fix(query): reject nullable domains in monotonic folding (databendlab…

…s#20130)

* fix

* test

---------

Co-authored-by: Winter Zhang <coswde@gmail.com>

feat(metabench): add bulk-load and random-read benchmarks (databendla…

…bs#20137)

* feat(test-helper): track meta process via pid file

# Summary

Make the databend-meta helper manageable across separate Python
invocations by recording the child pid in a file, so a `stop` can find
and terminate a process that an earlier `start` launched and left
running.

# Details

- start_process writes the child pid to an optional pid_file; new
  read_pid_file, is_pid_running, and stop_pid helpers inspect or stop a
  process by pid, escalating from SIGTERM to SIGKILL after a timeout.
- DatabendMeta keeps its pid file as a sibling of the raft dir rather
  than inside it, since databend-meta deletes foreign files under its
  raft dir on startup; pid, start, stop, and is_running all route
  through the pid file.
- Fall back to a 0.0.0+uninstalled version when the package is imported
  from the source tree without an install, so import never raises
  PackageNotFoundError.

* feat(metabench): add run_secs limit and create_tables benchmark

# Summary

Extend metabench for large-scale meta workloads with a wall-clock run
limit and a benchmark that accumulates distinct tables instead of
repeatedly rewriting a single one.

# Details

- --run-secs stops issuing new operations once the given number of
  seconds elapses; 0 preserves the previous behavior of bounding each
  client only by --number.
- New create_tables rpc creates distinct, accumulating tables, opening
  a fresh database every db_size tables and padding TableMeta.options
  with meta_size bytes to control the serialized record size. Each
  client uses its own databases so concurrent creates do not conflict
  on one db_meta record. Both knobs take a JSON suffix, e.g.
  create_tables:{"db_size":1000,"meta_size":600}.

* chore(test-helper): ignore egg-info as a directory

# Summary

Add a trailing slash to the databend_test_helper.egg-info ignore
pattern so it matches the generated directory specifically rather than
a path of that name.

* feat(metabench): add bulk-load and random-read benchmarks

# Summary

Add the two benchmarks needed to drive and measure a large table
population: a bulk loader that fills a cluster fast and a random reader
that samples what it wrote. Also point the benchmark client at every
cluster node so it follows leader changes.

# Details

- batch_create_tables writes the records of `batch` tables in one
  transaction, skipping the per-table id allocation and conditional
  create of the real DDL path, to fill a cluster to a target volume
  quickly. Table ids are `fetch_id() * 1_000_000 + offset`, so one
  generator bump per batch keeps ids unique across clients, runs, and
  restarts; the per-table records match create_table exactly (name->id,
  id->meta, name history, id->name). Use create_tables instead when
  measuring the real per-table DDL cost.
- get_table_rand reads a uniformly pseudo-random table from a prior
  batch_create_tables round through the tenant/db/table name path, to
  measure read latency against a populated cluster. A splitmix64 hash
  of (client, op index) gives a deterministic uniform spread.
- create_remote_meta_store now splits grpc_api_address on commas and
  hands the client every endpoint, so it follows leader changes instead
  of forwarding through a single node.

* fix(test-helper): guard pid file against pid reuse

# Summary

Trust a recorded pid only while it still names a live databend-meta
process, and drop the pid file on stop. A stale file left by a crashed
process whose pid the OS later recycles no longer blocks start or lets
stop signal an unrelated process.

# Details

- pid() verifies the pid read from the file belongs to a databend-meta
  process before trusting it, matching the executable name via psutil;
  a recycled pid now owned by an unrelated process reads as not running
  rather than as a live meta.
- stop() removes the pid file after stopping, so a clean shutdown
  leaves nothing stale behind.

* chore(metabench): format get_table_rand with rustfmt

# Summary

Apply rustfmt so `cargo fmt --check` passes: wrap the over-long
get_table_rand error println and normalize the batch-create-tables txn
block comments to line comments. No behavior change.

fix(base): avoid self-deadlock during runtime drop (databendlabs#20103)

fix(runtime): avoid self-deadlock during runtime drop

fix(query): resolve physical column name for runtime filter probe tar…

…get (databendlabs#20105)

* fix(query): resolve physical column name for runtime filter probe target

When building the bloom runtime filter's probe-side column reference,
use the physical column name from the table schema (via column_id)
instead of the ColumnBinding's context name. The binding name can be
an alias (e.g. SELECT col_b AS col_a), which may collide with another
column in the same table. This caused the bloom filter to target the
wrong column, reading unrelated data and producing false negatives.

* fix(query): skip physical name lookup for nested/path columns

Use schema_with_stream() to also resolve stream column names correctly.
For nested/path columns or when schema lookup fails, fall back to
base_col.column_name (the stable metadata-level name) instead of the
potentially-aliased ColumnBinding name.

* ci(query): add stream runtime filter alias test

fix(query): scope HTTP session state by tenant (databendlabs#19931)

* fix(query): scope http session state by tenant

* fix(query): move items before test module to satisfy clippy

Resolve `clippy::items_after_test_module` errors that failed the
linux/check and mac_check CI jobs by moving the items declared after
the `#[cfg(test)] mod tests` blocks to before them, so each test
module is the last item in its file.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(query): parse tenant-scoped temp table sessions

* fix(query): format temporary table session error

* fix(query): restore http temp state after session settings

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Winter Zhang <coswde@gmail.com>

Revert "fix(query): avoid range join for single-row side" (databendla…

…bs#20068)

Revert "fix(query): avoid range join for single-row side (databendlabs#20062)"

This reverts commit 0464c86.

chore: add aggressive_recluster gate for recluster (databendlabs#20052)

* update

* fix

* fix

fix(query): avoid range join for single-row side (databendlabs#20062)

fix(storage): move stage_path_traversal_policy from settings to config (

databendlabs#20046)

* fix(storage): move stage_path_traversal_policy from settings to config and default to disable

stage_path_traversal_policy should be a server-level config rather than a
session setting since it is a security policy that should not be overridden
by individual sessions.

Changes:
- Move StagePathTraversalPolicy enum from databend-common-settings to
  databend-common-storage config
- Add stage_path_traversal_policy field to StorageConfig (inner) and the
  outer config with CLI flag --storage-stage-path-traversal-policy
- Remove the setting from settings_default and settings_getter_setter
- Update all call sites to read from GlobalConfig instead of session settings
- Change default from 'readonly' to 'disable' (reject traversal paths for
  both read and write)
- Update sqllogictest to match new default behavior

* fix: remove unused import TableContextSettings in stage.rs

* fix: update configs_table_basic golden file for stage_path_traversal_policy

refactor: meta: reorganize txn fetched records (databendlabs#20033)

feat: meta: add MetaTxn CAS helper

# Summary

Add a typed transaction helper for meta KV operations that records reads, stages writes, and retries failed CAS commits through a small manager API.

# Details

`MetaTxnManager` now drives retryable transaction closures, while `MetaTxn` keeps the read and write sets for one attempt. Reads registered with `get_for_update` become commit-time `eq_seq` guards, and fetched records can assert present or absent state before staging writes back to the same key.

Dictionary rename and table-tag drop use the helper to replace hand-built transaction loops. The helper uses the KV API associated error type instead of forcing `MetaError`, and the databend-meta-client dependency is updated to the version needed by the generic transaction path.