[OIiveirra]

What problem does this PR solve?

Issue Number: N/A

Related PR: #69527, #69528

Problem Summary:

LOCAL/FILE-local discovery could escape its secure root, while alternate writers and delegated Hadoop routes could bypass the LOCAL setting or access BE-local files through a remote TVF.

• Add startup-only enable_local_tvf=false. Require ADMIN/OPERATOR before local discovery and during authorization; gate local writers and cleanup before side effects. Enabled reads require canonical containment under user_files_secure_path, including expanded paths and symlinks; rejection errors do not disclose resolved paths.
• Validate Hadoop TVF routes in FE and at the actual consumer using one shared route interpreter. Check the branch's actual normalized Globber probes before discovery, then validate returned and supplied file paths literally in Java and native consumers. Freeze merged runtime defaults/resources, retain each native connection's context, and check actual paths on cache hits. Native writes use their create-parent route; cleanup retains literal semantics.
• Isolate guarded native caches by exact connection/authority/configuration identity. Guarded Java ViewFS requests own and close their mount clients, including partial initialization and close failures. Disable ViewFS's authority-folding inner cache only for guarded configurations. Preserve unmarked catalog behavior and known remote providers, including JuiceFS and secure WASBS, while rejecting local overrides and unknown providers.

Release note

LOCAL TVF and FILE-local are disabled by default. Enable them with enable_local_tvf=true in fe.conf on every serving FE and restart. Enabled local reads still require ADMIN/OPERATOR and a nonempty BE user_files_secure_path. Hadoop TVF reads require proven remote storage even when LOCAL is enabled; use constrained local() for local reads.

Upgrade every serving FE/BE with the matching patched Hadoop runtime for full enforcement. Mixed-version enforcement is not guaranteed. Cross-mount Hadoop globs still require a proven remote route, such as an explicit remote fallback.

Check List (For Author)

• Test
  • Regression test (coverage added; full local execution incomplete)
  • Unit Test
  • Manual test
  • No need to test or manual test. Explain why:

Validation:

• Standard JDK17 FE wrapper: 111 selected tests passed with fresh reports for every required suite, zero failures/errors/skips and frozen source inputs. The selection ran after merging the target master and adapts to its Iterator-based schema request builder, retaining policy assertions in both properties and HDFS parameters. Coverage includes real Hadoop Globber probes with escaped literal metacharacters, literal returned/supplied paths, native route controls and request-owned ViewFS lifecycle.

• Prior source-bound Clang21/ASAN HdfsMgrTest: 12 selected tests passed for the native guard changes. Native source and test bytes remain identical to that validated run.

• Checkstyle inspected all 15 Doris Java source/test files in this PR; zero errors. Diff checks passed. The upstream Hadoop shadow source uses the repository's existing Checkstyle exclusion.

• Full SQL/Groovy regression, complete community CI and mixed-version execution were not performed locally.

• Behavior changed:

  • No.
  • Yes. Default-off local TVF access, canonical containment and effective filesystem route enforcement.

• Does this need documentation?

  • No.
  • Yes. Startup setting and upgrade guidance need documentation; documentation PR pending.

Check List (For Reviewer who merge this PR)

• Confirm the release note
• Confirm test cases
• Confirm document
• Add branch pick label

[hello-stephen]

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
3. What features were added. Why was this function added?
4. Which code was refactored and why was this part of the code refactored?
5. Which functions were optimized and what is the difference before and after the optimization?

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[OIiveirra]

/review

[github-actions]

Static review of PR #69526 at d353b6d, covering all 16 changed files and related SQL-to-BE discovery/read and LOCAL write-sink flows. Two P2 correctness issues need attention: canonical-root glob syntax breaks some valid enabled reads, and the new LOCAL disable switch does not cover INSERT INTO LOCAL. No existing inline threads were present, and no additional user focus was supplied.

