dir-sim: the history log in Lance; group grants read from the authority's policy

.claude/board/STATUS_BOARD.md

@@ -44,9 +44,9 @@ Plan: `.claude/plans/dir-sim-persist-v1.md`.
 |---|---|---|---|
 | **D-DSP-0** | `StoreImage` + `VersionStore::image` / `restore` (dir-sim, no I/O) | Shipped (#1473) | P-W3-0: round trip answers every read the same; damaged image refused |
 | **D-DSP-1** | `VersionStore::revert(current, earlier, evidence)` — undo as a version | Shipped (#1473) | the revert's view equals `earlier`'s |
-| **D-DSP-2a** | `log`: verified append-only batches of a `StoredImage` (pure, no I/O); torn saves refused; explicit prefix read | In PR | two-batch restore reads the same; four torn-save shapes refused; five disable runs red |
-| **D-DSP-2** | Lance writer/reader crate for `StoredImage`: logical versions in verifiable append-only batches (one batch = one Lance commit), torn saves refused | Queued (2b: Lance I/O over `log`) | write → read → restore equals the in-memory image; a truncated or reordered batch is refused |
-| **D-DSP-4** | `StoredImage` + `RuleRegistry` (exact `(name, version)`) + `restore_stored` + read-only `History` (decision 2(a)) | In PR | unknown rule refused, never substituted; history still reads; disable runs red |
+| **D-DSP-2a** | `log`: verified append-only batches of a `StoredImage` (pure, no I/O); torn saves refused; explicit prefix read | Shipped (#1482) | two-batch restore reads the same; four torn-save shapes refused; five disable runs red |
+| **D-DSP-2** | Lance writer/reader crate for `StoredImage`: logical versions in verifiable append-only batches (one batch = one Lance commit), torn saves refused | In PR (2b: `lance-graph-dir-sim-lance`, one batch = one Lance append) | two saves restore to the same reads; missing dataset = empty log; stale writer writes nothing (create and append); torn batch refused at restore; out-of-order batch refused |
+| **D-DSP-4** | `StoredImage` + `RuleRegistry` (exact `(name, version)`) + `restore_stored` + read-only `History` (decision 2(a)) | Shipped (#1481) | unknown rule refused, never substituted; history still reads; disable runs red |
 | **D-DSP-3** | `ViewActors` (W-2) + `from_graph` groups (wishlist #19) in dir-sim | Shipped (#1473) | disable runs red |
 
 ## D-LBL — labels of a concept, pulled through the plug (2026-10-11)

.claude/plans/dir-sim-persist-v1.md

@@ -86,9 +86,13 @@ as a simulated version whose origin names the restored version.
         refused; two-batch restore; torn saves (lost tail, lost header,
         flipped byte, missing batch) refused. Disable runs red: checksum,
         record count, batch gap, the sparse skip, stale commit.
-  - [ ] **D-DSP-2b** the Lance crate: one batch = one Lance append; the
-        dataset version checked before and after (stale writer refused,
-        race detected); read once at restore. Needs disk for lancedb.
+  - [x] **D-DSP-2b** the Lance crate `lance-graph-dir-sim-lance` (own
+        workspace, lance 13 without cloud stores; dir-sim itself stays
+        free of lance): one batch = one Lance append (`Create`, then
+        `Append`); the dataset version checked before (stale writer
+        refused, nothing written) and after (`Race` when the commit is not
+        the next version); read once at restore. Logical versions stay in
+        the records; the Lance version is only the commit counter.
 - [x] **Decision 4(b), 2026-10-11:** group-to-role grants are the
       authority's versioned policy, not directory state: OGAR
       `ogar_rbac::group_policy::GroupRolePolicy` (append-only, own

