mirror of
https://github.com/ModernRelay/omnigraph.git
synced 2026-06-09 01:35:18 +02:00
c6827919ca
Three writers each follow the same shape established in Phase 5: build SidecarTablePin list before the per-table commit_staged loop, write the sidecar via recovery::write_sidecar, do the existing work, delete the sidecar after the manifest publish succeeds. Loose-match classifier (recovery.rs): The classifier now distinguishes strict vs. loose match per SidecarKind. Strict (Mutation, Load, BranchMerge): exactly one commit_staged per table; lance_head == manifest_pinned + 1 AND post_commit_pin == lance_head required. Loose (SchemaApply, EnsureIndices): the writer may run N >= 1 commit_staged calls per table — index builds + rewrites compound, and the exact N is hard to compute at sidecar-write time. Loose accepts any lance_head > manifest_pinned (with expected_version still matching the manifest pin) as RolledPastExpected. The risk it admits — an external agent advancing HEAD between sidecar write and recovery — is out of scope for the single-coordinator model (MR-668 territory). roll_forward_all now reads the CURRENT Lance HEAD per table (not the sidecar's post_commit_pin) so the manifest publish reflects whatever HEAD landed, even if the loose-match writer committed multiple times per table. Per-writer wiring: - schema_apply::apply_schema_with_lock: sidecar covers rewritten_tables ∪ indexed_tables (the tables that go through stage_overwrite/stage_create_index commit_staged). Skips added_tables (fresh datasets, no Phase B residual class) and renamed_tables (handled by the existing schema-state staging recovery in recover_schema_state_files). - branch_merge::branch_merge_on_current_target: sidecar covers every table in candidates (publish_adopted_source_state + publish_rewritten_merge_table do the per-table commit_staged work). Sidecar writes after validate_merge_candidates and deletes after commit_manifest_updates. - ensure_indices_for_branch: sidecar covers every node + edge type in the catalog with a manifest entry (build_indices_on_dataset is per-table-per-index commit_staged). Skips when the catalog has nothing — steady-state calls incur no sidecar I/O when the manifest already pins all expected types. Allow recovery_audit.rs in forbidden_apis.rs: The new db/recovery_audit.rs uses Dataset::write to bootstrap the _graph_commit_recoveries.lance dataset (same pattern as commit_graph.rs which is already allow-listed). Add it to the ALLOW_LIST_FILES list in tests/forbidden_apis.rs. 8 new unit tests in db::manifest::recovery cover the loose-match classifier branches (SchemaApply + EnsureIndices accept multi-commit drift, NoMovement and InvariantViolation behave the same as strict). All 20 test binaries pass (350+ tests across the workspace). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| omnigraph | ||
| omnigraph-cli | ||
| omnigraph-compiler | ||
| omnigraph-server | ||