Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Request changes: two verified findings are attached inline: a P1 remote-URI validation bypass that reaches local Lance storage, and a P2 regression for valid percent-encoded LOCAL Lance file URIs. There were no existing inline threads or additional user focus points.

Reviewed all 20 changed files at a7a0f19, with independent BE, FE/configuration, and URI/path risk reviews. The policy goal is only partly achieved: direct LOCAL/FILE-local authorization and top-level glob/dataset containment improve, but the S3 URI check still permits local fallback.

Critical checkpoints:

1. Goal and proof: traced constructor authorization, file discovery, schema RPC, range construction, SDK metadata open, dataset/cache key, scan and close. The two inline cases remain incorrect; added tests omit both.
2. Scope and clarity: changes are focused on startup policy, path/URI validation, range identity and supporting tests/configuration.
3. Concurrency and locks: no new thread, lock, lock order or shared production mutation; existing query/scanner and RPC contexts remain in use.
4. Lifecycle/static initialization: local URI values, existing dataset RAII and session ownership remain intact; no new cross-TU initializer dependency or cleanup defect found.
5. Configuration: enable_local_tvf is false by default and nonmutable; ConfigBase rejects runtime updates. Enabling requires configuration and restart on every query-serving FE. Seven regression deployments explicitly opt in.
6. Compatibility: default-off and ADMIN/OPERATOR requirements are intentional behavior changes. Existing fixed-version catalogs retain their warehouse paths; the encoded file-URI regression needs correction. Mixed deployments require upgrading the nodes that enforce the policy.
7. Protocol definitions: no Thrift/protobuf IDs, required fields, function symbols or persistent format definitions changed.
8. Parallel paths: checked LOCAL, FILE delegation, non-Lance glob, Lance schema/latest scan/cache reuse, remote fixed snapshots and catalog/search/row-ID paths. HDFS/HTTP TVFs reject Lance in common parsing.
9. Conditional logic: explicit per-range LOCAL/S3 identity and scan-level fallback agree with their producers; positive catalog versions intentionally bypass LOCAL-TVF containment. The URI predicate has the documented P1 exception.
10. Test coverage: inspected BE containment/symlink/root/schema/scan tests, FE gate/privilege/revocation/URI/range tests, and LOCAL/FILE SELECT/EXPLAIN regression checks. Mocked loader acceptance does not prove Rust provider dispatch; real remote reads and full Groovy execution were not verified here.
11. Expected results: no golden result files changed; added row IDs and file sizes agree with the committed fixture and literals.
12. Observability/errors: new Status failures propagate through existing schema/RPC/scan boundaries; rejected expanded targets use generic errors. Existing open/version/URI profile counters remain. No new execution stage requiring new metrics was introduced.
13. Transactions/persistence/failover: not affected; no EditLog, publish, delete-bitmap or visible-version change.
14. Data writes/atomicity/crashes: production changes are read-only; no new transaction, write rollback or crash-recovery protocol.
15. FE/BE propagation: schema already tags file_type; execution now preserves the TVF identity in the existing optional range field. Both LOCAL schema and execution use the resolver before opening/cache access.
16. Performance/memory: added validation runs at construction or dataset/split setup, outside row loops; no significant new allocation, unbounded cache or read amplification identified.
17. Other checks: decoding, NULLs, row alignment, predicates and EOF behavior are unchanged. Top-level directory containment does not provide an SDK-wide sandbox for preexisting dataset-internal symlinks; no introduced defect was established for that separate limitation.

Static source review only: no builds or tests were run and no product files were changed. No unresolved review candidate or uncovered changed file remains. Operator documentation is still pending according to the PR description; the release note describes the intended startup migration.

Review converged after 3 round(s).

Static review of 90a3a93 found one new P2: LOCAL Lance file URIs with parent segments can select a different in-root dataset because filesystem symlinks are resolved before URL dot-segment normalization. The inline comment contains the concrete case and fix direction.

Existing threads were independently revalidated: P1 4361485535 is fixed by original-port digit validation and IPv6 validation; P2 4361485545 is fixed for its escaped-versus-literal path cases by one-pass file-URI decoding. Neither is reposted or carried as a current blocker. The new finding concerns URL dot-segment ordering in the newly added filesystem helper, independently of the earlier percent-decoding issue. No additional user focus was supplied.

