RFC: Isolated branch merge publication - #696
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8551cf4acf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| 4. Revalidate the target authority. Persist the publication-pending disposition | ||
| before submitting the one target publication. Use the existing | ||
| ***compare-and-swap (CAS)***, a conditional update that succeeds only against | ||
| the expected accepted state. A conflict cannot transparently publish a stale | ||
| merge result. Preserve the captured source parent and intended graph-commit id. |
There was a problem hiding this comment.
When the source branch is deleted and recreated after capture, step 4 checks only the target, so the target manifest CAS cannot detect the source ABA. The existing exec/merge.rs::revalidate_merge_inputs path explicitly rejects changes to the source branch_identifier before applying effects; without an equivalent final check, this protocol can publish data and merged-parent lineage captured from a dead source incarnation despite promising unchanged merge behavior. Revalidate the source incarnation at the final gate, or explicitly require a fence held continuously from capture through publication.
AGENTS.md reference: AGENTS.md:L93-L94
Useful? React with 👍 / 👎.
1 participant
What & why
This RFC could address issue #694: failed branch merges block subsequent writes until restart. A failed merge can leave pending recovery that prevents later writes on the same running instance.
The proposal prepares merges on private Lance owners and publishes the complete graph result once. Proven abandoned output becomes GC work, allowing later writes without first restoring the target tables or deleting the failed attempt's output.
Backing issue / RFC
docs/rfcs/0065-isolated-branch-merge-publication.mdChecklist
docs/dev/invariants.md; bounded ownership and recovery discovery are explicit acceptance requirements.Local verification
python3 scripts/check-docs.py: passed, 138 Markdown files.bash scripts/check-agents-md.sh: passed.git diff --check: passed.Notes for reviewers
Native branches versus fresh dataset paths remains open. Acceptance requires bounded ancestry and write-admission cost, change-feed lifetime witnesses, crash-safe publication and GC, and a supported format upgrade. The RFC specifies qualification requirements; it does not claim an implementation or performance improvement.