@amalgm/shell 0.1.111 → 0.1.112

package/dist/user-ground-host.js

@@ -205,6 +205,11 @@ export class UserGroundHost {
     stage(input) {
         emitFilesStage(this.options.onFilesStage, input);
     }
+    /** Whether a counter worth real time on the critical path may be computed. */
+    measuring() {
+        return this.options.filesTraceActive?.()
+            ?? (this.options.onFilesStage !== undefined || this.options.onDetectScan !== undefined);
+    }
     reportDetectScan(evidence) {
         this.options.onDetectScan?.(evidence);
         this.stage({
@@ -222,7 +227,19 @@ export class UserGroundHost {
                 gitInspections: evidence.gitInspections,
                 repositoryCaptures: evidence.repositoryCaptures,
                 records: evidence.records ?? 0,
-                recordBytes: evidence.recordBytes ?? 0,
+                ...(evidence.recordBytes === undefined ? {} : { recordBytes: evidence.recordBytes }),
+                // Where the scan actually went. `captureBusyMs / captureMs` is the
+                // capture pool's occupancy; at ~1 the pool ran one file at a time.
+                walkMs: Math.round(evidence.walkMs ?? 0),
+                gitMs: Math.round(evidence.gitMs ?? 0),
+                captureMs: Math.round(evidence.captureMs ?? 0),
+                captureBusyMs: Math.round(evidence.captureBusyMs ?? 0),
+                captureBytes: evidence.captureBytes ?? 0,
+                repoIdentityMs: Math.round(evidence.repositoryIdentityMs ?? 0),
+                repoCaptureMs: Math.round(evidence.repositoryCaptureMs ?? 0),
+                repoSealMs: Math.round(evidence.repositorySealMs ?? 0),
+                reconcileMs: Math.round(evidence.reconcileMs ?? 0),
+                persistMs: Math.round(evidence.persistMs ?? 0),
             },
         });
     }
@@ -620,6 +637,7 @@ export class UserGroundHost {
                         database: this.databasePath(identity),
                         cacheDir: this.cacheDir(identity),
                         onScan: (evidence) => this.reportDetectScan(evidence),
+                        measuring: this.measuring(),
                         registrationWorkspaceId: workspaceId,
                         suspicions: new Map(observations.map((observation) => [observation.directory, observation.suspicion])),
                     });
@@ -1137,6 +1155,7 @@ export class UserGroundHost {
                 await reconcileGround({
                     identity, userRoot, database, cacheDir,
                     onScan: (evidence) => this.reportDetectScan(evidence),
+                    measuring: this.measuring(),
                 });
                 return localValue(identity, userRoot, database);
             },
@@ -1851,6 +1870,7 @@ export class UserGroundHost {
                 database: this.databasePath(identity),
                 cacheDir: this.cacheDir(identity),
                 onScan: (evidence) => this.reportDetectScan(evidence),
+                measuring: this.measuring(),
                 suspicions: reconcileSuspicions,
                 coreScan,
             });
@@ -1999,24 +2019,43 @@ export class UserGroundHost {
         const state = this.cloudState;
         if (!state)
             throw new Error("cloud state is unavailable for graph publication");
-        const officialRecords = recordsAtDeliveryPrefix(state.records, readAcceptedResults(this.databasePath(identity), state.resourceId, state.deliveryWatermark, deliveryWatermark));
-        const localRecords = recordsRetainingMissingEvidence(readGroundRowsForRoots(this.databasePath(identity), "entities", publicationRootIds)
+        // Graph preparation is the leg between a committed local ground and the
+        // first wire frame. It is pure CPU and SQLite, so it is measured by its
+        // own parts: whoever reads this ledger must see which part is slow.