Critical checkpoint conclusions:

1. Goal and proof: startup opt-in, early read authorization and pre-open containment are implemented; the new P2 is the remaining identified correctness defect. Focused tests exist but omit its dot-segment/symlink interaction.
2. Scope: changes are focused on LOCAL admission, secure paths, Lance URI identity and regression opt-ins.
3. Concurrency and locks: validation uses existing planning/RPC/scanner contexts and request-local state; no new threads, locks, lock order or lock-held heavy work.
4. Lifecycle and static initialization: dataset ownership/cleanup is unchanged; no new resource cycle or cross-translation-unit initializer dependency.
5. Configuration: enable_local_tvf defaults false and is immutable at runtime. Enabling it requires configuration and restart on every query-serving FE, as described in the PR.
6. Compatibility: the default-disable behavior is intentional; positive-version catalog routing is preserved. File-URI compatibility needs the inline correction. No wire/storage format or function-signature change.
7. Shared definitions: no Thrift/protobuf definitions changed; cross-release field-ID checks are not applicable.
8. Parallel paths: LOCAL/FILE reads, INSERT/EXPLAIN, schema/execution, shared-storage/single-BE, cloud/shared-nothing selection, S3/Broker normalization and fixed-version catalogs were traced.
9. Special conditions: range-type precedence, version-zero LOCAL confinement, catalog exceptions, literal glob roots, provider allowlist, signed ports and IPv6 checks match their producers and pinned SDK behavior, apart from the inline URI-normalization defect.
10. Tests: inspected all changed FE/BE tests and the Groovy suite. Positive/negative admission, privilege ordering, aliases/authorities, range identity, symlink/glob roots and escaped URI cases are represented; dot segments with symlinks are missing. Opted-in pipeline configurations normally exercise the enabled Groovy branch.
11. Results: no expected-result files changed; new expectations agree with inspected inputs. Author-reported test runs were not independently executed.
12. Observability: admission errors are explicit; generic containment errors avoid exposing expanded target names. Existing reader profiles and failure propagation remain in place.
13. Persistence and transactions: no EditLog, transaction publication, visible-version, delete-bitmap or persisted metadata changes.
14. Data writes and crashes: only sink admission changes; external-file write atomicity and crash/cleanup behavior are otherwise unchanged.
15. FE-to-BE transport: existing optional file_type is now explicit on Lance TVF execution ranges; schema requests were already tagged, and catalog/remote snapshot versions remain fixed.
16. Performance and memory: bounded planning/per-open path validation introduces no per-row allocation, retained buffer or cache amplification; per-match canonicalization is required for glob confinement.
17. Further review: rechecked parser/provider dispatch, cached dataset opens, bare percent/query/fragment identity, legacy tags, authorization initialization and symlink resolution. No additional substantiated defect or unresolved code-analysis question remains.

Coverage: all 22 changed paths were reviewed, with two complete-scope reviewers and a separate remote-URI risk reviewer. Static inspection only: no Doris builds, test suites or live SDK/data scans were run; isolated filesystem path demonstrations supported the inline finding. Source files and submodules were unchanged. Runtime interoperability and full regression execution remain validation limits, not claimed results.

Review converged after 2 round(s).

Static review of all 22 changed paths at 90a3a93aae68c021024842b1f19e32965e730508, with independent BE, FE, and URI-risk coverage.

One new P2 finding is inline: valid uppercase/mixed-case file: schemes now fail LOCAL Lance schema discovery. The existing dot-segment/symlink finding still applies and was not reposted. The earlier signed-port/IPv6 bypass and percent-decoding finding are fixed for their reported cases. No existing P0/P1 was independently confirmed to remain applicable, so existing_blocking_comment_ids is empty. Review opinion: URI compatibility still needs correction.

Individual critical-checkpoint conclusions:

Validation limits: static inspection only, including pinned SDK/parser primary sources. No builds, tests, runtime reproduction, deployment restart, real remote-store reads, or exhaustive parser fuzzing were performed. Author-reported test results were treated as context, not independent validation.

Review converged after 2 round(s).

Static review of #69527 at 33cbacc reports two new P2 dataset-identity regressions in LOCAL Lance file-URI resolution. Both can silently select another existing dataset inside the allowed root. The inline comments provide independent triggering inputs and fix directions.