Critical checkpoint conclusions:

1. Goal and proof: read-side startup rejection precedes authorization, property parsing, backend selection and discovery. Canonical target containment and generic target-resolution errors address the stated discovery problem. The two inline findings identify remaining enabled-read and disable-switch gaps.
2. Scope and reuse: changes are focused and reuse existing config, URI conversion and containment helpers; a shared LOCAL startup check would cover the separate sink path.
3. Concurrency and locks: no new production threads, mutable shared state or lock ordering. Glob work runs on the existing heavy-work pthread pool; no new blocking under metadata locks was found.
4. Lifecycle and initialization: no new resource ownership, caches, cycles or cross-TU initialization dependencies. Test fixtures restore config; production config is loaded before serving requests.
5. Configuration: enable_local_tvf defaults false and is startup-only because ConfField.mutable defaults false and ConfigBase rejects runtime changes. Opt-in is per FE; fe_custom.conf can override fe.conf. All seven changed regression deployment configs explicitly enable it.
6. Compatibility: default-off reads are an intentional operator-visible change documented in the PR release note; every query-serving FE needs configuration and restart. The canonical-root glob regression is unintended. No wire/storage-format or function-symbol changes were found.
7. Thrift/protobuf: no definitions or field/enum IDs changed.
8. Parallel paths: LOCAL/FILE-local SELECT, schema discovery, DESCRIBE and ordinary EXPLAIN share the read constructor; remote FILE storage stays independent. Parquet metadata wildcard expansion also delegates to LOCAL, while its exact-path behavior is unchanged. INSERT LOCAL uses the separate unguarded sink chain described inline.
9. Conditions and errors: new BE checks have concrete failure comments and checked Status propagation; failed/outside matched targets return generic errors. Glob RPC suppresses partial file results on failure. FE rejection preserves the existing exception family and gives restart instructions.
10. Test coverage: BE cases cover traversal glob classes, sibling-prefix escapes, symlinks, broken targets, relative/trailing-slash/symlink roots, invalid roots and helper URI/NUL inputs. FE/Groovy cases cover read gate ordering, ADMIN/OPERATOR authorization, FILE-local delegation, remote FILE dispatch and SELECT/EXPLAIN. Missing cases are metacharacters introduced by canonical roots and disabled INSERT LOCAL. Standard pipeline configs run enabled, so disabled SQL integration additionally needs a default-off deployment.
11. Test results: no expected-result files changed or were handwritten in this diff; new Groovy error assertions are appropriate. Tests were inspected, not executed.
12. Observability: the disabled error, generic target rejection and existing discovery/RPC context suffice for these guards; no new metrics or high-volume logging are needed.
13. Transactions and persistence: no edit-log, replay, failover, visible-version or delete-bitmap changes.
14. Writes and atomicity: the production diff changes read admission/discovery, with no new write protocol. The supported existing LOCAL sink remains reachable despite the new off setting, as the second finding explains.
15. FE/BE transmission: no new transmitted state or protocol field; gate stays on FE and checked absolute paths continue through existing file statuses/ranges to BE readers.
16. Performance and memory: the FE guard is constant time. BE retains linear per-match work and adds root canonicalization/stat calls; no new significant persistent allocation, ownership leak or asymptotic regression was identified. No performance measurement was run.
17. Other concerns: user documentation for the new startup opt-in/upgrade behavior remains pending in the PR description. No additional substantiated issue or unresolved static candidate remains beyond the two inline findings.

Validation and limits: the pure-text build-support/check-build-hygiene.sh passed header layering/budgets, extern-template pairing and unity-skip coverage. No source modifications, builds, unit/regression execution, cluster reads or binary ABI audit were performed; author-reported execution results were not independently reproduced. The conclusions above are based on static control-flow and diff evidence.

Review converged after 2 round(s).

[OIiveirra]

/review

[github-actions]

Request changes: three new P1 findings prevent the intended local-storage admission boundary from holding. Effective LOCAL storage under S3 reads bypasses privileged canonical discovery; native Hadoop projection can select a different route after JNI string conversion; BE default resources can add local child mounts beneath an admitted remote parent.

Reviewed the full supplied aggregate diff at dc19f3f. No additional user focus was supplied. Existing P1 examples were independently revalidated and are fixed at this head, so no existing blocking IDs or duplicate comments are included. The already-discussed cross-mount glob/no-inline-fallback compatibility restriction intentionally remains.

