docs(releases): attribute the __run__ sweep (MR-770) to v0.6.2, not v0.6.1 (#161)

The v0.6.2 notes omitted the MR-770 `__run__` cleanup entirely, and the v0.6.1
notes wrongly claimed it shipped in v0.6.1. The code (the `migrate_v2_to_v3`
`__manifest` sweep + `is_internal_run_branch`/`run_registry.rs` removal) first
appears at the v0.6.2 tag via #132 and is absent at v0.6.1.

- v0.6.2: add the MR-770 highlight, correct the manifest-stamp note to describe
  the v2→v3 auto-migration on first read-write open (with the read-only caveat),
  and mention the cleanup in the intro.
- v0.6.1: replace the two over-claiming `__run__` lines with corrections that
  point to v0.6.2.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/releases/v0.6.1.md

@@ -7,7 +7,7 @@ v0.6.1 focuses on operational polish after v0.6.0: stored-query registries, safe
 - **Stored-query registries.** `omnigraph.yaml` can declare curated `queries:` blocks per graph. Servers load and type-check them at startup, `omnigraph queries validate` checks them offline, `omnigraph queries list` shows exposed queries and typed params, `GET /queries` exposes a typed catalog, and `POST /queries/{name}` invokes a stored query without accepting ad hoc `.gq` source from the client.
 - **Stored-query policy gate.** New Cedar action `invoke_query` gates the stored-query invocation surface. Stored mutations are double-gated: `invoke_query` to reach the stored query and `change` for the actual write.
 - **Safer branch deletion.** `branch_delete` now treats the manifest as the authority, flips branch visibility atomically, and reclaims per-table/commit-graph forks as derived state. If best-effort reclaim is interrupted, `cleanup` reconciles orphaned forks; reusing a branch name before cleanup reports an actionable error.
-- **Legacy `__run__` cleanup (MR-770).** Removed the last functional remnant of the Run state machine (retired in v0.4.0): the `__run__` branch-name guard. A new v2→v3 `__manifest` internal-schema migration sweeps any stale `__run__*` staging branches on the first read-write open, so `__run__*` is no longer a reserved branch name. This closes the "unpromoted `__run__` branches block reads" condition behind the zombie-run cascade incident; the inert `_graph_runs.lance` row cleanup is tracked separately (it needs a `delete_prefix` primitive).
+- **Legacy `__run__` cleanup (MR-770).** *(Correction: this item shipped in [v0.6.2](v0.6.2.md), not v0.6.1 — the v0.6.1 notes over-claimed it. At the v0.6.1 tag the `__run__` branch-name guard and `run_registry.rs` were still present and no v2→v3 sweep migration existed.)* The guard removal and the one-time v2→v3 `__manifest` migration that sweeps stale `__run__*` staging branches on first read-write open are described in the v0.6.2 release notes.
 - **Blob-safe optimize.** `omnigraph optimize` skips tables with `Blob` properties instead of failing the whole sweep on Lance's blob-v2 compaction decode bug. Skips are visible in human output, `--json` as `skipped`, `TableOptimizeStats.skipped`, and logs; non-blob tables still compact normally.
 - **Deployment improvements.** The container entrypoint now composes `OMNIGRAPH_TARGET_URI` with `OMNIGRAPH_CONFIG`, so operators can keep the graph URI in env while loading policy/query config from a mounted file. The local RustFS bootstrap pins RustFS beta.3 and allows the current insecure local-dev default credentials.
 - **Windows release support.** Tagged and edge releases now publish Windows x86_64 archives containing `omnigraph.exe` and `omnigraph-server.exe`, with a PowerShell installer and Windows install docs.
@@ -18,7 +18,7 @@ v0.6.1 focuses on operational polish after v0.6.0: stored-query registries, safe
 - A graph selected by name (`--target` or `server.graph`) now uses `graphs.<name>.policy` and `graphs.<name>.queries`. Top-level `policy` / `queries` blocks are only for anonymous bare-URI single-graph mode; using them with a named graph now fails loudly with migration guidance.
 - `mcp.expose` defaults to `true` for stored-query registry entries. Set `mcp: { expose: false }` for service-only queries that should not appear in the catalog.
 - `invoke_query` is graph-scoped, not branch-scoped. Branch/snapshot access remains enforced by the inner `read` / `change` gate.
-- **Legacy `__run__` migration.** Graphs created before v0.4.0 are migrated automatically on the first **read-write** open by a v0.6.1 binary (one-time `__manifest` stamp v2→v3 sweep of stale `__run__*` branches). No action required. Two caveats: (1) a graph opened **read-only** still lists any stale `__run__*` branch until its first read-write open, since the migration is write-path-only like all manifest migrations — long-lived read-only deployments should be opened read-write once after upgrading; (2) the inert `_graph_runs.lance` / `_graph_run_actors.lance` dataset bytes are left in place until a future `delete_prefix` primitive (they are invisible to graph-level state).
+- **Legacy `__run__` migration.** *(Correction: deferred to [v0.6.2](v0.6.2.md).)* The automatic v2→v3 `__manifest` stamp migration that sweeps stale `__run__*` branches on first read-write open ships in v0.6.2, not v0.6.1; a v0.6.1 binary does not perform it. See the v0.6.2 notes for the migration behavior and the read-only caveat.
 - Blob tables are not compacted until the upstream Lance fix lands, so fragment count and deleted-row space on blob tables are not reclaimed by `optimize`. Reads, writes, and query results are unaffected; no on-disk migration is required.
 - `TableOptimizeStats` is now `#[non_exhaustive]` and gains a `skipped: Option<SkipReason>` field (so does the new `SkipReason` enum). This is a source-level change only for downstream code that built this returned result struct by literal — rare, since it is produced by `optimize` and consumed by reading its fields; field access is unaffected, and `#[non_exhaustive]` keeps future additions non-breaking.
 

