@indigoai-us/hq-cloud 6.18.52 → 6.18.54

package/dist/bin/sync-runner-watch-loop.js

@@ -1,6 +1,7 @@
 import * as os from "os";
 import * as path from "path";
 import * as fs from "fs";
+import { createHash } from "node:crypto";
 import { MULTIPART_PART_SIZE_BYTES } from "../sync/multipart-uploader.js";
 import * as v8 from "node:v8";
 import { performance } from "node:perf_hooks";
@@ -15,13 +16,18 @@ import { TRANSIENT_NETWORK_EXIT } from "../lib/net-errors.js";
 import { PARTIAL_SYNC_EXIT, UNRESOLVED_COMPANY_EXIT, } from "../lib/exit-codes.js";
 import { getOrCreateMachineIdMetadata } from "../lib/machine-id.js";
 import { localPathForVaultKey } from "../local-path-codec.js";
+import { isEphemeralPath } from "../cli/share.js";
+import { isSafeRelativePath } from "../sync/push-event.js";
+import { cloudAuthoritativePathClass, isLocallyIneligibleForPush, } from "../lib/cloud-authoritative.js";
+import { inspectLocalSymlinkScope } from "../symlink-target-policy.js";
 import { shouldRecordLocalDeleteIntent } from "../local-replacement.js";
 import { createIgnoreFilter } from "../ignore.js";
+import { matchPersonalVaultExclusion, wrapFilterWithPersonalVaultDefaults, } from "../personal-vault-exclusions.js";
 import { TreeWatcher, resolveEventDebounceConfig, systemClock, } from "../watcher.js";
 import { recoverHqRootLocalState } from "../hq-root-recovery.js";
-import { clearLocalDeleteIntent, getStateDir, markLocalDeleteIntent, PERSONAL_VAULT_JOURNAL_SLUG, openJournalStoreSession, openJournalStoreSessionAsync, listJournalSlugs, isCorruptJournalJson, maintainAreaJournalSlice, disposeScopedJournalStores, releaseScopedJournalStore, releaseCachedAreaJournalMigrations, recoverCachedAreaJournalMirrorIfNeeded, setAreaLedgerRecoveryHqRootForProcess, journalCacheCensusSizes, emitJournalCacheMetric, journalRows, readJournalScoped, readJournalScopedAsync, applyJournalDeltaAsync, } from "../journal.js";
-import { isPersonalVaultDeletionExcluded } from "../personal-vault.js";
-import { NoopPushReceiver, ReceiverDispatchError, isReceiverTransportFailure, } from "../sync/push-receiver.js";
+import { clearLocalDeleteIntent, getStateDir, markLocalDeleteIntent, PERSONAL_VAULT_JOURNAL_SLUG, openJournalStoreSession, openJournalStoreSessionAsync, listJournalSlugs, isCorruptJournalJson, maintainAreaJournalSlice, disposeScopedJournalStores, releaseScopedJournalStore, releaseCachedAreaJournalMigrations, recoverCachedAreaJournalMirrorIfNeeded, setAreaLedgerRecoveryHqRootForProcess, journalCacheCensusSizes, emitJournalCacheMetric, journalRows, readJournalScoped, readJournalScopedAsync, readQuarantinedJournalPaths, hashSymlinkTarget, applyJournalDeltaAsync, } from "../journal.js";
+import { isPersonalVaultDeletionExcluded, readCloudBackedSlugsFromManifest, computeContinuityPointerPaths, computeAgencySyncPaths, computeSessionLogsSyncPaths, isPersonalVaultScopeExcluded, } from "../personal-vault.js";
+import { NoopPushReceiver, ReceiverDispatchError, RealtimePushYieldError, isReceiverTransportFailure, } from "../sync/push-receiver.js";
 import { CONTENT_HASH_PATTERN } from "../sync/push-event.js";
 import { resolveEventSync, startEventSync as defaultStartEventSync, } from "../sync/event-sync.js";
 import { resolveAreaStorageEnabled, resolveEffectiveParallelSyncRollout, resolveParallelSyncRollout, } from "../sync/feature-flags.js";
@@ -44,6 +50,36 @@ const FULL_RECONCILE_EVERY_TICKS = 10;
 const warnedUnresolvedReceiverCompanies = new Set();
 /** Maximum time shutdown waits for event-sync startup before abandoning it. */
 export const EVENT_SYNC_STARTUP_SHUTDOWN_WAIT_MS = 5_000;
+/** Group watcher changes by target route while retaining source insertion order. */
+export function groupBatchByRoute(batch) {
+    const grouped = new Map();
+    for (const [absolutePath, relativePath] of batch.paths.entries()) {
+        const change = batch.changes?.get(absolutePath);
+        const route = routeChangeToTarget(relativePath, change?.kind);
+        if (!route)
+            continue;
+        const category = isSessionLogsPushOnlyPath(relativePath) ? "session-log-backup" : "interactive";
+        const key = `${routeKey(route)}:${category}`;
+        const existing = grouped.get(key) ?? {
+            route,
+            paths: new Map(),
+            changes: new Map(),
+            relPaths: [],
+            deleteScopeRoots: [],
+        };
+        existing.paths.set(absolutePath, relativePath);
+        if (change)
+            existing.changes.set(absolutePath, change);
+        grouped.set(key, existing);
+    }
+    for (const group of grouped.values()) {
+        group.relPaths = [...new Set(group.paths.values())];
+        group.deleteScopeRoots = [
+            ...new Set([...group.changes.values()].flatMap((item) => (item.deleteSnapshots ?? []).flatMap((snapshot) => snapshot.deleteScopeRoot === undefined ? [] : [snapshot.deleteScopeRoot]))),
+        ];
+    }
+    return grouped;
+}
 /** A deferred full chore must get the next admission after this long. */
 export const CHORE_STARVATION_CAP_MS = 15 * 60 * 1000;
 /**
@@ -61,13 +97,13 @@ export const REALTIME_ADMISSION_DEADLINE_MS = 2 * DEFAULT_REALTIME_AUTHORIZATION
  */
 export const REALTIME_DRAIN_BURST_MS = REALTIME_ADMISSION_DEADLINE_MS;
 /**
- * How many realtime executes may run during one chore hand-off.
+ * Maximum guarded realtime executes, including the reserved watcher push peer.
  * HQ_SYNC_MAX_CONCURRENCY caps simultaneous S3 object transfers, not these
- * workers. One long transfer keeps its worker; a realtime item that arrives
- * while that execute() is in flight starts on the other slot instead of
- * waiting for the whole batch. In-flight work is never aborted.
+ * workers. One long pull and one long push may each retain a normal worker;
+ * one additional watcher push can still make bounded progress. In-flight
+ * work is never aborted for this admission.
  */
-export const REALTIME_WORKER_OCCUPANCY_CAP = 2;
+export const REALTIME_WORKER_OCCUPANCY_CAP = 3;
 /** Objects at least one multipart part are sent through the chore hand-off. */
 export const REALTIME_LARGE_UPLOAD_THRESHOLD_BYTES = MULTIPART_PART_SIZE_BYTES;
 let realtimeAdmissionDeadlineMsForTest;
@@ -91,6 +127,29 @@ function realtimeDrainBurstMs() {
  * so a long chore costs at most one attempt per deadline plus this delay.
  */
 export const REALTIME_ADMISSION_RETRY_MS = 5_000;
+/** Bound consecutive pull admissions while a watcher push is queued. */
+export const MAX_PULL_ADMISSIONS_BEFORE_PUSH = 3;
+/** Bound synchronous warm-up candidate work between event-loop turns. */
+export const WATCHER_WARMUP_YIELD_EVERY = 128;
+export function shouldYieldWatcherWarmup(examinedPaths) {
+    return examinedPaths > 0 && examinedPaths % WATCHER_WARMUP_YIELD_EVERY === 0;
+}
+export function yieldWatcherWarmupIfNeeded(examinedPaths, yieldNow = () => new Promise((resolve) => setImmediate(resolve))) {
+    return shouldYieldWatcherWarmup(examinedPaths) ? yieldNow() : undefined;
+}
+export function shouldSkipPersonalWarmupScopeCheck(pushFiltersApplied, routeKind) {
+    // TreeWatcher marks this only when its production filter has already applied
+    // the same personal scope predicate to every collected candidate. Unrouted
+    // paths retain the runner check because the collector may include company paths.
+    return pushFiltersApplied && routeKind === "personal";
+}
+export function createWatcherWarmupPathFilters(hqRoot, onPersonalExcluded, createIgnore = createIgnoreFilter, wrapPersonal = wrapFilterWithPersonalVaultDefaults) {
+    const ignoreFilter = createIgnore(hqRoot);
+    const personalPushFilter = wrapPersonal(ignoreFilter, hqRoot, (relativePath, match) => {
+        onPersonalExcluded(relativePath, match.id);
+    });
+    return { ignoreFilter, personalPushFilter };
+}
 /**
  * In-process result of a scoped drain whose only shortfall was admission
  * deferrals: the paths are restored and a retry is scheduled. Never a
@@ -191,6 +250,66 @@ export function allowConcurrentHandoffForGuardedWork(workClass, explicitlyAllowe
     return explicitlyAllowed ||
         (workClass === "realtime" && isFullPassDurableProgressEnabled());
 }
+export async function runGuardedPassPreparation(prepare, onStage, onFailure) {
+    onStage?.("pass preparation");
+    if (!prepare)
+        return;
+    try {
+        await prepare();
+    }
+    catch (error) {
+        const name = error instanceof Error ? error.name : "UnknownError";
+        const errorClass = /^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(name)
+            ? name
+            : "UnknownError";
+        onStage?.("pass preparation failed");
+        onFailure?.({ type: "watcher-push-preparation-failed", errorClass });
+        onStage?.("pass return");
+        throw error;
+    }
+}
+function pathFreeErrorClass(error) {
+    if (!(error instanceof Error))
+        return undefined;
+    return /^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(error.name)
+        ? error.name
+        : "UnknownError";
+}
+export function buildScopedPushFailureDiagnostic(fields, error, caughtError, caughtErrorClass) {
+    const errorClass = caughtErrorClass ?? pathFreeErrorClass(caughtError);
+    return {
+        type: "scoped-push-failure",
+        ...fields,
+        ...(errorClass ? { errorClass } : {}),
+        error,
+    };
+}
+export function resolveWatcherPushWaitStage(input) {
+    if (input.capYieldActive)
+        return "CPU/heap cap wait";
+    if (input.holders.some((holder) => holder.kind === "pull"))
+        return "pull-yield wait";
+    if (input.queueDepth > 0)
+        return "queued behind realtime work";
+    if (input.holders.some((holder) => holder.kind === "chore"))
+        return "chore holder wait";
+    if (input.holders.length > 0)
+        return "scheduler holder wait";
+    return "scheduler admission pending";
+}
+export function watcherPushWaitDiagnostics(input) {
+    return {
+        stage: input.admissionWaiting
+            ? resolveWatcherPushWaitStage(input)
+            : input.stage,
+        waitingSinceAdmissionRequestMs: input.admissionRequestedAtMonotonicMs === null
+            ? null
+            : Math.max(0, input.nowMonotonicMs - input.admissionRequestedAtMonotonicMs),
+        schedulerLastAdmittedAnyWorkAgoMs: input.lastAnyAdmissionAtMonotonicMs === null
+            ? null
+            : Math.max(0, input.nowMonotonicMs - input.lastAnyAdmissionAtMonotonicMs),
+    };
+}
 /**
  * One durable-state owner at a time for a full chore. Realtime work runs only
  * while that chore is suspended at `checkpoint()`. Only coordinator-fenced
@@ -205,6 +324,8 @@ export class CooperativePassScheduler {
     starvationCapMs;
     options;
     pending = [];
+    lastAnyAdmissionAtMonotonicMs = null;
+    nextEntryId = 0;
     active = null;
     /** Realtime executes started by the current hand-off. Not the chore slot. */
     realtimeOccupants = new Set();
@@ -241,12 +362,65 @@ export class CooperativePassScheduler {
     /** Successful callers still applying results after the network hand-off. */
     networkTransferCompletionCount = 0;
     networkTransferApplyRelease = null;
+    consecutivePullAdmissions = 0;
+    consecutiveFastAdmissions = 0;
     resolveNetworkTransferApplyRelease = null;
     constructor(now, starvationCapMs = CHORE_STARVATION_CAP_MS, options = {}) {
         this.now = now;
         this.starvationCapMs = starvationCapMs;
         this.options = options;
     }
+    recordAdmission(entry) {
+        const monotonicMs = performance.now();
+        const lastAdmissionAgoMs = this.lastAnyAdmissionAtMonotonicMs === null
+            ? null
+            : Math.max(0, monotonicMs - this.lastAnyAdmissionAtMonotonicMs);
+        const waitingPush = this.pending.find((pending) => pending.workClass === "realtime" && pending.transferDirection === "push");
+        const admittedIsPush = entry.workClass === "realtime" && entry.transferDirection === "push";
+        if (entry.workClass === "realtime") {
+            if (entry.lane === "fast")
+                this.consecutiveFastAdmissions += 1;
+            else
+                this.consecutiveFastAdmissions = 0;
+        }
+        const oldestPush = waitingPush ?? (admittedIsPush ? entry : undefined);
+        const waitingSinceAdmissionRequestMs = oldestPush
+            ? Math.max(0, this.now() - oldestPush.enqueuedAt)
+            : null;
+        if (waitingPush || admittedIsPush) {
+            this.options.onAdmission?.({
+                entryId: entry.entryId,
+                workClass: entry.workClass,
+                lane: entry.lane,
+                transferDirection: entry.transferDirection,
+                transferSizeClass: entry.transferSizeClass ?? "unknown",
+                label: entry.label.slice(0, 160),
+                admittedAt: new Date().toISOString(),
+                schedulerLastAdmittedAnyWorkAgoMs: lastAdmissionAgoMs,
+                realtimeAdmissionQueueDepth: this.pending.filter((pending) => pending.workClass === "realtime").length,
+                oldestWaitingWatcherPush: oldestPush
+                    ? {
+                        entryId: oldestPush.entryId,
+                        label: oldestPush.label.slice(0, 160),
+                        waitingSinceAdmissionRequestMs: waitingSinceAdmissionRequestMs ?? 0,
+                    }
+                    : null,
+                passedOver: waitingPush && waitingPush !== entry
+                    ? {
+                        entryId: waitingPush.entryId,
+                        label: waitingPush.label.slice(0, 160),
+                        waitingSinceAdmissionRequestMs: waitingSinceAdmissionRequestMs ?? 0,
+                        reason: entry.transferDirection === "pull"
+                            ? "pull-admitted-ahead-of-waiting-push"
+                            : this._handoffActive
+                                ? "handoff-selector-admitted-other-work"
+                                : "scheduler-admitted-other-work",
+                    }
+                    : null,
+            });
+        }
+        this.lastAnyAdmissionAtMonotonicMs = monotonicMs;
+    }
     get handoffActive() {
         return this._handoffActive;
     }
@@ -263,12 +437,40 @@ export class CooperativePassScheduler {
     get hasActiveSlowRealtime() {
         return this.active?.workClass === "realtime" && this.active.lane === "slow";
     }
+    get isInCapYield() {
+        return this.capYieldDepth > 0;
+    }
     /** Includes the running slow/fast lanes and hand-off occupants; it never changes their cap. */
     get activeRealtimeWorkerCount() {
         return ((this.active?.workClass === "realtime" ? 1 : 0) +
             (this.activeFastRealtime === null ? 0 : 1) +
             this.realtimeOccupants.size);
     }
+    get diagnosticAdmissionSnapshot() {
+        const active = [
+            this.active,
+            this.activeFastRealtime,
