dir-sim: the history as a log of verified append-only batches

.claude/board/STATUS_BOARD.md

@@ -43,7 +43,8 @@ Plan: `.claude/plans/dir-sim-persist-v1.md`.
 |---|---|---|---|
 | **D-DSP-0** | `StoreImage` + `VersionStore::image` / `restore` (dir-sim, no I/O) | Shipped (#1473) | P-W3-0: round trip answers every read the same; damaged image refused |
 | **D-DSP-1** | `VersionStore::revert(current, earlier, evidence)` — undo as a version | Shipped (#1473) | the revert's view equals `earlier`'s |
-| **D-DSP-2** | Lance writer/reader crate for `StoredImage`: logical versions in verifiable append-only batches (one batch = one Lance commit), torn saves refused | Queued | write → read → restore equals the in-memory image; a truncated or reordered batch is refused |
+| **D-DSP-2a** | `log`: verified append-only batches of a `StoredImage` (pure, no I/O); torn saves refused; explicit prefix read | In PR | two-batch restore reads the same; four torn-save shapes refused; five disable runs red |
+| **D-DSP-2** | Lance writer/reader crate for `StoredImage`: logical versions in verifiable append-only batches (one batch = one Lance commit), torn saves refused | Queued (2b: Lance I/O over `log`) | write → read → restore equals the in-memory image; a truncated or reordered batch is refused |
 | **D-DSP-4** | `StoredImage` + `RuleRegistry` (exact `(name, version)`) + `restore_stored` + read-only `History` (decision 2(a)) | In PR | unknown rule refused, never substituted; history still reads; disable runs red |
 | **D-DSP-3** | `ViewActors` (W-2) + `from_graph` groups (wishlist #19) in dir-sim | Shipped (#1473) | disable runs red |
 

.claude/plans/dir-sim-persist-v1.md

@@ -78,8 +78,17 @@ as a simulated version whose origin names the restored version.
     leaves the log refused until reconciled. In-band idempotency stays
     OPEN, as in the reference implementation.
   - Records: `Observation`, `Change`, `Origin` and `Violation` need a
-    stable encoding; it lives in the Lance crate next to the reader that
-    must decode it, with a round-trip test per variant.
+    stable encoding. **Amended 2026-10-11:** it lives in
+    `lance-graph-dir-sim::log` (pure, no I/O), next to the types, so the
+    storage crate only maps a `Record` to a row and back.
+  - [x] **D-DSP-2a** `log`: `LogState::batch` / `committed`, `replay`,
+        `replay_prefix`; per-variant round trips with every strict prefix
+        refused; two-batch restore; torn saves (lost tail, lost header,
+        flipped byte, missing batch) refused. Disable runs red: checksum,
+        record count, batch gap, the sparse skip, stale commit.
+  - [ ] **D-DSP-2b** the Lance crate: one batch = one Lance append; the
+        dataset version checked before and after (stale writer refused,
+        race detected); read once at restore. Needs disk for lancedb.
 - [x] **Decision 4(b), 2026-10-11:** group-to-role grants are the
       authority's versioned policy, not directory state: OGAR
       `ogar_rbac::group_policy::GroupRolePolicy` (append-only, own

crates/lance-graph-dir-sim/src/lib.rs

@@ -43,6 +43,7 @@ mod exec;
 pub mod groups;
 pub mod image;
 pub mod ldap;
+pub mod log;
 pub mod observe;
 pub mod proxy;
 pub mod rule;