The four existing threads were independently revalidated: signed ports/malformed IPv6 (4361485535), percent decoding (4361485545), dot-segment/symlink order (4365942546), and case-insensitive schemes (4365978318). Their reported triggers are fixed at this head; no existing P0/P1 remains confirmed. These new findings require neither percent escapes, dot segments nor mixed-case schemes and are distinct from those threads. No additional user focus was supplied.

Critical checkpoints:

1. Goal and evidence: default-deny LOCAL/FILE-local admission and canonical containment are implemented; SDK-compatible file-URI identity still fails in the two inline cases. Added tests exercise the intended gates and prior fixes but omit these collisions.
2. Scope: changes are focused on admission, range identity, filesystem validation and matching tests/configuration.
3. Concurrency: no new threads or locks. Glob/schema RPCs use the existing heavy-work pool; readers own per-scan state, and shared session initialization retains call_once. No new lock-order or heavy-under-lock issue found.
4. Lifecycle/static initialization: validation precedes schema and cached dataset opens; scanner/dataset release order is preserved. No new persistent owner, reference cycle or cross-TU static dependency.
5. Configuration: enable_local_tvf defaults false, is immutable, and explicitly requires every FE restart. Pipeline opt-ins are deliberate.
6. Compatibility: existing file-type fields and values are reused, including scan-level fallback; positive-version catalog and remote ranges preserve their providers. No new storage-format or symbol incompatibility found.
7. Thrift/proto: no definitions changed; cross-release ID comparison is inapplicable.
8. Parallel paths: LOCAL and FILE delegation, SELECT/EXPLAIN, legacy construction, independent INSERT/EXPLAIN sink binding, schema RPC, execution ranges, remote TVFs and local catalogs were traced. Existing sink ADMIN/LOAD admission remains.
9. Conditions: comments explain version-zero LOCAL handling, per-range precedence, canonical containment and final remote-URI validation. Both new URI identity findings apply to schema discovery and scanning.
10. Tests: reviewed positive/negative admission, privilege revocation, URI normalization, symlink/glob containment, literal root operators, remote/catalog preservation, range tags and actual scanner assertions. Disabled-sink regression coverage is conditional on configuration; binder unit tests cover it independently. Add distinguishable datasets and bare-path controls for the two new cases.
11. Results: no expected-result files changed. Assertions/error text were checked statically. No builds, tests or benchmarks were run; prior thread reports are not claimed as this invocation's validation.
12. Observability: existing errors and Lance URI/version/open profiling remain. Admission checks do not need new metrics; no added logging/counter defect found.
13. Persistence/transactions: no EditLog, transaction-state or visibility-protocol changes. Fixed snapshot and delete/bitmap semantics are untouched.
14. Writes/crashes: the independent LOCAL sink gains admission checking; existing writer/coordinator cleanup and file-output atomicity are unchanged. No new crash-related leak/deadlock identified.
15. FE/BE variables: execution now explicitly carries LOCAL/S3 range identity; schema requests already carry it. No additional variable or serialization path is introduced.
16. Performance/memory: added parsing/canonicalization occurs during admission or split setup rather than per row; no new large retained allocation, redundant dataset open or hot-path regression was substantiated.
17. Further sweep: checked parser/provider mismatches, rootless URLs, whitespace preprocessing, second parsing of canonical paths, symlink/dot/decode ordering, partial glob-result leakage and metadata-count/catalog exemptions. No unresolved candidates or uncovered changed paths remain.

Coverage includes all 22 changed files and their relevant upstream/downstream paths. Findings are supported by checked-out code and pinned SDK sources; runtime behavior remains unverified under the static-only contract.

Review converged after 2 round(s).

Three new findings: one P1 admission bypass, one P2 LOCAL Lance home-path regression, and one P3 drive-style file-URL compatibility regression. Request changes for the P1; all verified findings are inline.

Reviewed exact head 0d96b297bd650f18441aa054b9a4cc49cedb6ed5 against the supplied merge-base diff. All 22 changed files were covered by the main review, separate FE/BE complete reviews, and an additional parser/admission risk review. The review converged in two rounds on this unchanged finding set.

All six existing threads were independently revalidated as fixed: signed-port/mapped-IPv6 local fallback, percent decoding, URL dot-segment/symlink ordering, case-insensitive file schemes, rootless file URLs, and URL whitespace/control preprocessing. No existing P0/P1 remains applicable, so no existing blocking IDs are carried forward and none of those issues is reposted. There was no additional user-provided focus.

