fix: MariaDB compatibility for JSON queries and native password auth. Fixes #15413

[mariadb-MarioEApostolov]

Fixes #15413

Motivation

The MySQL branch of ListWorkflows uses -> and ->> JSON operators which are not supported by MariaDB, causing SQL syntax errors when listing archived workflows.

Additionally, go-sql-driver/mysql v1.9.x changed the default of AllowNativePasswords to false, which prevents connections to MariaDB since it uses mysql_native_password by default.

Modifications

• Use JSON_EXTRACT()/JSON_UNQUOTE() instead of -> / ->> in the MySQL branch of ListWorkflows (compatible with MySQL 5.7+ and MariaDB 10.2+)
• Set AllowNativePasswords: true in the MySQL driver config
• Add integration tests for both ListWorkflows and session creation, running against MySQL 8.4 and MariaDB 11.4 via testcontainers
• Add MariaDB to the supported databases list in the workflow archive documentation

Verification

Ran goimports, go vet, and the full test suites for the affected packages. All existing and new tests pass. No regressions.

Documentation

Updated docs/workflow-archive.md to include MariaDB (>= 10.2) as a supported database.

Summary by CodeRabbit

Release Notes

• New Features

  • Added MariaDB (version >= 10.2) as a newly supported database backend alongside Postgres and MySQL, expanding database flexibility for deployments.

• Documentation

  • Updated workflow archive documentation to explicitly list MariaDB as a supported database option alongside Postgres and MySQL.

• Improvements

  • Enhanced compatibility for archived workflow metadata queries and listing operations across MySQL and MariaDB databases.

[Joibel]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Joibel]

Claude Code review

Found 9 issues:

1. Container-leak risk in test setup helpers — both setupMySQLArchiveTest and setupMySQLContainer start a testcontainers container, then call require.NoError on several subsequent steps. If any of those fail, the container is never terminated because the cleanup closure is only invoked once the caller defers it. Should register t.Cleanup(func() { testcontainers.TerminateContainer(c) }) immediately after container start. (bug — resource leak)

argo-workflows/persist/sqldb/workflow_archive_mysql_test.go

Lines 36 to 81 in 7007a62

	func setupMySQLArchiveTest(ctx context.Context, t *testing.T, v mysqlVariant) (WorkflowArchive, func()) {
	t.Helper()
	c, err := testmysql.Run(ctx,
	v.image,
	testmysql.WithDatabase("argo"),
	testmysql.WithUsername("argo"),
	testmysql.WithPassword("argo"),
	testcontainers.WithWaitStrategy(
	wait.ForAll(
	wait.ForLog(v.waitMessage).WithStartupTimeout(60*time.Second),
	wait.ForListeningPort("3306/tcp"),
	)),
	)
	require.NoError(t, err)
	host, err := c.Host(ctx)
	require.NoError(t, err)
	p, err := c.MappedPort(ctx, "3306/tcp")
	require.NoError(t, err)
	port, err := strconv.Atoi(p.Port())
	require.NoError(t, err)
	proxy, err := usqldb.NewSessionProxy(ctx, usqldb.SessionProxyConfig{
	DBConfig: config.DBConfig{
	MySQL: &config.MySQLConfig{
	DatabaseConfig: config.DatabaseConfig{
	Database: "argo",
	Host: host,
	Port: port,
	},
	},
	},
	Username: "argo",
	Password: "argo",
	})
	require.NoError(t, err)
	err = Migrate(ctx, proxy.Session(), "test", "argo_workflows", proxy.DBType())
	require.NoError(t, err)
	return NewWorkflowArchive(proxy, "test", "", instanceid.NewService("")), func() {
	proxy.Close()
	testcontainers.TerminateContainer(c) //nolint:errcheck
	}
	}