The concrete flows reviewed were:

SELECT LOCAL/FILE -> startup + auth -> BE safe_glob -> canonical name -> schema/range reader
SELECT S3 -> effective adapter -> listing -> declared/schema-RPC schema -> split-derived reader
INSERT/EXPLAIN -> BindSink -> normalized TVF sink -> optional FE cleanup -> native/JNI writer

Critical checkpoint conclusions (static review):

• Goal and proof: canonical LOCAL discovery is enforced, but the three inline cases leave effective local reads/writes admitted. Added tests omit those combinations.
• Scope and reuse: changes stay within TVF admission, the existing local filesystem helper, tests and pipeline opt-in; the shared Hadoop interpreter is the main complexity surface.
• Concurrency and locks: new maps/sets/paths are statement-local; no new threads, metadata locks or lock-order changes.
• Lifecycle and initialization: gates precede the intended factories/coordinator; automatic local state adds no ownership cycle or cross-TU initialization dependency. The S3 read exception is reported inline.
• Configuration: enable_local_tvf defaults false and is startup-only; every serving FE needs the documented restart/setting. No Meta Service knob is needed.
• Compatibility: local opt-in and conservative Hadoop-route rejection are deliberate behavior changes; no persisted format or public-symbol change. Mixed-FE rollout needs consistent configuration.
• Thrift/protobuf: no gensrc definitions or field IDs change.
• Parallel paths: LOCAL/FILE, S3 effective Hadoop/LOCAL, native schema/range readers, INSERT/EXPLAIN/direct binding, CSV/Parquet/ORC writers, JNI local factory and FE cleanup were traced. Missing coverage is reflected in the inline findings.
• Conditional checks and errors: added branches explain concrete failures and throw/return errors; previous NUL, empty-target, comparator, authority and wrapper-provider cases now reject before side effects.
• Test coverage: inspected BE containment/root/symlink/whitespace tests, all five changed FE test classes, and both Groovy suites/pipeline configs. Mocks and unit-test listing shortcuts do not prove real consumer equivalence; no tests/builds were run.
• Test results: no generated .out changes; fixture bytes, expected schemas and error strings agree with the inspected branches.
• Observability: existing foreground errors and file-operation logs remain adequate; rejected expanded local names are suppressed; no new background metrics requirement.
• Transactions/persistence/failover: no EditLog, visible-version, MoW bitmap or transaction-protocol changes.
• Writes/crashes/atomicity: external sink/cleanup retain their existing partial-write and nontransactional deletion behavior; this PR changes admission, with the reported native route exception.
• FE-BE propagation: no new transmitted variable; existing path/property/type consumers were traced, including exact local path identity and the reported JNI mismatch.
• Performance/memory: per-file routing scans can cost O(files * properties); no substantiated material performance regression, new large retained allocation, leak or memory-tracking defect found.
• Other invariants: planner slot/ExprId semantics, nullability, committed-data visibility and storage formats are unchanged.

All changed files and initial risk items have explicit source-based dispositions. The inherited-child question is now the third verified finding: startup classpath, default-resource loading, individual-key overlay and nested mount precedence were independently traced. Findings relying on JDK/libhdfs/Hadoop behavior are source-derived, not observed executions. Runtime, builds, ELF compatibility and full regression execution are outside this static review. Convergence is assessed separately from these verified findings and delivery, using the final reviewer attestations.

Review did not converge within three rounds: the final risk pass required correcting an external source citation, and the corrected payload has not received a fresh unanimous unchanged-set pass. All three findings and their PR anchors are verified; no source candidate or changed-file coverage remains unresolved. No fourth round was started.

Review did not converge after 3 rounds. This automated review cannot pass the review check.

The final risk reviewer withheld NO_NEW_VALUABLE_FINDINGS for a source-citation line-range correction. Source links were corrected after the frozen-set pass, so the delivered exact payload lacks fresh unanimous unchanged-set attestations. All three code findings and PR anchors are verified; all changed-file coverage and risk/candidate dispositions are complete, with no unresolved source question. Static-only runtime/build/test limits remain. Three rounds executed; no fourth round.

[OIiveirra]

/review

[github-actions]

Reviewed exact head 9cba45b against the supplied aggregate diff (36 changed paths). One new P2 finding: escaped Hadoop glob components can trigger FE-local metadata listing before returned-path admission. No local file-content read or BE write is asserted for that case.

Review converged after 2 rounds: all three reviewers returned NO_NEW_VALUABLE_FINDINGS in the final round against this unchanged payload; complete coverage and candidate/risk dispositions are recorded in the shared ledger.

