Move Lance to crates.io 9.0.0 and bump the workspace to 0.9.0

[aaltshuler]

What & why

Lance 9.0.0 shipped stable on 2026-07-24 and every crate this workspace depends on is published at that version, so the 9.x prerelease git-rev pin (v9.0.0-rc.1, cec0b7df) is retired for ordinary registry version pins. Cargo.lock now carries zero git sources, which restores ordinary publishability — the release gate recorded in docs/dev/versioning.md and promised in the v0.8.1 notes ("registry publication resumes at v0.9.0").

The workspace version moves 0.8.1 → 0.9.0 in the same series.

Backing issue / RFC

• Trivial fast-lane — dependency bump plus the release-version bump. No behavior change: the two code edits are a test whose documented limitation upstream fixed, and a correction to a user-facing message table that the version bump would otherwise have made wrong.

Checklist

• Change is focused (one logical change: adopt the released substrate, then bump the release version)
• Tests added/updated for behavior changes
• Public docs updated if user-facing surface changed (upgrade.md, lance.md, testing.md, RFC-026, AGENTS.md)
• Reviewed against docs/dev/invariants.md — no Hard Invariant weakened, no deny-list item hit

The Lance move (4385eda4)

35 commits from the rc.1 rev, and not a storage-format event: no file-format or minimum-reader-version movement, OmniGraph still writes explicit stable V2_2, and every MemWAL format-bearing file (wal.rs, batch_store.rs, system_index/mem_wal.rs, protos/table.proto, mem_wal/util.rs) is byte-identical to the pinned rev. Dependency floors unchanged (Arrow 58, DataFusion 54, object_store 0.13.2, roaring 0.11.4, Rust 1.91+).

Behavior-affecting findings, all recorded in the new lance.md audit stanza:

• ShardWriter::close now propagates final flush failures (upstream #7769) — the re-audit item pre-registered at the rc.1 stanza. No code change needed: OmniGraph never treats close as durability evidence, and the enrollment adapter already maps its empty-shard close error. The three contract sentences (lance.md, testing.md, RFC-026) are reworded.
• Filtered scans over staged fragments are fixed (742da064). Through rc.1 a Some(filter) scan_with_staged silently dropped matching staged rows because stats-based pruning discarded uncommitted fragments. That limitation had a pin carrying an explicit "rewrite me if Lance fixes this" instruction; it fired, so the assertion is now the correct semantics and the test is renamed. Production was never affected either way — no production caller passes a filter, and read-your-writes goes through MutationStaging's in-memory union.
• read_transaction_by_version no longer populates session caches (#7817), adding one ranged read on the RFC-023 certificate-chain path. Cost gates re-run and unchanged.
• Neither RFC-026 upstream ask landed. InitializeMemWalBuilder::execute is still -> Result<()> with no enrollment receipt/seal, and WalAppender::append still has no post-success epoch recheck. Both negative MemWAL guards stay green and adapter-side containment remains load-bearing.
• Gate R0's revision tripwire was rewritten, not retired (f638a7ce) — it now pins the released version across the Lance package family (the two Arrow-versioned members carry their own surveyed version) and refuses any return to a git source. Verified non-vacuous: faking a version move fails it.

The version bump (0a02eae8)

Beyond the mechanical surfaces, this corrects the schema-to-release map, which the bump would otherwise have made wrong.

release_for_internal_schema_version claimed v5→0.9.x, v6→0.10.x, v7→0.11.x, v8→0.12.x, v9→0.13.x. But v0.8.1 is the last published release and it stamped v4 (verified via git show v0.8.1:crates/omnigraph/src/db/manifest/migrations.rs). The format then advanced five times — RFC-028 identity, RFC-023 key fencing, and the three RFC-026 stream slices — entirely inside the 0.8.1 → 0.9.0 development window, so no release ever stamped v5–v8 and none ever will.

Left uncorrected, two user-visible refusals would have lied: a v9 graph would tell operators to fetch an omnigraph 0.13.x binary that will never exist, and a v5 graph would name 0.9.x — the line this release now occupies. v5–v8 now report 0.9.0-dev; v9 reports 0.9.x.

Notes for reviewers

• Known gaps taken by choosing 9.0.0 over the v10 beta line, recorded in lance.md: #7704 (stable-row-id filter_deleted_ids — we set enable_stable_row_ids: true everywhere), #7868 (flat-KNN ordering, upstream-Critical), and #7965 (blob compaction misclassifying a valid empty blob as NULL, reachable through omnigraph optimize). All three exist only on v10, which is 96 commits ahead and 36 behind 9.0.0 after a 9.1→10.0 renumber, ships two breaking changes, and renames the MemWAL vocabulary our recovery sidecars bind to.
• Separately tracked, not in this PR: OmniGraph's own blob descriptor decoder replicates the same empty-vs-null misclassification as #7965, independently of Lance. It is live on main and should be fixed on its own merits.
• docs/releases/v0.9.0.md is not in this PR. Per AGENTS.md rule 2 a release boundary needs it, but the 0.8.1 → 0.9.0 delta is large and public-facing (five format bumps, the RFC-022/023/028 program, Lance 9 stable, resumed crates.io publication) and wants deliberate framing rather than a mechanical changelog.
• Three assertions across two existing tests caught the release-map correction immediately; a new assertion pins something the old map hid — the release string must read correctly in both slots of the rebuild instruction (created by omnigraph X and with an omnigraph X binary).

Validation

• cargo test --workspace --locked — 75 suites, 0 failures
• cargo test -p omnigraph-engine --test lance_surface_guards — 26 passed
• cargo test -p omnigraph-engine --features failpoints --test failpoints — 141 passed, 1 ignored
• cargo test -p omnigraph-engine --features failpoints --test memwal_stream — 35 passed
• cargo test -p omnigraph-server --features aws
• cost gates: write_cost, warm_read_cost, merge_cost
• OMNIGRAPH_UPDATE_OPENAPI=1 cargo test -p omnigraph-server --test openapi — regenerated, 84 passed
• scripts/check-agents-md.sh, rustfmt --check on touched files, git diff --check

Bucket-gated RustFS/S3 cells were not run locally and remain CI's responsibility.

Greptile Summary

The PR completes the OmniGraph 0.9.0 release transition.

• Moves the Lance package family from the 9.0.0-rc.1 Git revision to crates.io 9.0.0.
• Bumps all workspace crates and local dependency constraints from 0.8.1 to 0.9.0.
• Corrects internal-schema release labels and updates the staged-filter regression test for Lance 9.0.0 behavior.
• Adds the required v0.9.0 release notes, including the rebuild requirement and Lance transition.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously missing 0.9.0 release notes are now present and cover the required storage rebuild and Lance transition.

Important Files Changed

Filename	Overview
docs/releases/v0.9.0.md	Adds the canonical 0.9.0 release record requested by the prior review, including upgrade requirements, Lance 9.0.0 adoption, behavior changes, and compatibility notes.
AGENTS.md	Updates the surveyed workspace and Lance versions consistently with the release.
Cargo.toml	Replaces Lance Git-revision dependencies with published 9.0.0 registry versions.
crates/omnigraph/src/db/manifest/migrations.rs	Corrects user-facing release labels for unpublished schema stamps v5–v8 and the released v9 format.
crates/omnigraph/src/table_store/staged_tests.rs	Updates the staged filtered-scan regression test to assert the corrected Lance 9.0.0 behavior.

_{Reviews (3): Last reviewed commit: "docs: add the v0.9.0 release notes" | Re-trigger Greptile}