+            ...this.realtimeOccupants,
+            this.detachedChore,
+        ].filter((entry) => entry !== null);
+        const holders = active.map((entry) => ({
+            entryId: entry.entryId,
+            kind: entry.transferDirection === "pull"
+                ? "pull"
+                : entry.workClass === "chore"
+                    ? "chore"
+                    : "push",
+            scope: entry.label.slice(0, 160),
+            ageMs: entry.startedAtMonotonicMs === undefined
+                ? 0
+                : Math.max(0, performance.now() - entry.startedAtMonotonicMs),
+        }));
+        return {
+            queueDepth: this.pending.filter((entry) => entry.workClass === "realtime").length,
+            holders: holders.slice(0, 20),
+            lastAnyAdmissionAtMonotonicMs: this.lastAnyAdmissionAtMonotonicMs,
+        };
+    }
     pendingLaneCount(lane) {
         return this.pending.filter((entry) => entry.lane === lane).length;
     }
@@ -283,6 +485,7 @@ export class CooperativePassScheduler {
             signal.addEventListener("abort", () => controller.abort(), { once: true });
         }
         const directEntry = {
+            entryId: `guarded-${++this.nextEntryId}`,
             task,
             workClass,
             label,
@@ -306,7 +509,11 @@ export class CooperativePassScheduler {
         if (workClass === "realtime" &&
             this._handoffActive &&
             directEntry.allowConcurrentHandoff &&
-            this.canAdmitRealtimeOccupant(directEntry)) {
+            this.canAdmitRealtimeOccupant(directEntry) &&
+            !(directEntry.lane === "fast" && this.consecutiveFastAdmissions > 0 &&
+                this.pending.some((pending) => pending.workClass === "realtime" &&
+                    pending.lane === "slow" && pending.transferDirection === directEntry.transferDirection)) &&
+            !this.pullMustYieldForWaitingPush(directEntry)) {
             return new Promise((resolve, reject) => {
                 const entry = {
                     ...directEntry,
@@ -455,16 +662,21 @@ export class CooperativePassScheduler {
             this.admitHandoffBacklog();
             return;
         }
-        if (this.active !== null) {
+        if (this.active !== null || this.activeFastRealtime !== null || this.realtimeOccupants.size > 0) {
             const fastRealtime = this.nextFastRealtime();
-            if (fastRealtime && this.canStartFastRealtime(fastRealtime)) {
+            if (this.active !== null && fastRealtime && this.canStartFastRealtime(fastRealtime)) {
                 this.pending.splice(this.pending.indexOf(fastRealtime), 1);
                 this.startFastRealtime(fastRealtime);
+                return;
+            }
+            const peerIndex = this.nextRealtimeIndex((entry) => this.canAdmitRealtimePeer(entry));
+            if (peerIndex >= 0) {
+                const peer = this.pending.splice(peerIndex, 1)[0];
+                if (peer)
+                    this.startRealtimeOccupant(peer);
             }
             return;
         }
-        if (this.activeFastRealtime !== null)
-            return;
         const next = this.takeNext();
         if (next)
             this.start(next);
@@ -483,30 +695,116 @@ export class CooperativePassScheduler {
             return this.pending.splice(realtime, 1)[0];
         return this.pending.shift();
     }
-    nextRealtimeIndex() {
-        const slowRealtime = this.pending.findIndex((entry) => entry.workClass === "realtime" && entry.lane === "slow");
-        return slowRealtime >= 0
-            ? slowRealtime
-            : this.pending.findIndex((entry) => entry.workClass === "realtime");
+    pullMustYieldForWaitingPush(entry) {
+        return entry.transferDirection === "pull" &&
+            this.consecutivePullAdmissions >= MAX_PULL_ADMISSIONS_BEFORE_PUSH &&
+            this.pending.some((pending) => pending.workClass === "realtime" && pending.transferDirection === "push");
+    }
+    nextRealtimeIndex(eligible = () => true) {
+        let firstRealtime = -1;
+        let waitingPush = -1;
+        let slowPull = -1;
+        let fastPush = -1;
+        let slowPush = -1;
+        let firstFastLane = -1;
+        let firstSlowLane = -1;
+        for (let index = 0; index < this.pending.length; index += 1) {
+            const entry = this.pending[index];
+            if (!entry || entry.workClass !== "realtime" || !eligible(entry))
+                continue;
+            if (firstRealtime < 0)
+                firstRealtime = index;
+            if (entry.transferDirection === undefined) {
+                if (entry.lane === "fast" && firstFastLane < 0)
+                    firstFastLane = index;
+                if (entry.lane === "slow" && firstSlowLane < 0)
+                    firstSlowLane = index;
+            }
+            if (entry.transferDirection === "push" && waitingPush < 0)
+                waitingPush = index;
+            if (entry.transferDirection === "pull" && entry.lane === "slow" && slowPull < 0) {
+                slowPull = index;
+            }
+            if (entry.transferDirection === "push" && entry.lane === "fast" && fastPush < 0) {
+                fastPush = index;
+            }
+            if (entry.transferDirection === "push" && entry.lane === "slow" && slowPush < 0) {
+                slowPush = index;
+            }
+        }
+        if (waitingPush >= 0 && this.consecutivePullAdmissions >= MAX_PULL_ADMISSIONS_BEFORE_PUSH) {
+            this.consecutivePullAdmissions = 0;
+            this.consecutiveFastAdmissions = 0;
+            return waitingPush;
+        }
+        // A waiting slow pull is the receiver's progress boundary and retains its
+        // bounded turn ahead of pushes. For pushes, let the oldest fast batch take
+        // one turn before a queued bulk batch, then give the bulk batch a turn
+        // before admitting another fast batch. This prevents bulk arrivals from
+        // starving an older interactive write and prevents a stream of fast writes
+        // from starving a queued bulk upload.
+        const next = slowPull >= 0
+            ? slowPull
+            : fastPush >= 0 && slowPush >= 0
+                ? this.consecutiveFastAdmissions === 0 ? fastPush : slowPush
+                : firstFastLane >= 0 && firstSlowLane >= 0
+                    ? this.consecutiveFastAdmissions === 0 ? firstFastLane : firstSlowLane
+                    : firstRealtime;
+        if (next >= 0) {
+            const selected = this.pending[next];
+            if (selected?.transferDirection === "pull")
+                this.consecutivePullAdmissions += 1;
+            else if (selected?.transferDirection === "push")
+                this.consecutivePullAdmissions = 0;
+            if (selected?.transferDirection === "push" && selected.lane === "fast" && slowPush >= 0) {
+                this.consecutiveFastAdmissions += 1;
+            }
+            else if (selected?.transferDirection === "push") {
+                this.consecutiveFastAdmissions = 0;
+            }
+        }
+        return next;
     }
     nextFastRealtime() {
-        return this.pending.find((entry) => entry.workClass === "realtime" && entry.lane === "fast");
+        const fast = this.pending.find((entry) => entry.workClass === "realtime" && entry.lane === "fast");
+        if (!fast)
+            return undefined;
+        const slowOfSameDirectionWaiting = this.pending.some((entry) => entry.workClass === "realtime" && entry.lane === "slow" &&
+            entry.transferDirection === fast.transferDirection);
+        if (slowOfSameDirectionWaiting && this.consecutiveFastAdmissions > 0)
+            return undefined;
+        return fast;
     }
     hasStarvedChore() {
         const now = this.now();
         return this.pending.some((entry) => entry.workClass === "chore" && now - entry.enqueuedAt >= this.starvationCapMs);
     }
     canStartFastRealtime(entry) {
+        const slowOfSameDirectionWaiting = this.pending.some((pending) => pending.workClass === "realtime" && pending.lane === "slow" &&
+            pending.transferDirection === entry.transferDirection);
         return (!this._handoffActive &&
             this.activeFastRealtime === null &&
             entry.workClass === "realtime" &&
             entry.lane === "fast" &&
+            !(slowOfSameDirectionWaiting && this.consecutiveFastAdmissions > 0) &&
             entry.allowFastRealtimeOvertake &&
             this.hasActiveSlowRealtime &&
             !this.hasStarvedChore());
     }
+    /** Coordinator-fenced opposite-direction work may use the reserved realtime slot. */
+    canAdmitRealtimePeer(entry) {
+        if (entry.workClass !== "realtime" ||
+            !entry.allowConcurrentHandoff ||
+            entry.transferDirection === undefined ||
+            this.activeRealtimeWorkerCount >= REALTIME_WORKER_OCCUPANCY_CAP)
+            return false;
+        return [this.active, this.activeFastRealtime, ...this.realtimeOccupants].some((active) => active?.workClass === "realtime" &&
+            active.transferDirection !== undefined &&
+            active.transferDirection !== entry.transferDirection);
+    }
     start(entry) {
         this.clearAdmission(entry);
+        this.recordAdmission(entry);
         entry.startedAt = new Date().toISOString();
         // Holder duration uses the process monotonic clock; do not consume the
         // injected scheduler clock, whose reads define cadence-slot deadlines.
@@ -545,6 +843,8 @@ export class CooperativePassScheduler {
     }
     startFastRealtime(entry) {
         this.clearAdmission(entry);
+        this.recordAdmission(entry);
+        entry.startedAtMonotonicMs = performance.now();
         this.activeFastRealtime = entry;
         let current;
         try {
@@ -800,6 +1100,8 @@ export class CooperativePassScheduler {
     /** Run one realtime execute without aborting it and without taking the chore slot. */
     startRealtimeOccupant(entry) {
         this.clearAdmission(entry);
+        this.recordAdmission(entry);
+        entry.startedAtMonotonicMs = performance.now();
         this.realtimeOccupants.add(entry);
         this.handoffAdmitted = true;
         if (this.capYieldDepth > 0)
@@ -814,6 +1116,7 @@ export class CooperativePassScheduler {
                 this.handoffBacklog = null;
             entry.reject(error);
             this.notifyOccupantChange();
+            this.drain();
             return;
         }
         void running.then((outcome) => {
@@ -823,6 +1126,7 @@ export class CooperativePassScheduler {
             entry.resolve(outcome);
             this.promoteOccupancyArrivals();
             this.notifyOccupantChange();
+            this.drain();
         }, (error) => {
             this.realtimeOccupants.delete(entry);
             if (this.handoffBacklog === entry)
@@ -830,6 +1134,7 @@ export class CooperativePassScheduler {
             entry.reject(error);
             this.promoteOccupancyArrivals();
             this.notifyOccupantChange();
+            this.drain();
         });
     }
     /** Eligible arrivals may take a free slot before hand-off admission closes. */
@@ -838,8 +1143,7 @@ export class CooperativePassScheduler {
             (!this.networkTransferActive && !this.withinHandoffAdmission()))
             return;
         while (this.realtimeOccupants.size < REALTIME_WORKER_OCCUPANCY_CAP) {
-            const index = this.pending.findIndex((pending) => pending.workClass === "realtime" &&
-                pending.occupancyArrival === true &&
+            const index = this.nextRealtimeIndex((pending) => pending.occupancyArrival === true &&
                 pending.allowConcurrentHandoff &&
                 this.canAdmitRealtimeOccupant(pending));
             if (index < 0)
@@ -858,7 +1162,7 @@ export class CooperativePassScheduler {
             return;
         if (!this.withinHandoffAdmission())
             return;
-        const realtimeIndex = this.nextRealtimeIndex();
+        const realtimeIndex = this.nextRealtimeIndex((pending) => !pending.occupancyArrival && this.canAdmitRealtimeOccupant(pending));
         if (realtimeIndex < 0)
             return;
         const pending = this.pending[realtimeIndex];
@@ -1292,6 +1596,151 @@ export function isChoreLocalPush(paths, largeUpload) {
     }
     return count > 0;
 }
+/** Keep warm-up route telemetry useful on large checkouts without unbounded logs. */
+export function watcherWarmupPathsByRoute(relativePaths) {
+    const counts = new Map();
+    for (const relativePath of relativePaths) {
+        const route = routeChangeToTarget(relativePath);
+        const key = route ? routeKey(route) : "unrouted";
+        counts.set(key, (counts.get(key) ?? 0) + 1);
+    }
+    const ranked = [...counts.entries()].sort(([leftKey, leftCount], [rightKey, rightCount]) => rightCount - leftCount || leftKey.localeCompare(rightKey));
+    const result = {};
+    for (const [key, count] of ranked.slice(0, 20))
+        result[key] = count;
+    const other = ranked.slice(20).reduce((sum, [, count]) => sum + count, 0);
+    if (other > 0)
+        result.other = other;
+    return result;
+}
+export function watcherWarmupPrefixesByRoute(candidateRelativePaths, eligibleRelativePaths = candidateRelativePaths) {
+    const candidatePrefixes = new Map();
+    const candidateCounts = new Map();
+    for (const relativePath of candidateRelativePaths) {
+        const route = routeChangeToTarget(relativePath);
+        const key = route ? routeKey(route) : "unrouted";
+        candidateCounts.set(key, (candidateCounts.get(key) ?? 0) + 1);
+        const routePath = route?.kind === "company"
+            ? relativePath.slice(`companies/${route.slug}/`.length)
+            : relativePath;
+        const prefix = routePath.split("/").slice(0, 2).join("/") || "(root)";
+        const routeCounts = candidatePrefixes.get(key) ?? new Map();
+        routeCounts.set(prefix, (routeCounts.get(prefix) ?? 0) + 1);
+        candidatePrefixes.set(key, routeCounts);
+    }
+    const eligibleCounts = new Map();
+    for (const relativePath of eligibleRelativePaths) {
+        const route = routeChangeToTarget(relativePath);
+        const key = route ? routeKey(route) : "unrouted";
+        const routePath = route?.kind === "company"
+            ? relativePath.slice(`companies/${route.slug}/`.length)
+            : relativePath;
+        const prefix = routePath.split("/").slice(0, 2).join("/") || "(root)";
+        const routeCounts = eligibleCounts.get(key) ?? new Map();
+        routeCounts.set(prefix, (routeCounts.get(prefix) ?? 0) + 1);
+        eligibleCounts.set(key, routeCounts);
+    }
+    const result = {};
+    // Eligible routes are all retained; fill any remaining diagnostic slots
+    // with the largest candidate routes. This keeps alphabetical one-path
+    // stubs from crowding out a large route such as personal.
