[refactor](session) Simplify ConnectContext execution and cleanup ownership by morrySnow · Pull Request #70064 · apache/doris

morrySnow · 2026-11-03T06:56:06Z

Background

ConnectContext holds a frontend session's query, transaction and protocol resources. MySQL and Flight share ConnectPoolMgr registration, quotas and timeout scanning. Internal jobs and HTTP requests also create contexts, while helpers sometimes borrow an existing session.

What problem does this PR solve?

Issue Number: None
Related PR: #69867 (prepared Flight response schema integration)
PR Type: Refactor

Problem Summary:

Registration, execution and cleanup previously had overlapping owners. Some internal paths only removed a thread-local reference or closed a StatementContext, leaving session cleanup to object reclamation. This PR gives protocol requests one execution owner and makes private-context scopes responsible for cleanup on success, failure and cancellation. MySQL and Flight preserve their response contracts, and borrowed sessions remain with their original owner.

Details

Change map: Relative to upstream/master at b6c6751, production Java has 2443 added / 1673 removed lines across 93 files; tests and a regression comment have 8639 added / 462 removed lines across 77 files. The implementation additions are predominantly tests. The separately requested review inventory adds 12235 documentation lines in docs/connect-context-usage-review.md; no generated production file is added.
Moves vs. logic changes: ConnectContext retains SessionState (OPEN, DRAINING, STOPPING), an execution owner, one cleanupPending handoff flag and its registration handle. Protocol entries acquire/yield execution internally; there is no activate, caller-managed begin/end pair, reference count, cleanup-phase state machine, finalizer task or completion future. Flight uses that gate instead of a separate command lock. Private contexts use AutoCloseConnectContext or an explicit finally. MTMV and Insert factories transfer unbound ownership; factories returning an owning scope bind for that scope's lifetime. Cascades temporary expression planning uses a callback scope instead of returning an ownerless context. MTMV factories and cache helpers no longer perform overlapping binding/restoration. An unused analysis context and AutoCloseSessionVariable's dummy context sentinel are removed.
Behavior change: Both close modes reject new commands immediately. IMMEDIATE unregisters, closes the transport and cancels the captured executor. Only after synchronous interruption and request exit have both finished does the unique cleanup owner release resources. AFTER_RESPONSE drains the accepted response before unregistering and finalizing. MySQL flushes before yielding; Flight retains its ordinary FlightInfo schema/endpoints and results for DoGet. Existing result continuations can enter DRAINING without extending expiry. Cleanup closes remaining statement/protocol resources and runs existing transaction/session hooks; individual failures are logged and do not skip subsequent steps. Reentrant close cannot reopen or double-release the context.
Private and borrowed resources: Every production construction/factory path was traced to local cleanup, an owning scope, task ownership or a protocol session. This includes previously unbound temporary planning/authentication contexts. Stream Load, Broker/Routine Load, Export, statistics, cloud helpers, Dictionary, MTMV, connector rewrite workers and streaming metadata close only contexts they create. Factory failures during namespace or compute-group lookup clean up before ownership can reach the caller. Results and audit information are consumed before the scope closes. Synchronous scopes consume results and audit information before release; connector split cleanup retains its existing independent ownership. The usage inventory separately marks plan/job references that may retain a submitting session, including ExportJob plans and InsertJob's plans branch, for further review.
Avoid unnecessary contexts: The caller audit removes fifteen direct construction sites (46 to 31), including seven in the latest intent review (38 to 31). Group Commit planning borrows the active executor; materialization and backend selection use explicit compute-group inputs; HTTP Group Commit borrows its authenticated request; Cloud Warmup and post-load sync no longer create sessions for parameter/config access; auto-start does not invent an anonymous session when no user or cluster is provided. Broker Load passes its task-owned context explicitly through EnvFactory, Coordinator and CoordinatorContext. View dependency metadata creates at most one private context per request, only when a View needs parsing, and closes a separate StatementContext per view. Flight processors and MV hooks no longer duplicate their enclosing scope's thread-local management. No lifecycle state, registry or ownership wrapper is added.
Preserved isolation: Independent SQL, asynchronous attempts, change-user validation, MV planning and authentication inputs keep private contexts where identity, namespace, variables, query state or transactions differ. Synchronous helpers borrow their owner. Statement-only analysis uses a StatementContext without creating another session. Metadata-only journal synchronization and Group Commit pressure updates now use explicit request fields and ordinary-user timeout lookup, preserving retry/replay behavior without borrowing TLS. Workload policy and Routine Load group lookup take identity/group inputs directly. Their workload-group authorization retains AccessContext.NONE; the existing cloud-policy authorization still reads the caller-thread AccessContext, deliberately preserving that older behavior. Independent SQL forwarding and deeper cloud replica routing retain their session scopes.
Field ownership: All 68 original instance fields were checked against their producers, consumers and lifetimes; the detailed inventory is below. ConnectContext loses six fields: four unused values/accessors, the shared mutable ThreadInfo cache, and resultAttachedInfo. Result attachments now belong to the existing StmtExecutor and Export reads that executor; ordinary batches without attachments no longer append null. Processlist readers keep independent immutable display options. Session history, credentials, transactions, prepared statements and temporary tables retain their original owners. No additional context container or lifecycle state is introduced.
Execution intent: FileScan default-expression translation uses the existing context-free PlanTranslatorContext constructor; constant Round precision uses the existing context-independent fold before its context-dependent fallback; an index without a stored definition returns before session-variable setup. StreamLoadHandler owns or borrows the planning context, so the redundant cloud planner subclass is removed. The common SQL statement loop resets the statement-only Group Commit decision for both protocols, including multi-statement requests and requests after failure; MySQL retains its binary-command reset. Flight result continuation and HTTP stream planning are not moved to that boundary.
Caller behavior: Group Commit planning now publishes its planner to the current executor, so SQL block rules use the actual SQL/hash/user and audit sees the real plan. HTTP backend selection inherits the complete request settings, including the follower RPC timeout. Tests cover these ownership changes, cache reuse and planning failure without replacing queryId, loadId, transaction or StatementContext.
HTTP and forwarding: The HTTP filter records the context owned by each dispatch before initialization or authentication, including contexts not yet bound to TLS. It closes replaced contexts, handles rejected authentication/early returns, and restores outer dispatch ownership and binding. It never infers ownership from arbitrary TLS. The asynchronous JDBC worker stores the submitted database, not the HTTP context. Forward RPCs close their request-local context after response construction and query-map removal. Proxy cleanup does not roll back the originating session's transaction, drop its temporary tables or unregister its session id. ProxyMysqlChannel has no transport and keeps result packets intact for Thrift serialization.
Tasks and cancellation: TaskProcessor and the Disruptor handler close task-owned contexts on worker exit. Streaming Insert's cancel thread only cancels the captured executor; the execution thread unregisters the query and closes each attempt in finally, including preparation failure, retry and cancellation. MTMV nested scopes restore the outer context and unregister query resources before closing. Dry-run refresh withdraws its cancellation delegate before closing the private context. Forwarded cancellation snapshots the dispatched query identity and preserves the original SQL result, including delayed cancellation and publication races. It does not introduce a remote pending-cancellation protocol.
User switching: COM_CHANGE_USER unconditionally resets transaction, temporary-table, variable and prepared-statement state before authentication, including same-user requests. A private validation context applies target-user properties and namespace; the existing lifecycle/admission locks atomically commit identity and quota ownership. Refusal sends ERR before closing. Reset resources are not restored on failure. Registered contexts reject direct cross-user identity assignment. Login and change-user reuse initial-catalog setup.
Compatibility: No configuration, wire encoding, journal or stored-format changes. Internal Java planning helpers have updated ownership signatures and all callers are migrated. MySQL packet golden expectations remain unchanged. Flight self KILL and subsequent SHOW retain their ordinary result schema and rows; prepared executions follow the same contract. BE DoGet has no FE completion callback, so deferred coordinators retain their existing query/session expiry bounds.
Performance impact: One short gate controls protocol admission and handoff. No additional lifecycle registry, polling, worker pool or resource counter is introduced. Auth lookups, RPC, cancellation and resource release run outside lifecycle/admission locks. Timeout checks revalidate the observed executor and start time after property lookup. Small temporary contexts now finish through the same cleanup path instead of accumulating resources. Draining sessions retain their pool quota until results finish or expire.
Review inventory: Production ConnectContext usages records the source baseline 848f89a: all 31 direct construction sites, detailed intent/ownership scenarios, and 2559 method/member entries across 899 production source files. Java AST and compiled call/field/method-reference metadata cross-check the index. Known asynchronous handoff, retained-reference and local StatementContext questions are explicitly distinguished from proven leaks. This documentation commit changes no production behavior.
Rollback: Revert as a unit; no metadata migration is required.

Testing

Local JDK 17 verification used the repository's run-fe-ut.sh entry point.

416 tests across 38 selected FE classes passed, with zero failures, errors or skips in the combined final results.
The first 31-class run exposed seven test-fixture/expectation issues: an old authorization mock missed the new explicit entry point, exception assertions omitted existing Doris wrapping, and two new test setups initialized mocks in the wrong order. Only five test files changed to correct them. The follow-up 12-class run passed all 176 tests and the complete script finished with BUILD SUCCESS; the other 26 classes passed in the first run.
New tests cover explicit workload-group identity/defaults/authorization, metadata RPC fields/timeouts/retries/pool cleanup/journal waits, zero context construction in value-only paths, shared Stream Load planning ownership, independent processlist display options, and two real consecutive SQL executions with isolated result attachments.
Flight tests exercise real parsing, SET execution and Group Commit analysis across successive requests, failure, and a single multi-statement request. Existing Flight schema/options, MySQL prepared/forward/retry/cleanup and session-lifecycle tests also pass.
FE Checkstyle and git diff --cached --check passed. Surefire XML totals match the run logs; staged/source hashes match the final verification snapshot.

Documentation-only verification: all 8208 indexed call/field operations match the compiled metadata scan; all AST type references and 31 direct constructions are covered. Checked 3805 fixed-revision source links, 2797 unique anchors, table structure and whitespace. No kernel tests were rerun for the documentation-only addition.

No cluster SQL regression tests were run.

