@amalgm/shell 0.1.110 → 0.1.112

package/dist/user-ground-host.js

@@ -55,6 +55,15 @@ const WALK_CAPTURE_CONCURRENCY = 8;
 const REGISTER_STALE_CAPTURE_ATTEMPTS = 3;
 const DOWNLOAD_CONTENT_RETRY_ATTEMPTS = 3;
 const APPLY_GROUND_WAIT_TIMEOUT_MS = 15_000;
+function loadSnapshotPublication(entry) {
+    const snapshotRecords = snapshotFromRecords((JSON.parse(entry.snapshotBlob.toString("utf8")).records ?? [])).records;
+    const uploadIds = new Set(entry.uploadUuids);
+    return {
+        ...entry,
+        snapshotRecords,
+        uploadRecords: snapshotRecords.filter((record) => uploadIds.has(record.uuid)),
+    };
+}
 const GROUND_ROW_COLUMNS = [
     "uuid", "resource_id", "root_uuid", "type", "parent_uuid", "name", "status", "version",
     "payload_version", "transport_version", "relative_path", "absolute_path", "device_number",
@@ -196,6 +205,11 @@ export class UserGroundHost {
     stage(input) {
         emitFilesStage(this.options.onFilesStage, input);
     }
+    /** Whether a counter worth real time on the critical path may be computed. */
+    measuring() {
+        return this.options.filesTraceActive?.()
+            ?? (this.options.onFilesStage !== undefined || this.options.onDetectScan !== undefined);
+    }
     reportDetectScan(evidence) {
         this.options.onDetectScan?.(evidence);
         this.stage({
@@ -213,7 +227,19 @@ export class UserGroundHost {
                 gitInspections: evidence.gitInspections,
                 repositoryCaptures: evidence.repositoryCaptures,
                 records: evidence.records ?? 0,
-                recordBytes: evidence.recordBytes ?? 0,
+                ...(evidence.recordBytes === undefined ? {} : { recordBytes: evidence.recordBytes }),
+                // Where the scan actually went. `captureBusyMs / captureMs` is the
+                // capture pool's occupancy; at ~1 the pool ran one file at a time.
+                walkMs: Math.round(evidence.walkMs ?? 0),
+                gitMs: Math.round(evidence.gitMs ?? 0),
+                captureMs: Math.round(evidence.captureMs ?? 0),
+                captureBusyMs: Math.round(evidence.captureBusyMs ?? 0),
+                captureBytes: evidence.captureBytes ?? 0,
+                repoIdentityMs: Math.round(evidence.repositoryIdentityMs ?? 0),
+                repoCaptureMs: Math.round(evidence.repositoryCaptureMs ?? 0),
+                repoSealMs: Math.round(evidence.repositorySealMs ?? 0),
+                reconcileMs: Math.round(evidence.reconcileMs ?? 0),
+                persistMs: Math.round(evidence.persistMs ?? 0),
             },
         });
     }
@@ -611,6 +637,7 @@ export class UserGroundHost {
                         database: this.databasePath(identity),
                         cacheDir: this.cacheDir(identity),
                         onScan: (evidence) => this.reportDetectScan(evidence),
+                        measuring: this.measuring(),
                         registrationWorkspaceId: workspaceId,
                         suspicions: new Map(observations.map((observation) => [observation.directory, observation.suspicion])),
                     });
@@ -1128,6 +1155,7 @@ export class UserGroundHost {
                 await reconcileGround({
                     identity, userRoot, database, cacheDir,
                     onScan: (evidence) => this.reportDetectScan(evidence),
+                    measuring: this.measuring(),
                 });
                 return localValue(identity, userRoot, database);
             },
@@ -1842,6 +1870,7 @@ export class UserGroundHost {
                 database: this.databasePath(identity),
                 cacheDir: this.cacheDir(identity),
                 onScan: (evidence) => this.reportDetectScan(evidence),
+                measuring: this.measuring(),
                 suspicions: reconcileSuspicions,
                 coreScan,
             });
@@ -1939,7 +1968,7 @@ export class UserGroundHost {
             headVersion: first.baseVersion,
             checksum: "",
             deliveryWatermark: first.deliveryWatermark,
-            records: snapshotFromRecords(JSON.parse(first.snapshotJson).records || []).records,
+            records: loadSnapshotPublication(first).snapshotRecords,
         };
         try {
             await this.publishPendingSnapshots(identity);
@@ -1990,45 +2019,65 @@ export class UserGroundHost {
         const state = this.cloudState;
         if (!state)
             throw new Error("cloud state is unavailable for graph publication");
-        const officialRecords = recordsAtDeliveryPrefix(state.records, readAcceptedResults(this.databasePath(identity), state.resourceId, state.deliveryWatermark, deliveryWatermark));
-        const localRecords = recordsRetainingMissingEvidence(readGroundRowsForRoots(this.databasePath(identity), "entities", publicationRootIds)
+        // Graph preparation is the leg between a committed local ground and the
+        // first wire frame. It is pure CPU and SQLite, so it is measured by its
+        // own parts: whoever reads this ledger must see which part is slow.
