Request changes: two verified regressions remain: [P1] cleanup can delete files from an already published REST snapshot after response loss; [P2] a thrown allocation failure during sorted EOS can bypass file cleanup. Both are reported inline. There are no existing inline findings to carry forward, and no additional user-provided focus.

Reviewed the complete 15-file authoritative diff at head 8b8880d and traced the INSERT/overwrite, DELETE, MERGE, rewrite, sorter/spill, serializer, report, and transaction-owner paths. Static review only: no builds, tests, benchmarks, source edits, or submodule initialization.

Critical checkpoint conclusions:

• Goal and proof: required NULL/map-key checks run before partition writer creation; unit and ORC/Parquet regression cases cover the intended rejection and optional-parent behavior. The two failure paths below remain uncovered by those tests.
• Scope: changes stay within Iceberg validation, close/failure cleanup, and associated tests.
• Concurrency: report append and rollback snapshot/clear share the transaction monitor; remote deletion occurs outside it. Sort write/close/revoke share the sorter mutex. No new lock inversion identified.
• Lifecycle: reset destroys streams before waiting for S3/HDFS writers and invoking cleanup callbacks; retained FE authentication/FileIO survives cleanup. Sorted exception unwinding has the inline P2 defect. No new global initialization dependency.
• Configuration: no new configuration item.
• Compatibility: no changed wire/storage layout or function signature; existing mixed-version behavior remains.
• Thrift/protobuf: no gensrc definitions changed, so cross-release ID comparisons are inapplicable.
• Parallel paths: ordinary, sorted/spilled, and MERGE data writers share validation; append/overwrite/DELETE/MERGE/rewrite transaction cleanup was traced.
• Conditions: optional container parents mask descendants; constant materialization and padded collection offsets agree with this branch's column invariants and serializers.
• Test coverage: scalar/constant/nested/list/map rejection, optional parents, pre-creation rejection, close Status failure, repeated failed close, lease ordering, and explicit unknown commit state are covered in inspected tests. REST response loss and thrown EOS allocation failure need targeted cases.
• Expected results: no .out changes; Groovy baselines check published snapshot/file/row counts. Nested invalid input can be rejected by FE planning.
• Observability: validation reports field path and row/ordinal; cleanup logs per-file deletion failures and retains the original query error. No separate missing metric identified.
• Transactions/persistence: publication remains Iceberg metadata CAS with no new Doris EditLog state. The inline P1 violates committed-file visibility after an indeterminate REST commit; MoW/version machinery is untouched.
• Writes and crashes: rollback deletes newly reported paths, not referenced source files. Per-file deletion errors continue cleanup. No new crash recovery is implemented; sorted exceptions leave the inline P2 orphan.
• FE/BE propagation: no new transmitted variable; pinned schema/projection and row-lineage shapes were checked.
• Performance/memory: primitive required fields use a null-map fast path; rollback deduplicates paths and scales linearly. No substantiated additional performance or memory-accounting defect found.
• Other issues and limits: all changed-file scope and initial risks have dispositions. No additional distinct issue found. Physical orphan absence, async upload failure behavior, and REST reconciliation were not runtime-validated; metadata-only regression assertions do not prove those properties.

Review converged after 2 round(s).