argo-workflows/util/sqldb/sqldb_test.go

Lines 29 to 61 in 7007a62

	func setupMySQLContainer(ctx context.Context, t *testing.T, v mysqlVariant) (config.DBConfig, func()) {
	t.Helper()
	c, err := testmysql.Run(ctx,
	v.image,
	testmysql.WithDatabase("argo"),
	testmysql.WithUsername("argo"),
	testmysql.WithPassword("argo"),
	testcontainers.WithWaitStrategy(
	wait.ForAll(
	wait.ForLog(v.waitMessage).WithStartupTimeout(60*time.Second),
	wait.ForListeningPort("3306/tcp"),
	)),
	)
	require.NoError(t, err)
	host, err := c.Host(ctx)
	require.NoError(t, err)
	p, err := c.MappedPort(ctx, "3306/tcp")
	require.NoError(t, err)
	port, err := strconv.Atoi(p.Port())
	require.NoError(t, err)
	return config.DBConfig{
	MySQL: &config.MySQLConfig{
	DatabaseConfig: config.DatabaseConfig{
	Database: "argo",
	Host: host,
	Port: port,
	},
	},
	}, func() { testcontainers.TerminateContainer(c) } //nolint:errcheck
	}

2. Test scaffolding duplicated verbatim across two new files — mysqlVariant struct, mysqlVariants map, and most of the container-bootstrap code are copy-pasted between the two new test files. Image tags, wait-log strings, and setup behaviour will drift independently. Extract to a shared test helper. (DRY / maintainability)

argo-workflows/persist/sqldb/workflow_archive_mysql_test.go

Lines 24 to 50 in 7007a62

	)
	type mysqlVariant struct {
	image string
	waitMessage string
	}
	var mysqlVariants = map[string]mysqlVariant{
	"MySQL": {image: "mysql:8.4", waitMessage: "port: 3306 MySQL Community Server"},
	"MariaDB": {image: "mariadb:11.4", waitMessage: "mariadbd: ready for connections"},
	}
	func setupMySQLArchiveTest(ctx context.Context, t *testing.T, v mysqlVariant) (WorkflowArchive, func()) {
	t.Helper()
	c, err := testmysql.Run(ctx,
	v.image,
	testmysql.WithDatabase("argo"),
	testmysql.WithUsername("argo"),
	testmysql.WithPassword("argo"),
	testcontainers.WithWaitStrategy(
	wait.ForAll(
	wait.ForLog(v.waitMessage).WithStartupTimeout(60*time.Second),
	wait.ForListeningPort("3306/tcp"),
	)),
	)
	require.NoError(t, err)

argo-workflows/util/sqldb/sqldb_test.go

Lines 17 to 42 in 7007a62

	)
	type mysqlVariant struct {
	image string
	waitMessage string
	}
	var mysqlVariants = map[string]mysqlVariant{
	"MySQL": {image: "mysql:8.4", waitMessage: "port: 3306 MySQL Community Server"},
	"MariaDB": {image: "mariadb:11.4", waitMessage: "mariadbd: ready for connections"},
	}
	func setupMySQLContainer(ctx context.Context, t *testing.T, v mysqlVariant) (config.DBConfig, func()) {
	t.Helper()
	c, err := testmysql.Run(ctx,
	v.image,
	testmysql.WithDatabase("argo"),
	testmysql.WithUsername("argo"),
	testmysql.WithPassword("argo"),
	testcontainers.WithWaitStrategy(
	wait.ForAll(
	wait.ForLog(v.waitMessage).WithStartupTimeout(60*time.Second),
	wait.ForListeningPort("3306/tcp"),
	)),
	)

3. //nolint:errcheck silently swallows TerminateContainer errors — the existing pattern in workflow/sync/database_helper_test.go logs the termination error via t.Logf. The new code swallows it entirely, which will mask container leaks in CI. (inconsistent with repo convention)

argo-workflows/util/sqldb/sqldb_test.go

Lines 58 to 62 in 7007a62

	},
	},
	}, func() { testcontainers.TerminateContainer(c) } //nolint:errcheck
	}

4. Test assertions cover only 3 of 8 changed JSON expressions — the PR's primary fix is 8 JSON_EXTRACT / JSON_UNQUOTE expressions. TestMySQLListWorkflows asserts only Progress, Message, and one label. Annotations, Arguments, Suspend, EstimatedDuration, and ResourcesDuration are never asserted. Arguments.Parameters[msg=hello] is set in the test input but never validated on the way back. A bug in any of those extractions would not be caught. (test coverage)

