@amalgm/shell 0.1.109 → 0.1.111

package/dist/user-ground-host.js

@@ -27,7 +27,6 @@ import { GroundCoordinator } from "./ground-coordination.js";
 import { submitMutationOperation } from "./paged-mutation-submit.js";
 import { adoptSnapshotDeliveryBaseline } from "./snapshot-delivery-baseline.js";
 import { WireClient, WireRequestError } from "./wire-client.js";
-const SMALL_CONTENT_UPLOAD_CONCURRENCY = 16;
 /** Cargo waves hold up to 16MiB of payload each; two in flight bounds the
  * upload path's memory while keeping the wire busy. */
 const CARGO_UPLOAD_CONCURRENCY = 2;
@@ -47,8 +46,24 @@ const DETECT_RETRY_MS = 250;
 /** A Detect walk yields the event loop this often so Send, Receive, and
  * Apply progress during a large reconciliation instead of queueing behind it. */
 const DETECT_WALK_YIELD_ENTRIES = 256;
+/** File captures during a walk overlap reads and hashing across this many
+ * lanes; the directory traversal itself stays ordered and serial. */
+const WALK_CAPTURE_CONCURRENCY = 8;
+/** How many times one register attempt re-derives after ground moved under
+ * its capture. Each attempt re-walks at read+hash speed, so steady churn is
+ * surfaced instead of chased forever. */
+const REGISTER_STALE_CAPTURE_ATTEMPTS = 3;
 const DOWNLOAD_CONTENT_RETRY_ATTEMPTS = 3;
 const APPLY_GROUND_WAIT_TIMEOUT_MS = 15_000;
+function loadSnapshotPublication(entry) {
+    const snapshotRecords = snapshotFromRecords((JSON.parse(entry.snapshotBlob.toString("utf8")).records ?? [])).records;
+    const uploadIds = new Set(entry.uploadUuids);
+    return {
+        ...entry,
+        snapshotRecords,
+        uploadRecords: snapshotRecords.filter((record) => uploadIds.has(record.uuid)),
+    };
+}
 const GROUND_ROW_COLUMNS = [
     "uuid", "resource_id", "root_uuid", "type", "parent_uuid", "name", "status", "version",
     "payload_version", "transport_version", "relative_path", "absolute_path", "device_number",
@@ -532,19 +547,30 @@ export class UserGroundHost {
             // unchanged while a contract cutover moved its cargo namespace, so
             // the publish path re-proves seal evidence and repairs any missing
             // uploads before this answer is lawful.
+            let staleRepair = false;
             try {
                 const deliveryWatermark = await this.prepareSnapshotPublication(identity, { journey: "register", workspaceId });
                 await this.publishMaterializedSnapshot(identity, new Set([workspaceId]), deliveryWatermark, { journey: "register", workspaceId });
             }
-            finally {
+            catch (error) {
+                // A stale capture means a repair upload's evidence no longer matches
+                // the ground it was captured from. The full walk below recaptures
+                // and republishes current truth instead of failing the register.
+                if (!staleCapture(error)) {
+                    this.finishColdOperation();
+                    throw error;
+                }
+                staleRepair = true;
+            }
+            if (!staleRepair) {
                 this.finishColdOperation();
+                return {
+                    registered: true,
+                    entityCount: countDescendantRows(database, workspaceId),
+                    cloudHead: this.cloudState.checksum,
+                    watch,
+                };
             }
-            return {
-                registered: true,
-                entityCount: countDescendantRows(database, workspaceId),
-                cloudHead: this.cloudState.checksum,
-                watch,
-            };
         }
         // Register is a cold declaration, not a filesystem edit. It performs one
         // complete reconciliation and publishes one graph head; it must not mint
@@ -578,75 +604,88 @@ export class UserGroundHost {
             const observations = this.watchHost.observations().filter((observation) => observation.directory === this.userRoot(identity)
                 || pathWithin(contentOwner, observation.directory));
             this.watchDirty = false;
-            const registrationStarted = performance.now();
-            this.stage({
-                primitive: "register", stage: "entity-registration", status: "started", workspaceId,
-            });
-            const scanned = await reconcileGround({
-                identity,
-                userRoot: this.userRoot(identity),
-                database: this.databasePath(identity),
-                cacheDir: this.cacheDir(identity),
-                onScan: (evidence) => this.reportDetectScan(evidence),
-                registrationWorkspaceId: workspaceId,
-                suspicions: new Map(observations.map((observation) => [observation.directory, observation.suspicion])),
-            });
-            const retry = scanned.detection.find((plan) => plan.kind === "retry");
-            if (retry?.kind === "retry") {
-                throw new Error(retry.reasons.join("; "));
-            }
-            const registrationDuration = performance.now() - registrationStarted;
-            const commitStarted = performance.now();
-            this.stage({
-                primitive: "register", stage: "entity-sqlite-commit", status: "started", workspaceId,
-            });
-            const committed = commitDetectedState(this.databasePath(identity), {
-                notebookBasis: scanned.notebookBasis,
-                acceptedMaterializedRows: scanned.acceptedMaterializedRows,
-                materializedRemovals: scanned.materializedRemovals,
-                acceptedNotebookRows: scanned.acceptedNotebookRows,
-                notebookRemovals: scanned.notebookRemovals,
-            });
-            if (!committed) {
-                throw new Error("verified ground advanced while registration was observing; retry");
-            }
-            this.stage({
-                primitive: "register",
-                stage: "entity-sqlite-commit",
-                status: "completed",
-                workspaceId,
-                durationMs: performance.now() - commitStarted,
-            });
-            if (scanned.transferFailures.length > 0) {
-                const details = scanned.transferFailures
-                    .map(({ rootId, reason }) => `${rootId}: ${reason}`)
-                    .join("; ");
-                this.stage({
-                    primitive: "register",
-                    stage: "entity-registration",
-                    status: "failed",
-                    workspaceId,
-                    durationMs: registrationDuration,
-                    measurements: { roots: scanned.transferFailures.length },
-                });
-                throw pipelineStageError("entity registration", new Error(`repository state could not be captured: ${details}`));
-            }
-            this.stage({
-                primitive: "register",
-                stage: "entity-registration",
-                status: "completed",
-                workspaceId,
-                durationMs: registrationDuration,
-                measurements: {
-                    roots: scanned.publicationRootIds?.length ?? 0,
-                    rows: scanned.acceptedMaterializedRows.length,
-                },
-            });
-            this.namedDetect?.refreshEnrollmentPolicy();
-            if (!scanned.publicationRootIds) {
-                throw new Error("cold registration reconciliation did not name its publication roots");
+            // Ground may move between a walk's capture and its upload. Each retry
+            // re-walks and republishes the ground as it now is — bounded, because
+            // a workspace under continuous mutation belongs to Watch afterwards,
+            // not to an endless register.