Critical checkpoint conclusions:

• Goal and evidence: default-off LOCAL/FILE-local admission, privileged constrained LOCAL reads, alternate writer/cleanup gates and actual Hadoop consumer checks are implemented. The inline finding identifies a remaining pre-discovery gap. Added unit/regression cases cover ordinary positive/negative routes; escaped literal glob prefixes are missing.
• Scope and reuse: changes are focused on TVF IO admission, shared Hadoop route interpretation, cache isolation and related tests/configuration.
• Concurrency: connection creation and JNI checks occur outside the HdfsMgr mutex; exact guarded identities are checked at both lookups. Shared ownership keeps handlers alive through eviction; no new lock-order defect found.
• Lifecycle and initialization: native context capture follows outer provider initialization; pthread handoff and global-reference teardown preserve lifetime. Services register Hadoop resources before snapshotting; no new cross-TU initialization dependency found.
• Configuration: enable_local_tvf defaults false, is startup-only, and requires every serving FE to restart. Seven pipeline configurations explicitly opt in.
• Compatibility: no storage format or protocol definition changes. Guarded native IO requires matching patched Hadoop runtime and fails closed if unavailable; mixed-version full enforcement is explicitly not promised.
• Thrift/protobuf IDs: no changes under gensrc/thrift or gensrc/proto.
• Parallel paths: checked SELECT/EXPLAIN, INSERT/EXPLAIN, direct binding, FILE delegation, LOCAL JNI writer, effective adapters, cleanup, returned/supplied paths, declared schema, schema/data NameNodes and remote-provider variants. Generic unmarked catalogs keep the unguarded path.
• Conditions and errors: rejection paths propagate exceptions/Status and explain startup or remote-route requirements. Local canonicalization checks root containment and preserves exact whitespace; no additional conditional-path defect found.
• Tests: inspected all added/changed BE/FE/regression coverage. No builds, tests, cluster execution or storage IO were run for this static-only review; author-reported executions were not independently verified.
• Expected results: no .out files changed; Groovy additions use test/exception checks.
• Observability: configuration, missing-runtime/context and route errors give actionable context; no additional admission metric was identified as necessary.
• Persistence and failover: no EditLog, transaction or persisted metadata behavior changes.
• Writes and atomicity: external cleanup remains pre-execution and nontransactional; new admission precedes filesystem creation. Doris table transaction/version/delete-bitmap behavior is untouched.
• FE/BE variables: constant-size native marker reaches schema/data properties and THdfsParams plus writer properties; Java listing/cleanup receive independent encoded policies. Native consumers validate each actual converted path, including cache hits.
• Performance and memory: native marker size is constant in file count; raw configuration profile excludes per-path metadata. No additional substantiated allocation, lifetime or hot-path regression found by static inspection.
• Other issues: final sweep and missed-edge rechecks found no additional verified defect.

Existing threads: all 11 earlier P1 examples were independently revalidated as fixed at this head, including inherited BE child mounts; no existing blocking IDs remain. Earlier P2 sink/root/resource fixes are present. The already-discussed no-fallback cross-mount glob restriction remains explicitly documented and is not reposted.

User focus: no additional user-provided focus. Coverage limits: static inspection only; full SQL/Groovy, ABI/build, mixed-version and remote-service execution remain unverified. No unresolved code candidate remains in this review.

Review converged after 2 round(s).

[OIiveirra]

/review

[github-actions]

Static review of all 36 changed paths at c5f9890 found two new P2 issues: slash-containing brace patterns can reach FE-local discovery before admission, and exact remote cleanup can be rejected as though its literal brace directory were a glob. Both are reported inline.

Checkpoint conclusions:

• Goal and proof: default-off LOCAL/FILE-local admission, privilege-before-discovery and canonical containment are implemented. The two inline cases leave Hadoop discovery and exact cleanup behavior incomplete; the added tests do not cover those cases.
• Scope and reuse: changes stay within filesystem/TVF admission, the shared Hadoop route interpreter and related tests/configuration. Sharing the interpreter is appropriate; its two consumer-mode mismatches need correction.
• Concurrency and locks: concurrent native callers and cleanup use the HdfsMgr mutex for both cache lookups, insertion and individual eviction. Connections/context references are retained before unlocking; JNI construction, validation and release occur outside that mutex. No new lock-order problem was established.
• Lifecycle and initialization: connection-owned contexts and joined pthread workers keep stack/JNI lifetimes valid. Root context capture follows initialization; service-provider default resources are loaded before snapshotting. No new static-initialization dependency or ownership cycle was found.
• Configuration: enable_local_tvf defaults false and is startup-only. Its restart-every-FE guidance and the seven explicit regression-pipeline opt-ins agree with that behavior.
• Compatibility: no storage format or serialized function signature changes. Enforcement requires upgraded FE/BE and matching patched Hadoop consumers, as the PR notes; older BEs can ignore policy map entries during a rolling upgrade. Mixed-version enforcement was not validated.
• Thrift/protobuf IDs: no gensrc/thrift or gensrc/proto changes; no ID or enum compatibility issue applies.
• Parallel paths: LOCAL/FILE delegation, S3/HDFS effective adapters, native/JNI writers, cleanup, discovery, declared-schema shortcuts, schema RPCs and per-file native ranges were traced. The two reported cases are distinct listing/exact-delete paths. Ordinary unmarked catalogs retain their prior policy behavior.
• Conditional checks: local opt-in, native/Java projection, empty-target and cache-identity branches have concrete failure scenarios and focused tests. The brace fast path and cleanup rule mode are the remaining confirmed conditional errors.
• Test coverage: FE/BE unit additions cover gates, privileges, resources, inherited configuration, native identities, collisions/cache reuse, symlinks, root escaping and whitespace. Both Groovy changes and all pipeline configs were inspected. The JNI bridge is mocked in BE tests; full SQL/runtime coverage remains unverified.
• Expected results: no golden-output files changed. Unit expectations and Groovy error assertions were inspected statically; no test result is claimed as executed by this review.
• Observability: gate/runtime errors propagate through existing Status/listing/cleanup failures, with actionable startup guidance. No additional logging or metric defect was established.
• Transactions and persistence: EditLog, failover, partition versions and delete bitmaps are unaffected. No new persisted metadata or replay obligation applies.
• Writes and crash behavior: checks precede native file opening and FE cleanup. External file writes/cleanup retain their existing nontransactional behavior; no additional crash, partial-commit or deadlock defect was confirmed.
• FE/BE values: policy travels through existing properties/THdfsConf in native sink, scan and schema senders; actual converted paths are supplied at native connection creation and cache hits. No current native sender omission was found.
• Performance and memory: native guarded identities are compared within a hash bucket, the policy marker stays constant with file count, and direct remote cache hits avoid extra JNI/pthread work. Workers attach the existing thread context; no new significant untracked allocation or independently actionable performance defect was established.
• Other checks: canonical LOCAL glob roots are escaped, resolved targets remain contained, and returned filename whitespace is preserved. Currently unused Java-read helper APIs were not treated as an executable reader path. No further distinct verified issue remains.

Existing review context: all eleven original P1 instances were independently revalidated and are addressed at this head: supported JNI writer ID; effective LOCAL cleanup/S3 read adapters; delegated, overloaded and inherited Hadoop routes; Java/NUL and native map identities; default authority; empty targets; and JNI supplementary-character handling. No existing P0/P1 ID remains blocking. The original escaped-component example is fixed; the new singleton-brace case is a different transformation. The previously documented cross-mount read-glob restriction without a proven remote fallback remains an accepted compatibility limitation and is not reposted.

User focus: none supplied beyond the complete review. Coverage is static only: no source edits, builds, tests, storage IO, runtime/ASAN controls, mixed-version runs or final ELF ABI audit were performed. Author-reported test runs are not independent validation by this review.

Review converged after 2 round(s).

[hello-stephen]

BE UT Coverage Report

Increment line coverage 🎉

Increment coverage report
Complete coverage report

Category	Coverage
Function Coverage	66.57% (31942/47981)
Line Coverage	51.36% (336880/655942)
Region Coverage	46.74% (272604/583249)
Branch Coverage	48.47% (128531/265184)

[OIiveirra]

Local pipeline review — ✅ PASS

schema: doris-repo-review/v1
status: PASS
pr: apache/doris#69526
commit: 2832d38525e67a996e8a8c365bf9585240a048ca
base: 12f61bacec3ca1820a71dbd914633cc63c517413
reviewed_at: 2026-10-25T17:28+08:00
reviewer: OIiveirra
model: gpt-6.1-sol
effort: xhigh
findings: {blocker: 0, major: 0, minor: 0, nit: 0}
rounds: 1
converged: true

Notes for maintainers

• fe/be-java-extensions/hadoop-deps/src/main/java/org/apache/hadoop/fs/FileSystem.java:3715 — Rechecked literal metacharacters, later real wildcard prefixes and escaped-parent probes; previous runtime-04 is fixed while actual-local negatives remain.
• Full aggregate36-file review converged in round1 with zero findings. Parent source-bound110 selected FE tests and15 applicable Java Checkstyle files pass; full community CI and mixed-version behavior were not run in this review.