argo-workflows/persist/sqldb/workflow_archive_mysql_test.go

Lines 127 to 137 in 7007a62

	require.Len(t, results, 1)
	wf := results[0]
	assert.Equal(t, "test-wf", wf.Name)
	assert.Equal(t, wfv1.WorkflowSucceeded, wf.Status.Phase)
	assert.Equal(t, wfv1.Progress("1/1"), wf.Status.Progress)
	assert.Equal(t, "completed", wf.Status.Message)
	assert.Equal(t, "test", wf.GetLabels()["env"])
	})
	}
	}

5. require.Equal(t, MySQL, dbType) is tautological — CreateDBSessionWithCreds returns MySQL whenever cfg.MySQL != nil; the assertion checks a Go branch, not a property of the MariaDB connection. It does not differentiate MySQL from MariaDB in any way. (ineffective assertion)

argo-workflows/util/sqldb/sqldb_test.go

Lines 73 to 84 in 7007a62

	dbConfig, cleanup := setupMySQLContainer(ctx, t, variant)
	defer cleanup()
	sess, dbType, err := CreateDBSessionWithCreds(dbConfig, "argo", "argo")
	require.NoError(t, err)
	defer sess.Close()
	require.Equal(t, MySQL, dbType)
	require.NoError(t, sess.Ping())
	})
	}
	}

6. Misleading archive-strategy label in test input — the test sets workflows.argoproj.io/archive-strategy: Persisted on the input workflow, but ArchiveWorkflow unconditionally overwrites the archiving-status label before persisting. The input value has no bearing on what gets stored or retrieved. (misleading test fixture)

argo-workflows/persist/sqldb/workflow_archive_mysql_test.go

Lines 100 to 110 in 7007a62

	Namespace: "default",
	UID: types.UID("test-uid-001"),
	CreationTimestamp: now,
	Labels: map[string]string{
	"workflows.argoproj.io/archive-strategy": "Persisted",
	"env": "test",
	},
	},
	Spec: wfv1.WorkflowSpec{
	Arguments: wfv1.Arguments{
	Parameters: []wfv1.Parameter{

7. AllowNativePasswords: true has no inline comment — the rationale (MariaDB defaults to mysql_native_password, go-sql-driver v1.9 changed the zero-value default to false when using the struct literal) is non-obvious and lives only in the PR description. A future refactor is likely to "clean it up". Add a brief comment. (maintainability)

argo-workflows/util/sqldb/sqldb.go

Lines 196 to 210 in 7007a62

	func createMySQLDBSessionWithCreds(cfg *config.MySQLConfig, persistPool *config.ConnectionPool, username, password string) (db.Session, error) {
	// Build MySQL DSN using mysql.Config to safely handle special characters in credentials
	mysqlCfg := mysql.Config{
	User: username,
	Passwd: password,
	Net: "tcp",
	Addr: cfg.GetHostname(),
	DBName: cfg.Database,
	ParseTime: true,
	AllowNativePasswords: true,
	Params: cfg.Options,
	}
	dsn := mysqlCfg.FormatDSN()
	// Create traced *sql.DB using otelsql

8. Windows skip uses runtime check instead of //go:build !windows build tag — commit 7674c7f just standardised testcontainers tests on the build-tag pattern. These new files revert to the older runtime check, inconsistent with the freshly-established convention (and still compiles the testcontainers import on Windows). (consistency)

argo-workflows/persist/sqldb/workflow_archive_mysql_test.go

Lines 84 to 92 in 7007a62

	// ListWorkflows execute correctly against both MySQL and MariaDB.
	func TestMySQLListWorkflows(t *testing.T) {
	if runtime.GOOS == "windows" {
	t.Skip("test requires Linux container")
	}
	for name, variant := range mysqlVariants {
	t.Run(name, func(t *testing.T) {
	ctx := logging.TestContext(t.Context())