+            for (let attempt = 1;; attempt++) {
+                try {
+                    const registrationStarted = performance.now();
+                    this.stage({
+                        primitive: "register", stage: "entity-registration", status: "started", workspaceId,
+                    });
+                    const scanned = await reconcileGround({
+                        identity,
+                        userRoot: this.userRoot(identity),
+                        database: this.databasePath(identity),
+                        cacheDir: this.cacheDir(identity),
+                        onScan: (evidence) => this.reportDetectScan(evidence),
+                        registrationWorkspaceId: workspaceId,
+                        suspicions: new Map(observations.map((observation) => [observation.directory, observation.suspicion])),
+                    });
+                    const retry = scanned.detection.find((plan) => plan.kind === "retry");
+                    if (retry?.kind === "retry") {
+                        throw new Error(retry.reasons.join("; "));
+                    }
+                    const registrationDuration = performance.now() - registrationStarted;
+                    const commitStarted = performance.now();
+                    this.stage({
+                        primitive: "register", stage: "entity-sqlite-commit", status: "started", workspaceId,
+                    });
+                    const committed = commitDetectedState(this.databasePath(identity), {
+                        notebookBasis: scanned.notebookBasis,
+                        acceptedMaterializedRows: scanned.acceptedMaterializedRows,
+                        materializedRemovals: scanned.materializedRemovals,
+                        acceptedNotebookRows: scanned.acceptedNotebookRows,
+                        notebookRemovals: scanned.notebookRemovals,
+                    });
+                    if (!committed) {
+                        throw new Error("verified ground advanced while registration was observing; retry");
+                    }
+                    this.stage({
+                        primitive: "register",
+                        stage: "entity-sqlite-commit",
+                        status: "completed",
+                        workspaceId,
+                        durationMs: performance.now() - commitStarted,
+                    });
+                    if (scanned.transferFailures.length > 0) {
+                        const details = scanned.transferFailures
+                            .map(({ rootId, reason }) => `${rootId}: ${reason}`)
+                            .join("; ");
+                        this.stage({
+                            primitive: "register",
+                            stage: "entity-registration",
+                            status: "failed",
+                            workspaceId,
+                            durationMs: registrationDuration,
+                            measurements: { roots: scanned.transferFailures.length },
+                        });
+                        throw pipelineStageError("entity registration", new Error(`repository state could not be captured: ${details}`));
+                    }
+                    this.stage({
+                        primitive: "register",
+                        stage: "entity-registration",
+                        status: "completed",
+                        workspaceId,
+                        durationMs: registrationDuration,
+                        measurements: {
+                            roots: scanned.publicationRootIds?.length ?? 0,
+                            rows: scanned.acceptedMaterializedRows.length,
+                        },
+                    });
+                    this.namedDetect?.refreshEnrollmentPolicy();
+                    if (!scanned.publicationRootIds) {
+                        throw new Error("cold registration reconciliation did not name its publication roots");
+                    }
+                    await this.publishMaterializedSnapshot(identity, new Set(scanned.publicationRootIds), deliveryWatermark, { journey: "register", workspaceId }, scanned.largeManifests);
+                    break;
+                }
+                catch (error) {
+                    if (!staleCapture(error) || attempt >= REGISTER_STALE_CAPTURE_ATTEMPTS)
+                        throw error;
+                }
             }
-            await this.publishMaterializedSnapshot(identity, new Set(scanned.publicationRootIds), deliveryWatermark, { journey: "register", workspaceId });
             this.watchHost.settle(observations);
         }
         catch (error) {
@@ -1154,27 +1193,15 @@ export class UserGroundHost {
         }
         return inline;
     }
-    async uploadSnapshotContent(identity, resourceId, records, trace) {
+    async uploadSnapshotContent(identity, resourceId, records, trace, manifestHints) {
         const cache = this.cacheDir(identity);
         const byHash = new Map();
         for (const record of records) {
             const artifact = artifactForRecord(record);
-            if (artifact)
-                byHash.set(artifact.contentHash, artifact);
+            if (artifact && !byHash.has(artifact.contentHash)) {
+                byHash.set(artifact.contentHash, { artifact, uuid: record.uuid });
+            }
         }
-        const sources = [...byHash.values()].map((artifact) => {
-            const file = contentCacheFile(cache, artifact.contentHash);
-            const manifest = readCachedManifest(cache, artifact.contentHash);
-            return {
-                artifact,
-                file,
-                manifest,
-                // A retained manifest can prove the remote inventory without local
-                // cargo bytes. The source file is required only when the authority
-                // reports a missing block.
-                bytes: manifest?.bytes ?? statSync(file).size,
-            };
-        });
         const started = performance.now();
         let uploadedChunks = 0;
         let reusedChunks = 0;
@@ -1192,29 +1219,94 @@ export class UserGroundHost {
             ...identifiers,
             measurements: {
                 journey: trace?.journey ?? "bootstrap",
-                artifacts: sources.length,
-                declaredBytes: sources.reduce((total, source) => total + source.bytes, 0),
+                artifacts: byHash.size,
             },
         });
+        // The authority's seal inventory is the only permission to skip an
+        // upload — asked before any source is touched, so sealed artifacts cost
+        // zero local reads and a retried publication whose upload already sealed
+        // completely never needs its captured ground to still exist.
+        const alreadySealed = await this.sealedContentHashes(resourceId, [...byHash.keys()]);
+        const unsealed = [...byHash.values()]
+            .filter(({ artifact }) => !alreadySealed.has(artifact.contentHash));
+        const rows = readGroundRowsByUuid(this.databasePath(identity), unsealed.map(({ uuid }) => uuid));
+        // Each artifact uploads from the strongest evidence available: a cache
+        // copy when another journey pinned one, otherwise the ground entity
+        // itself. Register stages nothing, so the ground path is the common
+        // case — and every read is re-proven against the captured hash, turning
+        // ground churn into a stale capture instead of a wrong upload.
+        const sources = unsealed.map(({ artifact, uuid }) => {
+            const cached = contentCacheFile(cache, artifact.contentHash);
+            const fromCache = existsSync(cached);
+            const row = rows.get(uuid);
+            if (!fromCache && artifact.kind === "git") {
+                // Ground holds the working tree, never the transport parcel; a
+                // lost parcel means recapturing the repository as it now is.
+                throw new StaleCaptureError(`repository parcel ${artifact.contentHash} is no longer captured`);
+            }
+            if (!fromCache && !row) {
+                throw new StaleCaptureError(`entity ${uuid} left the ground before uploading ${artifact.contentHash}`);
+            }
+            const file = fromCache ? cached : row.absolutePath;
+            let linkTarget;
+            let bytes;
+            try {
+                if (!fromCache && artifact.kind === "link") {
+                    linkTarget = Buffer.from(readlinkSync(file), "utf8");
+                    bytes = linkTarget.byteLength;
+                }
+                else {
+                    bytes = statSync(file).size;
+                }
+            }
+            catch (error) {
+                throw new StaleCaptureError(`source for ${artifact.contentHash} is no longer readable`, { cause: error });
+            }
+            const declared = manifestHints?.get(artifact.contentHash)
+                ?? readCachedManifest(cache, artifact.contentHash)
+                ?? undefined;
+            return {
+                artifact,
+                file,
+                fromCache,
+                ...(linkTarget ? { linkTarget } : {}),
+                // Retained evidence only counts while it still describes the exact
+                // source being read; a disagreeing manifest is re-derived instead.