+        const preparationStarted = performance.now();
+        const leg = {};
+        const timed = (name, work) => {
+            const started = performance.now();
+            const value = work();
+            leg[`${name}Ms`] = performance.now() - started;
+            return value;
+        };
+        if (trace?.journey === "register") {
+            this.stage({
+                primitive: "register",
+                stage: "graph-preparation",
+                status: "started",
+                ...(trace.workspaceId ? { workspaceId: trace.workspaceId } : {}),
+            });
+        }
+        const officialRecords = timed("officialRows", () => recordsAtDeliveryPrefix(state.records, readAcceptedResults(this.databasePath(identity), state.resourceId, state.deliveryWatermark, deliveryWatermark)));
+        const localRecords = timed("groundRows", () => recordsRetainingMissingEvidence(readGroundRowsForRoots(this.databasePath(identity), "entities", publicationRootIds)
             .map(portableRecord), readGroundRowsForRoots(this.databasePath(identity), "detection_notebook", publicationRootIds)
-            .map(portableRecord));
-        const merged = mergeMaterializedRoots(officialRecords, localRecords);
-        const traveling = travelingRecords(merged, sha256Hex);
+            .map(portableRecord)));
+        const merged = timed("merge", () => mergeMaterializedRoots(officialRecords, localRecords));
+        const traveling = timed("project", () => travelingRecords(merged, sha256Hex));
         const impossibleGitLeaf = traveling.find((record) => (record.type === "file.text" || record.type === "file.binary" || record.type === "link")
             && record.payloadVersion?.startsWith("git:"));
         if (impossibleGitLeaf) {
             const parent = merged.find((record) => record.uuid === impossibleGitLeaf.parentUUID);
             throw new Error(`repository-owned leaf escaped its rail: ${impossibleGitLeaf.name} parent=${parent?.type ?? "missing"}`);
         }
-        const snapshot = snapshotFromRecords(traveling);
+        const snapshot = timed("normalize", () => snapshotFromRecords(traveling));
         // ONE canonical serialization: these exact bytes are the journal blob
         // and the checksum's input; they are never re-derived or re-parsed on
         // the in-process path.
-        const snapshotBlob = Buffer.from(stableJson(snapshot), "utf8");
-        const checksum = sha256Hex(snapshotBlob);
+        const snapshotBlob = timed("serialize", () => Buffer.from(stableJson(snapshot), "utf8"));
+        const checksum = timed("checksum", () => sha256Hex(snapshotBlob));
         const localIds = new Set(localRecords.map((record) => record.uuid));
         // Graph membership is never proof of sealed cargo: a record in the cloud
         // graph may name content sealed only under a prior content contract,
@@ -2027,6 +2066,12 @@ export class UserGroundHost {
         // before returning, even when the graph itself is unchanged.
         const cargoRecords = snapshot.records.filter((record) => localIds.has(record.uuid) && artifactForRecord(record) !== null);
         if (checksum === state.checksum && deliveryWatermark === state.deliveryWatermark) {
+            this.finishPreparation(trace, preparationStarted, leg, {
+                records: snapshot.records.length,
+                snapshotBytes: snapshotBlob.byteLength,
+                cargoRecords: cargoRecords.length,
+                graphUnchanged: true,
+            });
             // The graph is already committed; only cargo can be missing. Repair
             // uploads need no journal row — a crash simply re-runs the same
             // repair on the next Register.
@@ -2040,18 +2085,19 @@ export class UserGroundHost {
             }
             return;
         }
-        const replacementRootIds = localRecords
-            .filter((record) => record.parentUUID === null)
-            .map((record) => record.uuid);
-        const replacementRoots = new Set(replacementRootIds);
-        const rootOf = recordRootResolver(snapshot.records);
-        const replacementRecords = snapshot.records.filter((record) => {
-            const root = rootOf(record);
-            return root !== null && replacementRoots.has(root);
+        const replacement = timed("replacement", () => {
+            const rootIds = localRecords
+                .filter((record) => record.parentUUID === null)
+                .map((record) => record.uuid);
+            const roots = new Set(rootIds);
+            const rootOf = recordRootResolver(snapshot.records);
+            return rootReplacementFromRecords(rootIds, snapshot.records.filter((record) => {
+                const root = rootOf(record);
+                return root !== null && roots.has(root);
+            }));
         });
-        const replacement = rootReplacementFromRecords(replacementRootIds, replacementRecords);
         // The operation's canonical bytes: staged, hashed, and submitted as-is.