argo-workflows/util/sqldb/sqldb_test.go

Lines 64 to 72 in 7007a62

	// to both MySQL and MariaDB. MariaDB requires AllowNativePasswords.
	func TestMySQLSessionConnect(t *testing.T) {
	if runtime.GOOS == "windows" {
	t.Skip("test requires Linux container")
	}
	for name, variant := range mysqlVariants {
	t.Run(name, func(t *testing.T) {
	ctx := logging.TestContext(t.Context())

9. Other docs still advertise only MySQL — the AllowNativePasswords fix in util/sqldb/sqldb.go applies to all MySQL connections, so offloading/synchronization features also now work with MariaDB. docs/memoization.md, docs/offloading-large-workflows.md, docs/synchronization.md, and docs/synchronization-config.md still say "PostgreSQL or MySQL" without mentioning MariaDB. (docs scope)

argo-workflows/docs/workflow-archive.md

Lines 1 to 8 in 7007a62

	# Workflow Archive
	> v2.5 and after
	If you want to keep completed workflows for a long time, you can use the workflow archive to save them in a Postgres (>=9.4), MySQL (>= 5.7.8), or MariaDB (>= 10.2) database.
	The workflow archive stores the status of the workflow, which pods have been executed, what was the result etc.
	The job logs of the workflow pods will not be archived.
	If you need to save the logs of the pods, you must setup an [artifact repository](artifact-repository-ref.md) according to [this doc](configure-artifact-repository.md).

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[coderabbitai]

📝 Walkthrough

Walkthrough

These changes add MariaDB (>= 10.2) support to Argo Workflows by updating JSON query syntax in archived workflow queries from PostgreSQL-style operators to MySQL-compatible equivalents, configuring MySQL DSN settings, and adding integration tests for MySQL and MariaDB database connectivity.

Changes

Cohort / File(s)	Summary
Documentation & Dictionary .spelling, docs/workflow-archive.md	Added MariaDB to the spelling dictionary and documented MariaDB (>= 10.2) as a supported database alongside existing Postgres and MySQL support.
MySQL Session Configuration util/sqldb/sqldb.go	Modified createMySQLDBSessionWithCreds to set AllowNativePasswords: true in the MySQL DSN configuration for improved authentication compatibility.
Archived Workflow Query Compatibility persist/sqldb/workflow_archive.go	Replaced PostgreSQL-style JSON operators (-> and ->>) with JSON_EXTRACT and JSON_UNQUOTE equivalents for extracting archived workflow metadata fields (labels, annotations, progress, suspend, arguments, message, estimatedDuration, resourcesDuration) to ensure MySQL/MariaDB compatibility.
Database Connectivity Tests util/sqldb/sqldb_test.go, persist/sqldb/workflow_archive_mysql_test.go	Added integration tests for MySQL and MariaDB: TestMySQLSessionConnect validates database session connectivity with credentials for both MySQL 8.4 and MariaDB 11.4 variants; TestMySQLListWorkflows verifies archived workflow listing and JSON extraction query behavior on both databases using containerized database instances.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main changes: MariaDB compatibility fixes for JSON queries and native password authentication, with explicit issue reference.
Description check	✅ Passed	The PR description comprehensively covers motivation, modifications, verification, and documentation with proper issue reference and technical details about all changes.
Linked Issues check	✅ Passed	All code changes directly address issue #15413 requirements: JSON operator replacement for MariaDB compatibility and native password auth enablement, with integration tests demonstrating the fixes.
Out of Scope Changes check	✅ Passed	All changes are narrowly scoped to fix MariaDB compatibility: JSON query updates, authentication config, tests, documentation, and spelling dictionary additions are all directly relevant.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (4)

persist/sqldb/workflow_archive_mysql_test.go (3)

26-34: Minor: mysqlVariant/mysqlVariants duplicated across packages.