+                ...(declared && declared.bytes === bytes ? { manifest: declared } : {}),
+                bytes,
+            };
+        });
+        const stale = (source, error) => {
+            if (source.fromCache) {
+                // A cache copy that no longer proves its hash is torn evidence:
+                // purge it so the retry reads the ground itself.
+                rmSync(source.file, { force: true });
+                rmSync(manifestCacheFile(cache, source.artifact.contentHash), { force: true });
+            }
+            throw new StaleCaptureError(`${source.artifact.contentHash} no longer matches its source`, { cause: error });
+        };
         // Complete small artifacts ride cargo waves: whole artifacts per frame,
         // verified and sealed by the authority in the same round trip, so the
-        // frame count scales with bytes moved, never with file count. A small
-        // artifact whose cached manifest survives without local bytes keeps the
-        // per-artifact path — its manifest alone can re-prove remote cargo.
-        // Large artifacts keep per-artifact transfer where chunk reuse pays.
+        // frame count scales with bytes moved, never with file count. Large
+        // artifacts keep per-artifact transfer where chunk reuse pays.
         const small = sources.filter((source) => source.bytes <= CHUNK_BYTES);
-        const waveSources = small.filter((source) => !source.manifest || existsSync(source.file));
-        const repairSources = small.filter((source) => source.manifest && !existsSync(source.file));
         const large = sources.filter((source) => source.bytes > CHUNK_BYTES);
         let cargoWaves = 0;
         const transferCargoWave = async (wave) => {
             const loaded = await Promise.all(wave.items.map(async (source) => {
-                const bytes = await readFile(source.file);
-                return {
-                    source,
-                    bytes,
-                    manifest: deriveUploadManifest(source.artifact, bytes, sha256Hex),
-                };
+                try {
+                    const bytes = source.linkTarget ?? await readFile(source.file);
+                    return {
+                        source,
+                        bytes,
+                        manifest: deriveUploadManifest(source.artifact, bytes, sha256Hex),
+                    };
+                }
+                catch (error) {
+                    if (sourceMismatch(error))
+                        stale(source, error);
+                    throw error;
+                }
             }));
             const payload = Buffer.concat(loaded.map((item) => item.bytes));
             const encoded = await encodeContentWireBytes(payload);
@@ -1235,14 +1327,13 @@ export class UserGroundHost {
                 if (!sealed.has(item.source.artifact.contentHash)) {
                     throw new Error(`content authority did not seal ${item.source.artifact.contentHash}`);
                 }
-                atomicWrite(manifestCacheFile(cache, item.source.artifact.contentHash), stableJson(item.manifest));
                 uploadedChunks += item.manifest.chunks.length;
             }
             uploadedBytes += encoded.bytes.byteLength;
             cargoWaves += 1;
         };
         const transfer = async (source) => {
-            const { artifact, file, manifest: cachedManifest, bytes: fileBytes } = source;
+            const { artifact, file, manifest: knownManifest, bytes: fileBytes } = source;
             const sourceFile = { handle: null };
             let manifestPresent = false;
             const putChunk = async (manifest, index, bytes) => {
@@ -1264,8 +1355,7 @@ export class UserGroundHost {
             try {
                 const receipt = await uploadArtifact(artifact, {
                     bytes: fileBytes,
-                    ...(cachedManifest ? { manifest: cachedManifest } : {}),
-                    ...(cachedManifest ? { manifestVerified: true } : {}),
+                    ...(knownManifest ? { manifest: knownManifest, manifestVerified: true } : {}),
                     verify: async (contentHash) => await hashContentFile(file) === contentHash,
                     read: async (offset, bytes) => {
                         sourceFile.handle ??= open(file, "r");
@@ -1328,7 +1418,11 @@ export class UserGroundHost {
                 });
                 uploadedChunks += receipt.uploadedChunks;
                 reusedChunks += receipt.reusedChunks;
-                atomicWrite(manifestCacheFile(cache, artifact.contentHash), stableJson(receipt.manifest));
+            }
+            catch (error) {
+                if (sourceMismatch(error))
+                    stale(source, error);
+                throw error;
             }
             finally {
                 if (sourceFile.handle)
@@ -1336,8 +1430,7 @@ export class UserGroundHost {
             }
         };
         try {
-            await boundedForEach([...planCargoWaves(waveSources)], CARGO_UPLOAD_CONCURRENCY, transferCargoWave);
-            await boundedForEach(repairSources, SMALL_CONTENT_UPLOAD_CONCURRENCY, transfer);
+            await boundedForEach([...planCargoWaves(small)], CARGO_UPLOAD_CONCURRENCY, transferCargoWave);
             for (const source of large) {
                 await transfer(source);
             }
@@ -1349,7 +1442,8 @@ export class UserGroundHost {
                 durationMs: performance.now() - started,
                 measurements: {
                     journey: trace?.journey ?? "bootstrap",
-                    artifacts: sources.length,
+                    artifacts: byHash.size,
+                    reusedArtifacts: byHash.size - sources.length,
                     declaredBytes: sources.reduce((total, source) => total + source.bytes, 0),
                     uploadedBytes,
                     uploadedChunks,
@@ -1854,7 +1948,7 @@ export class UserGroundHost {
             headVersion: first.baseVersion,
             checksum: "",
             deliveryWatermark: first.deliveryWatermark,
-            records: snapshotFromRecords(JSON.parse(first.snapshotJson).records || []).records,
+            records: loadSnapshotPublication(first).snapshotRecords,
         };
         try {
             await this.publishPendingSnapshots(identity);
@@ -1862,9 +1956,11 @@ export class UserGroundHost {
         catch (error) {
             // A conclusive refusal settles the intent as rejected: the lookup that
             // follows fetches authoritative state and a later register supersedes
-            // the settled row, so a refused publication never wedges startup. An
+            // the settled row, so a refused publication never wedges startup. A
+            // stale capture already deleted its unsubmitted row — the intent will
+            // be re-derived from current ground by the next register boundary. An
             // unknown outcome must keep blocking — the mutation may have landed.
-            if (!conclusivelyRefused(error))
+            if (!conclusivelyRefused(error) && !staleCapture(error))
                 throw error;
             this.cloudState = null;
         }
@@ -1875,12 +1971,13 @@ export class UserGroundHost {
     async prepareSnapshotPublication(identity, trace) {
         // An older durable publication resolves before the new boundary derives.
         // Unknown outcomes remain pending; a conclusive refusal may be replaced
-        // by the newer complete snapshot below.
+        // by the newer complete snapshot below; a stale capture already deleted
+        // its unsubmitted row and the boundary being prepared re-derives it.
         try {
             await this.publishPendingSnapshots(identity, trace);
         }
         catch (error) {
-            if (!conclusivelyRefused(error))
+            if (!conclusivelyRefused(error) && !staleCapture(error))
                 throw error;
         }
         await this.recordRail?.flush();
@@ -1898,7 +1995,7 @@ export class UserGroundHost {
         await this.applyRail?.flush();
         return deliveryWatermark;
     }
-    async publishMaterializedSnapshot(identity, publicationRootIds, deliveryWatermark, trace) {
+    async publishMaterializedSnapshot(identity, publicationRootIds, deliveryWatermark, trace, manifestHints) {
         const state = this.cloudState;
         if (!state)
             throw new Error("cloud state is unavailable for graph publication");
@@ -1915,32 +2012,27 @@ export class UserGroundHost {
             throw new Error(`repository-owned leaf escaped its rail: ${impossibleGitLeaf.name} parent=${parent?.type ?? "missing"}`);
         }
         const snapshot = snapshotFromRecords(traveling);
-        const snapshotJson = stableJson(snapshot);
-        const checksum = sha256Hex(snapshotJson);
+        // ONE canonical serialization: these exact bytes are the journal blob
+        // and the checksum's input; they are never re-derived or re-parsed on
+        // the in-process path.
