graph/cycle_sink: the concrete Lance-backed WalSink — storage-proven cognitive-cycle sink (§I.6)

[AdaWorldAPI]

What

Closes the gap persist_sink deliberately left ("this module builds NO concrete Lance sink — compile+test green ≠ storage proven"): lance_graph::graph::cycle_sink::LanceCycleSink is a concrete implementation of lance_graph_planner::persist_sink::WalSink over the official Lance 9 insert path (Dataset::write / Dataset::append — the same InsertBuilder transaction machinery every Lance writer uses). No bespoke ledger, no acknowledgement protocol, no parallel replay system: Lance's own manifest/version chain IS the WAL.

The §I.6 invariant made physical

64k thoughts read sealed Vn → write-side temporal deinterlace →
one detached cycle batch → ONE official Lance commit →
exactly one real DatasetVersion Vn+1 → no open or partial visibility

• One durable append per cycle, all-or-nothing.
• The epistemic fence, both halves. Pre-commit: the store's current version must equal the cycle's sealed predecessor base (empty store ⇒ head DatasetVersion(0)), else refused with nothing written. Post-commit: the published version must be exactly base + 1 — Lance auto-resolves append-append conflicts, so a foreign interleaved writer surfaces as a loud timeline anomaly instead of silently shifting the cycle ↔ version identity reads derive.
• Zero sidecar state. A per-cycle frame row seals the cycle ↔ version mapping inside the same atomic commit; versions() and scan_sealed() read the reopened store, and sealed_version = base_version + 1 is an identity the commit path verifies, never assumes.
• Order is a write-side property. Landings are stored in the already-deinterlaced DetachedCycleBatch::freeze order and scanned back with scan_in_order(true) — this sink never sorts on read.

Domain-0x09 witness contract (module doc)

The patient SoA at classid domain 0x09 is the only place patient reasoning is written to Lance, so the store's schema is witness-focused and maximally rich: payload carries the 512-byte canonical EpisodicWitness node (visited ontology addresses, executed crosswalk mappings, exact RO/ontology edge ids, supporting/contradicting/missing observations, NARS truth + confidence, differential branches), whose edges point INTO the immutable domain-0x03 ontology address space. A cycle takes ontology immutability for granted for its representation window (base_version names the sealed predecessor it read) and never restates ontology content — the sealed versioning is a reflection of the thinking; downstream displays read the sealed version, never a live recomputation.

Gates

• 6 tokio tests, every guarantee proven against a reopened dataset (fresh sink instance + fresh Dataset::open, never an in-memory echo): seal survives restart; stale base fenced with nothing written (version chain, landings, timeline all checked untouched); sequential cycles chain V1→V2→V3 with strictly-after filtering; a zero-landing cycle advances the timeline only; an empty store reads empty (DatasetNotFound is a state, not an error); move-nullability + 512-byte payload byte-exact round-trip. The real Lance version chain is cross-checked against the returned DatasetVersion in-test.
• cargo clippy -p lance-graph --lib clean; cargo fmt clean; gated on the default-on planner feature (the trait lives in the optional planner dep).
• Board hygiene (LATEST_STATE inventory + PR_ARC_INVENTORY entry) in the same commit.

The branch also carries the two pre-existing post-#879 follow-up commits that were already on the remote branch (pre-commit failure contract correction + MedCare plan consolidation), merged with current main (lance-graph-supervisor re-checked green post-merge).

Deferred

The MedCare consumer arc (production drive_cohort_thoughts caller, witness-seal of real observation + CURIE/ELK/RO nodes, views reading the sealed version) — next PR, in MedCare-rs. recover_and_apply wiring against this sink in a production driver. Object-store URI smoke (only local paths exercised).

🤖 Generated with Claude Code

https://claude.ai/code/session_01KCGhDYoQBXs3poaR7sFuqp

---

Generated by Claude Code

Summary by CodeRabbit

• New Features

  • Added durable storage for cycle history with ordered recovery after restarts.
  • Preserved optional workflow moves, witness information, and final cycle images.
  • Added safeguards against stale writes and inconsistent version ordering.

• Bug Fixes

  • Improved failure handling so incomplete writes are discarded and safely regenerated.
  • Clarified recovery behavior for pre-commit and post-commit failures.

