Sparse typed-JSON segments fail boolean queries with required-component DataLoss

[zcourts]

Summary

Keldra 0.14.0 returns DataLoss / Unrecoverable data loss or corruption when a typed JSON boolean query references optional indexed fields that are absent from every document in one format-v4 segment.

This reproduces on a newly created Docker volume, so it is not an upgrade or stale-index problem.

Version

• Release/tag: 0.14.0, commit 4352bbd2
• Image: ghcr.io/keldra-store/keldra:0.14.0
• Single-node, local durability, fresh volume

Index shape

Create a typed JSON index over a broad REST-style prefix with:

• exact keyword object_kind
• exact keyword status
• exact signed integer engine_task_id
• range signed integer next_eval_at_unix_ms
• range signed integer lease_expires_at_unix_ms

Documents under the prefix legitimately have different kinds. Some documents contain object_kind but omit the optional scheduling fields entirely.

Query shape

The failing predicate is equivalent to:

all(
  equal(object_kind, "task"),
  in(status, ["ready", "deferred", "waiting", "running"]),
  any(
    not(exists(next_eval_at_unix_ms)),
    less_than_or_equal(next_eval_at_unix_ms, now)
  ),
  any(
    not(exists(lease_expires_at_unix_ms)),
    less_than_or_equal(lease_expires_at_unix_ms, now)
  )
)

Once the index contains a segment built from JSON documents that do not have one of those optional range fields, QueryIndex repeatedly fails with:

code: Unrecoverable data loss or corruption
message: invalid index format: format-v4 segment lacks a required component stream

The error originates from the missing-component assumptions in crates/keldra-index/src/v4/executor/posting.rs / segment_reader.rs.

Expected behavior

A missing optional field component in an otherwise valid sparse segment is not corruption:

• exists(field) should evaluate false for documents/segments without that field.
• not(exists(field)) should therefore include those documents, subject to the rest of the predicate.
• comparisons against an absent field should produce no matches for that branch.
• the query should return an ordinary empty or populated result, not DataLoss.

Operational impact

A scheduler using the new 0.14 boolean predicates cannot query eligible records when its index covers heterogeneous JSON documents with optional due/lease fields. The failure occurs continuously on a fresh deployment and prevents work acquisition.

[zcourts]

Follow-up qualification against image revision dc4c86c89d18ffe0bfee4aff81e0ccb4676f3915 found a remaining sparse optional point-field case.

A typed-JSON index contains two optional SignedIntegerField::single(...).range() fields. A stored document has both JSON fields set to null. For the same document set:

• required keyword predicates: 8 hits
• required predicates plus NOT EXISTS(optional_a) OR optional_a <= now: 4 hits (expected)
• required predicates plus NOT EXISTS(optional_b) OR optional_b <= now: 0 hits (unexpected)
• both optional expressions: 0 hits (unexpected)

The two optional fields have the same schema capabilities and null/missing shape. This suggests the fix handles the first sparse point component encountered but an equivalent later optional point field can still be planned against an absent component/incorrect empty set. There is no RPC error now; the result set is silently empty.

The application-level reproduction used the public 0.14.0 boolean-query builder and the exact NOT EXISTS OR <= expression covered by the issue's new test. A regression with at least two optional point fields in the same schema should expose it.