The same struct and map are defined verbatim in util/sqldb/sqldb_test.go. Consider promoting them to a shared internal test helper package (e.g. util/sqldb/sqldbtest) to avoid drift when a new variant or wait-message is added.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@persist/sqldb/workflow_archive_mysql_test.go` around lines 26 - 34, The
definitions of mysqlVariant and mysqlVariants are duplicated across tests;
extract these into a shared internal test helper (e.g., a package like
sqldbtest) and import it from both places. Create a single exported variable or
function in the helper that returns the map (e.g., sqldbtest.MySQLVariants or
sqldbtest.NewMySQLVariants()), replace the local mysqlVariant type/map usages in
workflow_archive_mysql_test.go and util/sqldb/sqldb_test.go with references to
that helper, and update imports accordingly so both tests consume the single
source of truth.

---

108-134: Extend coverage: exercise Spec.Suspend round-trip.

Spec.Suspend is explicitly projected by the MySQL branch of ListWorkflows but this test leaves it unset and doesn't assert on it after listing. Adding a boolean Suspend to the archived workflow and asserting wf.Spec.Suspend on the returned item would guard the projection (see the critical comment on workflow_archive.go line 190).

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@persist/sqldb/workflow_archive_mysql_test.go` around lines 108 - 134, The
test omits exercising the Spec.Suspend round-trip that the MySQL ListWorkflows
projection handles; update the archived workflow creation in the test to set
Spec.Suspend (e.g., true) and after calling archive.ListWorkflows assert that
the returned wf.Spec.Suspend matches the value you set; this ensures the
projection in ListWorkflows correctly preserves Spec.Suspend (referencing
Spec.Suspend and ListWorkflows/workflow_archive projection).

---

85-94: Gate testcontainer-based tests behind a build tag or env flag.

This test starts real MySQL and MariaDB containers, so every go test ./persist/sqldb/... run on a developer machine without Docker (or without network access to pull the images) will fail rather than skip. Consider gating with a build tag (e.g. //go:build mysql at the top of the file) or an env-var check so the standard unit-test run stays hermetic while CI can opt in explicitly.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@persist/sqldb/workflow_archive_mysql_test.go` around lines 85 - 94, The test
TestMySQLListWorkflows (which iterates mysqlVariants and calls
setupMySQLArchiveTest) runs real containerized MySQL/MariaDB and should be
gated; update the file to either add a build tag (e.g. //go:build mysql) at the
top or add an env-check at the start of TestMySQLListWorkflows that skips the
test unless an opt-in env var (e.g. RUN_MYSQL_INTEGRATION=true) is set, so
normal `go test` runs skip these container-backed tests while CI can enable them
explicitly.

persist/sqldb/workflow_archive.go (1)

187-194: Nit: inconsistent JSON_UNQUOTE usage for object-valued fields.

labels, annotations, and resourcesDuration are extracted with bare JSON_EXTRACT, but arguments — also a JSON object — additionally goes through JSON_UNQUOTE. While JSON_UNQUOTE on JSON objects simply returns the JSON text unchanged and does not modify nested escape sequences, using it here is semantically redundant and inconsistent with the other object fields. For consistency and clarity, treat spec.arguments the same way as metadata.labels/metadata.annotations.

♻️ Proposed change

-					db.Raw("coalesce(JSON_UNQUOTE(JSON_EXTRACT(workflow, '$.spec.arguments')), '{}') as arguments"),
+					db.Raw("coalesce(JSON_EXTRACT(workflow, '$.spec.arguments'), '{}') as arguments"),

