fix(eap): Generate minimal NULL-free SQL for map-backed attribute filters

[phacops]

EAP IN / NOT IN filters on optional attributes still fail under the new ClickHouse analyzer, even after #8032:

Code: 10. DB::Exception: Not found column sumOrNullIf(... in(if(...,
arrayElement(...), _CAST(NULL_Nullable(String), 'Nullable(String)')), __set)) ... in block.
There are only columns: ... in(if(..., arrayElement(...), NULL_Nullable(Nothing)), __set) ...

#8032 fixed the isNull(...) occurrence of the existence if(mapContains, arrayElement, NULL), but the in(...) left operand itself still diverges: the analyzer keeps the CAST when naming the projection column but folds it to a bare NULL_Nullable(Nothing) in the computed block, so the extrapolation aggregate column no longer matches its projection name. It's the IN-operand coercion, independent of whether the NULL is bare or typed.

Fix

Build per-key filters without the NULL-laden existence if(...). Since isNull(if(mapContains, arrayElement, NULL)) is just not(mapContains), each comparison uses the raw arrayElement (no NULL) guarded by mapContains:

IN:          and(exists, in(value, set))
NOT IN:      not(and(exists, in(value, set)))
EQUALS:      and(exists, equals(value, v));      = null  -> not(exists)
NOT_EQUALS:  not(and(exists, equals(value, v))); != null -> exists
LIKE:        and(exists, like(value, v))
NOT_LIKE:    not(and(exists, like(value, v)))

mapContains distinguishes an absent key from a stored empty value ('' / 0, which arrayElement also returns for a missing key). Coalesced attributes (transaction, environment, ...) are generated as a NULL-free multiIf over the per-key mapContains (first-present fallthrough), never coalesce(if(..., NULL), ...).

Minimal output

The mapContains guard is only required when the compared literal could equal the column default ('' / 0) — the only value an absent key reads as. For EQUALS / NOT_EQUALS / IN / NOT_IN against a non-default literal it is dropped, so the incident query collapses to its minimal form:

not(in(arrayElement(attributes_string,'sentry.status'), ['ok','cancelled','unknown']))

The guard is kept for comparisons against the default (= '', IN ['', ...]), for LIKE / NOT_LIKE (a pattern may match the default), and for = null / != null.

Verification

• Unit (TestAnalyzerSafeFilters): pruned forms carry no mapContains / NULL / if(...); guarded forms (default literal, LIKE, null) keep mapContains; coalesced renders as multiIf, not coalesce.
• E2E (TestEmptyVsAbsentComparison): one row with attr='', one with attr absent — every operator classifies them identically (the empty-vs-absent edge).
• Local CH is 25.3 (enable_analyzer=1 by default), so the full test_endpoint_time_series / test_endpoint_trace_item_table suites run under the analyzer and pass; CI also runs test_distributed + the 25.3/25.8 matrix.

⚠️ I could not reproduce the original Not found column failure locally — even with the analyzer on over a Distributed table — because it needs the exact prod query (a prepared __set, the full multi-aggregate context) and likely prod scale. The fix removes the exact construct the error points at and is regression-clean under the analyzer, but confirm on staging before re-enabling the analyzer in production; keep the rollback until then.

Fixes SNUBA-B62
Fixes SNUBA-B6C
Fixes SNUBA-A13

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8d9b451. Configure here.}