Critical checkpoint conclusions:

Static review only: no builds or tests were run. SDK behavior was checked against pinned primary sources. Full Groovy execution, disabled-mode SQL/JNI reproduction and real remote data reads remain unexecuted; inspected test code and the PR author's reported runs are not independent runtime validation. These execution limits do not imply uncovered static scope.

Review converged after 2 round(s).

Request changes: one new P1 remains in effective local-storage admission. A native HDFS sink can select fs.defaultFS=file:/// while LOCAL TVF is disabled, creating BE-local files; its optional cleanup can recursively delete an FE-local directory. The inline finding contains the concrete LOAD-user input and complete call-chain evidence. This is a distinct native path from the already-reported JNI writer issue.

Reviewed exact head d1ec854a5d1a1b6751583f0f900b805b9a702fee against the supplied authoritative merge-base diff: all 23 changed paths, all FE/BE tests and regression configurations, and relevant upstream/downstream paths. No additional user focus was supplied. Static inspection only: no builds, tests, runtime reproductions, source modifications or submodule initialization were performed.

The two existing P1 comments were independently revalidated and their reported instances are fixed: 4366199143 now gates the built-in LocalFileJniWriter across remote sink names, including slash/dot/NUL class identity; 4361485535 now rejects signed ports and malformed IPv6 before remote Lance metadata access. Therefore existing_blocking_comment_ids is empty. Existing BE percent-decoding, dot/symlink, case, whitespace, rootless-URL, drive and home-alias scenarios are also addressed; none is reposted.

Critical checkpoints:

1. Goal and evidence: default-deny LOCAL/FILE-local reads, early ADMIN/OPERATOR authorization, secure expanded-path containment, and consistent LOCAL Lance schema/scan identity are implemented. The native HDFS admission gap prevents the complete local-storage protection goal. Tests exercise the intended controls but omit this native local-provider case.
2. Scope and clarity: production changes are focused on admission, path resolution and range identity, with corresponding unit/regression coverage and explicit CI opt-ins.
3. Concurrency and locks: no new threads, lock acquisitions, lock-order protocol or shared mutable request state is introduced. Added filesystem checks use per-call state; passwd fallback is reentrant. Existing execution concurrency remains unchanged.
4. Lifecycle and static initialization: no new cross-TU initializer dependency, reference cycle or retained owner is introduced. Dataset ownership, session initialization and scanner close order remain intact.
5. Configuration: enable_local_tvf=false is intentionally startup-only; every serving FE must be restarted after enabling it. The annotation is not mutable, and dynamic configuration rejects immutable settings. Regression deployments explicitly opt in.
6. Compatibility: default-disabled behavior is an intentional operational change requiring the documented FE rollout action. No persisted storage format or protocol definition changes; existing optional range types are reused, and fixed-version catalogs preserve their URI routing. Older FE binaries cannot enforce the new FE admission policy during a mixed-version deployment.
7. Thrift/protobuf definitions: no gensrc files changed, so no field-ID/enum compatibility change is present.
8. Parallel paths: LOCAL and FILE delegation, schema and cached-scan opens, legacy scan-level and modern range tags, native/JNI sinks, remote S3 normalization/broker passthrough, HDFS/HTTP Lance rejection and fixed-version catalogs were traced. The one uncovered effective-provider admission path is reported inline.
9. Special conditions: LOCAL/version-zero validation and positive-version catalog exclusion match their callers. URI-only preprocessing preserves ordinary bare-path spelling; root escaping and component containment cover glob operators and symlinks. Effective native HDFS selection needs the additional admission check.
10. Test coverage: inspected positive/negative FE admission, privilege revocation, JNI aliases, remote URI controls, glob/symlink/root containment, and real Lance schema/key/row identity fixtures. End-to-end Groovy execution, real remote-service reads and the new native-HDFS reproduction were not run under this static-only contract.
11. Expected results: no generated .out files changed. Inspected assertions and Groovy backend-error expectations match their code paths; author-reported passing runs were not treated as validation performed here.
12. Observability: new denials provide actionable enablement/privilege errors and intentionally hide expanded external target names. Existing RPC status and reader profiles remain available; no new hot-path metric requirement was identified.
13. Transactions and persistence: no EditLog, transaction commit, visible-version or delete-bitmap protocol changes are introduced. Positive catalog snapshot routing remains unchanged.
14. Writes and crash behavior: accepted requests retain the existing sink lifecycle and its nontransactional file semantics. New admission normally precedes cleanup/execution, but the reported native HDFS bypass permits local side effects before those protections apply; no separate crash/cleanup regression was verified.
15. FE-BE propagation: no new wire variable is added. Explicit Lance range file_type now matches the schema request; per-range identity takes precedence over legacy scan parameters, and URI/version/options remain in dataset cache keys.
16. Performance and memory: parsing/allocation is bounded by input size and path resolution occurs during schema/dataset setup rather than per output row. No new substantial retained allocation, redundant batch operation or material performance regression was verified.
17. Additional issues and limits: the final missed-issue sweep found no second actionable defect. Pathless file-URL query/fragment handling was explicitly assessed as a low-impact parser edge, rather than a root escape or ordinary valid-dataset regression. No assigned changed-file or risk-mechanism coverage remains open; runtime validation remains excluded.