-        const operationBlob = Buffer.from(stableJson(replacement), "utf8");
+        const operationBlob = timed("operation", () => Buffer.from(stableJson(replacement), "utf8"));
         const entry = {
             mutationId: randomUUID(),
             resourceId: state.resourceId,
@@ -2067,7 +2113,15 @@ export class UserGroundHost {
             status: "pending",
             submitted: false,
         };
-        supersedeSnapshotJournal(this.databasePath(identity), entry);
+        timed("journal", () => supersedeSnapshotJournal(this.databasePath(identity), entry));
+        this.finishPreparation(trace, preparationStarted, leg, {
+            records: snapshot.records.length,
+            snapshotBytes: snapshotBlob.byteLength,
+            operationBytes: operationBlob.byteLength,
+            operationRoots: replacement.rootIds.length,
+            cargoRecords: cargoRecords.length,
+            graphUnchanged: false,
+        });
         // Publish the freshly journaled intent directly: the records are already
         // in memory and the operation bytes already exist — nothing is re-read,
         // re-parsed, or re-serialized between prepare and the wire.
@@ -2077,6 +2131,23 @@ export class UserGroundHost {
             uploadRecords: cargoRecords,
         }, trace, manifestHints);
     }
+    /** Close the graph-preparation stage with every leg it spent, so a slow
+     * preparation names the slow part instead of one opaque number. */
+    finishPreparation(trace, startedAt, legs, counters) {
+        if (trace?.journey !== "register")
+            return;
+        this.stage({
+            primitive: "register",
+            stage: "graph-preparation",
+            status: "completed",
+            durationMs: performance.now() - startedAt,
+            ...(trace.workspaceId ? { workspaceId: trace.workspaceId } : {}),
+            measurements: {
+                ...counters,
+                ...Object.fromEntries(Object.entries(legs).map(([name, value]) => [name, Math.round(value)])),
+            },
+        });
+    }
     /** Which of these heads does the authority hold sealed under the current
      * content contract? Batched so a whole workspace costs a handful of
      * frames; the answer is the only permission to skip an upload. */
@@ -2136,10 +2207,16 @@ export class UserGroundHost {
                 ...(trace.mutationId ? { mutationId: trace.mutationId } : {}),
             });
         }
+        const legMs = {};
+        const local = (name, work) => {
+            const at = performance.now();
+            const value = work();
+            legMs[`${name}Ms`] = performance.now() - at;
+            return value;
+        };
         if (!publication.submitted) {
-            markSnapshotJournalSubmitted(this.databasePath(identity), publication.mutationId);
+            local("markSubmitted", () => markSnapshotJournalSubmitted(this.databasePath(identity), publication.mutationId));
         }
-        const legMs = {};
         try {
             frame = await submitMutationOperation(this.wire, {
                 resourceId: publication.resourceId,
@@ -2172,7 +2249,27 @@ export class UserGroundHost {
             }
             throw pipelineStageError("cloud graph commit", error);
         }
+        this.cloudState = {
+            resourceId: publication.resourceId,
+            authorityEpoch: Number(frame.authority_epoch),
+            headVersion: Number(frame.version),
+            checksum: publication.snapshotChecksum,
+            deliveryWatermark: Number(frame.delivery_watermark),
+            records: publication.snapshotRecords,
+        };
+        local("clearJournal", () => deleteJournalEntry(this.databasePath(identity), publication.mutationId));
         if (trace?.journey === "register") {
+            // The authority reports where its side of the commit went; carrying
+            // its legs here gives one ledger line the whole story: local journal
+            // marks, wire time, gateway assemble/validate, and the database RPC.