Historical baseline: 7398c4f passed 316 tests across 28 selected classes, and 60cecaa passed 1097 tests across 100 selected classes. These are separate from this change's latest verification. No cluster SQL regression tests were run.

Notes for Reviewers

Start with ConnectContext's English class comment, then acquireExecution/executeOwned/yieldExecution and interruptAndHandOffCleanup/handOffCleanup. STOPPING is terminal but is not a promise that cleanup has completed. If interruption finishes first, cleanupPending transfers finalization to the running owner; otherwise the closer takes idle execution and finalizes inline. Graceful closure claims STOPPING while retaining execution once protocol responses are empty. Cleanup's finally releases execution directly.

AutoCloseConnectContext owns a newly created private context; it is not a general binding guard. Its synchronous body must finish using the context and copy results/audit data before exit. Background work must own its scope inside the worker or retain independent resources. A request or cancellation callback that never returns still prevents safe release of resources it may be using. Java object memory remains GC-managed; session resources are released explicitly.

COM_CHANGE_USER follows the MySQL change-user contract. The server dispatch path resets before authentication; connection admission checks the authenticated user's slot before releasing the previous slot, including same-user requests.

Deferred follow-up: the existing follower temporary-table deletion hook builds an unqualified DROP using the current database and does not check forwarded SQL error status. Cleanup invocation is deterministic here, but those inherited namespace/error-handling problems require a separate fix. Cross-FE orphan reclamation and remote cleanup retries are outside this local ownership change. The old no-op session-registration hook is not treated as an actual leak.

Remaining findings from the broader caller audit, not fixed by this allocation simplification:

MysqlLoadManager discards the asynchronous reader Future. If request construction fails while the reader is queued, synchronous draining can finish and return before the old reader starts; an already running reader can also race the catch-path drain. This is a borrowed-resource boundary problem, not a missing private-context constructor cleanup.
Ordinary InsertTask cancellation clears context/command/executor fields while its worker may still use them. Worker cleanup still runs, but cancellation and execution can race on those fields.
ConnectPoolMgr and KillUtils can match a queryId, then later obtain the session's next executor and cancel it. Forwarded cancellation's stable handle does not protect this earlier lookup window.

These inherited paths prevent claiming that every asynchronous borrowing/cancellation scenario is already correct. They need focused fixes and concurrency tests; adding ConnectContext lifecycle states would not resolve the caller ownership errors.

Caller scenario	Context decision and owner
MySQL / Flight client session	New session; protocol entry owns execution, registration and eventual cleanup.
HTTP / forwarded RPC	Request-owned context; synchronous helpers borrow it. A proxy keeps origin-session transaction ownership separate.
Same-command planning / backend selection	Borrow the existing context/executor or pass ComputeGroup directly; helper does not close the session.
Independent SQL / asynchronous job attempt / MV analysis	Private context for identity/settings/query isolation; the executing scope closes it after its last use.
Statement-only analysis	Separate StatementContext; reuse the session, release each statement's resources locally.
Configuration or explicit metadata parameters	No ConnectContext. Remaining APIs that still read TLS are retained rather than silently changing identity/routing semantics.

Complete ConnectContext field ownership audit

Field ownership audit: all 68 instance fields at 7398c4f, grouped by the same lifetime.

Fields	Actual owner / intent	Decision
`protocolAdapter`	Protocol session	Keep one owner for MySQL/Flight transport, prepared wire state and retained Flight responses; implementation details remain in the adapter.
`lifecycleLock`, `sessionState`, `owner`, `cleanupPending`, `registeredPool`	Session lifecycle	Keep: these arbitrate admission, interruption/owner handoff and exactly-once pool removal. They are not query analysis state.
`connectionId`, `loginTime`, `sessionId`	Session identity	Keep: processlist, admission indexes and cluster-wide temporary-table/session ownership span commands.
`currentUserIdentity`, `authenticatedPrincipal`, `authenticatedRoles`, `isTempUser`, `sessionContext`	Authenticated session	Keep: privilege identity, authentication grants and delegated credentials span commands. SessionContext is the immutable external-credential envelope, not a second execution lifecycle.
`remoteIP`, `connectAttributes`	Client session metadata	Keep: access decisions/audit and handshake attributes describe the client across commands.
`sessionVariable`, `userVars`	Session configuration	Keep: SET and user variables persist. Value-only helpers take explicit inputs instead of manufacturing a session.
`defaultCatalog`, `currentDb`, `currentDbId`, `lastDBOfCatalog`	Session namespace	Keep: USE and per-catalog database history persist; the name/id pair is restored together. Pure helpers may take the existing NameSpaceContext value.
`txnEntry`	Session transaction	Keep: explicit transactions span statements. A forwarding proxy borrows the origin transaction and must not roll it back on local cleanup.
`preparedStmtId`, `preparedStatementContextMap`	Session prepared statements	Keep: prepared plans/parameter state and IDs must survive EXECUTE calls until CLOSE/reset/session cleanup.
`dbToTempTableNamesMap`	Session temporary tables	Keep: table ownership spans commands and is released by the existing session hook. No temporary-table protocol redesign in this change.
`lastQueryId`, `insertResult`	Session result history	Keep: last_query_id and SHOW LAST INSERT intentionally observe an earlier command; they cannot be cleared with every statement.
`env`, `connectScheduler`	Borrowed services	Keep references: environment is injectable and scheduler identifies the protocol service. Neither is owned/closed by the session; they are not reasons for pure helpers to allocate contexts.
`executor`, `command`, `state`	Current execution/response	Keep the observable active handles: cancellation, timeout, processlist and MySQL/Flight response handling need them, including commands without a SQL StatementContext. The executor owns query payloads.
`stmtId`, `forwardedStmtId`, `queryId`, `traceId`	Current request identity	Keep the active identity facade for forwarding/audit/processlist/indexing. Async cancellation must retain its query-owned target rather than rereading this mutable facade.
`startTime`, `startTimeInstant`, `returnRows`, `sqlHash`, `auditEventBuilder`	Current request accounting	Keep for existing protocol/audit consumers; these are request data, not enduring user settings. Moving them together requires preserving non-SQL and response-drain boundaries; no extra request state machine is introduced.
`statementContext`	Owned analysis scope	Keep the current pointer: parser/SQL-cache publishes it before StmtExecutor exists for placeholders, hints and analysis IDs. StatementContext already owns planning caches, locks and cleanup. Independent nested analysis should use a local StatementContext borrowing the same session, with its own IDs/caches.
`loadId`, `backendId`, `needRegenerateInstanceId`, `instanceIdGenerator`	Execution/load routing	Currently required by load instance ID generation/retry and stream-file placement. Better long-term owner is the load/coordinator input, but blindly merging with queryId changes retry/load semantics; retained in this scoped refactor.
`cloudCluster`, `computeGroup`	Session routing selection	Keep: cloudCluster caches policy selection; computeGroup preserves the login resource-tag selection. They differ from SET_VAR overrides. Background resolution now takes identity/group values directly. The existing cloud-policy conditional-authorization path still reads ambient TLS AccessContext; workload-group authorization separately keeps NONE. This change preserves that distinction.
`effectiveCloudCluster`, `queryBackendSelectionDecision`, `loadBackendSelectionDecision`, `backendSelectionProfile`, `workloadGroupName`	Effective execution routing/audit	Request-level evidence of actual routing, including after SET_VAR restoration; not interchangeable with session preferences. Retained for planner/coordinator/audit consumers; future movement belongs to the existing execution owner.
`loadBackendSelectionHint`	Async load attempt input	Retain separately from the statement decision: replay restores persisted intent before replanning, while setStartTime resets per-statement evidence.
`currentConnectedFEIp`, `isProxy`	Forwarded execution provenance	Keep: direct coordinator routing and proxy-versus-origin resource ownership depend on them; internal RPC metadata helpers do not need a SQL context.
`syntheticWriteColTargetTableId`	Scoped analysis input	Row-level DML and EXPLAIN enable a synthetic write column for one table and restore the previous target in finally. This is analysis state, not a session preference; moving it belongs with those existing analysis entry points.
`skipAuth`	Scoped internal-command policy	Used by nested DML and private system scopes such as fetchLoadJob. Some existing callers reset false rather than restore an outer value. Retained without broad access-control changes; future cleanup should make the explicit command privilege boundary carry this intent.
`isGroupCommit`	Current SQL execution decision	Keep the current decision for planner and insert execution, but reset at the common SQL statement loop so both Flight and MySQL, including multi-statement SQL, recompute it. MySQL retains its packet-level reset for binary prepared execution. DoGet and HTTP stream planning are not reset by this boundary.
`statsErrorEstimator`	Query profiling (inactive producer)	Production readers exist but no writer to this ConnectContext field was found. It is not genuine session state. Retained here to avoid silently deleting/reworking the estimator plumbing across planner/coordinator/profile APIs; it needs a separate feature-level cleanup.
`noAuth`	Legacy cloud-check override	No production writer found; one WarmUp parser test enables it and Auth still reads it. Not a justified new session property. Retained in this change rather than mixing an access-control/test-fixture rewrite into allocation simplification.
`resultAttachedInfo`	Statement result payload	Move to existing StmtExecutor; Export consumes the executor result. It previously appended row-batch attachments indefinitely across session commands, with no reset.
`threadInfo`	Observer display option	Remove cached mutable view. Each processlist reader gets its own immutable isFull option; session data itself is still a live view, not an atomic snapshot.
`streamLoadInfo`, `notEvalNondeterministicFunction`, `queryDetail`, `connectingFeLocalResourceGroup`	Unused session storage	Remove fields/accessors: no production consumer. For connectingFeLocalResourceGroup remove the unused receive-side copy only; keep the wire field and sender for compatibility.