+        const snapshotBlob = Buffer.from(stableJson(snapshot), "utf8");
+        const checksum = sha256Hex(snapshotBlob);
         const localIds = new Set(localRecords.map((record) => record.uuid));
         // Graph membership is never proof of sealed cargo: a record in the cloud
         // graph may name content sealed only under a prior content contract,
         // whose namespace the current readers never touch. Only the authority's
-        // (resource, hash, contract) seal evidence may skip an upload — and the
-        // question is asked even when the graph itself is unchanged, so Register
-        // always re-establishes cargo closure before returning.
-        const cargo = snapshot.records.flatMap((record) => {
-            if (!localIds.has(record.uuid))
-                return [];
-            const artifact = artifactForRecord(record);
-            return artifact ? [{ record, contentHash: artifact.contentHash }] : [];
-        });
-        const sealedArtifacts = await this.sealedContentHashes(state.resourceId, [...new Set(cargo.map((entry) => entry.contentHash))]);
-        const uploadRecords = cargo
-            .filter((entry) => !sealedArtifacts.has(entry.contentHash))
-            .map((entry) => entry.record);
+        // (resource, hash, contract) seal evidence may skip an upload — the
+        // sealed-first upload asks that exact question itself and moves only
+        // what is unsealed, so Register always re-establishes cargo closure
+        // before returning, even when the graph itself is unchanged.
+        const cargoRecords = snapshot.records.filter((record) => localIds.has(record.uuid) && artifactForRecord(record) !== null);
         if (checksum === state.checksum && deliveryWatermark === state.deliveryWatermark) {
             // The graph is already committed; only cargo can be missing. Repair
             // uploads need no journal row — a crash simply re-runs the same
             // repair on the next Register.
-            if (uploadRecords.length > 0) {
+            if (cargoRecords.length > 0) {
                 try {
-                    await this.uploadSnapshotContent(identity, state.resourceId, uploadRecords, trace);
+                    await this.uploadSnapshotContent(identity, state.resourceId, cargoRecords, trace, manifestHints);
                 }
                 catch (error) {
                     throw pipelineStageError("cloud upload", error);
@@ -1958,20 +2050,32 @@ export class UserGroundHost {
             return root !== null && replacementRoots.has(root);
         });
         const replacement = rootReplacementFromRecords(replacementRootIds, replacementRecords);
-        supersedeSnapshotJournal(this.databasePath(identity), {
+        // The operation's canonical bytes: staged, hashed, and submitted as-is.
+        const operationBlob = Buffer.from(stableJson(replacement), "utf8");
+        const entry = {
             mutationId: randomUUID(),
             resourceId: state.resourceId,
             authorityEpoch: state.authorityEpoch,
             baseVersion: state.headVersion,
             snapshotChecksum: checksum,
-            snapshotJson,
             deliveryWatermark,
-            uploadRecords,
+            operationKind: replacement.kind,
             replacementRootIds: replacement.rootIds,
-            replacementRecords: replacement.records,
+            uploadUuids: cargoRecords.map((record) => record.uuid),
+            snapshotBlob,
+            operationBlob,
             status: "pending",
-        });
-        await this.publishPendingSnapshots(identity, trace);
+            submitted: false,
+        };
+        supersedeSnapshotJournal(this.databasePath(identity), entry);
+        // Publish the freshly journaled intent directly: the records are already
+        // in memory and the operation bytes already exist — nothing is re-read,
+        // re-parsed, or re-serialized between prepare and the wire.
+        await this.publishLoadedSnapshot(identity, {
+            ...entry,
+            snapshotRecords: snapshot.records,
+            uploadRecords: cargoRecords,
+        }, trace, manifestHints);
     }
     /** Which of these heads does the authority hold sealed under the current
      * content contract? Batched so a whole workspace costs a handful of
@@ -1996,84 +2100,101 @@ export class UserGroundHost {
         }
         return sealed;
     }
-    async publishPendingSnapshots(identity, trace) {
+    async publishPendingSnapshots(identity, trace, manifestHints) {
         for (const pending of readSnapshotPublications(this.databasePath(identity))) {
             // A rejected row is a settled fact, not an intent: the authority
             // conclusively refused this exact mutation, and only a newer complete
             // snapshot superseding it can publish this resource again.
             if (pending.status === "rejected")
                 continue;
-            const snapshot = snapshotFromRecords(JSON.parse(pending.snapshotJson).records || []);
-            const replacement = rootReplacementFromRecords(pending.replacementRootIds, pending.replacementRecords);
-            try {
-                await this.uploadSnapshotContent(identity, pending.resourceId, pending.uploadRecords, trace);
-            }
-            catch (error) {
-                throw pipelineStageError("cloud upload", error);
-            }
-            let frame;
-            const graphCommitStarted = performance.now();
-            if (trace?.journey === "register") {
-                this.stage({
-                    primitive: "register",
-                    stage: "cloud-graph-commit",
-                    status: "started",
-                    ...(trace.workspaceId ? { workspaceId: trace.workspaceId } : {}),
-                    ...(trace.mutationId ? { mutationId: trace.mutationId } : {}),
-                });
-            }
-            try {
-                frame = await submitMutationOperation(this.wire, {
-                    resourceId: pending.resourceId,
-                    authorityEpoch: pending.authorityEpoch,
-                    mutationId: pending.mutationId,
-                    deviceId: identity.deviceId,
-                    baseVersion: pending.baseVersion,
-                    contract: ENTITY_CLOUD_CONTRACT,
-                    schemaVersion: ENTITY_CLOUD_SCHEMA_VERSION,
-                    operationKind: replacement.kind,
-                    deliveryWatermark: pending.deliveryWatermark,
-                }, replacement);
-            }
-            catch (error) {
-                if (trace?.journey === "register") {
-                    this.stage({
-                        primitive: "register",
-                        stage: "cloud-graph-commit",
-                        status: "failed",
-                        ...(trace.workspaceId ? { workspaceId: trace.workspaceId } : {}),
-                        durationMs: performance.now() - graphCommitStarted,
-                    });
-                }
-                // A non-retryable error frame is the authority's answer: this exact
-                // mutation is refused forever. Settle the row so it is never
-                // replayed and a newer snapshot may supersede it. Every other
-                // failure leaves the outcome unknown and the row pending.