+            for (const [wire, leg] of [
+                ["assemble_ms", "serverAssembleMs"],
+                ["validate_ms", "serverValidateMs"],
+                ["database_ms", "serverDatabaseMs"],
+            ]) {
+                if (typeof frame[wire] === "number")
+                    legMs[leg] = frame[wire];
+            }
             this.stage({
                 primitive: "register",
                 stage: "cloud-graph-commit",
@@ -2182,19 +2279,11 @@ export class UserGroundHost {
                 measurements: {
                     version: Number(frame.version),
                     operationBytes: publication.operationBlob.byteLength,
-                    ...legMs,
+                    ...Object.fromEntries(Object.entries(legMs)
+                        .map(([name, value]) => [name, Math.round(value)])),
                 },
             });
         }
-        this.cloudState = {
-            resourceId: publication.resourceId,
-            authorityEpoch: Number(frame.authority_epoch),
-            headVersion: Number(frame.version),
-            checksum: publication.snapshotChecksum,
-            deliveryWatermark: Number(frame.delivery_watermark),
-            records: publication.snapshotRecords,
-        };
-        deleteJournalEntry(this.databasePath(identity), publication.mutationId);
     }
 }
 const sha256Hex = (input) => createHash("sha256").update(input).digest("hex");
@@ -2286,17 +2375,28 @@ function assertHealthyWatch(evidence, rootId) {
  * file over a dozen times; the file itself is never deleted by the host, so
  * every later open needs only the connection and its pragmas. */
 const migratedDatabases = new Set();
+/** The journal's mutable facts and its immutable payload live in separate
+ * tables on purpose: SQLite rewrites a row's entire record — overflow pages
+ * included — on any column update, so flipping submitted_at on a row that
+ * carried a register-scale snapshot cost a full multi-megabyte rewrite
+ * through the WAL at synchronous=FULL (measured ~7.5s of the production
+ * cloud-commit stage on the 1-GB machine). The blob row is written exactly
+ * once and read only on restart replay; every status transition touches only
+ * the small row. */
 const SNAPSHOT_PUBLICATIONS_SCHEMA = `
     CREATE TABLE IF NOT EXISTS snapshot_publications (
       sequence INTEGER PRIMARY KEY AUTOINCREMENT,
       mutation_id TEXT NOT NULL UNIQUE,
       resource_id TEXT NOT NULL,
       meta_json TEXT NOT NULL,
-      snapshot_blob BLOB NOT NULL,
-      operation_blob BLOB NOT NULL,
       created_at INTEGER NOT NULL,
       status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'rejected')),
       submitted_at INTEGER
+    );
+    CREATE TABLE IF NOT EXISTS snapshot_publication_blobs (
+      mutation_id TEXT PRIMARY KEY,
+      snapshot_blob BLOB NOT NULL,
+      operation_blob BLOB NOT NULL
     );`;
 /** Converts an old-shape publication journal (one nested publication_json
  * text per row) into the blob journal, atomically, preserving every row's
@@ -2328,8 +2428,7 @@ function convertLegacySnapshotJournal(database, columns) {
         database.exec(SNAPSHOT_PUBLICATIONS_SCHEMA);
         database.exec(`
       INSERT INTO snapshot_publications(
-        mutation_id, resource_id, meta_json, snapshot_blob, operation_blob,
-        created_at, status, submitted_at
+        mutation_id, resource_id, meta_json, created_at, status, submitted_at
       )
       SELECT
         mutation_id,
@@ -2346,20 +2445,50 @@ function convertLegacySnapshotJournal(database, columns) {
               FROM json_each(publication_json, '$.uploadRecords') AS uploaded
           ), json_array())
         ),
+        created_at,
+        ${columns.has("status") ? "CASE status WHEN 'rejected' THEN 'rejected' ELSE 'pending' END" : "'pending'"},
+        ${columns.has("submitted_at") ? "submitted_at" : "created_at"}
+      FROM snapshot_publications_legacy ORDER BY sequence
+    `);
+        database.exec(`
+      INSERT INTO snapshot_publication_blobs(mutation_id, snapshot_blob, operation_blob)
+      SELECT
+        mutation_id,
         CAST(json_extract(publication_json, '$.snapshotJson') AS BLOB),
         CAST(json_object(
           'kind', 'entity.roots.replace',
           'rootIds', json(json_extract(publication_json, '$.replacementRootIds')),
           'records', json(json_extract(publication_json, '$.replacementRecords'))
-        ) AS BLOB),
-        created_at,
-        ${columns.has("status") ? "CASE status WHEN 'rejected' THEN 'rejected' ELSE 'pending' END" : "'pending'"},
