SimpleText points: PointTree.clone() shares a saved split-value array with the tree it was cloned from, so moving one tree corrupts the node bounds the other reports

PointValues.PointTree#clone promises that "the current node becomes the root of the new tree". In the SimpleText points format, SimpleTextPointTree.clone() copies the reference to the original's per-level array that remembers the split dimension's old bound (SimpleTextBKDReader.java:131) instead of copying the array. Both trees then save into, and restore from, the same array at the clone's root level, so a move of one tree changes the bounds the other restores.

With 1,024 IntPoint values 0..1023, seven calls leave the clone at its root reporting [0, 0] instead of [0, 1023]; the default codec gives [0, 1023] for the same calls. It needs the debug-only SimpleText codec and code that drives the experimental PointTree API by hand; no Lucene query moves trees this way. It is in every release since the API appeared in 9.1.0, and the fix is one line in clone(): copy the array instead of its reference, or do not copy it at all, which is what the default format's clone does with its own saved-bound array.

public PointTree clone() {                                              // :124-134
  SimpleTextPointTree index =
      new SimpleTextPointTree(in.clone(), nodeID, level, minPackedValue, maxPackedValue);
  if (isLeafNode() == false) {
    // copy node data
    index.splitDims[level] = splitDims[level];
    index.splitDimValueStack[level] = splitDimValueStack[level];        // :131, the reference
  }
  return index;
}

• splitDimValueStack "holds the previous value of the split dimension", one byte[] per level (:92-93, allocated per tree at :110). A tree from getPointTree() starts at node 1, level 1 (:78-81).
• pushLeft() (:145-181, used by moveToChild()) allocates the level's array only if it is null (:154-156), saves the current max of the split dimension into it (:158-159), then narrows max to the split value.
• pushRight() (:193-227, the second half of moveToSibling()) saves the current min into the same array (:204-205), then narrows min.
• pop() (:238-258, used by moveToParent() and the first half of moveToSibling()) copies the array back into max (coming up from a left child) or min (from a right child).
• visitDocIDs() / visitDocValues() on an inner node run pushLeft, pop, pushRight, pop on the tree itself (:359-365, :391-397), so they fill and overwrite the array too.

• The array is shared only if the original had already allocated it at that level before clone(): after a moveToChild() + moveToParent(), or a visit of an inner node. Otherwise the clone allocates its own on its first push.
• Then one tree must push at that level between the other tree's push and pop there.
• It works both ways. An independent verifier's 6-call trigger has no moveToParent(): visitDocIDs at the root, clone(), tree.moveToChild(), clone.moveToChild(), clone.moveToSibling(), tree.moveToSibling(); on values 0..9999 the original's right child reports [5000, 0] (max < min) instead of [5000, 9999].
• The shortest known trigger has 5 calls (the devil's-advocate verifier's visit variant): tree.visitDocIDs(v) at the root, clone(), clone.moveToChild(), tree.visitDocIDs(v), clone.moveToParent(); the clone's root then reports [0, 0] for values 0..1023. The seven moves-only calls are used here because they need no visitor.

BKDReader's clone (BKDReader.java:341-376) builds the clone through the constructor that allocates a fresh splitDimValueStack for every tree (:317) and never copies that array, so the clone fills its own slot on its first push (:407-412). The byte array it does deep-copy, splitValuesStack[level].clone() (:366), is a different one: the per-level split values, which SimpleText reads from splitPackedValues instead. Its clone shares no per-level array with the original.

