*: fix CSE keyspace GC safepoint compatibility

[pingyu]

What problem does this PR solve?

Issue Number: close #5785

Related PD issue: tikv/pd#11108

Problem Summary:

TiCDC SchemaStore can fail to initialize on TiDB Cloud Essential because PD-CSE and client-go select different keyspace transaction safepoints when GetGCState is unavailable. PD-CSE returns the keyspace-v2 service safepoint, while client-go falls back to the legacy cluster-level etcd key when CSE keyspace-level GC metadata is not recognized. The resulting stale snapshot causes ListDatabases to fail with error 9006 and blocks changefeed creation.

What is changed and how it works?

• Adopt the TiDB compatibility fix from metaservice: support CSE keyspace-level GC tidb#70322 and the client-go compatibility fix from tikv: support CSE keyspace-level transaction safepoint tikv/client-go#2040 through temporary fork replacements.
• Align the TiDB nested parser module and Arrow dependency so the upgraded TiDB graph builds while retaining the API-v2 kvproto and PD client line.
• Add a hidden cdc cli unsafe verify-gc-safepoint --keyspace <name> command that:
  1. Resolves the keyspace and reads its current GC state from PD.
  2. By default, uses GCState.TxnSafePoint as snapshot S, matching the initial metadata snapshot selected by SchemaStore instead of using the latest TSO.
  3. With --legacy-safepoint, reads the keyspace-v2 minimum service safepoint through LegacyClientV2.GetMinServiceSafePointV2 and uses it as S.
  4. Warns that no service safepoint blocks GC advancement during verification.
  5. Opens the keyspace TiKV storage with GC disabled and runs ListDatabases at snapshot S.
  6. Reports the database count or propagates keyspace, GC-state, service-safepoint, and snapshot errors.

Both verifier modes are read-only. They do not create, update, or delete a service safepoint or GC barrier.

Check List

Tests

• Unit test
• Manual test

Commands run:

• make fmt
• go test ./cmd/cdc/cli -count=1
• go test -race -shuffle=on ./cmd/cdc/cli -run ^TestVerifyGCSafepoint(Run|Flags)$ -count=1
• gopls check cmd/cdc/cli/cli_unsafe_verify_gc_safepoint.go cmd/cdc/cli/cli_unsafe_verify_gc_safepoint_test.go
• make cdc
• ./bin/cdc cli unsafe verify-gc-safepoint --help
• ./bin/cdc cli unsafe verify-gc-safepoint --legacy-safepoint --no-confirm

A live Essential v1 cluster was not available for an end-to-end snapshot read.

Questions

Will it cause performance regression or break compatibility?

No performance regression is expected. The command is hidden and only runs when explicitly invoked. The dependency compatibility changes make client-go use the keyspace-scoped safepoint path for CSE keyspaces.

Do you need to update user documentation, design documentation or monitoring documentation?

No. This is a compatibility fix and unsafe diagnostic command for TiDB Cloud Essential.

Release note

Fix changefeed creation failures caused by inconsistent keyspace GC safepoints on TiDB Cloud Essential.

[ti-chi-bot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign flowbehappy for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0a74d480-da13-48a5-bcae-a992f422065e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[wk989898]

What is this used for? Why didn't we need it before?