-        ${columns.has("submitted_at") ? "submitted_at" : "created_at"}
+        ) AS BLOB)
       FROM snapshot_publications_legacy ORDER BY sequence
     `);
         database.exec("DROP TABLE snapshot_publications_legacy");
     })();
 }
+/** Converts the single-table blob journal (blobs stored on the publication
+ * row itself) into the split journal, atomically and entirely inside SQLite —
+ * the same engine-memory law as the nested-text conversion above. Every
+ * field already has its final meaning; the blobs simply move to their
+ * write-once table so status transitions stop rewriting them. */
+function splitSnapshotJournalBlobs(database) {
+    database.transaction(() => {
+        database.exec("ALTER TABLE snapshot_publications RENAME TO snapshot_publications_legacy");
+        database.exec(SNAPSHOT_PUBLICATIONS_SCHEMA);
+        database.exec(`
+      INSERT INTO snapshot_publications(
+        mutation_id, resource_id, meta_json, created_at, status, submitted_at
+      )
+      SELECT mutation_id, resource_id, meta_json, created_at, status, submitted_at
+        FROM snapshot_publications_legacy ORDER BY sequence
+    `);
+        database.exec(`
+      INSERT INTO snapshot_publication_blobs(mutation_id, snapshot_blob, operation_blob)
+      SELECT mutation_id, snapshot_blob, operation_blob
+        FROM snapshot_publications_legacy ORDER BY sequence
+    `);
+        database.exec("DROP TABLE snapshot_publications_legacy");
+    })();
+}
 /** The single opener and schema-migration entry for a user ground database.
  * Exported so the upgrade path is provable in isolation — the journal
  * conversion law test opens a legacy file through this exact entry inside a
@@ -2379,6 +2508,9 @@ export function initializeDatabase(file) {
     if (publicationColumns.has("publication_json")) {
         convertLegacySnapshotJournal(database, publicationColumns);
     }
+    else if (publicationColumns.has("snapshot_blob")) {
+        splitSnapshotJournalBlobs(database);
+    }
     if (migratedDatabases.has(file))
         return database;
     database.exec(`
@@ -2955,12 +3087,23 @@ function readSnapshotPublications(file) {
     const database = initializeDatabase(file);
     try {
         return database.prepare(`
-      SELECT mutation_id AS mutationId, resource_id AS resourceId,
-             meta_json AS metaJson, snapshot_blob AS snapshotBlob,
-             operation_blob AS operationBlob, status,
-             submitted_at AS submittedAt
-        FROM snapshot_publications ORDER BY sequence
+      SELECT publications.mutation_id AS mutationId,
+             publications.resource_id AS resourceId,
+             publications.meta_json AS metaJson,
+             blobs.snapshot_blob AS snapshotBlob,
+             blobs.operation_blob AS operationBlob,
+             publications.status,
+             publications.submitted_at AS submittedAt
+        FROM snapshot_publications AS publications
+        LEFT JOIN snapshot_publication_blobs AS blobs USING (mutation_id)
+       ORDER BY publications.sequence
     `).all().map((row) => {
+            // A publication without its payload is damage, never a skippable row —
+            // silently dropping it would let a new publication supersede a
+            // submitted mutation whose outcome exists only at the authority.
+            if (!row.snapshotBlob || !row.operationBlob) {
+                throw new Error(`snapshot publication ${row.mutationId} has no journaled payload`);
+            }
             const meta = JSON.parse(row.metaJson);
             // No lawful publication carries zero roots — rootReplacementFromRecords
             // refuses them at build time, so a rootless row here is damage.
@@ -3150,12 +3293,17 @@ function supersedeSnapshotJournal(file, entry) {
             if (unresolved) {
                 throw new Error("a submitted publication with an unknown outcome must resolve before supersession");
             }
+            database.prepare(`
+        DELETE FROM snapshot_publication_blobs WHERE mutation_id IN (
+          SELECT mutation_id FROM snapshot_publications WHERE resource_id = ?
+        )
+      `).run(entry.resourceId);
             database.prepare("DELETE FROM snapshot_publications WHERE resource_id = ?")
                 .run(entry.resourceId);
             database.prepare(`
         INSERT INTO snapshot_publications(
-          mutation_id, resource_id, meta_json, snapshot_blob, operation_blob, created_at
-        ) VALUES (?, ?, ?, ?, ?, ?)