docs/releases/v0.6.2.md

@@ -2,8 +2,9 @@
 
 v0.6.2 is a maintenance-safety release on top of v0.6.1. It tightens the
 `optimize` / recovery boundary, adds an explicit repair path for uncovered
-manifest/head drift, accepts pretty-printed JSON load input, and updates the
-project governance and release automation around those fixes.
+manifest/head drift, completes the legacy `__run__` branch cleanup (MR-770),
+accepts pretty-printed JSON load input, and updates the project governance and
+release automation around those fixes.
 
 ## Highlights
 
@@ -25,6 +26,15 @@ project governance and release automation around those fixes.
 - **Recovery roll-back convergence.** Recovery roll-back now aligns the
   manifest-visible version after restoring a table, closing the residual where
   Lance HEAD and `__manifest` could stay out of sync after recovery.
+- **Legacy `__run__` branch cleanup (MR-770).** Completes the retirement of the
+  Run state machine (removed in v0.4.0). A one-time v2→v3 `__manifest`
+  internal-schema migration runs on the first read-write open and deletes any
+  stale `__run__*` staging branches left by pre-v0.4.0 graphs — they previously
+  leaked into `branch list` and counted as blocking branches at `schema apply`
+  time. The migration is idempotent, and the `is_internal_run_branch` guard
+  (and `run_registry.rs`) is retired now that `__run__*` is an ordinary branch
+  name. (The earlier v0.6.1 notes described this as shipped in v0.6.1; it
+  actually landed here in v0.6.2.)
 - **Pretty-printed JSON load input.** `load` accepts multi-line JSON objects in
   addition to one-object-per-line JSONL, so formatted fixture or export files no
   longer need to be minified before import.
@@ -40,8 +50,12 @@ project governance and release automation around those fixes.
   `--force --confirm`.
 - `optimize` remains non-destructive. It still skips blob-bearing tables while
   OmniGraph is pinned to the Lance version with the blob-v2 compaction issue.
-- No manual on-disk migration is required. Existing graphs open under v0.6.2;
-  the internal manifest schema stamp remains v3.
+- No manual on-disk migration is required. Existing graphs open under v0.6.2.
+  Graphs already at internal manifest schema stamp v3 are unchanged; graphs
+  created before v0.4.0 that still carry the v2 stamp auto-migrate v2→v3 on the
+  first **read-write** open (the `__run__*` sweep above). The migration is
+  write-path-only, so a long-lived **read-only** deployment still lists any
+  stale `__run__*` branch until it is next opened read-write.
 
 ## Docs, Governance, And CI