• Documentation

  • Added guidance describing the active MedCare integration path, persistence guarantees, validation plans, and current implementation boundaries.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_4b5e21b3-bb5e-4a3d-9322-d5b1c43725d3)

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds a Lance-backed WalSink for cycle persistence, updates pre-commit failure recovery to use deterministic regeneration, and documents the active MedCare consumer-pull proof path and related repository findings.

Changes

Cycle persistence and recovery

Layer / File(s)	Summary
Lance cycle sink implementation crates/lance-graph/src/graph/cycle_sink.rs, crates/lance-graph/src/graph/mod.rs, .claude/board/LATEST_STATE.md, .claude/board/PR_ARC_INVENTORY.md	Adds the feature-gated LanceCycleSink, Arrow schema, atomic Lance writes, version fencing, ordered recovery, timeline reads, durable images, and tests for restart, ordering, empty cycles, stale bases, nullable moves, and witness payloads.
Pre-commit failure recovery crates/lance-graph-supervisor/src/cycle_driver.rs, .claude/board/LATEST_STATE.md	Defines failed seals as disposable provisional state. Retries regenerate from unchanged Vn; committed-history recovery remains separate. Tests verify no publication or state mutation before regeneration.
MedCare integration proof documentation .claude/plans/medcare-consumer-pull-thinking-proof-v1.md, .claude/board/INTEGRATION_PLANS.md, .claude/board/EPIPHANIES.md	Documents the live consumer-pull lineage, dormant host-side scaffold, proof flow, falsifiers, unresolved lineage findings, and current implementation status.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• AdaWorldAPI/lance-graph#878: Defines the cycle/WAL storage concepts implemented by LanceCycleSink.
• AdaWorldAPI/lance-graph#879: Establishes the related cycle-sealing and regeneration path.
• AdaWorldAPI/lance-graph#892: Covers the same Lance graph and MedCare integration seam.

Poem

A rabbit stores cycles in rows neat and bright,
Version fences keep every landing in sight.
Failed seals return to Vn for a new run,
MedCare traces the path when the proof has begun.
Lance holds each witness through day and night.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the concrete Lance-backed WalSink added in the main changeset.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e081ba32b8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 6

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.claude/board/EPIPHANIES.md:
- Around line 871-879: Move the entire `2026-08-02 —
E-TWO-MEDCARE-LINEAGES-THE-LIVE-ONE-PULLS-THE-DEAD-ONE-HOSTS-1` entry to the
topmost newest-first ledger position, ahead of all older entries and the other
existing `2026-08-02` item. Preserve the exact entry content and retain the
relative order of every other entry.

In @.claude/board/INTEGRATION_PLANS.md:
- Around line 147-169: Move the complete 2026-08-02
medcare-consumer-pull-thinking-proof v1 entry to the head of the ledger in
INTEGRATION_PLANS.md, before the existing 2026-08-02 entry. Preserve the entry’s
content exactly and do not edit any older entries.

In @.claude/board/LATEST_STATE.md:
- Around line 6-8: Define and document reconciliation for durable post-commit
version mismatches in commit_cycle(): do not treat PersistError::Write as
blindly retryable after rows may have been appended; serialize commits or return
an explicit ambiguous/committed result, and provide a rule to detect and
reconcile an existing frame-row cycle-to-version mapping before retrying the
same SealFailure.casts. Update the `#879` entries at .claude/board/LATEST_STATE.md
lines 6-8 and 150-152 and .claude/board/PR_ARC_INVENTORY.md lines 38-40; all
three sites require the reconciliation behavior to be recorded.

In @.claude/plans/medcare-consumer-pull-thinking-proof-v1.md:
- Line 29: Update the three Markdown diagram code fences in the document to
specify the text language identifier, including the fences near the referenced
sections, so each opening fence uses text and satisfies markdownlint MD040.

In `@crates/lance-graph/src/graph/cycle_sink.rs`:
- Around line 204-227: Enforce the canonical 512-byte payload size in the
landing-write loop around payload.append_value, rejecting any s.payload whose
length is not exactly 512 bytes before persistence. Update existing
short-payload fixtures to 512 bytes and add a test verifying invalid landing
payloads are rejected while preserving the canonical node row stride and 16-byte
edge reservation.
- Around line 369-408: Prevent interleaved cycle commits from appending under a
shifted DatasetVersion: update the cycle sink commit path at
crates/lance-graph/src/graph/cycle_sink.rs:369-408 to use an expected-version
conditional append, or return a distinct committed-anomaly result containing the
actual published version. Update
crates/lance-graph-supervisor/src/cycle_driver.rs:26-50 and :1016-1117 so this
result is routed through committed-history handling rather than classified as an
uncommitted CycleError::Seal; preserve the actual published version when
reporting the anomaly.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 01554bd8-d079-4c0f-86d7-aa25f719acf6