Review checkpoint	Conclusion
Goal and evidence	Explicit cleanup owners cover protocol sessions, private helper contexts and worker lifetimes. Tests observe resource release, admission/quota removal, response preservation and borrowed-parent survival.
Scope and reuse	Existing scopes, executors, StatementContext, explicit RPC request construction, pool and protocol adapters are reused; allocation-only helpers no longer create sessions. No additional shared ConnectContext lifecycle state; duplicate context/binding ownership is removed.
Concurrency and locks	One protocol execution gate; lifecycleLock precedes admissionLock. Heavy work is outside both. Streaming finalization belongs to the execution thread; HTTP ownership is per dispatch. No new lock order.
Lifecycle and ownership	Initialization failure, normal/exceptional exit, cancellation and early return all have an owner. Proxy session state is borrowed. Nested scopes restore parents. The remaining asynchronous borrowing exceptions are listed above.
Configuration	None added or changed.
Compatibility	No network/storage-format change. Internal helper signatures and callers change together; packet/result behavior is tested.
Parallel entry points	MySQL initialization/read loops, Flight commands/DoGet/expiry, HTTP, forwarded RPCs, load/background workers and temporary planners were inventoried.
Conditional checks	Checks distinguish concrete ownership, admission and handoff cases. No speculative validity branch or GC-based cleanup mechanism.
Test coverage	Success, refusal, failure, retry, both handoff orders, reentry, replacement, nesting and borrowed-resource protection are covered. Cluster regression remains unrun.
Test results	Actual run totals are in Testing. No handwritten regression output or changed packet golden expectations. Cleanup observations are asserted outside swallowed cleanup callbacks.
Observability	Existing connection/action-scoped failure logs remain; no new hot-path INFO log or monitoring mechanism.
Transactions and persistence	Existing transaction cleanup runs for owned sessions; proxy finalization preserves the origin's transaction. Journal, replay and failover protocols are unchanged.
Data writes and crashes	No new data-commit path. Cleanup respects resources still in use; remote orphan reclamation remains separate.
FE/BE variables	No new serialized fields or variable propagation.
Performance	Fifteen direct constructor sites removed across the caller audits; no global sweep, extra executor or reference accounting. Cleanup runs at existing exit boundaries; Flight loses its duplicate lock.
Other findings	Independent cross-review checked construction necessity, explicit ownership and scope-exit consumers. Remaining MysqlLoad reader, InsertTask cancellation and queryId lookup races, plus inherited temporary-table issues, are explicitly listed above.

Release note

HTTP and internal background work release their private session resources when their scope ends, including failure and cancellation paths. MySQL COM_CHANGE_USER resets the session even when the username is unchanged, reloads target-user defaults and enforces its connection limit. Failed changes return an error before closing. Group Commit planning applies SQL block rules to the active statement's SQL and user and exposes its planner to audit. Its statement decision is reset between Flight commands and text multi-statements. Result attachments no longer accumulate across commands in a long-lived session, and concurrent processlist readers do not overwrite each other's full-SQL display option.

Check List (For Author)

Behavior changed: Yes (see Details).
Does this need documentation: Yes; the caller and concurrency contract is in ConnectContext's English class comment, and the requested production-usage review inventory is in docs/connect-context-usage-review.md.
Pre-submission status: Not ready: Draft, awaiting human review; remaining caller-audit findings are listed above. Selected FE tests and style checks are documented above; cluster regression was not run.

AI Disclosure

Tool: OpenAI Codex (GPT-6).
Generated: Implementation, tests, class comments and this description.
Human review: Pending.

hello-stephen · 2026-11-03T06:56:11Z

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

What problem was fixed (it's best to include specific error reporting information). How it was fixed.
Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
What features were added. Why was this function added?
Which code was refactored and why was this part of the code refactored?
Which functions were optimized and what is the difference before and after the optimization?

### What problem does this PR solve? Issue Number: None Related PR: apache#70064 Problem Summary: Move the lifecycle and caller contract into ConnectContext's English class Javadoc, where callers can find the required initialization, activation, operation admission and cleanup APIs. Explain state transitions, registration and close races, thread binding, timeout responsibilities and cleanup completion/failure behavior. Remove the standalone lifecycle design document from the PR. No runtime code changes. ### Release note None ### Check List (For Author) - Test: No need to rerun unit tests for comment-only changes. Verified that all changed Java lines are comments; FE Core Checkstyle and git diff --check passed. - Behavior changed: No. - Does this need documentation: Yes, included as ConnectContext class Javadoc.

### What problem does this PR solve? Issue Number: None Related PR: apache#70064 Problem Summary: The isKilled flag duplicated lifecycle state and could leave a context ACTIVE after self KILL requested termination. MySQL consumed that flag after processing a command, while Flight could keep admitting requests. Self KILL QUERY also took the connection-termination path. Remove isKilled and make lifecycle state the admission authority. Rename the operation counter to inFlightOperations. Route closure through requestClose with immediate or after-response timing: both revoke registration immediately, but deferred closure lets admitted responses finish without cancellation. An immediate request can upgrade a pending deferred close; registration, transport closure and final release each run once across concurrent callers. Migrate MySQL quit/read loops, KILL and workload cancellation checks. Keep self KILL QUERY query-only, and return an empty FlightInfo for self KILL CONNECTION without issuing a DoGet ticket requiring the revoked session. Update the class Javadoc and test response ordering, mode upgrades and cleanup races. ### Release note Complete normal quit and self KILL CONNECTION responses before closing the session. Self KILL QUERY preserves the connection, and Flight self-termination does not return an unusable result ticket. ### Check List (For Author) - Test: Unit tests via run-fe-ut.sh --run: 15 classes, 181 tests passed with zero failures, errors or skipped tests; full script BUILD SUCCESS. FE Core Checkstyle and git diff --check passed. No cluster SQL regression tests run. - Behavior changed: Yes. Session admission uses lifecycle state only, close requests distinguish immediate and after-response closure, and self KILL QUERY no longer closes the connection. - Does this need documentation: Yes, updated ConnectContext class Javadoc.

### What problem does this PR solve? Issue Number: None Related PR: apache#70064 Problem Summary: Four correlated booleans encode sequential teardown progress, making concurrent and reentrant closure harder to reason about. Replace them with a monotonic CleanupPhase while retaining separate admission, close policy and operation lifetime. Name Flight's monitor-guarded deferred-executor sealing state explicitly. Document that MySQL flushes before operation exit, while a synchronous Flight response must be independent of session resources before gRPC serializes it. Clarify independent CloseSession cancellation semantics and test resource-release reentry, deferred handoff, response serialization after cleanup, and CloseSession from a concurrent RPC. ### Release note None ### Check List (For Author) - Test: Unit Test: 15 selected FE classes, 184 tests passed; FE Checkstyle and git diff --check passed - Behavior changed: No; preserve teardown and protocol behavior while simplifying state and clarifying response boundaries - Does this need documentation: Yes; update the English lifecycle and protocol Javadoc in the changed classes

### What problem does this PR solve? Issue Number: None Related PR: apache#70064 Problem Summary: Separate lifecycle, close-mode and cleanup-phase fields make concurrent close ownership harder to maintain. Keep one control value and a resource-user count instead. The unique protocol closer owns an internal reference and returns it in finally; the last reference holder runs final cleanup. Revoke local pool registration under the existing lifecycle-to-pool lock order and preserve immediate and after-response semantics. Derive public lifecycle observations from control and completion, and restore thread-local context before completion callbacks. Document caller responsibilities and verify both ownership handoff orders, reentry, close races and cleanup errors. ### Release note None ### Check List (For Author) - Test: Unit Test: 15 selected FE classes, 199 tests passed; FE Checkstyle and git diff --check passed - Behavior changed: Yes; completion callbacks observe the restored caller context, and executor publication is rejected once final cleanup owns all resources, including after cleanup failure. Client close policies are unchanged. - Does this need documentation: Yes; update the English ConnectContext class Javadoc and pool-unregistration contract in code

### What problem does this PR solve? Issue Number: None Related PR: apache#70064 Problem Summary: Keep one session-owned resource reference from construction until transport closure and let the last session or operation reference perform final cleanup. Remove the unused lifecycle observation enum, completion future, cleanup failure accumulator and close-action record. Release Flight deferred executors after admitted commands exit, removing the separate sealed flag and duplicate teardown path. Tests verify pool admission, response ordering and actual release effects instead of a test-only lifecycle view. Move assertions out of callbacks whose failures cleanup deliberately catches. ### Release note None ### Check List (For Author) - Test - [ ] Regression test - [ ] Unit Test - [x] Manual test (add detailed scripts or steps below) - [ ] No need to test or manual test. Explain why: Checkstyle and git diff --check passed. The selected unit-test build was stopped during dependency compilation so the final validation can include the current upstream Flight changes; no unit-test pass is claimed for this intermediate commit. - Behavior changed: - [ ] No. - [x] Yes. Flight deferred executors are released with other session resources after admitted commands exit. - Does this need documentation? - [ ] No. - [x] Yes. Updated the English ConnectContext and FlightProtocolAdapter class comments. ### Check List (For Reviewer who merge this PR) - [ ] Confirm the release note - [ ] Confirm test cases - [ ] Confirm document - [ ] Add branch pick label

…hemas ### Background ConnectContext coordinates client admission and resource lifetime. Flight prepared statements now validate execution response schemas against the schema advertised during Prepare. ### What problem does this PR solve? Issue Number: None Related PR: apache#70064, apache#69867 PR Type: Refactor Problem Summary: Integrate upstream/master while retaining deferred session cleanup and self-KILL responses. A self KILL CONNECTION response must carry the advertised StatusResult schema while avoiding a DoGet ticket for its revoked session. Also snapshot the volatile executor when reading its timeout to avoid racing the previous command's clear(). ### Details - **Change map:** Integrate upstream/master at 897bb25; resolve the Flight producer response conflict, add prepared self-KILL tests, adapt the new schema fixture to admission/cleanup, and use one local executor snapshot for timeout calculation. The other upstream changes are retained as-is. - **Moves vs. logic changes:** Retain current Flight schema handling and the unified reference-based cleanup; represent self-KILL with its matching status schema and no ticket. - **Behavior change:** Prepared self KILL CONNECTION succeeds without a schema mismatch; self KILL QUERY retains its session and prepared handle. - **Compatibility:** No wire definitions, stored formats or configuration changes. The response header matches Prepare. - **Performance impact:** No new shared state, lock or command-path allocation for timeout calculation. - **Rollback:** Revert the lifecycle PR as a unit; no metadata migration is required. ### Testing - ./run-fe-ut.sh --run with 17 selected lifecycle, protocol, timeout, KILL and schema test classes: 272 tests passed, zero failures/errors/skips; full script BUILD SUCCESS. - mvn -f fe/pom.xml checkstyle:check -pl fe-core: passed. - git diff --cached upstream/master --check: passed. - Verified report totals and source/compiled-class timestamps. No MySQL golden changes. - Cluster regression tests were not run. ### Release note None ### Check List (For Author) - Behavior changed: Yes (see Details). - Does this need documentation: Yes; ownership and caller responsibilities are documented in the English class comments. - Pre-submission status: Partially verified: selected unit tests and style checks passed; cluster regression was not run. ### AI Disclosure - Tool: OpenAI Codex (GPT-6). - Generated: Conflict resolution, tests and this description. - Human review: Pending.

