fix(view): decode signed account IDs in metadata admission

[gouhongshen]

What type of PR is this?

• API-change
• BUG
• Improvement
• Documentation
• Feature
• Test and CI
• Code Refactoring

Which issue(s) this PR fixes:

Related to #27768

What this PR does / why we need it:

Root cause

The catalog declares mo_catalog.mo_account.account_id as signed INT, which is the T_int32 vector type. The view-metadata admission fence read that result with vector.MustFixedColNoTypeCheck[uint32]. Race builds validate no-type-check vector access and panic when an INT vector is cast to []uint32. The former bounded-page fixture also used T_uint32, so it did not exercise the catalog type contract.

A pre-change race run with the fixture corrected to T_int32 reproduced the reported panic at view_metadata_recovery.go:157; the ordinary build passed because the no-type-check helper is unchecked outside race builds.

Changes

• Add one shared decoder for the account page that requires T_int32, validates the result shape and values, uses checked int32 reads, and converts valid IDs to the internal uint32 representation.
• Propagate a bounded internal error from the page callback and close the result before returning.
• Decode the complete page before any mo_view_dependencies writes, preserving failure atomicity.
• Keep the existing 32-row page limit, cursor advancement, dependency generation, and admission fencing unchanged.
• Change the bounded-page fixture to the actual T_int32 catalog type and add invalid-page regression cases for wrong type, negative ID, and batch/vector length mismatch. Each case asserts no panic, an error, and no metadata write.

BVT is not appropriate for this issue: SQL BVTs cannot directly control the internal executor vector type at this boundary. The focused compile UTs and the exact embedded-cluster issue test cover both the typed handoff and the public admission path.

Issue-to-test proof

• TestSeedViewMetadataRevalidationPageIsBounded supplies 32 signed INT32 account IDs and verifies bounded pagination and cursor advancement.
• TestSeedViewMetadataRevalidationPageRejectsInvalidAccountPage covers an unexpected UINT32 vector, a negative signed ID, and a row-count/vector-length mismatch; it verifies panic-free error handling and that no replacement/update follows a rejected page.
• TestIssue26114CrossAccountBranchQuotaAndOwnership exercises the reported embedded-cluster path, including both target_quota_and_ownership and legacy_metadata_counts_toward_target_quota.

Tests run

• .agents/skills/mo-dev/scripts/mo-cgo-test -v -count=1 -timeout=120s -run ^TestSeedViewMetadataRevalidationPage(IsBounded|RejectsInvalidAccountPage)$ ./pkg/sql/compile
• Same focused test command with -race
• .agents/skills/mo-dev/scripts/mo-cgo-test -count=1 -timeout=300s -run ^TestIssue26114CrossAccountBranchQuotaAndOwnership$ ./pkg/tests/issues/isolated
• Same issue command with -race
• Same issue command with -race -count=2
• .agents/skills/mo-dev/scripts/mo-cgo-test -count=1 -timeout=900s ./pkg/sql/compile

All listed commands passed.

Residual risks

The change is limited to decoding the account discovery page. A malformed catalog result now returns an internal error through the existing admission/recovery error path instead of panicking; generation fencing and bounded progress SQL are unchanged. The local exact race integration test was nondeterministic before the fix, but the corrected internal-vector regression deterministically reproduces the original panic and now passes in race mode.

[gouhongshen]

Unrelated CI blockers: the Ubuntu/x86 race UT has two unrelated, separately tracked failures.

• #27718: the earlier pkg/tests/issues TestIssue27718ConcurrentSnapshotQuota/optimistic_si mismatch was outside this PR and its attempt-1 workflow rerun passed on attempt 2; the blocker remains while [Bug]: Concurrent CREATE SNAPSHOT statements bypass the configured feature quota #27718 awaits manual validation.
• #26519: workflow run 33138188442 attempt 1, failed job 98742884390, failed only pkg/vm/engine/test/TestCheckLeaseFailed. The log shows the ISCP watermark wait never satisfied (current=0-0) and subsequent rpc client closed teardown errors. Existing [Bug]: Ubuntu UT job cascades across packages after cluster and checkpoint timeouts #26519 tracks this recurring embedded-cluster/ISCP full-UT failure family. The run passed pkg/tests/issues and pkg/tests/issues/isolated, including TestIssue26114CrossAccountBranchQuotaAndOwnership; this PR only changes pkg/sql/compile. Its attempt-1 workflow was rerun exactly once as attempt 2, then GitHub cancelled that prior-head attempt when the rebased head was pushed; no further rerun will be issued. The current-head workflow 33142440731 is pending.

[aptend]

Reviewed the exact head fea15e1. The signed INT32 catalog decode, page-shape validation, error propagation, result closure, and decode-before-write atomicity are consistent with the executor and catalog contracts. Focused normal and race tests, build, and vet passed.

[mergify]

Queued — the merge queue status continues in this comment ↓.

[gouhongshen]

@Mergifyio queue

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-28 06:37 UTC · Rule: main · triggered by @gouhongshen with the @mergifyio queue command
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged — 2026-08-28 06:37 UTC · at fea15e1bb145f15bec0ae5f592a048e929ca6b73 · squash

This pull request spent 20 seconds in the queue, including 2 seconds running CI.

Required conditions to merge

• #review-threads-unresolved = 0 [🛡 GitHub branch protection]
  • fix(view): decode signed account IDs in metadata admission #27770
• github-review-approved [🛡 GitHub branch protection]
  • fix(view): decode signed account IDs in metadata admission #27770
• any of [🛡 GitHub branch protection]:
  • check-success = Matrixone CI / UT Test on Ubuntu/x86
  • check-neutral = Matrixone CI / UT Test on Ubuntu/x86
  • check-skipped = Matrixone CI / UT Test on Ubuntu/x86
• any of [🛡 GitHub branch protection]:
  • check-success = Matrixone CI / SCA Test on Linux/arm64
  • check-neutral = Matrixone CI / SCA Test on Linux/arm64
  • check-skipped = Matrixone CI / SCA Test on Linux/arm64
• any of [🛡 GitHub branch protection]:
  • check-success = Matrixone Compose CI / multi cn e2e bvt test docker compose(PROXY)
  • check-neutral = Matrixone Compose CI / multi cn e2e bvt test docker compose(PROXY)
  • check-skipped = Matrixone Compose CI / multi cn e2e bvt test docker compose(PROXY)
• any of [🛡 GitHub branch protection]:
  • check-success = Matrixone Utils CI / Coverage
  • check-neutral = Matrixone Utils CI / Coverage
  • check-skipped = Matrixone Utils CI / Coverage
• any of [🛡 GitHub branch protection]:
  • check-success = Matrixone UT Coverage / UT Coverage on Ubuntu/x86
  • check-neutral = Matrixone UT Coverage / UT Coverage on Ubuntu/x86
  • check-skipped = Matrixone UT Coverage / UT Coverage on Ubuntu/x86
• any of [🛡 GitHub branch protection]:
  • check-success = Matrixone Standlone CI / multi CN e2e BVT Test on Linux/x64(COMPOSE, PESSIMISTIC)
  • check-neutral = Matrixone Standlone CI / multi CN e2e BVT Test on Linux/x64(COMPOSE, PESSIMISTIC)
  • check-skipped = Matrixone Standlone CI / multi CN e2e BVT Test on Linux/x64(COMPOSE, PESSIMISTIC)