+    const eligibleRoutes = [...eligibleCounts.keys()];
+    const remainingSlots = Math.max(0, 20 - eligibleRoutes.length);
+    const rankedCandidates = [...candidateCounts.entries()]
+        .filter(([route]) => !eligibleCounts.has(route))
+        .sort(([leftKey, leftCount], [rightKey, rightCount]) => rightCount - leftCount || leftKey.localeCompare(rightKey));
+    const selectedRoutes = [
+        ...eligibleRoutes.sort((left, right) => (candidateCounts.get(right) ?? 0) - (candidateCounts.get(left) ?? 0) || left.localeCompare(right)),
+        ...rankedCandidates.slice(0, remainingSlots).map(([route]) => route),
+    ];
+    for (const route of selectedRoutes) {
+        const topPrefixes = (counts) => {
+            const ranked = [...(counts ?? new Map()).entries()].sort(([leftKey, leftCount], [rightKey, rightCount]) => rightCount - leftCount || leftKey.localeCompare(rightKey));
+            const top = {};
+            for (const [prefix, count] of ranked.slice(0, 5))
+                top[prefix] = count;
+            const other = ranked.slice(5).reduce((sum, [, count]) => sum + count, 0);
+            if (other > 0)
+                top.other = other;
+            return top;
+        };
+        result[route] = {
+            candidate: topPrefixes(candidatePrefixes.get(route)),
+            eligible: topPrefixes(eligibleCounts.get(route)),
+        };
+    }
+    const otherRoutes = [...eligibleCounts.entries()].filter(([route]) => !selectedRoutes.includes(route));
+    if (otherRoutes.length > 0) {
+        const merged = new Map();
+        for (const [, routeCounts] of otherRoutes) {
+            for (const [prefix, count] of routeCounts)
+                merged.set(prefix, (merged.get(prefix) ?? 0) + count);
+        }
+        result.other = { candidate: {}, eligible: Object.fromEntries(merged) };
+    }
+    return result;
+}
+function recordWarmupRoutePath(counts, prefixes, routeName, routePath) {
+    counts.set(routeName, (counts.get(routeName) ?? 0) + 1);
+    const firstSlash = routePath.indexOf("/");
+    const secondSlash = firstSlash < 0 ? -1 : routePath.indexOf("/", firstSlash + 1);
+    const prefix = secondSlash < 0 ? routePath || "(root)" : routePath.slice(0, secondSlash);
+    let byPrefix = prefixes.get(routeName);
+    if (!byPrefix) {
+        byPrefix = new Map();
+        prefixes.set(routeName, byPrefix);
+    }
+    byPrefix.set(prefix, (byPrefix.get(prefix) ?? 0) + 1);
+}
+function rankedWarmupCounts(counts) {
+    const ranked = [...counts.entries()].sort(([leftKey, leftCount], [rightKey, rightCount]) => rightCount - leftCount || leftKey.localeCompare(rightKey));
+    const result = {};
+    for (const [key, count] of ranked.slice(0, 20))
+        result[key] = count;
+    const other = ranked.slice(20).reduce((sum, [, count]) => sum + count, 0);
+    if (other > 0)
+        result.other = other;
+    return result;
+}
+function rankedWarmupPrefixes(candidateCounts, candidatePrefixes, eligibleCounts, eligiblePrefixes) {
+    const topPrefixes = (counts) => {
+        const ranked = [...(counts ?? new Map()).entries()].sort(([leftKey, leftCount], [rightKey, rightCount]) => rightCount - leftCount || leftKey.localeCompare(rightKey));
+        const top = {};
+        for (const [prefix, count] of ranked.slice(0, 5))
+            top[prefix] = count;
+        const other = ranked.slice(5).reduce((sum, [, count]) => sum + count, 0);
+        if (other > 0)
+            top.other = other;
+        return top;
+    };
+    const eligibleRoutes = [...eligibleCounts.keys()].sort((left, right) => (candidateCounts.get(right) ?? 0) - (candidateCounts.get(left) ?? 0) || left.localeCompare(right));
+    const remainingSlots = Math.max(0, 20 - eligibleRoutes.length);
+    const rankedCandidates = [...candidateCounts.entries()]
+        .filter(([route]) => !eligibleCounts.has(route))
+        .sort(([leftKey, leftCount], [rightKey, rightCount]) => rightCount - leftCount || leftKey.localeCompare(rightKey));
+    const selectedRoutes = [
+        ...eligibleRoutes,
+        ...rankedCandidates.slice(0, remainingSlots).map(([route]) => route),
+    ];
+    const result = {};
+    for (const route of selectedRoutes) {
+        result[route] = {
+            candidate: topPrefixes(candidatePrefixes.get(route)),
+            eligible: topPrefixes(eligiblePrefixes.get(route)),
+        };
+    }
+    const otherRoutes = [...eligibleCounts.keys()].filter((route) => !selectedRoutes.includes(route));
+    if (otherRoutes.length > 0) {
+        const merged = new Map();
+        for (const route of otherRoutes) {
+            for (const [prefix, count] of eligiblePrefixes.get(route) ?? []) {
+                merged.set(prefix, (merged.get(prefix) ?? 0) + count);
+            }
+        }
+        result.other = { candidate: {}, eligible: Object.fromEntries(merged) };
+    }
+    return result;
+}
 /** A receiver event needs a known small upsert size before it can go realtime. */
 export function isFastReceiverBatch(eventCount) {
     return eventCount > 0 && eventCount <= resolveFastLaneLimits().maxFiles;
@@ -1762,9 +2211,23 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
     // RUNNER_HEAP_RECYCLE_EXIT through the normal shutdown()/finally teardown.
     let recycleRequested = null;
     const pendingAppliedUpserts = new Map();
+    const appliedUpsertHashesForWatcher = new Map();
+    const APPLIED_UPSERT_WATCHER_HASH_CAP = 10_000;
     const pendingAppliedDeletes = new Set();
+    const uploadedAwaitingPublish = new Set();
+    const UPLOADED_AWAITING_PUBLISH_BATCH_SIZE = 1_000;
+    const UPLOADED_AWAITING_PUBLISH_CAP = 10_000;
+    let uploadedAwaitingPublishDropLogged = false;
     const rememberAppliedUpsert = (relativePath, contentHash) => {
         pendingAppliedDeletes.delete(relativePath);
+        appliedUpsertHashesForWatcher.delete(relativePath);
+        appliedUpsertHashesForWatcher.set(relativePath, contentHash);
+        while (appliedUpsertHashesForWatcher.size > APPLIED_UPSERT_WATCHER_HASH_CAP) {
+            const oldest = appliedUpsertHashesForWatcher.keys().next().value;
+            if (oldest === undefined)
+                break;
+            appliedUpsertHashesForWatcher.delete(oldest);
+        }
         if (eventSyncLive && eventSync) {
             eventSync.markContentPublished?.(relativePath, contentHash);
             return;
@@ -1779,6 +2242,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         }
     };
     const rememberAppliedDelete = (relativePath) => {
+        appliedUpsertHashesForWatcher.delete(relativePath);
         pendingAppliedUpserts.delete(relativePath);
         if (eventSyncLive && eventSync) {
             eventSync.markContentDeleted?.(relativePath);
@@ -1793,6 +2257,65 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             pendingAppliedDeletes.delete(oldest);
         }
     };
+    const isUnchangedAppliedUpsert = async (relativePath) => {
+        const expectedHash = appliedUpsertHashesForWatcher.get(relativePath);
+        if (!expectedHash)
+            return false;
+        // Receiver-applied hashes suppress only the first watcher observation.
+        // A later local edit may legitimately revert to this content.
+        appliedUpsertHashesForWatcher.delete(relativePath);
+        const absolutePath = localPathForVaultKey(hqRoot, relativePath);
+        try {
+            const stat = await fs.promises.lstat(absolutePath);
+            let actualHash;
+            if (stat.isSymbolicLink()) {
+                actualHash = `sha256:${hashSymlinkTarget(await fs.promises.readlink(absolutePath))}`;
+            }
+            else if (stat.isFile()) {
+                const digest = createHash("sha256");
+                await new Promise((resolve, reject) => {
+                    const input = fs.createReadStream(absolutePath);
+                    input.on("data", (chunk) => digest.update(chunk));
+                    input.once("error", reject);
+                    input.once("end", resolve);
+                });
+                actualHash = `sha256:${digest.digest("hex")}`;
+            }
+            else {
+                return false;
+            }
+            return actualHash === expectedHash;
+        }
+        catch (error) {
+            const code = error && typeof error === "object" && "code" in error
+                ? error.code
+                : undefined;
+            if (code !== "ENOENT") {
+                process.stderr.write(`${JSON.stringify({
+                    type: "watcher-applied-upsert-hash-check-failed",
+                    errorClass: pathFreeErrorClass(error) ?? "UnknownError",
+                })}\n`);
+            }
+            return false;
+        }
+    };
+    const flushPendingUploadEvents = () => {
+        if (!eventSyncLive || !eventSync || uploadedAwaitingPublish.size === 0)
+            return;
+        while (uploadedAwaitingPublish.size > 0) {
+            const uploadedPaths = [...uploadedAwaitingPublish].slice(0, UPLOADED_AWAITING_PUBLISH_BATCH_SIZE);
+            const paths = new Map(uploadedPaths.map((relativePath) => [
+                localPathForVaultKey(hqRoot, relativePath),
+                relativePath,
+            ]));
+            const expanded = expandDirectoryPublishPaths(paths, uploadedPaths);
+            if (expanded.size > 0)
+                eventSync.publishBatch({ paths: expanded });
+            for (const relativePath of uploadedPaths) {
+                uploadedAwaitingPublish.delete(relativePath);
+            }
+        }
+    };
     const flushPendingAppliedUpserts = () => {
         if (!eventSyncLive || !eventSync)
             return;
@@ -1804,6 +2327,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             eventSync.markContentDeleted?.(relativePath);
         }
         pendingAppliedDeletes.clear();
+        flushPendingUploadEvents();
     };
     // `activeSlowPass` is assigned before its task has necessarily acquired the
     // cross-process lock (it may be waiting behind a rescue or a second runner).
@@ -1853,8 +2377,17 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         }, 0);
         refresh.unref?.();
     }
-    const passScheduler = new CooperativePassScheduler(monotonicNow, CHORE_STARVATION_CAP_MS, { caps: fullPassCaps });
-    const runPassWithLock = async (passArgvForRun, prepare, lane = "slow", workClass = "chore", checkpoint, telemetry, pullSignal, receiverSignal) => {
+    const passScheduler = new CooperativePassScheduler(monotonicNow, CHORE_STARVATION_CAP_MS, {
+        caps: fullPassCaps,
+        onAdmission: (event) => {
+            process.stderr.write(`${JSON.stringify({
+                type: "watcher-push-scheduler-admission",
+                diagnostic: true,
+                ...event,
+            })}\n`);
+        },
+    });
+    const runPassWithLock = async (passArgvForRun, prepare, lane = "slow", workClass = "chore", checkpoint, telemetry, pullSignal, receiverSignal, watcherPushStage) => {
         const passCheckpoint = pullSignal || receiverSignal
             ? Object.assign(async () => checkpoint?.(), {
                 shouldYieldToRealtime: checkpoint?.shouldYieldToRealtime,
@@ -1884,21 +2417,50 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             }
         };
         const invokePass = () => {
-            if (!runPassSupportsCooperativeCheckpoint) {
-                if (!runPassSupportsQmdLifecycle)
-                    return runPass(passArgvForRun);
-                return runPass(passArgvForRun, undefined, undefined, undefined, undefined, qmdShutdownController.signal, writeMaintenanceProgress, idleHeartbeatIntervalMs);
-            }
-            // This callback is emitted by the production runner after journal
-            // repair/seed and before fanout. It starts ingress early, but never
-            // admits a second durable writer: queued realtime still waits for the
-            // existing scheduler's cooperative hand-off checkpoint.
