amalgm 0.1.261 → 0.1.263

package/runtime/scripts/amalgm-mcp/registration/service.js

@@ -52,6 +52,7 @@ const {
   migrateLegacyToolboxCatalog,
 } = require('../toolbox/artifacts');
 const { createObserver } = require('../observer');
+const { gitDirTruth } = require('../observer/scan');
 const { shouldEnroll } = require('../workspace/tree/inclusion');
 const { classifyFile } = require('./classify');
 const { createEntityCloud } = require('./entity-cloud');
@@ -86,6 +87,17 @@ function createRegistrationService({
 
   const evidenceDb = new Database(path.join(dir, 'observer.db'));
   const identityDb = new Database(path.join(dir, 'identity.db'));
+  // WAL, decided here because this root OWNS the handles: SQLite's default
+  // journal mode pays a create-fsync-delete journal cycle on every commit,
+  // which made a large registration ~65% commit ceremony. WAL appends to
+  // one log instead, and synchronous=NORMAL keeps every commit durable
+  // against process crash (an OS crash can lose the tail, never corrupt —
+  // detection re-derives evidence, and identity commits are re-walked by
+  // the registration that was still running).
+  for (const handle of [evidenceDb, identityDb]) {
+    handle.pragma('journal_mode = WAL');
+    handle.pragma('synchronous = NORMAL');
+  }
   const entityContent = createEntityContent({ dir });
   // createRegistration owns the schema migration. Give entity-cloud a stable
   // lookup facade now, then connect it to that one migrated state store once
@@ -95,13 +107,37 @@ function createRegistrationService({
   const repoTransportHeads = new Map(); // semantic stateId -> immutable content hash
   const importedRepoStates = new Map(); // cloud UUID -> verified bundle-free state
 
+  /** The identity map a settled repo state travels with: every enrolled
+   * record beneath the repo boundary (stopping at nested repo boundaries,
+   * which pack their own maps). Repo children never journal their own
+   * cloud mutations, so this map — inside the one transport parcel — is
+   * the only way their permanent UUIDs reach another machine. */
+  function worktreeIdentity(repoUuid) {
+    const registry = boundary.current?.registry;
+    if (!registry) return null;
+    const entries = [];
+    const visit = (parentUuid, base) => {
+      for (const child of registry.children(parentUuid)) {
+        if (child.status !== 'active') continue;
+        const childPath = base ? `${base}/${child.name}` : child.name;
+        entries.push({ path: childPath, uuid: child.uuid, type: child.type });
+        if (child.type === 'folder') visit(child.uuid, childPath);
+      }
+    };
+    visit(repoUuid, '');
+    return entries;
+  }
+
   /** Git transport is immutable content, not identity-database cargo.  The
    * semantic repo stateId remains the entity head; this prepares the exact
    * Card + Checkpoint + bundle payload and leaves only its content hash in
-   * SQLite so a large clone cannot bloat the device registry. */
-  function prepareRepo(captured) {
+   * SQLite so a large clone cannot bloat the device registry. Registration
+   * supplies the freshly assigned identity entries; a settled follower
+   * names its repo UUID instead and the map is read from the registry. */
+  function prepareRepo(captured, { identity = null, entityUuid = null } = {}) {
     if (captured?.busy) return captured;
-    const artifact = entityContent.captureBytes({ bytes: transportBytes(captured) });
+    const transportIdentity = identity ?? (entityUuid ? worktreeIdentity(entityUuid) : null);
+    const artifact = entityContent.captureBytes({ bytes: transportBytes(captured, transportIdentity) });
     repoTransportHeads.set(captured.stateId, artifact.contentHash);
     return localState(captured, artifact.contentHash);
   }
@@ -137,7 +173,7 @@ function createRegistrationService({
       db: identityDb,
       sentinelPath: path.join(dir, 'identity.epoch'),
       journal: entityCloud.journal,
-      captureRepo: (repoPath) => prepareRepo(capture(repoPath, { withBundle: true })),
+      captureRepo: (repoPath, options) => prepareRepo(capture(repoPath, { withBundle: true }), options),
       prepareRepo,
       repoStateAt: (uuid) => importedRepoStates.get(uuid) || null,
     }),
@@ -147,10 +183,12 @@ function createRegistrationService({
 
   let closed = false;
 
