mirror of
https://github.com/milvus-io/milvus.git
synced 2026-07-21 10:15:43 +00:00
66069bfc13
## Problem Milvus supports online collection-schema mutations — add/drop field, add/drop function, alter field, enable dynamic field — through several RootCoord DDL paths. Existing segments are written under the committed schema, so a mutation that reinterprets an existing field (its data type, nullability, or structural role) or relabels existing data as a function output makes already-written binlogs read incorrectly. Before this change there was no single authoritative check that a proposed schema is a **safe structural successor** of the committed one; validation was scattered and incomplete across DDL paths, so an unsafe mutation could reach the WAL and silently corrupt or misinterpret existing data. ## What this PR does Adds an authoritative, validation-only, fail-closed gate `ValidateSchemaEvolution(oldSchema, newSchema)`, invoked in every RootCoord schema-mutating callback **before** any side effect (analyzer reservation, bound-index allocation, WAL broadcast). It rejects: - in-place field reinterpretation — name, data type, element type, nullability, or structural role (primary / partition / clustering key, autoID, dynamic); - relabeling an existing field as a function output — function outputs must use brand-new fields, never existing data; - unsafe field additions — a newly added field may not arrive already marked primary / partition / clustering key, function output, or dynamic; - unsafe drops of protected fields; - more than one clustering key; - a dynamic field that is also a function output; - corruption of the reserved `max_field_id` watermark. Property-only / TTL updates, analyzer rollback, BM25 / MinHash `add_function_field`, and legacy function Drop / detach paths are preserved unchanged. ## Scope Non-function structural invariants only. Function-graph validation (single producer, output binding, alter-time immutability, cascade) is intentionally **out of scope here and owned by #51360**. This PR does not include schema propagation, Proxy barriers, DML draining, backfill / readiness, index promotion, TextEmbedding enablement, protobuf, configuration, or C++ changes. ## Validation - `go test -tags dynamic,test -gcflags='all=-N -l' ./internal/util/schemautil -count=1` — PASS (the gate's own unit tests) - `git diff --check origin/master...HEAD` — PASS issue: #51340 --------- Signed-off-by: xiaofanluan <xf@hjjaq.com> Co-authored-by: xiaofanluan <xf@hjjaq.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>