…ership ### Background ConnectContext cleanup used explicit activation, paired operation calls and resource reference counting. MySQL scheduling and Flight's separate command lock also participated in lifetime management. ### What problem does this PR solve? Issue Number: None Related PR: apache#70064 (continuation) PR Type: Refactor Problem Summary: Give each context one execution owner and one ready finalizer. Fixed protocol callbacks now own initialization and requests, while close interruption publishes cleanup only after its synchronous work returns. Capture forwarded cancellation identity so a delayed cancel cannot target a subsequent query or overwrite the statement response. ### Details - **Change map:** Production Java: 421 added / 350 removed lines in 12 files. Tests: 1243 added / 541 removed lines in 13 files. No standalone document or generated file. - **Moves vs. logic changes:** Remove activate, public begin/end pairs and resource reference counting. Share one execution gate across MySQL and Flight. Move MySQL read rearm after response/finally/TLS completion. Document creation, usage, closing and handoff in the English class comment. - **Behavior change:** Closed sessions reject queued work. Immediate close interrupts transport/execution, then hands off final cleanup; deferred close preserves the response and supports immediate upgrade. Reentry cannot repeat cleanup. Forwarded cancellation retains the original query identity and uses its own result for journal waiting. - **Compatibility:** No configuration, wire, journal or stored-format changes. Existing MySQL packet and Flight response expectations remain covered. - **Performance impact:** Remove Flight's duplicate command lock. No additional per-session thread or cleanup executor; admission and handoff use short critical sections. - **Rollback:** Revert this commit; no metadata migration. ### Testing The repository run-fe-ut.sh broad selection exercised 306 tests across 23 classes. A missing token in one new mocked Flight fixture was corrected; the focused lifecycle rerun passed all 33 executions and completed with BUILD SUCCESS. Latest reports for the 23 classes show 306 passing tests, zero failures/errors/skips. All changed Java sources have current compiled classes. FE Checkstyle and git diff --cached upstream/master --check passed. Cluster SQL regression was not run. ### Release note None ### Check List (For Author) - Behavior changed: Yes (see Details). - Does this need documentation: Yes; English ConnectContext class comment updated. - Pre-submission status: Not ready: Draft awaiting human review; selected local unit tests and style checks passed. ### AI Disclosure - Tool: OpenAI Codex (GPT-6). - Generated: Implementation, tests, class comment and description. - Human review: Pending.

### What problem does this PR solve? Issue Number: None Related PR: None Problem Summary: ConnectContext construction, connection registration, thread binding, statement cleanup, and session teardown follow different ownership paths across MySQL, Flight, forwarding, background jobs, and HTTP requests. Document those paths and map concrete cleanup gaps and unverified lifecycle contracts to their triggering scenarios and validation cases. Exclude the obsolete temporary-table session registration mechanism from the findings. ### Release note None ### Check List (For Author) - Test: No need to test runtime behavior (documentation only); validated source links, scenario and issue mappings, Markdown structure, and git diff --check - Behavior changed: No - Does this need documentation: No (this change is the documentation)

### What problem does this PR solve? Issue Number: None Related PR: None Problem Summary: The existing lifecycle inventory mixes protocols, execution phases, ownership, and failure events. Define a four-state ConnectContext lifecycle, separate registration and thread binding from object state, and consolidate the scenarios into client-session and operation-owned templates. Map cleanup defects to shared activation, teardown, and scope mechanisms while preserving protocol-specific and deferred-resource boundaries. ### Release note None ### Check List (For Author) - Test: No need to test runtime behavior (documentation only); validated source links, section ordering, scenario coverage, Markdown fences, and git diff --check - Behavior changed: No - Does this need documentation: No (this change is the documentation)

### What problem does this PR solve? Issue Number: None Related PR: None Problem Summary: The lifecycle refactoring proposal needs explicit ownership of connection registration, deregistration, and Flight timeout handling. Document entry-point triggers, ConnectContext orchestration, connection-pool bookkeeping, and protocol resource boundaries. Distinguish idle-session expiry, query timeout, and deferred-result expiry, including concurrency constraints and migration acceptance tests. ### Release note None ### Check List (For Author) - Test: No need to test runtime behavior (documentation only); validated 38 source anchors, section ordering, existing scenario and issue mappings, Markdown fences, and git diff --check - Behavior changed: No - Does this need documentation: No (this change is the documentation)

### What problem does this PR solve? Issue Number: None Related PR: None Problem Summary: MySQL registration could survive a failed login response because unregistration depended on a channel listener installed after the response. Flight teardown called back into the connection pool, which also owned protocol release and transaction rollback, leaving lifecycle responsibilities split across paths. Coordinate initialization, activation, registration and idempotent closure in ConnectContext. Revoke admission before cancelling commands and closing transport, then release session resources after the existing protocol operations exit. Keep pool bookkeeping separate, preserve the caller's thread context during cleanup, and distinguish idle session expiry from query and deferred-result timeouts. Migrate MySQL and Flight client entry points, cover initialization and response failures and registration/closure races, and update the lifecycle design document. Internal owned/binding scopes and reliable remote cleanup retries remain separate migration work. ### Release note Clean up failed client sessions reliably and defer Flight session buffer release until running commands exit. ### Check List (For Author) - Test: Unit tests via run-fe-ut.sh --run: 9 selected classes, 115 tests passed; full script BUILD SUCCESS. FE Core Checkstyle and git diff --check passed. - Behavior changed: Yes. Client teardown uses one lifecycle, rejects new commands after closure starts, and releases resources after running operations exit. - Does this need documentation: Yes, updated docs/connect-context-lifecycle.md.

### What problem does this PR solve? Issue Number: None Related PR: apache#70064 Problem Summary: Move the lifecycle and caller contract into ConnectContext's English class Javadoc, where callers can find the required initialization, activation, operation admission and cleanup APIs. Explain state transitions, registration and close races, thread binding, timeout responsibilities and cleanup completion/failure behavior. Remove the standalone lifecycle design document from the PR. No runtime code changes. ### Release note None ### Check List (For Author) - Test: No need to rerun unit tests for comment-only changes. Verified that all changed Java lines are comments; FE Core Checkstyle and git diff --check passed. - Behavior changed: No. - Does this need documentation: Yes, included as ConnectContext class Javadoc.

Issue Number: None Related PR: apache#70064 Problem Summary: The isKilled flag duplicated lifecycle state and could leave a context ACTIVE after self KILL requested termination. MySQL consumed that flag after processing a command, while Flight could keep admitting requests. Self KILL QUERY also took the connection-termination path. Remove isKilled and make lifecycle state the admission authority. Rename the operation counter to inFlightOperations. Route closure through requestClose with immediate or after-response timing: both revoke registration immediately, but deferred closure lets admitted responses finish without cancellation. An immediate request can upgrade a pending deferred close; registration, transport closure and final release each run once across concurrent callers. Migrate MySQL quit/read loops, KILL and workload cancellation checks. Keep self KILL QUERY query-only, and return an empty FlightInfo for self KILL CONNECTION without issuing a DoGet ticket requiring the revoked session. Update the class Javadoc and test response ordering, mode upgrades and cleanup races. Complete normal quit and self KILL CONNECTION responses before closing the session. Self KILL QUERY preserves the connection, and Flight self-termination does not return an unusable result ticket. - Test: Unit tests via run-fe-ut.sh --run: 15 classes, 181 tests passed with zero failures, errors or skipped tests; full script BUILD SUCCESS. FE Core Checkstyle and git diff --check passed. No cluster SQL regression tests run. - Behavior changed: Yes. Session admission uses lifecycle state only, close requests distinguish immediate and after-response closure, and self KILL QUERY no longer closes the connection. - Does this need documentation: Yes, updated ConnectContext class Javadoc.

Issue Number: None Related PR: apache#70064 Problem Summary: Four correlated booleans encode sequential teardown progress, making concurrent and reentrant closure harder to reason about. Replace them with a monotonic CleanupPhase while retaining separate admission, close policy and operation lifetime. Name Flight's monitor-guarded deferred-executor sealing state explicitly. Document that MySQL flushes before operation exit, while a synchronous Flight response must be independent of session resources before gRPC serializes it. Clarify independent CloseSession cancellation semantics and test resource-release reentry, deferred handoff, response serialization after cleanup, and CloseSession from a concurrent RPC. None - Test: Unit Test: 15 selected FE classes, 184 tests passed; FE Checkstyle and git diff --check passed - Behavior changed: No; preserve teardown and protocol behavior while simplifying state and clarifying response boundaries - Does this need documentation: Yes; update the English lifecycle and protocol Javadoc in the changed classes

### What problem does this PR solve? Issue Number: None Related PR: apache#70064 Problem Summary: Separate lifecycle, close-mode and cleanup-phase fields make concurrent close ownership harder to maintain. Keep one control value and a resource-user count instead. The unique protocol closer owns an internal reference and returns it in finally; the last reference holder runs final cleanup. Revoke local pool registration under the existing lifecycle-to-pool lock order and preserve immediate and after-response semantics. Derive public lifecycle observations from control and completion, and restore thread-local context before completion callbacks. Document caller responsibilities and verify both ownership handoff orders, reentry, close races and cleanup errors. ### Release note None ### Check List (For Author) - Test: Unit Test: 15 selected FE classes, 199 tests passed; FE Checkstyle and git diff --check passed - Behavior changed: Yes; completion callbacks observe the restored caller context, and executor publication is rejected once final cleanup owns all resources, including after cleanup failure. Client close policies are unchanged. - Does this need documentation: Yes; update the English ConnectContext class Javadoc and pool-unregistration contract in code