Converged after 2 review rounds: all assigned reviewers returned NO_NEW_VALUABLE_FINDINGS on the unchanged final finding set, required static coverage is complete, and all candidates and risk focuses have explicit dispositions. Convergence describes review completeness; the new P1 still warrants changes. No documentation file is added in this PR; its description says the documentation PR is pending.

Review converged after 2 round(s).

Review converged after 2 rounds of static review of all 64 changed paths at d8dfb58. One new P2 regression is reported inline: explicitly configured JuiceFS is rejected by FE admission although the effective runtime recognizes it as remote.

Existing review context: the five earlier P1 findings (malformed Lance authorities, local JNI writers, native Hadoop local writes/cleanup, remote Lance manifest bases, and S3-to-Hadoop reads) were independently rechecked against their current consumers; their reported triggers are addressed, so no existing P0/P1 is retained. Existing P2 thread r4367753241 still covers a paired-toolchain retry gap: if Lance finishes installation under a newer selected Rust toolchain and Paimon fails before its installer begins, the next invocation can reuse new Lance with old Paimon. This is not reposted.

Critical checkpoints:

1. Goal/behavior: default-off LOCAL admission, privilege-before-discovery, canonical containment and effective Hadoop/Lance storage validation are traced from SQL through schema/listing/sinks to native/JNI/SDK consumers. The new remote-provider regression prevents full compatibility.
2. Scope: the FE/BE/runtime/SDK/build changes serve these boundaries; no unrelated feature change identified.
3. Concurrency/locks: HdfsMgr lookup/insertion/cleanup remain locked; slow construction/JNI checks occur outside that lock; exact identities and atomic access timestamps are checked. No new lock-order problem established.
4. Lifecycle/static state: temporary datasets/JSON and Java context ownership, failure cleanup, pthread completion and reused-session validation were checked; no new static-initialization defect found.
5. Configuration: enable_local_tvf is deliberately startup-only, false by default, requiring every FE restart. Enabled Hadoop reads still require remote routes.
6. Symbols/storage compatibility: additive Lance metadata C ABI requires matching headers/archive; interrupted individual installation is detected. The paired-package retry gap above remains. Dataset formats are unchanged.
7. Thrift/proto: optional TLanceFileDesc field 7 has no collision against current master, 4.2, 4.1, 4.0 and 3.1 definitions. Complete enforcement requires upgraded serving FE/BE and patched Hadoop runtime.
8. Parallel paths: LOCAL/FILE/S3/HDFS, read/write/cleanup, schema/data, native/libhdfs3/Avro, and Lance scanner/index/row-id/session reuse were covered.
9. Conditions: marker ownership, LOCAL/version-zero compatibility, direct-remote fast path, selected ViewFS mounts and decoded versus bare paths were checked. No additional verified bypass found.
10. Tests: added positive/negative admission, URI identity, symlink/base, cache/collision, fixture and build-gate tests were inspected. Explicit JuiceFS TVF construction and paired-build retry coverage are missing.
11. Expected results: no golden-output changes; fixture generation uses official SDK APIs and checks actual row identities. Historical test claims are not current execution evidence.
12. Observability: route failures and existing scan/open counters remain; local tree preflight has no separate timing counter. No additional observability defect established.
13. Transactions/persistence: no Doris EditLog, visible-version or publish-protocol changes.
14. Writes/atomicity: checks precede native writer and FE deletion side effects; package publication is staged, subject to the known paired retry gap.
15. FE/BE propagation: runtime policy and Lance TVF marker were followed through schema/data senders and Avro; old peers cannot provide the new enforcement.
16. Performance/memory: cached direct-remote checks avoid a new pthread; LOCAL tree walks are iterative and deduplicate canonical directories. They run at open/range boundaries, not each batch; no further actionable regression established.
17. Final recheck: all changed paths, candidate dispositions, prior threads and R1-R4 risk mechanisms were swept; only the new inline P2 and existing paired-build P2 remain verified concerns.