-            const onJournalsReady = () => activateEventPushSurfaces();
-            if (!runPassSupportsQmdLifecycle) {
-                return runPass(passArgvForRun, passCheckpoint, onJournalsReady, recordDurableAppliedUpserts, workClass);
-            }
-            return runPass(passArgvForRun, passCheckpoint, onJournalsReady, recordDurableAppliedUpserts, workClass, qmdShutdownController.signal, writeMaintenanceProgress, idleHeartbeatIntervalMs, recordDurableAppliedDeletes);
+            watcherPushStage?.("pass invocation");
+            activePassCount += 1;
+            emitSyncWorkState(true);
+            const trackPass = (pass) => {
+                const complete = () => {
+                    watcherPushStage?.("pass return");
+                    activePassCount = Math.max(0, activePassCount - 1);
+                    emitSyncWorkState(true);
+                };
+                // Observe settlement without returning a chained promise to the pass
+                // scheduler. The scheduler's synchronous test seam and watcher wake
+                // ordering depend on the original pass promise's completion turn.
+                void pass.then(complete, complete);
+                return pass;
+            };
+            try {
+                if (!runPassSupportsCooperativeCheckpoint) {
+                    if (!runPassSupportsQmdLifecycle)
+                        return trackPass(runPass(passArgvForRun));
+                    return trackPass(runPass(passArgvForRun, undefined, undefined, undefined, undefined, qmdShutdownController.signal, writeMaintenanceProgress, idleHeartbeatIntervalMs));
+                }
+                // This callback is emitted by the production runner after journal
+                // repair/seed and before fanout. It starts ingress early, but never
+                // admits a second durable writer: queued realtime still waits for the
+                // existing scheduler's cooperative hand-off checkpoint.
+                const onJournalsReady = () => activateEventPushSurfaces();
+                if (!runPassSupportsQmdLifecycle) {
+                    return trackPass(runPass(passArgvForRun, passCheckpoint, onJournalsReady, recordDurableAppliedUpserts, workClass));
+                }
+                return trackPass(runPass(passArgvForRun, passCheckpoint, onJournalsReady, recordDurableAppliedUpserts, workClass, qmdShutdownController.signal, writeMaintenanceProgress, idleHeartbeatIntervalMs, recordDurableAppliedDeletes));
+            }
+            catch (error) {
+                watcherPushStage?.("pass return");
+                activePassCount = Math.max(0, activePassCount - 1);
+                emitSyncWorkState(true);
+                throw error;
+            }
         };
+        const preparePass = () => runGuardedPassPreparation(prepare, watcherPushStage, watcherPushStage
+            ? (event) => process.stderr.write(`${JSON.stringify({
+                ...event,
+                diagnostic: true,
+            })}\n`)
+            : undefined);
         // Observe the heap at pass boundaries — a gated checkpoint immediately before
         // admitting a pass and immediately after it returns. A pass that runs a long
         // synchronous stretch starves the interval timer, so these boundary
@@ -1912,6 +2474,11 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 return;
             recordDurableAppliedUpserts(outcome.result?.appliedUpserts ?? []);
             recordDurableAppliedDeletes(outcome.result?.appliedDeletes ?? []);
+            rememberUploadedPaths(outcome);
+            if (typeof outcome !== "number") {
+                acknowledgeDurableWatcherUploads(outcome.result?.uploadedPaths ?? []);
+            }
+            flushPendingUploadEvents();
         };
         // Pre-admit boundary observation.
         heapCheckpoint?.();
@@ -1931,9 +2498,9 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             try {
                 telemetry?.mark("network");
                 const outcome = telemetry ? await telemetry.measureNetwork(async () => {
-                    await prepare?.();
+                    await preparePass();
                     return invokePass();
-                }) : await (async () => { await prepare?.(); return invokePass(); })();
+                }) : await (async () => { await preparePass(); return invokePass(); })();
                 recordAppliedUpserts(outcome);
                 return outcome;
             }
@@ -1948,9 +2515,9 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             try {
                 telemetry?.mark("network");
                 const outcome = telemetry ? await telemetry.measureNetwork(async () => {
-                    await prepare?.();
+                    await preparePass();
                     return invokePass();
-                }) : await (async () => { await prepare?.(); return invokePass(); })();
+                }) : await (async () => { await preparePass(); return invokePass(); })();
                 recordAppliedUpserts(outcome);
                 return outcome;
             }
@@ -1972,9 +2539,9 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                     acquireOperationLockUser();
                 }
                 const outcome = telemetry ? await telemetry.measureNetwork(async () => {
-                    await prepare?.();
+                    await preparePass();
                     return invokePass();
-                }) : await (async () => { await prepare?.(); return invokePass(); })();
+                }) : await (async () => { await preparePass(); return invokePass(); })();
                 recordAppliedUpserts(outcome);
                 return outcome;
             }
@@ -2010,9 +2577,9 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 }
                 try {
                     const outcome = telemetry ? await telemetry.measureNetwork(async () => {
-                        await prepare?.();
+                        await preparePass();
                         return invokePass();
-                    }) : await (async () => { await prepare?.(); return invokePass(); })();
+                    }) : await (async () => { await preparePass(); return invokePass(); })();
                     recordAppliedUpserts(outcome);
                     return outcome;
                 }
@@ -2162,15 +2729,25 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         // watcher fast path explicitly opts into its established scoped exception.
         return passScheduler.submit(task, workClass, lane, allowFastRealtimeOvertake, signal, resourceCap, allowFlaggedRealtimeHandoff, transferDirection, transferSizeClass, holderLabel);
     };
-    const runGuarded = (passArgvForRun, prepare, lane = "slow", workClass = "chore", allowFastRealtimeOvertake = false, signal, resourceCap = false, telemetry, allowConcurrentHandoff = false, receiverSignal, holderLabel = workClass === "chore" && resourceCap ? "full-reconcile" : workClass) => {
+    const runGuarded = (passArgvForRun, prepare, lane = "slow", workClass = "chore", allowFastRealtimeOvertake = false, signal, resourceCap = false, telemetry, allowConcurrentHandoff = false, receiverSignal, holderLabel = workClass === "chore" && resourceCap ? "full-reconcile" : workClass, watcherPushStage) => {
+        if (watcherPushStage) {
+            watcherPushStage("guarded scheduler admission requested");
+            const admission = passScheduler.diagnosticAdmissionSnapshot;
+            if (passScheduler.isInCapYield)
+                watcherPushStage("CPU/heap cap wait");
+            else if (admission.holders.some((holder) => holder.kind === "pull")) {
+                watcherPushStage("pull-yield wait");
+            }
+        }
         telemetry?.mark("operationGate");
         const admissionSignal = signal && receiverSignal
             ? AbortSignal.any([signal, receiverSignal])
             : signal ?? receiverSignal;
         return runGuardedTask((context) => {
+            watcherPushStage?.("guarded scheduler admission granted");
             telemetry?.mark("appendLock");
             telemetry?.setOccupancy(passScheduler.activeRealtimeWorkerCount);
-            return runPassWithLock(passArgvForRun, prepare, lane, workClass, workClass === "chore" ? context.checkpoint : undefined, telemetry, context.signal, receiverSignal);
+            return runPassWithLock(passArgvForRun, prepare, lane, workClass, workClass === "chore" ? context.checkpoint : undefined, telemetry, context.signal, receiverSignal, watcherPushStage);
         }, lane, workClass, allowFastRealtimeOvertake, admissionSignal, resourceCap, allowConcurrentHandoff, telemetry?.direction, telemetry?.sizeClass, holderLabel);
     };
     /*
@@ -2206,11 +2783,18 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         }
         const pathOutcome = coordinatorPathOutcome(passExitCode(execution.result));
         return {
-            paths: slice.paths.map((item) => ({
-                path: item.canonicalPath,
-                epoch: item.epoch,
-                ...pathOutcome,
-            })),
+            paths: slice.paths.map((item) => execution.refusedPaths?.has(item.canonicalPath)
+                ? {
+                    path: item.canonicalPath,
+                    epoch: item.epoch,
+                    status: "refused",
+                    reason: "remote upsert already present locally",
+                }
+                : {
+                    path: item.canonicalPath,
+                    epoch: item.epoch,
+                    ...pathOutcome,
+                }),
         };
     };
     const createCoordinator = () => new DefaultParallelSyncCoordinator({
@@ -2256,6 +2840,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                     result = await task(slice, telemetry, true);
                 }
                 catch (error) {
+                    execution.errorClass = pathFreeErrorClass(error);
                     if (error instanceof RealtimeAdmissionTimeoutError) {
                         execution.admissionTimeout = error;
                     }
@@ -2292,9 +2877,11 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             return {
                 result: execution.result ?? (allRefused ? 0 : 1),
                 accepted,
+                yieldedToPush: outcome.paths.some((path) => path.reason === "yielded to queued watcher push"),
                 coordinatorRefusedPaths: normalizeCoordinatorPaths(outcome.paths
                     .filter((path) => path.status === "refused")
                     .map((path) => path.path)),
+                ...(execution.errorClass ? { errorClass: execution.errorClass } : {}),
                 ...(admissionTimeout ? { admissionTimeout } : {}),
             };
         }
@@ -2489,6 +3076,222 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
     /** Vanished never-journaled file deletes removed from batches at drain time. */
     let drainedUntrackedDeletes = 0;
     const pendingWatcherPaths = new Map();
+    const durableWatcherPaths = new Map();
+    const durableWatcherPathLimit = 10_000;
+    let durableWatcherOverflowed = false;
+    let durableWatcherPersistTimer;
+    let durableWatcherPersistQueue = Promise.resolve();
+    let durableWatcherPersistGeneration = 0;
+    let durableWatcherPersistedGeneration = 0;
+    const watcherPushStatePath = path.join(getStateDir(), "sync-runner", `watcher-push-${createHash("sha256").update(hqRoot).digest("hex").slice(0, 20)}.json`);
+    const persistDurableWatcherPaths = () => {
+        const generation = durableWatcherPersistGeneration;
+        if (generation === durableWatcherPersistedGeneration)
+            return durableWatcherPersistQueue;
+        const snapshot = durableWatcherOverflowed
+            ? { format: 1, hqRoot, overflowed: true }
+            : { format: 1, hqRoot, paths: [...durableWatcherPaths.values()] };
+        durableWatcherPersistQueue = durableWatcherPersistQueue.then(async () => {
+            try {
+                if (!durableWatcherOverflowed && durableWatcherPaths.size === 0) {
+                    await fs.promises.rm(watcherPushStatePath, { force: true });
+                    durableWatcherPersistedGeneration = Math.max(durableWatcherPersistedGeneration, generation);
+                    return;
+                }
+                await fs.promises.mkdir(path.dirname(watcherPushStatePath), { recursive: true, mode: 0o700 });
+                const tempPath = `${watcherPushStatePath}.${process.pid}.tmp`;
+                await fs.promises.writeFile(tempPath, JSON.stringify(snapshot), { mode: 0o600 });
+                await fs.promises.rename(tempPath, watcherPushStatePath);
+                durableWatcherPersistedGeneration = Math.max(durableWatcherPersistedGeneration, generation);
+            }
+            catch (err) {
+                process.stderr.write(`hq-sync-runner: watcher push state persistence failed: ${describeError(err)}\n`);
+            }
+        }).catch((err) => {
+            process.stderr.write(`hq-sync-runner: watcher push state persistence failed: ${describeError(err)}\n`);
+        });
+        return durableWatcherPersistQueue;
+    };
+    const scheduleDurableWatcherPersist = () => {
+        durableWatcherPersistGeneration += 1;
+        if (durableWatcherPersistTimer !== undefined)
+            clearTimeout(durableWatcherPersistTimer);
+        durableWatcherPersistTimer = setTimeout(() => {
+            durableWatcherPersistTimer = undefined;
+            void persistDurableWatcherPaths();
+        }, 1_000);
+        durableWatcherPersistTimer.unref?.();
+    };
+    const addDurableWatcherPath = (absolutePath, relativePath) => {
+        if (durableWatcherOverflowed)
+            return;
+        if (!durableWatcherPaths.has(absolutePath) && durableWatcherPaths.size >= durableWatcherPathLimit) {
+            durableWatcherPaths.clear();
+            durableWatcherOverflowed = true;
+        }
+        else if (!durableWatcherOverflowed) {
+            durableWatcherPaths.set(absolutePath, relativePath);
+        }
+        scheduleDurableWatcherPersist();
+    };
+    const clearDurableWatcherOverflow = () => {
+        if (!durableWatcherOverflowed)
+            return;
+        durableWatcherOverflowed = false;
+        durableWatcherPaths.clear();
+        for (const [absolutePath, relativePath] of pendingWatcherPaths) {
+            addDurableWatcherPath(absolutePath, relativePath);
+        }
+        scheduleDurableWatcherPersist();
+    };
+    const acknowledgeDurableWatcherUploads = (relativePaths) => {
+        let changed = false;
+        const uploaded = new Set(relativePaths);
+        for (const [absolutePath, relativePath] of durableWatcherPaths) {
+            if (!uploaded.has(relativePath))
+                continue;
+            durableWatcherPaths.delete(absolutePath);
+            changed = true;
+        }
+        if (changed)
+            scheduleDurableWatcherPersist();
+    };
+    const acknowledgeDurableWatcherPathsCoveredByFullPass = (relativePaths) => {