-  /** Count only the same eligible shape that registration will see.  This is
+  /** Count only the records that will actually TRAVEL to the cloud.  This is
    * not a second registration walker: it is a bounded routing decision that
    * lets a large tree use one atomic cloud graph replacement instead of
-   * thousands of individually compacted mutations. */
+   * thousands of individually compacted mutations. A repository counts as
+   * ONE — its children ride the transport parcel, never the cloud graph —
+   * so registering even a 40,000-file repo is a single ordinary mutation. */
   function estimatedRegistrationRecords(targetPath, limit = ATOMIC_REGISTRATION_THRESHOLD) {
     let total = 0;
     const visit = (candidate) => {
@@ -159,6 +197,7 @@ function createRegistrationService({
       let stat;
       try { stat = fs.lstatSync(candidate); } catch { return; }
       if (!stat.isDirectory() || stat.isSymbolicLink()) return;
+      if (gitDirTruth(candidate) === 'present') return;
       let entries;
       try { entries = fs.readdirSync(candidate, { withFileTypes: true }); } catch { return; }
       for (const entry of entries) {
@@ -471,15 +510,50 @@ function createRegistrationService({
       group.push(record);
       children.set(record.parentUUID, group);
     }
+    // Unpacking a transport decodes the whole bundle from base64; one unpack
+    // per repository, not one per caller.
+    const repoStatesByUuid = new Map();
     function repoState(record) {
+      const cached = repoStatesByUuid.get(record.uuid);
+      if (cached) return cached;
       if (!record.transportVersion) throw new Error(`cloud repository ${record.uuid} has no Repocard transport head`);
       const state = unpack(entityContent.bytes({ contentHash: record.transportVersion }));
       if (state.stateId !== record.payloadVersion) {
         throw new Error(`cloud repository ${record.uuid} transport does not name its declared state`);
       }
+      repoStatesByUuid.set(record.uuid, state);
       return state;
     }
 
+    /** The identity a repo's transport carries for one worktree address:
+     * the same permanent UUID the registering machine minted, synthesized
+     * into the record shape the structural walk verifies. Records under a
+     * repository no longer live in the cloud catalog — the map inside the
+     * one state parcel is their identity carrier. */
+    function repoChildIdentity(repoRecord, repoRelativePath) {
+      const state = repoState(repoRecord);
+      if (!Array.isArray(state.identity)) return null;
+      const byPath = state.identityByPath
+        || (state.identityByPath = new Map(state.identity.map((entry) => [entry.path, entry])));
+      const entry = byPath.get(repoRelativePath);
+      if (!entry) return null;
+      // A nested repository does not travel (the repo travel law), so the
+      // transport cannot promise this ground materializes as a repo here.
+      // The receiving walk decides what the ground actually is and mints
+      // fresh local identity for it.
+      if (entry.type === 'repo.git') return null;
+      const slash = repoRelativePath.lastIndexOf('/');
+      const parentEntry = slash === -1 ? null : byPath.get(repoRelativePath.slice(0, slash));
+      return {
+        uuid: entry.uuid,
+        type: entry.type,
+        parentUUID: parentEntry ? parentEntry.uuid : repoRecord.uuid,
+        name: repoRelativePath.slice(slash + 1),
+        status: 'active',
+        payloadVersion: null,
+      };
+    }
+
     for (const { contentHash } of entityCloud.contentHeads(active)) {
       if (!entityContent.complete({ contentHash })) return false;
     }
@@ -524,9 +598,21 @@ function createRegistrationService({
     function identityAt(relativePath) {
       if (!relativePath) return root;
       let cursor = root;
-      for (const name of relativePath.split('/')) {
-        cursor = (children.get(cursor.uuid) || []).find((record) => record.name === name) || null;
-        if (!cursor) return null;
+      const parts = relativePath.split('/');
+      for (let index = 0; index < parts.length; index += 1) {
+        const next = (children.get(cursor.uuid) || []).find((record) => record.name === parts[index]) || null;
+        if (next) {
+          cursor = next;
+          continue;
+        }
+        // Inside a repository boundary the catalog goes quiet: the rest of
+        // the address is answered by that repo's transport identity map.
+        // (A snapshot from before the repo travel law still carries child
+        // records; those keep answering above, exactly as they used to.)
+        if (cursor.type === 'repo.git') {
+          return repoChildIdentity(records.get(cursor.uuid) || cursor, parts.slice(index).join('/'));
+        }
+        return null;
       }
       return records.get(cursor.uuid) || null;
     }
@@ -610,12 +696,18 @@ function createRegistrationService({
       return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
     }
 