+          mutation_id, resource_id, meta_json, created_at
+        ) VALUES (?, ?, ?, ?)
       `).run(entry.mutationId, entry.resourceId, stableJson({
                 authorityEpoch: entry.authorityEpoch,
                 baseVersion: entry.baseVersion,
@@ -3164,7 +3312,11 @@ function supersedeSnapshotJournal(file, entry) {
                 operationKind: entry.operationKind,
                 replacementRootIds: entry.replacementRootIds,
                 uploadUuids: entry.uploadUuids,
-            }), entry.snapshotBlob, entry.operationBlob, Date.now());
+            }), Date.now());
+            database.prepare(`
+        INSERT INTO snapshot_publication_blobs(mutation_id, snapshot_blob, operation_blob)
+        VALUES (?, ?, ?)
+      `).run(entry.mutationId, entry.snapshotBlob, entry.operationBlob);
         })();
     }
     finally {
@@ -3234,7 +3386,10 @@ function captureChurn(error) {
 function deleteJournalEntry(file, mutationId) {
     const database = initializeDatabase(file);
     try {
-        database.prepare("DELETE FROM snapshot_publications WHERE mutation_id = ?").run(mutationId);
+        database.transaction(() => {
+            database.prepare("DELETE FROM snapshot_publication_blobs WHERE mutation_id = ?").run(mutationId);
+            database.prepare("DELETE FROM snapshot_publications WHERE mutation_id = ?").run(mutationId);
+        })();
     }
     finally {
         database.close();
@@ -3614,7 +3769,7 @@ function materializedWorkspaceBindings(bindingDir) {
     return bindings.sort((left, right) => left.workspaceId.localeCompare(right.workspaceId));
 }
 async function reconcileGround(input) {
-    const { identity, userRoot, database, cacheDir, suspicions, coreScan, registrationWorkspaceId, onScan, } = input;
+    const { identity, userRoot, database, cacheDir, suspicions, coreScan, registrationWorkspaceId, onScan, measuring = false, } = input;
     const resourceId = privateEntityResourceId(identity.userId, sha256Hex);
     const bindingDir = workspaceBindingDir(userRoot, identity.deviceId);
     const boundRootEntries = materializedWorkspaceBindings(bindingDir);
@@ -3709,9 +3864,24 @@ async function reconcileGround(input) {
             contentReads: 0,
             gitInspections: 0,
             repositoryCaptures: 0,
+            walkMs: 0,
+            captureMs: 0,
+            captureBusyMs: 0,
+            captureBytes: 0,
+            gitMs: 0,
+            repositoryIdentityMs: 0,
+            repositoryCaptureMs: 0,
+            repositorySealMs: 0,
+            reconcileMs: 0,
+            persistMs: 0,
         };
         const started = performance.now();
-        const result = await reconcileRoot({ ...parameters, evidence: counters, materializedUUIDs });
+        const result = await reconcileRoot({
+            ...parameters,
+            evidence: counters,
+            measureEvidence: measuring,
+            materializedUUIDs,
+        });
         if (result.transferFailure !== null) {
             transferFailures.push({ rootId: parameters.rootUUID, reason: result.transferFailure });
         }
@@ -3749,7 +3919,14 @@ async function reconcileGround(input) {
             durationMs: performance.now() - started,
             plannedRows: proposals.length,
             records: proposals.length,
-            recordBytes: proposals.reduce((bytes, proposal) => bytes + encodedRecordBytes(parameters.resourceId, proposal), 0),
+            // Encoding every proposal to learn its wire size costs one record
+            // construction per entity — real time on the critical path of a cold
+            // Register. It is evidence, so it is paid only when read.
+            ...(measuring
+                ? {
+                    recordBytes: proposals.reduce((bytes, proposal) => bytes + encodedRecordBytes(parameters.resourceId, proposal), 0),
+                }
+                : {}),
         });
         // Each root commits its local projection before Detect yields. Native
         // callbacks can therefore preserve new suspicion between large roots.
