[JingsongLi]

Purpose

Paired PyPaimon integration: apache/paimon#10724.

Allow PyPaimon to assemble ordinary search source plans and use Ray for placement while Rust Core owns query execution and global coordination.

Changes

• Make VectorScanPlan and FullTextScanPlan snapshot-and-split data with public constructors, synchronous source access and validated serde restoration. Plans carry no live table, SDK handle, query configuration or fingerprint.
• Execute explicitly supplied sources without discovering additional indexes or uncovered raw ranges. Readers own the schema, query, options, filters, authorization and FileIO, and resolve data-file/deletion-vector metadata at the captured snapshot.
• Preserve global ANN candidate selection before refinement, one raw BM25 corpus and hybrid rank fusion. Keep task batching bounded and share repeated immutable inputs between workers.
• Keep shard task transport out of the default public Core API. Repository bindings use a hidden internal-api bridge and private scheduler callbacks.
• Expose typed SDK VectorScanPlan(splits, snapshot=None) and FullTextScanPlan(splits, snapshot=None) with snapshot() and splits() accessors. Accept concrete Index/Raw/PrimaryKey split objects and Snapshot objects, rather than JSON arguments or metadata dictionaries. Keep codecs private to the adapter and pickle. Hybrid snapshot configuration also accepts the Snapshot object.
• Use a single execute() SDK method for vector, batch-vector, full-text and hybrid builders. Remove the local/batch-local aliases; keep scheduling on the internal Plan/Read bridge.
• Support transported plans, reader-added filters, captured empty plans, primary-key source payloads and schema-only field renames. Capture full snapshots for decoded Java bucket splits without changing the C ABI.
• Derive indexed partition masks from pinned data-file row ranges. Keep full predicates on raw sources and intersect partition, scalar and caller masks before ANN Top-K.
• Validate primary-key full-text payload field/type before I/O, and reject search payloads supplied as scalar metadata so explicit source ranges cannot be expanded.
• Match the hybrid scheduler entry's test configuration to its full-text parity callers, preserving default-feature test builds without exposing shard APIs.

Validation

• Rust 1.98.0 Core vector tests: 79 passed; full-text tests: 42 passed; hybrid tests: 22 passed; source payload validation tests: 2 passed.
• Primary-key vector unit tests: 31 passed; Java bucket-split integration tests: 7 passed.
• All 117 Python binding unit tests passed, including typed constructors, module registration, pickle and codec preservation, wrong-family and wire-container rejection, hybrid snapshot configuration, unified execute results and configuration errors, concurrency, cancellation errors and generator cleanup.
• Core source-plan tests: 11 passed after the typed API change.
• C bridge reading the Java bucket-split fixture: 1 passed.
• Strict Clippy for default Core, full-text Core test targets and Python binding production/test targets passed with Rust 1.98.0 and -D warnings; formatting passed.

The Native extension is not rebuilt or installed into the PyPaimon test environment. There is no storage-format change or distributed primary-key search extension.

CI follow-up

• Update only rustls-webpki to 0.103.16 and webpki-root-certs to 1.0.10 to address RUSTSEC-2026-0382/0383; retain all other locked dependency edges and refresh the nine dependency reports.
• Replace stale plan-context rejection assertions with reader-owned filter results and actual source I/O errors. Test a valid vector column without indexes separately from an invalid column, matching current Java field validation.
• Dependency advisories/licenses and dependency report verification passed. Release-license validation generated and verified all 21 binary legal files without adding them to Git.
• The Core result/source-plan group passed all 14 tests. The original DataFusion no-index failure and new missing-column regression both passed; seven broader vector-search cases passed locally, while two Lumina cases require the Linux-only SDK available in CI.
• Final Rust 1.98.0 workspace Clippy passed with --locked --all-targets --workspace --features fulltext,vortex -- -D warnings; formatting and diff checks passed.

[leaves12138]

LGTM