+    // One unpack per repository: the live projection consults the same
+    // state for its drift check, its registry preload, and its apply.
+    const repoStatesByUuid = new Map();
     function repoState(record) {
+      const cached = repoStatesByUuid.get(record.uuid);
+      if (cached) return cached;
       if (!record.transportVersion) throw new Error(`cloud repository ${record.uuid} has no Repocard transport head`);
       const state = unpack(entityContent.bytes({ contentHash: record.transportVersion }));
       if (state.stateId !== record.payloadVersion) {
         throw new Error(`cloud repository ${record.uuid} transport does not name its declared state`);
       }
+      repoStatesByUuid.set(record.uuid, state);
       return state;
     }
 
@@ -873,7 +965,13 @@ function createRegistrationService({
     /** `amalgm register <path>` — register, then begin Watch + Detect. */
     register: async (targetPath) => {
       entityCloud.assertRegistrationReady();
-      if (estimatedRegistrationRecords(targetPath) < ATOMIC_REGISTRATION_THRESHOLD) {
+      // No active cloud replica means no cloud is listening — the journal
+      // itself already no-ops there, so a large tree takes the same plain
+      // local registration a small one does instead of demanding an atomic
+      // replacement that has nowhere to land. Size never changes whether a
+      // signed-out registration is allowed.
+      const cloudActive = entityCloud.replica()?.state === 'active';
+      if (!cloudActive || estimatedRegistrationRecords(targetPath) < ATOMIC_REGISTRATION_THRESHOLD) {
         return boundary.current.add(targetPath);
       }
       const result = boundary.current.registry.withoutJournal(() => boundary.current.add(targetPath));
@@ -886,13 +984,20 @@ function createRegistrationService({
      * materialize. Small selections retain their ordinary per-entity intent. */
     registerMany: async (targetPaths) => {
       entityCloud.assertRegistrationReady();
-      const needsAtomicReplacement = targetPaths.some((targetPath) => (
-        estimatedRegistrationRecords(targetPath) >= ATOMIC_REGISTRATION_THRESHOLD
-      ));
+      const needsAtomicReplacement = entityCloud.replica()?.state === 'active'
+        && targetPaths.some((targetPath) => (
+          estimatedRegistrationRecords(targetPath) >= ATOMIC_REGISTRATION_THRESHOLD
+        ));
       if (!needsAtomicReplacement) return boundary.current.addMany(targetPaths);
-      const results = boundary.current.registry.withoutJournal(() => boundary.current.addMany(targetPaths));
-      entityCloud.replaceSnapshot(boundary.current.registry.syncRecords());
-      return results;
+      // The snapshot must describe whatever actually committed, even when a
+      // later path refuses (each path is durable alone): without journal
+      // rows, a committed-but-unsnapshotted registration would be local
+      // truth with zero cloud delivery intent — a ghost nothing repairs.
+      try {
+        return boundary.current.registry.withoutJournal(() => boundary.current.addMany(targetPaths));
+      } finally {
+        entityCloud.replaceSnapshot(boundary.current.registry.syncRecords());
+      }
     },
     /** `amalgm add <cloud-root-uuid> [parent-directory]` — cloud to local. */
     add: async ({ uuid, targetPath }) => {

package/runtime/scripts/amalgm-mcp/registration/tree.js

@@ -44,6 +44,57 @@ function isRepository(dirPath) {
   return gitDirTruth(dirPath) === 'present';
 }
 