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@persist/sqldb/workflow_archive.go` around lines 187 - 194, The extraction of
spec.arguments is inconsistent: it uses JSON_UNQUOTE while other object-valued
fields (labels, annotations, resourcesDuration) use JSON_EXTRACT. Update the
db.Raw call that produces "arguments" in workflow_archive.go to mirror the other
object fields by removing JSON_UNQUOTE and using coalesce(JSON_EXTRACT(workflow,
'$.spec.arguments'), '{}') as arguments so the handling is consistent with
labels, annotations, and resourcesduration.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@persist/sqldb/workflow_archive.go`:
- Line 190: The MySQL/MariaDB raw select for the suspend value is missing an
alias so archivedWorkflowMetadata.Suspend never gets populated; update the
db.Raw call that currently uses JSON_UNQUOTE(JSON_EXTRACT(workflow,
'$.spec.suspend')) to include "AS suspend" (matching the Postgres branch) so
GORM/upper can map to the suspend field, and add/extend TestMySQLListWorkflows
to archive a workflow with Spec.Suspend set and assert it round-trips via
ListWorkflows to catch regressions.

---

Nitpick comments:
In `@persist/sqldb/workflow_archive_mysql_test.go`:
- Around line 26-34: The definitions of mysqlVariant and mysqlVariants are
duplicated across tests; extract these into a shared internal test helper (e.g.,
a package like sqldbtest) and import it from both places. Create a single
exported variable or function in the helper that returns the map (e.g.,
sqldbtest.MySQLVariants or sqldbtest.NewMySQLVariants()), replace the local
mysqlVariant type/map usages in workflow_archive_mysql_test.go and
util/sqldb/sqldb_test.go with references to that helper, and update imports
accordingly so both tests consume the single source of truth.
- Around line 108-134: The test omits exercising the Spec.Suspend round-trip
that the MySQL ListWorkflows projection handles; update the archived workflow
creation in the test to set Spec.Suspend (e.g., true) and after calling
archive.ListWorkflows assert that the returned wf.Spec.Suspend matches the value
you set; this ensures the projection in ListWorkflows correctly preserves
Spec.Suspend (referencing Spec.Suspend and ListWorkflows/workflow_archive
projection).
- Around line 85-94: The test TestMySQLListWorkflows (which iterates
mysqlVariants and calls setupMySQLArchiveTest) runs real containerized
MySQL/MariaDB and should be gated; update the file to either add a build tag
(e.g. //go:build mysql) at the top or add an env-check at the start of
TestMySQLListWorkflows that skips the test unless an opt-in env var (e.g.
RUN_MYSQL_INTEGRATION=true) is set, so normal `go test` runs skip these
container-backed tests while CI can enable them explicitly.

In `@persist/sqldb/workflow_archive.go`:
- Around line 187-194: The extraction of spec.arguments is inconsistent: it uses
JSON_UNQUOTE while other object-valued fields (labels, annotations,
resourcesDuration) use JSON_EXTRACT. Update the db.Raw call that produces
"arguments" in workflow_archive.go to mirror the other object fields by removing
JSON_UNQUOTE and using coalesce(JSON_EXTRACT(workflow, '$.spec.arguments'),
'{}') as arguments so the handling is consistent with labels, annotations, and
resourcesduration.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 47f9ed73-795b-4c57-986e-154ed711bd60

📥 Commits

Reviewing files that changed from the base of the PR and between 51ea54b and 7007a62.

📒 Files selected for processing (6)

• .spelling
• docs/workflow-archive.md
• persist/sqldb/workflow_archive.go
• persist/sqldb/workflow_archive_mysql_test.go
• util/sqldb/sqldb.go
• util/sqldb/sqldb_test.go

[mariadb-MarioEApostolov]

Thanks for the review. All feedback addressed in the latest push:

1. Container leak → t.Cleanup right after container start
2. DRY → shared MySQLVariant in util/sqldb/mysql_test_helper.go
3. TerminateContainer → error logged via t.Logf
4. Test coverage → assertions for annotations, arguments, suspend, estimatedDuration
5. Tautological assertion → removed
6. Misleading label → removed from fixture
7. AllowNativePasswords → inline comment added
8. Build tag → //go:build !windows
9. Docs → updated synchronization, synchronization-config, offloading docs
10. Missing AS suspend alias → fixed with round-trip assertion
11. Inconsistent JSON_UNQUOTE → removed from arguments

All tests pass locally against MySQL 8.4 and MariaDB 11.4.