+        const stillPending = new Set(pendingWatcherPaths.values());
+        acknowledgeDurableWatcherUploads(relativePaths.filter((relativePath) => !stillPending.has(relativePath)));
+    };
+    let activePassCount = 0;
+    let inFlightWatcherPushes = 0;
+    const watcherPushStages = new Map();
+    let nextWatcherPushGroupId = 0;
+    const setWatcherPushStage = (groupId, stage) => {
+        const record = watcherPushStages.get(groupId);
+        if (!record || record.stage === stage)
+            return;
+        record.stage = stage;
+        record.stageEnteredAt = Date.now();
+        if (stage === "guarded scheduler admission requested") {
+            record.admissionRequestedAtMonotonicMs = performance.now();
+            record.admissionWaiting = true;
+        }
+        else if (stage === "guarded scheduler admission granted") {
+            record.admissionWaiting = false;
+        }
+        process.stderr.write(`${JSON.stringify({
+            type: "watcher-push-group-stage",
+            diagnostic: true,
+            groupId: record.groupId,
+            route: record.route,
+            paths: record.paths,
+            stage: record.stage,
+            stageEnteredAt: new Date(record.stageEnteredAt).toISOString(),
+        })}\n`);
+    };
+    const startWatcherPushStageTracking = (route, paths) => {
+        const groupId = `watcher-push-${++nextWatcherPushGroupId}`;
+        watcherPushStages.set(groupId, {
+            groupId,
+            route,
+            paths,
+            stage: "",
+            stageEnteredAt: Date.now(),
+            admissionRequestedAtMonotonicMs: null,
+            admissionWaiting: false,
+        });
+        return { groupId, setStage: (stage) => setWatcherPushStage(groupId, stage) };
+    };
+    const emitWatcherPushInflightStages = () => {
+        if (inFlightWatcherPushes <= 0)
+            return;
+        const now = Date.now();
+        const entries = [...watcherPushStages.values()];
+        const admission = passScheduler.diagnosticAdmissionSnapshot;
+        const coordinatorAdmission = coordinator?.inspect();
+        for (const record of entries) {
+            if (!record.admissionWaiting)
+                continue;
+            const liveStage = resolveWatcherPushWaitStage({
+                capYieldActive: passScheduler.isInCapYield,
+                queueDepth: admission.queueDepth,
+                holders: admission.holders,
+            });
+            if (liveStage !== record.stage)
+                setWatcherPushStage(record.groupId, liveStage);
+        }
+        process.stderr.write(`${JSON.stringify({
+            type: "watcher-push-inflight-stages",
+            diagnostic: true,
+            groups: entries.slice(0, 20).map((record) => {
+                const monotonicNow = performance.now();
+                const current = watcherPushWaitDiagnostics({
+                    stage: record.stage,
+                    admissionWaiting: record.admissionWaiting,
+                    admissionRequestedAtMonotonicMs: record.admissionRequestedAtMonotonicMs,
+                    lastAnyAdmissionAtMonotonicMs: admission.lastAnyAdmissionAtMonotonicMs,
+                    nowMonotonicMs: monotonicNow,
+                    capYieldActive: passScheduler.isInCapYield,
+                    queueDepth: admission.queueDepth,
+                    holders: admission.holders,
+                });
+                return {
+                    route: record.route,
+                    paths: record.paths,
+                    ...current,
+                    ageMs: Math.max(0, now - record.stageEnteredAt),
+                };
+            }),
+            other: Math.max(0, entries.length - 20),
+            realtimeAdmissionQueueDepth: admission.queueDepth,
+            holders: admission.holders,
+            coordinatorRealtimeQueueDepth: coordinatorAdmission?.realtimeQueued ?? 0,
+            coordinatorRealtimeRunning: coordinatorAdmission?.realtimeRunning ?? false,
+            coordinatorRealtimeLanes: coordinatorAdmission?.realtimeLanes ?? {
+                fast: null,
+                slow: null,
+                overflowPush: null,
+            },
+            coordinatorChoreQueueDepth: coordinatorAdmission?.choreQueued ?? 0,
+            coordinatorRealtimeLastAdmissionAgoMs: coordinatorAdmission?.lastRealtimeAdmissionAt === null ||
+                coordinatorAdmission === undefined
+                ? null
+                : Math.max(0, coordinatorAdmission.now - coordinatorAdmission.lastRealtimeAdmissionAt),
+            coordinatorChoreLastAdmissionAgoMs: coordinatorAdmission?.lastChoreAdmissionAt === null ||
+                coordinatorAdmission === undefined
+                ? null
+                : Math.max(0, coordinatorAdmission.now - coordinatorAdmission.lastChoreAdmissionAt),
+        })}\n`);
+    };
+    const watcherPushStagesTimer = setInterval(emitWatcherPushInflightStages, Math.max(1, deps.watcherPushDiagnosticsIntervalMs ?? 60_000));
+    watcherPushStagesTimer.unref?.();
+    let pendingReceivers = 0;
+    let lastSyncWorkStateEmitAt = 0;
+    let syncWorkStateTimer;
+    const emitSyncWorkState = (force = false) => {
+        const now = Date.now();
+        const elapsed = now - lastSyncWorkStateEmitAt;
+        if (force || elapsed >= 250) {
+            if (syncWorkStateTimer !== undefined)
+                clearTimeout(syncWorkStateTimer);
+            syncWorkStateTimer = undefined;
+            lastSyncWorkStateEmitAt = now;
+            const snapshot = {
+                passActive: activePassCount > 0,
+                queuedWatcherPushes: pendingWatcherPaths.size,
+                inFlightWatcherPushes,
+                pendingReceivers,
+            };
+            deps.onSyncWorkStateSnapshot?.(snapshot);
+            stdout.write(`${JSON.stringify({ type: "sync-work-state", ...snapshot })}\n`);
+            return;
+        }
+        if (syncWorkStateTimer !== undefined)
+            return;
+        syncWorkStateTimer = setTimeout(() => {
+            syncWorkStateTimer = undefined;
+            emitSyncWorkState(true);
+        }, Math.max(1, 250 - elapsed));
+        syncWorkStateTimer.unref?.();
+    };
     const droppedUnresolvedWatcherSlugs = new Set();
     const logDroppedUnresolvedWatcherRoute = (slug) => {
         if (droppedUnresolvedWatcherSlugs.has(slug))
@@ -2531,10 +3334,23 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         const changes = new Map();
         for (const [absolutePath, relativePath] of batch.paths.entries()) {
             const change = batch.changes?.get(absolutePath);
-            const route = routeChangeToTarget(relativePath, change?.kind);
+            let routedRelativePath = relativePath;
+            const absoluteRootRelativePath = path.relative(hqRoot, absolutePath)
+                .split(path.sep)
+                .join("/");
+            if (isSafeRelativePath(absoluteRootRelativePath)) {
+                const absoluteRoute = routeChangeToTarget(absoluteRootRelativePath, change?.kind);
+                const reportedRoute = routeChangeToTarget(relativePath, change?.kind);
+                if (absoluteRoute?.kind === "company" &&
+                    (reportedRoute?.kind !== "company" ||
+                        reportedRoute.slug.toLowerCase() !== absoluteRoute.slug.toLowerCase())) {
+                    routedRelativePath = absoluteRootRelativePath;
+                }
+            }
+            const route = routeChangeToTarget(routedRelativePath, change?.kind);
             if (!route || !isWatchRouteSelected(route, watchRouteSelection))
                 continue;
-            paths.set(absolutePath, relativePath);
+            paths.set(absolutePath, routedRelativePath);
             if (change)
                 changes.set(absolutePath, change);
         }
@@ -2556,6 +3372,11 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             }
         }
         if (batch) {
+            if (batch.overflowed || batch.paths.size > durableWatcherPathLimit) {
+                durableWatcherPaths.clear();
+                durableWatcherOverflowed = true;
+                scheduleDurableWatcherPersist();
+            }
             const entries = [...batch.paths.entries()].filter(([absolutePath]) => {
                 const previousSequence = pendingWatcherChangeSequences.get(absolutePath);
                 return previousSequence === undefined ||
@@ -2564,6 +3385,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             });
             if (entries.length === 0)
                 return false;
+            const queueWasEmpty = pendingWatcherPaths.size === 0;
             pendingWatcherBatchGeneration ??= ++nextWatcherBatchGeneration;
             pendingWatcherOriginalBatch =
                 pendingWatcherPaths.size === 0 &&
@@ -2575,11 +3397,13 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                     : null;
             for (const [absolutePath, relativePath] of entries) {
                 pendingWatcherPaths.set(absolutePath, relativePath);
+                addDurableWatcherPath(absolutePath, relativePath);
                 const change = batch.changes?.get(absolutePath);
                 if (change)
                     pendingWatcherChanges.set(absolutePath, change);
                 pendingWatcherChangeSequences.set(absolutePath, ++nextPendingWatcherChangeSequence);
             }
+            emitSyncWorkState(queueWasEmpty);
             if (batch.overflowed) {
                 pendingWatcherOverflowed = true;
                 pendingWatcherDroppedPaths += batch.droppedPaths ?? 0;
@@ -2603,16 +3427,20 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             // counterpart must be re-derived through the codec — a raw join would
             // point at the impossible colon path on Windows.
             const absolutePath = localPathForVaultKey(hqRoot, changedRelPath);
+            const queueWasEmpty = pendingWatcherPaths.size === 0;
             pendingWatcherPaths.set(absolutePath, changedRelPath);
+            addDurableWatcherPath(absolutePath, changedRelPath);
             pendingWatcherChangeSequences.set(absolutePath, ++nextPendingWatcherChangeSequence);
             // A bare path signal carries no delete intent; drop any change record
             // a prior batch left for this path so the stale intent cannot leak
             // into the coalesced batch (#227).
             pendingWatcherChanges.delete(absolutePath);
+            emitSyncWorkState(queueWasEmpty);
             return true;
         }
         pendingWatcherOriginalBatch = null;
         pendingWatcherBareChange = true;
+        emitSyncWorkState();
         return true;
     };
     const takePendingWatcherChange = () => {
@@ -2657,6 +3485,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         pendingWatcherDroppedRouteHints.clear();
         pendingWatcherDroppedRoutesUnknown = false;
         pendingWatcherBatchGeneration = null;
+        emitSyncWorkState();
         return { batch, bare, warmupCatchup, warmupCatchupFailed, generation };
     };
     const restorePendingWatcherPaths = (paths, generation, changes) => {
@@ -2670,12 +3499,54 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             if (pendingWatcherChangeSequences.has(absolutePath))
                 continue;
             pendingWatcherPaths.set(absolutePath, relativePath);
+            addDurableWatcherPath(absolutePath, relativePath);
             pendingWatcherChangeSequences.set(absolutePath, ++nextPendingWatcherChangeSequence);
             const change = changes?.get(absolutePath);
             if (change)
                 pendingWatcherChanges.set(absolutePath, change);
         }
+        emitSyncWorkState();
     };
+    if (eventPush) {
+        try {
+            const stored = JSON.parse(fs.readFileSync(watcherPushStatePath, "utf8"));
+            if (stored.format !== 1 || stored.hqRoot !== hqRoot ||
+                (!Array.isArray(stored.paths) && stored.overflowed !== true)) {
+                throw new Error("stored watcher push state has an unsupported shape or root");
+            }
+            if (stored.overflowed === true) {
+                durableWatcherOverflowed = true;
+                pendingWatcherOverflowed = true;
+                pendingWatcherWarmupCatchup = true;
+                pendingWatcherDroppedRoutesUnknown = true;
+                pendingWatcherBatchGeneration = ++nextWatcherBatchGeneration;
+                emitSyncWorkState(true);
+                process.stderr.write("hq-sync-runner: restored overflowed watcher push state; scheduling full warm-up catch-up\n");
+            }
+            for (const relativePath of Array.isArray(stored.paths) ? stored.paths : []) {
+                if (typeof relativePath !== "string" || relativePath.length === 0)
+                    continue;
+                const route = routeChangeToTarget(relativePath);
+                if (!route || !isWatchRouteSelected(route, watchRouteSelection))
+                    continue;
+                const absolutePath = localPathForVaultKey(hqRoot, relativePath);
+                addDurableWatcherPath(absolutePath, relativePath);
+                pendingWatcherPaths.set(absolutePath, relativePath);
+                pendingWatcherChangeSequences.set(absolutePath, ++nextPendingWatcherChangeSequence);
+            }
+            if (pendingWatcherPaths.size > 0) {
+                pendingWatcherBatchGeneration = ++nextWatcherBatchGeneration;
+                pendingWatcherWarmupCatchup = true;
+                emitSyncWorkState(true);
+                process.stderr.write(`hq-sync-runner: restored ${pendingWatcherPaths.size} watcher push path(s) from prior shutdown\n`);
+            }
+        }
+        catch (err) {
+            if (!(err instanceof Error && err.code === "ENOENT")) {
+                process.stderr.write(`hq-sync-runner: watcher push state recovery failed: ${describeError(err)}\n`);
+            }
+        }
+    }
     const routePushFailureBackoff = new RoutePushFailureBackoff();
     const pushRetryScheduler = deps.pushRetryScheduler ?? systemPushRetryScheduler;
     const routePushRetryTimerHandles = new Map();
@@ -3256,14 +4127,12 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 const relativePath = route.kind === "personal"
                     ? key
                     : ["companies", route.slug, key].join("/");
-                const localPath = path.resolve(hqRoot, ...relativePath.split("/"));
-                const fromRoot = path.relative(hqRoot, localPath);
-                const parentPrefix = ["..", path.sep].join("");
-                if (fromRoot === ".." ||
-                    fromRoot.startsWith(parentPrefix) ||
-                    path.isAbsolute(fromRoot)) {
+                // Journal keys are POSIX relative paths. Reject unsafe segments with
+                // a string-only check before building the absolute path; path.resolve
+                // plus path.relative allocated and normalized every journal row.