@@ -3848,7 +4025,7 @@ async function reconcileGround(input) {
     };
 }
 async function reconcileRoot(input) {
-    const { identity, resourceId, rootUUID, rootName, rootPath, rootType, database, cacheDir, policy, bindingDir, suspects = null, evidence, plansSendRecords, largeManifests, } = input;
+    const { identity, resourceId, rootUUID, rootName, rootPath, rootType, database, cacheDir, policy, bindingDir, suspects = null, evidence, measureEvidence = false, plansSendRecords, largeManifests, } = input;
     // Prior rows reach this scan from every binding this root encloses. A row's
     // stored relativePath is relative to the root that last committed it, which
     // is a different frame when an enclosing boundary was just registered
@@ -4021,6 +4198,33 @@ async function reconcileRoot(input) {
     // its own entry in place; every task is awaited before entries are read.
     const captureTasks = [];
     const captureGate = concurrencyGate(WALK_CAPTURE_CONCURRENCY);
+    // The scan's three costs are metadata traversal, content capture, and Git
+    // inspection. They interleave, so each is accumulated where it is spent
+    // rather than inferred from the total afterwards.
+    let captureOpenedAt = 0;
+    let captureClosedAt = 0;
+    const spent = (work, into) => {
+        if (!measureEvidence || !evidence)
+            return work();
+        const at = performance.now();
+        try {
+            return work();
+        }
+        finally {
+            evidence[into] += performance.now() - at;
+        }
+    };
+    const spentAsync = async (work, into) => {
+        if (!measureEvidence || !evidence)
+            return work();
+        const at = performance.now();
+        try {
+            return await work();
+        }
+        finally {
+            evidence[into] += performance.now() - at;
+        }
+    };
     const visit = async (directory, parentUUID, parentType, base = "", activeRepository = parentType === "repo.git"
         ? {
             root: directory,
@@ -4028,8 +4232,8 @@ async function reconcileRoot(input) {
             evidence: directory === rootPath ? rootRepositoryEvidence : null,
         }
         : null, forceObserve = rootRailChanged) => {
-        const children = readdirSync(directory, { withFileTypes: true })
-            .sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+        const children = spent(() => readdirSync(directory, { withFileTypes: true })
+            .sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0), "walkMs");
         for (const child of children) {
             // Every materialization boundary reserves its root .amalgm/ directory
             // for machine intents, staging, and recovery. This is structural host
@@ -4045,7 +4249,7 @@ async function reconcileRoot(input) {
             if (!policy(relativePath))
                 continue;
             const absolutePath = join(directory, child.name);
-            const stats = lstatSync(absolutePath);
+            const stats = spent(() => lstatSync(absolutePath), "walkMs");
             evidence && (evidence.entries += 1);
             // The walk is synchronous metadata work. Yield periodically so the
             // wire, Receive, and Apply keep running while a large root is proved.
@@ -4076,7 +4280,7 @@ async function reconcileRoot(input) {
             if (observe && repositoryPath && activeRepository && !activeRepository.evidence) {
                 evidence && (evidence.gitInspections += 1);
                 try {
-                    activeRepository.evidence = inspectGitRegistration(activeRepository.root, activeRepository.evidencePaths);
+                    activeRepository.evidence = spent(() => inspectGitRegistration(activeRepository.root, activeRepository.evidencePaths), "gitMs");
                 }
                 catch {
                     // Classification already settled from the marker. If Git cannot
@@ -4169,11 +4373,19 @@ async function reconcileRoot(input) {
             });
             if (deferredCapture) {
                 const entry = entries[entries.length - 1];
+                if (measureEvidence && evidence && captureOpenedAt === 0)
+                    captureOpenedAt = performance.now();
                 captureTasks.push(captureGate(async () => {
+                    const taskStarted = measureEvidence ? performance.now() : 0;
                     let current = stats;
                     for (let attempt = 1;; attempt++) {
                         try {
                             const captured = await captureContentFile(absolutePath, current, activeRepository || !plansSendRecords ? null : cacheDir);
+                            if (measureEvidence && evidence) {
+                                evidence.captureBusyMs += performance.now() - taskStarted;
