fix: reject probe rows routed to a canceled hash join partition

datafusion/physical-plan/src/joins/hash_join/exec.rs

@@ -10542,8 +10542,8 @@ mod tests {
     /// Here the build-side logical NULL lives in exactly one build partition, so
     /// the `keys_have_null` flag has to survive the per-partition aggregation in
     /// `build_partitioned_filter` and widen the *routed* filter as a whole: the
-    /// probe NULL is routed to a single `CASE` branch, and OR-ing `IS NULL` into
-    /// that one branch would still drop it for every other route.
+    /// probe NULL is routed to a single partition, and OR-ing `IS NULL` into
+    /// that one partition's check would still drop it for every other route.
     #[tokio::test]
     async fn test_partitioned_null_equal_dynamic_filter_keeps_probe_nulls_for_build_logical_null()
     -> Result<()> {

datafusion/physical-plan/src/joins/hash_join/partitioned_hash_eval.rs

@@ -58,9 +58,8 @@ impl SeededRandomState {
 /// This expression computes the hash of join key columns using a specific RandomState.
 /// It returns a UInt64Array containing the hash values.
 ///
-/// This is used for:
-/// - Computing routing hashes (with RepartitionExec's 0,0,0,0 seeds)
-/// - Computing lookup hashes (with HashJoin's 'J','O','I','N' seeds)
+/// The hash join does not build this expression. It exists so that
+/// `datafusion-proto` can still decode serialized plans that contain it.
 pub struct HashExpr {
     /// Columns to hash
     on_columns: Vec<PhysicalExprRef>,
@@ -353,8 +352,9 @@ impl HashTableLookupExpr {
     /// * `pruning_bitmap` - key-range summary covering every partition's keys
     ///   for pruning only, or `None`
     ///
-    /// A single non-empty map is probed directly without routing, so it may be
-    /// any [`Map`] and `router` is ignored. Otherwise `router` is required.
+    /// When `maps` has exactly one entry, that map is probed directly without
+    /// routing and `router` is ignored. Otherwise `router` is required, even if
+    /// only one entry is non-empty.
     ///
     /// # Public Only for Internal Use:
     /// `datafusion-proto` tests require this constructor, but it is not part of