+                if (!isSafeRelativePath(relativePath))
                     continue;
-                }
+                const localPath = path.join(hqRoot, relativePath);
                 if (shouldSync(localPath)) {
                     paths.push(relativePath);
                     continue;
@@ -3428,36 +4297,6 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             }
         }
     };
-    const groupBatchByRoute = (batch) => {
-        const grouped = new Map();
-        for (const [absolutePath, relativePath] of batch.paths.entries()) {
-            const change = batch.changes?.get(absolutePath);
-            const route = routeChangeToTarget(relativePath, change?.kind);
-            if (!route)
-                continue;
-            const category = isSessionLogsPushOnlyPath(relativePath) ? "session-log-backup" : "interactive";
-            const key = `${routeKey(route)}:${category}`;
-            const existing = grouped.get(key) ??
-                {
-                    route,
-                    paths: new Map(),
-                    changes: new Map(),
-                    relPaths: [],
-                    deleteScopeRoots: [],
-                };
-            existing.paths.set(absolutePath, relativePath);
-            if (change)
-                existing.changes.set(absolutePath, change);
-            existing.relPaths = [...new Set([...existing.paths.values()])];
-            existing.deleteScopeRoots = [
-                ...new Set([...existing.changes.values()].flatMap((item) => (item.deleteSnapshots ?? []).flatMap((snapshot) => snapshot.deleteScopeRoot === undefined
-                    ? []
-                    : [snapshot.deleteScopeRoot]))),
-            ];
-            grouped.set(key, existing);
-        }
-        return grouped;
-    };
     /** Resolve deferred delete snapshots immediately before their scoped drain. */
     const resolveDeleteSnapshotCaptures = async (batch) => {
         for (const [absolutePath, change] of batch.changes ?? []) {
@@ -3526,8 +4365,6 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
     // a file and still be refused as stale (a download changed the directory
     // mid-pass); the retry then finds the file already in the cloud and uploads
     // nothing, so without this the file is never announced to peers.
-    const uploadedAwaitingPublish = new Set();
-    const UPLOADED_AWAITING_PUBLISH_CAP = 1_000;
     const rememberUploadedPaths = (result) => {
         if (result === undefined || typeof result === "number")
             return;
@@ -3540,6 +4377,14 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 const oldest = uploadedAwaitingPublish.values().next().value;
                 if (oldest !== undefined)
                     uploadedAwaitingPublish.delete(oldest);
+                if (!uploadedAwaitingPublishDropLogged) {
+                    uploadedAwaitingPublishDropLogged = true;
+                    process.stderr.write(`${JSON.stringify({
+                        type: "event-sync-upload-buffer-overflow",
+                        cap: UPLOADED_AWAITING_PUBLISH_CAP,
+                        action: "drop-oldest",
+                    })}\n`);
+                }
             }
         }
     };
@@ -3556,8 +4401,37 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
     };
     let emitScopedPushFailureTelemetry = null;
     const runScopedDrain = async (batch, watcherBatchGeneration, _wakeOnPushFailure = false, allowFastRealtimeOvertake = false) => {
-        if (batch)
-            await resolveDeleteSnapshotCaptures(batch);
+        if (batch) {
+            // Read each routed quarantine shard once for this watcher batch. Filter
+            // before resolving delete snapshots or submitting work to the coordinator
+            // so a quarantined key cannot acquire a new upload/delete intent.
+            const pathsByJournal = new Map();
+            let unresolvedCount = 0;
+            for (const [absolutePath, relativePath] of [...batch.paths]) {
+                const kind = batch.changes?.get(absolutePath)?.kind;
+                const coordinates = journalCoordinates(relativePath, kind);
+                if (!coordinates)
+                    continue;
+                let quarantined = pathsByJournal.get(coordinates.slug);
+                if (!quarantined) {
+                    quarantined = readQuarantinedJournalPaths(coordinates.slug);
+                    pathsByJournal.set(coordinates.slug, quarantined);
+                }
+                if (!quarantined.has(coordinates.key))
+                    continue;
+                batch.paths.delete(absolutePath);
+                batch.changes?.delete(absolutePath);
+                unresolvedCount += 1;
+            }
+            if (unresolvedCount > 0) {
+                (deps.stderr ?? process.stderr).write(`${JSON.stringify({
+                    type: "journal-quarantine-unresolved",
+                    count: unresolvedCount,
+                })}\n`);
+            }
+            if (batch.paths.size > 0)
+                await resolveDeleteSnapshotCaptures(batch);
+        }
         const grouped = batch && batch.paths.size > 0 ? groupBatchByRoute(batch) : null;
         const skipCompanies = grouped ? resolveSkipCompanies() : null;
         const isPausedRoute = (route) => route.kind === "company" &&
@@ -3582,7 +4456,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             return routeFailure?.message ?? failures[0]?.message ??
                 `sync pass exited ${result.exitCode}`;
         };
-        const recordPushFailure = (route, exitCode, message) => {
+        const recordPushFailure = (route, exitCode, message, caughtError, caughtErrorClass) => {
             const routeId = routeKey(route);
             const companyRoot = route.kind === "company"
                 ? path.join(hqRoot, "companies", route.slug)
@@ -3599,11 +4473,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 nextRetryDelayMs: state.delayMs,
                 errorSummary: pushFailureTelemetryLabel(errorText),
             };
-            const diagnostic = {
-                type: "scoped-push-failure",
-                ...event,
-                error: errorText,
-            };
+            const diagnostic = buildScopedPushFailureDiagnostic(event, errorText, caughtError, caughtErrorClass);
             (deps.stderr ?? process.stderr).write(`${JSON.stringify(diagnostic)}\n`);
             if (deps.emitScopedPushFailureTelemetry) {
                 deps.emitScopedPushFailureTelemetry(event);
@@ -3654,19 +4524,86 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                         ? localUploadSizeClass(uploadPaths)
                         : "small";
                     const largeUpload = sizeClass !== "small";
-                    const chorePush = isChoreLocalPush(group.relPaths, largeUpload);
-                    const execution = parallelCoordinatorEnabled && !chorePush
-                        ? await runRealtimePass("watcher", "push", group.relPaths, lane, async (slice, telemetry, coordinatorFenced) => {
-                            const admittedPaths = slice.paths.map((path) => path.canonicalPath);
-                            const admittedChanges = changesForAdmittedPaths(group, admittedPaths);
-                            const scopedArgv = buildScopedPushArgv(group.route, admittedPaths, passArgv, group.deleteScopeRoots);
-                            return runGuarded(scopedArgv, admittedChanges.size > 0
-                                ? () => prepareWatcherChanges(admittedChanges)
-                                : undefined, lane, "realtime", allowFastRealtimeOvertake, slice.signal, false, telemetry, coordinatorFenced);
-                        }, sizeClass)
-                        : { result: await runGuarded(buildScopedPushArgv(group.route, group.relPaths, passArgv, group.deleteScopeRoots), group.changes.size > 0
-                                ? () => prepareWatcherChanges(group.changes)
-                                : undefined, lane, chorePush ? "chore" : "realtime", allowFastRealtimeOvertake), accepted: true, coordinatorRefusedPaths: [] };
+                    // With coordinator fencing enabled, even large watcher batches can
+                    // use bounded realtime admission. Keeping them as chores would make
+                    // them wait behind a long-lived receiver pull's slot indefinitely.
+                    const chorePush = isChoreLocalPush(group.relPaths, largeUpload && !parallelCoordinatorEnabled);
+                    const { groupId, setStage: watcherPushStage } = startWatcherPushStageTracking(routeId, group.relPaths.length);
+                    watcherPushStage("coordinator submit");
+                    inFlightWatcherPushes += group.relPaths.length;
+                    emitSyncWorkState(true);
+                    emitWatcherPushInflightStages();
+                    let execution;
+                    try {
+                        execution = await (parallelCoordinatorEnabled && !chorePush
+                            ? runRealtimePass("watcher", "push", group.relPaths, lane, async (slice, telemetry) => {
+                                watcherPushStage("worker entry");
+                                const candidatePaths = slice.paths.map((path) => path.canonicalPath);
+                                const changeByRelativePath = new Map([...group.paths.entries()].map(([absolutePath, relativePath]) => [
+                                    relativePath,
+                                    group.changes.get(absolutePath),
+                                ]));
+                                const refusedPaths = new Set();
+                                const admittedPaths = [];
+                                for (const relativePath of candidatePaths) {
+                                    const kind = changeByRelativePath.get(relativePath)?.kind;
+                                    const isUpsert = kind === undefined || kind === "add" || kind === "change";
+                                    if (isUpsert && await isUnchangedAppliedUpsert(relativePath)) {
+                                        refusedPaths.add(relativePath);
+                                    }
+                                    else {
+                                        // Admission means this is a local edit (or a delete); it
+                                        // supersedes any stale receiver echo marker.
+                                        appliedUpsertHashesForWatcher.delete(relativePath);
+                                        admittedPaths.push(relativePath);
+                                    }
+                                }
+                                if (refusedPaths.size > 0) {
+                                    const execution = coordinatorExecutions.get(slice.work);
+                                    if (execution)
+                                        execution.refusedPaths = refusedPaths;
+                                    process.stderr.write(`${JSON.stringify({
+                                        type: "watcher-applied-upsert-echo-suppressed",
+                                        count: refusedPaths.size,
+                                    })}\n`);
+                                }
+                                if (admittedPaths.length === 0) {
+                                    if (refusedPaths.size > 0 && eventSyncLive && eventSync) {
+                                        // The emitter's empty-batch outcome is the settlement
+                                        // signal for this completed echo check. No path is
+                                        // published, but receivers and diagnostics can still
+                                        // observe that the watcher drained the batch.
+                                        eventSync.publishBatch({ paths: new Map() });
+                                    }
+                                    return 0;
+                                }
+                                const admittedChanges = changesForAdmittedPaths(group, admittedPaths);
+                                const scopedArgv = buildScopedPushArgv(group.route, admittedPaths, passArgv, group.deleteScopeRoots);
+                                return runGuarded(scopedArgv, admittedChanges.size > 0
+                                    ? () => prepareWatcherChanges(admittedChanges)
+                                    : undefined, lane, "realtime", allowFastRealtimeOvertake, slice.signal, false, telemetry, 
+                                // Watcher-originated pushes may share the guarded
+                                // realtime slot with an in-flight pull. Coordinator
+                                // fencing already serializes overlapping path epochs;
+                                // this must not depend on the optional full-pass flag.
+                                true, undefined, routeId, watcherPushStage);
+                            }, sizeClass)
+                            : (() => {
+                                watcherPushStage("worker entry");
+                                return runGuarded(buildScopedPushArgv(group.route, group.relPaths, passArgv, group.deleteScopeRoots), group.changes.size > 0
+                                    ? () => prepareWatcherChanges(group.changes)
+                                    : undefined, lane, chorePush ? "chore" : "realtime", allowFastRealtimeOvertake, undefined, false, undefined, false, undefined, routeId, watcherPushStage).then((result) => ({
+                                    result,
+                                    accepted: true,
+                                    coordinatorRefusedPaths: [],
+                                }));
+                            })());
+                    }
+                    finally {
+                        watcherPushStages.delete(groupId);
+                        inFlightWatcherPushes = Math.max(0, inFlightWatcherPushes - group.relPaths.length);
+                        emitSyncWorkState(true);
+                    }
                     const result = execution.result;
                     rememberUploadedPaths(result);
                     const pushExit = passExitCode(result);
@@ -3677,6 +4614,11 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                         const refusedPaths = new Set(pushPathResults
                             .filter((pathResult) => pathResult.status === "refused")
                             .map((pathResult) => pathResult.relativePath));
+                        for (const pathResult of pushPathResults) {
+                            if (pathResult.status === "accepted" && pathResult.operation !== "delete") {
+                                appliedUpsertHashesForWatcher.delete(pathResult.relativePath);
+                            }
+                        }
                         const successfullyDeletedPaths = new Set(pushPathResults
                             .filter((pathResult) => pathResult.status === "accepted" && pathResult.operation === "delete")
                             .map((pathResult) => pathResult.relativePath));
@@ -3685,6 +4627,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                         }
                         const isRefusedPath = (relativePath) => [...refusedPaths].some((refusedPath) => relativePath === refusedPath ||
                             relativePath.startsWith(`${refusedPath}/`));
+                        acknowledgeDurableWatcherUploads(group.relPaths.filter((relativePath) => !isRefusedPath(relativePath)));
                         const publishPaths = new Map();
                         for (const [absolutePath, relativePath] of group.paths) {
                             if (isRefusedPath(relativePath))
@@ -3724,16 +4667,21 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                         deferPushAfterAdmissionTimeout(group, routeId);
                     }
                     else if (pushExit === UNRESOLVED_COMPANY_EXIT) {
+                        acknowledgeDurableWatcherUploads(group.relPaths);
                         routePushFailureBackoff.succeeded(routeId);
                         clearRoutePushRetry(routeId);
                         if (group.route.kind === "company") {
+                            deps.watcherCatchupSkipStore?.recordUnresolvedCompany(group.route.slug);
                             logDroppedUnresolvedWatcherRoute(group.route.slug);
                         }
                     }
                     else {
+                        // A failure before pass invocation (including journal preparation)
+                        // has no durable upload outcome. Keep every path pending so the
+                        // next scoped drain retries it after the failed coordinator slice.
