feat(table): decode and validate unified fragment reuse history

[LuQQiu]

What this adds

This PR implements one decoder for version-1 FRI history while preserving the existing version-0 representation.

FragmentReuseIndexDetails
        │
        ├── inline InlineContent
        └── external InlineContent bytes
                    │
                    ▼
        decode legacy_versions[] and transitions[]
                    │
                    ▼
          validate and order fragment lineage
                    │
                    ▼
               FragReuseLedger

Legacy Version.groups are lifted in memory into ordered-compaction transitions. Version-1 transitions decode their explicit mapping type:

• Ordered compaction reuses the existing RowAddrRemap.
• Stable partition retains its row-map reference for the dataset reader to open later.

The outer inline/external envelope is decoded through the same entry point, including external offset and size validation. Unsupported FRI index versions return an upgrade error.

Lineage validation

The decoder validates fragment digests and mapping-specific row-count invariants, then builds producer and consumer lookups for fragment IDs. It rejects duplicate producers, duplicate consumers, and cycles before returning transitions in deterministic topological order.

A transition with an unknown mapping is excluded from the readable lineage and marks the history as partially unsupported. This lets readers fall back to scanning affected paths while allowing writers and maintenance operations to reject a history they cannot preserve safely.

Mapping reuse

Each supported transition receives an in-memory content fingerprint derived from its ordered source and destination digests plus its mapping contents. The fingerprint is not persisted. It allows later reader layers to reuse an unchanged mapping reader when the FRI entry UUID changes because another transition was appended or removed.

This PR only decodes and validates history. It performs no stable-partition row-map IO, dataset lineage traversal, coverage planning, or index loading. The legacy version-0 reader and writer remain unchanged.

Validation

Tests cover inline and external histories, legacy lifting, mixed ordered-compaction and stable-partition transitions, multi-step lineage, deterministic ordering, invalid digests and row counts, duplicate producers and consumers, cycles, malformed protobuf input, unsupported mappings and index versions, external-size validation, and mapping fingerprint stability.

Validated with workspace Clippy and cargo fmt --all.

[github-actions]

Important

Format specification vote

This PR modifies the Lance format specification, so it requires 3 binding +1 votes from PMC members (excluding the proposer) and a minimum 72-hour voting period, weekends excluded, before it can merge. Vote by approving this PR (+1) or requesting changes (−1, a veto). See the voting process.

Status: ❌ Blocked — 0 of 3 required approvals

Approvals (this commit)	none (0/3)
Vetoes	none
Voting period	elapsed — ended Tue 2026-09-15 18:21 UTC (11:21 PDT)

_{Updated automatically by the format-spec vote gate, which re-checks every 15 minutes — just voted? Re-check now (press Run workflow; leave the input blank to re-check every open format PR). A PMC member may apply the format-waived label to waive the vote for a trivial edit (typo, wording, formatting).}

[lance-gatekeeper]

✅ Gate recommendation: approve.

The stale prerequisite stack is gone: this revision keeps the finalized FRI contract and merged mapping layer, and adds only the metadata ledger. The decoder preserves version 0 behavior, validates inline and external version 1 histories, mapping payloads, row conservation, and acyclic lineage, and leaves stable-partition row maps lazy.