### What problem does this PR solve? Issue Number: None Related PR: apache#70064 Problem Summary: Keep one session-owned resource reference from construction until transport closure and let the last session or operation reference perform final cleanup. Remove the unused lifecycle observation enum, completion future, cleanup failure accumulator and close-action record. Release Flight deferred executors after admitted commands exit, removing the separate sealed flag and duplicate teardown path. Tests verify pool admission, response ordering and actual release effects instead of a test-only lifecycle view. Move assertions out of callbacks whose failures cleanup deliberately catches. ### Release note None ### Check List (For Author) - Test - [ ] Regression test - [ ] Unit Test - [x] Manual test (add detailed scripts or steps below) - [ ] No need to test or manual test. Explain why: Checkstyle and git diff --check passed. The selected unit-test build was stopped during dependency compilation so the final validation can include the current upstream Flight changes; no unit-test pass is claimed for this intermediate commit. - Behavior changed: - [ ] No. - [x] Yes. Flight deferred executors are released with other session resources after admitted commands exit. - Does this need documentation? - [ ] No. - [x] Yes. Updated the English ConnectContext and FlightProtocolAdapter class comments. ### Check List (For Reviewer who merge this PR) - [ ] Confirm the release note - [ ] Confirm test cases - [ ] Confirm document - [ ] Add branch pick label

…ership ConnectContext cleanup used explicit activation, paired operation calls and resource reference counting. MySQL scheduling and Flight's separate command lock also participated in lifetime management. Issue Number: None Related PR: apache#70064 (continuation) PR Type: Refactor Problem Summary: Give each context one execution owner and one ready finalizer. Fixed protocol callbacks now own initialization and requests, while close interruption publishes cleanup only after its synchronous work returns. Capture forwarded cancellation identity so a delayed cancel cannot target a subsequent query or overwrite the statement response. - **Change map:** Production Java: 421 added / 350 removed lines in 12 files. Tests: 1243 added / 541 removed lines in 13 files. No standalone document or generated file. - **Moves vs. logic changes:** Remove activate, public begin/end pairs and resource reference counting. Share one execution gate across MySQL and Flight. Move MySQL read rearm after response/finally/TLS completion. Document creation, usage, closing and handoff in the English class comment. - **Behavior change:** Closed sessions reject queued work. Immediate close interrupts transport/execution, then hands off final cleanup; deferred close preserves the response and supports immediate upgrade. Reentry cannot repeat cleanup. Forwarded cancellation retains the original query identity and uses its own result for journal waiting. - **Compatibility:** No configuration, wire, journal or stored-format changes. Existing MySQL packet and Flight response expectations remain covered. - **Performance impact:** Remove Flight's duplicate command lock. No additional per-session thread or cleanup executor; admission and handoff use short critical sections. - **Rollback:** Revert this commit; no metadata migration. The repository run-fe-ut.sh broad selection exercised 306 tests across 23 classes. A missing token in one new mocked Flight fixture was corrected; the focused lifecycle rerun passed all 33 executions and completed with BUILD SUCCESS. Latest reports for the 23 classes show 306 passing tests, zero failures/errors/skips. All changed Java sources have current compiled classes. FE Checkstyle and git diff --cached upstream/master --check passed. Cluster SQL regression was not run. None - Behavior changed: Yes (see Details). - Does this need documentation: Yes; English ConnectContext class comment updated. - Pre-submission status: Not ready: Draft awaiting human review; selected local unit tests and style checks passed. - Tool: OpenAI Codex (GPT-6). - Generated: Implementation, tests, class comment and description. - Human review: Pending.

### Background Flight SQL returns a FlightInfo ticket before DoGet consumes the local result. Backend results also retain deferred query resources on the frontend. ### What problem does this PR solve? Issue Number: None Related PR: apache#70064 (ConnectContext lifecycle refactor) PR Type: Bugfix Problem Summary: Deferred closure revoked the session token and replaced normal Flight results with an empty StatusResult response. Keep existing tickets usable until their results are consumed or expire, while rejecting new commands and retaining the unique execution owner for cleanup. ### Details - **Change map:** Production Java has 272 added / 120 removed lines across 6 files; tests have 820 added / 45 removed lines across 8 files. Changes cover response admission/readiness, expiry under execution ownership, producer failure cleanup and protocol tests. No generated files or standalone documents are added. - **Frequency:** A Flight request requests AFTER_RESPONSE, such as self KILL CONNECTION, including a following SHOW in the same request. - **Root cause:** GetFlightInfo returning was treated as completion of result delivery, although DoGet still needs the session registration and Arrow buffers. - **Why existing tests missed it:** The earlier self-kill tests asserted zero endpoints and successful serialization instead of consuming a normal result ticket. - **Fix:** Defer unregister and finalizer readiness until response resources are released. Existing result continuations and expiry maintenance share the execution owner, with fixed expiry and immediate-close upgrade support. Preserve normal schema, endpoints and rows; discard results on failed response construction and listener failures. - **Behavior change:** A gracefully closing Flight session retains its pool quota and existing result tickets until consumption or expiry; new commands are rejected. - **Other paths and branches:** Covers ordinary and prepared statements, metadata admission, MySQL handoff, immediate closure and deferred backend query expiry. No wire format, configuration or shared lifecycle flag is added. BE DoGet still has no FE completion callback, so existing query/session deadlines bound retention. ### Testing Local verification on the final source tree (JDK 17): - `bash run-fe-ut.sh --run 'ConnectContextLifecycleTest,ConnectContextFlightDrainTest,ConnectContextTest,ConnectPoolMgrTest,AcceptListenerTest,ReadListenerTest,FlightProtocolAdapterTest,DorisFlightSqlProducerTest,DorisFlightSqlSchemaTest,FlightSqlDeferredQueryIdleTimeoutTest,FlightSessionsInConnectPoolTest,FlightSessionOptionsTest,FlightSqlTableTypesTest,FlightSqlChannelTest,FEOpExecutorCancellationTest,FEOpExecutorMysqlProtocolTest,MasterOpExecutorBackendSelectionTest,MysqlPreparedStatementForwardingTest'`: **245 tests passed across 18 classes**, zero failures, errors or skips. The complete script finished with **BUILD SUCCESS**. Counts were verified against the fresh Surefire XML reports. - Covers real SQL parsing/execution of `KILL CONNECTION <self>; SHOW DATABASES`, normal and prepared self-kill tickets, actual DoGet rows, fixed result expiry, deferred BE query expiry, immediate-close/DoGet handoff, slow cleanup notification, reentry, listener failures and failed response construction. Existing MySQL and forwarded-cancellation checks also pass. - `mvn -f fe/pom.xml checkstyle:check -pl fe-core`: **passed**, zero violations. - `git diff --cached --check`: **passed**. Validated source hashes match the submitted files. - Cluster SQL regression tests were not run. ### Release note Flight SQL preserves the normal result of self KILL CONNECTION and subsequent statements in the same accepted request until the result is consumed or expires. ### Check List (For Author) - Behavior changed: Yes (see Details). - Does this need documentation: No; the existing English lifecycle and protocol class comments are updated. - Pre-submission status: Partially verified: selected local FE tests and Checkstyle pass; cluster SQL regression was not run. Draft PR awaits human review. ### AI Disclosure - Tool: OpenAI Codex (GPT-6). - Generated: Implementation, tests, class comments and this description. - Human review: Pending.

### Background ConnectContext serializes local session admission and execution ownership while MySQL and Flight callbacks can concurrently request closure. User quota and statement timeout properties can block on Auth metadata or directory lookup. ### What problem does this PR solve? Issue Number: None Related PR: apache#70064 (ConnectContext lifecycle refactor) PR Type: Refactor Problem Summary: Property lookup under the lifecycle gate could delay immediate interruption. Move these lookups outside the gate and revalidate the observed statement before timeout cancellation. Remove redundant cancellation copies and audit state, restore independent static Flight metadata handling and preserve pool-slot release after COM_CHANGE_USER. ### Details - **Change map:** Production Java: 103 added / 91 removed lines in 5 files; tests: 219 added / 22 removed lines in 4 files. No generated files or standalone documents. - **Moves vs. logic changes:** Registration accepts a pre-read quota. Timeout lookup checks the same executor and start time after returning. Cancellation shares its read-only request and derives audit IDs from the SQL result. Prepared-query cleanup uses the existing failure boundaries. - **Behavior change:** Slow property reads no longer block connection interruption. Static metadata does not wait for SQL ownership or refresh idle time. Unregistration after a changed user with no quota counter still releases the total slot. - **Compatibility:** No configuration, protocol, persisted format or journal changes. Per-user quota transfer during COM_CHANGE_USER remains unchanged. - **Performance impact:** Shorter lifecycle critical sections and no duplicate cancellation request, address or audit-set state. - **Rollback:** Revert this commit; no migration required. ### Testing - Preset run-fe-ut.sh: 326 tests passed across 24 selected FE classes; zero failures, errors or skips. Complete script BUILD SUCCESS. - Includes blocked Auth lookup interruption, stale timeout revalidation, independent static metadata, changed-user pool release and repeated cancellation tests. - FE Checkstyle: zero violations. git diff --cached --check passed. - No cluster SQL regression run. ### Notes for Reviewers Rechecked the complete PR for scope, redundant state, ownership, lock boundaries, protocol compatibility, exception paths and test coverage after applying the corrections. Remote SQL/cancel arrival ordering and historical changed-user quota transfer remain outside this local lifecycle refactor. ### Release note None ### Check List (For Author) - Behavior changed: Yes (see Details). - Does this need documentation: Yes; the English ConnectContext class contract is updated. - Pre-submission status: Not ready: Draft awaiting human review. Selected unit tests and style passed; cluster regression not run. ### AI Disclosure - Tool: OpenAI Codex (GPT-6). - Generated: Code, tests, class comment and commit description. - Human review: Pending.