                         restorePendingWatcherPaths(group.paths, watcherBatchGeneration, group.changes);
                         if (pushExit !== 0) {
-                            recordPushFailure(group.route, pushExit, pushFailureText(result, group.route));
+                            recordPushFailure(group.route, pushExit, pushFailureText(result, group.route), undefined, execution.errorClass);
                         }
                         else if (_wakeOnPushFailure) {
                             interruptWait();
@@ -3745,7 +4693,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                         deferPushAfterAdmissionTimeout(group, routeId);
                         continue;
                     }
-                    recordPushFailure(group.route, 1, pushFailureText(1, group.route, err));
+                    recordPushFailure(group.route, 1, pushFailureText(1, group.route, err), err);
                     restorePendingWatcherPaths(group.paths, watcherBatchGeneration, group.changes);
                 }
             }
@@ -3788,7 +4736,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 const execution = parallelCoordinatorEnabled
                     ? await runRealtimePass("watcher", "pull", group.relPaths, lane, (slice, telemetry, coordinatorFenced) => {
                         const slicePaths = slice.paths.map((path) => path.canonicalPath);
-                        return runGuarded(buildTargetedPullArgv(group.route, passArgv, slicePaths, exactFileUpserts.filter((relativePath) => slicePaths.includes(relativePath))), undefined, lane, "realtime", false, slice.signal, false, telemetry, coordinatorFenced);
+                        return runGuarded(buildTargetedPullArgv(group.route, passArgv, slicePaths, exactFileUpserts.filter((relativePath) => slicePaths.includes(relativePath))), undefined, lane, "realtime", false, slice.signal, false, telemetry, coordinatorFenced, undefined, routeKey(group.route));
                     })
                     : await runGuarded(pullArgv, undefined, lane, "realtime").then((result) => ({ result, accepted: true }), (error) => {
                         if (error instanceof RealtimeAdmissionTimeoutError) {
@@ -3840,6 +4788,15 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             addRoute(hint);
         const skipCompanies = resolveSkipCompanies();
         if (parallelCoordinatorEnabled) {
+            let routesRemaining = [...routes.values()].filter((route) => route.kind !== "company" || !skipCompanies.has(route.slug.toLowerCase())).length;
+            // An overflow whose known touched routes are all explicitly disabled
+            // has no chores to enqueue, so no completion callback can clear it.
+            // Clear only when there was at least one known selected route; an empty
+            // route set still means the overflow was not safely attributable here.
+            if (routes.size > 0 && routesRemaining === 0) {
+                clearDurableWatcherOverflow();
+                return 0;
+            }
             for (const route of routes.values()) {
                 if (route.kind === "company" &&
                     skipCompanies.has(route.slug.toLowerCase())) {
@@ -3868,6 +4825,11 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                         process.stderr.write(`hq-sync-runner: backlog chore for ${routeKey(route)} failed; will retry on cadence\n`);
                         interruptWait();
                     }
+                    else {
+                        routesRemaining -= 1;
+                        if (routesRemaining === 0)
+                            clearDurableWatcherOverflow();
+                    }
                 });
             }
             return 0;
@@ -3983,6 +4945,9 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 // churn overflowed the 200-path batch and skipped publishBatch.
                 personalMode: true,
                 includeCompanyPaths: companiesMode || companyMode,
+                // Inventory filtered candidates so the route's push filter remains
+                // authoritative and can attribute exclusions in warm-up diagnostics.
+                includeFilteredWarmupCandidates: true,
                 onDegraded: opts.onDegraded,
                 captureLocalDeleteSnapshots: opts.captureLocalDeleteSnapshots,
                 queueLocalDeleteSnapshots: opts.queueLocalDeleteSnapshots,
@@ -4104,6 +5069,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 }
             }
             watcher.start();
+            let catchupPathStatWarningReported = false;
             const reportWatcherReady = () => {
                 if (stopped || watcher === null)
                     return;
@@ -4144,14 +5110,202 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                             : watcher?.collectWarmupCatchup?.(serviceStartedAt - WATCHER_WARMUP_SAFETY_MARGIN_MS, journalPaths);
                         if (!catchup || catchup.cancelled || stopped || watcher === null)
                             return;
-                        const queued = addPendingWatcherChange(undefined, catchup.batch, {
+                        const skipStore = deps.watcherCatchupSkipStore;
+                        const cloudCompanySlugs = readCloudBackedSlugsFromManifest(hqRoot);
+                        const eligiblePaths = new Map();
+                        const eligibleChanges = new Map();
+                        const excludedByReason = {};
+                        const excludedByReasonByRoute = {};
+                        const personalFilterExclusions = new Map();
+                        const continuityPaths = new Set(computeContinuityPointerPaths(hqRoot).map((p) => path.relative(hqRoot, p).split(path.sep).join("/")));
+                        const hasAgencyCarveout = computeAgencySyncPaths(hqRoot).length > 0;
+                        const hasSessionLogsCarveout = computeSessionLogsSyncPaths(hqRoot).length > 0;
+                        const { ignoreFilter, personalPushFilter } = createWatcherWarmupPathFilters(hqRoot, (relativePath, exclusionId) => personalFilterExclusions.set(relativePath, exclusionId));
+                        const clearedResolvedCompanies = new Set();
+                        const ontologyBackupPaths = { attioCleanup: 0, readModelRollout: 0 };
+                        const candidateRouteCounts = new Map();
+                        const candidateRoutePrefixes = new Map();
+                        const eligibleRouteCounts = new Map();
+                        const eligibleRoutePrefixes = new Map();
+                        const backupClass = (relativePath) => {
+                            if (/\/ontology\/_attio-cleanup-backup\//.test(`/${relativePath}`))
+                                return "attioCleanup";
+                            if (/\/ontology\/_read-model-rollout-backup\//.test(`/${relativePath}`))
+                                return "readModelRollout";
+                            return undefined;
+                        };
+                        const exclude = (reason, routeName) => {
+                            excludedByReason[reason] = (excludedByReason[reason] ?? 0) + 1;
+                            const routeReasons = excludedByReasonByRoute[routeName] ??= {};
+                            routeReasons[reason] = (routeReasons[reason] ?? 0) + 1;
+                        };
+                        let filteredCandidateCount = 0;
+                        for (const [reason, count] of Object.entries(catchup.filteredWarmupCandidateCounts ?? {})) {
+                            filteredCandidateCount += count;
+                            excludedByReason[reason] = (excludedByReason[reason] ?? 0) + count;
+                            const routeReasons = excludedByReasonByRoute.filtered ??= {};
+                            routeReasons[reason] = (routeReasons[reason] ?? 0) + count;
+                        }
+                        if (filteredCandidateCount > 0)
+                            candidateRouteCounts.set("filtered", filteredCandidateCount);
+                        let examinedWarmupPaths = 0;
+                        for (const [absolutePath, relativePath] of catchup.batch.paths) {
+                            examinedWarmupPaths += 1;
+                            const warmupYield = yieldWatcherWarmupIfNeeded(examinedWarmupPaths);
+                            if (warmupYield)
+                                await warmupYield;
+                            if (catchup.safeRelativePaths !== true && !isSafeRelativePath(relativePath)) {
+                                recordWarmupRoutePath(candidateRouteCounts, candidateRoutePrefixes, "unrouted", relativePath);
+                                exclude("unsafe-path", "unrouted");
+                                continue;
+                            }
+                            const route = routeChangeToTarget(relativePath);
+                            const routeName = route ? routeKey(route) : "unrouted";
+                            const summaryRoutePath = route?.kind === "company"
+                                ? relativePath.slice(`companies/${route.slug}/`.length)
+                                : relativePath;
+                            recordWarmupRoutePath(candidateRouteCounts, candidateRoutePrefixes, routeName, summaryRoutePath);
+                            const ontologyBackupClass = backupClass(relativePath);
+                            if (ontologyBackupClass) {
+                                exclude("local-rule:ontology-backup", routeName);
+                                ontologyBackupPaths[ontologyBackupClass] += 1;
+                                continue;
+                            }
+                            if (route?.kind === "company") {
+                                const resolvedNow = cloudCompanySlugs.has(route.slug) ||
+                                    skipStore?.hasCurrentGrantCompany(route.slug) ||
+                                    skipStore?.hasCurrentGrantVersion(route.slug) ||
+                                    (companyMode && companySlug?.trim().toLowerCase() === route.slug.trim().toLowerCase());
+                                if (resolvedNow && !clearedResolvedCompanies.has(route.slug)) {
+                                    skipStore?.clearUnresolvedCompany(route.slug);
+                                    clearedResolvedCompanies.add(route.slug);
+                                }
+                                if (!resolvedNow && skipStore?.hasFreshUnresolvedCompany(route.slug)) {
+                                    exclude("unresolved-company", routeName);
+                                    continue;
+                                }
+                            }
+                            if (route?.kind === "company" &&
+                                !cloudCompanySlugs.has(route.slug) &&
+                                !skipStore?.hasCurrentGrantCompany(route.slug) &&
+                                !skipStore?.hasCurrentGrantVersion(route.slug) &&
+                                !(companyMode && companySlug?.trim().toLowerCase() === route.slug.trim().toLowerCase())) {
+                                exclude("local-only-company", routeName);
+                                continue;
+                            }
+                            const company = route?.kind === "company" ? route.slug : "personal";
+                            const routePath = route?.kind === "company"
+                                ? relativePath.slice(`companies/${route.slug}/`.length)
+                                : relativePath;
+                            if (isEphemeralPath(routePath)) {
+                                exclude("push-filter:conflict-mirror", routeName);
+                                continue;
+                            }
+                            // The production TreeWatcher collector has already applied this
+                            // shared filter stack and reports rejected files as reason counts.
+                            // Injected/custom collectors without that proof still evaluate the
+                            // route filter here, with personal defaults first for `.env` attribution.
+                            const personalDefaultExclusion = catchup.pushFiltersApplied === true
+                                ? undefined
+                                : route?.kind === "personal"
+                                    ? matchPersonalVaultExclusion(relativePath, false)
+                                    : undefined;
+                            const isPersonalRoute = route?.kind !== "company";
+                            const acceptedByPushFilter = catchup.pushFiltersApplied === true || (!personalDefaultExclusion && (isPersonalRoute
+                                ? personalPushFilter(absolutePath, false, relativePath)
+                                : ignoreFilter(absolutePath, false, relativePath)));
+                            if (!acceptedByPushFilter) {
+                                const exclusionId = personalDefaultExclusion?.id ?? (route?.kind === "personal"
+                                    ? personalFilterExclusions.get(relativePath)
+                                    : undefined);
+                                exclude(exclusionId
+                                    ? `push-filter:personal:${exclusionId}`
+                                    : "push-filter:ignore", routeName);
+                                continue;
+                            }
+                            if (isPersonalRoute &&
+                                !shouldSkipPersonalWarmupScopeCheck(catchup.pushFiltersApplied === true, route?.kind) &&
+                                isPersonalVaultScopeExcluded(relativePath, {
+                                    continuityPaths,
+                                    hasAgencyCarveout,
+                                    hasSessionLogsCarveout,
+                                })) {
+                                exclude("push-filter:personal:excluded-top-level", routeName);
+                                continue;
+                            }
+                            if (route && isLocallyIneligibleForPush(routePath, {
+                                boardClientOwned: true,
+                                ontologyEntityPush: route.kind === "company" && skipStore?.allowsOntologyEntityPush(company),
+                            })) {
+                                const pathClass = cloudAuthoritativePathClass(routePath) ?? "other";
+                                exclude(`local-rule:${pathClass}`, routeName);
+                                continue;
+                            }
+                            const knownSymlink = catchup.symlinkPaths?.has(absolutePath) ?? false;
+                            const hasSkipRecord = skipStore?.hasRecord(company, routePath) ?? false;
+                            try {
+                                const stat = !catchup.symlinkPaths || hasSkipRecord
+                                    ? fs.lstatSync(absolutePath)
+                                    : undefined;
+                                if (route && (knownSymlink || stat?.isSymbolicLink())) {
+                                    const scopeRoot = route.kind === "company"
+                                        ? path.join(hqRoot, "companies", route.slug)
+                                        : relativePath.startsWith("personal/")
+                                            ? path.join(hqRoot, "personal")
+                                            : hqRoot;
+                                    const inspection = inspectLocalSymlinkScope({
+                                        absoluteLinkPath: absolutePath,
+                                        linkPath: relativePath,
+                                        scopeRoot,
+                                        scope: route.kind === "company"
+                                            ? { kind: "company", companySlug: route.slug }
+                                            : { kind: "personal" },
+                                    });
+                                    if (inspection.refused) {
+                                        exclude("symlink", routeName);
+                                        continue;
+                                    }
+                                }
+                                if (hasSkipRecord && stat &&
+                                    skipStore?.matches(company, routePath, stat)) {
+                                    exclude("record-match", routeName);
+                                    continue;
+                                }
+                            }
+                            catch (error) {
+                                // Fail open: unreadable state or a filesystem race must not suppress a candidate.
