[P1] Hudi can miss cancellation before syncFsView starts. Registering the statement lease here lets cleanup stop the SplitAssignment while Hudi's BatchFsViewOwner has not yet published its sync thread. SplitAssignment.addCloseable then closes the owner with syncThread still null; Hudi subsequently calls beginSync and the potentially blocking syncFsView unconditionally (lines 738-744), so the stop interrupt is missed and a cancelled query can remain blocked on remote timeline I/O. Check the stop state before entering sync or make owner publication/close atomically interrupt an already-stopping sync.

Fixed in 0068bcf. Both Hudi fs-view owners publish the sync thread before checking cancellation, so an already-closed owner rejects the remote sync; a later close interrupts the published thread. Batch beginSync is inside the terminal catch/finally to preserve exact lease release. Added deterministic close-before-publication cases alongside the existing blocked-sync tests; all 339 related FE tests and full FE packaging/Checkstyle pass.

[P1] Preserve historical DATE partition values across DATE-to-TIMESTAMP_NANO evolution. DorisDataTableScan rebinds historical manifest specs to the current schema, so ManifestCacheValue.forScan reaches this unsupported conversion for old date-partitioned files and throws. In batch mode this runs lazily from IcebergScanNode's manifest iterator after the manifest-cache fallback boundary, causing the query to fail instead of scanning the historical partition (and dropped promoted fields can also mismatch equality-delete partition keys). Add a correct DATE/TIMESTAMP_NANO adaptation or retain the historical spec/value for matching, with a partitioned streaming regression test.

Fixed in 0068bcf. Query-local adaptation now converts DATE/nanos exactly and normalizes dropped temporal partition keys without overflow. Delete manifest caching also preserves the manifest's physical partition types, matching the data-file reader, so current schemas cannot erase or reinterpret historical partition values before adaptation. Added partitioned streaming tests using the production cache readers: old DATE data retains its equality delete both before and after the promoted identity field is removed. All 339 related FE tests and full FE packaging/Checkstyle pass.

[P1] Support DATE to ordinary TIMESTAMP partition promotion. The adapter converts DATE only when the target is TIMESTAMP_NANO; an old identity-partitioned DATE file rebound to an ordinary Iceberg TIMESTAMP (microseconds) reaches the final unsupported-conversion exception. DorisDataTableScan rebinds historical specs by field ID, and the batch manifest iterator evaluates this adaptation lazily, so the producer fails the query instead of reading the historical partition. Add an exact days-to-micros conversion with overflow checks and a partitioned DATE-to-TIMESTAMP regression covering data and delete files.

Fixed in 68ef8c2. DATE partitions now convert exactly to ordinary without-zone TIMESTAMP microseconds, with overflow checks and exact-midnight checks for reverse historical adaptation. DATE-to-zoned timestamp conversions are rejected for both precisions. Added real partitioned streaming metadata cases and unit tests for positive/negative days, nulls, overflow and lossy narrowing. This is a reader repair; SQL ALTER type support is unchanged. All 253 related FE tests and full FE packaging/Checkstyle pass.

[P1] Normalize dropped DATE and ordinary TIMESTAMP keys consistently. In the UNKNOWN target branch, dropped DATE values become BigInteger days multiplied by NANOS_PER_DAY, while ordinary TIMESTAMP values fall through as Long microseconds; only TIMESTAMP_NANO uses the common BigInteger representation. After a partition field is promoted from DATE to ordinary TIMESTAMP and dropped, an old data file and a current equality-delete file therefore produce unequal keys for DeleteFileIndex, so the delete can be omitted. Convert ordinary TIMESTAMP to the same lossless representation and add a dropped DATE-to-TIMESTAMP equality-delete regression.

Fixed in 68ef8c2. Dropped DATE, microsecond TIMESTAMP and nanosecond TIMESTAMP keys now use the same lossless BigInteger nanosecond representation, so comparisons and hashes agree without overflowing the source ranges. The dropped DATE-to-microsecond partition test now retains its equality delete, and unit tests compare keys across all three representations. All 253 related FE tests and full FE packaging/Checkstyle pass.