📥 Commits

Reviewing files that changed from the base of the PR and between 8997948 and e081ba3.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (8)

• .claude/board/EPIPHANIES.md
• .claude/board/INTEGRATION_PLANS.md
• .claude/board/LATEST_STATE.md
• .claude/board/PR_ARC_INVENTORY.md
• .claude/plans/medcare-consumer-pull-thinking-proof-v1.md
• crates/lance-graph-supervisor/src/cycle_driver.rs
• crates/lance-graph/src/graph/cycle_sink.rs
• crates/lance-graph/src/graph/mod.rs

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

file=".claude/board/EPIPHANIES.md"
rg -n '^## [0-9]{4}-[0-9]{2}-[0-9]{2} — ' "$file"
git diff --unified=3 -- "$file"

Repository: AdaWorldAPI/lance-graph

Length of output: 50380

---

Move the MedCare finding to the newest-first ledgers position.

:2026-08-02 — E-TWO-MEDCARE-LINEAGES… is currently after older entries and before another existing 2026-08-02 item. This board must keep new entries prepended and preserve prior order.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.claude/board/EPIPHANIES.md around lines 871 - 879, Move the entire
`2026-08-02 — E-TWO-MEDCARE-LINEAGES-THE-LIVE-ONE-PULLS-THE-DEAD-ONE-HOSTS-1`
entry to the topmost newest-first ledger position, ahead of all older entries
and the other existing `2026-08-02` item. Preserve the exact entry content and
retain the relative order of every other entry.

Sources: Coding guidelines, Learnings

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🌐 Web query:

For Lance 9.0.0 Rust, which Dataset write or append API can make an append conditional on an expected dataset version, so a concurrent writer cannot turn a cycle based on Vn into a successful commit at Vn+2?

💡 Result:

In Lance 9.0.0 (Rust), you can implement a conditional append by using the lower-level Dataset::commit function, which allows you to explicitly provide a read_version parameter [1]. The standard high-level append method (e.g., Dataset::append) generally handles the current dataset version automatically [2], which may not provide the strict conditional control you need to prevent a concurrent writer from evolving the state (e.g., from Vn to Vn+2) before your commit completes. To ensure your write is conditional on a specific expected version (Vn), follow these steps: 1. Read the current version (Vn) of your dataset [3]. 2. Prepare your operation (e.g., an Append operation) with your data [4][5]. 3. Use the Dataset::commit method to finalize the transaction, passing Vn as the read_version argument [1][3]. The signature for Dataset::commit is: pub async fn commit( dest: impl Into<WriteDestination<'_>>, operation: Operation, read_version: Option, store_params: Option, commit_handler: Option<Arc>, session: Arc, enable_v2_manifest_paths: bool) -> Result<>; By explicitly providing read_version = Some(Vn), the commit process enforces optimistic concurrency control [4]. If a concurrent writer has already committed a newer version (Vn+1) to the underlying storage, the Lance commit mechanism will detect the conflict and fail the operation [4][6], preventing your transaction from creating a cycle or incorrectly applying changes based on an stale manifest [4][5]. If you are using the high-level InsertBuilder or append path, you are typically operating within a more abstracted flow that may mask this manual version management [2]. For maximum control over concurrency and version coupling, calling commit directly is the recommended approach [1].

Citations:

• 1: https://docs.rs/lance/latest/lance/dataset/struct.Dataset.html
• 2: https://github.com/lancedb/lance/blob/119f87b3/rust/lance/src/dataset.rs
• 3: https://lance.org/guide/distributed_write/
• 4: http://lance.org/format/table/transaction/
• 5: https://github.com/lancedb/lance/blob/119f87b3/rust/lance/src/dataset/transaction.rs
• 6: Optimistic concurrency control lance-format/lance#951

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== locate relevant files =="
git ls-files | rg 'crates/(lance-graph/src/graph/cycle_sink\.rs|lance-graph-supervisor/src/cycle_driver\.rs)$' || true

echo
echo "== cycle_sink outline =="
ast-grep outline crates/lance-graph/src/graph/cycle_sink.rs --view compact || true

echo
echo "== relevant cycle_sink lines =="
sed -n '330,430p' crates/lance-graph/src/graph/cycle_sink.rs

echo
echo "== cycle_driver relevant imports/types/calls =="
rg -n "run_cycle|write|WriteFailed|Determine|DatasetVersion|sealed|SealFailure|recover" crates/lance-graph-supervisor/src/cycle_driver.rs | head -n 200