+        const preparationStarted = performance.now();
+        const leg = {};
+        const timed = (name, work) => {
+            const started = performance.now();
+            const value = work();
+            leg[`${name}Ms`] = performance.now() - started;
+            return value;
+        };
+        if (trace?.journey === "register") {
+            this.stage({
+                primitive: "register",
+                stage: "graph-preparation",
+                status: "started",
+                ...(trace.workspaceId ? { workspaceId: trace.workspaceId } : {}),
+            });
+        }
+        const officialRecords = timed("officialRows", () => recordsAtDeliveryPrefix(state.records, readAcceptedResults(this.databasePath(identity), state.resourceId, state.deliveryWatermark, deliveryWatermark)));
+        const localRecords = timed("groundRows", () => recordsRetainingMissingEvidence(readGroundRowsForRoots(this.databasePath(identity), "entities", publicationRootIds)
             .map(portableRecord), readGroundRowsForRoots(this.databasePath(identity), "detection_notebook", publicationRootIds)
-            .map(portableRecord));
-        const merged = mergeMaterializedRoots(officialRecords, localRecords);
-        const traveling = travelingRecords(merged, sha256Hex);
+            .map(portableRecord)));
+        const merged = timed("merge", () => mergeMaterializedRoots(officialRecords, localRecords));
+        const traveling = timed("project", () => travelingRecords(merged, sha256Hex));
         const impossibleGitLeaf = traveling.find((record) => (record.type === "file.text" || record.type === "file.binary" || record.type === "link")
             && record.payloadVersion?.startsWith("git:"));
         if (impossibleGitLeaf) {
             const parent = merged.find((record) => record.uuid === impossibleGitLeaf.parentUUID);
             throw new Error(`repository-owned leaf escaped its rail: ${impossibleGitLeaf.name} parent=${parent?.type ?? "missing"}`);
         }
-        const snapshot = snapshotFromRecords(traveling);
-        const snapshotJson = stableJson(snapshot);
-        const checksum = sha256Hex(snapshotJson);
+        const snapshot = timed("normalize", () => snapshotFromRecords(traveling));
+        // ONE canonical serialization: these exact bytes are the journal blob
+        // and the checksum's input; they are never re-derived or re-parsed on
+        // the in-process path.
+        const snapshotBlob = timed("serialize", () => Buffer.from(stableJson(snapshot), "utf8"));
+        const checksum = timed("checksum", () => sha256Hex(snapshotBlob));
         const localIds = new Set(localRecords.map((record) => record.uuid));
         // Graph membership is never proof of sealed cargo: a record in the cloud
         // graph may name content sealed only under a prior content contract,
         // whose namespace the current readers never touch. Only the authority's
-        // (resource, hash, contract) seal evidence may skip an upload — and the
-        // question is asked even when the graph itself is unchanged, so Register
-        // always re-establishes cargo closure before returning.
-        const cargo = snapshot.records.flatMap((record) => {
-            if (!localIds.has(record.uuid))
-                return [];
-            const artifact = artifactForRecord(record);
-            return artifact ? [{ record, contentHash: artifact.contentHash }] : [];
-        });
-        const sealedArtifacts = await this.sealedContentHashes(state.resourceId, [...new Set(cargo.map((entry) => entry.contentHash))]);
-        const uploadRecords = cargo
-            .filter((entry) => !sealedArtifacts.has(entry.contentHash))
-            .map((entry) => entry.record);
+        // (resource, hash, contract) seal evidence may skip an upload — the
+        // sealed-first upload asks that exact question itself and moves only
+        // what is unsealed, so Register always re-establishes cargo closure
+        // before returning, even when the graph itself is unchanged.
+        const cargoRecords = snapshot.records.filter((record) => localIds.has(record.uuid) && artifactForRecord(record) !== null);
         if (checksum === state.checksum && deliveryWatermark === state.deliveryWatermark) {
+            this.finishPreparation(trace, preparationStarted, leg, {
+                records: snapshot.records.length,
+                snapshotBytes: snapshotBlob.byteLength,
+                cargoRecords: cargoRecords.length,
+                graphUnchanged: true,
+            });
             // The graph is already committed; only cargo can be missing. Repair
             // uploads need no journal row — a crash simply re-runs the same
             // repair on the next Register.
-            if (uploadRecords.length > 0) {
+            if (cargoRecords.length > 0) {
                 try {
-                    await this.uploadSnapshotContent(identity, state.resourceId, uploadRecords, trace, manifestHints);
+                    await this.uploadSnapshotContent(identity, state.resourceId, cargoRecords, trace, manifestHints);
                 }
                 catch (error) {
                     throw pipelineStageError("cloud upload", error);
@@ -2036,30 +2085,68 @@ export class UserGroundHost {
             }
             return;
         }
-        const replacementRootIds = localRecords
-            .filter((record) => record.parentUUID === null)
-            .map((record) => record.uuid);
-        const replacementRoots = new Set(replacementRootIds);
-        const rootOf = recordRootResolver(snapshot.records);
-        const replacementRecords = snapshot.records.filter((record) => {
-            const root = rootOf(record);
-            return root !== null && replacementRoots.has(root);
+        const replacement = timed("replacement", () => {
+            const rootIds = localRecords
+                .filter((record) => record.parentUUID === null)
+                .map((record) => record.uuid);
+            const roots = new Set(rootIds);
+            const rootOf = recordRootResolver(snapshot.records);
+            return rootReplacementFromRecords(rootIds, snapshot.records.filter((record) => {
+                const root = rootOf(record);
+                return root !== null && roots.has(root);
+            }));
         });
-        const replacement = rootReplacementFromRecords(replacementRootIds, replacementRecords);
-        supersedeSnapshotJournal(this.databasePath(identity), {
+        // The operation's canonical bytes: staged, hashed, and submitted as-is.
+        const operationBlob = timed("operation", () => Buffer.from(stableJson(replacement), "utf8"));
+        const entry = {
             mutationId: randomUUID(),
             resourceId: state.resourceId,
             authorityEpoch: state.authorityEpoch,
             baseVersion: state.headVersion,
             snapshotChecksum: checksum,
-            snapshotJson,
             deliveryWatermark,
-            uploadRecords,
+            operationKind: replacement.kind,
             replacementRootIds: replacement.rootIds,
-            replacementRecords: replacement.records,
+            uploadUuids: cargoRecords.map((record) => record.uuid),
+            snapshotBlob,
+            operationBlob,
             status: "pending",
+            submitted: false,
+        };
+        timed("journal", () => supersedeSnapshotJournal(this.databasePath(identity), entry));
+        this.finishPreparation(trace, preparationStarted, leg, {
+            records: snapshot.records.length,
+            snapshotBytes: snapshotBlob.byteLength,
+            operationBytes: operationBlob.byteLength,
+            operationRoots: replacement.rootIds.length,
+            cargoRecords: cargoRecords.length,
+            graphUnchanged: false,
+        });
+        // Publish the freshly journaled intent directly: the records are already
+        // in memory and the operation bytes already exist — nothing is re-read,
+        // re-parsed, or re-serialized between prepare and the wire.