+/**
+ * Assign every enrolled worktree entity its permanent UUID BEFORE the
+ * repo's transport is packed, so the transport's identity map and the
+ * records this walk then creates name the exact same UUIDs. Repo children
+ * never travel as individual cloud records (the repo travel law); this
+ * map, riding inside the one state parcel, is how a receiving machine
+ * binds the same child identities instead of minting competitors.
+ *
+ * The walk mirrors registerDirectory's classification exactly — same
+ * readdir order, same enrollment gate, same lstat shape — and stops at a
+ * nested repository boundary: that repo's own capture owns its own map.
+ */
+function collectWorktreeIdentity(repoPath, { shouldEnroll, identityFor }) {
+  const assignment = new Map(); // repo-relative path -> { uuid, type }
+  const walk = (dirPath, relativePath) => {
+    let entries;
+    try {
+      entries = fs.readdirSync(dirPath, { withFileTypes: true })
+        .sort((a, b) => a.name.localeCompare(b.name));
+    } catch (error) {
+      if (error.code === 'EACCES' || error.code === 'EPERM') return;
+      throw error;
+    }
+    for (const entry of entries) {
+      const entryPath = path.join(dirPath, entry.name);
+      const entryRelativePath = relativePath ? `${relativePath}/${entry.name}` : entry.name;
+      if (!shouldEnroll(entryPath)) continue;
+      let stat;
+      try {
+        stat = fs.lstatSync(entryPath);
+      } catch {
+        continue; // raced away between readdir and look; the create-walk decides
+      }
+      let type;
+      if (stat.isSymbolicLink()) type = 'link';
+      else if (stat.isDirectory()) type = isRepository(entryPath) ? 'repo.git' : 'folder';
+      else if (stat.isFile()) type = 'file.text';
+      else continue;
+      const uuid = identityFor?.(entryRelativePath) || crypto.randomUUID();
+      assignment.set(entryRelativePath, { uuid, type });
+      if (type === 'folder') walk(entryPath, entryRelativePath);
+    }
+  };
+  walk(repoPath, '');
+  return assignment;
+}
+
+function transportIdentity(assignment) {
+  return [...assignment].map(([entryPath, { uuid, type }]) => ({ path: entryPath, uuid, type }));
+}
+
 /**
  * Create the root record, its witness, and every entity below ordinary
  * directory ground. The caller supplies a root that is already known to the
@@ -90,47 +141,58 @@ function registerTree({ root, registry, memory, shouldEnroll, captureRepo, repoS
   /** An imported repository already has a verified Repocard artifact in the
    * local state table before it is bound to Watch. Reuse that exact state;
    * recapturing would waste a second Git bundle and could race the import.
-   * Ordinary local registration has no seeded UUID and captures fresh truth. */
-  function repoStateFor(identity, repoPath) {
+   * Ordinary local registration has no seeded UUID and captures fresh truth:
+   * the worktree's UUIDs are assigned FIRST so the packed transport's
+   * identity map and the created child records agree exactly. */
+  function repoStateFor(identity, repoPath, relativePath) {
     if (identity.uuid) {
       const imported = repoStateAt?.(identity.uuid);
-      if (imported?.stateId === identity.payloadVersion) return imported;
+      if (imported?.stateId === identity.payloadVersion) return { state: imported, assignment: null };
       const saved = repoStates.get(identity.uuid);
-      if (saved?.stateId === identity.payloadVersion) return saved;
+      if (saved?.stateId === identity.payloadVersion) return { state: saved, assignment: null };
     }
-    return captureInitialRepo(repoPath, captureRepo);
+    const assignment = collectWorktreeIdentity(repoPath, {
+      shouldEnroll,
+      identityFor: (repoRelativePath) => identityAt?.(
+        relativePath ? `${relativePath}/${repoRelativePath}` : repoRelativePath,
+      )?.uuid || null,
+    });
+    return {
+      state: captureInitialRepo(repoPath, captureRepo, transportIdentity(assignment)),
+      assignment,
+    };
   }
 
