishes, contrary to the bounded cancellation contract.

Independently reproduced using the current sort function's complete control flow in a temporary Go harness, substituting only the INT64 vector/comparator adapter and unsupported-type diagnostic. Cancelling a real context on the first comparison of 65,536 equal values produced checks=1, comparisons=196602, moved_selectors=65536, sort_error=<nil>, with context_error=context canceled. A descending-input control returned context canceled at the second check. Count comparisons or loop iterations, including paths that perform no sift swap and the extraction loop, and add an equal-key mid-sort cancellation regression. The existing cancellation fixtures use descending input and do not cover this path.

Validation: regenerated the parser using the head's in-tree goyacc in a temporary directory; output is byte-identical to mysql_sql.go, with zero shift/reduce and reduce/reduce conflicts. All 29 changed Go files pass formatting comparison; git diff --check passes; the source worktree remains clean. The supplied exact-head snapshot has 29 completed checks: 13 success, 14 skipped, 2 neutral, with no failures. GitHub reports mergeable, with mergeable state behind; the available newer origin/main change concerns foreign-key DML and does not change the aggregate ID allocation.

History: this is the first review by this account. Inspected all three supplied prior reviews, the empty inline-comment collection, and the PR conversation. Author replies address the older design-evidence, scratch-memory and cancellation findings. The latest same-head equal-key cancellation finding from the other review account has no corresponding author reply in the supplied snapshot; those earlier replies do not resolve this counterexample.

Validation limits: the cancellation harness is a focused sort probe, not a linked aggregate/window package test. No local package suite, live SQL cluster or mixed-version deployment was rerun; CI results above come from the supplied metadata snapshot.

[gouhongshen]

Addressing the requested-changes review (P2 · pkg/sql/colexec/aggexec/quantile_exact_weighted.go:584 — cancelling immediately after the sort's initial context check let a large equal-valued group's sort run to completion): fixed by conforming the sort's checkpoint cadence to the approved design's D12 bounded-cadence contract. No design decision, invariant, admission set or validation plan changed, so no design re-review is needed — the delivered sort had departed from approved D12's "bounded per-row cadence inside each group's finalization"; it now follows it.

Valid finding. The interruptible heap sort charged its checkpoint counter on sift-down element swaps only, and not even the root-extraction swaps received a charge. With an equal-valued group every sift-down returns at the !less comparison without a swap, so the counter never advanced: your probe (65,536 equal values, context cancelled after the entry check) observed checks=1, selector_moves=65536, err=nil — the whole sort completed, retaining CPU and the selector scratch, and cancellation surfaced only at the later cumulative-scan checkpoints. Pre-fix reproductions recorded locally in this round match that signature exactly: over 65,536 equal values the sort-level counting warmup observes exactly 1 checkpoint (the entry check), and a 4096-row equal-valued group's finalization learns 11 total checks — zero in-sort checkpoints (entry + restore cadence + sort entry + scan only).

Fix (quantile_exact_weighted.go, commit a4a7ef92bd):

• The cadence now charges every elementary heap step: each sift-down iteration — including the comparing iterations that return without swapping, which is all an equal-valued group performs — plus each root-extraction swap, exactly the review's requested "count comparisons or iterations, including no-swap work". The context is re-checked at the sort's entry (unchanged) and after every quantileSortCheckSteps = 1024 charged steps, before the next element move; a charged unit is one constant-time comparison/branch/swap, so the work between checks stays bounded by the same constant factor for every value distribution. The comparator, heap shape and selection order are untouched (SortByVectors-parity re-verified); DISTINCT/merge/wire/spill state is untouched.