+        await this.publishLoadedSnapshot(identity, {
+            ...entry,
+            snapshotRecords: snapshot.records,
+            uploadRecords: cargoRecords,
+        }, trace, manifestHints);
+    }
+    /** Close the graph-preparation stage with every leg it spent, so a slow
+     * preparation names the slow part instead of one opaque number. */
+    finishPreparation(trace, startedAt, legs, counters) {
+        if (trace?.journey !== "register")
+            return;
+        this.stage({
+            primitive: "register",
+            stage: "graph-preparation",
+            status: "completed",
+            durationMs: performance.now() - startedAt,
+            ...(trace.workspaceId ? { workspaceId: trace.workspaceId } : {}),
+            measurements: {
+                ...counters,
+                ...Object.fromEntries(Object.entries(legs).map(([name, value]) => [name, Math.round(value)])),
+            },
         });
-        await this.publishPendingSnapshots(identity, trace, manifestHints);
     }
     /** Which of these heads does the authority hold sealed under the current
      * content contract? Batched so a whole workspace costs a handful of
@@ -2091,87 +2178,111 @@ export class UserGroundHost {
             // snapshot superseding it can publish this resource again.
             if (pending.status === "rejected")
                 continue;
-            const snapshot = snapshotFromRecords(JSON.parse(pending.snapshotJson).records || []);
-            const replacement = rootReplacementFromRecords(pending.replacementRootIds, pending.replacementRecords);
-            try {
-                await this.uploadSnapshotContent(identity, pending.resourceId, pending.uploadRecords, trace, manifestHints);
-            }
-            catch (error) {
-                // An unsubmitted pending row is a local intent the authority has
-                // never seen. When its captured ground moved before upload, the
-                // intent is simply stale: delete it and let the caller re-derive
-                // one from current ground. A submitted row never lands here — its
-                // upload sealed completely before the first submit frame left.
-                if (staleCapture(error) && !pending.submitted) {
-                    deleteJournalEntry(this.databasePath(identity), pending.mutationId);
-                }
-                throw pipelineStageError("cloud upload", error);
+            await this.publishLoadedSnapshot(identity, loadSnapshotPublication(pending), trace, manifestHints);
+        }
+    }
+    async publishLoadedSnapshot(identity, publication, trace, manifestHints) {
+        try {
+            await this.uploadSnapshotContent(identity, publication.resourceId, publication.uploadRecords, trace, manifestHints);
+        }
+        catch (error) {
+            // An unsubmitted pending row is a local intent the authority has
+            // never seen. When its captured ground moved before upload, the
+            // intent is simply stale: delete it and let the caller re-derive
+            // one from current ground. A submitted row never lands here — its
+            // upload sealed completely before the first submit frame left.
+            if (staleCapture(error) && !publication.submitted) {
+                deleteJournalEntry(this.databasePath(identity), publication.mutationId);
             }
-            let frame;
-            const graphCommitStarted = performance.now();
+            throw pipelineStageError("cloud upload", error);
+        }
+        let frame;
+        const graphCommitStarted = performance.now();
+        if (trace?.journey === "register") {
+            this.stage({
+                primitive: "register",
+                stage: "cloud-graph-commit",
+                status: "started",
+                ...(trace.workspaceId ? { workspaceId: trace.workspaceId } : {}),
+                ...(trace.mutationId ? { mutationId: trace.mutationId } : {}),
+            });
+        }
+        const legMs = {};
+        const local = (name, work) => {
+            const at = performance.now();
+            const value = work();
+            legMs[`${name}Ms`] = performance.now() - at;
+            return value;
+        };
+        if (!publication.submitted) {
+            local("markSubmitted", () => markSnapshotJournalSubmitted(this.databasePath(identity), publication.mutationId));
+        }
+        try {
+            frame = await submitMutationOperation(this.wire, {
+                resourceId: publication.resourceId,
+                authorityEpoch: publication.authorityEpoch,
+                mutationId: publication.mutationId,
+                deviceId: identity.deviceId,
+                baseVersion: publication.baseVersion,
+                contract: ENTITY_CLOUD_CONTRACT,
+                schemaVersion: ENTITY_CLOUD_SCHEMA_VERSION,
+                operationKind: publication.operationKind,
+                deliveryWatermark: publication.deliveryWatermark,
+            }, publication.operationBlob, (leg, durationMs) => { legMs[`${leg}Ms`] = durationMs; });
+        }
+        catch (error) {
             if (trace?.journey === "register") {
                 this.stage({
                     primitive: "register",
                     stage: "cloud-graph-commit",
-                    status: "started",
+                    status: "failed",
                     ...(trace.workspaceId ? { workspaceId: trace.workspaceId } : {}),
-                    ...(trace.mutationId ? { mutationId: trace.mutationId } : {}),
+                    durationMs: performance.now() - graphCommitStarted,
                 });
             }
-            if (!pending.submitted) {
-                markSnapshotJournalSubmitted(this.databasePath(identity), pending.mutationId);
-            }
-            try {
-                frame = await submitMutationOperation(this.wire, {
-                    resourceId: pending.resourceId,
-                    authorityEpoch: pending.authorityEpoch,
-                    mutationId: pending.mutationId,
-                    deviceId: identity.deviceId,
-                    baseVersion: pending.baseVersion,
-                    contract: ENTITY_CLOUD_CONTRACT,
-                    schemaVersion: ENTITY_CLOUD_SCHEMA_VERSION,
-                    operationKind: replacement.kind,
-                    deliveryWatermark: pending.deliveryWatermark,
-                }, replacement);
-            }
-            catch (error) {
-                if (trace?.journey === "register") {
-                    this.stage({
-                        primitive: "register",
-                        stage: "cloud-graph-commit",
-                        status: "failed",
-                        ...(trace.workspaceId ? { workspaceId: trace.workspaceId } : {}),
-                        durationMs: performance.now() - graphCommitStarted,
-                    });
-                }
-                // A non-retryable error frame is the authority's answer: this exact
-                // mutation is refused forever. Settle the row so it is never
-                // replayed and a newer snapshot may supersede it. Every other
-                // failure leaves the outcome unknown and the row pending.