There was no additional user focus. This was static-only: no builds, tests, filesystem read/write scenarios, Rust link, SQL/Groovy, external-service scans or mixed-version runs were executed. Local tree preflight is not an atomic filesystem snapshot. These validation limits remain; no unresolved static-review candidate or uncovered changed path remains.

Review converged after 2 round(s).

Static review of 43ccc01: one new P1 finding in native Hadoop write admission (inline). The runtime guard validates the final component although ViewFS creation resolves the parent; BE-only mount configuration can therefore select a local write route after admission. The earlier FE parent check is present; this finding concerns the new BE consumer boundary.

Existing threads were read and independently revalidated. The original P1 instances (4361485535, 4366199143, 4366424083, 4366876841, 4367464261) are addressed on this head; none is reposted or retained as an existing blocker. The existing parser, declared-schema, provider-set and paired-toolchain findings are also addressed.

Critical checkpoint conclusions:

1. Goal and proof: default-off LOCAL and effective-storage admission are broadly implemented, but the inline write-route defect leaves enforcement incomplete. Positive/negative tests are present; none was executed during this static-only review.
2. Scope: the changes consistently implement TVF admission, path identity, guarded caches and required SDK integration; no unrelated change identified.
3. Concurrency: HdfsMgr protects lookup/insert/cleanup with its mutex and performs construction/JNI checks outside it; no new lock-order defect found.
4. Lifecycle: dataset/string ownership uses RAII, checked datasets enter reader state only after admission, and Java contexts retain connection configuration and release on pthreads; no new static-initialization dependency found.
5. Configuration: enable_local_tvf is intentionally startup-only, defaults false and documents restarting every FE.
6. Compatibility: the additive Lance C ABI requires matching headers/archive; paired repair rebuilds Lance/Paimon using one selected cargo environment and retains interruption markers. Mixed-version full enforcement remains an explicit deployment limitation.
7. Wire definitions: the new is_tvf field is optional id 7. Live master and 4.2/4.1/4.0/3.1 definitions have no conflicting id/type; schema and data senders both carry the marker.
8. Parallel paths: LOCAL/FILE, S3/HDFS, schema/data, Avro/native, sink binding/cleanup, Lance primary/base and cache-reuse paths were covered.
9. Conditional routing: shared raw/effective provider classification and separate Java/native path projections are appropriate; native writes still require operation-specific parent resolution as reported inline.
10. Coverage: inspected FE/BE/Java, parser/glob, fixture schema/rows, dependency publication/retry and regression tests. Runtime tests for the reported parent-route mismatch are missing.
11. Expected results: no .out file changes; manifest fixtures have an official-SDK generator and row assertions. Binary/runtime behavior was not executed here.
12. Observability: policy failures are explicit and avoid resolved local-name disclosure; existing IO/reader profiling is retained.
13. Persistence: no Doris EditLog, visible-version, rowset or MoW/delete-bitmap changes; no new transaction-persistence obligation identified.
14. Writes and failure: FE checks precede cleanup, and dependency publication is recoverable; the inline BE route mismatch must be fixed before relying on disabled-mode local-write denial.
15. FE/BE propagation: native policies and Lance TVF markers reach schema/data/write consumers, including FILE delegation and Avro configuration copies.
16. Performance and memory: cached direct-remote checks avoid per-file pthread dispatch; byte caches include configuration identity, and LOCAL preflight scales with reachable entries. No additional substantiated performance or ownership regression found.
17. Additional concerns and limits: no extra user-provided focus. No builds, tests, source modifications or submodule initialization were performed. Full SQL/Groovy, optional io_uring and mixed-version deployment behavior remain unexecuted. Local tree preflight is not an atomic filesystem snapshot.

Review converged after 3 rounds; all verified findings are inline and no unresolved review candidate or assigned coverage gap remains. Convergence describes completion of the static review, not acceptance of the P1 defect.

Review converged after 3 round(s).