[P2] Keep adapted Iceberg files serializable for task reuse. ManifestCacheValue.forScan returns DataView/DeleteView when a historical manifest partition type differs from the rebound spec, but FileView implements only ContentFile and is not Serializable. Non-batch manifest planning serializes each BaseFileScanTask; this throws and planFileScanTaskWithoutReuse falls back to a full SDK scan, so adapted DATE/TIMESTAMP or dropped-field tables bypass statement manifest/task reuse. Make the views serializable with serializable state, or materialize concrete serializable Iceberg file objects, and add a non-batch adapted-task reuse regression test.

Fixed in 68ef8c2. The shared static file-view base and both concrete wrappers are serializable with explicit serialVersionUID; their only state is the native Iceberg content file and query-owned PartitionData. No adapter, cache loader or statement resource is captured. A real supported int-to-long partition evolution test reproduced NotSerializableException before the change and now verifies serialized data/delete partition values and one manifest load across two equivalent non-batch relations. All 253 related FE tests and full FE packaging/Checkstyle pass.

[P2] Keep the estimate per partition. getNextBatch() advances through fileCaches/partitions whenever a range iterator is exhausted, so one returned batch can contain ranges from many partitions; this line records that combined batch size as numSplitsPerPartition. With one partition containing N ranges and splitBatchSize=1, numApproximateSplits() reports only the initial 10-split floor instead of N when N is larger; with several small partitions it can over-report. The estimate becomes TSplitSource.numSplits and drives BE scanner-count/file-meta-cache heuristics. Track per-partition counts or maintain a separate batch-size metric.

Fixed in 663c74d. The streaming source now counts splits for its current selected partition across producer batches and files. It publishes the existing global maximum at a yield and before advancing partitions, then resets only at that boundary. There is no per-range atomic update or eager materialization. The ten-split floor and int saturation remain. Tests reproduced 17 expected versus 10 actual for a one-range batch, and 51 versus 87 when unequal partitions share a large batch; both now pass. Counts remain approximate while unseen files are still being lazily generated. All 147 related FE tests and full FE packaging/Checkstyle pass locally.

[P2] Validate these global scheduler values as positive at configuration load. A non-positive external_scan_split_threads or external_scan_metadata_threads is accepted by ConfigBase and then makes ExternalMetaCacheMgr construction throw in FairTaskExecutor; external_scan_task_queue_capacity <= 0 reaches newGroup() and fails the first external scan. Add startup range validation (and a regression for invalid fe.conf values) so a typo is rejected at the configuration boundary.

Fixed in 663c74d. All three settings opt into a pure positive-integer config validator during both ordinary and custom startup-file loading. Zero/negative values are rejected with the config name before that invalid field is updated. The existing empty-entry default rule and runtime immutability are preserved; unrelated runtime callbacks with side effects are still not dispatched during startup. Scheduler constructor/group preconditions remain for direct programmatic callers. Config tests cover both startup paths, 0/-1, valid positive/whitespace values, previous-value preservation and runtime update rejection. All 147 related FE tests and full FE packaging/Checkstyle pass locally.

[P1] Release the retained Iceberg generation when admission races cancellation. doStartSplit retains generationLease before evaluating getSplitTaskExecutor() here; if statement cleanup closes scanTaskLease in that window, Lease.group(false) throws before SplitProducer.start() registers the source and before BatchSource.close() can release generationLease. The statement's original lease is a separate reference, so repeated cancelled scans retain retired table generations/FileIO. Acquire the executor first or close generationLease in a failure path around producer construction.

Fixed in 7e8a562. The executor/group lookup now happens before retaining the independent generation lease. Cancellation during that lookup therefore cannot strand an unregistered lease; after acquisition, SplitProducer still owns cleanup on executor rejection, cancellation and normal completion. A production-entry regression reproduces the distinct statement-reference release followed by admission failure (one leaked reference before the fix, zero after). All 218 related FE tests and full FE packaging/Checkstyle pass locally.

[P1] Bound the producer batch allocation independently of the user setting. split_batch_size accepts any positive int, and this new ArrayList<>(splitAssignment.getSplitBatchSize()) allocates that many references before backpressure or file availability is known. A query hint such as split_batch_size=2147483647 can trigger an FE OOME (the Iceberg batch source has the same allocation). Cap the setting or start with a small bounded capacity and grow as batches are filled.