_{Reviewed locally with the doris-repo-review pipeline. Repository policy may accept this receipt for the matching commit; it is not a human Apache approval.}

[OIiveirra]

run buildall

[hello-stephen]

TPC-H: Total hot run time: 28353 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpch-tools
Tpch sf100 test result on commit 2832d38525e67a996e8a8c365bf9585240a048ca, data reload: false

------ Round 1 ----------------------------------
============================================
q1	17584	5094	5048	5048
q2	2160	302	266	266
q3	10203	1361	817	817
q4	4679	457	338	338
q5	7446	782	547	547
q6	182	182	152	152
q7	748	793	593	593
q8	9267	1322	1091	1091
q9	5550	4209	4176	4176
q10	6836	1289	1024	1024
q11	422	241	223	223
q12	638	400	281	281
q13	18079	3549	2995	2995
q14	276	281	245	245
q15	q16	723	709	682	682
q17	1192	751	570	570
q18	6991	6166	6101	6101
q19	1101	985	597	597
q20	378	334	235	235
q21	4958	2120	2262	2120
q22	350	290	252	252
Total cold run time: 99763 ms
Total hot run time: 28353 ms

----- Round 2, with runtime_filter_mode=off -----
============================================
q1	5616	5608	5595	5595
q2	679	592	526	526
q3	5273	5407	4951	4951
q4	1992	2144	1576	1576
q5	5247	5145	5472	5145
q6	247	203	155	155
q7	2380	2044	1877	1877
q8	3031	2655	2622	2622
q9	8033	7977	7924	7924
q10	3704	3655	3279	3279
q11	601	585	414	414
q12	675	711	523	523
q13	3560	3953	3253	3253
q14	329	328	282	282
q15	q16	706	701	665	665
q17	8258	7478	6992	6992
q18	12957	12167	12891	12167
q19	907	758	767	758
q20	2149	2139	1952	1952
q21	5622	4705	4672	4672
q22	496	433	404	404
Total cold run time: 72462 ms
Total hot run time: 65732 ms

[OIiveirra]

/review

[hello-stephen]

TPC-DS: Total hot run time: 150398 ms

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/tpcds-tools
TPC-DS sf100 test result on commit 2832d38525e67a996e8a8c365bf9585240a048ca, data reload: false

query5	4303	596	436	436
query6	431	212	196	196
query7	4822	445	226	226
query8	314	159	159	159
query9	8786	3032	3025	3025
query10	481	311	271	271
query11	5994	3850	3565	3565
query12	140	100	88	88
query13	1251	467	314	314
query14	6105	3949	3618	3618
query14_1	3398	3408	3405	3405
query15	206	195	179	179
query16	935	423	419	419
query17	855	657	541	541
query18	2437	429	307	307
query19	193	167	137	137
query20	86	84	86	84
query21	209	127	109	109
query22	12973	13015	12872	12872
query23	13483	12668	12556	12556
query23_1	12527	12429	12428	12428
query24	7448	798	468	468
query24_1	450	456	458	456
query25	500	387	332	332
query26	1257	253	130	130
query27	2784	438	266	266
query28	4634	1919	1927	1919
query29	1540	561	434	434
query30	295	215	185	185
query31	1004	922	814	814
query32	139	89	88	88
query33	522	286	222	222
query34	886	849	487	487
query35	716	736	656	656
query36	804	815	695	695
query37	118	92	82	82
query38	1746	1725	1651	1651
query39	781	787	742	742
query39_1	721	737	734	734
query40	216	113	92	92
query41	66	62	62	62
query42	82	80	85	80
query43	338	364	310	310
query44	1275	673	666	666
query45	187	167	162	162
query46	834	959	572	572
query47	2949	2764	2895	2764
query48	300	302	215	215
query49	567	397	284	284
query50	672	273	216	216
query51	10572	10254	10486	10254
query52	77	110	68	68
query53	181	204	150	150
query54	236	181	177	177
query55	81	67	62	62
query56	233	205	213	205
query57	1658	1593	1560	1560
query58	290	264	262	262
query59	2063	2156	1961	1961
query60	293	250	226	226
query61	146	144	141	141
query62	393	340	278	278
query63	179	154	157	154
query64	2733	922	728	728
query65	3308	3271	3287	3271
query66	1772	415	321	321
query67	20285	20047	20041	20041
query68	2963	988	619	619
query69	400	285	253	253
query70	827	781	767	767
query71	294	236	214	214
query72	2787	2562	2281	2281
query73	502	517	290	290
query74	4610	4540	4352	4352
query75	2319	2301	1899	1899
query76	2306	1007	585	585
query77	344	398	272	272
query78	9623	9628	9175	9175
query79	873	843	496	496
query80	463	426	342	342
query81	516	327	272	272
query82	205	125	116	116
query83	193	190	173	173
query84	285	121	98	98
query85	783	407	367	367
query86	261	240	226	226
query87	1995	1943	1809	1809
query88	3518	2657	2639	2639
query89	314	274	243	243
query90	2086	167	164	164
query91	156	151	130	130
query92	88	80	90	80
query93	971	967	562	562
query94	443	318	284	284
query95	593	356	313	313
query96	662	476	232	232
query97	2444	2400	2328	2328
query98	164	155	153	153
query99	755	758	644	644
Total cold run time: 232653 ms
Total hot run time: 150398 ms

