u70b3 commented on issue #66497: URL: https://github.com/apache/doris/issues/66497#issuecomment-5301826623
Thanks @Gabriel39. I updated the original [v5.1 design](https://github.com/apache/doris/issues/66497#issuecomment-5301314544) in place with only the two requested clarifications. No other design text changed. ```diff @@ Section 5.2 — Hard process isolation -The BE supervisor and queue are bounded. Pre-invocation busy rejection leaves the job `PENDING` for another admissible BE; durable `RUNNING` forbids any automatic redispatch. +The BE supervisor and queue are bounded. While a job is `PENDING`, BE selection and possible-live-slot reservation are strictly non-invoking: they do not send the execute request, launch a worker, initialize Lance/Rust, or enter FFI. FE durably records `RUNNING` before sending the single execute request. Once that request is sent, a complete trusted identity-matched busy or other pre-FFI rejection is terminal `NOT_COMMITTED` and is never automatically redispatched; a missing, partial, or untrusted result is `UNKNOWN`. + +Local/`file://` mutation has a separate disabled-by-default operator assertion, requires exactly one FE and BE, normalized absolute paths, pre/post version and identity checks, and rejection on topology change before dispatch. These checks do not prove a shared mount namespace. Object storage is the production mode. ``` The first change makes the `PENDING` boundary strictly non-invoking and makes every complete trusted post-send pre-FFI rejection terminal `NOT_COMMITTED`, with no automatic redispatch. The second restores the disabled-by-default single-node/test assertion, mandatory multi-node rejection, the unprovable shared-filesystem warning, and object storage as the production path. I will proceed with implementation against the updated v5.1 contract. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
