apunkt/omnigraph
1
0
Fork 0
mirror of https://github.com/ModernRelay/omnigraph.git synced 2026-07-12 03:12:11 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Harden RFC-022 pre-arm recovery ownership (#346)

Browse source
This commit is contained in:
Andrew Altshuler 2026-07-11 23:52:53 +03:00 • committed by GitHub
parent e0e145aa92
commit 905a27c4bd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
17 changed files with 2166 additions and 538 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/dev/invariants.md
View file

@ -84,6 +84,11 @@ converge the physical state.
5. **Recovery is part of the commit protocol.** Writers that can advance Lance
HEAD before manifest publish must write `__recovery/{ulid}.json` sidecars.
Under their final schema → branch → table gates, they must first prove every
existing physical target still equals its manifest pin; a new sidecar must
never claim an older writer's effect or uncovered drift. First-touch refs use
sidecar-before-ref ordering. A non-noop SchemaApply writes a sidecar even
with zero table pins because schema-contract staging is durable state.
`Omnigraph::open` in read-write mode runs the all-or-nothing sweep; the
write entry points (`load_as`, `mutate_as`, `apply_schema_as`,
`branch_merge_as`) and `refresh` run roll-forward-only recovery in-process,