[hello-stephen]

ClickBench: Total hot run time: 24.45 s

machine: 'aliyun_ecs.c7a.8xlarge_32C64G'
scripts: https://github.com/apache/doris/tree/master/tools/clickbench-tools
ClickBench test result on commit 2832d38525e67a996e8a8c365bf9585240a048ca, data reload: false

query1	0.01	0.00	0.00
query2	0.09	0.05	0.05
query3	0.26	0.09	0.09
query4	1.61	0.10	0.09
query5	0.24	0.24	0.24
query6	1.17	0.68	0.68
query7	0.04	0.01	0.00
query8	0.06	0.04	0.04
query9	0.40	0.35	0.35
query10	0.56	0.58	0.61
query11	0.20	0.14	0.14
query12	0.18	0.15	0.15
query13	0.50	0.48	0.50
query14	1.03	1.00	1.01
query15	0.63	0.61	0.63
query16	0.31	0.34	0.34
query17	1.10	1.15	1.13
query18	0.22	0.20	0.21
query19	2.14	2.03	2.03
query20	0.02	0.01	0.02
query21	15.48	0.19	0.14
query22	4.95	0.05	0.06
query23	16.26	0.33	0.12
query24	2.96	0.79	0.43
query25	0.10	0.05	0.06
query26	1.28	0.20	0.16
query27	0.07	0.03	0.03
query28	3.25	0.75	0.37
query29	12.50	4.11	3.29
query30	0.28	0.12	0.09
query31	2.77	0.56	0.32
query32	3.22	0.60	0.50
query33	3.26	3.24	3.25
query34	15.33	4.00	3.38
query35	3.34	3.30	3.36
query36	0.56	0.42	0.43
query37	0.09	0.06	0.06
query38	0.05	0.04	0.04
query39	0.03	0.03	0.03
query40	0.17	0.15	0.14
query41	0.08	0.03	0.02
query42	0.04	0.03	0.03
query43	0.05	0.03	0.03
Total cold run time: 96.89 s
Total hot run time: 24.45 s

[github-actions]

Reviewed #69526 at head 2832d38 using the authoritative aggregate diff. All 36 changed paths and all supplied review threads were inspected. No new actionable finding was verified.

Existing blocking context: the eleven original P1 instances covering the JNI local-writer identifier, effective LOCAL cleanup/S3 reads, delegated/dynamic ViewFS providers, authority/key/JNI identity, empty mount targets and inherited child mounts are addressed at this head. None is carried in existing_blocking_comment_ids. The existing P2 restriction on cross-mount globs without a proven remote route remains acknowledged in the thread and release note; it is not reposted.