-                if (error instanceof WireRequestError && error.retryable === false) {
-                    markSnapshotJournalRejected(this.databasePath(identity), pending.mutationId);
-                }
-                throw pipelineStageError("cloud graph commit", error);
+            await this.publishLoadedSnapshot(identity, loadSnapshotPublication(pending), trace, manifestHints);
+        }
+    }
+    async publishLoadedSnapshot(identity, publication, trace, manifestHints) {
+        try {
+            await this.uploadSnapshotContent(identity, publication.resourceId, publication.uploadRecords, trace, manifestHints);
+        }
+        catch (error) {
+            // An unsubmitted pending row is a local intent the authority has
+            // never seen. When its captured ground moved before upload, the
+            // intent is simply stale: delete it and let the caller re-derive
+            // one from current ground. A submitted row never lands here — its
+            // upload sealed completely before the first submit frame left.
+            if (staleCapture(error) && !publication.submitted) {
+                deleteJournalEntry(this.databasePath(identity), publication.mutationId);
             }
+            throw pipelineStageError("cloud upload", error);
+        }
+        let frame;
+        const graphCommitStarted = performance.now();
+        if (trace?.journey === "register") {
+            this.stage({
+                primitive: "register",
+                stage: "cloud-graph-commit",
+                status: "started",
+                ...(trace.workspaceId ? { workspaceId: trace.workspaceId } : {}),
+                ...(trace.mutationId ? { mutationId: trace.mutationId } : {}),
+            });
+        }
+        if (!publication.submitted) {
+            markSnapshotJournalSubmitted(this.databasePath(identity), publication.mutationId);
+        }
+        const legMs = {};
+        try {
+            frame = await submitMutationOperation(this.wire, {
+                resourceId: publication.resourceId,
+                authorityEpoch: publication.authorityEpoch,
+                mutationId: publication.mutationId,
+                deviceId: identity.deviceId,
+                baseVersion: publication.baseVersion,
+                contract: ENTITY_CLOUD_CONTRACT,
+                schemaVersion: ENTITY_CLOUD_SCHEMA_VERSION,
+                operationKind: publication.operationKind,
+                deliveryWatermark: publication.deliveryWatermark,
+            }, publication.operationBlob, (leg, durationMs) => { legMs[`${leg}Ms`] = durationMs; });
+        }
+        catch (error) {
             if (trace?.journey === "register") {
                 this.stage({
                     primitive: "register",
                     stage: "cloud-graph-commit",
-                    status: "completed",
+                    status: "failed",
                     ...(trace.workspaceId ? { workspaceId: trace.workspaceId } : {}),
                     durationMs: performance.now() - graphCommitStarted,
-                    measurements: { version: Number(frame.version) },
                 });
             }
-            this.cloudState = {
-                resourceId: pending.resourceId,
-                authorityEpoch: Number(frame.authority_epoch),
-                headVersion: Number(frame.version),
-                checksum: pending.snapshotChecksum,
-                deliveryWatermark: Number(frame.delivery_watermark),
-                records: snapshot.records,
-            };
-            deleteJournalEntry(this.databasePath(identity), pending.mutationId);
+            // A non-retryable error frame is the authority's answer: this exact
+            // mutation is refused forever. Settle the row so it is never
+            // replayed and a newer snapshot may supersede it. Every other
+            // failure leaves the outcome unknown and the row pending.
+            if (error instanceof WireRequestError && error.retryable === false) {
+                markSnapshotJournalRejected(this.databasePath(identity), publication.mutationId);
+            }
+            throw pipelineStageError("cloud graph commit", error);
         }
+        if (trace?.journey === "register") {
+            this.stage({
+                primitive: "register",
+                stage: "cloud-graph-commit",
+                status: "completed",
+                ...(trace.workspaceId ? { workspaceId: trace.workspaceId } : {}),
+                durationMs: performance.now() - graphCommitStarted,
+                measurements: {
+                    version: Number(frame.version),
+                    operationBytes: publication.operationBlob.byteLength,
+                    ...legMs,
+                },
+            });
+        }
+        this.cloudState = {
+            resourceId: publication.resourceId,
+            authorityEpoch: Number(frame.authority_epoch),
+            headVersion: Number(frame.version),
+            checksum: publication.snapshotChecksum,
+            deliveryWatermark: Number(frame.delivery_watermark),
+            records: publication.snapshotRecords,
+        };
+        deleteJournalEntry(this.databasePath(identity), publication.mutationId);
     }
 }
 const sha256Hex = (input) => createHash("sha256").update(input).digest("hex");
@@ -2165,12 +2286,99 @@ function assertHealthyWatch(evidence, rootId) {
  * file over a dozen times; the file itself is never deleted by the host, so
  * every later open needs only the connection and its pragmas. */
 const migratedDatabases = new Set();
-function initializeDatabase(file) {
+const SNAPSHOT_PUBLICATIONS_SCHEMA = `
+    CREATE TABLE IF NOT EXISTS snapshot_publications (
+      sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+      mutation_id TEXT NOT NULL UNIQUE,
+      resource_id TEXT NOT NULL,
+      meta_json TEXT NOT NULL,
+      snapshot_blob BLOB NOT NULL,
+      operation_blob BLOB NOT NULL,
+      created_at INTEGER NOT NULL,
+      status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'rejected')),
+      submitted_at INTEGER
+    );`;
+/** Converts an old-shape publication journal (one nested publication_json
+ * text per row) into the blob journal, atomically, preserving every row's
+ * meaning. A pending row may be a submitted mutation whose outcome exists
+ * only at the authority — dropping it would violate the retry law that
+ * recovers a lost acknowledgement — so conversion is structural: the nested
+ * snapshot text becomes the snapshot blob verbatim, the stored replacement
+ * becomes the operation blob, and semantic judgment stays where it always
+ * was, with the reader (an unlawful row still blocks registration rather
+ * than being silently replaced).
+ *
+ * The transform runs entirely inside SQLite. A production journal row is a
+ * register-scale graph serialized three times over — the exact text whose
+ * repeated JavaScript materialization blew the 512 MB heap — so no part of
+ * it may ever become a JavaScript value here: json_extract lifts the nested
+ * snapshot text straight into its blob, and the meta and operation rows are
+ * json_object over subtrees, all in engine memory outside the V8 heap.
+ *
+ * Tables older than the three-state journal carry no status or submitted_at;
+ * their rows were written before the pre-submit durability mark existed, so
+ * the only safe reading is "possibly submitted": keep them pending and
+ * marked submitted, which replays the same mutation id — always idempotent —
+ * and never supersedes. A row whose publication_json does not parse fails
+ * the open loudly with the journal intact; nothing is ever deleted on a
+ * conversion failure. */
+function convertLegacySnapshotJournal(database, columns) {
+    database.transaction(() => {
+        database.exec("ALTER TABLE snapshot_publications RENAME TO snapshot_publications_legacy");
+        database.exec(SNAPSHOT_PUBLICATIONS_SCHEMA);
+        database.exec(`
+      INSERT INTO snapshot_publications(
+        mutation_id, resource_id, meta_json, snapshot_blob, operation_blob,
+        created_at, status, submitted_at
+      )
+      SELECT
+        mutation_id,
+        resource_id,
+        json_object(
+          'authorityEpoch', json_extract(publication_json, '$.authorityEpoch'),
+          'baseVersion', json_extract(publication_json, '$.baseVersion'),
+          'deliveryWatermark', json_extract(publication_json, '$.deliveryWatermark'),
+          'snapshotChecksum', json_extract(publication_json, '$.snapshotChecksum'),
+          'operationKind', 'entity.roots.replace',
+          'replacementRootIds', json(json_extract(publication_json, '$.replacementRootIds')),
+          'uploadUuids', coalesce((
+            SELECT json_group_array(json_extract(uploaded.value, '$.uuid'))
+              FROM json_each(publication_json, '$.uploadRecords') AS uploaded
+          ), json_array())
+        ),
+        CAST(json_extract(publication_json, '$.snapshotJson') AS BLOB),
+        CAST(json_object(
+          'kind', 'entity.roots.replace',
+          'rootIds', json(json_extract(publication_json, '$.replacementRootIds')),
+          'records', json(json_extract(publication_json, '$.replacementRecords'))
+        ) AS BLOB),
+        created_at,
+        ${columns.has("status") ? "CASE status WHEN 'rejected' THEN 'rejected' ELSE 'pending' END" : "'pending'"},
+        ${columns.has("submitted_at") ? "submitted_at" : "created_at"}
+      FROM snapshot_publications_legacy ORDER BY sequence
+    `);
+        database.exec("DROP TABLE snapshot_publications_legacy");
+    })();
+}
+/** The single opener and schema-migration entry for a user ground database.
