feat(transaction): implement the Transaction V2 action vocabulary

docs/src/format/table/transaction.md

@@ -582,6 +582,11 @@ same id, name, or path.
     opt-in for exactly this reason, and a table that has one anywhere in its
     history raises the minimum reader version for that table to v12.0.0.
 
+    Writing is gated twice while the feature is experimental: the calling code
+    opts in per commit, and the deployment sets
+    `LANCE_ENABLE_UNSTABLE_TRANSACTION_V2` in the environment. Release builds
+    refuse without both.
+
 Every operation above is a single named verb. A transaction may instead carry a
 `CompositeOperation`: an ordered list of granular *actions* that apply
 atomically as one manifest change. This lets one commit express a change no

java/lance-jni/src/transaction.rs

@@ -1217,6 +1217,11 @@ fn convert_to_java_operation_inner<'local>(
                 &[JValue::Object(&new_bases)],
             )?)
         }
+        // Transaction V2 is a pre-vote draft with no Java surface yet; a
+        // composite operation has no Java class to map onto.
+        Operation::CompositeOperation(_) => Err(Error::unsupported_error(
+            "CompositeOperation transactions are not exposed to the Java bindings".to_string(),
+        )),
     }
 }
 

protos/transaction/actions.proto

@@ -18,8 +18,9 @@ package lance.table;
  * atomically as one manifest change. This is an experimental feature under
  * the process in docs/src/community/voting.md: the field numbers are not a
  * stable contract, may change without a separate vote, and are removed if
- * the stabilization vote does not pass. Support here is read-side
- * fail-closed — rejected on load, with no write path.
+ * the stabilization vote does not pass. Reading is fail-closed: an action
+ * this build does not recognize aborts the load rather than being skipped.
+ * Writing is opt-in, for the reason below.
  *
  * COMPATIBILITY WARNING. A table version carrying one of these cannot be
  * opened at all by Lance before v12.0.0, and the fix is not backported

rust/lance-table/src/feature_flags.rs

@@ -70,6 +70,24 @@ pub(crate) const STICKY_PAIRED_FLAGS: u64 = FLAG_MIXED_DATA_FILE_VERSIONS;
 /// overlay files before the feature is generally released.
 pub const ENABLE_UNSTABLE_DATA_OVERLAY_FILES_ENV: &str = "LANCE_ENABLE_UNSTABLE_DATA_OVERLAY_FILES";
 
+/// Environment variable that opts a release build into committing Transaction
+/// V2 (an action-based [`CompositeOperation`]) before the feature is generally
+/// released.
+///
+/// This gates the writer only. It lives here so every
+/// `LANCE_ENABLE_UNSTABLE_*` switch is discoverable in one place, even though
+/// Transaction V2 has no manifest flag bit of its own.
+///
+/// [`CompositeOperation`]: crate::transaction::action::CompositeOperation
+pub const ENABLE_UNSTABLE_TRANSACTION_V2_ENV: &str = "LANCE_ENABLE_UNSTABLE_TRANSACTION_V2";
+
+/// Whether this build may commit Transaction V2: always in debug builds, so
+/// tests exercise the path, and in release builds only when
+/// [`ENABLE_UNSTABLE_TRANSACTION_V2_ENV`] is set.
+pub fn transaction_v2_enabled() -> bool {
+    cfg!(debug_assertions) || std::env::var_os(ENABLE_UNSTABLE_TRANSACTION_V2_ENV).is_some()
+}
+
 /// Set the reader and writer feature flags in the manifest based on the contents of the manifest.
 pub fn apply_feature_flags(
     manifest: &mut Manifest,

rust/lance-table/src/format/fragment.rs

@@ -455,6 +455,22 @@ impl TryFrom<pb::DeletionFile> for DeletionFile {
     }
 }
 
+impl From<&DeletionFile> for pb::DeletionFile {
+    fn from(value: &DeletionFile) -> Self {
+        let file_type = match value.file_type {
+            DeletionFileType::Array => pb::deletion_file::DeletionFileType::ArrowArray,
+            DeletionFileType::Bitmap => pb::deletion_file::DeletionFileType::Bitmap,
+        };
+        Self {
+            read_version: value.read_version,
+            id: value.id,
+            file_type: file_type.into(),
+            num_deleted_rows: value.num_deleted_rows.unwrap_or_default() as u64,
+            base_id: value.base_id,
+        }
+    }
+}
+
 /// Data fragment.
 ///
 /// A fragment is a set of files which represent the different columns of the same rows.
@@ -717,19 +733,7 @@ impl TryFrom<pb::DataFragment> for Fragment {
 
 impl From<&Fragment> for pb::DataFragment {
     fn from(f: &Fragment) -> Self {
-        let deletion_file = f.deletion_file.as_ref().map(|f| {
-            let file_type = match f.file_type {
-                DeletionFileType::Array => pb::deletion_file::DeletionFileType::ArrowArray,
-                DeletionFileType::Bitmap => pb::deletion_file::DeletionFileType::Bitmap,
-            };
-            pb::DeletionFile {
-                read_version: f.read_version,
-                id: f.id,
-                file_type: file_type.into(),
-                num_deleted_rows: f.num_deleted_rows.unwrap_or_default() as u64,
-                base_id: f.base_id,
-            }
-        });
+        let deletion_file = f.deletion_file.as_ref().map(pb::DeletionFile::from);
 
         let row_id_sequence = f.row_id_meta.as_ref().map(|m| match m {
             RowIdMeta::Inline(data) => {

rust/lance-table/src/transaction.rs

@@ -17,6 +17,7 @@
 //! ```text
 //! builder            Transaction: an operation plus the version it was based on
 //! operation          the vocabulary of changes an operation can describe
+//! action             the finer-grained Transaction V2 vocabulary (experimental)
 //! update_map         incremental edits to the manifest's string maps
 //! validate           pre-commit checks against the manifest being replaced
 //! manifest_build     applying an operation to produce the next manifest
@@ -26,6 +27,7 @@
 //! proto              the persisted protobuf encoding of all of the above
 //! ```
 
+pub mod action;
 mod builder;
 mod conflicts;
 mod index_maintenance;