…issing

In debug/sanitizer builds ReplicatedDatabaseQueryStatusSource::checkStatus
re-reads the per-host finished/<host_id> ZooKeeper node to double-check the
remote status. For a Replicated database this node is always written with
status 0 in the transaction that applies the query (DDLWorker::processTask),
and on error the executing replica throws UNFINISHED and retries without ever
persisting a non-zero status. So a present finished/<host_id> node always holds
status 0, and an absent one is the benign cleaner/retry race (the sibling
generate() already handles the same race for the parent node via its UNFINISHED
deleted-by-the-cleaner branch).

When the node was absent, DistributedQueryStatusSource::getExecutionStatus
returned its sentinel ExecutionStatus(-1, 'Cannot obtain error message')
unchanged. generate() then saw code != 0 and called handleNonZeroStatusCode,
which threw LOGICAL_ERROR 'There was an error on <host>: Cannot obtain error
message (probably its a bug)', aborting the server in debug/sanitizer builds.

getExecutionStatus returns that same sentinel in two cases: the node was absent
(tryGet == false, the benign race), and the node was present but its payload
could not be deserialized (a corrupt finished/<host_id>). Distinguishing them
by the sentinel code alone would silently turn a corrupt payload into success
and defeat that arm of the cross-check. getExecutionStatus now reports node
presence via an optional out-parameter, and checkStatus maps only the truly
absent-node case to ExecutionStatus{0}. A present-but-unreadable node keeps the
sentinel so the cross-check still fires. The ON CLUSTER consumer keeps the
default nullptr and is unaffected.

Adds a regression test using a new failpoint
(replicated_database_status_finished_node_missing) that forces the missing-node
read deterministically.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…ross-check arm survives

The previous refinement distinguished an absent finished/<host_id> node
(benign cleaner/retry race) from a present one via a node_exists out-parameter,
but a present-but-corrupt node was still collapsed to success.

The reason is in tryDeserializeText itself. deserializeText does
"rb >> code >> \n >> escape >> message", i.e. it reads code before it can fail
on the rest of the payload. tryDeserializeText caught the exception but left the
target object partially overwritten: a payload beginning with a parsable integer,
for example "0garbage" or "0", set code=0 before the failure was reported. Because
getExecutionStatus deserializes directly into its (-1, "Cannot obtain error
message") sentinel, such a corrupt present node became code=0 and
ReplicatedDatabaseQueryStatusSource::checkStatus reported it as success, defeating
that arm of the debug/sanitizer cross-check.

Fix the try-pattern at its source: tryDeserializeText now parses into a temporary
ExecutionStatus and assigns *this only on success, so a failed parse leaves the
target untouched (the general contract every caller expects). getExecutionStatus
therefore keeps its (-1) sentinel intact for a present-but-corrupt node, and
checkStatus already maps only the truly absent node (node_exists false) to success
while the sentinel (negative code) still trips the cross-check. The ON CLUSTER
consumer, whose finished/<host_id> holds a real persisted status, deserializes
fully and is unaffected.

Add gtest_execution_status.cpp asserting tryDeserializeText leaves the target
unchanged on malformed input ("0garbage", "0", "garbage", "") and round-trips a
valid payload. The corrupt-node arm cannot be a stateless "server stays alive"
test because tripping the cross-check throws LOGICAL_ERROR, which aborts the
server in debug/sanitizer builds; the existing failpoint test still covers the
absent-node arm. Verified both directions on a debug build: the malformed-input
assertions fail against the old in-place implementation and pass with this change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>