-                if (error instanceof WireRequestError && error.retryable === false) {
-                    markSnapshotJournalRejected(this.databasePath(identity), pending.mutationId);
-                }
-                throw pipelineStageError("cloud graph commit", error);
+            // A non-retryable error frame is the authority's answer: this exact
+            // mutation is refused forever. Settle the row so it is never
+            // replayed and a newer snapshot may supersede it. Every other
+            // failure leaves the outcome unknown and the row pending.
+            if (error instanceof WireRequestError && error.retryable === false) {
+                markSnapshotJournalRejected(this.databasePath(identity), publication.mutationId);
             }
-            if (trace?.journey === "register") {
-                this.stage({
-                    primitive: "register",
-                    stage: "cloud-graph-commit",
-                    status: "completed",
-                    ...(trace.workspaceId ? { workspaceId: trace.workspaceId } : {}),
-                    durationMs: performance.now() - graphCommitStarted,
-                    measurements: { version: Number(frame.version) },
-                });
+            throw pipelineStageError("cloud graph commit", error);
+        }
+        this.cloudState = {
+            resourceId: publication.resourceId,
+            authorityEpoch: Number(frame.authority_epoch),
+            headVersion: Number(frame.version),
+            checksum: publication.snapshotChecksum,
+            deliveryWatermark: Number(frame.delivery_watermark),
+            records: publication.snapshotRecords,
+        };
+        local("clearJournal", () => deleteJournalEntry(this.databasePath(identity), publication.mutationId));
+        if (trace?.journey === "register") {
+            // The authority reports where its side of the commit went; carrying
+            // its legs here gives one ledger line the whole story: local journal
+            // marks, wire time, gateway assemble/validate, and the database RPC.
+            for (const [wire, leg] of [
+                ["assemble_ms", "serverAssembleMs"],
+                ["validate_ms", "serverValidateMs"],
+                ["database_ms", "serverDatabaseMs"],
+            ]) {
+                if (typeof frame[wire] === "number")
+                    legMs[leg] = frame[wire];
             }
-            this.cloudState = {
-                resourceId: pending.resourceId,
-                authorityEpoch: Number(frame.authority_epoch),
-                headVersion: Number(frame.version),
-                checksum: pending.snapshotChecksum,
-                deliveryWatermark: Number(frame.delivery_watermark),
-                records: snapshot.records,
-            };
-            deleteJournalEntry(this.databasePath(identity), pending.mutationId);
+            this.stage({
+                primitive: "register",
+                stage: "cloud-graph-commit",
+                status: "completed",
+                ...(trace.workspaceId ? { workspaceId: trace.workspaceId } : {}),
+                durationMs: performance.now() - graphCommitStarted,
+                measurements: {
+                    version: Number(frame.version),
+                    operationBytes: publication.operationBlob.byteLength,
+                    ...Object.fromEntries(Object.entries(legMs)
+                        .map(([name, value]) => [name, Math.round(value)])),
+                },
+            });
         }
     }
 }
@@ -2264,12 +2375,142 @@ function assertHealthyWatch(evidence, rootId) {
  * file over a dozen times; the file itself is never deleted by the host, so
  * every later open needs only the connection and its pragmas. */
 const migratedDatabases = new Set();
-function initializeDatabase(file) {
+/** The journal's mutable facts and its immutable payload live in separate
+ * tables on purpose: SQLite rewrites a row's entire record — overflow pages
+ * included — on any column update, so flipping submitted_at on a row that
+ * carried a register-scale snapshot cost a full multi-megabyte rewrite
+ * through the WAL at synchronous=FULL (measured ~7.5s of the production
+ * cloud-commit stage on the 1-GB machine). The blob row is written exactly
+ * once and read only on restart replay; every status transition touches only
+ * the small row. */
+const SNAPSHOT_PUBLICATIONS_SCHEMA = `
+    CREATE TABLE IF NOT EXISTS snapshot_publications (
+      sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+      mutation_id TEXT NOT NULL UNIQUE,
+      resource_id TEXT NOT NULL,
+      meta_json TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'rejected')),
+      submitted_at INTEGER
+    );
+    CREATE TABLE IF NOT EXISTS snapshot_publication_blobs (
+      mutation_id TEXT PRIMARY KEY,
+      snapshot_blob BLOB NOT NULL,
+      operation_blob BLOB NOT NULL
+    );`;
+/** Converts an old-shape publication journal (one nested publication_json
+ * text per row) into the blob journal, atomically, preserving every row's
+ * meaning. A pending row may be a submitted mutation whose outcome exists
+ * only at the authority — dropping it would violate the retry law that
+ * recovers a lost acknowledgement — so conversion is structural: the nested
+ * snapshot text becomes the snapshot blob verbatim, the stored replacement
+ * becomes the operation blob, and semantic judgment stays where it always
+ * was, with the reader (an unlawful row still blocks registration rather
+ * than being silently replaced).
+ *
+ * The transform runs entirely inside SQLite. A production journal row is a
+ * register-scale graph serialized three times over — the exact text whose
+ * repeated JavaScript materialization blew the 512 MB heap — so no part of
+ * it may ever become a JavaScript value here: json_extract lifts the nested
+ * snapshot text straight into its blob, and the meta and operation rows are
+ * json_object over subtrees, all in engine memory outside the V8 heap.
