feat(dice-storage): Drivine drift-report store and observed-schema source

[jimador]

PR 5 of the metamodel train, stacked on #86. The Drivine half of the drift story. DrivineDriftReportStore runs three distinct Cypher reads (all / global / one context), each scoping before limiting, newest-first with a persisted per-schema sequence as the deterministic tie-break, and injective scope keys so a context id equal to the old sentinel cannot overwrite a global report. DrivineObservedSchemaSource observes the whole graph via label and relationship-type queries plus a mention-type query, and observes a context via the proposition walk. DrivineMetamodelVersionStore declares SweptBaselineStore, binding its markSwept/sweptVersion semantics. A full-loop integration test runs declare → ingest an undeclared mention → check → report persisted and hash-resolvable → sweep → proposition quarantined, against a real Neo4j container.

Changed in this review round:

• The whole observation takes one read snapshot — one transaction, read-committed, stated as such in the KDoc, closing the window where concurrent writes produced a combined observation that never existed at any instant.
• Mention types are separated from graph labels. ObservedSchema.EntityTypeBasis splits the declared set: the mention-type arm compares against declared type names plus aliases, so a mention typed with a governed type's inherited parent label no longer passes governance silently. Global mention-type observation is new too — a recorded mention type that projected no node was previously invisible to unscoped checks.
• Graph ownership is derived from the registered schemas. DiceStorageSchema is the contract each Cypher-backed store's schema object implements; DiceOwnedSchema.of(registered) derives the bookkeeping exclusion from that bean list, and the DDL comes off the same list via diceStorageCatalog, so a store cannot get its constraints while sitting outside the exclusion. The hand-written label map is gone; a store registered nowhere stays visible to observation, which is what a drift check should report.
• The label side counts only labels some node wears — a uniqueness constraint on an empty graph no longer reads as permanent drift — and Drivine's own _DrivineSchema inventory label is excluded by name.
• Activating @Transactional exposed that Boot 4.1 moved transaction autoconfiguration into spring-boot-transaction; the module now depends on it, and the dedup boundary runs REQUIRES_NEW.

Breaking changes: none. New stores and one new constraint set for hosts adopting drift persistence. Behavioral notes: DrivineObservedSchemaSource gains a required constructor argument (branch-new type), and the transaction activation is a genuine runtime change on upgrade, stated in the CHANGELOG.

Status: the derived-ownership surface (DiceStorageSchema, diceStorageCatalog, DiceOwnedSchema) is EXPERIMENTAL; a store takes part by being registered.

sequenceDiagram
    participant R as DriftCheckRunner
    participant S as DrivineObservedSchemaSource
    participant N as Neo4j
    R->>S: observe(contextId)
    activate S
    Note over S,N: one transaction, one read snapshot
    S->>N: labels with nodes, relationship types
    S->>N: mention types
    N-->>S: combined observation
    deactivate S
    S-->>R: ObservedSchema with basis
    Note over R: MENTION_TYPES compares against declared names plus aliases
    Note over R: GRAPH_LABELS compares against the full label closure
    Note over R: registered DiceStorageSchema beans define the exclusion

Loading

Next in stack: #88 — opt-in Spring Boot wiring and the operator surface.

• Release takes the quarantine keys off the node. The Drivine property bag is merge-only, so a release that dropped previousStatus and reason from the proposition's metadata left both on the node. DrivinePropositionRepository now removes every metadata.* property the saved metadata no longer names, with one dynamic REMOVE after the node write (Neo4j 5.24+). The drift integration test checks both keys are gone after a release.

[igordayen]

@jimador - few comments from my side and codex. thank you

[igordayen]

@jimador - appears rebase is now required

[jimador]

@igordayen both threads are answered above and the annotations version is fixed in 6f1db2d. Could you take another look? This is the last unapproved PR in the metamodel stack.

[igordayen]

@igordayen both threads are answered above and the annotations version is fixed in 6f1db2d. Could you take another look? This is the last unapproved PR in the metamodel stack.

@jimador yes, i wanted to approve, but it appears rebase is still required.

[jimador]

@igordayen rebased. The whole metamodel stack (#83 through #88 and #106) is now on top of main after the user-guide merge, replayed commit for commit with no conflicts; the only difference between the old and new tops is main's own change. Full clean install at the top of the stack is green. Ready for your approval whenever you get a moment.

[jimador]

Heads up on the red checks across this stack: every run dies in the first seconds with 401 Unauthorized from repo.embabel.com/artifactory/libs-snapshot while resolving embabel-agent-dependencies:1.5.0-SNAPSHOT. The Build workflow reads that repository anonymously and anonymous reads are returning 401 right now (main's own Deploy Snapshots run at 20:14 UTC failed the same way). The extraction train went green minutes earlier only because its Maven cache already held the BOM. Nothing in the rebase; a rerun once the repository is back should clear it.

[igordayen]

@jimador looks good!