### Background ConnectPoolMgr counts each admitted connection against its authenticated user. COM_CHANGE_USER authenticates a replacement identity and selects its default database while keeping the same client connection. ### What problem does this PR solve? Issue Number: None Related PR: apache#70064 (session lifecycle refactor) PR Type: Bugfix Problem Summary: Changing users updated the context identity without moving its connection quota. Disconnect then leaked the original user's count or decremented another user's count, and switching did not enforce the target user's limit. Validate the new namespace privately, then transfer the quota and identity under the existing lifecycle/admission locks. Failed changes preserve the original session. ### Details - **Change map:** production Java: 111 added / 20 removed lines in 3 files; tests: 628 added / 8 removed lines in 3 files. No generated files or standalone documents. - **Frequency:** A connection switches to a different user with COM_CHANGE_USER; a later disconnect leaves the per-user counters inconsistent. Database selection failure could also leave the new identity installed. - **Root cause:** Registration charged the original user, while unregistration looked up the independently mutable current identity. The switch path neither checked nor transferred the target quota and published identity before database validation. - **Why existing tests missed it:** The previous changed-user test only checked global slot release after direct identity mutation. It did not inspect both user counts or exercise a real COM_CHANGE_USER packet and failure response. - **Fix:** Require registered identity changes to use one command-owned entry. A private, always-cleaned context validates namespace and reads target quota outside lifecycle locks using the intended TLS/authentication/catalog context. Commit user counts, identity and namespace while holding the existing close lock order; total quota stays unchanged. Same-user refreshes do not consume another slot. No additional shared lifecycle state or quota-owner map. - **Other paths and branches:** Initial authentication, private contexts and same-user setters remain valid. Reviewed all production identity setters. MySQL and Flight still share pool accounting. Authentication policy, protocol layouts and persistence are unchanged; this commit targets the current master-based PR. ### Testing - Preset run-fe-ut.sh: 373 tests passed across 29 selected FE classes; zero failures, errors or skips. Complete script BUILD SUCCESS. - Covers successful and repeated transfers, existing target-user connections, quota rejection, same-user changes at full quota, competing new admission, both switch/close orderings, property failure, authentication/database failure, namespace/TLS isolation and actual OK/ERR packets followed by a usable old session. - FE Checkstyle: zero violations. git diff --cached --check passed. - No cluster SQL regression run. ### Notes for Reviewers The registered identity remains the quota owner: direct cross-user setter writes are rejected, so no duplicate owner field is needed. A close and quota transfer cannot interleave between count migration and identity commit. Namespace commit uses validated values without catalog IO under the lock. Candidate session variables are independent, while existing authentication and delegated catalog context are preserved for equivalent validation. ### Release note MySQL COM_CHANGE_USER now enforces the target user's connection limit and correctly transfers connection counts. A rejected user change preserves the original identity and namespace. ### Check List (For Author) - Behavior changed: Yes. Successful changes transfer user quota; failed changes leave the original session intact. - Does this need documentation: Yes; the English ConnectContext caller contract documents the registered-user invariant. - Pre-submission status: Not ready: Draft awaiting human review. Selected unit tests and style passed; cluster regression not run. ### AI Disclosure - Tool: OpenAI Codex (GPT-6). - Generated: Code, tests, class comment and commit description. - Human review: Pending.

### Background COM_CHANGE_USER authenticates a new logical session on an existing MySQL connection. ConnectContext owns session resources and the pool tracks the registered user's connection quota. ### What problem does this PR solve? Issue Number: None Related PR: apache#70064 (ConnectContext lifecycle refactor) PR Type: Bugfix Problem Summary: The previous switch path transferred identity and quota without resetting session resources, including when the username was unchanged. Reset before authentication, reload target-user defaults and close rejected changes after sending their error response. ### Details - **Change map:** Production Java has 69 added / 37 removed lines across five files; tests have 323 added / 25 removed lines across two files. No generated files or standalone documents change. - **Frequency:** Every COM_CHANGE_USER with existing session resources or overridden session defaults; same-user requests are affected too. - **Root cause:** User switching was treated as an identity/quota transfer instead of a fresh logical session. The private validation context copied old authentication and session state, and equal usernames bypassed target admission. - **Why existing tests missed it:** Tests checked quota transfer and namespace preservation but did not populate old session resources or assert reset-before-authentication. They incorrectly expected rejected changes to leave the old connection usable. - **Fix:** Reuse resetConnection before authentication. Initialize fresh target-user variables, authentication metadata, compute group and catalog; commit them with quota ownership under the existing locks. Reuse login's default-catalog setup, check same-user admission, and use AFTER_RESPONSE for rejected changes. - **Other paths and branches:** Login and change-user share default-catalog initialization. COM_RESET_CONNECTION retains its namespace behavior. No new lifecycle state, configuration or wire/storage fields are added; no release branch is changed. - **Behavior change:** Same-user requests reset the session and can be refused at the user connection limit. Failed authentication, namespace validation, quota admission or reset sends an error before closing. ### Testing - The repository run-fe-ut.sh script ran 392 tests across 33 lifecycle, pool, MySQL, Flight and forwarded-cancellation classes. One new rollback-error text assertion failed; the remaining 32 classes passed. After correcting the assertion and verifying final-close rollback retry, run-fe-ut.sh --run MysqlConnectProcessorChangeUserTest passed all 13 tests with BUILD SUCCESS. Combined final coverage is 392 distinct tests, zero remaining failures, errors or skips; fresh Surefire reports and source hashes were checked. - Maven Checkstyle passed with zero violations; git diff --cached --check passed. - Cluster SQL regression tests were not run. ### Release note MySQL COM_CHANGE_USER resets existing session state even when the username is unchanged, reloads target-user defaults and enforces its connection limit. Failed changes send an error before closing the connection. ### Check List (For Author) - Behavior changed: Yes (see Details). - Does this need documentation: No; the caller contract is updated in the ConnectContext class comment. - Pre-submission status: Not ready: Draft awaiting human review; cluster SQL regression was not run. ### AI Disclosure - Tool: OpenAI Codex (GPT-6). - Generated: Implementation, tests, class comments and this description. - Human review: Pending.

### Background ConnectContext serializes commands and resource cleanup with one execution owner. Immediate closure must wait for synchronous cancellation to return, while graceful closure must wait for response resources to be released. ### What problem does this PR solve? Issue Number: None Related PR: apache#70064 (ConnectContext lifecycle refactor) PR Type: Refactor Problem Summary: Cleanup used a pending Runnable that moved between a field and local variables through publishing, claiming and execution helpers. Finalizer exit recursively called yieldExecution and inspected already-released protocol resources. Replace the task with a direct ownership handoff and release execution directly after cleanup. ### Details - **Moves vs. logic changes:** Replace pendingFinalizer with cleanupPending, used only when interruption finishes before the current owner exits. The interruption winner either sets that flag or takes idle execution to clean up. A graceful owner atomically claims STOPPING and unregisters while retaining execution, then closes and cleans up directly. Remove claimFinalizerLocked, runFinalizer and finishAfterResponse; keep existing resource-release steps. - **Behavior change:** Public command and response contracts are unchanged. Cleanup no longer reenters yieldExecution or reads protocol state after releasing resources. - **Compatibility:** No configuration, protocol encoding, journal or persisted-format changes. The lifecycle-to-admission lock order is unchanged. - **Performance impact:** Remove Runnable finalizer allocation and post-cleanup response scanning. Interruption and resource release remain outside the locks; no new waits or workers. - **Rollback:** Revert this commit; no metadata migration is needed. ### Testing - run-fe-ut.sh ran 395 tests across 33 classes, including 39 ConnectContext lifecycle cases and 14 Flight drain cases: zero failures, errors or skips; the complete script finished with BUILD SUCCESS. Fresh Surefire XML counts and tested source hashes were verified. - New tests cover immediate closure during the response-readiness check and both close modes avoiding protocol reads after resource release. Existing handoff, reentry, exception, MySQL/Flight response, change-user and forwarding tests pass. - Maven Checkstyle passed with zero violations; git diff --cached --check passed. - Cluster SQL regression tests were not run. ### Release note None ### Check List (For Author) - Behavior changed: Yes (see Details; internal cleanup ordering only). - Does this need documentation: No; the English ConnectContext class comment describes the handoff and caller contract. - Pre-submission status: Not ready: Draft awaiting human review. Cluster SQL regression tests were not run. ### AI Disclosure - Tool: OpenAI Codex (GPT-6). - Generated: Implementation, tests, class comments and this description. - Human review: Pending.

### Background FlightProtocolAdapter resets cached results, deferred executors and endpoint state before the next SQL execution and when a request fails before returning a result ticket. ### What problem does this PR solve? Issue Number: None Related PR: apache#70064 (ConnectContext lifecycle refactor) PR Type: Refactor Problem Summary: The name beginRequest obscured that the same operation also discards failed-request resources. Rename it to resetRequestState and update every call and related comment so its cleanup responsibility is explicit. ### Details - **Moves vs. logic changes:** Rename the existing method and all production/test callers. Update Javadoc, sender comments and the session-lifecycle regression comment. The method body and failure-path cancellation/reset order are unchanged. - **Behavior change:** None. Both ordinary-request failure and prepared-schema mismatch continue to discard unpublished results. - **Compatibility:** Internal Java method rename only; no configuration, wire encoding, journal or persistent-format changes. - **Performance impact:** None; no new allocations, checks, waits or I/O. - **Rollback:** Revert this naming-only commit; no migration is required. ### Testing - run-fe-ut.sh --run 'FlightProtocolAdapterTest,DorisFlightSqlProducerTest,DorisFlightSqlSchemaTest,FlightSqlExecutionSchemaTest,FlightSqlDeferredQueryIdleTimeoutTest,ConnectContextFlightDrainTest': 118 tests across six classes passed, zero failures, errors or skips; the complete script finished with BUILD SUCCESS. Fresh Surefire XML counts and source hashes were checked. - A token comparison of all eight modified files confirms only the identifier rename and comment changes. Existing tests cover failed-request result cleanup and prepared-schema failure cleanup; no new tests were added for the rename. - Maven Checkstyle passed with zero violations; git diff --cached --check passed. - Cluster SQL regression tests were not run; the regression-file change is a comment only. ### Release note None ### Check List (For Author) - Behavior changed: No. - Does this need documentation: No; method and caller comments are updated. - Pre-submission status: Not ready: Draft awaiting human review. Cluster SQL regression was not run. ### AI Disclosure - Tool: OpenAI Codex (GPT-6). - Generated: Rename, comments and this description. - Human review: Pending.