+                                if (!catchupPathStatWarningReported) {
+                                    catchupPathStatWarningReported = true;
+                                    process.stderr.write(`hq-sync-runner: warm-up skip stat failed open: ${describeError(error)}\n`);
+                                }
+                            }
+                            eligiblePaths.set(absolutePath, relativePath);
+                            recordWarmupRoutePath(eligibleRouteCounts, eligibleRoutePrefixes, routeName, summaryRoutePath);
+                            const change = catchup.batch.changes?.get(absolutePath);
+                            if (change)
+                                eligibleChanges.set(absolutePath, change);
+                        }
+                        const queued = addPendingWatcherChange(undefined, {
+                            paths: eligiblePaths,
+                            changes: eligibleChanges,
+                        }, {
                             preserveChangesAfter: liveChangeSequenceAtWarmupStart,
                         });
                         pendingWatcherWarmupCatchup ||= queued;
+                        const capEvicted = skipStore?.takeCapEvictedCount() ?? 0;
                         process.stderr.write(JSON.stringify({
                             type: "watcher-warmup-catchup",
                             reason: "watch-set-ready",
-                            pathsFound: catchup.batch.paths.size,
+                            pathsFound: eligiblePaths.size,
+                            candidatePathsByRoute: rankedWarmupCounts(candidateRouteCounts),
+                            pathsByRoute: rankedWarmupCounts(eligibleRouteCounts),
+                            pathPrefixesByRoute: rankedWarmupPrefixes(candidateRouteCounts, candidateRoutePrefixes, eligibleRouteCounts, eligibleRoutePrefixes),
+                            excludedByReason: {
+                                ...excludedByReason,
+                                ...(capEvicted > 0 ? { "cap-evicted": capEvicted } : {}),
+                            },
+                            excludedByReasonByRoute,
+                            ontologyBackupPaths,
                             scannedPaths: catchup.scannedPaths,
                             elapsedMs: Date.now() - startedAt,
                             queued,
@@ -4218,13 +5372,16 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 const execution = await runRealtimePass("receiver", "pull", events.map((event) => event.relativePath), lane, (slice, telemetry, coordinatorFenced) => {
                     const slicePaths = slice.paths.map((path) => path.canonicalPath);
                     const exactFileUpserts = exactUpsertPathsForCoordinatorSlice(events, slicePaths);
-                    return withScopeContentHashesFile(route, events, slicePaths, (contentHashesFile) => runGuarded(buildTargetedPullArgv(route, passArgv, slicePaths, exactFileUpserts, contentHashesFile), undefined, lane, "realtime", lane === "fast", slice.signal, false, telemetry, coordinatorFenced, receiverSignal));
+                    return withScopeContentHashesFile(route, events, slicePaths, (contentHashesFile) => runGuarded(buildTargetedPullArgv(route, passArgv, slicePaths, exactFileUpserts, contentHashesFile), undefined, lane, "realtime", lane === "fast", slice.signal, false, telemetry, coordinatorFenced, receiverSignal, routeKey(route)));
                 });
                 const pathCount = events.length;
                 // Rethrow the typed refusal so the receiver keeps the lease and
                 // retries the whole batch, instead of bisecting a "failed" pull.
                 if (execution.admissionTimeout)
                     throw execution.admissionTimeout;
+                if (execution.yieldedToPush) {
+                    throw new RealtimePushYieldError();
+                }
                 const exitCode = passExitCode(execution.result);
                 if (shouldAcknowledgeParallelUnresolvedCompany(execution.accepted, exitCode)) {
                     if (!unresolvedReceiverMessagesWereRedelivered(events, receiveCountsByPath)) {
@@ -4246,74 +5403,82 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         const receiverSyncBatchFn = async ({ events, signal, approximateReceiveCountsByPath, settleEvents, }) => {
             if (stopped)
                 return;
-            // The injectable receiver seam and the production SQS receiver both
-            // arrive here only after a successful receive. Keep the cadence tight
-            // until the receiver later reports an empty outer long-poll.
-            onReceiveActivity(true);
-            // A received wake/high-water signal means there is bounded work now.
-            // It wakes the scheduler but is still funneled through runGuarded below,
-            // so it cannot overlap the pass that may currently own the operation
-            // lock.
-            // Apply the caps once across the whole delivery, then retain the residue
-            // in the normal lane. The receiver already coalesces to one latest event
-            // per path, so the partition cannot split revisions of one path.
-            if (parallelCoordinatorEnabled) {
-                const lane = receiverLaneByBatch.get(events);
-                if (lane) {
-                    receiverLaneByBatch.delete(events);
-                    await drainParallelReceiverLane(lane, events, approximateReceiveCountsByPath, settleEvents, signal);
+            try {
+                // The injectable receiver seam and the production SQS receiver both
+                // arrive here only after a successful receive. Keep the cadence tight
+                // until the receiver later reports an empty outer long-poll.
+                onReceiveActivity(true);
+                pendingReceivers += events.length;
+                emitSyncWorkState();
+                // A received wake/high-water signal means there is bounded work now.
+                // It wakes the scheduler but is still funneled through runGuarded below,
+                // so it cannot overlap the pass that may currently own the operation
+                // lock.
+                // Apply the caps once across the whole delivery, then retain the residue
+                // in the normal lane. The receiver already coalesces to one latest event
+                // per path, so the partition cannot split revisions of one path.
+                if (parallelCoordinatorEnabled) {
+                    const lane = receiverLaneByBatch.get(events);
+                    if (lane) {
+                        receiverLaneByBatch.delete(events);
+                        await drainParallelReceiverLane(lane, events, approximateReceiveCountsByPath, settleEvents, signal);
+                        return;
+                    }
+                    // Direct embedders may invoke the engine without first going through
+                    // SqsPushReceiver. Preserve that seam while applying the same
+                    // delivery-wide partition the receiver would expose.
+                    const lanes = partitionByKnownSizes(events, receiverEventSize);
+                    await drainParallelReceiverLane("fast", lanes.fast, approximateReceiveCountsByPath, settleEvents, signal);
+                    await drainParallelReceiverLane("slow", lanes.slow, approximateReceiveCountsByPath, settleEvents, signal);
                     return;
                 }
-                // Direct embedders may invoke the engine without first going through
-                // SqsPushReceiver. Preserve that seam while applying the same
-                // delivery-wide partition the receiver would expose.
                 const lanes = partitionByKnownSizes(events, receiverEventSize);
-                await drainParallelReceiverLane("fast", lanes.fast, approximateReceiveCountsByPath, settleEvents, signal);
-                await drainParallelReceiverLane("slow", lanes.slow, approximateReceiveCountsByPath, settleEvents, signal);
-                return;
-            }
-            const lanes = partitionByKnownSizes(events, receiverEventSize);
-            const drainLane = async (lane, laneEvents, receiveCountsByPath, receiverSignal) => {
-                const eventsByRoute = new Map();
-                for (const event of laneEvents) {
-                    const route = routeChangeToTarget(event.relativePath);
-                    // The receiver is an independent ingress from the local watcher.
-                    // Apply the same route-selection boundary before it can enqueue a
-                    // fast pull: a --skip-personal runner must acknowledge, not pull,
-                    // a personal-namespace delivery.
-                    if (!route || !isWatchRouteSelected(route, watchRouteSelection))
-                        continue;
-                    const key = routeKey(route);
-                    const group = eventsByRoute.get(key) ?? { route, events: [], upsertPaths: [] };
-                    group.events.push(event);
-                    if (event.kind === "upsert")
-                        group.upsertPaths.push(event.relativePath);
-                    eventsByRoute.set(key, group);
-                }
-                for (const { route, events: routeEvents, upsertPaths } of eventsByRoute.values()) {
-                    const paths = routeEvents.map((event) => event.relativePath);
-                    const result = await withScopeContentHashesFile(route, routeEvents, paths, (contentHashesFile) => runGuarded(buildTargetedPullArgv(route, passArgv, paths, upsertPaths, contentHashesFile), undefined, lane, "realtime", false, receiverSignal));
-                    const exitCode = passExitCode(result);
-                    if (exitCode === UNRESOLVED_COMPANY_EXIT) {
-                        if (!unresolvedReceiverMessagesWereRedelivered(routeEvents, receiveCountsByPath)) {
+                const drainLane = async (lane, laneEvents, receiveCountsByPath, receiverSignal) => {
+                    const eventsByRoute = new Map();
+                    for (const event of laneEvents) {
+                        const route = routeChangeToTarget(event.relativePath);
+                        // The receiver is an independent ingress from the local watcher.
+                        // Apply the same route-selection boundary before it can enqueue a
+                        // fast pull: a --skip-personal runner must acknowledge, not pull,
+                        // a personal-namespace delivery.
+                        if (!route || !isWatchRouteSelected(route, watchRouteSelection))
+                            continue;
+                        const key = routeKey(route);
+                        const group = eventsByRoute.get(key) ?? { route, events: [], upsertPaths: [] };
+                        group.events.push(event);
+                        if (event.kind === "upsert")
+                            group.upsertPaths.push(event.relativePath);
+                        eventsByRoute.set(key, group);
+                    }
+                    for (const { route, events: routeEvents, upsertPaths } of eventsByRoute.values()) {
+                        const paths = routeEvents.map((event) => event.relativePath);
+                        const result = await withScopeContentHashesFile(route, routeEvents, paths, (contentHashesFile) => runGuarded(buildTargetedPullArgv(route, passArgv, paths, upsertPaths, contentHashesFile), undefined, lane, "realtime", false, receiverSignal));
+                        const exitCode = passExitCode(result);
+                        if (exitCode === UNRESOLVED_COMPANY_EXIT) {
+                            if (!unresolvedReceiverMessagesWereRedelivered(routeEvents, receiveCountsByPath)) {
+                                throw targetedReceiverDispatchError(result, true, runtime.authRequiredPassExit);
+                            }
+                            warnUnresolvedReceiverCompany(route, routeEvents.length);
+                            await settleEvents?.(routeEvents);
+                            continue;
+                        }
+                        if (exitCode !== 0) {
                             throw targetedReceiverDispatchError(result, true, runtime.authRequiredPassExit);
                         }
-                        warnUnresolvedReceiverCompany(route, routeEvents.length);
                         await settleEvents?.(routeEvents);
-                        continue;
                     }
-                    if (exitCode !== 0) {
-                        throw targetedReceiverDispatchError(result, true, runtime.authRequiredPassExit);
-                    }
-                    await settleEvents?.(routeEvents);
-                }
-            };
-            // Dispatch realtime work before awaiting its bulk residue. This lets an
-            // established slow pass continue while the small scoped pull uses its
-            // ref-counted lock carve-out; the residue remains serialized and cannot
-            // starve the slow lane.
-            await drainLane("fast", lanes.fast, approximateReceiveCountsByPath, signal);
-            await drainLane("slow", lanes.slow, approximateReceiveCountsByPath, signal);
+                };
+                // Dispatch realtime work before awaiting its bulk residue. This lets an
+                // established slow pass continue while the small scoped pull uses its
+                // ref-counted lock carve-out; the residue remains serialized and cannot
+                // starve the slow lane.
+                await drainLane("fast", lanes.fast, approximateReceiveCountsByPath, signal);
+                await drainLane("slow", lanes.slow, approximateReceiveCountsByPath, signal);
+            }
+            finally {
+                pendingReceivers = Math.max(0, pendingReceivers - events.length);
+                emitSyncWorkState();
+            }
         };
         receiverSyncBatchFn.partition = (events, maxPaths) => {
             const lanes = partitionByKnownSizes(events, receiverEventSize);
@@ -4470,6 +5635,14 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
         if (stopped)
             return shutdownPromise ?? Promise.resolve();
         stopped = true;
+        clearInterval(watcherPushStagesTimer);
+        if (durableWatcherPersistTimer !== undefined)
+            clearTimeout(durableWatcherPersistTimer);
+        durableWatcherPersistTimer = undefined;
+        if (syncWorkStateTimer !== undefined)
+            clearTimeout(syncWorkStateTimer);
+        syncWorkStateTimer = undefined;
+        emitSyncWorkState(true);
         for (const route of routePushRetryTimerHandles.keys()) {
             clearRoutePushRetry(route);
         }
@@ -4499,6 +5672,7 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
             coordinatorDisposal,
             boundedEventSyncStartup,
             eventSyncDisposal,
+            persistDurableWatcherPaths(),
         ]).then(() => undefined);
         try {
             void receiver?.dispose();
@@ -4916,6 +6090,14 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                                 lastCompletedFullReconcileWallAt = Date.now();
                                 fullPassJournalHealthy = execution.accepted &&
                                     isFullPassJournalHealthy(exit, typeof execution.result === "number" ? undefined : execution.result.result?.partial);
+                                if (fullPassJournalHealthy && pending.batch?.overflowed === true) {
+                                    clearDurableWatcherOverflow();
+                                }
+                                else if (fullPassJournalHealthy && pending.batch !== null) {
+                                    acknowledgeDurableWatcherPathsCoveredByFullPass([
+                                        ...pending.batch.paths.values(),
+                                    ]);
+                                }
                                 if (fullPassJournalHealthy) {
                                     fullPassContinuity.markFullPassCompleted(lastCompletedFullReconcileAt);
                                 }
@@ -4973,7 +6155,11 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                         const catchupBatch = workingBatch;
                         const catchupGeneration = pending.generation;
                         void runScopedDrain(catchupBatch, catchupGeneration, true).then((exit) => {
-                            if (exit === 0 || exit === SCOPED_DRAIN_DEFERRED)
+                            if (exit === 0) {
+                                clearDurableWatcherOverflow();
+                                return;
+                            }
+                            if (exit === SCOPED_DRAIN_DEFERRED)
                                 return;
                             restorePendingWatcherPaths(catchupBatch.paths, catchupGeneration);
                             interruptWait();
@@ -5081,6 +6267,19 @@ export async function runWatchLoop(argv, parsed, deps, runtime) {
                 ? exitCode === 0
                 : hasCompletedRunnerPass(result));
             if (completedPostRepairPass) {
+                if (!parallelCoordinatorEnabled &&
+                    pending.batch?.overflowed === true &&
+                    ((ranFullReconcile && fullPassJournalHealthy) || (!watcherWarmupCatchup && exitCode === 0))) {
+                    clearDurableWatcherOverflow();
+                }
+                else if (!parallelCoordinatorEnabled &&
+                    ranFullReconcile &&
+                    fullPassJournalHealthy &&
+                    pending.batch !== null) {
+                    acknowledgeDurableWatcherPathsCoveredByFullPass([
+                        ...pending.batch.paths.values(),
+                    ]);
+                }
                 // The production adapter returns RunnerPassResult only after fanout,
                 // which follows journal repair. Its numeric seam has the same
                 // contract: zero means the injected pass completed. This preserves