Static review of #69527 at 2767d73: request changes for one new P1. JuiceFS is classified as remote by implementation class even when its namespace selects a local authoritative data backend. The inline finding gives the supported-version trigger and source evidence.

Critical checkpoints:

• Goal and evidence: default-off LOCAL/FILE-local access, pre-discovery privileges, canonical containment and effective Hadoop/Lance storage admission are implemented across the intended paths. The JuiceFS backing-store case leaves that goal incomplete. Added positive/negative tests were inspected statically; they do not cover this case.
• Scope and clarity: changes remain within admission, path identity, request/client isolation and the required Lance SDK/build support. Shared Hadoop interpretation reduces separate FE/runtime classifiers; the remaining issue is an unsupported assumption within that shared classifier.
• Concurrency and locks: HdfsMgr uses its manager mutex for cache selection/insertion; expensive connection creation and JNI validation occur outside it, and the selected handle is revalidated after racing creation. No additional deadlock or unprotected shared-state defect was established.
• Lifecycle and static initialization: native contexts retain global JNI references with OS-thread release, Java ViewFS requests own mount clients, and Avro closes readers before clients on success and partial failure. No new cross-translation-unit initialization dependency was found.
• Configuration: enable_local_tvf defaults to false and intentionally requires fe.conf plus restart of every FE; regression configurations explicitly opt in. No new dynamically mutable setting is claimed.
• Compatibility and definitions: TLanceFileDesc field 7 is optional bool is_tvf. HEAD and origin/master, branch-4.2, branch-4.1, branch-4.0 and branch-3.1 definitions were compared; no field collision/reuse or new required field was found. SDK headers/archive require both new exports; paired Rust repair retains failure markers until Lance/Paimon outputs validate.
• Parallel paths and conditions: LOCAL/FILE/S3/HDFS reads, schema/data consumers, native/JNI sinks, FE cleanup, ViewFS nested/glob routes, Avro, Lance aliases/manifest bases and reused handles were traced. Conditions document legacy version-zero LOCAL and unmarked fixed-version catalog behavior. The new inline issue concerns JuiceFS delegation and is distinct from the prior remote-JuiceFS compatibility request.
• Test coverage and results: FE, BE, Avro, filesystem, protocol, fixture-generator, build-control and Groovy changes were reviewed. Negative/positive, alias, cache, split/projection and failure-cleanup cases exist. No expected .out result files changed. No build, test or runtime validation was performed during this review.
• Observability: existing open/cache/profile/error paths were inspected; new admission failures report their reason and local containment failures avoid expanded private paths. No separate observability defect was established.
• Transactions, persistence and writes: no committed-visibility, delete-bitmap, EditLog or transaction protocol changes. This PR adds admission to existing external writes/deletes; it adds no new atomicity or failover guarantee. Side-effect admission is covered by the new P1.
• FE/BE propagation: the TVF marker, protected native read/write properties, schema request properties/THdfsParams, Avro marker and range file types have corresponding receive/fallback paths.
• Performance and memory: exact connection/profile identity protects guarded caches; direct remote cached paths avoid per-file JNI; LOCAL Lance has one whole-dataset split and no per-batch tree walk. Required preflight remains linear in reachable entries. No additional substantiated CPU/memory regression was found.
• Other risks and user focus: the final missed-issue recheck covered nested create parents, decoded base paths, manifest references and interrupted paired SDK publication. There was no additional user-provided focus.

Existing P1 findings 4361485535, 4366199143, 4366424083, 4366876841, 4367464261 and 4369701678 were independently revalidated and are addressed by the current guards; none is carried as still blocking or duplicated. Other existing threads remain fenced.

Review convergence: converged after two rounds with complete assigned static coverage and all candidates/risk focuses disposed. Remaining validation/deployment limits: compilation, actual test execution, Rust final linking, full SQL/Groovy/CI and optional io_uring/remote runtime behavior were not verified here. Full enforcement requires every serving FE/BE and matching patched runtimes to be upgraded; local tree preflight is not an atomic filesystem snapshot. These limits are explicit and do not represent unresolved review candidates.

Review converged after 2 round(s).

No new actionable findings on head a59bdfd. The existing P1 findings were independently revalidated against this head; none remains applicable, so no blocking comment IDs are carried forward and no duplicate inline comments are posted. Review converged after 2 rounds.