### Background ConnectContext accepts a CloseMode request and retains a private state to coordinate admission, response draining and cleanup. ### What problem does this PR solve? Issue Number: None Related PR: apache#70064 (ConnectContext lifecycle refactor) PR Type: Refactor Problem Summary: CloseIntent included OPEN and STOPPING even though it represented the session's current state. Rename it to SessionState, its field to sessionState and its internal AFTER_RESPONSE value to DRAINING to distinguish state from the public close request. ### Details - **Moves vs. logic changes:** Rename the private enum, field and value throughout ConnectContext. Update the English class contract, transition diagram and enum comments. All other code tokens are unchanged after normalizing these names. - **Behavior change:** None. Public CloseMode remains IMMEDIATE/AFTER_RESPONSE; state transitions, ownership and cleanup are unchanged. Temporary-table handling is unchanged and deferred to a separate follow-up. - **Compatibility:** Private Java identifiers only; no configuration, wire encoding, persisted-format or FE/BE field changes. - **Performance impact:** None. - **Rollback:** Revert this naming-only commit; no migration is required. ### Testing - Local JDK 17: `bash run-fe-ut.sh --run 'ConnectContextLifecycleTest,ConnectContextFlightDrainTest,ConnectContextTest,ConnectSchedulerTest,ConnectContextChangeUserTest,MysqlConnectProcessorChangeUserTest'` passed: 108 tests across 6 classes, zero failures, errors or skips; complete script BUILD SUCCESS. Counts match fresh Surefire XML reports and tested source hashes. - `mvn -f fe/pom.xml checkstyle:check -pl fe-core` passed with zero violations. - `git diff --cached --check` passed. Independent review and normalized code-token comparison confirmed only the approved identifiers and comments changed. - Cluster SQL regression was not run. ### Release note None ### Check List (For Author) - Behavior changed: No. - Does this need documentation: No; class and enum comments are updated. - Pre-submission status: Not ready: Draft awaiting human review. Cluster SQL regression was not run. ### AI Disclosure - Tool: OpenAI Codex (GPT-6). - Generated: Rename, comments and this description. - Human review: Pending.

### Background ConnectContext owns session and statement resources and can be bound to reusable HTTP or background threads. Internal helpers also create private contexts that must restore the caller's binding when they finish. ### What problem does this PR solve? Issue Number: None Related PR: apache#70064 (lifecycle refactor) PR Type: Bugfix Problem Summary: HTTP requests and several background load/planning paths left their context bound after completion. Streaming metadata scopes captured their own context as the parent, and query-id publication could recreate a trace index after unregistration. Close private scopes deterministically, restore borrowed caller bindings, serialize trace publication with close, and finish statement-resource cleanup even when planner release fails. ### Details - **Change map:** Production Java: 362 added / 269 removed lines in 23 files; tests: 1342 added / 0 removed lines in 12 files. Production changes reuse existing scope and cleanup APIs; much of the diff indents existing task bodies inside scopes. - **Frequency:** HTTP and affected background task exits; trace publication requires concurrent immediate close, and statement cleanup requires a resource-close failure. - **Root cause:** Missing scope owners, binding before capturing the parent, publication outside the close gate, and sequential cleanup that stopped after its first error. - **Why existing tests missed it:** Existing tests checked operation results without asserting the worker's TLS, parent ownership or resources retained after failure. - **Fix:** One HTTP dispatch filter; private task scopes; database-only snapshots for async HTTP workers; trace publication under lifecycleLock; final-owner StatementContext cleanup with exception-safe resource release. - **Other paths and branches:** Audited production context creation, bindings and long-lived holders. Cover single/multi-table Stream Load, Group Commit, Broker/Routine Load, cloud Alter/Index jobs, metadata replay, MV cache and connector rewrite. Borrowed contexts and deferred Flight resources retain their owner. No new shared state, configuration or wire/storage format. - **Behavior change:** Completed private scopes release statement resources; immediate closure cannot recreate a removed trace index. No change to MySQL or Flight response encoding. ### Testing - Repository FE UT script: 642 tests passed across 63 selected classes (57 classes in the broad run, then 39 tests in six corrected fixture classes). The targeted rerun completed with BUILD SUCCESS. - Fresh Surefire XML and source hashes verified; production and the other 57 test classes were unchanged between runs. - FE Checkstyle passed with zero violations; git diff --cached --check passed. - Cluster SQL regression tests were not run. ### Release note Fix retained HTTP and background-task contexts and incomplete statement cleanup after resource-release failures. ### Check List (For Author) - Behavior changed: Yes (see Details). - Does this need documentation: No; the English ConnectContext class contract is updated. - Pre-submission status: Partially verified: local unit tests and style checks completed; cluster regression not run. PR remains a draft for human review. ### AI Disclosure - Tool: OpenAI Codex (GPT-6). - Generated: Implementation, tests, comments and this commit description. - Human review: Pending.

### Background AutoCloseConnectContext owns a private context and now requests final cleanup when its scope exits. That cleanup releases statement resources and resets session counters. ### What problem does this PR solve? Issue Number: None Related PR: apache#70064 (context lifecycle refactor) PR Type: Bugfix Problem Summary: StatisticsUtil.execUpdate wrote its audit event after closing the context, so the new deterministic cleanup reset returnRows before the audit consumed it. Write the audit event while the private context is still open and bound, then close the scope on success or failure. Clarify the owning scope contract and correct analysis-test factories that incorrectly wrapped a borrowed parent context. ### Details - **Frequency:** Internal statistics INSERTs that update returnRows and use StatisticsUtil.execUpdate. - **Root cause:** The caller treated close as only statement/TLS cleanup and read session counters afterwards; final cleanup now clears those counters. - **Why existing tests missed it:** No test observed audit counters and scope lifetime together; two analysis fixtures also returned a borrowed context from a factory that creates private contexts in production. - **Fix:** Outer try-with-resources owns the context; the inner finally audits before closing. Audit failures still close the context. No new state or ownership flags are added. - **Other paths and branches:** Audited every production AutoCloseConnectContext construction and factory consumer. Borrowing helpers return no owning scope, private workers create it within their execution, and asynchronous connector cleanup retains its own resources. Returned load plans/results and driver-owned rewrite transactions do not depend on an open scoped context. - **Behavior change:** Statistics update audits retain the actual row count. The scope still requests AFTER_RESPONSE, which is not a barrier for arbitrary asynchronous work. ### Testing - `bash run-fe-ut.sh --run 'StatisticsUpdateContextLifecycleTest,StatisticsUtilTest,AnalyzeTest,AnalysisJobTest,BaseAnalysisTaskTest,OlapAnalysisTaskTest,RewriteSimpleAggToConstantRuleTest,AutoCloseConnectContextTest,StreamLoadContextLifecycleTest,LoadTaskContextLifecycleTest,ConnectorRewriteGroupTaskTest,ConnectorStatementScopeTest,StatementContextCleanupTest'`: **107 tests passed across 13 classes**, zero failures/errors/skips; complete script **BUILD SUCCESS** on the final source tree. Fresh Surefire XML and source hashes were verified. FE Checkstyle and `git diff --cached --check` passed. - Cluster SQL regression was not run. ### Release note Preserve the affected-row count in internal statistics update audit events when the private context is cleaned up. ### Check List (For Author) - Behavior changed: Yes (see Details). - Does this need documentation: No; the English owning-scope contract is updated in code. - Pre-submission status: Partially verified: selected local unit tests and style checks passed; cluster regression was not run. Draft PR awaits human review. ### AI Disclosure - Tool: OpenAI Codex (GPT-6). - Generated: Fix, tests, comments and this description. - Human review: Pending.

### Background Frontend protocols, requests, planning helpers and background jobs all use ConnectContext. Helpers may own a private context or borrow their caller's session, and asynchronous cancellation must not release resources still in use. ### What problem does this PR solve? Issue Number: None Related PR: None PR Type: Bugfix Problem Summary: Some private contexts only lost their thread-local binding or closed their statement, leaving session cleanup without an owner. Failed initialization and unbound HTTP authentication were also outside their cleanup boundary. Assign deterministic cleanup at each owning boundary while preserving borrowed sessions and asynchronous resource ownership. ### Details - **Change map:** This follow-up changes 49 production Java files (+847/-704) and 26 test files (+1615/-224). Production changes mostly establish cleanup boundaries around existing bodies; no generated files or standalone documents are included. - **Frequency:** Internal planning, HTTP requests, forwarded statements and background task exits, including failure, retry and cancellation paths. - **Root cause:** Ownership transfer was implicit in thread-local bindings, and several callers restored or dropped references without closing the created context. Streaming cancellation could release execution resources on a different thread. - **Why existing tests missed it:** Tests mostly asserted results or restored thread bindings, without observing context/statement release or the ownership of resources after failure and cancellation. - **Fix:** Close private scopes and failed factories; make MTMV/Insert factories transfer unbound ownership; use callback-scoped temporary Cascades contexts; track HTTP dispatch-owned contexts before binding; finalize streaming attempts on their execution thread. Proxy cleanup preserves the originating transaction/session and response packets. Remove an unused context and the session-variable dummy sentinel. Cover Flight admission failure before its command body. - **Other paths and branches:** Audit every production context constructor/factory and its callers. Borrowed sessions remain owned by their protocol/task. No new lifecycle flags, locks, wire fields or persisted data. ### Testing Local verification used JDK 17 and the repository's `run-fe-ut.sh` entry point: - Broad run with 100 selected FE test classes: **1097 tests passed**, zero failures, errors or skips; the complete script finished with **BUILD SUCCESS**. Coverage includes MySQL/Flight admission, response completion and cancellation; ConnectContext ownership and change-user; HTTP/RPC boundaries; Stream/Broker/Routine Load; cloud/background/streaming tasks; planning/MTMV; statistics and connector resource cleanup. - Final targeted run: `bash run-fe-ut.sh --run 'RefreshMTMVCommandTest,MTMVContextLifecycleTest,ExternalCatalogNamespaceFailureTest'`: **36 tests passed across 3 classes**, zero failures, errors or skips; complete script **BUILD SUCCESS**. This verifies the final refresh factory implementation and updated explicit-ownership test callers. - Fresh Surefire XML counts match both run logs. Source hashes confirm that the other production/test changes are unchanged from the broad run and that the final tested tree matches the staged files. Combined latest results remain **1097 passing tests across 100 classes**. - FE Checkstyle (`mvn -f fe/pom.xml checkstyle:check -pl fe-core`) and `git diff --cached --check`: passed. - Cluster SQL regression tests were not run. ### Release note HTTP, forwarded and internal background work explicitly release private session resources on completion and failure; streaming cancellation leaves final resource release to the execution thread. ### Check List (For Author) - Behavior changed: Yes (see Details). - Does this need documentation: No; caller ownership is documented in the class and helper comments. - Pre-submission status: Not ready: Existing draft PR awaits human review; cluster regression was not run. ### AI Disclosure - Tool: OpenAI Codex (GPT-6). - Generated: Implementation, tests, comments and this description. - Human review: Pending.