Repository: AdaWorldAPI/lance-graph

Length of output: 18330

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== cycle_sink constructor and append path outline =="
ast-grep outline crates/lance-graph/src/graph/*cycle_sink*.rs --view signatures

echo
echo "== cycle_sink full file (focused around methods) =="
wc -l crates/lance-graph/src/graph/cycle_sink.rs
sed -n '1,180p' crates/lance-graph/src/graph/cycle_sink.rs

echo
echo "== cycle_driver run_cycle and run_cycle tests =="
sed -n '318,358p' crates/lance-graph-supervisor/src/cycle_driver.rs
sed -n '486,530p' crates/lance-graph-supervisor/src/cycle_driver.rs
sed -n '984,1120p' crates/lance-graph-supervisor/src/cycle_driver.rs

Repository: AdaWorldAPI/lance-graph

Length of output: 19532

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== run_cycle error variants and callers =="
rg -n "enum CycleError|CycleError\::|seal_cycle\(|recover_fleet\(|recover_and_apply\(" crates/lance-graph-supervisor -g '*.rs' | head -n 200

echo
echo "== run_circular/fleet lifecycle callers =="
for f in $(git ls-files crates/lance-graph-supervisor/src | rg '\.rs$'); do
  echo "--- $f"
  rg -n "run_cycle|seal_cycle|recover_fleet|CycleError" "$f" || true
done

echo
echo "== persist_sink traits =="
rg -n "struct|enum|trait|persist_cycle|commit_cycle|WriteFailed|DetachedCycleBatch" crates/*/src crates/lance-graph-supervisor/src -g '*.rs' | head -n 240

echo
echo "== Lance dependency version =="
rg -n 'name = "lance"\n|lance ="|lance = "' -g 'Cargo.toml' -C 3 .

Repository: AdaWorldAPI/lance-graph

Length of output: 28182

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== cycle_driver error enum =="
sed -n '136,180p' crates/lance-graph-supervisor/src/cycle_driver.rs
sed -n '467,518p' crates/lance-graph-supervisor/src/cycle_driver.rs

echo
echo "== persist_sink definitions/usages =="
rg -n "pub (trait WalSink|enum WriteFailed|struct DetachedCycleBatch|struct PersistError|fn persist_cycle|fn commit_cycle)|WriteFailed|persist_cycle|commit_cycle" crates/lance-graph-planner crates/lance-graph src crates/lance-graph-supervisor -g '*.rs'

echo
echo "== Lance dependency declarations =="
rg --multiline -- '^\s*name = "lance"\n|^\s*name = "lance-graph"\n|^\s*name = "lance-graph-contract"\n|^\s*name = "lance-graph-supervisor"\n' Cargo.lock -g 'Cargo.lock' -C 2 || true

echo
echo "== deterministic verifier for race window and row sealing =="
python3 - <<'PY'
from dataclasses import dataclass
from enum import auto, Enum

class State(Enum):
    base_read = auto()
    foreign_commit_n_plus_1 = auto()
    append_starts_after_foreign_commit = auto()
    append_commits_unconditionally = auto()
    post_check_mismatch = auto()

`@dataclass`(equivalent=True)
class Run:
    state: State

trace = []
for state in State:
    run = Run(state)
    trace.append(run)
    if state is State.base_read:
        base = 0
        head = 0
    elif state is State.foreign_commit_n_plus_1:
        head = base + 1
    elif state is State.append_starts_after_foreign_commit:
        base_for_append = 0
        head_for_append = base + 1
    elif state is State.append_commits_unconditionally:
        published = head_for_append + 1
    elif state is State.post_check_mismatch:
        expected = base + 1
        mismatch_publish = published
        row_base_version = base
        row_derived_version = row_base_version + 1
print({
    "race_trace": [run.state.name for run in trace],
    "published_after_race": mismatch_publish,
    "row_derives": row_derived_version,
    "expected": expected,
})
PY

Repository: AdaWorldAPI/lance-graph

Length of output: 21275

---

Fail the cycle commit before appending an interleaved version.