+ * Exported so the upgrade path is provable in isolation — the journal
+ * conversion law test opens a legacy file through this exact entry inside a
+ * heap-capped child process. */
+export function initializeDatabase(file) {
     ensurePrivateDir(dirname(file));
     const database = new Database(file);
     database.pragma("busy_timeout = 5000");
     database.pragma("journal_mode = WAL");
     database.pragma("synchronous = FULL");
+    // The legacy probe runs on every open, before the migration memo: a journal
+    // row may be a submitted publication whose outcome exists only at the
+    // authority, so an old-shape table must convert — never drop — no matter
+    // how this file arrived at this process. One PRAGMA against the in-memory
+    // catalog costs nothing next to the connection open itself.
+    const publicationColumns = new Set(database.prepare("PRAGMA table_info(snapshot_publications)").all().map(({ name }) => name));
+    if (publicationColumns.has("publication_json")) {
+        convertLegacySnapshotJournal(database, publicationColumns);
+    }
     if (migratedDatabases.has(file))
         return database;
     database.exec(`
@@ -2262,14 +2470,7 @@ function initializeDatabase(file) {
       authority_id TEXT PRIMARY KEY,
       delivery_sequence INTEGER NOT NULL CHECK(delivery_sequence >= 0)
     );
-    CREATE TABLE IF NOT EXISTS snapshot_publications (
-      sequence INTEGER PRIMARY KEY AUTOINCREMENT,
-      mutation_id TEXT NOT NULL UNIQUE,
-      resource_id TEXT NOT NULL,
-      publication_json TEXT NOT NULL,
-      created_at INTEGER NOT NULL,
-      status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'rejected'))
-    );
+    ${SNAPSHOT_PUBLICATIONS_SCHEMA}
     CREATE TABLE IF NOT EXISTS workspace_add_intents (
       workspace_uuid TEXT PRIMARY KEY,
       destination_path TEXT NOT NULL UNIQUE,
@@ -2305,10 +2506,6 @@ function initializeDatabase(file) {
     if (!inboxColumns.has("resolved_at")) {
         database.exec("ALTER TABLE record_inbox ADD COLUMN resolved_at INTEGER");
     }
-    const publicationColumns = new Set(database.prepare("PRAGMA table_info(snapshot_publications)").all().map(({ name }) => name));
-    if (!publicationColumns.has("status")) {
-        database.exec("ALTER TABLE snapshot_publications ADD COLUMN status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'rejected'))");
-    }
     database.exec("DROP INDEX IF EXISTS record_inbox_delivery");
     database.exec("DROP TABLE IF EXISTS mutation_journal");
     migratedDatabases.add(file);
@@ -2350,6 +2547,31 @@ function readGroundRowsForRoots(file, table, rootUUIDs) {
         database.close();
     }
 }
+/** Exact ground rows for a UUID set, batched under SQLite's parameter bound.
+ * Upload resolves each traveling artifact's source path and recorded size
+ * from these rows — content bytes live in the ground itself, never in a
+ * staged register copy. */
+function readGroundRowsByUuid(file, uuids) {
+    if (!existsSync(file) || uuids.length === 0)
+        return new Map();
+    const database = initializeDatabase(file);
+    try {
+        const found = new Map();
+        for (let start = 0; start < uuids.length; start += 500) {
+            const batch = uuids.slice(start, start + 500);
+            const rows = database.prepare(`
+        SELECT ${GROUND_ROW_PROJECTION}
+          FROM entities WHERE uuid IN (${batch.map(() => "?").join(", ")})
+      `).all(...batch);
+            for (const row of rows)
+                found.set(row.uuid, row);
+        }
+        return found;
+    }
+    finally {
+        database.close();
+    }
+}
 /** Type and UUID settle locally even when immutable repository capture must
  * retry. Those rows are identity evidence for the next observation, while
  * their absence from the notebook still means no verified logical result has
@@ -2734,33 +2956,36 @@ function readSnapshotPublications(file) {
     try {
         return database.prepare(`
       SELECT mutation_id AS mutationId, resource_id AS resourceId,
-             publication_json AS publicationJson, status
+             meta_json AS metaJson, snapshot_blob AS snapshotBlob,
+             operation_blob AS operationBlob, status,
+             submitted_at AS submittedAt
         FROM snapshot_publications ORDER BY sequence
     `).all().map((row) => {
-            const publication = JSON.parse(row.publicationJson);
-            if (!Array.isArray(publication.uploadRecords)) {
-                throw new Error(`snapshot publication ${row.mutationId} has no exact upload subset`);
-            }
-            if (!Array.isArray(publication.replacementRootIds)
-                || !Array.isArray(publication.replacementRecords)) {
+            const meta = JSON.parse(row.metaJson);
+            // No lawful publication carries zero roots — rootReplacementFromRecords
+            // refuses them at build time, so a rootless row here is damage.