+ *
+ * Tables older than the three-state journal carry no status or submitted_at;
+ * their rows were written before the pre-submit durability mark existed, so
+ * the only safe reading is "possibly submitted": keep them pending and
+ * marked submitted, which replays the same mutation id — always idempotent —
+ * and never supersedes. A row whose publication_json does not parse fails
+ * the open loudly with the journal intact; nothing is ever deleted on a
+ * conversion failure. */
+function convertLegacySnapshotJournal(database, columns) {
+    database.transaction(() => {
+        database.exec("ALTER TABLE snapshot_publications RENAME TO snapshot_publications_legacy");
+        database.exec(SNAPSHOT_PUBLICATIONS_SCHEMA);
+        database.exec(`
+      INSERT INTO snapshot_publications(
+        mutation_id, resource_id, meta_json, created_at, status, submitted_at
+      )
+      SELECT
+        mutation_id,
+        resource_id,
+        json_object(
+          'authorityEpoch', json_extract(publication_json, '$.authorityEpoch'),
+          'baseVersion', json_extract(publication_json, '$.baseVersion'),
+          'deliveryWatermark', json_extract(publication_json, '$.deliveryWatermark'),
+          'snapshotChecksum', json_extract(publication_json, '$.snapshotChecksum'),
+          'operationKind', 'entity.roots.replace',
+          'replacementRootIds', json(json_extract(publication_json, '$.replacementRootIds')),
+          'uploadUuids', coalesce((
+            SELECT json_group_array(json_extract(uploaded.value, '$.uuid'))
+              FROM json_each(publication_json, '$.uploadRecords') AS uploaded
+          ), json_array())
+        ),
+        created_at,
+        ${columns.has("status") ? "CASE status WHEN 'rejected' THEN 'rejected' ELSE 'pending' END" : "'pending'"},
+        ${columns.has("submitted_at") ? "submitted_at" : "created_at"}
+      FROM snapshot_publications_legacy ORDER BY sequence
+    `);
+        database.exec(`
+      INSERT INTO snapshot_publication_blobs(mutation_id, snapshot_blob, operation_blob)
+      SELECT
+        mutation_id,
+        CAST(json_extract(publication_json, '$.snapshotJson') AS BLOB),
+        CAST(json_object(
+          'kind', 'entity.roots.replace',
+          'rootIds', json(json_extract(publication_json, '$.replacementRootIds')),
+          'records', json(json_extract(publication_json, '$.replacementRecords'))
+        ) AS BLOB)
+      FROM snapshot_publications_legacy ORDER BY sequence
+    `);
+        database.exec("DROP TABLE snapshot_publications_legacy");
+    })();
+}
+/** Converts the single-table blob journal (blobs stored on the publication
+ * row itself) into the split journal, atomically and entirely inside SQLite —
+ * the same engine-memory law as the nested-text conversion above. Every
+ * field already has its final meaning; the blobs simply move to their
+ * write-once table so status transitions stop rewriting them. */
+function splitSnapshotJournalBlobs(database) {
+    database.transaction(() => {
+        database.exec("ALTER TABLE snapshot_publications RENAME TO snapshot_publications_legacy");
+        database.exec(SNAPSHOT_PUBLICATIONS_SCHEMA);
+        database.exec(`
+      INSERT INTO snapshot_publications(
+        mutation_id, resource_id, meta_json, created_at, status, submitted_at
+      )
+      SELECT mutation_id, resource_id, meta_json, created_at, status, submitted_at
+        FROM snapshot_publications_legacy ORDER BY sequence
+    `);
+        database.exec(`
+      INSERT INTO snapshot_publication_blobs(mutation_id, snapshot_blob, operation_blob)
+      SELECT mutation_id, snapshot_blob, operation_blob
+        FROM snapshot_publications_legacy ORDER BY sequence
+    `);
+        database.exec("DROP TABLE snapshot_publications_legacy");
+    })();
+}
+/** The single opener and schema-migration entry for a user ground database.
+ * Exported so the upgrade path is provable in isolation — the journal
+ * conversion law test opens a legacy file through this exact entry inside a
+ * heap-capped child process. */
+export function initializeDatabase(file) {
     ensurePrivateDir(dirname(file));
     const database = new Database(file);
     database.pragma("busy_timeout = 5000");
     database.pragma("journal_mode = WAL");
     database.pragma("synchronous = FULL");
+    // The legacy probe runs on every open, before the migration memo: a journal
+    // row may be a submitted publication whose outcome exists only at the
+    // authority, so an old-shape table must convert — never drop — no matter
+    // how this file arrived at this process. One PRAGMA against the in-memory
+    // catalog costs nothing next to the connection open itself.