• Who. Direct users of PointValues.PointTree (@lucene.experimental, PointValues.java:235-240) on a SimpleText index that clone a tree and keep moving both trees: a custom BKD walker, or a test that navigates trees by hand.
• Opt-in, debug-only codec. SimpleTextPointsFormat: "For debugging, curiosity, transparency only!! Do not use this codec in production." (SimpleTextPointsFormat.java:27); SimpleTextCodec: "FOR RECREATIONAL USE ONLY" (SimpleTextCodec.java:35). The default codec gives the right bounds for the same calls.
• Randomized tests. The test framework's random codec picks SimpleTextCodec when random.nextInt(11) == 9 and rarely() (SetupAndRestoreStaticEnv.java:144, :185-190). A suite that drives PointTree clones by hand can therefore fail rarely, and only under that codec, which looks like flakiness.
• No in-tree query reaches it. NearestNeighbor clones right after descending, at a level the source tree has not pushed at, so nothing is shared (NearestNeighbor.java:298-299). IndexSortSortedNumericDocValuesRangeQuery.lastDoc moves the original only sideways or up after its clone at :366, and its clone at :404 comes right after a descent, as in NearestNeighbor. A brute-force check of both on SimpleText ran 10,800 checks with 0 wrong results.
• Scale. Any segment with more than one leaf, that is more than 512 points per field (SimpleTextPointsWriter.java:83, BKDConfig.DEFAULT_MAX_POINTS_IN_LEAF_NODE).
• Effect. Wrong node bounds ([0, 0] for values 0..1023; also max < min). A traversal that prunes on them could skip or keep the wrong cells. No exception, no hang, no index damage; the same with assertions on and off.

• Smallest input. Two leaves are enough (1,024 points); the first moveToChild() + moveToParent() is needed because the per-level array is allocated lazily, and without it the clone would allocate its own.
• Deterministic. ByteBuffersDirectory, fixed data, one thread, nothing randomized; the same result with assertions on and off.
• Releases. The same file fails unchanged on 10.6.0 and 9.1.0; 9.0.0 has no PointTree.
• As the regression test: this same test, for example as a method of TestSimpleTextPointsFormat. It passes with either fix.

cp $REPRO/TestSimpleTextPointTreeCloneIndependence.java $LUCENE/lucene/codecs/src/test/org/apache/lucene/codecs/simpletext/
cd $LUCENE
./gradlew :lucene:codecs:test --tests org.apache.lucene.codecs.simpletext.TestSimpleTextPointTreeCloneIndependence -Ptests.seed=DEADBEEF
# assertions off: add -Ptests.asserts=false (same result)

# gradle, main 645d4fe14a20, seed DEADBEEF, assertions on
TestSimpleTextPointTreeCloneIndependence > testMovingOriginalDoesNotChangeClone FAILED
    java.lang.AssertionError: expected:<1023> but was:<0>
        at __randomizedtesting.SeedInfo.seed([DEADBEEF:579C430CFEBB0A1C]:0)
        at org.junit.Assert.fail(Assert.java:89)
        at org.junit.Assert.failNotEquals(Assert.java:835)
        at org.junit.Assert.assertEquals(Assert.java:647)
        at org.junit.Assert.assertEquals(Assert.java:633)
        at org.apache.lucene.codecs.simpletext.TestSimpleTextPointTreeCloneIndependence.testMovingOriginalDoesNotChangeClone(TestSimpleTextPointTreeCloneIndependence.java:50)

# main 645d4fe14a20, assertions on and off (standalone): the same AssertionError
# releases 10.6.0 (assertions on and off) and 9.1.0: the same AssertionError
# release 9.0.0: does not compile (no PointValues.PointTree)
# the same calls with the default codec: pass (the clone reports [0, 1023])
# with either fix: BUILD SUCCESSFUL (the test and TestSimpleTextPointsFormat)

• Contract. PointValues.java:242: "Clone, the current node becomes the root of the new tree." :263-267: the min and max "of the current node".
• Random navigation is allowed. LUCENE-10262 (a590c6d2a08, #476, 9.1.0; "This change allows random navigation of a PointValues#PointTree") removed "The method should not be called after a successful call to moveToParent()" from clone() and moveToChild(). It updated BKDReader, not the SimpleText fork. In the review of the introducing PR (#7), a committer had called the old rule "quite trappy".
• In-tree reliance. NearestNeighbor.java:298: "we must clone the index so that we can recurse left and right "concurrently"".
• The copy gains nothing. The clone always writes the slot in its own pushLeft before any pop at that level reads it. BKDReader's clone does not copy its own splitDimValueStack at all (BKDReader.java:341-376), neither at the introducing commit nor on main.
• Precedent. LUCENE-10264 (#11300, fixed by #478, 9.1.0): trees from SimpleTextBKDReader.getPointTree() shared one IndexInput; fixed as a bug. That fix edited clone() but left line 131.
• Why tests miss it. BasePointsFormatTestCase.assertSize (:1086-1126) clones and "rarely" continues with the clone, but never interleaves moves of a clone and its original; randomPointTreeNavigation (:1128-1143) uses one tree.