+            if (!Array.isArray(meta.replacementRootIds) || meta.replacementRootIds.length === 0
+                || !Array.isArray(meta.uploadUuids) || meta.operationKind !== "entity.roots.replace") {
                 throw new Error(`snapshot publication ${row.mutationId} has no exact root replacement`);
             }
-            const deliveryWatermark = Number(publication.deliveryWatermark);
+            const deliveryWatermark = Number(meta.deliveryWatermark);
             if (!Number.isSafeInteger(deliveryWatermark) || deliveryWatermark < 0) {
                 throw new Error(`snapshot publication ${row.mutationId} has no delivery watermark`);
             }
             return {
                 mutationId: row.mutationId,
                 resourceId: row.resourceId,
-                authorityEpoch: Number(publication.authorityEpoch),
-                baseVersion: Number(publication.baseVersion),
+                authorityEpoch: Number(meta.authorityEpoch),
+                baseVersion: Number(meta.baseVersion),
                 deliveryWatermark,
-                snapshotChecksum: String(publication.snapshotChecksum),
-                snapshotJson: String(publication.snapshotJson),
-                uploadRecords: snapshotFromRecords(publication.uploadRecords).records,
-                replacementRootIds: publication.replacementRootIds.map(String),
-                replacementRecords: snapshotFromRecords(publication.replacementRecords).records,
+                snapshotChecksum: String(meta.snapshotChecksum),
+                operationKind: meta.operationKind,
+                replacementRootIds: meta.replacementRootIds.map(String),
+                uploadUuids: meta.uploadUuids.map(String),
+                snapshotBlob: row.snapshotBlob,
+                operationBlob: row.operationBlob,
                 status: row.status === "rejected" ? "rejected" : "pending",
+                submitted: row.submittedAt !== null,
             };
         });
     }
@@ -2904,47 +3129,61 @@ function commitDetectedState(file, input) {
     }
 }
 /** Journal the newest snapshot publication for its resource. A journal row
- * has exactly two meanings: `pending` — the submit outcome is unknown, so
- * the same mutation id must retry until the authority answers (the mutation
- * may already be accepted with only the acknowledgement lost); `rejected` —
- * the authority conclusively refused it, so it is never replayed. Only a
- * rejected row may be superseded — last write wins — and supersession and
- * insertion share one transaction, so a crash leaves exactly one durable
- * intent. Content uploads are content-addressed and idempotent, so a
- * superseded row loses no uploaded work. */
+ * has exactly three meanings: `pending` and never submitted — a local intent
+ * the authority has never seen, superseded freely (last write wins);
+ * `pending` and submitted — the submit outcome is unknown, so the same
+ * mutation id must retry until the authority answers (the mutation may
+ * already be accepted with only the acknowledgement lost) and nothing may
+ * supersede it; `rejected` — the authority conclusively refused it, so it is
+ * never replayed and awaits supersession. Supersession and insertion share
+ * one transaction, so a crash leaves exactly one durable intent. Content
+ * uploads are content-addressed and idempotent, so a superseded row loses no
+ * uploaded work. */
 function supersedeSnapshotJournal(file, entry) {
     const database = initializeDatabase(file);
     try {
         database.transaction(() => {
             const unresolved = database.prepare(`
         SELECT 1 AS present FROM snapshot_publications
-          WHERE resource_id = ? AND status = 'pending' LIMIT 1
+          WHERE resource_id = ? AND status = 'pending' AND submitted_at IS NOT NULL LIMIT 1
       `).get(entry.resourceId);
             if (unresolved) {
-                throw new Error("a pending publication with an unknown outcome must resolve before supersession");
+                throw new Error("a submitted publication with an unknown outcome must resolve before supersession");
             }
-            database.prepare("DELETE FROM snapshot_publications WHERE resource_id = ? AND status = 'rejected'")
+            database.prepare("DELETE FROM snapshot_publications WHERE resource_id = ?")
                 .run(entry.resourceId);
             database.prepare(`
         INSERT INTO snapshot_publications(
-          mutation_id, resource_id, publication_json, created_at
-        ) VALUES (?, ?, ?, ?)
+          mutation_id, resource_id, meta_json, snapshot_blob, operation_blob, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?)
       `).run(entry.mutationId, entry.resourceId, stableJson({
                 authorityEpoch: entry.authorityEpoch,
                 baseVersion: entry.baseVersion,
                 deliveryWatermark: entry.deliveryWatermark,
                 snapshotChecksum: entry.snapshotChecksum,
-                snapshotJson: entry.snapshotJson,
-                uploadRecords: entry.uploadRecords,
+                operationKind: entry.operationKind,
                 replacementRootIds: entry.replacementRootIds,
-                replacementRecords: entry.replacementRecords,
-            }), Date.now());
+                uploadUuids: entry.uploadUuids,
+            }), entry.snapshotBlob, entry.operationBlob, Date.now());
         })();
     }
     finally {
         database.close();
     }
 }
+/** Durably declare a submit attempt before the first frame leaves. From this
+ * moment the row's outcome may exist only at the authority, so it must retry
+ * the same mutation id and may never be superseded or rebuilt locally. */
+function markSnapshotJournalSubmitted(file, mutationId) {
+    const database = initializeDatabase(file);
+    try {
+        database.prepare("UPDATE snapshot_publications SET submitted_at = ? WHERE mutation_id = ?")
+            .run(Date.now(), mutationId);
+    }
+    finally {
+        database.close();
+    }
+}
 /** Settle a journal row as conclusively refused. It is never replayed again;
  * a newer complete snapshot supersedes it on the next publication. */
 function markSnapshotJournalRejected(file, mutationId) {
@@ -2966,6 +3205,32 @@ function conclusivelyRefused(error) {
         return error.retryable === false;
     return error instanceof Error && conclusivelyRefused(error.cause);
 }
+/** Ground moved between capture and upload: a source no longer yields the
+ * bytes its recorded content head names, so the publication built on that
+ * capture can never complete. It was never submitted, so the lawful recovery
+ * is a fresh walk — capture current ground and publish that truth instead. */
+class StaleCaptureError extends Error {
+    constructor(detail, options) {
+        super(`captured ground moved before upload: ${detail}`, options);
+    }
+}
+function staleCapture(error) {
+    if (error instanceof StaleCaptureError)
+        return true;
+    return error instanceof Error && staleCapture(error.cause);
+}
+/** Local read evidence disagreeing with the recorded content head — the
+ * upload law's typed mismatch or the source file being gone entirely. */
+function sourceMismatch(error) {
+    const code = error?.code;
+    return code === "UPLOAD_SOURCE_MISMATCH" || code === "ENOENT";
+}
+/** The walked file moved while its bytes were being captured — ordinary
+ * ground behavior, answered by recapturing what stands there now. */
+function captureChurn(error) {
+    const code = error?.code;
+    return code === "CAPTURE_SOURCE_CHANGED" || code === "ENOENT";
+}
 function deleteJournalEntry(file, mutationId) {
     const database = initializeDatabase(file);
     try {
@@ -3436,6 +3701,7 @@ async function reconcileGround(input) {
     const notebookRemovals = new Set();
     const detection = [];
     const transferFailures = [];
+    const largeManifests = new Map();
     const scan = async (parameters) => {
         const counters = {
             entries: 0,
@@ -3513,6 +3779,8 @@ async function reconcileGround(input) {
                 : coreSuspicion,
             existingRows: existing.filter((row) => row.rootUUID === coreUUID),
             suspicion: observationFor(userRoot),
+            plansSendRecords: suspicions !== undefined,
+            largeManifests,
         });
     }
     const physicalRoots = registrationOwner ? [registrationOwner] : outerBoundRoots;
@@ -3548,6 +3816,11 @@ async function reconcileGround(input) {
             existingRows: existingWorkspaceRows,
             registeredBoundaries,
             suspicion: observationFor(rootPath),
+            // A register scan publishes one complete snapshot; it never mints Send
+            // records for the same initial contents, so it plans no detection and
+            // stages no cache bytes — upload reads the ground itself.