+    const publicationColumns = new Set(database.prepare("PRAGMA table_info(snapshot_publications)").all().map(({ name }) => name));
+    if (publicationColumns.has("publication_json")) {
+        convertLegacySnapshotJournal(database, publicationColumns);
+    }
+    else if (publicationColumns.has("snapshot_blob")) {
+        splitSnapshotJournalBlobs(database);
+    }
     if (migratedDatabases.has(file))
         return database;
     database.exec(`
@@ -2361,15 +2602,7 @@ function initializeDatabase(file) {
       authority_id TEXT PRIMARY KEY,
       delivery_sequence INTEGER NOT NULL CHECK(delivery_sequence >= 0)
     );
-    CREATE TABLE IF NOT EXISTS snapshot_publications (
-      sequence INTEGER PRIMARY KEY AUTOINCREMENT,
-      mutation_id TEXT NOT NULL UNIQUE,
-      resource_id TEXT NOT NULL,
-      publication_json TEXT NOT NULL,
-      created_at INTEGER NOT NULL,
-      status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'rejected')),
-      submitted_at INTEGER
-    );
+    ${SNAPSHOT_PUBLICATIONS_SCHEMA}
     CREATE TABLE IF NOT EXISTS workspace_add_intents (
       workspace_uuid TEXT PRIMARY KEY,
       destination_path TEXT NOT NULL UNIQUE,
@@ -2405,13 +2638,6 @@ function initializeDatabase(file) {
     if (!inboxColumns.has("resolved_at")) {
         database.exec("ALTER TABLE record_inbox ADD COLUMN resolved_at INTEGER");
     }
-    const publicationColumns = new Set(database.prepare("PRAGMA table_info(snapshot_publications)").all().map(({ name }) => name));
-    if (!publicationColumns.has("status")) {
-        database.exec("ALTER TABLE snapshot_publications ADD COLUMN status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'rejected'))");
-    }
-    if (!publicationColumns.has("submitted_at")) {
-        database.exec("ALTER TABLE snapshot_publications ADD COLUMN submitted_at INTEGER");
-    }
     database.exec("DROP INDEX IF EXISTS record_inbox_delivery");
     database.exec("DROP TABLE IF EXISTS mutation_journal");
     migratedDatabases.add(file);
@@ -2861,34 +3087,46 @@ function readSnapshotPublications(file) {
     const database = initializeDatabase(file);
     try {
         return database.prepare(`
-      SELECT mutation_id AS mutationId, resource_id AS resourceId,
-             publication_json AS publicationJson, status,
-             submitted_at AS submittedAt
-        FROM snapshot_publications ORDER BY sequence
+      SELECT publications.mutation_id AS mutationId,
+             publications.resource_id AS resourceId,
+             publications.meta_json AS metaJson,
+             blobs.snapshot_blob AS snapshotBlob,
+             blobs.operation_blob AS operationBlob,
+             publications.status,
+             publications.submitted_at AS submittedAt
+        FROM snapshot_publications AS publications
+        LEFT JOIN snapshot_publication_blobs AS blobs USING (mutation_id)
+       ORDER BY publications.sequence
     `).all().map((row) => {
-            const publication = JSON.parse(row.publicationJson);
-            if (!Array.isArray(publication.uploadRecords)) {
-                throw new Error(`snapshot publication ${row.mutationId} has no exact upload subset`);
+            // A publication without its payload is damage, never a skippable row —
+            // silently dropping it would let a new publication supersede a
+            // submitted mutation whose outcome exists only at the authority.
+            if (!row.snapshotBlob || !row.operationBlob) {
+                throw new Error(`snapshot publication ${row.mutationId} has no journaled payload`);
             }
-            if (!Array.isArray(publication.replacementRootIds)
-                || !Array.isArray(publication.replacementRecords)) {
+            const meta = JSON.parse(row.metaJson);
+            // No lawful publication carries zero roots — rootReplacementFromRecords
+            // refuses them at build time, so a rootless row here is damage.
+            if (!Array.isArray(meta.replacementRootIds) || meta.replacementRootIds.length === 0
+                || !Array.isArray(meta.uploadUuids) || meta.operationKind !== "entity.roots.replace") {
                 throw new Error(`snapshot publication ${row.mutationId} has no exact root replacement`);
             }
-            const deliveryWatermark = Number(publication.deliveryWatermark);
+            const deliveryWatermark = Number(meta.deliveryWatermark);
             if (!Number.isSafeInteger(deliveryWatermark) || deliveryWatermark < 0) {
                 throw new Error(`snapshot publication ${row.mutationId} has no delivery watermark`);
             }
             return {
                 mutationId: row.mutationId,
                 resourceId: row.resourceId,
-                authorityEpoch: Number(publication.authorityEpoch),
-                baseVersion: Number(publication.baseVersion),
+                authorityEpoch: Number(meta.authorityEpoch),
+                baseVersion: Number(meta.baseVersion),
                 deliveryWatermark,
-                snapshotChecksum: String(publication.snapshotChecksum),
-                snapshotJson: String(publication.snapshotJson),
-                uploadRecords: snapshotFromRecords(publication.uploadRecords).records,
-                replacementRootIds: publication.replacementRootIds.map(String),
-                replacementRecords: snapshotFromRecords(publication.replacementRecords).records,
+                snapshotChecksum: String(meta.snapshotChecksum),
+                operationKind: meta.operationKind,
+                replacementRootIds: meta.replacementRootIds.map(String),
+                uploadUuids: meta.uploadUuids.map(String),
+                snapshotBlob: row.snapshotBlob,
+                operationBlob: row.operationBlob,
                 status: row.status === "rejected" ? "rejected" : "pending",
                 submitted: row.submittedAt !== null,
             };
@@ -3055,22 +3293,30 @@ function supersedeSnapshotJournal(file, entry) {
             if (unresolved) {
                 throw new Error("a submitted publication with an unknown outcome must resolve before supersession");
             }
+            database.prepare(`
+        DELETE FROM snapshot_publication_blobs WHERE mutation_id IN (
+          SELECT mutation_id FROM snapshot_publications WHERE resource_id = ?
+        )
+      `).run(entry.resourceId);
             database.prepare("DELETE FROM snapshot_publications WHERE resource_id = ?")
                 .run(entry.resourceId);
             database.prepare(`
         INSERT INTO snapshot_publications(
-          mutation_id, resource_id, publication_json, created_at
+          mutation_id, resource_id, meta_json, created_at
         ) VALUES (?, ?, ?, ?)
       `).run(entry.mutationId, entry.resourceId, stableJson({
                 authorityEpoch: entry.authorityEpoch,
                 baseVersion: entry.baseVersion,
                 deliveryWatermark: entry.deliveryWatermark,
                 snapshotChecksum: entry.snapshotChecksum,
-                snapshotJson: entry.snapshotJson,
-                uploadRecords: entry.uploadRecords,
+                operationKind: entry.operationKind,
                 replacementRootIds: entry.replacementRootIds,
-                replacementRecords: entry.replacementRecords,
+                uploadUuids: entry.uploadUuids,
             }), Date.now());
+            database.prepare(`
+        INSERT INTO snapshot_publication_blobs(mutation_id, snapshot_blob, operation_blob)
+        VALUES (?, ?, ?)