   return registry.transaction(() => {
     const rootIdentity = seeded('', {
       type: rootType(root.path, root.kind), parentUUID: null, name: path.basename(root.path), root: true,
     });
-    const initialState = root.kind === 'repo' ? repoStateFor(rootIdentity, root.path) : null;
+    const initial = root.kind === 'repo' ? repoStateFor(rootIdentity, root.path, '') : null;
     // A repo's immutable transport head is already held by the injected
     // cloud-cargo lookup before its entity journal runs. Allocate the UUID,
     // create the FK parent, then persist its bundle-free state in this same
     // transaction. A rollback removes both durable facts together.
-    const rootUuid = rootIdentity.uuid || (initialState ? crypto.randomUUID() : undefined);
+    const rootUuid = rootIdentity.uuid || (initial ? crypto.randomUUID() : undefined);
     const record = registry.enrollRoot({
       type: rootIdentity.type,
       name: path.basename(root.path),
-      payloadVersion: initialState?.stateId ?? rootIdentity.payloadVersion ?? null,
+      payloadVersion: initial?.state.stateId ?? rootIdentity.payloadVersion ?? null,
       uuid: rootUuid,
     });
     memory.bind(root.rootId, root.rootId, record.uuid);
-    if (initialState) repoStates.put(record.uuid, initialState);
+    if (initial) repoStates.put(record.uuid, initial.state);
 
     if (root.kind === 'files' || root.kind === 'repo') {
       registerDirectory(root.path, record.uuid, {
         registry, shouldEnroll, captureRepo, repoStates, identityAt, repoStateAt, repoStateFor, seeded, relativePath: '',
-      });
+      }, initial?.assignment ? { base: '', byPath: initial.assignment } : null);
     }
     return record;
   });
 }
 
-function captureInitialRepo(repoPath, captureRepo) {
-  const state = captureRepo(repoPath);
+function captureInitialRepo(repoPath, captureRepo, identityEntries = null) {
+  const state = captureRepo(repoPath, { identity: identityEntries });
   if (state?.busy) {
     throw new Error(`cannot register ${repoPath}: Git is unsettled (${state.busy})`);
   }
@@ -142,7 +204,7 @@ function captureInitialRepo(repoPath, captureRepo) {
 
 function registerDirectory(dirPath, parentUUID, {
   registry, shouldEnroll, captureRepo, repoStates, identityAt, repoStateAt, repoStateFor, seeded, relativePath,
-}) {
+}, assigned = null) {
   let entries;
   try {
     entries = fs.readdirSync(dirPath, { withFileTypes: true })
@@ -155,6 +217,20 @@ function registerDirectory(dirPath, parentUUID, {
     throw error;
   }
 