+                                evidence.captureBytes += captured.bytes;
+                                captureClosedAt = performance.now();
+                            }
                             entry.type = classifyFile({ binary: captured.binary });
                             entry.payloadVersion = captured.contentHash;
                             entry.contentVerifiedAtMs = Date.now();
@@ -4219,6 +4431,10 @@ async function reconcileRoot(input) {
     };
     await visit(rootPath, rootUUID, rootType);
     await Promise.all(captureTasks);
+    if (measureEvidence && evidence && captureOpenedAt !== 0) {
+        evidence.captureMs += captureClosedAt - captureOpenedAt;
+    }
+    const reconcileStarted = measureEvidence ? performance.now() : 0;
     // When every entry sits at its stored address with its stored type and
     // physical fingerprint (honoring any fixed UUID), path-first claiming makes
     // the multi-pass reconciliation the identity map — resolve directly. Any
@@ -4252,6 +4468,8 @@ async function reconcileRoot(input) {
         inode: entry.inode,
         ...(entry.fixedUUID ? { fixedUUID: entry.fixedUUID } : {}),
     })));
+    if (measureEvidence && evidence)
+        evidence.reconcileMs += performance.now() - reconcileStarted;
     const resolvedByProvisional = new Map();
     for (const entry of entries) {
         const resolved = resolvedIdentity.get(entry.relativePath) ?? entry.uuid;
@@ -4318,13 +4536,13 @@ async function reconcileRoot(input) {
             contentVerifiedAtMs: entry.contentVerifiedAtMs,
         };
     });
-    const persistCurrentRows = () => {
+    const persistCurrentRows = () => spent(() => {
         const rows = rowsFromEntries();
         if (input.suspicion === undefined) {
             persistRows(database, identity, resourceId, rootUUID, rows, existingRows);
         }
         return rows;
-    };
+    }, "persistMs");
     // Seal nested repositories first so their independent rows are complete
     // before the enclosing graph is persisted. Their state is not an input to
     // the enclosing identity map; only their address boundary is.
@@ -4452,7 +4670,7 @@ async function reconcileRoot(input) {
                 }
             }
             const fingerprintBefore = gitEvidenceFingerprint(repository.absolutePath);
-            let repoIdentity = await refreshRepositoryIdentity();
+            let repoIdentity = await spentAsync(refreshRepositoryIdentity, "repositoryIdentityMs");
             /* The rows and the transport identity are derived from the same fresh
              * worktree evidence. A later Watch ring for one of these dirty paths is
              * therefore ordinary equality, not a transport-only echo. */
@@ -4490,8 +4708,8 @@ async function reconcileRoot(input) {
             let captured = null;
             let coherent = false;
             for (let attempt = 0; attempt < 3; attempt += 1) {
-                captured = captureRepository(repository.absolutePath, repoIdentity, prior, previousIdentity);
-                const after = await refreshRepositoryIdentity();
+                captured = spent(() => captureRepository(repository.absolutePath, repoIdentity, prior, previousIdentity), "repositoryCaptureMs");
+                const after = await spentAsync(refreshRepositoryIdentity, "repositoryIdentityMs");
                 if (sameGitIdentity(after, repoIdentity)) {
                     repoIdentity = [...captured.identity];
                     coherent = true;
@@ -4513,15 +4731,18 @@ async function reconcileRoot(input) {
             }
             repository.payloadVersion = captured.stateId;
             repository.transportVersion = captured.transportVersion;
-            if (captured.bytes) {
-                sealCapturedArtifact(cacheDir, {
-                    entityId: repository.uuid,
-                    entityType: "repo.git",
-                    kind: "git",
-                    contentHash: captured.transportVersion,
-                }, captured.bytes);
-            }
-            const currentLayout = inspectRepositoryTransportFile(join(cacheDir, `${captured.transportVersion}.bin`));
+            const settled = captured;
+            const currentLayout = spent(() => {
+                if (settled.bytes) {
+                    sealCapturedArtifact(cacheDir, {
+                        entityId: repository.uuid,
+                        entityType: "repo.git",
+                        kind: "git",
+                        contentHash: settled.transportVersion,
+                    }, settled.bytes);
+                }
+                return inspectRepositoryTransportFile(join(cacheDir, `${settled.transportVersion}.bin`));
+            }, "repositorySealMs");
             replayByUuid.set(repository.uuid, {
                 kind: "repo.git",
                 stateId: currentLayout.stateId,