[lance-gatefixer]

Operators lack dataset CLI commands to identify missing or damaged data files and remove their references from a manifest.

Add dataset verify-data-files, repair-manifest, locate-data-file, and restore. Verification checks every referenced object's size and optionally its current-format metadata. Repair validates every explicit file selection, previews affected fragments with --dry-run, and removes whole fragments through a normal delete transaction. File resolution uses the dataset's registered storage bases, including shallow clones. Storage options and optional cloud provider features support remote datasets.

Removing a fragment drops all its rows and columns from the new version; physical objects and historical manifests remain intact. Repair commits skip automatic cleanup so retention settings cannot delete recovery history during repair. Deep verification checks metadata, not every data page or blob payload. The README documents these limits and the recovery commands.

Adding Dataset to the public LanceToolsCommand enum requires callers with exhaustive matches to handle the new variant (breaking-change).

Validation:

• cargo test -p lance-tools --profile ci --locked — 32 tests passed, including recovery, history preservation under automatic cleanup, table-manifest dispatch, and manifest fixture parsing.
• cargo fmt --all -- --check — passed.
• cargo clippy --all --tests --benches --profile ci --locked -- -D warnings — passed.
• RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps --profile ci --locked — passed.

Fixes #6694

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[lance-gatefixer]

Applied the breaking-change label for the public LanceToolsCommand::Dataset enum addition, which requires callers with exhaustive matches to handle the new variant. No code change was needed for this labeling request.

[lance-gatekeeper]

✅ Gate recommendation: approve.

The recovery commands continue to work alongside table manifest. Repair preserves retained history when automatic cleanup is configured.