Harden RFC-022 pre-arm recovery ownership

[aaltshuler]

What & why

Completes the next RFC-022 slice by preventing SchemaApply, BranchMerge, and EnsureIndices from claiming physical effects or uncovered Lance HEAD drift that existed before their recovery intent. It also makes metadata-only SchemaApply recovery and interrupted EnsureIndices rollback unambiguous across crashes.

Backing issue / RFC

• Fixes an accepted issue: Closes #
• Implements / is an accepted RFC: RFC-022 unified write path
• Trivial fast-lane (typo / docs / dependency bump / comment / one-line CI) — no issue/RFC required

Checklist

• Change is focused (one logical change)
• Tests added/updated for behavior changes (or N/A)
• Public docs updated if user-facing surface changed (or N/A)
• Reviewed against docs/dev/invariants.md — no Hard Invariant weakened, no deny-list item hit (or justified)

Notes for reviewers

• Adds one shared pre-arm physical-baseline check under the final schema → branch → table gates. Existing targets must still equal their manifest pins; first-touch refs use sidecar-before-ref ordering.
• SchemaApply v5 records the target schema identity and durable Phase-C confirmation, including zero-table metadata-only applies. Table effects remain loosely classified until the full exact adapter.
• EnsureIndices v6 retains loose effect classification but pre-mints rollback lineage and persists the rollback audit plan before restore, making compensation retry-exact. Exact forward/effect identity remains a follow-up.
• BranchMerge carries the verified target handle into effects and rejects late target drift before arming.
• Sidecar versions are explicitly gated; older v2 sidecars remain readable and older binaries refuse newer semantics.

Validation:

• cargo test --workspace --locked
• cargo test -p omnigraph-engine --locked --features failpoints --test failpoints (104/104)
• cargo check -p omnigraph-engine --locked --features failpoints
• touched-file rustfmt check
• scripts/check-agents-md.sh
• git diff --check

---

Greptile Summary

This PR tightens recovery ownership for RFC-022 write paths. The main changes are:

• Adds SchemaApply sidecar confirmation and schema identity tracking.
• Adds fixed rollback identity for EnsureIndices recovery.
• Rechecks manifest and physical table baselines before arming sidecars.
• Carries verified BranchMerge targets into the effect phase.
• Updates failpoint coverage and recovery documentation.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.
• The crash-recovery paths converge for the inspected SchemaApply, EnsureIndices, BranchMerge, and staging flows.
• The added sidecar versions are validated before use.

Important Files Changed

Filename	Overview
crates/omnigraph/src/db/manifest/recovery.rs	Adds versioned recovery handling for SchemaApply confirmation and EnsureIndices rollback replay.
crates/omnigraph/src/db/omnigraph/schema_apply.rs	Writes SchemaApply v5 sidecars under a complete gate envelope and confirms manifest publication before schema promotion.
crates/omnigraph/src/db/omnigraph/table_ops.rs	Reworks EnsureIndices planning so only real index effects are pinned and protected by v6 recovery sidecars.
crates/omnigraph/src/exec/merge.rs	Carries verified existing merge target handles through BranchMerge effect publication.
crates/omnigraph/src/exec/staging.rs	Uses the shared physical-baseline helper for mutation and load staging.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
  participant Writer
  participant Gates as Schema/Branch/Table gates
  participant Sidecar as Recovery sidecar
  participant Lance as Lance table HEADs
  participant Manifest as Manifest
  participant Recovery as Recovery sweep

  Writer->>Gates: Acquire ownership envelope
  Writer->>Manifest: Revalidate schema, branch, and table pins
  Writer->>Lance: Verify existing HEAD matches manifest pin
  Writer->>Sidecar: Write recovery intent before effects
  Writer->>Lance: Apply table, index, or schema effects
  Writer->>Sidecar: Confirm completed effect phase
  Writer->>Manifest: Publish graph commit
  Writer->>Sidecar: Delete sidecar best-effort

  Recovery->>Sidecar: Read versioned intent
  Recovery->>Lance: Classify visible effects
  Recovery->>Manifest: Roll forward or roll back
  Recovery->>Sidecar: Record audit and delete

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
  participant Writer
  participant Gates as Schema/Branch/Table gates
  participant Sidecar as Recovery sidecar
  participant Lance as Lance table HEADs
  participant Manifest as Manifest
  participant Recovery as Recovery sweep

  Writer->>Gates: Acquire ownership envelope
  Writer->>Manifest: Revalidate schema, branch, and table pins
  Writer->>Lance: Verify existing HEAD matches manifest pin
  Writer->>Sidecar: Write recovery intent before effects
  Writer->>Lance: Apply table, index, or schema effects
  Writer->>Sidecar: Confirm completed effect phase
  Writer->>Manifest: Publish graph commit
  Writer->>Sidecar: Delete sidecar best-effort

  Recovery->>Sidecar: Read versioned intent
  Recovery->>Lance: Classify visible effects
  Recovery->>Manifest: Roll forward or roll back
  Recovery->>Sidecar: Record audit and delete

Loading

_{Reviews (1): Last reviewed commit: "Harden RFC-022 pre-arm recovery ownershi..." | Re-trigger Greptile}

Context used:

• Context used - AGENTS.md (source)
• Context used - CLAUDE.md (source)

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.