omnigraph/docs/releases/v0.4.2.md

Omnigraph v0.4.2

Omnigraph v0.4.2 is a correctness and operability release for concurrent writes. It closes snapshot-isolation lost-update windows, expands recovery sidecar coverage for inline deletes, and removes an unwired admission-control surface before it becomes public API.

Highlights

• Read-time drift checks for strict mutations: staged mutations now compare the manifest pin captured when the query opened against the manifest snapshot captured under table-queue ownership. If a concurrent writer moved the table after the query read, the stale writer returns a manifest-conflict 409 instead of staging work computed against an old snapshot.
• Inline-delete recovery coverage: delete-only mutations still use Lance's inline delete path, but their recovery sidecar is now written before the manifest-version rejection path can return. If a delete moves Lance HEAD and a concurrent manifest update makes the query stale, the next read-write open can roll the residual back rather than leaving a head-ahead-of-manifest table.
• Branch-merge target revalidation: merges re-check target table versions after acquiring target write queues. A stale merge plan returns a structured conflict instead of overwriting concurrent target-branch changes or adopting a source table over newly appended target rows.
• Lean admission API: removed the unused global rewrite admission pool, service_unavailable error variant, related 503 documentation, and benchmark flag. The server keeps the wired per-actor inflight and byte-budget admission gates.
• Regression coverage: failpoint and server matrix tests now cover the inline-delete sidecar race, merge × change target movement, and post-reopen branch-op state.

Behavior changes

• Some concurrent mutation and merge races now return manifest_conflict instead of relying on later publisher-CAS detection or allowing a stale plan to proceed.
• Concurrent branch merge × change on the same target branch may return either success or a clean 409 conflict, depending on which operation wins the queue.
• OMNIGRAPH_GLOBAL_REWRITE_MAX is no longer recognized. Remove it from deployment manifests; use the remaining per-actor inflight and byte-budget admission settings for the currently wired server controls.

Upgrade Notes

• No repository migration is required. Existing v0.4.1 repos can be opened directly with v0.4.2.
• Clients should treat manifest_conflict 409 responses as retryable stale-view conflicts. This was already the documented contract, but this release uses it in more concurrent-write paths.
• Operators should remove stale references to global rewrite admission and 503 rewrite-pool exhaustion from local runbooks.

Included Changes

• Per-table writer queues and read-time version checks for strict mutation publishes.
• Branch-merge target snapshot revalidation under queue ownership.
• Inline-delete manifest-conflict recovery-sidecar regression test and fix.
• Matrix coverage updates for merge × change concurrency and reopen consistency.
• Removal of the unwired global rewrite admission / 503 server surface.