Regressions per the finding, each proven failing on the pre-fix code and green after it (logs and per-step exit-status files preserved under issue-29944/review-equal-key-cancellation/logs/ in the loop state artifacts):

• TestQuantileSortSelectorsInterruptsEqualValuedWork — the direct probe variant at the sort level, your 65,536-equal-values scenario. Pre-fix: FAIL ("1" is not greater than "10" — the warmup proves the only checkpoint in equal-key work is the entry check). Post-fix: a counting warmup observes ~160 in-sort checkpoints over the same data; flipping at the first checkpoint surfaces the cancelled cause at check 2 with zero element moves (equal-key heap builds compare without swapping — the pre-fix code returned nil here and ran all 65,536 root extractions); a flip at the learned mid-extraction point surfaces the cause with selectors neither identity nor the completed permutation.
• TestQuantileExactWeightedEqualValuedCancellation — the executor-level regression, the finding's "cancel the finalization of a large equal-valued aggregate or window partition" (window partitions finalize through this same FlushWithContext path): a 4096-row equal-valued group, counting warmup, then cancellation at the sort's first in-work checkpoint (check 8) and deep inside its element work (learned T-5). Pre-fix: FAIL ("11" is not greater than "15" — no in-sort checkpoints existed). Post-fix: each abort surfaces context.Cause at exactly the first flipped check, FlushWithContext returns nil results and frees all scratch (mp.CurrNB() back to the baseline after Free), and a fresh executor over the same group finalizes the correct value.
• TestQuantileSortSelectorsInterruptsInsideElementWork — the pre-existing descending witness was retuned to the new cadence and kept as an invariance witness: its old flip pinned "checkpoint 2 fires after exactly 1024 swaps", which under iteration-charging fires during the heap build (descending builds compare without swapping) before any element move; the flip point is now learned from a counting warmup (deep inside the extraction phase) and the same three assertions — cause at the first cancelled check, selectors moved, yet not the completed order — are kept, green on both the old and new cadence.
• The full TestQuantileExactWeightedCancellation descending large-group matrix, the TestQuantileSortSelectorsMatchesSortByVectors ordering-parity suite over every supported value type (including NaN/±Inf, −0.0/+0.0, width extremes and duplicates), the 8192-row peak-scratch budget admission and the allocation-failure sweeps all stay green under the new cadence, and TestWindowQuantileExactWeighted* (including the 40000-row full-partition cancellation through the window route) is unchanged and green.

Local evidence (macOS/arm64, .agents/skills/mo-dev/scripts/mo-cgo-test): pre-fix failure of the same new tests via a stashed implementation hunk (tests kept) recorded at base-prefixed-code-fails.log (exit 1, the two signatures above); post-fix postfix-new-regressions-pass.log exit 0 (ok 2.367s); the full aggexec matrix TestQuantile|TestAccounted|TestSumFullLocalTable exit 0 (ok 4.847s, 69 matched tests via -list: 22 TestQuantile*, 45 TestAccounted*, 2 TestSumFullLocalTable* — the ladder-v5 67-test set plus the two new regressions); TestWindowQuantileExactWeighted exit 0 (ok 1.419s); gofmt -l clean; go vet and golangci-lint --new-from-rev zero findings on the changed closure under the repository CGo native environment. No runtime services were launched; no generated files, .github content, or mo-tester files were touched.

Re-requesting review.

[XuPeng-SH]

mo-bot review · mo-bot-local · done

Commit: a56f0b0313910268d8500260ec5572dfad514df7

Review completed. Read the assessment.

[iamlinjunhong]

Reviewed head a56f0b0313910268d8500260ec5572dfad514df7 against base 80ea60aaeb42d06415438e0eb26eeb76b124993a. No current confirmed findings: P0=0, P1=0, P2=0, P3=0. Event: APPROVE.

Covered the complete 33-file change, including parser regeneration, function/executor ID consistency, typed weight admission and exact threshold arithmetic, paired NULLs and zero-weight endpoints, DISTINCT, saved-state merge/wire/spill paths, allocation and output ownership, prepared configuration, full-partition and bounded-frame windows, and remote dispatch through the protocol floor and destination-stream confirmation. The prepared newer origin/main does not introduce another function-ID or protocol-slot allocation collision.

The previous review's non-blocking equal-key cancellation finding is resolved. Read the previous review, its inline thread, the author's direct thread reply, and the corresponding PR conversation reply. The reply explicitly accepts the finding and identifies commit a4a7ef92bd. At the reviewed head, every sift-down iteration, including no-swap returns, and every root-extraction step advances the checkpoint counter. The added sorter and executor regressions cover equal-valued work and cancellation cleanup.