### Background Synchronous helpers can use their caller's execution context, while parameter-only helpers do not need a session. Independent SQL and background execution still need explicit session ownership. ### What problem does this PR solve? Issue Number: None Related PR: None PR Type: Refactor Problem Summary: Several helpers created a ConnectContext only to obtain defaults, copy a request or wrap an already owned load task. Remove eight redundant construction sites, reduce view metadata to one context per request and keep statement-only isolation local. ### Details - **Change map:** 18 production Java files, +168/-232; 11 test files, +465/-71. No generated files or standalone documentation. - **Moves vs. logic changes:** Pass the current executor and compute group directly; pass the task context through the load coordinator chain. Remove redundant cloud/HTTP contexts and duplicate Flight/MV TLS management. Keep private contexts for independent identity, settings and SQL execution. - **Behavior change:** Group Commit block rules and audit use the current SQL, user and planner. HTTP Group Commit uses request settings; auto-start without a context or explicit cluster returns no selection. View collection closes statement resources per view without replacing the borrowed statement. - **Compatibility:** Internal Java call sites migrate together. No protocol, journal, stored format or configuration changes. - **Performance impact:** Direct construction sites fall from 46 to 38. A metadata request creates at most one context only when a view needs parsing. No new lifecycle state or executor. - **Rollback:** Revert this commit; no metadata migration. ### Testing Combined final results: 316 tests passed across 28 FE classes. The initial run passed 27 classes and found two exception-format assertion errors in LoadActionTest. After correcting those test assertions, the repository run-fe-ut.sh script passed all 26 LoadActionTest cases and completed with BUILD SUCCESS. FE Checkstyle and staged diff checks passed. Cluster regression tests were not run. ### Notes for Reviewers Private execution/identity contexts remain owned by their scope. Synchronous borrowing does not transfer cleanup responsibility. The broader audit found pre-existing MysqlLoad reader, InsertTask cancellation and queryId lookup races; these are documented in the draft PR and not modified here. ### Release note Group Commit planning uses the active statement's user and SQL for block-rule checks and its planner for audit information. ### Check List (For Author) - Behavior changed: Yes (see Details). - Does this need documentation: Yes; ConnectContext's English class comment explains when to create or borrow a context. - Pre-submission status: Not ready: Draft, awaiting human review; broader audit findings are documented and cluster regression is unrun. ### AI Disclosure - Tool: OpenAI Codex (GPT-6). - Generated: Implementation, tests, class comments and PR description. - Human review: Pending.

### Background Internal helpers sometimes create a SQL session only to supply metadata parameters. ConnectContext also carries analysis, execution, response and session data with different lifetimes. ### What problem does this PR solve? Issue Number: None Related PR: apache#70064 (ConnectContext lifecycle refactor) PR Type: Refactor Problem Summary: Remove unnecessary helper sessions and keep result payloads and observer options with their actual owners. Review all 68 instance fields, remove unused storage, and reset the Group Commit decision at the SQL statement boundary for both protocols. ### Details - **Change map:** Production Java: 22 files, +233/-270; FE tests: 16 files, +1117/-86. No generated files or standalone documentation. - **Moves vs. logic changes:** Seven direct production constructor sites disappear. Metadata RPCs accept explicit fields; workload-group resolution takes owner and group inputs. FileScan expression translation and constant Round precision avoid temporary sessions. Stream Load uses its handler-owned context instead of a redundant cloud planner subclass. Result attachments move to the existing StmtExecutor; processlist readers own their immutable full-SQL option. Four unused context fields/accessors are removed. - **Behavior change:** Result attachments no longer accumulate across commands. Processlist readers cannot overwrite each other's display option. Each text SQL statement, including Flight requests and multi-statement packets, recomputes its Group Commit decision; binary MySQL requests retain their existing reset. DoGet and HTTP stream planning preserve their execution boundaries. - **Compatibility:** No wire, configuration, journal or stored-format change. Metadata timeout, retry and replay behavior remain the same. Workload-group access context stays NONE; the existing cloud-policy path retains its caller-thread authorization context. Internal Java helpers and all callers change together. - **Performance impact:** Context creation sites drop from 38 to 31 and instance fields from 68 to 62. Explicit default-value getters avoid session-variable cloning. No new registry, lifecycle flag, lock order or context container; no throughput benchmark performed. - **Rollback:** Revert this commit; no metadata migration is needed. ### Testing Local JDK 17 verification used the repository's `run-fe-ut.sh` entry point. - **416 tests across 38 selected FE classes passed**, with zero failures, errors or skips in the combined final results. - The first 31-class run exposed seven test-fixture/expectation issues: an old authorization mock missed the new explicit entry point, exception assertions omitted existing Doris wrapping, and two new test setups initialized mocks in the wrong order. Only five test files changed to correct them. The follow-up 12-class run passed all **176 tests** and the complete script finished with **BUILD SUCCESS**; the other 26 classes passed in the first run. - New tests cover explicit workload-group identity/defaults/authorization, metadata RPC fields/timeouts/retries/pool cleanup/journal waits, zero context construction in value-only paths, shared Stream Load planning ownership, independent processlist display options, and two real consecutive SQL executions with isolated result attachments. - Flight tests exercise real parsing, SET execution and Group Commit analysis across successive requests, failure, and a single multi-statement request. Existing Flight schema/options, MySQL prepared/forward/retry/cleanup and session-lifecycle tests also pass. - FE Checkstyle and `git diff --cached --check` passed. Surefire XML totals match the run logs; staged/source hashes match the final verification snapshot. No cluster SQL regression tests were run. ### Notes for Reviewers Read ConnectContext's State ownership class comment and the complete field inventory in PR apache#70064. Session identity, namespace, variables, transactions, prepared statements, temporary tables and history remain session-owned. Existing analysis and protocol scopes retain their owners. ### Release note Long-lived sessions no longer retain result attachments from previous commands. Concurrent processlist readers preserve their individual full-SQL display choices. Flight and multi-statement SQL recompute the Group Commit decision for each statement. ### Check List (For Author) - Behavior changed: Yes (see Details). - Does this need documentation: Yes; updated English class comment and the PR's field ownership inventory. - Pre-submission status: Draft; selected FE tests and Checkstyle verified. Cluster regression not run. ### AI Disclosure - Tool: OpenAI Codex (GPT-6). - Generated: Implementation, tests, class comments and this description. - Human review: Pending.

### Background ConnectContext is used by protocol sessions, private tasks and analysis helpers. Reviewing its ownership requires both the callers' business intent and the actual state each method accesses. ### What problem does this PR solve? Issue Number: None Related PR: apache#70064 (lifecycle refactor under review) PR Type: Build/CI/Chore Problem Summary: Add the requested production usage inventory for human review. It records construction, borrowing, retained references and cleanup responsibility, with a complete per-method index at a fixed source revision. This commit changes documentation only. ### Details - **Change map:** One document with 12235 lines; zero production, test or generated-code changes. - **Affected:** docs/connect-context-usage-review.md covers 899 production files, 2559 method/member entries and 31 direct constructions. - **Developer and release impact:** Review aid only; no runtime or build behavior changes. Ownership questions are labeled separately from confirmed facts. - **License and third-party:** Apache license header; no dependency or third-party code added. - **Rollback:** Remove the inventory document. ### Testing Cross-checked Java AST references with compiled call, field and method-reference metadata. Validated all 8208 indexed operations, 31 direct constructions, 3805 fixed-source links, 2797 unique anchors and Markdown table structure. Whitespace validation passed. No kernel tests were rerun for this documentation-only commit. ### Release note None ### Check List (For Author) - Behavior changed: No - Does this need documentation: Yes; this commit is the requested review document. - Pre-submission status: Not ready: Draft, awaiting human review. ### AI Disclosure - Tool: Codex, GPT-6 - Generated: Usage inventory and this commit description. - Human review: Pending.

morrySnow changed the title ~~[refactor](fe) Unify ConnectContext lifecycle and cleanup~~ [refactor](session) Unify ConnectContext lifecycle and cleanup Nov 4, 2026

morrySnow changed the title ~~[refactor](session) Unify ConnectContext lifecycle and cleanup~~ [refactor](session) Simplify ConnectContext execution and cleanup ownership Nov 5, 2026

morrySnow added 10 commits November 5, 2026 23:38

morrySnow force-pushed the codex/connect-context-lifecycle branch from 8a8f18a to 82bfe0f Compare November 5, 2026 15:53

morrySnow added 9 commits November 6, 2026 00:45

morrySnow added 4 commits November 8, 2026 00:03

Navigation Menu

Repository navigation

[refactor](session) Simplify ConnectContext execution and cleanup ownership - #70064

[refactor](session) Simplify ConnectContext execution and cleanup ownership#70064
morrySnow wants to merge 23 commits into
apache:masterfrom
morrySnow:codex/connect-context-lifecycle

morrySnow commented Nov 3, 2026 •

edited

Loading

Uh oh!

hello-stephen commented Nov 3, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

morrySnow commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Background

What problem does this PR solve?

Details

Testing

Notes for Reviewers

Release note

Check List (For Author)

AI Disclosure

Uh oh!

hello-stephen commented Nov 3, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

morrySnow commented Nov 3, 2026 •

edited

Loading