fix: reject NULL elements in decode_sample (#143)

[NikolayS]

Closes #143

Summary

• reject NULL wait markers, counts, and query-map IDs during the decoder's validation pass
• preserve the existing position-specific warning messages
• return zero rows for every malformed array before the emission pass begins
• keep public decoder behavior aligned with the _sample_data_is_valid() storage CHECK

TDD evidence

Before the fix:

• array[NULL,1,0] emitted a fabricated blank row
• array[-1,NULL,0] raised upper bound of FOR loop cannot be null
• array[-1,1,NULL] emitted a fabricated blank row

The new gate checks exact zero-row counts and exactly one warning per input. After the fix the warnings are:

• expected negative wait_id at position 1
• non-positive count <NULL> at position 2
• expected non-negative query_id at position 3

Validation

Postgres 18:

• fresh install
• installer reapply
• exact three malformed calls
• storage validator rejects all three inputs
• valid packed array still decodes normally
• released-SQL branch guard passes
• git diff --check passes

The hosted PG14–PG19 beta/no-cron matrix is left to this draft PR.

[NikolayS]

codex review (standing in for REV)

REV is not installed on this host. I ran codex review --base origin/main in a separate clean, non-interactive worktree against rebased head 17ccccb.

Findings

No actionable findings. The added NULL checks reject malformed packed-array elements before decoding, and the regression verifies all three affected positions and warning paths. No breaking or blocking issue was found.

Audit §5a verdict

Ready — 4000-iteration fuzz: 278 validator/decoder mismatches before, 0 after. pg_dump diff = exactly 3 lines. Green PG14 + PG19beta2.

RED/GREEN evidence

• RED on current main (e31b525), fresh isolated PG17 database: marker_rows=1, then upper bound of FOR loop cannot be null; the release-gate step exited 1.
• GREEN on rebased PR head (17ccccb), separate fresh isolated PG17 database: all three calls returned zero rows, emitted exactly the expected marker/count/query-map warnings, and the exact release-gate step exited 0.
• git diff --check origin/main...HEAD: passed.

This is a codex review report standing in for REV; no REV run is claimed.