.github/workflows/dir-sim-persist.yml

@@ -0,0 +1,71 @@
+name: dir-sim persist
+# lance-graph-dir-sim-lance stores the dir-sim history log in Lance. It is
+# workspace-excluded (own [workspace] root, like lance-graph-dir-sim, which
+# it depends on), so no other job builds it. Without this one a change to
+# `lance_graph_dir_sim::log` or a lance bump could break it unnoticed.
+#
+# lance's build compiles .proto files: `protoc` alone is not enough, the
+# well-known includes (libprotobuf-dev) are needed too.
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    paths:
+      - crates/lance-graph-dir-sim/**
+      - crates/lance-graph-dir-sim-lance/**
+      - crates/lance-graph-quack/**
+      - crates/lance-graph-mask-risc/**
+      - .github/workflows/dir-sim-persist.yml
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_INCREMENTAL: "0"
+  CARGO_PROFILE_DEV_DEBUG: "0"
+  CARGO_PROFILE_TEST_DEBUG: "0"
+  RUST_BACKTRACE: "1"
+
+jobs:
+  lance-log:
+    name: dir-sim log in Lance
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    defaults:
+      run:
+        working-directory: lance-graph
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: lance-graph
+          persist-credentials: false
+      - name: Checkout AdaWorldAPI/ndarray (sibling dependency)
+        uses: actions/checkout@v4
+        with:
+          repository: AdaWorldAPI/ndarray
+          path: ndarray
+          persist-credentials: false
+      - name: Checkout AdaWorldAPI/OGAR (sibling dependency)
+        uses: actions/checkout@v4
+        with:
+          repository: AdaWorldAPI/OGAR
+          path: OGAR
+          persist-credentials: false
+      - name: Install protoc and the protobuf includes (for lance)
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libprotobuf-dev
+      - name: Setup rust toolchain (pinned by rust-toolchain.toml)
+        run: rustup show
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: lance-graph/crates/lance-graph-dir-sim-lance
+      - name: clippy
+        run: cargo clippy --manifest-path crates/lance-graph-dir-sim-lance/Cargo.toml --all-targets -- -D warnings
+      - name: test
+        run: cargo test --manifest-path crates/lance-graph-dir-sim-lance/Cargo.toml

crates/lance-graph-dir-sim-lance/Cargo.toml

@@ -0,0 +1,46 @@
+# lance-graph-dir-sim-lance — the dir-sim history log stored in Lance
+# (plan dir-sim-persist-v1, D-DSP-2b). EXCLUDED from the lance-graph
+# workspace (own [workspace] root), like lance-graph-dir-sim, which it
+# depends on: dir-sim stays free of lance, arrow and datafusion.
+#
+# One log batch is one Lance append. The history's logical versions live
+# in the records; the Lance dataset version is only the physical commit
+# counter, used to refuse a stale writer and detect a race.
+#
+# Build/verify:
+#   cargo test --manifest-path crates/lance-graph-dir-sim-lance/Cargo.toml
+
+[package]
+name = "lance-graph-dir-sim-lance"
+version = "0.1.0"
+edition = "2021"
+publish = false
+license = "Apache-2.0"
+description = "Lance storage for the dir-sim history log: one verified batch per append, dataset version checked before and after, read once at restore."
+
+[workspace]
+
+[dependencies]
+lance-graph-dir-sim = { path = "../lance-graph-dir-sim" }
+# The lance family moves in lockstep with the lance-graph root (13 / arrow
+# 58); no cloud object stores, a local or file URI is enough here.
+lance = { version = "13.*", default-features = false }
+arrow-array = "58"
+arrow-schema = "58"
+
+[dev-dependencies]
+tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
+tempfile = "3"
+ogar-dir-core = { git = "https://github.com/AdaWorldAPI/OGAR", branch = "main" }
+ogar-dir-sim = { git = "https://github.com/AdaWorldAPI/OGAR", branch = "main" }
+
+# The same patches as lance-graph-dir-sim: [patch] applies only at the
+# workspace root, so a crate that depends on dir-sim repeats them.
+[patch."https://github.com/AdaWorldAPI/ndarray"]
+ndarray = { path = "../../../ndarray" }
+
+[patch."https://github.com/AdaWorldAPI/OGAR"]
+ogar-dir-core = { path = "../../../OGAR/crates/ogar-dir-core" }
+ogar-dir-sim = { path = "../../../OGAR/crates/ogar-dir-sim" }
+ogar-ad = { path = "../../../OGAR/crates/ogar-ad" }
+ogar-az = { path = "../../../OGAR/crates/ogar-az" }