+      `).run(entry.mutationId, entry.snapshotBlob, entry.operationBlob);
         })();
     }
     finally {
@@ -3140,7 +3386,10 @@ function captureChurn(error) {
 function deleteJournalEntry(file, mutationId) {
     const database = initializeDatabase(file);
     try {
-        database.prepare("DELETE FROM snapshot_publications WHERE mutation_id = ?").run(mutationId);
+        database.transaction(() => {
+            database.prepare("DELETE FROM snapshot_publication_blobs WHERE mutation_id = ?").run(mutationId);
+            database.prepare("DELETE FROM snapshot_publications WHERE mutation_id = ?").run(mutationId);
+        })();
     }
     finally {
         database.close();
@@ -3520,7 +3769,7 @@ function materializedWorkspaceBindings(bindingDir) {
     return bindings.sort((left, right) => left.workspaceId.localeCompare(right.workspaceId));
 }
 async function reconcileGround(input) {
-    const { identity, userRoot, database, cacheDir, suspicions, coreScan, registrationWorkspaceId, onScan, } = input;
+    const { identity, userRoot, database, cacheDir, suspicions, coreScan, registrationWorkspaceId, onScan, measuring = false, } = input;
     const resourceId = privateEntityResourceId(identity.userId, sha256Hex);
     const bindingDir = workspaceBindingDir(userRoot, identity.deviceId);
     const boundRootEntries = materializedWorkspaceBindings(bindingDir);
@@ -3615,9 +3864,24 @@ async function reconcileGround(input) {
             contentReads: 0,
             gitInspections: 0,
             repositoryCaptures: 0,
+            walkMs: 0,
+            captureMs: 0,
+            captureBusyMs: 0,
+            captureBytes: 0,
+            gitMs: 0,
+            repositoryIdentityMs: 0,
+            repositoryCaptureMs: 0,
+            repositorySealMs: 0,
+            reconcileMs: 0,
+            persistMs: 0,
         };
         const started = performance.now();
-        const result = await reconcileRoot({ ...parameters, evidence: counters, materializedUUIDs });
+        const result = await reconcileRoot({
+            ...parameters,
+            evidence: counters,
+            measureEvidence: measuring,
+            materializedUUIDs,
+        });
         if (result.transferFailure !== null) {
             transferFailures.push({ rootId: parameters.rootUUID, reason: result.transferFailure });
         }
@@ -3655,7 +3919,14 @@ async function reconcileGround(input) {
             durationMs: performance.now() - started,
             plannedRows: proposals.length,
             records: proposals.length,
-            recordBytes: proposals.reduce((bytes, proposal) => bytes + encodedRecordBytes(parameters.resourceId, proposal), 0),
+            // Encoding every proposal to learn its wire size costs one record
+            // construction per entity — real time on the critical path of a cold
+            // Register. It is evidence, so it is paid only when read.
+            ...(measuring
+                ? {
+                    recordBytes: proposals.reduce((bytes, proposal) => bytes + encodedRecordBytes(parameters.resourceId, proposal), 0),
+                }
+                : {}),
         });
         // Each root commits its local projection before Detect yields. Native
         // callbacks can therefore preserve new suspicion between large roots.
@@ -3754,7 +4025,7 @@ async function reconcileGround(input) {
     };
 }
 async function reconcileRoot(input) {
-    const { identity, resourceId, rootUUID, rootName, rootPath, rootType, database, cacheDir, policy, bindingDir, suspects = null, evidence, plansSendRecords, largeManifests, } = input;
+    const { identity, resourceId, rootUUID, rootName, rootPath, rootType, database, cacheDir, policy, bindingDir, suspects = null, evidence, measureEvidence = false, plansSendRecords, largeManifests, } = input;
     // Prior rows reach this scan from every binding this root encloses. A row's
     // stored relativePath is relative to the root that last committed it, which
     // is a different frame when an enclosing boundary was just registered
@@ -3927,6 +4198,33 @@ async function reconcileRoot(input) {
     // its own entry in place; every task is awaited before entries are read.
     const captureTasks = [];
     const captureGate = concurrencyGate(WALK_CAPTURE_CONCURRENCY);
+    // The scan's three costs are metadata traversal, content capture, and Git
+    // inspection. They interleave, so each is accumulated where it is spent
+    // rather than inferred from the total afterwards.
+    let captureOpenedAt = 0;
+    let captureClosedAt = 0;
+    const spent = (work, into) => {
+        if (!measureEvidence || !evidence)
+            return work();
+        const at = performance.now();
+        try {
+            return work();
+        }
+        finally {
+            evidence[into] += performance.now() - at;
+        }
+    };
+    const spentAsync = async (work, into) => {
+        if (!measureEvidence || !evidence)
+            return work();
+        const at = performance.now();
+        try {
+            return await work();
+        }
+        finally {
+            evidence[into] += performance.now() - at;
+        }
+    };
     const visit = async (directory, parentUUID, parentType, base = "", activeRepository = parentType === "repo.git"
         ? {
             root: directory,
@@ -3934,8 +4232,8 @@ async function reconcileRoot(input) {
             evidence: directory === rootPath ? rootRepositoryEvidence : null,
         }
         : null, forceObserve = rootRailChanged) => {
-        const children = readdirSync(directory, { withFileTypes: true })
-            .sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+        const children = spent(() => readdirSync(directory, { withFileTypes: true })
+            .sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0), "walkMs");
         for (const child of children) {
             // Every materialization boundary reserves its root .amalgm/ directory
             // for machine intents, staging, and recovery. This is structural host
@@ -3951,7 +4249,7 @@ async function reconcileRoot(input) {
             if (!policy(relativePath))
                 continue;
             const absolutePath = join(directory, child.name);
-            const stats = lstatSync(absolutePath);
+            const stats = spent(() => lstatSync(absolutePath), "walkMs");
             evidence && (evidence.entries += 1);
             // The walk is synchronous metadata work. Yield periodically so the
             // wire, Receive, and Apply keep running while a large root is proved.