A foreign writer can publish DatasetVersion(base.0 + 1) after this code reads the current head. ds.append() then commits under the new manifest and can return DatasetVersion(base.0 + 2), but the rows are still emitted with sealed_version() == base + 1. run_cycle then classifies this as CycleError::Seal and treats it as uncommitted regeneration. Make the append expected-version conditional, or return a separate committed-anomaly result including the actual published version and route it to committed-history handling.

📍 Affects 2 files

• crates/lance-graph/src/graph/cycle_sink.rs#L369-L408 (this comment)
• crates/lance-graph-supervisor/src/cycle_driver.rs#L26-L50
• crates/lance-graph-supervisor/src/cycle_driver.rs#L1016-L1117

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/lance-graph/src/graph/cycle_sink.rs` around lines 369 - 408, Prevent
interleaved cycle commits from appending under a shifted DatasetVersion: update
the cycle sink commit path at crates/lance-graph/src/graph/cycle_sink.rs:369-408
to use an expected-version conditional append, or return a distinct
committed-anomaly result containing the actual published version. Update
crates/lance-graph-supervisor/src/cycle_driver.rs:26-50 and :1016-1117 so this
result is routed through committed-history handling rather than classified as an
uncommitted CycleError::Seal; preserve the actual published version when
reporting the anomaly.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_54530d94-a5ed-414a-9b5a-c142b85054ee)

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/lance-graph/src/graph/cycle_sink.rs`:
- Around line 517-547: The compensating delete in the post-publication branch
advances the physical dataset version, so treating the append as an uncommitted
retryable failure leaves sealed history inconsistent. Update the `ds.delete`
compensation and subsequent commit handling to use an expected-version
conditional, or record the actual published version as committed history; never
regenerate from the recovered sealed predecessor after the append was externally
visible.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3351047e-9880-410c-addc-641bc5c60ae0

📥 Commits

Reviewing files that changed from the base of the PR and between e081ba3 and ba4f06c.

📒 Files selected for processing (5)

• .claude/board/INTEGRATION_PLANS.md
• .claude/board/LATEST_STATE.md
• .claude/board/PR_ARC_INVENTORY.md
• .claude/plans/medcare-consumer-pull-thinking-proof-v1.md
• crates/lance-graph/src/graph/cycle_sink.rs

🚧 Files skipped from review as they are similar to previous changes (4)

• .claude/board/PR_ARC_INVENTORY.md
• .claude/plans/medcare-consumer-pull-thinking-proof-v1.md
• .claude/board/LATEST_STATE.md
• .claude/board/INTEGRATION_PLANS.md

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Do not treat a published append as an uncommitted failure.

The compensating Dataset::delete publishes another dataset version. If the append lands at base + 2, the delete advances the physical head again. versions() still reports only frame-derived versions, so a subsequent commit using the recovered sealed predecessor fails the head != base.0 check at Line 508.

Use an expected-version commit, or return the actual published version as committed history. Do not regenerate from a cycle that was externally visible.

For Lance Rust version 9.0.0, does `Dataset::delete` create a new dataset version? Which official API supports a write conditional on an expected dataset version or read version?

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/lance-graph/src/graph/cycle_sink.rs` around lines 517 - 547, The
compensating delete in the post-publication branch advances the physical dataset
version, so treating the append as an uncommitted retryable failure leaves
sealed history inconsistent. Update the `ds.delete` compensation and subsequent
commit handling to use an expected-version conditional, or record the actual
published version as committed history; never regenerate from the recovered
sealed predecessor after the append was externally visible.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ba4f06cd5c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Do not delete the competing writer's cycle

When two writers derive the same cycle ID from the same sealed base, the first writer's successful rows and this writer's rebased rows both satisfy this predicate. The compensating delete therefore removes the winning writer's already-acknowledged frame, landings, and image as well, even though that writer may already have applied its transitions; after restart, its durable recovery history is gone. Fresh evidence beyond the earlier publication finding is that the new compensation path identifies rows only by the shared (cycle, base_version) rather than by the exact appended fragments or transaction.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve a valid payload when restaging held moves

When an owner produces multiple intent moves, restage_held explicitly stages each deferred move with Vec::new() (cycle_driver.rs:300-307), and the following cycle carries that empty payload into this check. The concrete sink then rejects the cycle because every landing must be exactly 512 bytes, so the documented held-intent progression can never commit through LanceCycleSink; restaging must retain or synthesize a valid row payload, or intent-only landings must be represented without violating the payload invariant.

Useful? React with 👍 / 👎.