+  // The UUID a pre-capture assignment reserved for this exact ground. The
+  // transport's identity map was packed from these, so the created record
+  // must wear the same UUID — unless the ground changed shape between the
+  // assignment walk and this one, in which case the walk's truth wins and
+  // the map entry is honestly stale.
+  const assignedFor = (entryRelativePath, type) => {
+    if (!assigned) return undefined;
+    const repoRelativePath = assigned.base
+      ? entryRelativePath.slice(assigned.base.length + 1)
+      : entryRelativePath;
+    const seat = assigned.byPath.get(repoRelativePath);
+    return seat && seat.type === type ? seat.uuid : undefined;
+  };
+
   for (const entry of entries) {
     const entryPath = path.join(dirPath, entry.name);
     const entryRelativePath = relativePath ? `${relativePath}/${entry.name}` : entry.name;
@@ -173,7 +249,7 @@ function registerDirectory(dirPath, parentUUID, {
         // Preserve it through the structural bind; normal local registration
         // still leaves this null until Watch observes the filesystem.
         payloadVersion: identity.payloadVersion ?? null,
-        uuid: identity.uuid,
+        uuid: identity.uuid ?? assignedFor(entryRelativePath, 'link'),
       });
       continue;
     }
@@ -182,19 +258,27 @@ function registerDirectory(dirPath, parentUUID, {
       const identity = seeded(entryRelativePath, {
         type, parentUUID, name: entry.name, root: false,
       });
-      const state = type === 'repo.git' ? repoStateFor(identity, entryPath) : null;
-      const uuid = identity.uuid || (state ? crypto.randomUUID() : undefined);
+      const initial = type === 'repo.git' ? repoStateFor(identity, entryPath, entryRelativePath) : null;
+      const uuid = identity.uuid
+        ?? assignedFor(entryRelativePath, type)
+        ?? (initial ? crypto.randomUUID() : undefined);
       const record = registry.create({
         type: identity.type,
         parentUUID,
         name: entry.name,
-        payloadVersion: state?.stateId ?? identity.payloadVersion ?? null,
+        payloadVersion: initial?.state.stateId ?? identity.payloadVersion ?? null,
         uuid,
       });
-      if (state) repoStates.put(record.uuid, state);
+      if (initial) repoStates.put(record.uuid, initial.state);
+      // A repository starts its own assignment scope: its transport's map
+      // covers exactly its worktree, so its children draw from it — never
+      // from an enclosing repo's map.
+      const childAssigned = type === 'repo.git'
+        ? (initial?.assignment ? { base: entryRelativePath, byPath: initial.assignment } : null)
+        : assigned;
       registerDirectory(entryPath, record.uuid, {
         registry, shouldEnroll, captureRepo, repoStates, identityAt, repoStateAt, repoStateFor, seeded, relativePath: entryRelativePath,
-      });
+      }, childAssigned);
       continue;
     }
     if (stat.isFile()) {
@@ -206,7 +290,7 @@ function registerDirectory(dirPath, parentUUID, {
         parentUUID,
         name: entry.name,
         payloadVersion: identity.payloadVersion ?? null,
-        uuid: identity.uuid,
+        uuid: identity.uuid ?? assignedFor(entryRelativePath, 'file.text'),
       });
     }
   }

package/runtime/scripts/amalgm-mcp/registry/evidence.js

@@ -103,6 +103,8 @@
 const fs = require('fs');
 const path = require('path');
 