Critical checkpoints:

1. Goal and evidence: startup-disabled LOCAL/FILE-local access, authorization before discovery, canonical containment, effective Hadoop route admission, and Lance primary/base policy are implemented across the traced consumers. Added unit and regression cases exercise those mechanisms; this invocation inspected them statically.
2. Scope and reuse: the changes span the required FE, BE, Java/SDK and build boundaries. One shared Hadoop route interpreter and one known-provider classification serve raw and runtime checks; no unrelated actionable change was found.
3. Concurrency and locks: native cache lookup/insertion and collision cleanup remain under the cache mutex; provider creation, JNI route checks and destruction run outside it. Guarded Java ViewFS clients are request-owned, with synchronized child ownership and close. No new lock-order cycle was established.
4. Lifecycle and initialization: native connection creation forces a new Hadoop instance, clears/takes its thread-local context, and captures the outer frozen context after nested initialization. Avro closes readers before their filesystem, including partial-open failures. No new cross-translation-unit static-initialization dependency was found.
5. Configuration: enable_local_tvf is intentionally startup-only, defaults false, and requires a restart of every serving FE. Test pipelines opt in explicitly. Hadoop reads still require proven remote routes when LOCAL is enabled; JuiceFS rejection is an intentional, documented restriction because its backing store is mutable.
6. Compatibility: unmarked catalogs retain their configured policy. The additive Lance C APIs require matching headers/archive and paired Lance/Paimon Rust repair. Interrupted publication is fenced by individual and pair markers. Full enforcement requires upgraded serving FE/BE and the patched Hadoop runtime; mixed-version enforcement is not promised.
7. Shared definitions: TLanceFileDesc field 7 is optional is_tvf. Supported release-branch definitions were compared; no reused field ID or conflicting meaning was found, and no proto definition changed.
8. Parallel consumers: reviewed SELECT/EXPLAIN, FILE delegation, LOCAL/S3/HDFS, Java listing and cleanup, supplied/returned file paths, schema RPC versus declared CSV schema, native/JNI sinks, Avro, Lance schema/scans and cache reuse.
9. Conditional behavior: native create-parent versus read-leaf routing, Java literal cleanup versus glob probes, C-string projection versus Java strings, and TVF versus catalog identity are explained in code and covered by targeted assertions. Unknown or runtime-dependent routes fail explicitly.
10. Test coverage: changed FE/Avro/Hadoop and BE filesystem/Lance tests, SDK-generated fixture code, SDK C/Rust tests, build-control tests and account regression changes were inspected. Positive, negative, alias, nested-mount, cache, projection/split and cleanup-failure cases are present.
11. Expected results: no generated SQL .out files changed. Inspected schema, row-identity, path, error and lifecycle assertions match the traced contracts; optional remote/io_uring tests depend on their stated environment.
12. Observability: admission failures are explicit, rejected LOCAL resolution avoids exposing expanded target names, and existing filesystem/Lance profiles and error contexts remain available. No new per-row logging was introduced.
13. Persistence and visibility: no EditLog, transaction metadata, partition visible-version or MoW delete-bitmap logic changed. Existing committed-data visibility contracts are outside the modified mechanisms.
14. Writes and failures: effective-writer and cleanup checks precede their side effects. Existing external TVF writes remain nontransactional; this change does not add an atomicity or failover guarantee. Resource and interrupted SDK-publication failure paths were inspected.
15. FE/BE propagation: Hadoop policy reaches schema and data properties/HDFS params, final sink properties, and Avro Java parameters. Lance TVF identity reaches both schema and scan descriptors and participates in reader policy identity.
16. Performance and memory: no new row-loop work, redundant RPC under metadata locks, or substantiated unbounded hot-path regression was found. LOCAL Lance tree preflight is an intentional traversal with canonical-directory cycle deduplication; LOCAL uses one whole-dataset split. Temporary reader/context ownership and cleanup were reviewed without executing memory instrumentation.
17. Final recheck and focus: all 65 authoritative changed paths were covered, existing threads were used as duplicate fences, and all investigated candidates and initial risks have evidence-backed dispositions. There was no additional user-provided focus.

Limits: static review only; no builds, tests, source modifications or submodule initialization were performed. Full SQL/cluster execution, live storage-provider behavior, io_uring and mixed-version deployment were not validated by this invocation. LOCAL tree preflight is not an atomic filesystem snapshot, as the PR documents. No unresolved static candidate or assigned coverage gap remains.

Review converged after 2 round(s).