Strongest case for "not a bug": SimpleText is a debug codec, PointTree is @lucene.experimental, and clone() never says "deep copy", so sharing is acceptable.

Why it fails: those notes limit impact, not correctness. @lucene.experimental means the API may change incompatibly, not that its current contract is void. The codec implements the public PointTree API and the test framework runs suites on it at random. The javadoc promises a new tree, LUCENE-10262 allows random navigation, and the sibling implementation does not share. Of the cross-model reviews (OpenAI GPT-5.6), the works-as-designed review rated the intended-behaviour case weak, and the read-only refute-lens review rated it moderate ("This limits support and priority, but does not document corrupted bounds as intended"), while agreeing on the root cause and that the inputs are in contract.

What it does establish: low priority.

Two one-line options. Both were applied in a scratch worktree of main 645d4fe14a20 and run with gradle against the minimal test and TestSimpleTextPointsFormat.

In SimpleTextPointTree.clone() (SimpleTextBKDReader.java:131), copy the array instead of its reference.

if (isLeafNode() == false) {
  // copy node data
  index.splitDims[level] = splitDims[level];
  index.splitDimValueStack[level] =
      splitDimValueStack[level] == null ? null : splitDimValueStack[level].clone();
}

Trade-offs

• Correct without any invariant: the clone starts from the same saved bound, in its own array, so it is easy to review. It follows the pattern BKDReader.clone uses for a different per-level array (splitValuesStack[level].clone(), BKDReader.java:366); for its own splitDimValueStack, BKDReader copies nothing, which is fix B.
• Cost: one small array (bytes per dimension) per clone, only on this debug codec.

What the checks validated

• Gradle, scratch worktree of 645d4fe14a20, seed DEADBEEF: the minimal test fails before the change and passes after it; TestSimpleTextPointsFormat: 21 tests, 0 failures (3 skipped by the suite: testCheckIntegrityReadsAllBytes, testMergeStability, testRandomBinaryBig).
• Standalone, with the change shadowed in, the minimal test passes with assertions on and off.
• Earlier, on main a9779ef3c193: the finder's test (1 of 1), an independent verifier's 6 tests and the cross-model reviewer's 6 tests pass with the same change.
• Not run: the whole :lucene:codecs:test or check.

Delete index.splitDimValueStack[level] = splitDimValueStack[level];. The clone can only pop at its root level after its own pushLeft() there, which allocates and fills the slot (:154-159); moveToParent() and moveToSibling() at the clone's root return false (:185, :231). Suggested by the devil's-advocate verifier.

if (isLeafNode() == false) {
  // copy node data
  index.splitDims[level] = splitDims[level];
}

Trade-offs

This is what BKDReader does for the same field: its clone never copies splitDimValueStack (BKDReader.java:341-376); each tree allocates its own (:317) and fills a slot on its first push (:407-412). One line shorter and no allocation, but its correctness rests on that push-before-pop invariant.

What the checks validated

• Gradle, the same scratch worktree and seed: the minimal test passes; TestSimpleTextPointsFormat: 21 tests, 0 failures (3 skipped).

• The hunt unit checked the coherence of PointTree cursors across points formats on the stock main build.
• The harness built a table of each node's true bounds from fresh trees, validated against the indexed points, then ran every sequence of length up to 3 over child, sibling, parent, clone, visitDocIDs and visitDocValues on up to 3 live trees, plus 1,500 random sequences of length 14, and checked every live tree after every step.
• The saved log of that tier, which runs SimpleText trees only, holds 281 bound errors. The shortest known trigger has 5 calls (a visit, clone, child, visit, parent), longer than the exhaustive length-3 bound, so the signal came from the long random sequences, after a reading of clone() had predicted it.
• A second harness checked the two in-tree clone users (NearestNeighbor, IndexSortSortedNumericDocValuesRangeQuery.lastDoc) on SimpleText: 10,800 checks, 0 wrong results.
• The finder turned the finding into a public-API JUnit test; independent verifiers reproduced it with their own tests.