Fixed in 7e8a562. Both Hive and Iceberg now use one batch allocator that limits only the initial ArrayList capacity to 128, retaining the configured batch maximum and growing with actual work. An isolated 64MB JDK probe reproduced Integer.MAX_VALUE failing before any split. Actual-source tests now cover that maximum with 257 Hive ranges (no artificial 128-range cap) and empty Iceberg planning with generation cleanup. All 218 related FE tests and full FE packaging/Checkstyle pass locally.

[P2] Keep the COUNT() split decision scan-wide in streaming mode. createSplitBatchSource now calls needSplitFiles(loaded, numBackends) after loading each singleton partition, so a table with 100 one-file partitions and a parallelism threshold of 32 makes every 1-GB Parquet/ORC file splittable even though the aggregate file count would disable splitting in the eager path. Each file is then split into many ranges and its metadata is reread, defeating the count-pushdown optimization. Carry the aggregate selected-file count (or an equivalent shared decision) while retaining lazy range materialization, and add a multi-partition COUNT() regression.

Fixed in 7e8a562. COUNT(*) now makes one scan-wide decision using bounded metadata lookahead on the existing concurrent, cancellable producers. They retain nonempty file metadata until the parallelism/backend threshold is reached, allowing only already in-flight partitions to complete, then share that decision and reuse the metadata before lazily listing further partitions. Singleton listing and original interruption/fair scheduling are preserved; no split-executor task waits for child tasks. The 100-file regression produced 800 ranges before repair and 100 after; a two-file scan still splits to 16 ranges. Tests cover both scanner versions, Parquet/ORC, disabled file caching without relisting, bounded lookahead, metadata failure and cancellation. All 218 related FE tests and full FE packaging/Checkstyle pass locally.

[P1] Remove the unreachable checked IOException catch in splitFileIterator's anonymous Iterator.next(). SplitCreator.create(...) has no throws IOException, and every other call in that try body is non-throwing, so javac reports exception IOException is never thrown in body of corresponding try statement and the FE module cannot compile. Either remove the catch/wrapper or change the SplitCreator API and all implementations to a checked contract.

This finding does not apply to reviewed head 7e8a562. The try body also calls Hadoop BlockLocation.getHosts() in the unsplittable and explicit-size branches; the actual Hadoop 3.4.2 dependency declares public String[] getHosts() throws java.io.IOException (confirmed with javap). That checked exception must be adapted because Iterator.next cannot declare it. SplitCreator.create need not throw. The exact-head remote COMPILE build 1089472 succeeded, and local full FE packaging/Checkstyle also passed. I retained this catch and the lazy UncheckedIOException/eager IOException boundary. The repair head f69a307 again passes all 90 selected FE tests and full FE packaging/Checkstyle.

[P1] Keep deferred Arrow Flight Hudi split owners alive until coordinator finalization. FileQueryScanNode now dispatches batch scans through this Hudi-specific assignment factory, but Hudi registers BatchFsViewOwner as a StatementContext resource and its close() unconditionally calls splitAssignment.stop(). StatementContext closes resources at the end of GetFlightInfo, so a Hudi batch scan is stopped before the BE's later DoGet/fetchSplitBatch, even though FileQueryScanNode explicitly preserves deferred scans. Make this owner cleanup defer-aware while retaining cancellation/connection teardown, and add a Hudi deferred-batch regression.

Fixed in f69a307. Hudi now registers a statement-only cleanup wrapper that captures this query executor and checks its deferred flag when the statement closes. The actual BatchFsViewOwner remains an unconditional SplitAssignment resource, so coordinator finalization/query cancellation still cancels tasks and releases its lease after terminal accounting. Capturing the executor preserves the handoff even if processor cleanup clears it from ConnectContext. A regression using real HudiScanNode.startSplit, StatementContext, SplitAssignment and source registration reproduced premature stop before repair; it now retains the queued producer/source through deferred statement close, then verifies explicit scan stop cancels the producer, removes the source and releases the lease exactly once. Ordinary and absent-executor statement cleanup remain covered. All 90 selected FE tests and full FE packaging/Checkstyle pass locally; no live Flight/Hudi external regression is claimed.