@@ -3982,7 +4280,7 @@ async function reconcileRoot(input) {
             if (observe && repositoryPath && activeRepository && !activeRepository.evidence) {
                 evidence && (evidence.gitInspections += 1);
                 try {
-                    activeRepository.evidence = inspectGitRegistration(activeRepository.root, activeRepository.evidencePaths);
+                    activeRepository.evidence = spent(() => inspectGitRegistration(activeRepository.root, activeRepository.evidencePaths), "gitMs");
                 }
                 catch {
                     // Classification already settled from the marker. If Git cannot
@@ -4075,11 +4373,19 @@ async function reconcileRoot(input) {
             });
             if (deferredCapture) {
                 const entry = entries[entries.length - 1];
+                if (measureEvidence && evidence && captureOpenedAt === 0)
+                    captureOpenedAt = performance.now();
                 captureTasks.push(captureGate(async () => {
+                    const taskStarted = measureEvidence ? performance.now() : 0;
                     let current = stats;
                     for (let attempt = 1;; attempt++) {
                         try {
                             const captured = await captureContentFile(absolutePath, current, activeRepository || !plansSendRecords ? null : cacheDir);
+                            if (measureEvidence && evidence) {
+                                evidence.captureBusyMs += performance.now() - taskStarted;
+                                evidence.captureBytes += captured.bytes;
+                                captureClosedAt = performance.now();
+                            }
                             entry.type = classifyFile({ binary: captured.binary });
                             entry.payloadVersion = captured.contentHash;
                             entry.contentVerifiedAtMs = Date.now();
@@ -4125,6 +4431,10 @@ async function reconcileRoot(input) {
     };
     await visit(rootPath, rootUUID, rootType);
     await Promise.all(captureTasks);
+    if (measureEvidence && evidence && captureOpenedAt !== 0) {
+        evidence.captureMs += captureClosedAt - captureOpenedAt;
+    }
+    const reconcileStarted = measureEvidence ? performance.now() : 0;
     // When every entry sits at its stored address with its stored type and
     // physical fingerprint (honoring any fixed UUID), path-first claiming makes
     // the multi-pass reconciliation the identity map — resolve directly. Any
@@ -4158,6 +4468,8 @@ async function reconcileRoot(input) {
         inode: entry.inode,
         ...(entry.fixedUUID ? { fixedUUID: entry.fixedUUID } : {}),
     })));
+    if (measureEvidence && evidence)
+        evidence.reconcileMs += performance.now() - reconcileStarted;
     const resolvedByProvisional = new Map();
     for (const entry of entries) {
         const resolved = resolvedIdentity.get(entry.relativePath) ?? entry.uuid;
@@ -4224,13 +4536,13 @@ async function reconcileRoot(input) {
             contentVerifiedAtMs: entry.contentVerifiedAtMs,
         };
     });
-    const persistCurrentRows = () => {
+    const persistCurrentRows = () => spent(() => {
         const rows = rowsFromEntries();
         if (input.suspicion === undefined) {
             persistRows(database, identity, resourceId, rootUUID, rows, existingRows);
         }
         return rows;
-    };
+    }, "persistMs");
     // Seal nested repositories first so their independent rows are complete
     // before the enclosing graph is persisted. Their state is not an input to
     // the enclosing identity map; only their address boundary is.
@@ -4358,7 +4670,7 @@ async function reconcileRoot(input) {
                 }
             }
             const fingerprintBefore = gitEvidenceFingerprint(repository.absolutePath);
-            let repoIdentity = await refreshRepositoryIdentity();
+            let repoIdentity = await spentAsync(refreshRepositoryIdentity, "repositoryIdentityMs");
             /* The rows and the transport identity are derived from the same fresh
              * worktree evidence. A later Watch ring for one of these dirty paths is
              * therefore ordinary equality, not a transport-only echo. */
@@ -4396,8 +4708,8 @@ async function reconcileRoot(input) {
             let captured = null;
             let coherent = false;
             for (let attempt = 0; attempt < 3; attempt += 1) {
-                captured = captureRepository(repository.absolutePath, repoIdentity, prior, previousIdentity);
-                const after = await refreshRepositoryIdentity();
+                captured = spent(() => captureRepository(repository.absolutePath, repoIdentity, prior, previousIdentity), "repositoryCaptureMs");
+                const after = await spentAsync(refreshRepositoryIdentity, "repositoryIdentityMs");
                 if (sameGitIdentity(after, repoIdentity)) {
                     repoIdentity = [...captured.identity];
                     coherent = true;
@@ -4419,15 +4731,18 @@ async function reconcileRoot(input) {
             }
             repository.payloadVersion = captured.stateId;
             repository.transportVersion = captured.transportVersion;
-            if (captured.bytes) {
-                sealCapturedArtifact(cacheDir, {
-                    entityId: repository.uuid,
-                    entityType: "repo.git",
-                    kind: "git",
-                    contentHash: captured.transportVersion,
-                }, captured.bytes);
-            }
-            const currentLayout = inspectRepositoryTransportFile(join(cacheDir, `${captured.transportVersion}.bin`));
+            const settled = captured;
+            const currentLayout = spent(() => {
+                if (settled.bytes) {
+                    sealCapturedArtifact(cacheDir, {
+                        entityId: repository.uuid,
+                        entityType: "repo.git",
+                        kind: "git",
+                        contentHash: settled.transportVersion,
+                    }, settled.bytes);
+                }
+                return inspectRepositoryTransportFile(join(cacheDir, `${settled.transportVersion}.bin`));
+            }, "repositorySealMs");
             replayByUuid.set(repository.uuid, {
                 kind: "repo.git",
                 stateId: currentLayout.stateId,