+            plansSendRecords: suspicions !== undefined && registrationWorkspaceId === undefined,
+            largeManifests,
         });
     }
     const changedUUIDs = new Set([
@@ -3571,10 +3844,11 @@ async function reconcileGround(input) {
         notebookRemovals: [...notebookRemovals],
         publicationRootIds: selectedRoots ? [...selectedRoots] : null,
         transferFailures,
+        largeManifests,
     };
 }
 async function reconcileRoot(input) {
-    const { identity, resourceId, rootUUID, rootName, rootPath, rootType, database, cacheDir, policy, bindingDir, suspects = null, evidence, } = input;
+    const { identity, resourceId, rootUUID, rootName, rootPath, rootType, database, cacheDir, policy, bindingDir, suspects = null, evidence, plansSendRecords, largeManifests, } = input;
     // Prior rows reach this scan from every binding this root encloses. A row's
     // stored relativePath is relative to the root that last committed it, which
     // is a different frame when an enclosing boundary was just registered
@@ -3614,7 +3888,7 @@ async function reconcileRoot(input) {
             transferable: true,
             transferFailure: null,
             notebookRemovals: [],
-            detection: input.suspicion ? planGroundDetection({
+            detection: input.suspicion && plansSendRecords ? planGroundDetection({
                 rootId: rootUUID,
                 suspicion: input.suspicion,
                 before: existingRows.map(portableRecord),
@@ -3742,6 +4016,11 @@ async function reconcileRoot(input) {
         return [...new Set(paths)].sort();
     };
     let visitedEntries = 0;
+    // File captures overlap reads and hashing across a bounded pool while the
+    // directory traversal itself stays ordered and serial. Each task settles
+    // its own entry in place; every task is awaited before entries are read.
+    const captureTasks = [];
+    const captureGate = concurrencyGate(WALK_CAPTURE_CONCURRENCY);
     const visit = async (directory, parentUUID, parentType, base = "", activeRepository = parentType === "repo.git"
         ? {
             root: directory,
@@ -3817,6 +4096,7 @@ async function reconcileRoot(input) {
             let type;
             let payloadVersion = null;
             let linkTarget;
+            let deferredCapture = false;
             let contentVerifiedAtMs = existing?.contentVerifiedAtMs ?? null;
             if (!observe && existing && !stats.isDirectory()) {
                 type = existing.type;
@@ -3842,7 +4122,7 @@ async function reconcileRoot(input) {
                         linkTarget = readlinkSync(absolutePath);
                         const bytes = Buffer.from(linkTarget, "utf8");
                         payloadVersion = sha256Hex(bytes);
-                        if (!activeRepository)
+                        if (!activeRepository && plansSendRecords)
                             sealCapturedArtifact(cacheDir, {
                                 entityId: uuid,
                                 entityType: type,
@@ -3862,9 +4142,10 @@ async function reconcileRoot(input) {
                 }
                 else {
                     evidence && (evidence.contentReads += 1);
-                    const captured = await captureContentFile(absolutePath, stats, activeRepository ? null : cacheDir);
-                    type = classifyFile({ binary: captured.binary });
-                    payloadVersion = captured.contentHash;
+                    // Provisional identity; the pooled capture scheduled below settles
+                    // type, content head, and fingerprint before entries are read.
+                    type = "file.binary";
+                    deferredCapture = true;
                 }
             }
             else {
@@ -3886,6 +4167,44 @@ async function reconcileRoot(input) {
                 ...(linkTarget !== undefined ? { linkTarget } : {}),
                 ...statFingerprint(stats),
             });
+            if (deferredCapture) {
+                const entry = entries[entries.length - 1];
+                captureTasks.push(captureGate(async () => {
+                    let current = stats;
+                    for (let attempt = 1;; attempt++) {
+                        try {
+                            const captured = await captureContentFile(absolutePath, current, activeRepository || !plansSendRecords ? null : cacheDir);
+                            entry.type = classifyFile({ binary: captured.binary });
+                            entry.payloadVersion = captured.contentHash;
+                            entry.contentVerifiedAtMs = Date.now();
+                            Object.assign(entry, statFingerprint(current));
+                            if (captured.bytes > CHUNK_BYTES) {
+                                largeManifests?.set(captured.contentHash, captured.manifest);
+                            }
+                            return;
+                        }
+                        catch (error) {
+                            if (!captureChurn(error))
+                                throw error;
+                            if (attempt >= REGISTER_STALE_CAPTURE_ATTEMPTS) {
+                                throw new StaleCaptureError(`${absolutePath} kept changing while being captured`, { cause: error });
+                            }
+                            // The file moved mid-read. Capture what stands there now —
+                            // the walk publishes point-in-time truth, not the first bytes
+                            // it happened to observe.
+                            try {
+                                current = lstatSync(absolutePath);
+                            }
+                            catch (statError) {
+                                throw new StaleCaptureError(`${absolutePath} disappeared during capture`, { cause: statError });
+                            }
+                            if (!current.isFile()) {
+                                throw new StaleCaptureError(`${absolutePath} is no longer a file`, { cause: error });
+                            }
+                        }
+                    }
+                }));
+            }
             if (stats.isDirectory() && !stats.isSymbolicLink()) {
                 const childRailChanged = existing !== undefined && existing.type !== type;
                 await visit(absolutePath, uuid, type, relativePath, type === "repo.git"
@@ -3899,6 +4218,7 @@ async function reconcileRoot(input) {
         }
     };
     await visit(rootPath, rootUUID, rootType);
+    await Promise.all(captureTasks);
     // When every entry sits at its stored address with its stored type and
     // physical fingerprint (honoring any fixed UUID), path-first claiming makes
     // the multi-pass reconciliation the identity map — resolve directly. Any
@@ -4285,7 +4605,9 @@ async function reconcileRoot(input) {
     const before = existingRows.map(portableRecord);
     const beforeByUuid = new Map(before.map((record) => [record.uuid, record]));
     const entryByUuid = new Map(entries.map((entry) => [entry.uuid, entry]));
-    const detected = rows.map((row) => {
+    // Replays exist to mint Send records; a scan that plans none builds none —
+    // and its walk staged no cache bytes for replays to read.
+    const detected = !plansSendRecords ? [] : rows.map((row) => {
         const base = beforeByUuid.get(row.record.uuid) ?? null;
         const entry = entryByUuid.get(row.record.uuid);
         if (row.record.type !== "repo.git" && entry && territory.ownerOf(entry)) {
@@ -4380,7 +4702,7 @@ async function reconcileRoot(input) {
         transferable: true,
         transferFailure: null,
         notebookRemovals,
-        detection: input.suspicion ? planGroundDetection({
+        detection: input.suspicion && plansSendRecords ? planGroundDetection({
             rootId: rootUUID,
             suspicion: input.suspicion,
             before: plannedBefore,
@@ -5087,4 +5409,25 @@ async function boundedForEach(items, concurrency, perform) {
     };
     await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, () => worker()));
 }
+/** Admit queued async tasks with at most `limit` in flight. Scheduling never
+ * blocks the caller; each task's settlement is its returned promise. The
+ * admitted task re-checks the bound because a released slot may be claimed
+ * synchronously before a woken waiter resumes. */
+function concurrencyGate(limit) {
+    let active = 0;
+    const waiting = [];
+    return async (task) => {
+        while (active >= limit) {
+            await new Promise((grant) => waiting.push(grant));
+        }
+        active += 1;
+        try {
+            return await task();
+        }
+        finally {
+            active -= 1;
+            waiting.shift()?.();
+        }
+    };
+}
 //# sourceMappingURL=user-ground-host.js.map