rfc: drop the legacy id alias from RFC 0040 and define its upgrade protocol

[azimafroozeh]

What & why

This PR amends the merged RFC 0040 (#546, status draft) with the source-verified findings of its second review, and renumbers it against #593 and #686. One file; each superseded sentence is named in the Decision log.

• Legacy alias deleted: the compiler never resolved $p.id or a bare id predicate to the system column (it resolves against declared properties only), so the coexistence row, the deprecation lint, the .gq rewrite tool, and the two-revision rollout addressed a surface that did not exist. $p.id is a declared user property on both vintages; the meta-fields $p.@id/$e.@src/$e.@dst are the only identity accessor; stored queries need no change at the upgrade.
• Wire surfaces: every surface carries identity in a fixed logical envelope, the same shape on both vintages; load and export move id beside type/edge, out of data, so a user property named id round-trips; legacy data.id still loads on old-vintage graphs.
• Historical reads: a read pinned to a pre-upgrade version resolves each system role's spelling by Lance stable field ID from the pinned image, so history stays readable after the upgrade and the change feed crosses the upgrade commit (the merged text was silent; today the current catalog is bound to snapshot_at(version)).
• The upgrade as a SchemaApply intent: preflight refuses __id/__src/__dst and _-named properties and non-main branches before any effect; effects run in order (stamp advance, one rename-only alter_columns per table, publish, promotion with _schema.pg respelled); recovery is roll-forward-only under the existing schema-apply failpoints plus one between renames; a read-only open refuses a pending intent.
• Early fence: the __manifest internal-schema stamp advances 7 to 8 on new-vintage graphs, read before the recovery sweeps on every binary, so no earlier binary writes before refusing; this binary serves {7, 8}, which retires the single-version storage contract (owners named in Rollout step 2).
• blocked_on closed: on Lance 11.0.0 a rename-only alter_columns is a field-ID-preserving Project that leaves fragments and indexes in place, pinned as a Lance surface guard; the one-shot migration tool fallback is retired.
• Unresolved question 1 settled: @unique(@src, @dst) on both vintages; bare src/dst in a constraint list keeps the role meaning on old-vintage graphs only, and the upgrade respells it.
• Renumbered against three merges: the set-carrying ir_version is 5 (feat(engine): add edge keys with derived identity #593 took 4 for edge keys, 3 stays burned per RFC 0054), the stamp scheme is {7, 8} (feat(storage): totally order table registrations by the manifest version #686 took 7), and refuse_unsupported_schema_versions (RFC 0054's withdrawal) now refuses an unknown number before recovery on main, so the stamp's two remaining reasons are stated.

Backing issue / RFC

• Is an RFC PR: amends docs/rfcs/0040-system-column-namespace.md (merged as draft in rfc: add RFC 0040, the system column namespace #546; discussion bug: a node property named id silently collides with the implicit physical id column, and @key then fails claiming the property is undeclared #529). Merge is not acceptance; the registry row stays public / draft / in-progress.

Checklist

• Change is focused (one file, the RFC text and its Decision log; no registry change)
• Tests added/updated for behavior changes (N/A, RFC text; the Evidence and tests section names every gate this amendment adds, owned by feat(schema): resolve system column spellings per graph #548 and the upgrade step)
• Public docs updated if user-facing surface changed (none in this PR; Rollout step 2 names the user-doc rewrites the implementation carries: docs/user/schema/index.md §IDs, docs/dev/ingestion.md, docs/user/operations/upgrade.md, docs/dev/versioning.md)
• Reviewed against docs/dev/invariants.md — no Hard Invariant weakened, no deny-list item hit (the field-ID lookup locates a spelling within one table incarnation and never infers an identity; the Invariants section states the Invariant 6 clause owed at acceptance)

Local verification

• python3 scripts/check-docs.py — Documentation OK (134 Markdown files checked)
• typos docs/rfcs/0040-system-column-namespace.md — clean
• cargo check --workspace — not run: docs-only diff, one file under docs/rfcs/

Notes for reviewers

• Two payload changes existing clients see at the release, on every vintage: export carries id beside type/edge instead of inside data, and the identity member of a projected node object (return { $p }) becomes @id (today id, a member a declared property id would take). An export written by this release does not load into an older binary.
• The upgrade is not reversible in place: recovery is roll-forward-only, rollback is restoring the whole pre-upgrade graph root with the pre-upgrade fleet, and the cluster procedure is one revision with servers stopped first.
• RFC 0044 is not edited here: its pointers to "RFC 0040's unresolved question 1" resolve to this RFC's Design section by one sentence; the 0044 text amendment (minting edge-keys, retiring its deferral) lands with or before 0044's acceptance.
• The pushed resolution layer in feat(schema): resolve system column spellings per graph #548 is untouched by the alias deletion; the alias, lint, and rewrite layers were never built.
• The 2026-09-01 and 2026-09-05 Decision-log entries keep their historical numbers on purpose; the 2026-09-08 entry maps them to today's

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.