Critical checkpoint conclusions (static review):

1. Goal and evidence: startup LOCAL admission, canonical secure-root containment and remote-only Hadoop TVF route checks are present on the traced read/write/cleanup paths. Added unit and regression cases target these contracts; no tests were executed in this review.
2. Scope and reuse: the changes stay within TVF admission, its Hadoop/native consumers and their tests/configuration. The shared route interpreter avoids separate FE/runtime mount-resolution implementations; the complexity follows the consumer boundary.
3. Concurrency: native cache selection/insertion/expiry uses its mutex while connection creation and JNI checks run outside it; exact guarded identities coexist in collision buckets. Request-owned Java clients are isolated. No actionable live-operation locking defect was verified.
4. Lifecycle and initialization: retained JNI Context/global references are released on OS threads; Java request ownership covers nested/Nfly peers, partial initialization and close failures. No new cross-translation-unit static initialization dependency was found.
5. Configuration: enable_local_tvf is deliberately startup-only and false by default; every serving FE must restart after opt-in. Regression configurations opt in explicitly; no cloud meta-service setting is needed.
6. Compatibility: no persistent format change was found. Guarded consumers require the matching patched Hadoop runtime and enforce its version. Full enforcement during mixed-version upgrades is explicitly not guaranteed in the release note and was not validated here; final glibc ELF compatibility was not tested.
7. Thrift/protobuf IDs: no definition changed; the cross-release field-ID audit is not applicable.
8. Parallel paths: LOCAL/FILE reads, HDFS/S3 discovery and supplied files, schema versus data requests, native and JNI sink selection, Java cleanup, V1/V2 native readers and cache hits were traced. This checkout has no active Avro/Lance reader implementation to validate through the unused compatibility APIs.
9. Special conditions: empty roots, NUL/surrogate identity, URI conversion, mount selection, glob normalization, literal cleanup and runtime-version conditions have concrete failure scenarios and explanatory comments. No additional admitted unsafe route was established.
10. Test coverage: added FE/BE tests cover default-off/opt-in behavior, authorization ordering, canonical/symlink/metacharacter/whitespace paths, discovery versus literal paths, inherited providers/mounts, cache isolation and child ownership. SQL/Groovy coverage is present; full cluster and actual runtime validation remain unperformed by this review.
11. Expected results: no .out result file was changed. Inspected error expectations follow the relevant validation order, and regression failures use test/sql/exception cases.
12. Observability: admission/version failures propagate as exceptions or non-OK Status; rejected local paths do not expose expanded external names. No critical missing metric or new noisy hot-path INFO log was identified.
13. Transactions and persistence: no EditLog, replay, failover, partition-visible-version or delete-bitmap logic changed.
14. Writes, failures and atomicity: native admission checks the actual generated file's create-parent route; cleanup validates its literal parent before filesystem creation/deletion. Existing TVF write/commit/crash semantics are retained; no new atomicity defect was verified.
15. FE-BE values: internal markers flow through both properties and THdfsParams where needed, including schema requests and native writers. BE validates the actual converted path before open, including connection cache hits.
16. Performance and memory: direct remote cache hits avoid per-file JNI/thread creation; expensive connection work stays outside cache locks. Added context metadata is per connection/request; no newly introduced data-sized untracked allocation or material redundant operation was established.
17. Other invariants: no additional data-correctness, memory-safety or error-propagation defect was verified. The reviewed code does not alter transaction visibility or MoW consistency.

User focus: no additional focus was supplied. Remaining validation limits are static-only inspection, unexecuted builds/tests/cluster scenarios and final ELF ABI checks, plus the documented mixed-version and cross-mount compatibility restrictions. There are no unresolved finding candidates or uncovered changed paths after the final sweep.

Convergence: true after 1 review round; both complete-review agents and the separate runtime-risk agent returned NO_NEW_VALUABLE_FINDINGS after their missed-issue rechecks.

Review converged after 1 round(s).

[hello-stephen]

FE UT Coverage Report

Increment line coverage 81.47% (189/232) 🎉
Increment coverage report
Complete coverage report

[hello-stephen]

BE UT Coverage Report

Increment line coverage 🎉

Increment coverage report
Complete coverage report

Category	Coverage
Function Coverage	66.62% (31972/47990)
Line Coverage	51.40% (337259/656131)
Region Coverage	46.79% (273059/583537)
Branch Coverage	48.52% (128734/265325)

[hello-stephen]

BE Regression && UT Coverage Report

Increment line coverage 100% (0/0) 🎉

Increment coverage report
Complete coverage report

Category	Coverage
Function Coverage	77.37% (35973/46497)
Line Coverage	62.60% (406326/649098)
Region Coverage	59.06% (343414/581420)
Branch Coverage	60.03% (158878/264672)

[hello-stephen]

FE Regression Coverage Report

Increment line coverage 61.09% (146/239) 🎉
Increment coverage report
Complete coverage report