fix(compat): close 21 defects blocking real MySQL clients

[maxpert]

Found by driving LLDAP 0.6.3 (Rust, sqlx + sea-orm) against a live Marmot node and auditing the code paths it exercised. Each fix is covered by tests that fail on the prior code.

Result: LLDAP went from dying on its second schema migration to completing all 11 migrations. It is still blocked afterward by #170 (generated ids overflow its 32-bit id type), which is a design decision, not a defect in this branch.

CDC correctness

• Tables with no declared PRIMARY KEY could not replicate UPDATE/DELETE at all. The capture side never emitted the rowid the apply side required. Rowid is now the replicated identity; capture is refused when a column shadows rowid/oid/_rowid_.
• BLOB columns silently became TEXT on every replica. go-sqlite3 hands TEXT and BLOB back identically as []byte, so the distinction was already lost before decoding. The choice is now made at capture time from column affinity (only BLOB affinity stays msgpack Bin), with a strict CDC decode that no longer coerces Bin to string. Would have corrupted password hashes and UUID columns.
• Segfault on any DML against a table with a VIRTUAL generated column — go-sqlite3's preupdate row() dereferences a NULL value for virtual column indices. Capture now refuses such tables before touching Old()/New().
• PRAGMA table_info renumbers cid when hidden columns exist, which silently broke PK positional indexing. Now uses table_xinfo true positions. (Latent pre-existing bug.)
• Schema-cache reload failures after DDL are propagated instead of logged-and-ignored; schema/value count mismatches fail loud instead of truncating.
• Zero-rows-affected CDC applies are logged at Debug so divergence is diagnosable; added FK ON DELETE CASCADE convergence tests.

Interactive transactions

DML inside BEGIN...COMMIT was buffered until COMMIT and answered with a fabricated RowsAffected: 1, so ORMs got no real last_insert_id and no read-your-own-writes.

• DML now executes eagerly against a pinned SQLite transaction; CDC is captured incrementally and replayed through the existing 2PC path at COMMIT. The pinned transaction is always rolled back locally — the write lands only via CDC replay.
• Pinned sessions are released before 2PC (holding them through the local commit deadlocks SQLite's single writer).
• Pinned state is released on disconnect, rollback and 2PC rejection; fixed a forwarded-session leak that never released transaction state.
• Forward-session eviction now serializes against in-flight statements. An eviction racing a slow COMMIT could discard captured CDC, after which COMMIT reported success with the write silently lost. COMMIT additionally fails loudly if pinned state disappears rather than treating it as an empty transaction.
• New transaction.ddl_implicit_commit (default true): DDL commits the open transaction, as MySQL does.

SQL transpilation

• Partially-parsed DDL was forwarded truncated into 2PC — Vitess returns a partial AST on syntax errors, so alter table users add CONSTRAINT ... UNIQUE (email) became alter table users. Now rejected with a clean parse error.
• Every HAVING was emitted as WHERE. Vitess models both with the same node and the serializer ignored the discriminator, so any GROUP BY ... HAVING (including inside subqueries) produced invalid SQL.
• Index DDL now flows through one path: ADD CONSTRAINT UNIQUE, ADD INDEX, ADD UNIQUE and standalone CREATE [UNIQUE] INDEX all emit SQLite CREATE INDEX; DROP INDEX ... ON drops the ON clause and handles backtick-quoted names.
• CHARACTER SET/COLLATE are stripped on ALTER TABLE ADD/MODIFY/CHANGE COLUMN, sharing the CREATE TABLE implementation.

MySQL wire protocol

• COM_STMT_PREPARE reported zero columns. sqlx builds its column-name index from the prepare response, so every prepared query failed to find its columns — this was the actual cause of the reported client panic. Now sends real column count, names and types.
• Column types are inferred from data and declared types instead of always VAR_STRING; time.Time and binary DATETIME encode correctly.
• SERVER_STATUS_IN_TRANS is now set so clients can see transaction state.
• Implemented COM_STMT_SEND_LONG_DATA (no response, per-parameter accumulation, cleared only by RESET/CLOSE) and COM_STMT_RESET; the unhandled default sent an ERR packet and desynced the connection.
• The unsigned parameter flag is honored; values above MaxInt64 return ER_WARN_DATA_OUT_OF_RANGE rather than a confusing driver error or a negative value.

Parameter handling

• not enough args to execute query: want 6 got 5 — literal extraction turns the injected auto-increment id into a placeholder, but every execution site chose either wire params or extracted params, never both. Added Statement.MergeExecParams, which interleaves them by per-placeholder provenance (proven by a test where the literal precedes the bound param).
• Added Statement.WithResolvedParams so rewritten statements cannot carry stale placeholder provenance and misinterleave already-resolved args.

Test harness

The coordinator test package initialized the pipeline with a nil ID generator and left transpilation disabled, so auto-increment injection and BEGIN were both inert in tests — which is why several of these defects shipped. Both fixed; full suite still green.

Verification

• go build clean with the required CGO tags.
• Full repo suite: 25/25 packages pass.
• -race clean on coordinator, protocol/..., grpc, encoding, cfg.
• go vet: only the two pre-existing findings (one filed as vet copylocks: cloneForwardResponse copies a protobuf message by value #169).
• gofmt clean.
• LLDAP 0.6.3 boot verified live against a real node.

Follow-ups filed

#164, #165, #166, #167, #168, #169, #170

🤖 Generated with Claude Code

https://claude.ai/code/session_015eBWcTYK93Zy5KAAwLMzZc