+const { preparer } = require('../lib/prepared');
+
 const FILE_TYPES = new Set(['file.text', 'file.binary']);
 const LEAF_TYPES = new Set(['file.text', 'file.binary', 'link']);
 // Adoption candidates by ground shape: a dir channel can be an arrived
@@ -132,6 +134,7 @@ const MEMORY_TABLES = ['registry_meta', 'channel_bindings', 'contested_ground'];
  * Retiring a tree drops its whole scope — bindings and markers together.
  */
 function createEvidenceMemory(db) {
+  const prepared = preparer(db);
   const present = db.prepare(
     `SELECT name FROM sqlite_master WHERE type = 'table' AND name IN (${MEMORY_TABLES.map(() => '?').join(', ')})`,
   ).all(...MEMORY_TABLES).map((row) => row.name);
@@ -145,30 +148,30 @@ function createEvidenceMemory(db) {
   }
   return {
     epoch: () => meta.epoch_uuid,
-    bindings: (scopeId) => db.prepare('SELECT channel_id, entity_uuid FROM channel_bindings WHERE scope_id = ?')
+    bindings: (scopeId) => prepared('SELECT channel_id, entity_uuid FROM channel_bindings WHERE scope_id = ?')
       .all(scopeId).map((row) => ({ channelId: row.channel_id, uuid: row.entity_uuid })),
-    bind: (scopeId, channelId, uuid) => db.prepare(
+    bind: (scopeId, channelId, uuid) => prepared(
       'INSERT INTO channel_bindings (channel_id, scope_id, entity_uuid) VALUES (?, ?, ?)'
       + ' ON CONFLICT(channel_id) DO UPDATE SET scope_id = excluded.scope_id, entity_uuid = excluded.entity_uuid',
     ).run(channelId, scopeId, uuid),
-    unbind: (channelId) => db.prepare('DELETE FROM channel_bindings WHERE channel_id = ?').run(channelId),
+    unbind: (channelId) => prepared('DELETE FROM channel_bindings WHERE channel_id = ?').run(channelId),
     /** Across scopes — channel ids are globally unique. */
-    boundTo: (channelId) => db.prepare('SELECT entity_uuid FROM channel_bindings WHERE channel_id = ?')
+    boundTo: (channelId) => prepared('SELECT entity_uuid FROM channel_bindings WHERE channel_id = ?')
       .get(channelId)?.entity_uuid,
-    allBindings: () => db.prepare('SELECT channel_id, scope_id, entity_uuid FROM channel_bindings').all()
+    allBindings: () => prepared('SELECT channel_id, scope_id, entity_uuid FROM channel_bindings').all()
       .map((row) => ({ channelId: row.channel_id, scopeId: row.scope_id, uuid: row.entity_uuid })),
     /** A retired tree's whole evidence namespace, gone as one act. */
     dropScope: (scopeId) => {
-      db.prepare('DELETE FROM channel_bindings WHERE scope_id = ?').run(scopeId);
-      db.prepare('DELETE FROM contested_ground WHERE scope_id = ?').run(scopeId);
+      prepared('DELETE FROM channel_bindings WHERE scope_id = ?').run(scopeId);
+      prepared('DELETE FROM contested_ground WHERE scope_id = ?').run(scopeId);
     },
-    contests: (scopeId) => db.prepare('SELECT rel_path, claimant_uuid, kind FROM contested_ground WHERE scope_id = ?')
+    contests: (scopeId) => prepared('SELECT rel_path, claimant_uuid, kind FROM contested_ground WHERE scope_id = ?')
       .all(scopeId).map((row) => ({ relPath: row.rel_path, uuid: row.claimant_uuid, kind: row.kind })),
-    contest: (scopeId, relPath, uuid, kind) => db.prepare(
+    contest: (scopeId, relPath, uuid, kind) => prepared(
       'INSERT INTO contested_ground (scope_id, rel_path, claimant_uuid, kind) VALUES (?, ?, ?, ?)'
       + ' ON CONFLICT(scope_id, rel_path) DO UPDATE SET claimant_uuid = excluded.claimant_uuid, kind = excluded.kind',
     ).run(scopeId, relPath, uuid, kind),
-    clearContest: (scopeId, relPath) => db.prepare('DELETE FROM contested_ground WHERE scope_id = ? AND rel_path = ?')
+    clearContest: (scopeId, relPath) => prepared('DELETE FROM contested_ground WHERE scope_id = ? AND rel_path = ?')
       .run(scopeId, relPath),
   };
 }
@@ -359,6 +362,27 @@ function createEvidence(options) {
   function reconcile() {
     dirty = false; // an event landing mid-reconcile re-dirties honestly
     try {
+      // One reconciliation is ONE durable truth transition: a first census
+      // over thousands of channels lands as one commit, not one per record.
+      // The registry's own transaction defers every bell to the commit and
+      // discards them all on rollback, so a failed pass publishes nothing.
+      registry.transaction(pass);
+    } catch (error) {
+      // The transaction rolled every durable write back; the in-memory
+      // caches may still hold entries from the rolled-back half. Durable
+      // truth first, cache second — so the caches reload from the tables
+      // before the retry, never believing a write that no longer exists.
+      channelToUuid.clear();
+      for (const row of memory.bindings(rootId)) channelToUuid.set(row.channelId, row.uuid);
+      contested.clear();
+      for (const row of memory.contests(rootId)) contested.set(row.relPath, { uuid: row.uuid, kind: row.kind });
+      dirty = true;
+      throw error;
+    }
+  }
+
+  function pass() {
+    {
       const rootRow = observer.listRoots().find((row) => row.rootId === rootId);
       if (!rootRow) return; // not enrolled yet — nothing is claimed
       groundPath = rootRow.path; // the address is derived, never the lens's identity
@@ -771,9 +795,6 @@ function createEvidence(options) {
             : null);
       }
       for (const [relPath, hash] of nowDivergent) divergent.set(relPath, hash);
-    } catch (error) {
-      dirty = true;
-      throw error;
     }
   }