fix(compile): preserve remote pipeline receiver ownership

[XuPeng-SH]

What type of PR is this?

• API-change
• BUG
• Improvement
• Documentation
• Feature
• Test and CI
• Code Refactoring

Which issue(s) this PR fixes:

Fixes #26595

What this PR does / why we need it:

Root cause

A distributed shuffle FULL OUTER JOIN creates multiple DOP receiver buckets per CN. A dispatch attached to one bucket can target local receivers owned by sibling buckets. When a following global operator such as WINDOW calls the common merge path, each bucket becomes a separate RemoteRun tree, so the dispatch-bearing tree is not standalone executable and is rejected before remote start.

Fix

• Extract the existing standalone receiver-ownership check into a pure compile-time detector while retaining the RemoteRun fail-fast guard.
• At the common newMergeScope boundary, group an invalid remote input stage by CN so each serialized tree owns every in-process receiver it targets.
• Preserve the direct path for local dependencies and independent remote inputs.
• Add focused Dispatch and Connector counterexamples plus a distributed FULL OUTER JOIN to WINDOW topology regression.
• Add an end-to-end multi-CN BVT using the existing optimizer shuffle data.

Validation

• Pre-fix focused counterexamples reproduced the defect: Dispatch and Connector inputs remained split, and FULL OUTER JOIN to WINDOW produced four non-standalone RemoteRun inputs instead of two per-CN trees.
• Focused compile tests passed.
• Full pkg/sql/compile passed under normal and race modes.
• New topology tests each passed under race with count 100.
• go list, go build, and go vet passed for pkg/sql/compile.
• A latest-main binary at d29b475 passed the exact BVT SQL on a real two-CN cluster: MULTICN plan, FULL OUTER range shuffle, Window, and result both=2 / left_only=2 in 0.161s.

Lifecycle audit

• Q1 ownership: regrouped scopes, receivers, and connectors remain in the existing scope tree and retain single cleanup ownership.
• Q2 unhappy paths: remote-start and merge failures keep the existing sibling cancellation and fail-before-start cleanup paths.
• Q3 boundedness: detection is bounded by the input scope tree and added merge scopes are bounded by the CN count.

Scope and risk

No API, wire, catalog, or storage-format changes. Regrouping is compile-time only and triggers only when a remote input would otherwise be non-standalone. Independent stages retain their existing topology.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[LeftHandCold]

Deep-reviewed head 8d9b02d: no blocking issues found.

I traced the complete path from newMergeScope regrouping through per-CN scope construction, standalone validation, RemoteRun root stripping/serialization, local and remote dispatch registration, receiver notification, cancellation, and cleanup.

The regrouping is gated to non-local trees with an external in-process receiver dependency. Independent remote inputs and local dependencies retain the existing topology. Each original scope is attached exactly once, receiver/end counts remain consistent, wrapper growth is bounded by CN/input count, and error paths retain sibling cancellation plus bounded cleanup.

Focused race tests for the new Dispatch/Connector counterexamples, independent-input fast path, FULL OUTER JOIN -> WINDOW topology, and the existing standalone detector passed 3 consecutive runs with -p=1. The PR is based on current main, diff check is clean, and current GitHub checks have no failures or pending jobs.

[gouhongshen]

Codex automated review

No findings. The per-CN regrouping restores remote receiver ownership while preserving local and independent-input paths, cancellation, cleanup, boundedness, and compatibility. Tests cover Dispatch, Connector, fast-path, and FULL OUTER JOIN→WINDOW topologies. Diff and formatting checks are clean; focused local execution was unavailable because this worktree lacks MatrixOne’s native CGo prerequisites.

[aptend]

Reviewed the receiver-ownership regrouping and RemoteRun lifecycle paths. The focused topology tests, package tests, race tests, build, and vet pass locally.