Realign cross-version refusal assertions with the corrected release map - #386
Open
aaltshuler wants to merge 7 commits into
Open
Realign cross-version refusal assertions with the corrected release map#386aaltshuler wants to merge 7 commits into
aaltshuler wants to merge 7 commits into
Conversation
Lance 9.0.0 shipped stable on 2026-07-24 and every crate this workspace depends on is published at that version, so the 9.x prerelease git-rev pin (`v9.0.0-rc.1`, cec0b7df) is retired for ordinary registry version pins. `Cargo.lock` now carries zero git sources, which restores ordinary publishability — the release gate recorded in docs/dev/versioning.md. The delta is 35 commits with no file-format or minimum-reader-version movement: OmniGraph still writes explicit stable V2_2, and every MemWAL format-bearing file is byte-identical to the rc.1 rev. Dependency floors are unchanged (Arrow 58, DataFusion 54, object_store 0.13.2, roaring 0.11.4, Rust 1.91+). Includes the engine's `lance-io` test dependency, which carried the same rev pin.
Lance 9.0.0 fixed the documented limitation that a `Some(filter)` `scan_with_staged` silently dropped matching *staged* rows: stats-based pruning discarded uncommitted fragments because they lack the per-column statistics committed fragments carry, and `use_stats(false)` did not bypass it. The pin for that limitation carried an explicit instruction to rewrite it if Lance ever scanned uncommitted fragments without stats-based pruning. It did, so the assertion becomes the correct semantics and the test is renamed to describe them. Production was unaffected in both directions: no production caller passes a filter to `scan_with_staged`, and read-your-writes goes through `MutationStaging`'s in-memory union via DataFusion `MemTable`.
Gate R0's tripwire asserted the exact git rev in `Cargo.lock` so the source audit could not silently outlive the source it surveyed. The crates.io move retires that rev, so the tripwire now pins the released version across the whole Lance package family — with the two Arrow-versioned members (`lance-arrow-scalar`, `lance-arrow-stats`) carrying their own surveyed version — and additionally refuses any return to a git source. Purpose unchanged, and verified non-vacuous: faking a version move fails the assertion. The underlying RC.1 no-go facts survive the bump because the MemWAL flush ordering and system-index files did not change.
Adds the required audit stanza for the bump and demotes the rc.1 stanza to prior. Records: no storage-format event; the #7769 `ShardWriter::close` contract change (the pre-registered re-audit item, which needed no code change because close is never durability evidence here); the fixed filtered-staged-scan limitation; #7817's extra ranged read with the cost gates re-run green; #7699's BM25 corpus-statistics change; and that neither RFC-026 upstream ask landed, so adapter-side containment stays load-bearing. Also records the three known gaps taken by choosing 9.0.0 over the v10 beta line — #7704 (stable-row-id filter_deleted_ids), #7868 (flat-KNN ordering, upstream-Critical), and #7965 (blob compaction misclassifying an empty blob as NULL, reachable through `omnigraph optimize`) — and notes that OmniGraph's own blob decoder replicates the same empty-vs-null misclassification independently, to be fixed on its own merits. Rewords the matching close-contract sentences in testing.md and RFC-026, and updates the substrate line in AGENTS.md.
Moves every published crate manifest, path-dependency constraint,
Cargo.lock, the generated openapi.json `info.version`, and AGENTS.md's
surveyed version from 0.8.1 to 0.9.0.
Corrects the schema-to-release map in the same change, because the bump
makes it wrong. `release_for_internal_schema_version` claimed v5 -> 0.9.x,
v6 -> 0.10.x, v7 -> 0.11.x, v8 -> 0.12.x, v9 -> 0.13.x, but v0.8.1 was
the last published release and it stamped v4 (verified with
`git show v0.8.1:.../migrations.rs`). The format then advanced five times
— RFC-028 identity, RFC-023 key fencing, and the three RFC-026 stream
slices — entirely inside the 0.8.1 -> 0.9.0 development window, so no
release ever stamped v5 through v8 and none ever will.
Left uncorrected, a v9 graph's refusal would have told operators to fetch
an omnigraph 0.13.x binary that will never exist, and a v5 graph's
refusal would have named 0.9.x — the line this release actually occupies.
v5-v8 now report `0.9.0-dev`, which reads correctly in both slots of the
rebuild instruction ("created by omnigraph X" and "with an omnigraph X
binary"); a new assertion pins that grammar. v9 reports 0.9.x.
docs/user/operations/upgrade.md carries the same correction and explains
that those stamps only ever came from source builds.