Independent local validation: extracted the current sort function's complete control flow into a temporary Go probe, replacing only the vector/comparator adapter with INT64 slices and the unsupported-type diagnostic. Cancelling a real context on the first comparison of 65,536 equal values now returns context canceled at check 2, after 2,045 comparisons and zero selector moves. Descending and random controls also abort at check 2; uncancelled ordering controls match the standard-library sort. Regenerated mysql_sql.go using the head's in-tree goyacc: byte-identical output, zero shift/reduce and reduce/reduce conflicts. All 29 changed Go files pass formatting comparison, and git diff --check passes.

The supplied exact-head CI snapshot has 29 completed checks: 13 success, 14 skipped and 2 neutral, with no failures. GitHub's supplied mergeability result is mergeable=true, state behind. Source remains unchanged. Review used the Loom-prepared repository objects and GitHub snapshot; no GitHub write was performed here.

Validation limits: the independent sort probe is not a linked aggregate/window package test. No local package suite, live SQL cluster, memory benchmark or mixed-version deployment was rerun. The added package/BVT cases were inspected; CI results above come from the supplied metadata rather than independently rerun jobs.

[XuPeng-SH]

mo-bot review · mo-bot-local · review

Commit: a56f0b0313910268d8500260ec5572dfad514df7

Assessment: approve

Reviewed the complete 33-file delta and surrounding owners. The design preserves exact typed weights through existing aggregate state, configuration, window and protocol implementations. Design approval, scratch-memory accounting and equal-value cancellation concerns are closed. No actionable findings remain.

Model: gpt-6-astra / xhigh

Session: 01a13dcf-1586-7a01-9000-d45e20995cf8 · slot 1 · generation 1

Validation:

• Verified frozen HEAD, clean source, supplied patch equivalence, approved design hash and formatting of all 29 changed Go files. Parser regeneration is byte-identical with zero conflicts.

• Isolation preflight passed. Repository-owned native provenance and 192 compatible inputs were verified before testing. An initial compiler-profile setup failure was corrected and retained separately.

• 37 focused test roots passed across aggexec, window, function, planner and compiler; the parser-form test also passed. Coverage includes arithmetic, boundaries, DISTINCT, merge/intermediate state, ownership, scratch budget, cancellation, prepared parameters and protocol gates.

• Independent linked probes passed for cancellation with 65,536 equal values and a discriminating UINT64 precision case. All three selected allocation-failure sweep cases passed.

• Frozen exact-head CI records successful build, UT, coverage, arm64 SCA and both multi-CN BVT lanes. Skipped and neutral checks were not counted as passes.

• Commands, source fingerprints, exits and logs are reconciled in /home/xupeng/.local/state/mo-bot/jobs/0e5b08dc7ee5cd8f1b0ba17a/attempt-1/validation-audit.json; complete review coverage is recorded in review-map.json.

Limitations:

• No local live SQL or mixed-version cluster run; protocol validation used compiler/stream seams. Individual CI case logs were not supplied. The linked issue's complete body was unavailable; its preserved fixture, approved design and BVT defined the reviewed contract.

• At 65,536 rows, cancellable sorting measured 0.485/5.17/7.80 ms for equal/descending/random inputs versus 0.131/0.146/4.77 ms for the repository sorter, adding one 32-byte allocation. This accepted cost is confined to the new aggregate; these are sorting-strategy measurements, not end-to-end query benchmarks.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-25 06:18 UTC · Rule: main · triggered by rule Automatic queue on approval for main
• ✅ Checks passed · in-place
• ✅ Merged — 2026-10-25 07:24 UTC · at 9a7e12a93328a69bac7261beedc88930b7984a10 · squash

This pull request spent 1 hour 6 minutes 11 seconds in the queue, including 1 hour 5 minutes 53 seconds running CI.

Required conditions to merge

• #review-threads-unresolved = 0 [🛡 GitHub branch protection]
  • feat(sql): add quantileExactWeighted exact weighted percentile #31000
• github-review-approved [🛡 GitHub branch protection]
  • feat(sql): add quantileExactWeighted exact weighted percentile #31000
• any of [🛡 GitHub branch protection]:
  • check-success = CI Required
  • check-neutral = CI Required
  • check-skipped = CI Required