AGENTS.md's maintenance contract requires a docs/releases/<version>.md alongside any release-version bump; the 0.8.1 -> 0.9.0 move landed without one. Covers the user-visible delta across the whole window, not just the substrate bump: the Lance 9.0.0 stable move and restored registry publication, the internal schema v4 -> v9 rebuild requirement (including why stamps v5-v8 name no published release), stable schema identity across renames, keyed-write conflict fencing, writer crash recovery, `branch merge --delete-branch`, release container images, and batched committed @unique probes. Behavior changes are called out separately because several are script-breaking: newest-first commit listings, strict `load --mode append` on an existing id, per-verb rejection of scope flags that were previously discarded, registry-scoped `graphs list`, and `GET /commits` authorizing an omitted branch as main. Excludes the blob read surface added and then reverted in this window (#367 / #373) — it is not in the release.
…ease map The 0.9.0 release bump corrected `release_for_internal_schema_version`: stamps v5-v8 never shipped in any published binary, so they now report `0.9.0-dev` instead of naming 0.9.x/0.10.x/0.11.x/0.12.x lines that will never exist. `migrations.rs`, `upgrade.md`, and the manifest unit tests were updated with that change; this CLI suite was not. All four genuine-binary cells asserted the old strings. Only the v8 cell turned red on the post-merge `main` run because CI builds `OMNIGRAPH_V8_BIN` for the immediate-predecessor fence while the v5/v6/v7 seams stay gated on unset paths and skip. The other three are equally stale and would fire the moment someone supplies those binaries. The expected value is taken from the observed refusal in the failing run: "This graph was created by omnigraph 0.9.0-dev. Rebuild it: with an omnigraph 0.9.0-dev binary run `omnigraph export ...`". Note the v5 cell was the sharpest of the four: it asserted `0.9.x`, which is what a *v9* graph now reports, so a regression conflating the two would have passed. `0.9.0-dev` is the exact discriminating string.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
mainis red. The post-merge run for #385 failedTest Workspaceoncurrent_v9_refuses_and_rebuilds_genuine_v8_and_v8_refuses_v9.Not a regression in product behavior — a stale test. #385 deliberately corrected
release_for_internal_schema_versionbecause internal schema stamps v5–v8 nevershipped in any published binary: the format advanced five times inside the single
0.8.1 → 0.9.0 window. They now report
0.9.0-devrather than naming 0.9.x/0.10.x/0.11.x/0.12.x lines that will never exist. That change updated
migrations.rs,upgrade.md, and the manifest unit tests, but missed this CLI suite.Scope: four stale assertions, not one
0.8.x0.8.x— correct, unchanged0.9.x0.9.0-dev0.10.x0.9.0-dev0.11.x0.9.0-dev0.12.x0.9.0-devOnly v8 turned red because CI builds
OMNIGRAPH_V8_BINfor theimmediate-predecessor fence; the v5/v6/v7 seams stay gated on unset absolute
paths and skip. The other three are equally stale and would fire the moment
someone supplies those binaries.
The v5 cell was the sharpest: it asserted
0.9.x, which is exactly what a v9graph now reports — so a future regression conflating v5 with v9 would have
passed silently.
0.9.0-devis the exact discriminating string.Evidence
The expected value is taken from the actual refusal in the failing run, not
guessed:
Locally all six cells pass, but they take the graceful-skip path (no old binaries
present), so that only proves compilation. I am dispatching
Test Workspaceonthis branch so the v8 cell runs non-vacuously before merge, rather than
discovering it post-merge a second time.
Note for reviewers
This is the second-order cost of
Test Workspacebeing post-merge-only: #385passed every PR check and still broke
main. Worth considering whether thecross-version fence — which is cheap once the old binary is cached — belongs in
the PR gate.
Greptile Summary
Realigns the v5–v8 cross-version refusal assertions with the corrected
0.9.0-devrelease mapping.Confidence Score: 5/5
The PR appears safe to merge with the corrected cross-version assertions and coordinated release updates.
The changed assertions agree with the updated release mapping, the workspace version and Lance source changes are coordinated across manifests and the lockfile, and no changed-code-triggered failure remains.
Important Files Changed
0.9.0-devlabel.0.9.0-dev, maps v9 to0.9.x, and updates focused unit coverage.Reviews (1): Last reviewed commit: "test: realign cross-version refusal asse..." | Re-trigger Greptile